@skyhook-io/radar-app 1.13.4 → 1.13.5

package/src/components/diagnose/investigationEvidence.test.ts

@@ -6,6 +6,7 @@ import {
   investigationEvidenceSourceDomId,
   investigationEvidenceSourceId,
   investigationEvidenceSubjectRef,
+  metricsScope,
   projectInvestigationEvidence,
   resolveInvestigationRootCauseEvidence,
   type InvestigationEvidenceGroup,
@@ -560,7 +561,7 @@ describe("root-cause evidence resolution", () => {
     const projection = project([
       tool(
         "metrics-1",
-        "query_prometheus",
+        "discover_metrics",
         { result: [1] },
         { evidenceRef: ref },
       ),
@@ -858,10 +859,10 @@ describe("semantic diagnose evidence projection", () => {
     expect(limitationText).toContain("selected 2 of 5");
     expect(limitationText).toContain("includes 2 of 8 selected log lines");
     expect(limitationText).toContain("not the container's full log history");
-    expect(limitationText).toContain("Additional crash-cause");
+    expect(limitationText).toContain("part of the crash-cause candidates");
     expect(limitationText).toContain("received 1 of 3 event groups");
     expect(limitationText).toContain("rbac denied");
-    expect(limitationText).toContain("Referenced-by relationships");
+    expect(limitationText).toContain("referenced-by relationships");
     expect(limitationText).toContain("recent-change result limit");
     expect(result.coverage).toEqual({
       attempted: 1,
@@ -2595,7 +2596,7 @@ describe("strict evidence adapters", () => {
 
   it("keeps unknown tools in Activity and limits invalid known contracts", () => {
     const result = project([
-      tool("other", "query_prometheus", { data: "ignored" }),
+      tool("other", "discover_metrics", { data: "ignored" }),
       tool("bad-events", "get_events", { events: [{ nope: true }] }),
     ]);
     expect(result.sources.map((source) => source.stepId)).toEqual([
@@ -2848,10 +2849,10 @@ describe("honest zero and partial-result states", () => {
           group.latest.data.checked === "events",
       )?.latest,
     ).toMatchObject({
-      title: "No matching warning events",
-      data: {
-        message: "The warning-event query completed and returned no groups.",
-      },
+      // The title and the scope beside it are the whole answer here; a body
+      // would only restate them.
+      title: "No warning events",
+      data: { message: undefined },
     });
   });
 
@@ -3427,7 +3428,9 @@ describe("workload logs adapter", () => {
     expect(malformed.limitations[0].message).toContain(
       "couldn't summarize this investigation step",
     );
-    expect(malformed.limitations[2].message).toContain("3 resolved pods");
+    expect(malformed.limitations[2].message).toContain(
+      "Radar found 3 pods but got no logs from them",
+    );
   });
 });
 
@@ -3742,7 +3745,7 @@ describe("prometheus rules adapter", () => {
     expect(firing[0].latest).toMatchObject({
       tier: "checked",
       relevance: "target",
-      title: "No firing alert rules name this Deployment",
+      title: "No firing alerts matched this Deployment",
       summary: "Deployment shop/api",
       data: {
         type: "receipt",
@@ -4009,9 +4012,7 @@ describe("prometheus rules adapter", () => {
       ]),
     ).toHaveLength(0);
     expect(run([])).toHaveLength(1);
-    expect(run([])[0].latest.title).toBe(
-      "No firing alert rules name this Node",
-    );
+    expect(run([])[0].latest.title).toBe("No firing alerts matched this Node");
   });
 
   it("keeps recording rules off the card list and flags truncation and evaluation health", () => {
@@ -4407,7 +4408,11 @@ describe("subject permissions adapter", () => {
         "perm",
         "get_subject_permissions",
         {
-          subject: { kind: "ServiceAccount", namespace: "shop", name: "api-sa" },
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
           accessCheck: {
             verb: "get",
             resource: "secrets",
@@ -4424,7 +4429,9 @@ describe("subject permissions adapter", () => {
     const [group] = groupsOf(projection.groups, "permissions");
     expect(group.latest.title).toContain("Could not check whether");
     expect(group.latest.title).not.toContain("cannot get");
-    expect(group.latest.summary).toContain("webhook authorizer returned partial data");
+    expect(group.latest.summary).toContain(
+      "webhook authorizer returned partial data",
+    );
     expect(group.latest.summary).not.toContain("No RBAC rule allows it");
     // The gap still reaches the coverage strip as well.
     expect(projection.limitations).toContainEqual(
@@ -4444,7 +4451,11 @@ describe("subject permissions adapter", () => {
         "perm",
         "get_subject_permissions",
         {
-          subject: { kind: "ServiceAccount", namespace: "shop", name: "api-sa" },
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
           accessCheck: {
             verb: "get",
             resource: "secrets",
@@ -4987,169 +4998,1573 @@ describe("card leads and deep-link subjects", () => {
   });
 });
 
-describe("live-run follow-ups", () => {
-  it("reads the producer's nil-slice null as an empty events or changes result", () => {
+describe("query_prometheus evidence", () => {
+  const rangeSeries = [
+    {
+      labels: { pod: "api-7f6-abc" },
+      dataPoints: [
+        { timestamp: 1_788_679_043, value: 169_377_792 },
+        { timestamp: 1_788_679_068, value: 171_401_216 },
+      ],
+    },
+  ];
+  // The pods a diagnose bundle established as the target's own, so an agent
+  // query naming exactly them is target evidence. A prefix over the same
+  // namespace is not: "api-.*" also selects api-worker's pods.
+  const establishedPods = ["api-7f6-abc", "api-7f6-def"];
+  const podSetPattern = `^(${establishedPods.join("|")})$`;
+  const targetSelectors = [
+    {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: podSetPattern },
+      ],
+    },
+  ];
+  const prefixSelectors = [
+    {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: "api-.*" },
+      ],
+    },
+  ];
+  // A diagnose of the target that lists its pods, so a later query can be
+  // proved to be about them.
+  function podsBundle() {
+    return tool(
+      "diag-pods",
+      "diagnose",
+      { resource: deployment, pods: 2, podNames: establishedPods },
+      {
+        summary: JSON.stringify({
+          kind: "Deployment",
+          namespace: "shop",
+          name: "api",
+        }),
+      },
+    );
+  }
+  function promResult(patch: Record<string, unknown> = {}) {
+    return {
+      query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"${podSetPattern}"})`,
+      type: "range",
+      start: "2026-09-06T07:17:23Z",
+      end: "2026-09-06T09:17:23Z",
+      step: "25s",
+      resultType: "matrix",
+      seriesCount: 1,
+      series: rangeSeries,
+      selectors: targetSelectors,
+      ...patch,
+    };
+  }
+
+  it("keeps an unrecognised metric's own name as the title", () => {
     const projection = project([
       tool(
-        "events-none",
-        "get_events",
-        { events: null },
-        {
-          summary: JSON.stringify({
-            kind: "Pod",
-            namespace: "shop",
-            name: "api",
-          }),
-        },
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: 'sum(acme_widget_queue_depth{namespace="shop"})',
+          selectors: [
+            {
+              metric: "acme_widget_queue_depth",
+              matchers: [{ label: "namespace", op: "=", value: "shop" }],
+            },
+          ],
+        }),
       ),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("acme_widget_queue_depth");
+    // No family label means the summary keeps its generic lead-in rather than
+    // repeating the name already in the title.
+    expect(group.latest.summary).toContain("Prometheus · 1 series");
+  });
+
+  it("keeps the generic title when the selectors name no metric", () => {
+    const projection = project([
       tool(
-        "changes-none",
-        "get_changes",
-        { changes: null },
-        {
-          summary: JSON.stringify({
-            kind: "Deployment",
-            namespace: "shop",
-            name: "api",
-            since: "24h",
-          }),
-        },
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: 'sum({namespace="shop"})',
+          selectors: [
+            {
+              metric: "",
+              matchers: [{ label: "namespace", op: "=", value: "shop" }],
+            },
+          ],
+        }),
       ),
     ]);
-    // A complete, successful events query that returned nothing is a checked
-    // receipt for its scope; the producer marks a denied namespace separately.
-    expect(
-      projection.groups.map((group) => [
-        group.latest.data.type,
-        group.latest.title,
-      ]),
-    ).toEqual([["receipt", "No events matched"]]);
-    expect(
-      projection.limitations.map((limitation) => [
-        limitation.source,
-        limitation.kind,
-      ]),
-    ).toEqual([["Recent changes", "unknown"]]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("Prometheus metrics");
+    expect(group.latest.summary).toBe("1 series · 2h window · 25s step");
   });
 
-  it("merges identical startup blockers across pods into one card with the pod list", () => {
-    const blocker = (
-      name: string,
-      message = "1 node(s) no free host ports",
-    ) => ({
-      kind: "Pod",
-      name,
-      reason: "Unschedulable",
-      severity: "critical",
-      message,
-    });
+  it("charts a range query scoped to the target as target evidence", () => {
     const projection = project([
-      tool("diagnose", "diagnose", {
-        resource: {
-          apiVersion: "apps/v1",
-          kind: "DaemonSet",
-          metadata: { namespace: "opencost", name: "node-exporter" },
-        },
-        resourceContext: { tier: "basic" },
-        pods: 3,
-        startupBlockers: [
-          blocker("node-exporter-a"),
-          blocker("node-exporter-b"),
-          blocker("node-exporter-c", "0/10 nodes: insufficient memory"),
-        ],
+      podsBundle(),
+      tool("prom", "query_prometheus", promResult(), {
+        summary: JSON.stringify({ query: "sum(...)", type: "range" }),
       }),
     ]);
-    const startup = projection.groups.filter(
-      (group) => group.latest.data.type === "startup",
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group).toBeDefined();
+    expect(group.latest.relevance).toBe("target");
+    expect(group.latest.tier).toBe("supporting");
+    expect(group.latest.tone).toBe("neutral");
+    expect(group.latest.title).toBe("Memory working set · Deployment shop/api");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · 1 series · 2h window · 25s step",
     );
-    expect(
-      startup.map((group) => [
-        group.latest.summary,
-        group.latest.data.type === "startup" ? group.latest.data.pods : null,
-      ]),
-    ).toEqual([
-      [
-        "2 pods · 1 node(s) no free host ports",
-        ["node-exporter-a", "node-exporter-b"],
-      ],
-      ["0/10 nodes: insufficient memory", undefined],
+    const data = group.latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.mode).toBe("range");
+    expect(data.origin).toBe("query");
+    expect(data.subject).toEqual({
+      kind: "Deployment",
+      group: "apps",
+      namespace: "shop",
+      name: "api",
+    });
+    expect(data.unit).toBe("bytes");
+    expect(data.series).toEqual(rangeSeries);
+    expect(investigationEvidenceSubjectRef(data)).toEqual(data.subject);
+    // The chart and the diagnose bundle that established its pods.
+    expect(projection.coverage.projected).toBe(2);
+  });
+
+  it("claims a unit only for a single bare metric that states one", () => {
+    const projection = project([
+      tool(
+        "bare",
+        "query_prometheus",
+        promResult({
+          query:
+            'container_memory_working_set_bytes{namespace="shop",pod=~"api-.*"}',
+        }),
+      ),
+      tool(
+        "rate",
+        "query_prometheus",
+        promResult({
+          query:
+            'rate(container_cpu_usage_seconds_total{namespace="shop",pod=~"api-.*"}[5m])',
+          selectors: [
+            {
+              metric: "container_cpu_usage_seconds_total",
+              matchers: targetSelectors[0].matchers,
+            },
+          ],
+        }),
+      ),
     ]);
-    // A single pod keeps the per-pod identity so saved runs still match.
-    expect(startup[1].id).not.toBe(startup[0].id);
+    const units = groupsOf(projection.groups, "metrics").map((group) =>
+      group.latest.data.type === "metrics" ? group.latest.data.unit : "?",
+    );
+    expect(units).toEqual(["bytes", ""]);
   });
 
-  it("folds pods' startup blocker into the classified issue that repeats it", () => {
-    const blocker = (name: string) => ({
-      kind: "Pod",
-      name,
-      reason: "Unschedulable",
-      severity: "critical",
-      message: "1 node(s) no free host ports",
-    });
+  it("renders an instant query as values, not a chart", () => {
     const projection = project([
-      tool("diagnose", "diagnose", {
-        resource: {
-          apiVersion: "apps/v1",
-          kind: "DaemonSet",
-          metadata: { namespace: "opencost", name: "node-exporter" },
-        },
-        resourceContext: { tier: "basic" },
-        pods: 2,
-        relatedIssues: [
-          {
-            id: "issue-unsched",
-            severity: "critical",
-            source: "scheduling",
-            category: "unschedulable",
-            category_group: "startup",
-            grouping_scope: "workload",
-            kind: "DaemonSet",
-            namespace: "opencost",
-            name: "node-exporter",
-            reason: "Unschedulable",
-            message: "1 node(s) no free host ports",
-          },
-        ],
-        startupBlockers: [
-          blocker("node-exporter-a"),
-          blocker("node-exporter-b"),
-        ],
-      }),
+      tool(
+        "instant",
+        "query_prometheus",
+        promResult({
+          type: "instant",
+          start: undefined,
+          end: undefined,
+          step: undefined,
+          resultType: "vector",
+          series: [
+            {
+              labels: { pod: "api-7f6-abc" },
+              dataPoints: [{ timestamp: 1_788_679_068, value: 3 }],
+            },
+          ],
+        }),
+      ),
     ]);
-    expect(
-      projection.groups.filter((group) => group.latest.data.type === "startup"),
-    ).toHaveLength(0);
-    const [issue] = projection.groups.filter(
-      (group) => group.latest.data.type === "issue",
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("Memory working set");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · 1 series",
+    );
+    expect(group.latest.data.type === "metrics" && group.latest.data.mode).toBe(
+      "instant",
     );
-    expect(
-      issue.latest.data.type === "issue" && issue.latest.data.pods,
-    ).toEqual(["node-exporter-a", "node-exporter-b"]);
   });
 
-  it("files a denied events namespace as an access limitation, not a receipt", () => {
+  it("reports a truncated result as a limitation with its cardinality, never as a chart", () => {
     const projection = project([
       tool(
-        "events-denied",
-        "get_events",
-        { events: [], accessDenied: true },
-        {
-          summary: JSON.stringify({ namespace: "locked", kind: "Pod" }),
-        },
+        "big",
+        "query_prometheus",
+        promResult({
+          series: [],
+          truncated: true,
+          summary: {
+            seriesCount: 812,
+            totalDataPoints: 194_880,
+            labelCardinality: { pod: 812, container: 3 },
+            suggestion: "topk(5, ...)",
+          },
+          note: "Result exceeded the 96 KiB cap.",
+        }),
       ),
     ]);
-    expect(projection.groups).toHaveLength(0);
-    expect(
-      projection.limitations.map((limitation) => [
-        limitation.source,
-        limitation.kind,
-      ]),
-    ).toEqual([["Events", "error"]]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(projection.limitations).toHaveLength(1);
+    expect(projection.limitations[0].kind).toBe("truncated");
+    expect(projection.limitations[0].message).toContain("812 series");
     expect(projection.limitations[0].message).toContain(
-      "not readable with your permissions",
+      "812 distinct pod values",
+    );
+    expect(projection.limitations[0].message).toContain("Result exceeded");
+    expect(projection.coverage.limited).toBe(1);
+  });
+
+  it("keeps a query that matched nothing as a fact about the window", () => {
+    const projection = project([
+      tool("none", "query_prometheus", promResult({ series: [] })),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · No series matched · 2h window · 25s step",
     );
   });
 
+  it("classifies scope from the producer's selectors, never from the expression text", () => {
+    const withNamespace = (
+      metric: string,
+      extra: Array<{ label: string; op: string; value: string }> = [],
+    ) => ({
+      metric,
+      matchers: [{ label: "namespace", op: "=", value: "shop" }, ...extra],
+    });
+    const cases: Array<[string, Record<string, unknown>, string]> = [
+      ["namespace only", { selectors: [withNamespace("up")] }, "broader"],
+      [
+        "workload label",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "target",
+      ],
+      [
+        "pod named by the workload's prefix, never established",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=", value: "api-7f6-abc" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "owner join over the namespace",
+        {
+          selectors: [
+            withNamespace("kube_pod_owner", [
+              { label: "owner_kind", op: "=", value: "ReplicaSet" },
+              { label: "owner_name", op: "=~", value: "^(api-7f6)$" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "container alone",
+        {
+          selectors: [
+            withNamespace("container_memory_working_set_bytes", [
+              { label: "container", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "broader",
+      ],
+      [
+        "sibling workload",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=", value: "worker" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "pod regex with an optional dash",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=~", value: "api-?.*" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "pod regex alternation behind the target prefix",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=~", value: "api-.*|worker-.*" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "workload alternation",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=~", value: "api|worker" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "statefulset label on a deployment target",
+        {
+          selectors: [
+            withNamespace("kube_statefulset_status_replicas_ready", [
+              { label: "statefulset", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "braced target numerator over a bare cluster denominator",
+        {
+          query:
+            'sum(container_memory_working_set_bytes{namespace="shop",pod=~"api-.*"}) / scalar(sum(machine_memory_bytes))',
+          selectors: [
+            ...targetSelectors,
+            { metric: "machine_memory_bytes", matchers: [] },
+          ],
+        },
+        "broader",
+      ],
+      [
+        "other namespace",
+        {
+          selectors: [
+            {
+              metric: "up",
+              matchers: [
+                { label: "namespace", op: "=", value: "other" },
+                { label: "pod", op: "=~", value: "api-.*" },
+              ],
+            },
+          ],
+        },
+        "broader",
+      ],
+      ["empty selectors", { selectors: [] }, "broader"],
+      [
+        "unknown selectors",
+        { selectors: targetSelectors, selectorsUnknown: true },
+        "broader",
+      ],
+    ];
+    for (const [name, patch, expected] of cases) {
+      const projection = project([
+        tool(`case-${name}`, "query_prometheus", promResult(patch)),
+      ]);
+      const [group] = groupsOf(projection.groups, "metrics");
+      expect(group?.latest.relevance, name).toBe(expected);
+      expect(
+        group?.latest.data.type === "metrics"
+          ? group.latest.data.subject
+          : "missing",
+        name,
+      ).toEqual(
+        expected === "target"
+          ? {
+              kind: "Deployment",
+              group: "apps",
+              namespace: "shop",
+              name: "api",
+            }
+          : undefined,
+      );
+      expect(group?.latest.tier, name).toBe(
+        expected === "broader" ? "context" : "supporting",
+      );
+    }
+  });
+
+  // The diagnose prompt tells the agent to scope a query as `pod=~'^(a|b)$'`.
+  // A Pod target has to recognise its own name written that way, or following
+  // our own instruction demotes the target's own series.
+  it("accepts the anchored set form the prompt asks for on a Pod target", () => {
+    const podTarget = {
+      kind: "Pod",
+      group: "",
+      namespace: "shop",
+      name: "api-7f6-abc",
+    };
+    const podSelector = (value: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "pod", op: "=~", value },
+        ],
+      },
+    ];
+    expect(metricsScope(podTarget, podSelector("api-7f6-abc"), false)).toBe(
+      "target",
+    );
+    expect(metricsScope(podTarget, podSelector("^(api-7f6-abc)$"), false)).toBe(
+      "target",
+    );
+    // A set that also names a neighbour is not evidence about this pod alone,
+    // and a prefix still selects pods this one does not stand for.
+    expect(
+      metricsScope(
+        podTarget,
+        podSelector("^(api-7f6-abc|api-7f6-def)$"),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(metricsScope(podTarget, podSelector("api-7f6-.*"), false)).toBe(
+      "producer-related",
+    );
+  });
+
+  it("treats an unescaped dot in a workload regex as naming more than the target", () => {
+    const dotted = { ...target, name: "api.v2" };
+    const selector = (value: string) => [
+      {
+        metric: "kube_deployment_status_replicas_available",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "deployment", op: "=~", value },
+        ],
+      },
+    ];
+    expect(metricsScope(dotted, selector("api.v2"), false)).toBe(
+      "producer-related",
+    );
+    expect(metricsScope(dotted, selector("api\\.v2"), false)).toBe("target");
+    expect(
+      metricsScope(
+        dotted,
+        [
+          {
+            metric: "up",
+            matchers: [
+              { label: "namespace", op: "=", value: "shop" },
+              { label: "pod", op: "=~", value: "api\\.v2-.*" },
+            ],
+          },
+        ],
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        dotted,
+        [
+          {
+            metric: "up",
+            matchers: [
+              { label: "namespace", op: "=", value: "shop" },
+              { label: "pod", op: "=~", value: "api.v2-.*" },
+            ],
+          },
+        ],
+        false,
+      ),
+    ).toBe("producer-related");
+  });
+
+  it("names a Pod target only by its exact name and accepts an anchored namespace regex", () => {
+    const pod = { ...target, kind: "Pod", group: "", name: "api-7f6-abc" };
+    const selector = (
+      namespace: { op: string; value: string },
+      podMatcher: { op: string; value: string },
+    ) => [
+      {
+        metric: "container_memory_working_set_bytes",
+        matchers: [
+          { label: "namespace", ...namespace },
+          { label: "pod", ...podMatcher },
+        ],
+      },
+    ];
+    const exactNs = { op: "=", value: "shop" };
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=~", value: "api-7f6-abc-.*" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=", value: "api-7f6-abc" }),
+        false,
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=~", value: "api-7f6-abc" }),
+        false,
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=", value: "api-7f6-abc-extra" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        target,
+        selector({ op: "=~", value: "shop" }, { op: "=~", value: "api-.*" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "=~", value: "shop" },
+          {
+            op: "=~",
+            value: "^(api-7f6-abc)$",
+          },
+        ),
+        false,
+        new Set(["api-7f6-abc"]),
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "=~", value: "shop|other" },
+          { op: "=~", value: "api-.*" },
+        ),
+        false,
+      ),
+    ).toBe("broader");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "!=", value: "kube-system" },
+          { op: "=~", value: "api-.*" },
+        ),
+        false,
+      ),
+    ).toBe("broader");
+  });
+
+  // Membership can also be established by a workload-logs read, which the
+  // main pass adapts into groups as it goes. Classifying a metrics query
+  // against those groups while they are still being built made the verdict
+  // depend on which tool the agent happened to call first: the same facts,
+  // read in the other order, demoted the same chart.
+  it("classifies a metrics query the same whichever order the agent worked in", () => {
+    const loggedPod = "api-68c7b766dc-fmphn";
+    const exactLoggedPod = {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: `^(${loggedPod})$` },
+      ],
+    };
+    const logs = () =>
+      tool("wl-logs", "get_workload_logs", workloadLogsPayload, {
+        summary: workloadLogsArgs,
+      });
+    const metrics = () =>
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          selectors: [exactLoggedPod],
+          query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"^(${loggedPod})$"})`,
+        }),
+      );
+
+    const logsFirst = groupsOf(project([logs(), metrics()]).groups, "metrics");
+    const metricsFirst = groupsOf(
+      project([metrics(), logs()]).groups,
+      "metrics",
+    );
+    expect(logsFirst[0].latest.relevance).toBe("target");
+    expect(metricsFirst[0].latest.relevance).toBe(
+      logsFirst[0].latest.relevance,
+    );
+
+    // Across turns too: the read that names the pod may arrive in a later one.
+    const acrossTurns = groupsOf(
+      project([metrics()], [logs()]).groups,
+      "metrics",
+    );
+    expect(acrossTurns[0].latest.relevance).toBe("target");
+  });
+
+  it("proves pod membership from the bundle instead of the workload's name", () => {
+    const withBundle = project([
+      podsBundle(),
+      tool("prom", "query_prometheus", promResult()),
+    ]);
+    expect(groupsOf(withBundle.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+
+    // The same exact set with no bundle to establish it, and the prefix that
+    // would also select a sibling workload's pods: kept, never promoted.
+    const unproven = project([tool("prom", "query_prometheus", promResult())]);
+    expect(groupsOf(unproven.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+    const prefixed = project([
+      podsBundle(),
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: prefixSelectors }),
+      ),
+    ]);
+    const prefixGroup = groupsOf(prefixed.groups, "metrics")[0];
+    expect(prefixGroup.latest.relevance).toBe("producer-related");
+    expect(
+      prefixGroup.latest.data.type === "metrics" &&
+        prefixGroup.latest.data.subject,
+    ).toBeUndefined();
+
+    // A subset of the established pods is still about the target.
+    const subset = project([
+      podsBundle(),
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          selectors: [
+            {
+              metric: "container_memory_working_set_bytes",
+              matchers: [
+                { label: "namespace", op: "=", value: "shop" },
+                { label: "pod", op: "=", value: "api-7f6-abc" },
+              ],
+            },
+          ],
+        }),
+      ),
+    ]);
+    expect(groupsOf(subset.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("proves membership whatever order the agent ran its tools in", () => {
+    // The agent may know the pod names from an earlier turn and chart them
+    // before it calls diagnose. The same facts must read the same way.
+    const queryFirst = project([
+      tool("prom", "query_prometheus", promResult()),
+      podsBundle(),
+    ]);
+    expect(groupsOf(queryFirst.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("will not establish target pods from a diagnose that never confirmed success", () => {
+    // This set is what proves a Prometheus selector is about the target, so it
+    // takes confirmed success — the same test the sources use — rather than
+    // merely the absence of an error.
+    const unconfirmed = {
+      ...podsBundle(),
+      isError: undefined as unknown as boolean,
+    };
+    const projection = project([
+      unconfirmed,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"${podSetPattern}"})`,
+          selectors: [
+            {
+              metric: "container_memory_working_set_bytes",
+              matchers: [
+                { label: "namespace", op: "=", value: "shop" },
+                { label: "pod", op: "=~", value: podSetPattern },
+              ],
+            },
+          ],
+        }),
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")[0].latest.relevance).not.toBe(
+      "target",
+    );
+  });
+
+  it("does not let a generic workload label claim another kind's series", () => {
+    const workloadSelectors = (type?: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "workload", op: "=", value: "api" },
+          ...(type ? [{ label: "workload_type", op: "=", value: type }] : []),
+        ],
+      },
+    ];
+    const asDeployment = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: workloadSelectors("deployment") }),
+      ),
+    ]);
+    expect(groupsOf(asDeployment.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+    // A StatefulSet also called api in the same namespace is a different
+    // workload, and the series says so.
+    const asStatefulSet = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: workloadSelectors("statefulset") }),
+      ),
+    ]);
+    expect(groupsOf(asStatefulSet.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+
+    // The same exclusion written as a regex. Reading only `=` let a sibling's
+    // chart take the target's identity and its change markers.
+    const regexSelectors = (value: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "workload", op: "=", value: "api" },
+          { label: "workload_type", op: "=~", value },
+        ],
+      },
+    ];
+    for (const [value, relevance] of [
+      ["statefulset", "producer-related"],
+      ["^(statefulset)$", "producer-related"],
+      // A set that includes the target kind could be the target, so it is no
+      // conflict; an inexact regex proves nothing either way.
+      ["^(deployment|statefulset)$", "target"],
+      [".*", "target"],
+    ] as const) {
+      const projection = project([
+        tool(
+          "prom",
+          "query_prometheus",
+          promResult({ selectors: regexSelectors(value) }),
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")[0].latest.relevance).toBe(
+        relevance,
+      );
+    }
+  });
+
+  it("refuses an unescaped dot as proof that a pod set names the target", () => {
+    const dotted = ["api.v2-0"];
+    const bundle = tool(
+      "diag-dotted",
+      "diagnose",
+      { resource: deployment, pods: 1, podNames: dotted },
+      {
+        summary: JSON.stringify({
+          kind: "Deployment",
+          namespace: "shop",
+          name: "api",
+        }),
+      },
+    );
+    const podSelector = (value: string) => [
+      {
+        metric: "container_memory_working_set_bytes",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "pod", op: "=~", value },
+        ],
+      },
+    ];
+    // `^(api.v2-0)$` also selects api-v2-0, so it names more than the pod it
+    // appears to and cannot prove membership.
+    const wildcard = project([
+      bundle,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: podSelector("^(api.v2-0)$") }),
+      ),
+    ]);
+    expect(groupsOf(wildcard.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+    const escaped = project([
+      bundle,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: podSelector("^(api\\.v2-0)$") }),
+      ),
+    ]);
+    expect(groupsOf(escaped.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("rejects a result without the producer's selector inventory", () => {
+    const projection = project([
+      tool("old", "query_prometheus", promResult({ selectors: undefined })),
+      tool(
+        "bad-series",
+        "query_prometheus",
+        promResult({
+          series: [{ labels: {}, dataPoints: [{ timestamp: "x", value: 1 }] }],
+        }),
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(projection.limitations.map((item) => item.kind)).toEqual([
+      "unknown",
+    ]);
+    expect(projection.limitations[0].source).toBe("Prometheus query");
+    expect(projection.limitations[0].sources).toHaveLength(2);
+  });
+
+  it("merges the same query into one card with revisions", () => {
+    const projection = project(
+      [tool("first", "query_prometheus", promResult())],
+      [
+        tool(
+          "second",
+          "query_prometheus",
+          promResult({
+            series: [
+              {
+                labels: { pod: "api-7f6-abc" },
+                dataPoints: [{ timestamp: 1_788_679_043, value: 1 }],
+              },
+            ],
+          }),
+        ),
+      ],
+    );
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(1);
+    expect(groups[0].observations).toHaveLength(2);
+    expect(groups[0].observations[1].changedFromPrevious).toBe(true);
+  });
+});
+
+describe("resource cards scaled by an HPA", () => {
+  const scaled = (state: string) =>
+    tool("workload", "diagnose", {
+      resource: {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { namespace: "shop", name: "api" },
+      },
+      resourceContext: {
+        tier: "basic",
+        workloadSummary: { replicas: { desired: 5, ready: 5, available: 5 } },
+        scaledBy: [
+          {
+            kind: "HorizontalPodAutoscaler",
+            namespace: "shop",
+            name: "api-hpa",
+            hpaSummary: {
+              state,
+              summary: "summary from Radar",
+              bounds: { min: 1, max: 5, current: 5, desired: 5 },
+            },
+          },
+        ],
+      },
+    });
+
+  it("lifts a healthy workload whose autoscaler cannot act", () => {
+    const result = project([scaled("metrics_unavailable")]);
+    const card = groupsOf(result.groups, "resource")[0].latest;
+    expect(card.tier).toBe("supporting");
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Metrics unavailable");
+  });
+
+  it("treats a maxed-out autoscaler as adverse", () => {
+    const card = groupsOf(
+      project([scaled("limited_max")]).groups,
+      "resource",
+    )[0].latest;
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Maxed");
+  });
+
+  it("leaves an autoscaler that is simply scaling as context", () => {
+    const card = groupsOf(project([scaled("scaling_up")]).groups, "resource")[0]
+      .latest;
+    expect(card.tier).toBe("context");
+    expect(card.tone).toBe("neutral");
+    expect(card.summary).toBe("5/5 replicas ready");
+  });
+});
+
+describe("diagnose metrics evidence", () => {
+  const window = {
+    start: "2026-09-06T07:00:00Z",
+    end: "2026-09-06T08:00:00Z",
+    step: "1m2s",
+  };
+  const samples = [
+    { timestamp: Date.parse(window.start) / 1000, value: 0.003457 },
+    { timestamp: Date.parse(window.end) / 1000, value: 0.004 },
+  ];
+  function vitals(patch: Record<string, unknown> = {}) {
+    return {
+      window,
+      pods: 2,
+      series: [
+        {
+          category: "cpu",
+          unit: "cores",
+          query:
+            "sum(rate(container_cpu_usage_seconds_total{container!='',namespace='shop',pod=~'^(api-a|api-b)$'}[5m]))",
+          series: [{ labels: {}, dataPoints: samples }],
+        },
+        {
+          category: "memory",
+          unit: "bytes",
+          query:
+            "sum(max by (pod,namespace,container) (container_memory_working_set_bytes{container!='',namespace='shop',pod=~'^(api-a|api-b)$'}))",
+          series: [{ labels: {}, dataPoints: samples }],
+        },
+        {
+          category: "restarts",
+          unit: "count",
+          query:
+            "sum(round(increase(kube_pod_container_status_restarts_total{namespace='shop',pod=~'^(api-a|api-b)$'}[1h])))",
+          series: [],
+        },
+      ],
+      ...patch,
+    };
+  }
+  const args = { kind: "Deployment", namespace: "shop", name: "api" };
+
+  it("charts each captured category as target evidence with the diagnosed resource as subject", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        { resource: deployment, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups.map((group) => group.latest.title)).toEqual([
+      "CPU usage · Deployment shop/api",
+      "Memory working set · Deployment shop/api",
+      "Restarts · Deployment shop/api",
+    ]);
+    for (const group of groups) {
+      expect(group.latest.relevance).toBe("target");
+      expect(group.latest.tier).toBe("supporting");
+      expect(group.latest.tone).toBe("neutral");
+      const data = group.latest.data;
+      if (data.type !== "metrics") throw new Error("expected metrics");
+      expect(data.origin).toBe("diagnose");
+      expect(data.mode).toBe("range");
+      expect(data.start).toBe(window.start);
+      expect(data.end).toBe(window.end);
+      expect(data.step).toBe(window.step);
+      expect(data.pods).toBe(2);
+      expect(data.partial).toBe(false);
+      expect(data.truncated).toBe(false);
+      expect(data.subject).toEqual({
+        kind: "Deployment",
+        group: "apps",
+        namespace: "shop",
+        name: "api",
+      });
+      expect(investigationEvidenceSubjectRef(data)).toEqual(data.subject);
+    }
+    const [cpu, , restarts] = groups;
+    expect(cpu.latest.summary).toBe("2 current pods · 60m window · 1m2s step");
+    const cpuData = cpu.latest.data;
+    if (cpuData.type !== "metrics") throw new Error("expected metrics");
+    expect(cpuData.unit).toBe("cores");
+    expect(cpuData.label).toBe("CPU usage");
+    expect(cpuData.query).toContain("pod=~'^(api-a|api-b)$'");
+    expect(cpuData.series).toEqual([{ labels: {}, dataPoints: samples }]);
+    expect(restarts.latest.summary).toBe(
+      "No samples in the window · 60m window · 1m2s step",
+    );
+    expect(
+      projection.limitations.filter(
+        (item) => item.source === "Workload metrics",
+      ),
+    ).toHaveLength(0);
+  });
+
+  it("merges a re-diagnose of the same workload into the same chart per category", () => {
+    const later = vitals({
+      window: { ...window, end: "2026-09-06T08:30:00Z" },
+    });
+    const projection = project(
+      [
+        tool(
+          "diag-1",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics: vitals() },
+          { summary: JSON.stringify(args) },
+        ),
+      ],
+      [
+        tool(
+          "diag-2",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics: later },
+          { summary: JSON.stringify(args) },
+        ),
+      ],
+    );
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(3);
+    expect(groups.every((group) => group.observations.length === 2)).toBe(true);
+    const data = groups[0].latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.end).toBe("2026-09-06T08:30:00Z");
+  });
+
+  it("reports a producer error as a limitation and still charts what answered", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [vitals().series[1]],
+            error:
+              "cpu: prom: query error from prometheus: cpu exploded (execution)",
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(1);
+    const limitation = projection.limitations.find(
+      (item) => item.source === "Workload metrics",
+    );
+    expect(limitation?.kind).toBe("error");
+    expect(limitation?.message).toContain("cpu exploded");
+  });
+
+  it("reports an unreachable Prometheus without inventing a chart", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [],
+            error:
+              "prometheus unreachable: dial tcp 10.0.0.9:9090: connection refused",
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    const limitation = projection.limitations.find(
+      (item) => item.source === "Workload metrics",
+    );
+    expect(limitation?.kind).toBe("error");
+    expect(limitation?.message).toBe(
+      "prometheus unreachable: dial tcp 10.0.0.9:9090: connection refused",
+    );
+  });
+
+  it("says nothing when diagnose carried no metrics field", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        { resource: deployment, pods: 2 },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(
+      projection.limitations.some((item) => item.source === "Workload metrics"),
+    ).toBe(false);
+  });
+
+  it("notes a partial pod set in the summary and keeps the cap on the card", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 55,
+          metrics: vitals({ pods: 50, partial: true, omittedPods: 5 }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const [cpu] = groupsOf(projection.groups, "metrics");
+    expect(cpu.latest.summary).toBe(
+      "first 50 of 55 current pods · 60m window · 1m2s step · partial pod set",
+    );
+    const data = cpu.latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.pods).toBe(50);
+    expect(data.partial).toBe(true);
+  });
+
+  it("keeps a neighbour's vitals broader with the neighbour as subject", () => {
+    const worker = {
+      ...deployment,
+      metadata: { namespace: "shop", name: "worker" },
+    };
+    const projection = project([
+      tool(
+        "diag-worker",
+        "diagnose",
+        { resource: worker, pods: 2, metrics: vitals() },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "worker",
+          }),
+        },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(3);
+    for (const group of groups) {
+      expect(group.latest.relevance).toBe("broader");
+      expect(group.latest.tier).toBe("context");
+      const data = group.latest.data;
+      if (data.type !== "metrics") throw new Error("expected metrics");
+      expect(data.subject).toEqual({
+        kind: "Deployment",
+        group: "apps",
+        namespace: "shop",
+        name: "worker",
+      });
+    }
+  });
+
+  it("rejects a malformed metrics field instead of charting it", () => {
+    const malformed: Record<string, unknown>[] = [
+      { window: { start: window.start }, pods: "two", series: [] },
+      { window: { ...window, end: "not a date" }, pods: 2, series: [] },
+      { window: { ...window, end: window.start }, pods: 2, series: [] },
+      { window, pods: -1, series: [] },
+      { window, pods: 1.5, series: [] },
+      { window, pods: 2, omittedPods: -3, series: [] },
+    ];
+    for (const metrics of malformed) {
+      const projection = project([
+        tool(
+          "diag",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics },
+          { summary: JSON.stringify(args) },
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+      expect(
+        projection.limitations.some(
+          (item) =>
+            item.source === "Workload metrics" && item.kind === "unknown",
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it("keeps same-named workloads in different API groups on separate charts", () => {
+    const rollout = {
+      ...deployment,
+      apiVersion: "argoproj.io/v1alpha1",
+      kind: "Rollout",
+    };
+    const projection = project([
+      tool(
+        "diag-deployment",
+        "diagnose",
+        { resource: deployment, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+      tool(
+        "diag-rollout",
+        "diagnose",
+        { resource: rollout, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(6);
+    expect(groups.every((group) => group.observations.length === 1)).toBe(true);
+    expect(new Set(groups.map((group) => group.identity)).size).toBe(6);
+  });
+
+  it("rejects inherited object keys posing as categories", () => {
+    for (const category of ["__proto__", "constructor", "toString"]) {
+      const projection = project([
+        tool(
+          "diag",
+          "diagnose",
+          {
+            resource: deployment,
+            pods: 2,
+            metrics: vitals({
+              series: [{ ...vitals().series[0], category }],
+            }),
+          },
+          { summary: JSON.stringify(args) },
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+      expect(
+        projection.limitations.some(
+          (item) =>
+            item.source === "Workload metrics" && item.kind === "unknown",
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it("rejects a category outside the contract or a series without a unit", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [
+              { ...vitals().series[0], category: "latency" },
+              { ...vitals().series[1], unit: undefined },
+              vitals().series[2],
+            ],
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups.map((group) => group.latest.title)).toEqual([
+      "Restarts · Deployment shop/api",
+    ]);
+    expect(
+      projection.limitations.some(
+        (item) => item.source === "Workload metrics" && item.kind === "unknown",
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("live-run follow-ups", () => {
+  it("reads the producer's nil-slice null as an empty events or changes result", () => {
+    const projection = project([
+      tool(
+        "events-none",
+        "get_events",
+        { events: null },
+        {
+          summary: JSON.stringify({
+            kind: "Pod",
+            namespace: "shop",
+            name: "api",
+          }),
+        },
+      ),
+      tool(
+        "changes-none",
+        "get_changes",
+        { changes: null },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "api",
+            since: "24h",
+          }),
+        },
+      ),
+    ]);
+    // A complete, successful events query that returned nothing is a checked
+    // receipt for its scope; the producer marks a denied namespace separately.
+    expect(
+      projection.groups.map((group) => [
+        group.latest.data.type,
+        group.latest.title,
+      ]),
+    ).toEqual([["receipt", "No events in this window"]]);
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Recent changes", "unknown"]]);
+  });
+
+  it("keeps one identity for a blocker whether one pod holds it or several", () => {
+    const blocker = (name: string) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message: "1 node(s) no free host ports",
+    });
+    const bundle = (pods: string[]) => ({
+      resource: {
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: { namespace: "opencost", name: "node-exporter" },
+      },
+      resourceContext: { tier: "basic" },
+      pods: pods.length,
+      startupBlockers: pods.map(blocker),
+    });
+    // Two pods recover to one between diagnoses. The blocker is the same
+    // finding, so it must update its card rather than open a second one
+    // beside it saying the same thing.
+    const projection = projectInvestigationEvidence(
+      [
+        {
+          status: "done",
+          timeline: [tool("first", "diagnose", bundle(["a", "b"]))],
+        },
+        {
+          status: "done",
+          verify: true,
+          timeline: [tool("second", "diagnose", bundle(["a"]))],
+        },
+      ],
+      {
+        kind: "DaemonSet",
+        group: "apps",
+        namespace: "opencost",
+        name: "node-exporter",
+      },
+    );
+    const startup = projection.groups.filter(
+      (group) => group.latest.data.type === "startup",
+    );
+    expect(startup).toHaveLength(1);
+    expect(startup[0].observations).toHaveLength(2);
+    expect(startup[0].latest.summary).toBe("1 node(s) no free host ports");
+  });
+
+  it("merges identical startup blockers across pods into one card with the pod list", () => {
+    const blocker = (
+      name: string,
+      message = "1 node(s) no free host ports",
+    ) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message,
+    });
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: {
+          apiVersion: "apps/v1",
+          kind: "DaemonSet",
+          metadata: { namespace: "opencost", name: "node-exporter" },
+        },
+        resourceContext: { tier: "basic" },
+        pods: 3,
+        startupBlockers: [
+          blocker("node-exporter-a"),
+          blocker("node-exporter-b"),
+          blocker("node-exporter-c", "0/10 nodes: insufficient memory"),
+        ],
+      }),
+    ]);
+    const startup = projection.groups.filter(
+      (group) => group.latest.data.type === "startup",
+    );
+    expect(
+      startup.map((group) => [
+        group.latest.summary,
+        group.latest.data.type === "startup" ? group.latest.data.pods : null,
+      ]),
+    ).toEqual([
+      [
+        "2 pods · 1 node(s) no free host ports",
+        ["node-exporter-a", "node-exporter-b"],
+      ],
+      // A blocker only one pod holds still carries that pod, so the pods a
+      // later Prometheus query is proved against do not depend on how many
+      // happened to share a reason.
+      ["0/10 nodes: insufficient memory", ["node-exporter-c"]],
+    ]);
+    expect(startup[1].id).not.toBe(startup[0].id);
+  });
+
+  it("folds pods' startup blocker into the classified issue that repeats it", () => {
+    const blocker = (name: string) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message: "1 node(s) no free host ports",
+    });
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: {
+          apiVersion: "apps/v1",
+          kind: "DaemonSet",
+          metadata: { namespace: "opencost", name: "node-exporter" },
+        },
+        resourceContext: { tier: "basic" },
+        pods: 2,
+        relatedIssues: [
+          {
+            id: "issue-unsched",
+            severity: "critical",
+            source: "scheduling",
+            category: "unschedulable",
+            category_group: "startup",
+            grouping_scope: "workload",
+            kind: "DaemonSet",
+            namespace: "opencost",
+            name: "node-exporter",
+            reason: "Unschedulable",
+            message: "1 node(s) no free host ports",
+          },
+        ],
+        startupBlockers: [
+          blocker("node-exporter-a"),
+          blocker("node-exporter-b"),
+        ],
+      }),
+    ]);
+    expect(
+      projection.groups.filter((group) => group.latest.data.type === "startup"),
+    ).toHaveLength(0);
+    const [issue] = projection.groups.filter(
+      (group) => group.latest.data.type === "issue",
+    );
+    expect(
+      issue.latest.data.type === "issue" && issue.latest.data.pods,
+    ).toEqual(["node-exporter-a", "node-exporter-b"]);
+  });
+
+  it("files a denied events namespace as an access limitation, not a receipt", () => {
+    const projection = project([
+      tool(
+        "events-denied",
+        "get_events",
+        { events: [], accessDenied: true },
+        {
+          summary: JSON.stringify({ namespace: "locked", kind: "Pod" }),
+        },
+      ),
+    ]);
+    expect(projection.groups).toHaveLength(0);
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Events", "error"]]);
+    expect(projection.limitations[0].message).toContain(
+      "not readable with your permissions",
+    );
+  });
+
+  it("keeps a cluster-wide events read that was narrowed to readable namespaces from reading as a clean cluster", () => {
+    const empty = project([
+      tool(
+        "events-partial-empty",
+        "get_events",
+        { events: [], partialScope: true, scopeNamespaces: ["alpha", "beta"] },
+        { summary: JSON.stringify({}) },
+      ),
+    ]);
+    const [receipt] = groupsOf(empty.groups, "receipt");
+    expect(receipt.latest.title).toBe(
+      "No events in the namespaces you can read",
+    );
+    const narrowedBody =
+      receipt.latest.data.type === "receipt" ? receipt.latest.data.message : "";
+    expect(narrowedBody).toContain("alpha, beta");
+    // The load-bearing half: an empty answer from the namespaces a reader can
+    // see must never read as an answer about the cluster.
+    expect(narrowedBody).toContain("does not clear the cluster");
+    expect(empty.limitations).toHaveLength(0);
+
+    const found = project([
+      tool(
+        "events-partial",
+        "get_events",
+        {
+          events: [
+            {
+              type: "Warning",
+              reason: "BackOff",
+              message: "back-off restarting",
+              count: 3,
+              lastTimestamp: "2026-09-02T09:00:00Z",
+              involvedObject: { kind: "Pod", namespace: "alpha", name: "api" },
+            },
+          ],
+          partialScope: true,
+          scopeNamespaces: ["alpha", "beta"],
+        },
+        { summary: JSON.stringify({}) },
+      ),
+    ]);
+    expect(
+      found.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Events", "unknown"]]);
+    expect(found.limitations[0].message).toContain("alpha, beta");
+  });
+
   it("keeps repeated change reads of one resource on one card and names the window", () => {
     const change = {
       kind: "Deployment",