@skyhook-io/radar-app 1.14.0 → 1.14.2

package/src/components/diagnose/investigationCase.ts

@@ -33,6 +33,8 @@ export interface InvestigationCaseItem {
   index: number;
   role: DiagnosisEvidenceRole;
   claim: string;
+  /** What the agent says this result does not cover. */
+  gap?: string;
   subject?: DiagnosisEvidenceSubject;
   source: InvestigationEvidenceSource;
   placement: InvestigationCasePlacement;
@@ -51,65 +53,6 @@ export interface InvestigationCaseResolution {
   ruledOut: InvestigationCaseRuledOut[];
 }
 
-/**
- * Notes the agent put on cards in earlier assessments stay on those cards
- * when a later turn takes over the pane's case, unless the later turn
- * addressed the same card; a follow-up about one chart must not strip the
- * initial assessment's reading from everything else. Ordering and the
- * ruled-out list follow the live turn alone, and source-placed notes stay
- * listed under their own assessment. `earlier` is newest first.
- */
-export function mergeInvestigationCases(
-  live: InvestigationCaseResolution | undefined,
-  earlier: readonly (InvestigationCaseResolution | undefined)[],
-): InvestigationCaseResolution | undefined {
-  const liveItems = live?.items ?? [];
-  const covered = new Set(
-    liveItems.flatMap((item) => (item.groupId ? [item.groupId] : [])),
-  );
-  const carried: InvestigationCaseItem[] = [];
-  for (const resolution of earlier) {
-    // The newest assessment that spoke about a group wins it outright, and it
-    // wins with everything it said: a card note and a pinned revision note are
-    // two readings of one group, not rivals. Coverage is therefore taken after
-    // the whole resolution, not as each of its items is carried.
-    const takenHere = new Set<string>();
-    for (const item of resolution?.items ?? []) {
-      if (item.placement === "source" || !item.groupId) continue;
-      if (covered.has(item.groupId)) continue;
-      takenHere.add(item.groupId);
-      carried.push(item);
-    }
-    for (const groupId of takenHere) covered.add(groupId);
-  }
-  if (carried.length === 0) return live;
-  return { items: [...liveItems, ...carried], ruledOut: live?.ruledOut ?? [] };
-}
-
-/**
- * The subset of one assessment's items that survived into the case the pane
- * actually renders. Matching is by value, not object identity: the merge is
- * fed freshly resolved copies of every turn, so an identity test would report
- * that an assessment's own note had vanished the moment any other turn was
- * re-resolved.
- */
-export function investigationCaseItemsStillRendered(
-  assessmentItems: readonly InvestigationCaseItem[] | undefined,
-  renderedItems: readonly InvestigationCaseItem[] | undefined,
-): InvestigationCaseItem[] {
-  if (!assessmentItems?.length || !renderedItems?.length) return [];
-  const key = (item: InvestigationCaseItem) =>
-    [
-      item.index,
-      item.source.id,
-      item.placement,
-      item.groupId ?? "",
-      item.observation ? investigationCaseObservationKey(item.observation) : "",
-    ].join("\u0000");
-  const rendered = new Set(renderedItems.map(key));
-  return assessmentItems.filter((item) => rendered.has(key(item)));
-}
-
 /**
  * One half of a Go↔TS contract: `evidenceRoles` in internal/ai/parse.go and the
  * DiagnosisEvidenceRole union in api/diagnose.ts must list exactly these roles.
@@ -134,10 +77,12 @@ export function investigationCaseObservationKey(
 
 /**
  * Resolves the agent's case for one assessment. Refs are re-validated against
- * the assessment turn exactly like root-cause refs; an item whose ref does not
- * resolve is dropped on its own. Placement follows the observation the
- * (ref, subject) pair names: exactly one match pins the claim to that
- * observation, anything else falls back to the source row.
+ * the run up to and including the assessment turn, exactly like root-cause
+ * refs — a revised assessment may rest on a result read in an earlier turn,
+ * and the observation it resolves to is that earlier read, never a later one.
+ * An item whose ref does not resolve is dropped on its own. Placement follows
+ * the observation the (ref, subject) pair names: exactly one match pins the
+ * claim to that observation, anything else falls back to the source row.
  */
 export function resolveInvestigationCase(
   projection: InvestigationEvidenceProjection,
@@ -149,17 +94,17 @@ export function resolveInvestigationCase(
 ): InvestigationCaseResolution {
   const evidence = diagnosis?.evidence ?? [];
   if (evidence.length === 0) return { items: [], ruledOut: [] };
+  const targetPods = new Set(projection.targetPods);
   const byRef = new Map<string, InvestigationEvidenceSource[]>();
   for (const source of projection.evidenceRefSources) {
-    if (source.turnIndex !== assessmentTurnIndex || !source.evidenceRef)
-      continue;
+    if (source.turnIndex > assessmentTurnIndex || !source.evidenceRef) continue;
     const matches = byRef.get(source.evidenceRef) ?? [];
     matches.push(source);
     byRef.set(source.evidenceRef, matches);
   }
   const citableSourceIds = new Set(
     projection.citableSources
-      .filter((source) => source.turnIndex === assessmentTurnIndex)
+      .filter((source) => source.turnIndex <= assessmentTurnIndex)
       .map((source) => source.id),
   );
   const items: InvestigationCaseItem[] = [];
@@ -188,6 +133,9 @@ export function resolveInvestigationCase(
       index,
       role: entry.role,
       claim: typeof entry.claim === "string" ? entry.claim.trim() : "",
+      ...(typeof entry.gap === "string" && entry.gap.trim()
+        ? { gap: entry.gap.trim() }
+        : {}),
       ...(subject ? { subject } : {}),
       source,
       placement: "source",
@@ -200,7 +148,12 @@ export function resolveInvestigationCase(
               (observation) =>
                 observation.source.id === source.id &&
                 (!subject ||
-                  observationMatchesSubject(group, observation, subject)),
+                  observationMatchesSubject(
+                    group,
+                    observation,
+                    subject,
+                    targetPods,
+                  )),
             )
             .map((observation) => ({ group, observation })),
         );
@@ -241,11 +194,11 @@ export function resolveInvestigationCase(
 function validCaseSubject(
   value: DiagnosisEvidenceSubject | undefined,
 ): DiagnosisEvidenceSubject | undefined {
-  if (!value || !nonEmptyString(value.kind) || !nonEmptyString(value.name))
-    return undefined;
+  if (!value || !nonEmptyString(value.kind)) return undefined;
   const optional = (field: unknown) =>
     field === undefined || typeof field === "string";
   if (
+    !optional(value.name) ||
     !optional(value.group) ||
     !optional(value.namespace) ||
     !optional(value.container) ||
@@ -268,6 +221,8 @@ interface ObservationSubjectIdentity {
   name: string;
   container?: string;
   stream?: "current" | "previous";
+  /** A listing names a kind (and scope) but no single object. */
+  listing?: boolean;
 }
 
 /**
@@ -319,17 +274,44 @@ function observationSubjectIdentity(
     };
   }
   const args = investigationSourceArgs(observation.source);
-  if (!args || !nonEmptyString(args.kind) || !nonEmptyString(args.name))
-    return undefined;
+  // A listing whose call names no kind (list_namespaces) is still a listing
+  // of the one kind its rows carry.
+  if (data.type === "inventory" && !nonEmptyString(args?.kind)) {
+    const kinds = new Set(data.resources.map((resource) => resource.kind));
+    if (kinds.size !== 1) return undefined;
+    return {
+      kind: [...kinds][0],
+      namespace: nonEmptyString(args?.namespace) ? args.namespace : undefined,
+      name: "",
+      listing: true,
+    };
+  }
+  if (!args || !nonEmptyString(args.kind)) return undefined;
   return {
     kind: args.kind,
     group: nonEmptyString(args.group) ? args.group : undefined,
     namespace: nonEmptyString(args.namespace) ? args.namespace : undefined,
-    name: args.name,
+    name: nonEmptyString(args.name) ? args.name : "",
+    ...(nonEmptyString(args.name) ? {} : { listing: true }),
   };
 }
 
-function sameKind(left: string, right: string): boolean {
+// No CRD lives in a built-in API group: the core group under its three
+// spellings, the four legacy unsuffixed groups, or any group under k8s.io.
+const LEGACY_BUILT_IN_GROUPS = new Set([
+  "",
+  "core",
+  "v1",
+  "apps",
+  "batch",
+  "autoscaling",
+  "policy",
+]);
+function isBuiltInGroup(group: string): boolean {
+  return LEGACY_BUILT_IN_GROUPS.has(group) || group.endsWith(".k8s.io");
+}
+
+export function sameKind(left: string, right: string): boolean {
   return pluralToKind(left).toLowerCase() === pluralToKind(right).toLowerCase();
 }
 
@@ -342,6 +324,7 @@ function observationMatchesSubject(
   group: InvestigationEvidenceGroup,
   observation: InvestigationEvidenceObservation,
   subject: DiagnosisEvidenceSubject,
+  targetPods: ReadonlySet<string>,
 ): boolean {
   if (subject.observation !== undefined) {
     // A diagnose bundle captures several vitals charts for one resource, so
@@ -349,7 +332,10 @@ function observationMatchesSubject(
     // whose identity ends in that category. An agent-run query is one chart,
     // so a qualifier on it carries no meaning.
     const [kind, qualifier] = subject.observation.toLowerCase().split(":", 2);
-    if (kind !== observation.data.type) return false;
+    // A listing is resources too: "resource" names an inventory card as well.
+    const inventoryAsResource =
+      kind === "resource" && observation.data.type === "inventory";
+    if (kind !== observation.data.type && !inventoryAsResource) return false;
     if (
       qualifier !== undefined &&
       observation.data.type === "metrics" &&
@@ -359,6 +345,10 @@ function observationMatchesSubject(
       return false;
     }
   }
+  // One rules result holds many rules and none states a resource; the rule's
+  // name is the handle that tells them apart.
+  if (observation.data.type === "alerts" && subject.name !== undefined)
+    return observation.data.rule.name === subject.name;
   const identities = observationIdentities(observation);
   // An observation that states no resource of its own (an agent-run query
   // whose selectors do not name the target exactly, a topology summary) can
@@ -366,7 +356,7 @@ function observationMatchesSubject(
   // the rest.
   if (identities.length === 0) return subject.observation !== undefined;
   return identities.some((identity) =>
-    identityMatchesSubject(identity, observation, subject),
+    identityMatchesSubject(identity, observation, subject, targetPods),
   );
 }
 
@@ -397,17 +387,72 @@ function observationIdentities(
   return identities;
 }
 
+// Pod names are DNS subdomains (letters, digits, hyphens, dots), so a name
+// is a whole word between characters that cannot be part of one; "api"
+// inside "api-other" names another Pod.
+function namesPod(text: string, name: string): boolean {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(^|[^A-Za-z0-9.-])${escaped}(?![A-Za-z0-9.-])`).test(text);
+}
+
 function identityMatchesSubject(
   identity: ObservationSubjectIdentity,
   observation: InvestigationEvidenceObservation,
   subject: DiagnosisEvidenceSubject,
+  targetPods: ReadonlySet<string>,
 ): boolean {
-  if (!sameKind(identity.kind, subject.kind) || identity.name !== subject.name)
+  // "The events of namespace X" names a namespace-scoped read whose
+  // observation inherits the resource its call was asked about; the agent
+  // naming the namespace instead is not wrong, so a stated evidence kind plus
+  // a matching namespace is enough for that shape.
+  if (
+    subject.observation !== undefined &&
+    sameKind(subject.kind, "Namespace") &&
+    identity.namespace !== undefined &&
+    identity.namespace === subject.name
+  )
+    return true;
+  // A workload read collects its pods' events, so "the events of Pod X" names
+  // the events observation a diagnose bundle or workload call inherited from
+  // the workload; the ref already fixes the call, uniqueness fixes the card.
+  if (
+    subject.observation !== undefined &&
+    observation.data.type === "events" &&
+    sameKind(subject.kind, "Pod") &&
+    !sameKind(identity.kind, "Pod") &&
+    (identity.namespace === undefined ||
+      subject.namespace === undefined ||
+      identity.namespace === subject.namespace) &&
+    // The Pod has to be the target's own on events the target's read produced,
+    // or named whole by an event: a Pod nothing here establishes is not this card.
+    (subject.name === undefined ||
+      (targetPods.has(subject.name) && observation.relevance !== "broader") ||
+      observation.data.events.some((event) =>
+        namesPod(event.message, subject.name!),
+      ))
+  )
+    return true;
+  if (!sameKind(identity.kind, subject.kind)) return false;
+  // A subject with no name (a listing cited for what it does not contain) is
+  // a wildcard that uniqueness still gates. A listing has no name of its own; the agent naming the entry it means
+  // ("ConfigMap kube-root-ca.crt" in the ConfigMaps of a namespace) still
+  // points at that listing, whether or not the listing holds the entry: an
+  // absent entry is often the point, and the card says which it is.
+  if (
+    !identity.listing &&
+    subject.name !== undefined &&
+    identity.name !== subject.name
+  )
     return false;
+  // A built-in group on a core kind ("apps" on a Pod) is the agent
+  // misremembering the API, not naming a different object: no CRD lives in a
+  // built-in group, so nothing else could be meant. A vendor group on a core
+  // kind (a Knative Service) still names a different object.
   if (
     subject.group !== undefined &&
     identity.group !== undefined &&
-    subject.group.toLowerCase() !== identity.group.toLowerCase()
+    subject.group.toLowerCase() !== identity.group.toLowerCase() &&
+    !(identity.group === "" && isBuiltInGroup(subject.group.toLowerCase()))
   ) {
     return false;
   }

package/src/components/diagnose/investigationEvidence/adapters/resource.test.ts

@@ -27,6 +27,33 @@ describe("resource cards scaled by an HPA", () => {
       },
     });
 
+  it("states a workload's readiness from the resource when the read carried no context", () => {
+    const result = project([
+      tool(
+        "res",
+        "get_resource",
+        {
+          resource: {
+            apiVersion: "apps/v1",
+            kind: "Deployment",
+            metadata: { namespace: "shop", name: "api" },
+            spec: { replicas: 1 },
+            status: { replicas: 1, readyReplicas: 0 },
+          },
+        },
+        {
+          summary: JSON.stringify({
+            kind: "deployment",
+            namespace: "shop",
+            name: "api",
+          }),
+        },
+      ),
+    ]);
+    const card = groupsOf(result.groups, "resource")[0].latest;
+    expect(card.summary).toBe("0/1 replicas ready");
+  });
+
   it("lifts a healthy workload whose autoscaler cannot act", () => {
     const result = project([scaled("metrics_unavailable")]);
     const card = groupsOf(result.groups, "resource")[0].latest;

package/src/components/diagnose/investigationEvidence/adapters/resource.ts

@@ -198,6 +198,34 @@ export function adaptGetResource(
     );
   }
 }
+// A namespace listing is an inventory like any other; its entries carry no
+// kind of their own, so the card gets one.
+export function adaptListNamespaces(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  if (!Array.isArray(payload)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  adaptListResources(
+    builder,
+    source,
+    payload.map((entry) => {
+      const item = record(entry);
+      return item
+        ? {
+            kind: "Namespace",
+            name: item.name,
+            status: item.status,
+            terminating: item.status === "Terminating",
+          }
+        : entry;
+    }),
+  );
+}
+
 export function adaptListResources(
   builder: ProjectionBuilder,
   source: InvestigationEvidenceSource,

package/src/components/diagnose/investigationEvidence/builder.ts

@@ -1,4 +1,7 @@
-import { apiVersionToGroup, knownKindForPluralWithGroup } from "../../../utils/navigation";
+import {
+  apiVersionToGroup,
+  knownKindForPluralWithGroup,
+} from "../../../utils/navigation";
 import { adaptChanges } from "./adapters/changes";
 import { adaptDiagnose } from "./adapters/diagnose";
 import { adaptEvents } from "./adapters/events";
@@ -10,7 +13,11 @@ import {
   adaptPrometheusRules,
   adaptQueryPrometheus,
 } from "./adapters/prometheus";
-import { adaptGetResource, adaptListResources } from "./adapters/resource";
+import {
+  adaptGetResource,
+  adaptListResources,
+  adaptListNamespaces,
+} from "./adapters/resource";
 import { adaptNeighborhood, adaptTopology } from "./adapters/topology";
 import {
   investigationEvidenceRefRe,
@@ -58,6 +65,7 @@ const ADAPTERS: Record<
   issues: adaptIssues,
   get_resource: adaptGetResource,
   list_resources: adaptListResources,
+  list_namespaces: adaptListNamespaces,
   get_events: adaptEvents,
   get_pod_logs: adaptPodLogs,
   get_changes: adaptChanges,
@@ -408,6 +416,7 @@ export function projectInvestigationEvidence(
     sources: builder.sources,
     evidenceRefSources,
     citableSources,
+    targetPods: [...builder.establishedTargetPods],
     coverage: {
       attempted: builder.sources.length,
       projected: builder.projectedSources.size,

package/src/components/diagnose/investigationEvidence/identity.test.ts

@@ -471,7 +471,7 @@ describe("root-cause evidence resolution", () => {
     ).toBeUndefined();
   });
 
-  it("fails closed for malformed, unmatched, prior-turn, failed, or partial refs", () => {
+  it("fails closed for malformed, unmatched, later-turn, failed, or partial refs", () => {
     const currentRef = evidenceRef("a", "b");
     const priorRef = evidenceRef("c", "d");
     const failedRef = evidenceRef("a", "e");
@@ -493,9 +493,27 @@ describe("root-cause evidence resolution", () => {
       ],
     );
 
+    // A result read in an earlier turn of the same run is citable — a revised
+    // assessment may rest on it — and resolves to that earlier read.
+    expect(
+      resolveInvestigationRootCauseEvidence(
+        projection,
+        { status: "linked", refs: [priorRef] },
+        1,
+      ),
+    ).toMatchObject({ status: "linked", links: [{ source: { stepId: "old" } }] });
+    // A result read AFTER the assessment turn is not: the assessment could not
+    // have seen it.
+    expect(
+      resolveInvestigationRootCauseEvidence(
+        projection,
+        { status: "linked", refs: [currentRef] },
+        0,
+      ),
+    ).toEqual({ status: "invalid", links: [] });
+
     for (const evidence of [
       { status: "linked" as const, refs: [evidenceRef("a", "z")] },
-      { status: "linked" as const, refs: [priorRef] },
       { status: "linked" as const, refs: [failedRef] },
       { status: "linked" as const, refs: [partialRef] },
       { status: "linked" as const, refs: [currentRef, currentRef] },
@@ -531,7 +549,7 @@ describe("root-cause evidence resolution", () => {
     ).toEqual({ status: "invalid", links: [] });
   });
 
-  it("counts ineligible duplicate refs only in the assessment turn", () => {
+  it("counts duplicate refs across every turn up to the assessment", () => {
     const ref = evidenceRef("a", "b");
     const currentDuplicate = project(
       [tool("prior", "get_resource", deployment, { evidenceRef: ref })],
@@ -562,16 +580,16 @@ describe("root-cause evidence resolution", () => {
       ],
       [tool("current-only", "get_resource", deployment, { evidenceRef: ref })],
     );
+    // A server-issued ref names one payload in one scope; the same ref in two
+    // turns can only be a replay, so run-wide uniqueness is the rule — the
+    // same rule the server binds by.
     expect(
       resolveInvestigationRootCauseEvidence(
         priorDuplicateOnly,
         { status: "linked", refs: [ref] },
         1,
       ),
-    ).toMatchObject({
-      status: "linked",
-      links: [{ source: { stepId: "current-only" } }],
-    });
+    ).toEqual({ status: "invalid", links: [] });
   });
 
   it("rejects a replay that claims refs from different investigation scopes are linked", () => {

package/src/components/diagnose/investigationEvidence/identity.ts

@@ -189,7 +189,7 @@ export function resolveInvestigationRootCauseEvidence(
 
   const byRef = new Map<string, InvestigationEvidenceSource[]>();
   for (const source of projection.evidenceRefSources) {
-    if (source.turnIndex !== assessmentTurnIndex) continue;
+    if (source.turnIndex > assessmentTurnIndex) continue;
     if (!source.evidenceRef) continue;
     const matches = byRef.get(source.evidenceRef) ?? [];
     matches.push(source);
@@ -197,14 +197,14 @@ export function resolveInvestigationRootCauseEvidence(
   }
   const citableSourceIds = new Set(
     projection.citableSources
-      .filter((source) => source.turnIndex === assessmentTurnIndex)
+      .filter((source) => source.turnIndex <= assessmentTurnIndex)
       .map((source) => source.id),
   );
   const links: InvestigationRootCauseEvidenceLink[] = [];
   for (const ref of refs) {
     const matches = byRef.get(ref);
-    // Match the server's fail-closed binding: every current-turn occurrence
-    // counts before success/completeness eligibility is considered.
+    // Match the server's fail-closed binding: every occurrence up to this
+    // turn counts before success/completeness eligibility is considered.
     if (matches?.length !== 1 || !citableSourceIds.has(matches[0].id)) {
       return { status: "invalid", links: [] };
     }

package/src/components/diagnose/investigationEvidence/observations.ts

@@ -174,6 +174,7 @@ const INVESTIGATION_RESULT_LABELS: Readonly<Record<string, string>> = {
   issues: "Issue scan",
   get_resource: "Resource details",
   list_resources: "Resource inventory",
+  list_namespaces: "Namespace inventory",
   get_events: "Kubernetes events",
   get_pod_logs: "Container logs",
   get_changes: "Recent changes",
@@ -585,11 +586,34 @@ function resourceObservationSummary(
   if (context?.statusSummary?.phase) return context.statusSummary.phase;
   if (context?.issueSummary?.topReason) return context.issueSummary.topReason;
   return (
+    workloadReadinessFromResource(resource) ||
     investigationResourceEvidenceSummary(resource) ||
     warnings[0] ||
     resource.metadata.namespace
   );
 }
+
+// A workload read that carried no context still states its own readiness;
+// a row that names only its namespace says nothing.
+function workloadReadinessFromResource(
+  resource: InvestigationKubernetesResource,
+): string | undefined {
+  const spec = record(resource.spec);
+  const status = record(resource.status);
+  const count = (value: unknown): number | undefined =>
+    typeof value === "number" && Number.isFinite(value) ? value : undefined;
+  if (resource.kind === "Deployment" || resource.kind === "StatefulSet") {
+    const desired = count(spec?.replicas) ?? (spec ? 1 : undefined);
+    if (desired === undefined) return undefined;
+    return `${count(status?.readyReplicas) ?? 0}/${desired} replicas ready`;
+  }
+  if (resource.kind === "DaemonSet") {
+    const desired = count(status?.desiredNumberScheduled);
+    if (desired === undefined) return undefined;
+    return `${count(status?.numberReady) ?? 0}/${desired} pods ready`;
+  }
+  return undefined;
+}
 // A scaler that cannot act (no metrics, cannot read the target) or is pinned
 // at its ceiling is a captured Radar fact about the workload, so it lifts the
 // card the way an adverse condition does. Ordinary scale-ups and scale-downs

package/src/components/diagnose/investigationEvidence/projection.test.ts

@@ -510,9 +510,7 @@ describe("strict evidence adapters", () => {
     expect(groupsOf(result.groups, "events")[0].latest.relevance).toBe(
       "target",
     );
-    expect(groupsOf(result.groups, "issue")[0].latest.relevance).toBe(
-      "target",
-    );
+    expect(groupsOf(result.groups, "issue")[0].latest.relevance).toBe("target");
   });
 
   it("keeps colliding non-core plurals on their own API group", () => {
@@ -2701,3 +2699,38 @@ describe("live-run follow-ups", () => {
     expect(changes[1].latest.title).toBe("Recent changes · last 24h");
   });
 });
+
+describe("namespace listings", () => {
+  it("renders a list_namespaces result as an inventory card of Namespaces", () => {
+    const projection = projectInvestigationEvidence(
+      [
+        {
+          timeline: [
+            tool(
+              "namespaces",
+              "list_namespaces",
+              [
+                {
+                  name: "capi-system",
+                  status: "Terminating",
+                  labels: { a: "b" },
+                },
+                { name: "shop", status: "Active" },
+              ],
+              { summary: "{}" },
+            ),
+          ],
+        },
+      ],
+      { kind: "Deployment", group: "apps", namespace: "shop", name: "api" },
+    );
+    const card = projection.groups.find((group) => group.kind === "inventory");
+    expect(card?.latest.title).toBe("Namespaces");
+    expect(card?.latest.summary).toBe("2 returned");
+    expect(
+      card?.latest.data.type === "inventory"
+        ? card.latest.data.resources.map((r) => r.name)
+        : [],
+    ).toEqual(["capi-system", "shop"]);
+  });
+});

package/src/components/diagnose/investigationEvidence/types.ts

@@ -500,6 +500,8 @@ export interface InvestigationEvidenceProjection {
   /** Complete confirmed-success sources eligible for server-authored links. */
   citableSources: InvestigationEvidenceSource[];
   coverage: InvestigationEvidenceCoverage;
+  /** Pods a producer established as the target's own, by name. */
+  targetPods: string[];
 }
 export interface InvestigationRootCauseEvidenceLink {
   source: InvestigationEvidenceSource;

package/src/components/diagnose/investigationEvidencePresentation.test.ts

@@ -428,6 +428,8 @@ describe("coverage presentation", () => {
       limitation("Container logs", "Connection timed out", "error"),
     ]);
     expect(groups[0].hasError).toBe(true);
+    expect(groups[0].bookkeepingOnly).toBe(false);
+    expect(groups[1].bookkeepingOnly).toBe(true);
     expect(groups[0].summary).toContain("Forbidden");
     expect(groups[0].summary).toContain("Connection timed out");
     expect(groups[0].limitations).toHaveLength(3);

package/src/components/diagnose/investigationEvidencePresentation.ts

@@ -105,6 +105,8 @@ export interface EvidenceCoverageGroup {
   limitations: InvestigationEvidenceLimitation[];
   hasError: boolean;
   historyOnly: boolean;
+  /** Every entry is a sampling cap or a history bound: bookkeeping for the record, not an open question. */
+  bookkeepingOnly: boolean;
 }
 
 /** Group the presentation, not the underlying limitations or health qualification. */
@@ -158,6 +160,7 @@ export function groupEvidenceCoverage(
         limitations: entries,
         hasError: errors.length > 0,
         historyOnly,
+        bookkeepingOnly: ordinaryLimits,
       };
     })
     .sort(