@skyhook-io/radar-app 1.14.5 → 1.14.6

package/src/components/resources/ResourcesView.tsx

@@ -179,14 +179,14 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
 
   // Cluster Audit findings for the selected kind, keyed by "namespace/name" for
   // the resource list. The list shows ONE kind at a time, so ns/name is enough;
-  // we still match the finding's group (built-ins → real group, CRDs → "") so a
+  // we still match the finding's group for every resource so a
   // kind shared across groups doesn't bleed findings across the two lists. Only
   // "badge-worthy" findings count (reference-integrity / lifecycle) — posture
   // and best-practice nags fire near-universally and would just be noise.
   const audit = useAudit(namespaces)
   const auditBadges = useMemo(() => {
     if (!selectedKind || !audit.data?.findings) return undefined
-    const wantGroup = isSelectedCrd ? '' : selectedKind.group
+    const wantGroup = selectedKind.group
     const map: Record<string, { danger: number; warning: number; messages: AuditBadgeMessage[] }> = {}
     for (const f of audit.data.findings) {
       if (f.kind !== selectedKindCanonical || (f.group ?? '') !== wantGroup) continue
@@ -202,7 +202,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       cur.messages.sort((a, b) => (a.severity === 'danger' ? 0 : 1) - (b.severity === 'danger' ? 0 : 1))
     }
     return map
-  }, [audit.data?.findings, audit.data?.checks, selectedKind, selectedKindCanonical, isSelectedCrd])
+  }, [audit.data?.findings, audit.data?.checks, selectedKind, selectedKindCanonical])
 
   const selectedCountKey = selectedKind ? resourceCountKey(selectedKind) : ''
   const selectedCount = selectedCountKey ? countsData?.counts[selectedCountKey] : undefined

package/src/components/resources/renderers/CAPIClusterRenderer.tsx

@@ -0,0 +1,8 @@
+import { CAPIClusterRenderer as BaseCAPIClusterRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/CAPIClusterRenderer'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useCapabilities } from '../../../api/client'
+
+export function CAPIClusterRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const { data: capabilities } = useCapabilities()
+  return <BaseCAPIClusterRenderer data={data} onNavigate={onNavigate} canConnect={capabilities != null && capabilities.configManagement !== 'operator'} />
+}

package/src/components/resources/renderers/KueueWorkloadRenderer.test.tsx

@@ -0,0 +1,39 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { KueueWorkloadRenderer } from './KueueWorkloadRenderer'
+
+const mock = vi.hoisted(() => ({ query: {} as any }))
+vi.mock('../../../api/client', () => ({ useKueueProvisioning: () => mock.query }))
+const data = { metadata: { name: 'work', namespace: 'ml', uid: 'new' }, status: { admissionChecks: [{ name: 'capacity', state: 'Rejected', message: 'Capacity unavailable' }] } }
+const render = () => renderToStaticMarkup(<KueueWorkloadRenderer data={data} />)
+
+describe('Workload provisioning observation', () => {
+  beforeEach(() => { mock.query = {} })
+  it('never reports failed or old-generation lookups as an empty collection', () => {
+    mock.query = { error: new Error('no access to list ProvisioningRequests'), data: { uid: 'new', requests: [] } }
+    expect(render()).toContain('Could not observe')
+    expect(render()).not.toContain('No retained')
+    mock.query = { data: { uid: 'old', installed: true, requests: [{ metadata: { name: 'old-request' } }] } }
+    expect(render()).toContain('Looking for')
+    expect(render()).not.toContain('old-request')
+  })
+  it('keeps the rejected explanation when requests have already been cleaned up', () => {
+    mock.query = { data: { uid: 'new', installed: true, requests: [], total: 0 } }
+    expect(render()).toContain('Capacity unavailable')
+    expect(render()).toContain('may have been cleaned up')
+    mock.query.data.installed = false
+    expect(render()).toContain('API is not served')
+    expect(render()).not.toContain('No retained')
+  })
+  it('shows retained request state before PodSets without inferring check membership', () => {
+    mock.query = { data: { uid: 'new', installed: true, total: 21, truncated: true, requests: [{
+      metadata: { name: 'request-1', namespace: 'ml', uid: 'request-id' }, spec: { provisioningClassName: 'test.invalid' },
+      status: { conditions: [{ type: 'Failed', status: 'True', message: 'No capacity' }] },
+    }] } }
+    const html = render()
+    expect(html).toContain('request-1')
+    expect(html).toContain('Showing 1 of 21')
+    expect(html.indexOf('Provisioning Requests')).toBeLessThan(html.indexOf('Pod Sets'))
+    expect(html).toContain('not a retry history')
+  })
+})

package/src/components/resources/renderers/KueueWorkloadRenderer.tsx

@@ -0,0 +1,37 @@
+import { Boxes } from 'lucide-react'
+import { KueueWorkloadRenderer as BaseRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/KueueWorkloadRenderer'
+import { getProvisioningRequestStatus, getProvisioningRequestMessage } from '@skyhook-io/k8s-ui/components/resources/resource-utils-kueue'
+import { Badge, ResourceLink, Section, type ResourceRef } from '@skyhook-io/k8s-ui'
+import { useKueueProvisioning } from '../../../api/client'
+
+export function KueueWorkloadRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const namespace = data.metadata?.namespace ?? ''
+  const uid = data.metadata?.uid
+  const hasChecks = (data.status?.admissionChecks?.length ?? 0) > 0
+  const requests = useKueueProvisioning(namespace, data.metadata?.name ?? '', uid, hasChecks)
+  const current = requests.data?.uid === uid ? requests.data : undefined
+  const provisioning = hasChecks ? <Section title="Provisioning Requests" icon={Boxes} defaultExpanded>
+      {requests.error ? <p className="text-sm text-warning-text">Could not observe provisioning requests: {requests.error.message}</p>
+        : !current ? <p className="text-sm text-theme-text-tertiary">Looking for provisioning requests…</p>
+          : !current.installed ? <p className="text-sm text-theme-text-tertiary">The ProvisioningRequest API is not served by this cluster.</p>
+            : current.requests.length === 0 ? <p className="text-sm text-theme-text-tertiary">No retained provisioning requests found on this cluster. A request may not be needed or may have been cleaned up. Check results above retain the controller’s explanation; requests on a MultiKueue worker cluster are not included.</p>
+              : <div className="space-y-2">
+                <p className="text-xs text-theme-text-tertiary">Currently retained requests owned by this Workload, not a retry history. Requests may be removed after completion or eviction.</p>
+                {current.requests.map(request => {
+                  const status = getProvisioningRequestStatus(request)
+                  const message = getProvisioningRequestMessage(request)
+                  return <div key={request.metadata.uid} className="card-inner">
+                    <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+                      <ResourceLink kind="provisioningrequests" group="autoscaling.x-k8s.io" namespace={namespace} name={request.metadata.name} onNavigate={onNavigate} />
+                      <Badge colorClass={status.color} size="sm">{status.text}</Badge>
+                      {request.metadata.deletionTimestamp && <Badge severity="neutral" size="sm">Deleting</Badge>}
+                    </div>
+                    <p className="mt-1 break-all text-xs text-theme-text-tertiary">{request.spec.provisioningClassName}</p>
+                    {message && <p className="mt-1 whitespace-pre-wrap break-words text-sm text-theme-text-secondary">{message}</p>}
+                  </div>
+                })}
+                {current.truncated && <p className="text-xs text-theme-text-tertiary">Showing {current.requests.length} of {current.total} retained requests, newest first.</p>}
+              </div>}
+    </Section> : undefined
+  return <BaseRenderer data={data} onNavigate={onNavigate} provisioning={provisioning} />
+}

package/src/components/resources/renderers/RayClusterRenderer.test.tsx

@@ -0,0 +1,18 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RayClusterRenderer } from './RayClusterRenderer'
+const mock = vi.hoisted(() => ({ result: {} as any, calls: [] as any[] }))
+vi.mock('../../../api/client', () => ({ useWorkloadPods: (...args: any[]) => { mock.calls.push(args); return mock.result } }))
+const root = { apiVersion: 'ray.io/v1', kind: 'RayCluster', metadata: { name: 'cluster', namespace: 'ml', uid: 'current' } }
+describe('RayCluster host evidence', () => {
+  beforeEach(() => { mock.result = {}; mock.calls = [] })
+  it('makes one bounded UID-bound query with polling', () => {
+    renderToStaticMarkup(<RayClusterRenderer data={root} />)
+    expect(mock.calls).toEqual([['rayclusters', 'ml', 'cluster', { ownerUID: 'current', limit: 200, refetchInterval: 5000 }]])
+  })
+  it.each(['Forbidden', 'Cache warming', 'RayCluster was recreated'])('surfaces %s without claiming an empty cluster', message => {
+    mock.result = { error: new Error(message) }
+    const html = renderToStaticMarkup(<RayClusterRenderer data={root} />)
+    expect(html).toContain(message); expect(html).not.toContain('No directly owned Pods')
+  })
+})

package/src/components/resources/renderers/RayClusterRenderer.tsx

@@ -0,0 +1,17 @@
+import { useState } from 'react'
+import { RayClusterRenderer as BaseRenderer, type RayClusterPodSelection } from '@skyhook-io/k8s-ui/components/resources/renderers/RayClusterRenderer'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useWorkloadPods } from '../../../api/client'
+
+export function RayClusterRenderer(props: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  return <RayClusterEvidence key={props.data.metadata.uid} {...props} />
+}
+
+function RayClusterEvidence({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const [requestedSelection, setSelection] = useState<RayClusterPodSelection>({})
+  const selection = requestedSelection.workerGroup != null && !(data.spec?.workerGroupSpecs ?? []).some((group: any) => group.groupName === requestedSelection.workerGroup) ? {} : requestedSelection
+  const query = useWorkloadPods('rayclusters', data.metadata.namespace, data.metadata.uid ? data.metadata.name : '', {
+    ownerUID: data.metadata.uid, ...selection, limit: 200, refetchInterval: 5000,
+  })
+  return <BaseRenderer data={data} onNavigate={onNavigate} selection={selection} onSelectPods={setSelection} podEvidence={query.data} podsLoading={query.isLoading} podsError={query.error?.message} />
+}

package/src/components/resources/renderers/RayServiceRenderer.test.tsx

@@ -0,0 +1,69 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RayServiceRenderer } from './RayServiceRenderer'
+import { ApiError } from '../../../api/client'
+
+const mock = vi.hoisted(() => ({ queries: {} as Record<string, any>, reads: [] as any[] }))
+vi.mock('../../../api/client', () => ({
+  ApiError: class extends Error { constructor(message: string, public status: number) { super(message) } },
+  useResource: (...args: any[]) => { mock.reads.push(args); return mock.queries[args[2]] ?? {} },
+}))
+const root = { apiVersion: 'ray.io/v1', kind: 'RayService', metadata: { namespace: 'ml', name: 'serve', uid: 'root' }, status: { activeServiceStatus: { rayClusterName: 'active' }, pendingServiceStatus: { rayClusterName: 'pending' } } }
+const cluster = (name: string, extra = {}) => ({ apiVersion: 'ray.io/v1', kind: 'RayCluster', metadata: { namespace: 'ml', name, generation: 1, ownerReferences: [{ controller: true, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'root' }], ...extra }, status: { conditions: [{ type: 'HeadPodReady', status: 'False', reason: 'CrashLoopBackOff', message: 'Head container failed' }] } })
+const render = (data = root) => renderToStaticMarkup(<RayServiceRenderer data={data} />)
+
+describe('RayService runtime observation', () => {
+  beforeEach(() => { mock.queries = {}; mock.reads = [] })
+  it('makes only two exact named reads and reports direct pending failures', () => {
+    mock.queries.pending = { data: cluster('pending') }
+    const html = render()
+    expect(mock.reads).toEqual([['rayclusters', 'ml', 'active', 'ray.io'], ['rayclusters', 'ml', 'pending', 'ray.io']])
+    expect(html).toContain('Reading RayCluster status')
+    expect(html).toContain('Head container failed')
+  })
+  it.each([403, 500, 503])('shows %s read failure instead of empty/healthy runtime', status => {
+    mock.queries.pending = { error: new ApiError('Access unavailable', status), data: cluster('pending') }
+    const html = render()
+    expect(html).toContain('Could not read RayCluster: Access unavailable')
+    expect(html).not.toContain('Head container failed')
+  })
+  it('uses root freshness rather than unstamped RayCluster conditions', () => {
+    const data = cluster('pending')
+    mock.queries.pending = { data: { ...data, status: { observedGeneration: 1, conditions: [{ type: 'HeadPodReady', status: 'True', observedGeneration: 0 }] } } }
+    expect(render()).not.toContain('RayCluster status describes an earlier generation')
+    mock.queries.pending.data.metadata.generation = 2
+    expect(render()).toContain('RayCluster status describes an earlier generation')
+  })
+  it('treats missing and conditions-unreported as distinct observations', () => {
+    mock.queries.active = { error: new ApiError('Missing', 404) }
+    mock.queries.pending = { data: { ...cluster('pending'), status: {} } }
+    const html = render()
+    expect(html).toContain('may have been cleaned up')
+    expect(html).toContain('Runtime conditions are not reported')
+  })
+  it('does not attribute foreign, recreated or incorrectly owned children', () => {
+    for (const data of [
+      cluster('wrong-name'), cluster('pending', { namespace: 'other' }),
+      { ...cluster('pending'), apiVersion: 'foreign.io/v1' },
+      cluster('pending', { ownerReferences: [{ controller: true, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'old-root' }] }),
+      cluster('pending', { ownerReferences: [{ controller: false, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'root' }] }),
+    ]) {
+      mock.queries.pending = { data }
+      expect(render()).toContain('Runtime status is not attributed')
+      expect(render()).not.toContain('Head container failed')
+    }
+  })
+  it('accepts the same controller identity across served owner versions', () => {
+    const data = cluster('pending')
+    data.metadata.ownerReferences[0].apiVersion = 'ray.io/v1alpha1'
+    mock.queries.pending = { data }
+    expect(render()).toContain('Head container failed')
+  })
+  it('follows promotion and root recreation using current slot and owner identity', () => {
+    mock.queries.pending = { data: cluster('pending') }
+    const promoted = { ...root, status: { activeServiceStatus: { rayClusterName: 'pending' }, pendingServiceStatus: { rayClusterName: '' } } }
+    expect(render(promoted)).not.toContain('Pending Revision')
+    expect(mock.reads).toEqual([['rayclusters', 'ml', 'pending', 'ray.io']])
+    expect(render({ ...promoted, metadata: { ...root.metadata, uid: 'new-root' } })).toContain('Runtime status is not attributed')
+  })
+})

package/src/components/resources/renderers/RayServiceRenderer.tsx

@@ -0,0 +1,38 @@
+import { apiVersionToGroup } from '@skyhook-io/k8s-ui/utils/navigation'
+import { RayServiceRenderer as BaseRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/RayServiceRenderer'
+import { isRayObservationStale } from '@skyhook-io/k8s-ui/components/resources/resource-utils-ray'
+import { AlertBanner, ConditionsSection, type ConditionTone } from '@skyhook-io/k8s-ui/components/ui/drawer-components'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { ApiError, useResource } from '../../../api/client'
+
+function runtimeConditionTone(condition: any): ConditionTone {
+  if (!['True', 'False'].includes(condition.status)) return 'unknown'
+  if (condition.type === 'RayClusterReplicaFailure') return condition.status === 'True' ? 'fail' : 'unknown'
+  if (['HeadPodReady', 'RayClusterProvisioned'].includes(condition.type)) return condition.status === 'True' ? 'ok' : 'warning'
+  return 'unknown'
+}
+
+function RuntimeEvidence({ root, name }: { root: any; name: string }) {
+  const query = useResource<any>('rayclusters', root.metadata.namespace, name, 'ray.io')
+  if (query.error) return <AlertBanner variant="warning" title="Runtime evidence unavailable" message={query.error instanceof ApiError && query.error.status === 404 ? 'The named RayCluster was not found; it may have been cleaned up.' : `Could not read RayCluster: ${query.error.message}`} />
+  if (!query.data) return <p className="mt-2 text-sm text-theme-text-tertiary">Reading RayCluster status…</p>
+  const cluster = query.data
+  const owned = root.metadata.uid && cluster.apiVersion === 'ray.io/v1' && cluster.kind === 'RayCluster' && cluster.metadata?.namespace === root.metadata.namespace && cluster.metadata?.name === name && cluster.metadata.ownerReferences?.some((owner: any) => owner.controller === true && apiVersionToGroup(owner.apiVersion) === 'ray.io' && owner.kind === 'RayService' && owner.name === root.metadata.name && owner.uid === root.metadata.uid)
+  if (!owned) return <AlertBanner variant="warning" title="Runtime ownership mismatch" message="The named RayCluster does not report this RayService as its controller. Runtime status is not attributed to this revision." />
+  const conditions = (cluster.status?.conditions ?? []).filter((condition: any) => ['HeadPodReady', 'RayClusterProvisioned', 'RayClusterReplicaFailure', 'RayClusterSuspending', 'RayClusterSuspended'].includes(condition.type))
+  const stale = isRayObservationStale(cluster.metadata.generation, cluster.status?.observedGeneration)
+  return <div className="mt-2">
+    <p className="text-xs text-theme-text-tertiary">Directly observed RayCluster conditions, separate from the RayService application snapshot.</p>
+    {stale && <p className="mt-2 text-sm text-theme-text-secondary">RayCluster status describes an earlier generation.</p>}
+    {conditions.length === 0 ? <p className="mt-2 text-sm text-theme-text-secondary">Runtime conditions are not reported by this RayCluster.</p> : <ConditionsSection conditions={conditions} getConditionTone={condition => stale ? 'unknown' : runtimeConditionTone(condition)} defaultExpanded />}
+  </div>
+}
+
+export function RayServiceRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const active = data.status?.activeServiceStatus?.rayClusterName
+  const pending = data.status?.pendingServiceStatus?.rayClusterName
+  return <BaseRenderer data={data} onNavigate={onNavigate} runtimeEvidence={{
+    active: active ? <RuntimeEvidence root={data} name={active} /> : undefined,
+    pending: pending ? <RuntimeEvidence root={data} name={pending} /> : undefined,
+  }} />
+}

package/src/components/rightsizing/RightsizingScanView.tsx

@@ -48,6 +48,7 @@ export const RIGHTSIZING_EMBEDDED_METRICS_REQUIRED_BODY =
   `${RIGHTSIZING_METRICS_REQUIRED_BODY}\nConfigure metrics for this cluster in the host application or Radar deployment.`
 
 export type RightsizingScanSurfaceState =
+  | 'loading_scan'
   | 'discovering'
   | 'prometheus_required'
   | 'first_run'
@@ -57,6 +58,7 @@ export type RightsizingScanSurfaceState =
   | 'results'
 
 export function getRightsizingScanSurfaceState(input: {
+  scanLoading?: boolean
   statusLoading: boolean
   hasStatus: boolean
   connected: boolean
@@ -67,6 +69,7 @@ export function getRightsizingScanSurfaceState(input: {
 }): RightsizingScanSurfaceState {
   if (input.statusLoading && !input.hasStatus) return 'discovering'
   if (!input.connected) return 'prometheus_required'
+  if (input.scanLoading && !input.hasResult) return 'loading_scan'
   if (input.pending && !input.hasResult) return 'scanning'
   if (input.hasError && !input.hasResult) return 'fatal_error'
   if (!input.hasResult) return 'first_run'
@@ -185,6 +188,7 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
   const onlySystemRowsAreHidden = !includeSystem && rows.length > 0 && scopeRows.length === 0
   const surfaceState = getRightsizingScanSurfaceState({
     statusLoading,
+    scanLoading: scan.isLoading,
     hasStatus: Boolean(promStatus),
     connected: promStatus?.connected === true,
     pending: scan.isPending,
@@ -232,12 +236,12 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
             {result && (
               <button
                 type="button"
-                onClick={runScan}
-                disabled={scan.isPending}
+                onClick={scan.isPending ? scan.stop : runScan}
+                disabled={scan.isStarting || scan.isStopping}
                 className="btn-brand inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium"
               >
                 <RefreshCw className={`h-3.5 w-3.5 ${scan.isPending ? 'animate-spin' : ''}`} />
-                {scan.isPending ? 'Scanning…' : 'Run again'}
+                {scan.isStarting ? 'Starting…' : scan.isStopping ? 'Stopping…' : scan.isPending ? 'Stop scan' : 'Run again'}
               </button>
             )}
           </div>
@@ -280,25 +284,27 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               </div>
             }
           />
+        ) : surfaceState === 'loading_scan' ? (
+          <CenteredState loading title="Loading scan…" body="Checking for an existing scan in this cluster and namespace scope." />
         ) : surfaceState === 'first_run' ? (
           <FirstRunState namespaces={namespaces} onRun={runScan} />
         ) : surfaceState === 'scanning' ? (
           <CenteredState
             loading
             title="Analyzing CPU and memory requests…"
-            body="Comparing 7 days of CPU and memory usage with configured requests. Larger clusters can take up to a minute."
+            body="Comparing 7 days of CPU and memory usage with configured requests. Results appear as batches finish; scans run for up to three minutes."
           />
         ) : surfaceState === 'fatal_error' ? (
           <CenteredState
-            title="Rightsizing scan failed"
+            title={scan.statusError ? "Could not retrieve scan status" : "Rightsizing scan failed"}
             body={errorMessage(scan.error)}
             action={
               <button
                 type="button"
-                onClick={runScan}
+                onClick={scan.statusError ? () => void scan.retryStatus() : runScan}
                 className="btn-brand px-3 py-1.5 text-xs font-medium"
               >
-                Try again
+                {scan.statusError ? 'Retry status' : 'Try again'}
               </button>
             }
           />
@@ -310,7 +316,6 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               <button
                 type="button"
                 onClick={runScan}
-                disabled={scan.isPending}
                 className="btn-brand px-3 py-1.5 text-xs font-medium"
               >
                 Try again
@@ -319,16 +324,16 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
           />
         ) : result ? (
           <div
-            className={`flex flex-col gap-4 transition-opacity ${scan.isPending ? 'opacity-70' : ''}`}
+            className="flex flex-col gap-4"
           >
             {scan.error && (
-              <Notice
-                tone="warning"
-                text={`Refresh failed; showing results from ${formatScanTime(result.scannedAt)}. ${errorMessage(scan.error)}`}
-              />
+              <div className="flex items-center gap-3">
+                <Notice tone="warning" text={`${scan.statusError ? 'Could not retrieve scan status. The scan may still be running.' : 'Could not start or stop the scan.'} ${errorMessage(scan.error)}`} />
+                <button type="button" className="btn-brand-muted shrink-0 px-3 py-1.5 text-xs" onClick={() => void scan.retryStatus()}>Retry status</button>
+              </div>
             )}
             {scan.isPending && (
-              <Notice text="Scanning the current scope. Previous results remain visible until the scan completes." />
+              <Notice loading text={`${scan.progress?.coverage.workloadsDiscovered ? `Scanning — ${scan.progress.coverage.workloadsEvaluated} of ${scan.progress.coverage.workloadsDiscovered} workloads attempted.` : 'Preparing scan…'} Results and rankings update as batches finish. You can leave this page and return.${scan.showingPrevious ? ' Showing previous results until the first batch is ready.' : ''}`} />
             )}
             <ScanSummary
               namespaces={namespaces}
@@ -337,8 +342,10 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               selected={classFilter}
               onSelect={(value) => setFilter('rfClass', value === 'actions' ? undefined : value)}
             />
-            <ScanNotices key={result.scannedAt} result={result} />
-            {result.reason === 'only_daemonsets_without_nodes' ? (
+            {!scan.isPending && <ScanNotices key={result.scannedAt} result={result} />}
+            {scan.isPending && rows.length === 0 ? (
+              <CenteredState loading title="Preparing recommendations…" body="The scan is running. Recommendations appear after each batch finishes." />
+            ) : result.reason === 'only_daemonsets_without_nodes' ? (
               <EmptyState
                 variant="card"
                 headline="Only DaemonSets with no nodes in this scope"
@@ -369,7 +376,9 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
                   onClear={clearFilters}
                   active={activeFilters}
                 />
-                {filteredRows.length === 0 ? (
+                {filteredRows.length === 0 && scan.isPending ? (
+                  <EmptyState variant="card" headline="No matching results yet" body="The scan is still running. More workloads may match these filters as batches finish." />
+                ) : filteredRows.length === 0 ? (
                   <ScanEmptyState
                     counts={counts}
                     classFilter={classFilter}
@@ -571,7 +580,7 @@ export function ScanSummary({
       <div className="mt-3 flex flex-wrap items-center justify-between gap-2 text-xs text-theme-text-tertiary">
         <span>
           {result.coverage.workloadsEvaluated} of {result.coverage.workloadsDiscovered} workloads
-          attempted
+          attempted{result.scanStatus === 'running' ? ' so far' : ''}
           {' · '}
           {result.coverage.workloadsWithData} with usage data · {result.window} window
         </span>
@@ -624,7 +633,7 @@ export function ScanNotices({ result }: { result: ScanResult }) {
       `${pluralize(daemonSetsWithoutNodes, 'DaemonSet')} ${daemonSetsWithoutNodes === 1 ? 'runs' : 'run'} on no node right now and ${daemonSetsWithoutNodes === 1 ? 'is' : 'are'} not listed. Open one from Resources to see recommendations from its retained history.`,
     )
   const warnings = result.warnings ?? []
-  const deadlineExceeded = warnings.some((warning) => warning.code === 'scan_deadline_exceeded')
+  const deadlineExceeded = result.scanStatus === 'timed_out' || warnings.some((warning) => warning.code === 'scan_deadline_exceeded')
   for (const warning of warnings) {
     if (warning.code !== 'scan_deadline_exceeded') notices.push(warningMessage(warning.code))
   }
@@ -633,7 +642,7 @@ export function ScanNotices({ result }: { result: ScanResult }) {
   const details = [...new Set(notices)]
   const singleNote = details.length === 1 && !deadlineExceeded
   const hasDetails = details.length > 0 && !singleNote
-  const summary = singleNote
+  const summary = result.scanStatus === 'cancelled' ? 'Scan stopped. Available recommendations are shown. Run again to start a new scan.' : singleNote
     ? details[0]
     : deadlineExceeded
       ? 'The scan reached its time limit. Available recommendations are shown. For a narrower scan, select namespaces in the top bar and run again.'
@@ -677,12 +686,12 @@ export function ScanNotices({ result }: { result: ScanResult }) {
   )
 }
 
-function Notice({ text, tone }: { text: string; tone?: 'warning' }) {
+function Notice({ text, tone, loading }: { text: string; tone?: 'warning'; loading?: boolean }) {
   return (
     <div
       className={`flex items-start gap-2 rounded-lg border px-3 py-2 text-xs ${tone === 'warning' ? 'status-degraded' : 'border-theme-border bg-theme-surface text-theme-text-secondary'}`}
     >
-      <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+      {loading ? <Loader2 className="mt-0.5 h-3.5 w-3.5 shrink-0 animate-spin" /> : <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />}
       {text}
     </div>
   )
@@ -1089,6 +1098,9 @@ function unavailableMessage(reason?: string): string {
     return 'Deployment history cannot be mapped because kube_replicaset_owner is unavailable from kube-state-metrics.'
   if (reason === 'owner_metrics_query_failed')
     return 'Radar found Prometheus, but could not query kube-state-metrics ownership data.'
+  if (reason === 'scan_capacity_exceeded') return 'This scope is too large for one scan. Select fewer namespaces in the top bar and run again.'
+  if (reason === 'scan_cancelled') return 'The scan was stopped before any workloads were evaluated. Run again to start a new scan.'
+  if (reason === 'scan_deadline_exceeded') return 'The scan reached its three-minute time limit. Select fewer namespaces in the top bar and run again.'
   if (reason === 'scan_incomplete')
     return 'The scan could not evaluate any workloads in the current scope.'
   return 'Prometheus or kube-state-metrics does not expose the metrics required for this scan.'

package/src/components/rightsizing/copy.test.ts

@@ -60,6 +60,13 @@ describe('rightsizing scan copy', () => {
     ).toBe('fatal_error')
   })
 
+  it('waits for the retained scan lookup before offering a first run', () => {
+    expect(getRightsizingScanSurfaceState({
+      statusLoading: false, hasStatus: true, connected: true, scanLoading: true,
+      pending: false, hasResult: false, hasError: false,
+    })).toBe('loading_scan')
+  })
+
   it('does not auto-scan a connected first visit', () => {
     expect(
       getRightsizingScanSurfaceState({

package/src/components/rightsizing/model.test.ts

@@ -31,6 +31,7 @@ function response(
   scaledToZero = false,
 ): RightsizingScanResponse {
   return {
+    scanId: 'rs_test', scanStatus: 'finished', deadlineAt: '2026-09-19T10:03:00Z',
     state: 'complete',
     scannedAt: '2026-07-12T10:00:00Z',
     window: '7d',
@@ -40,7 +41,7 @@ function response(
       workloadsEvaluated: 1,
       workloadsWithData: 1,
       batches: 1,
-      completedBatches: 1,
+      attemptedBatches: 1, completedBatches: 1,
     },
     workloads: [
       {

package/src/components/rightsizing/notices.test.tsx

@@ -4,7 +4,8 @@ import type { RightsizingRow, RightsizingScanResponse } from '../../api/client'
 import { FitWhy, ScanNotices, ScanSummary } from './RightsizingScanView'
 
 const scan: RightsizingScanResponse = {
-  state: 'complete',
+  scanId: 'rs_test', scanStatus: 'finished', deadlineAt: '2026-09-19T10:03:00Z',
+    state: 'complete',
   scannedAt: '2026-09-19T06:52:54Z',
   window: '7d',
   source: 'radar',
@@ -13,7 +14,7 @@ const scan: RightsizingScanResponse = {
     workloadsEvaluated: 120,
     workloadsWithData: 47,
     batches: 3,
-    completedBatches: 3,
+    attemptedBatches: 3, completedBatches: 3,
   },
   workloads: [],
 }
@@ -30,7 +31,7 @@ describe('rightsizing scan notices', () => {
       coverage: {
         ...scan.coverage,
         workloadsEvaluated: 100,
-        completedBatches: 0,
+        attemptedBatches: 1, completedBatches: 0,
         daemonSetsWithoutNodes: 27,
       },
       warnings: ['cpu_query_failed', 'memory_query_failed', 'scan_deadline_exceeded'].map(

package/src/components/settings/OperatorManagedNotice.tsx

@@ -0,0 +1,17 @@
+import { Lock } from 'lucide-react'
+
+export function OperatorManagedNotice({ helmValue }: { helmValue?: string }) {
+  return (
+    <div className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-elevated/50 p-3 text-sm">
+      <Lock className="mt-0.5 h-4 w-4 shrink-0 text-theme-text-tertiary" />
+      <div className="min-w-0">
+        <p className="font-medium text-theme-text-primary">Managed by your operator</p>
+        <p className="mt-1 text-xs text-theme-text-secondary">
+          To change these settings, ask your operator to update {helmValue ? <><code className="font-mono">{helmValue}</code> in </> : null}
+          Radar’s Helm values or startup configuration.
+          {' '}<a className="text-accent hover:underline" href="https://github.com/skyhook-io/radar/blob/main/docs/in-cluster.md#installation-settings" target="_blank" rel="noreferrer">Configuration guide</a>
+        </p>
+      </div>
+    </div>
+  )
+}