@skyhook-io/radar-app 1.14.5 → 1.15.0

package/src/components/resources/renderers/RayJobRenderer.tsx

@@ -0,0 +1,45 @@
+import { Tooltip } from '@skyhook-io/k8s-ui/components/ui/Tooltip'
+import { Badge } from '@skyhook-io/k8s-ui/components/ui/Badge'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { RayJobRenderer as BaseRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/RayJobRenderer'
+import { rayJobIsLocal, rayJobSubmissionMode } from '@skyhook-io/k8s-ui/components/resources/resource-utils-ray'
+import { getJobStatus } from '@skyhook-io/k8s-ui/components/resources/resource-utils'
+import { apiVersionToGroup } from '@skyhook-io/k8s-ui/utils/navigation'
+import { formatRelativeAgeTime } from '@skyhook-io/k8s-ui/utils/format'
+import { AlertBanner, ResourceLink } from '@skyhook-io/k8s-ui/components/ui/drawer-components'
+import { ApiError, useResource } from '../../../api/client'
+import { KueueAdmission } from '../../execution/JobSetAdmission'
+
+function Submitter({ root, onNavigate }: { root: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const query = useResource<any>('jobs', root.metadata.namespace, root.metadata.name, 'batch')
+  if (query.error) return query.error instanceof ApiError && query.error.status === 404
+    ? <p className="text-theme-text-secondary">No submitter Job observed. It may not have been created yet or may have been cleaned up.</p>
+    : <AlertBanner variant="warning" title="Submitter evidence unavailable" message={query.error.message} />
+  if (!query.data) return <p className="text-theme-text-secondary">Reading submitter Job…</p>
+  const job = query.data
+  const owned = job.apiVersion === 'batch/v1' && job.kind === 'Job' && job.metadata?.name === root.metadata.name && job.metadata?.namespace === root.metadata.namespace && job.metadata.ownerReferences?.some((owner: any) => owner.controller === true && apiVersionToGroup(owner.apiVersion) === 'ray.io' && owner.kind === 'RayJob' && owner.name === root.metadata.name && owner.uid === root.metadata.uid)
+  if (!owned) return <AlertBanner variant="warning" title="Submitter ownership mismatch" message="The same-name Job does not report this RayJob incarnation as its controller. Its status is not attributed to this RayJob." />
+  const status = getJobStatus(job)
+  return <div className="space-y-2">
+    <div className="flex flex-wrap items-center gap-2"><ResourceLink kind="jobs" group="batch" namespace={job.metadata.namespace} name={job.metadata.name} onNavigate={onNavigate} />{job.metadata.deletionTimestamp ? <Badge severity="alert">Deleting</Badge> : <span className={`badge ${status.color}`}>{status.text}</span>}</div>
+    {job.metadata.creationTimestamp && <p className="text-xs text-theme-text-secondary">Created <Tooltip content={job.metadata.creationTimestamp}><time dateTime={job.metadata.creationTimestamp}>{formatRelativeAgeTime(job.metadata.creationTimestamp)}</time></Tooltip></p>}
+    <p className="text-xs text-theme-text-secondary">Open this Job for submitter Pods and logs. Ownership identifies the RayJob, not a particular attempt.</p>
+    {(job.metadata.deletionTimestamp || ['Retrying', 'Suspending'].includes(root.status?.jobDeploymentStatus)) && <p className="text-xs text-theme-text-secondary">The submitter may be part of the attempt being cleaned up.</p>}
+  </div>
+}
+
+function SelectedCluster({ namespace, name }: { namespace: string; name: string }) {
+  const query = useResource<any>('rayclusters', namespace, name, 'ray.io')
+  if (query.error) return <AlertBanner variant="warning" title="Selected cluster unavailable" message={query.error instanceof ApiError && query.error.status === 404 ? 'The selected existing RayCluster was not found. RayJob initialization requires that cluster.' : query.error.message} />
+  if (!query.data) return <p className="text-xs text-theme-text-secondary">Checking selected RayCluster…</p>
+  return <p className="text-xs text-theme-text-secondary">Selected RayCluster is present. It may be shared; its health is separate from this application.</p>
+}
+
+export function RayJobRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const local = rayJobIsLocal(data)
+  const selected = data.spec?.clusterSelector?.['ray.io/cluster']
+  return <BaseRenderer data={data} onNavigate={onNavigate}
+    admissionContent={<KueueAdmission resource={data} namespace={data.metadata.namespace} name={data.metadata.name} onNavigate={onNavigate} presentation="card" />}
+    submitterEvidence={local && rayJobSubmissionMode(data) === 'K8sJobMode' && data.metadata.uid ? <Submitter root={data} onNavigate={onNavigate} /> : undefined}
+    selectedClusterEvidence={local && selected ? <SelectedCluster namespace={data.metadata.namespace} name={selected} /> : undefined} />
+}

package/src/components/resources/renderers/RayServiceRenderer.test.tsx

@@ -0,0 +1,69 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RayServiceRenderer } from './RayServiceRenderer'
+import { ApiError } from '../../../api/client'
+
+const mock = vi.hoisted(() => ({ queries: {} as Record<string, any>, reads: [] as any[] }))
+vi.mock('../../../api/client', () => ({
+  ApiError: class extends Error { constructor(message: string, public status: number) { super(message) } },
+  useResource: (...args: any[]) => { mock.reads.push(args); return mock.queries[args[2]] ?? {} },
+}))
+const root = { apiVersion: 'ray.io/v1', kind: 'RayService', metadata: { namespace: 'ml', name: 'serve', uid: 'root' }, status: { activeServiceStatus: { rayClusterName: 'active' }, pendingServiceStatus: { rayClusterName: 'pending' } } }
+const cluster = (name: string, extra = {}) => ({ apiVersion: 'ray.io/v1', kind: 'RayCluster', metadata: { namespace: 'ml', name, generation: 1, ownerReferences: [{ controller: true, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'root' }], ...extra }, status: { conditions: [{ type: 'HeadPodReady', status: 'False', reason: 'CrashLoopBackOff', message: 'Head container failed' }] } })
+const render = (data = root) => renderToStaticMarkup(<RayServiceRenderer data={data} />)
+
+describe('RayService runtime observation', () => {
+  beforeEach(() => { mock.queries = {}; mock.reads = [] })
+  it('makes only two exact named reads and reports direct pending failures', () => {
+    mock.queries.pending = { data: cluster('pending') }
+    const html = render()
+    expect(mock.reads).toEqual([['rayclusters', 'ml', 'active', 'ray.io'], ['rayclusters', 'ml', 'pending', 'ray.io']])
+    expect(html).toContain('Reading RayCluster status')
+    expect(html).toContain('Head container failed')
+  })
+  it.each([403, 500, 503])('shows %s read failure instead of empty/healthy runtime', status => {
+    mock.queries.pending = { error: new ApiError('Access unavailable', status), data: cluster('pending') }
+    const html = render()
+    expect(html).toContain('Could not read RayCluster: Access unavailable')
+    expect(html).not.toContain('Head container failed')
+  })
+  it('uses root freshness rather than unstamped RayCluster conditions', () => {
+    const data = cluster('pending')
+    mock.queries.pending = { data: { ...data, status: { observedGeneration: 1, conditions: [{ type: 'HeadPodReady', status: 'True', observedGeneration: 0 }] } } }
+    expect(render()).not.toContain('RayCluster status describes an earlier generation')
+    mock.queries.pending.data.metadata.generation = 2
+    expect(render()).toContain('RayCluster status describes an earlier generation')
+  })
+  it('treats missing and conditions-unreported as distinct observations', () => {
+    mock.queries.active = { error: new ApiError('Missing', 404) }
+    mock.queries.pending = { data: { ...cluster('pending'), status: {} } }
+    const html = render()
+    expect(html).toContain('may have been cleaned up')
+    expect(html).toContain('Runtime conditions are not reported')
+  })
+  it('does not attribute foreign, recreated or incorrectly owned children', () => {
+    for (const data of [
+      cluster('wrong-name'), cluster('pending', { namespace: 'other' }),
+      { ...cluster('pending'), apiVersion: 'foreign.io/v1' },
+      cluster('pending', { ownerReferences: [{ controller: true, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'old-root' }] }),
+      cluster('pending', { ownerReferences: [{ controller: false, apiVersion: 'ray.io/v1', kind: 'RayService', name: 'serve', uid: 'root' }] }),
+    ]) {
+      mock.queries.pending = { data }
+      expect(render()).toContain('Runtime status is not attributed')
+      expect(render()).not.toContain('Head container failed')
+    }
+  })
+  it('accepts the same controller identity across served owner versions', () => {
+    const data = cluster('pending')
+    data.metadata.ownerReferences[0].apiVersion = 'ray.io/v1alpha1'
+    mock.queries.pending = { data }
+    expect(render()).toContain('Head container failed')
+  })
+  it('follows promotion and root recreation using current slot and owner identity', () => {
+    mock.queries.pending = { data: cluster('pending') }
+    const promoted = { ...root, status: { activeServiceStatus: { rayClusterName: 'pending' }, pendingServiceStatus: { rayClusterName: '' } } }
+    expect(render(promoted)).not.toContain('Pending Revision')
+    expect(mock.reads).toEqual([['rayclusters', 'ml', 'pending', 'ray.io']])
+    expect(render({ ...promoted, metadata: { ...root.metadata, uid: 'new-root' } })).toContain('Runtime status is not attributed')
+  })
+})

package/src/components/resources/renderers/RayServiceRenderer.tsx

@@ -0,0 +1,38 @@
+import { apiVersionToGroup } from '@skyhook-io/k8s-ui/utils/navigation'
+import { RayServiceRenderer as BaseRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/RayServiceRenderer'
+import { isRayObservationStale } from '@skyhook-io/k8s-ui/components/resources/resource-utils-ray'
+import { AlertBanner, ConditionsSection, type ConditionTone } from '@skyhook-io/k8s-ui/components/ui/drawer-components'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { ApiError, useResource } from '../../../api/client'
+
+function runtimeConditionTone(condition: any): ConditionTone {
+  if (!['True', 'False'].includes(condition.status)) return 'unknown'
+  if (condition.type === 'RayClusterReplicaFailure') return condition.status === 'True' ? 'fail' : 'unknown'
+  if (['HeadPodReady', 'RayClusterProvisioned'].includes(condition.type)) return condition.status === 'True' ? 'ok' : 'warning'
+  return 'unknown'
+}
+
+function RuntimeEvidence({ root, name }: { root: any; name: string }) {
+  const query = useResource<any>('rayclusters', root.metadata.namespace, name, 'ray.io')
+  if (query.error) return <AlertBanner variant="warning" title="Runtime evidence unavailable" message={query.error instanceof ApiError && query.error.status === 404 ? 'The named RayCluster was not found; it may have been cleaned up.' : `Could not read RayCluster: ${query.error.message}`} />
+  if (!query.data) return <p className="mt-2 text-sm text-theme-text-tertiary">Reading RayCluster status…</p>
+  const cluster = query.data
+  const owned = root.metadata.uid && cluster.apiVersion === 'ray.io/v1' && cluster.kind === 'RayCluster' && cluster.metadata?.namespace === root.metadata.namespace && cluster.metadata?.name === name && cluster.metadata.ownerReferences?.some((owner: any) => owner.controller === true && apiVersionToGroup(owner.apiVersion) === 'ray.io' && owner.kind === 'RayService' && owner.name === root.metadata.name && owner.uid === root.metadata.uid)
+  if (!owned) return <AlertBanner variant="warning" title="Runtime ownership mismatch" message="The named RayCluster does not report this RayService as its controller. Runtime status is not attributed to this revision." />
+  const conditions = (cluster.status?.conditions ?? []).filter((condition: any) => ['HeadPodReady', 'RayClusterProvisioned', 'RayClusterReplicaFailure', 'RayClusterSuspending', 'RayClusterSuspended'].includes(condition.type))
+  const stale = isRayObservationStale(cluster.metadata.generation, cluster.status?.observedGeneration)
+  return <div className="mt-2">
+    <p className="text-xs text-theme-text-tertiary">Directly observed RayCluster conditions, separate from the RayService application snapshot.</p>
+    {stale && <p className="mt-2 text-sm text-theme-text-secondary">RayCluster status describes an earlier generation.</p>}
+    {conditions.length === 0 ? <p className="mt-2 text-sm text-theme-text-secondary">Runtime conditions are not reported by this RayCluster.</p> : <ConditionsSection conditions={conditions} getConditionTone={condition => stale ? 'unknown' : runtimeConditionTone(condition)} defaultExpanded />}
+  </div>
+}
+
+export function RayServiceRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const active = data.status?.activeServiceStatus?.rayClusterName
+  const pending = data.status?.pendingServiceStatus?.rayClusterName
+  return <BaseRenderer data={data} onNavigate={onNavigate} runtimeEvidence={{
+    active: active ? <RuntimeEvidence root={data} name={active} /> : undefined,
+    pending: pending ? <RuntimeEvidence root={data} name={pending} /> : undefined,
+  }} />
+}

package/src/components/rightsizing/RightsizingScanView.tsx

@@ -48,6 +48,7 @@ export const RIGHTSIZING_EMBEDDED_METRICS_REQUIRED_BODY =
   `${RIGHTSIZING_METRICS_REQUIRED_BODY}\nConfigure metrics for this cluster in the host application or Radar deployment.`
 
 export type RightsizingScanSurfaceState =
+  | 'loading_scan'
   | 'discovering'
   | 'prometheus_required'
   | 'first_run'
@@ -57,6 +58,7 @@ export type RightsizingScanSurfaceState =
   | 'results'
 
 export function getRightsizingScanSurfaceState(input: {
+  scanLoading?: boolean
   statusLoading: boolean
   hasStatus: boolean
   connected: boolean
@@ -67,6 +69,7 @@ export function getRightsizingScanSurfaceState(input: {
 }): RightsizingScanSurfaceState {
   if (input.statusLoading && !input.hasStatus) return 'discovering'
   if (!input.connected) return 'prometheus_required'
+  if (input.scanLoading && !input.hasResult) return 'loading_scan'
   if (input.pending && !input.hasResult) return 'scanning'
   if (input.hasError && !input.hasResult) return 'fatal_error'
   if (!input.hasResult) return 'first_run'
@@ -185,6 +188,7 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
   const onlySystemRowsAreHidden = !includeSystem && rows.length > 0 && scopeRows.length === 0
   const surfaceState = getRightsizingScanSurfaceState({
     statusLoading,
+    scanLoading: scan.isLoading,
     hasStatus: Boolean(promStatus),
     connected: promStatus?.connected === true,
     pending: scan.isPending,
@@ -232,12 +236,12 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
             {result && (
               <button
                 type="button"
-                onClick={runScan}
-                disabled={scan.isPending}
+                onClick={scan.isPending ? scan.stop : runScan}
+                disabled={scan.isStarting || scan.isStopping}
                 className="btn-brand inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium"
               >
                 <RefreshCw className={`h-3.5 w-3.5 ${scan.isPending ? 'animate-spin' : ''}`} />
-                {scan.isPending ? 'Scanning…' : 'Run again'}
+                {scan.isStarting ? 'Starting…' : scan.isStopping ? 'Stopping…' : scan.isPending ? 'Stop scan' : 'Run again'}
               </button>
             )}
           </div>
@@ -280,25 +284,27 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               </div>
             }
           />
+        ) : surfaceState === 'loading_scan' ? (
+          <CenteredState loading title="Loading scan…" body="Checking for an existing scan in this cluster and namespace scope." />
         ) : surfaceState === 'first_run' ? (
           <FirstRunState namespaces={namespaces} onRun={runScan} />
         ) : surfaceState === 'scanning' ? (
           <CenteredState
             loading
             title="Analyzing CPU and memory requests…"
-            body="Comparing 7 days of CPU and memory usage with configured requests. Larger clusters can take up to a minute."
+            body="Comparing 7 days of CPU and memory usage with configured requests. Results appear as batches finish; scans run for up to three minutes."
           />
         ) : surfaceState === 'fatal_error' ? (
           <CenteredState
-            title="Rightsizing scan failed"
+            title={scan.statusError ? "Could not retrieve scan status" : "Rightsizing scan failed"}
             body={errorMessage(scan.error)}
             action={
               <button
                 type="button"
-                onClick={runScan}
+                onClick={scan.statusError ? () => void scan.retryStatus() : runScan}
                 className="btn-brand px-3 py-1.5 text-xs font-medium"
               >
-                Try again
+                {scan.statusError ? 'Retry status' : 'Try again'}
               </button>
             }
           />
@@ -310,7 +316,6 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               <button
                 type="button"
                 onClick={runScan}
-                disabled={scan.isPending}
                 className="btn-brand px-3 py-1.5 text-xs font-medium"
               >
                 Try again
@@ -319,16 +324,16 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
           />
         ) : result ? (
           <div
-            className={`flex flex-col gap-4 transition-opacity ${scan.isPending ? 'opacity-70' : ''}`}
+            className="flex flex-col gap-4"
           >
             {scan.error && (
-              <Notice
-                tone="warning"
-                text={`Refresh failed; showing results from ${formatScanTime(result.scannedAt)}. ${errorMessage(scan.error)}`}
-              />
+              <div className="flex items-center gap-3">
+                <Notice tone="warning" text={`${scan.statusError ? 'Could not retrieve scan status. The scan may still be running.' : 'Could not start or stop the scan.'} ${errorMessage(scan.error)}`} />
+                <button type="button" className="btn-brand-muted shrink-0 px-3 py-1.5 text-xs" onClick={() => void scan.retryStatus()}>Retry status</button>
+              </div>
             )}
             {scan.isPending && (
-              <Notice text="Scanning the current scope. Previous results remain visible until the scan completes." />
+              <Notice loading text={`${scan.progress?.coverage.workloadsDiscovered ? `Scanning — ${scan.progress.coverage.workloadsEvaluated} of ${scan.progress.coverage.workloadsDiscovered} workloads attempted.` : 'Preparing scan…'} Results and rankings update as batches finish. You can leave this page and return.${scan.showingPrevious ? ' Showing previous results until the first batch is ready.' : ''}`} />
             )}
             <ScanSummary
               namespaces={namespaces}
@@ -337,8 +342,10 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
               selected={classFilter}
               onSelect={(value) => setFilter('rfClass', value === 'actions' ? undefined : value)}
             />
-            <ScanNotices key={result.scannedAt} result={result} />
-            {result.reason === 'only_daemonsets_without_nodes' ? (
+            {!scan.isPending && <ScanNotices key={result.scannedAt} result={result} />}
+            {scan.isPending && rows.length === 0 ? (
+              <CenteredState loading title="Preparing recommendations…" body="The scan is running. Recommendations appear after each batch finishes." />
+            ) : result.reason === 'only_daemonsets_without_nodes' ? (
               <EmptyState
                 variant="card"
                 headline="Only DaemonSets with no nodes in this scope"
@@ -369,7 +376,9 @@ export function RightsizingScanView({ namespaces }: RightsizingScanViewProps) {
                   onClear={clearFilters}
                   active={activeFilters}
                 />
-                {filteredRows.length === 0 ? (
+                {filteredRows.length === 0 && scan.isPending ? (
+                  <EmptyState variant="card" headline="No matching results yet" body="The scan is still running. More workloads may match these filters as batches finish." />
+                ) : filteredRows.length === 0 ? (
                   <ScanEmptyState
                     counts={counts}
                     classFilter={classFilter}
@@ -571,7 +580,7 @@ export function ScanSummary({
       <div className="mt-3 flex flex-wrap items-center justify-between gap-2 text-xs text-theme-text-tertiary">
         <span>
           {result.coverage.workloadsEvaluated} of {result.coverage.workloadsDiscovered} workloads
-          attempted
+          attempted{result.scanStatus === 'running' ? ' so far' : ''}
           {' · '}
           {result.coverage.workloadsWithData} with usage data · {result.window} window
         </span>
@@ -624,7 +633,7 @@ export function ScanNotices({ result }: { result: ScanResult }) {
       `${pluralize(daemonSetsWithoutNodes, 'DaemonSet')} ${daemonSetsWithoutNodes === 1 ? 'runs' : 'run'} on no node right now and ${daemonSetsWithoutNodes === 1 ? 'is' : 'are'} not listed. Open one from Resources to see recommendations from its retained history.`,
     )
   const warnings = result.warnings ?? []
-  const deadlineExceeded = warnings.some((warning) => warning.code === 'scan_deadline_exceeded')
+  const deadlineExceeded = result.scanStatus === 'timed_out' || warnings.some((warning) => warning.code === 'scan_deadline_exceeded')
   for (const warning of warnings) {
     if (warning.code !== 'scan_deadline_exceeded') notices.push(warningMessage(warning.code))
   }
@@ -633,7 +642,7 @@ export function ScanNotices({ result }: { result: ScanResult }) {
   const details = [...new Set(notices)]
   const singleNote = details.length === 1 && !deadlineExceeded
   const hasDetails = details.length > 0 && !singleNote
-  const summary = singleNote
+  const summary = result.scanStatus === 'cancelled' ? 'Scan stopped. Available recommendations are shown. Run again to start a new scan.' : singleNote
     ? details[0]
     : deadlineExceeded
       ? 'The scan reached its time limit. Available recommendations are shown. For a narrower scan, select namespaces in the top bar and run again.'
@@ -677,12 +686,12 @@ export function ScanNotices({ result }: { result: ScanResult }) {
   )
 }
 
-function Notice({ text, tone }: { text: string; tone?: 'warning' }) {
+function Notice({ text, tone, loading }: { text: string; tone?: 'warning'; loading?: boolean }) {
   return (
     <div
       className={`flex items-start gap-2 rounded-lg border px-3 py-2 text-xs ${tone === 'warning' ? 'status-degraded' : 'border-theme-border bg-theme-surface text-theme-text-secondary'}`}
     >
-      <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+      {loading ? <Loader2 className="mt-0.5 h-3.5 w-3.5 shrink-0 animate-spin" /> : <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />}
       {text}
     </div>
   )
@@ -1089,6 +1098,9 @@ function unavailableMessage(reason?: string): string {
     return 'Deployment history cannot be mapped because kube_replicaset_owner is unavailable from kube-state-metrics.'
   if (reason === 'owner_metrics_query_failed')
     return 'Radar found Prometheus, but could not query kube-state-metrics ownership data.'
+  if (reason === 'scan_capacity_exceeded') return 'This scope is too large for one scan. Select fewer namespaces in the top bar and run again.'
+  if (reason === 'scan_cancelled') return 'The scan was stopped before any workloads were evaluated. Run again to start a new scan.'
+  if (reason === 'scan_deadline_exceeded') return 'The scan reached its three-minute time limit. Select fewer namespaces in the top bar and run again.'
   if (reason === 'scan_incomplete')
     return 'The scan could not evaluate any workloads in the current scope.'
   return 'Prometheus or kube-state-metrics does not expose the metrics required for this scan.'

package/src/components/rightsizing/copy.test.ts

@@ -60,6 +60,13 @@ describe('rightsizing scan copy', () => {
     ).toBe('fatal_error')
   })
 
+  it('waits for the retained scan lookup before offering a first run', () => {
+    expect(getRightsizingScanSurfaceState({
+      statusLoading: false, hasStatus: true, connected: true, scanLoading: true,
+      pending: false, hasResult: false, hasError: false,
+    })).toBe('loading_scan')
+  })
+
   it('does not auto-scan a connected first visit', () => {
     expect(
       getRightsizingScanSurfaceState({

package/src/components/rightsizing/model.test.ts

@@ -31,6 +31,7 @@ function response(
   scaledToZero = false,
 ): RightsizingScanResponse {
   return {
+    scanId: 'rs_test', scanStatus: 'finished', deadlineAt: '2026-09-19T10:03:00Z',
     state: 'complete',
     scannedAt: '2026-07-12T10:00:00Z',
     window: '7d',
@@ -40,7 +41,7 @@ function response(
       workloadsEvaluated: 1,
       workloadsWithData: 1,
       batches: 1,
-      completedBatches: 1,
+      attemptedBatches: 1, completedBatches: 1,
     },
     workloads: [
       {

package/src/components/rightsizing/notices.test.tsx

@@ -4,7 +4,8 @@ import type { RightsizingRow, RightsizingScanResponse } from '../../api/client'
 import { FitWhy, ScanNotices, ScanSummary } from './RightsizingScanView'
 
 const scan: RightsizingScanResponse = {
-  state: 'complete',
+  scanId: 'rs_test', scanStatus: 'finished', deadlineAt: '2026-09-19T10:03:00Z',
+    state: 'complete',
   scannedAt: '2026-09-19T06:52:54Z',
   window: '7d',
   source: 'radar',
@@ -13,7 +14,7 @@ const scan: RightsizingScanResponse = {
     workloadsEvaluated: 120,
     workloadsWithData: 47,
     batches: 3,
-    completedBatches: 3,
+    attemptedBatches: 3, completedBatches: 3,
   },
   workloads: [],
 }
@@ -30,7 +31,7 @@ describe('rightsizing scan notices', () => {
       coverage: {
         ...scan.coverage,
         workloadsEvaluated: 100,
-        completedBatches: 0,
+        attemptedBatches: 1, completedBatches: 0,
         daemonSetsWithoutNodes: 27,
       },
       warnings: ['cpu_query_failed', 'memory_query_failed', 'scan_deadline_exceeded'].map(

package/src/components/settings/OperatorManagedNotice.tsx

@@ -0,0 +1,17 @@
+import { Lock } from 'lucide-react'
+
+export function OperatorManagedNotice({ helmValue }: { helmValue?: string }) {
+  return (
+    <div className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-elevated/50 p-3 text-sm">
+      <Lock className="mt-0.5 h-4 w-4 shrink-0 text-theme-text-tertiary" />
+      <div className="min-w-0">
+        <p className="font-medium text-theme-text-primary">Managed by your operator</p>
+        <p className="mt-1 text-xs text-theme-text-secondary">
+          To change these settings, ask your operator to update {helmValue ? <><code className="font-mono">{helmValue}</code> in </> : null}
+          Radar’s Helm values or startup configuration.
+          {' '}<a className="text-accent hover:underline" href="https://github.com/skyhook-io/radar/blob/main/docs/in-cluster.md#installation-settings" target="_blank" rel="noreferrer">Configuration guide</a>
+        </p>
+      </div>
+    </div>
+  )
+}

package/src/components/settings/PrivacySection.test.tsx

@@ -0,0 +1,84 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { renderToString } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import type { UsageDataStatus } from '../../api/usage-data'
+import { exampleReport, exampleStatus } from '../../api/usage-data.fixtures'
+
+let current: UsageDataStatus
+
+vi.mock('../../api/usage-data', async (orig) => ({
+  ...(await orig<typeof import('../../api/usage-data')>()),
+  useUsageData: () => ({ data: current, isLoading: false, error: null }),
+  useSetUsageData: () => ({ mutate: vi.fn(), isPending: false }),
+}))
+
+import { PrivacySection } from './PrivacySection'
+
+function make(patch: Partial<UsageDataStatus>): UsageDataStatus {
+  return exampleStatus({ preview: exampleReport({ views: { topology: 3 } }), ...patch })
+}
+
+function render(status: UsageDataStatus) {
+  current = status
+  return renderToString(
+    <QueryClientProvider client={new QueryClient()}>
+      <PrivacySection active />
+    </QueryClientProvider>,
+  )
+}
+
+describe('PrivacySection', () => {
+  it('shows an example report and promises nothing is sent while off', () => {
+    const html = render(make({}))
+    expect(html).toContain('See an example report')
+    expect(html).toContain('What isn')
+    expect(html).not.toContain('usage-report.json')
+    expect(html).toContain('aria-checked="false"')
+  })
+
+  it('shows the pending report and where it lives once on', () => {
+    const html = render(make({ state: 'on', source: 'user', nextReportAt: '2026-09-30T12:00:00Z' }))
+    expect(html).toContain('See the next report')
+    expect(html).toContain('usage-report.json')
+    expect(html).toContain('&quot;topology&quot;: 3')
+  })
+
+  it('names the control that fixed the choice', () => {
+    expect(render(make({ state: 'off', source: 'deployment', canChange: false }))).toContain('Radar Cloud manages')
+    const helm = make({ state: 'on', source: 'env', canChange: false, shared: true })
+    expect(render({ ...helm, preview: { ...helm.preview, mode: 'in-cluster' } })).toContain('Helm value usageReporting.enabled')
+    expect(render(make({ state: 'off', source: 'env', canChange: false }))).toContain('RADAR_USAGE_REPORTING=off')
+  })
+})
+
+describe('PrivacySection intro', () => {
+  it('does not claim data stays on this machine for an in-cluster install', () => {
+    const base = make({ state: 'off', source: 'deployment', canChange: false })
+    const html = render({ ...base, preview: { ...base.preview, mode: 'in-cluster' } })
+    expect(html).toContain('from inside it')
+    expect(html).not.toContain('from this machine')
+  })
+})
+
+describe('PrivacySection on a shared Radar', () => {
+  it('points at the Helm value while nothing set it', () => {
+    const base = make({ shared: true, canChange: false })
+    const html = render({ ...base, preview: { ...base.preview, mode: 'in-cluster' } })
+    expect(html).toContain('Applies to everyone using this Radar.')
+    expect(html).toContain('usageReporting.enabled')
+    expect(html).toContain('aria-checked="false"')
+  })
+
+  it('uses the environment variable outside a cluster', () => {
+    expect(render(make({ shared: true, canChange: false }))).toContain('RADAR_USAGE_REPORTING=on')
+  })
+})
+
+describe('PrivacySection storage and log wording', () => {
+  it('says logs, not sends, for development builds', () => {
+    const html = render(make({ state: 'on', source: 'user', developmentBuild: true, nextReportAt: '2026-09-25T12:00:00Z' }))
+    expect(html).toContain('logs')
+    expect(html).toContain('reports go to the log, never sent')
+    expect(render(make({ state: 'on', source: 'user', nextReportAt: '2026-09-25T12:00:00Z' }))).toContain('sends')
+  })
+})