From 0bc522a8c5400e9d2626130b982a26060c288ea5 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 00:55:12 +0300
Subject: [PATCH 01/26] Move the workspace building blocks out of CloudNativePG

Facts, sections and the problem list become components/workspace in
k8s-ui (Fact, FactGrid/Row/Value/Source, SectionHeading, FoldSection,
FoldSummary, WorkspaceProblem with a rootKind prop, OpenIssueContext),
RefLink moves to ui/ on the existing ResourceRef type, and toneTextClass
and worseTone join toneFillClass in ui/status-tone. CloudNativePG keeps its
categories, ordering, wording and builders, and binds WorkspaceProblem to
its own categories.

Badges read health through healthToSeverity like the rest of the app, and
secondary buttons use a new .btn-secondary class instead of hand-rolled
class strings.
---
 DESIGN.md                                     |   1 +
 .../src/components/cnpg/CNPGBackupSummary.tsx |  14 +-
 .../components/cnpg/CNPGClusterHASection.tsx  |  11 +-
 .../cnpg/CNPGClusterSummary.test.tsx          |   6 +-
 .../components/cnpg/CNPGClusterSummary.tsx    |  40 +--
 .../components/cnpg/CNPGConnectSection.tsx    |   9 +-
 .../cnpg/CNPGDeclarativeSummary.tsx           |  29 +-
 .../cnpg/CNPGImageCatalogSummary.tsx          |  10 +-
 .../src/components/cnpg/CNPGLogicalPath.tsx   |  12 +-
 .../cnpg/CNPGObjectStoreSummary.tsx           |  14 +-
 .../src/components/cnpg/CNPGPoolerSummary.tsx |  16 +-
 .../src/components/cnpg/CNPGSharedSummary.tsx |  13 +-
 packages/k8s-ui/src/components/cnpg/ha.ts     |  21 +-
 .../src/components/cnpg/logicalReplication.ts |   8 +-
 .../k8s-ui/src/components/cnpg/primitives.tsx | 258 +-----------------
 .../k8s-ui/src/components/cnpg/relations.ts   |  38 +--
 .../k8s-ui/src/components/cnpg/workspace.ts   | 101 ++-----
 packages/k8s-ui/src/components/ui/RefLink.tsx |  20 ++
 packages/k8s-ui/src/components/ui/index.ts    |   4 +-
 .../src/components/ui/status-tone.test.ts     |  11 +-
 .../k8s-ui/src/components/ui/status-tone.tsx  |  25 ++
 .../facts.test.tsx}                           |   2 +-
 .../k8s-ui/src/components/workspace/facts.tsx |  60 ++++
 .../k8s-ui/src/components/workspace/index.ts  |   5 +
 .../components/workspace/problems.test.tsx    |  26 ++
 .../src/components/workspace/problems.tsx     | 175 ++++++++++++
 .../src/components/workspace/sections.tsx     |  63 +++++
 packages/k8s-ui/src/index.ts                  |   5 +-
 packages/k8s-ui/src/theme/components.css      |  15 +
 web/src/components/cnpg/CNPGDetailPage.tsx    |   2 +-
 web/src/components/cnpg/CNPGOverview.tsx      |   6 +-
 web/src/components/cnpg/CNPGStorage.tsx       |   2 +-
 web/src/components/cnpg/CNPGSummaryHost.tsx   |  24 +-
 .../cnpg/actions/CNPGClusterActions.tsx       |   6 +-
 .../cnpg/actions/CNPGConnectButton.tsx        |   6 +-
 .../cnpg/actions/CNPGPoolerActions.tsx        |   2 +-
 .../cnpg/actions/CNPGScheduleActions.tsx      |   2 +-
 web/src/components/cnpg/baseBackup.ts         |   4 +-
 .../cnpg/operations/CNPGOperationTracker.tsx  |   2 +-
 .../cnpg/recovery/CNPGRestoreButton.tsx       |   2 +-
 web/src/components/cnpg/runtimeModel.ts       |   6 +-
 41 files changed, 576 insertions(+), 500 deletions(-)
 create mode 100644 packages/k8s-ui/src/components/ui/RefLink.tsx
 rename packages/k8s-ui/src/components/{cnpg/primitives.test.tsx => workspace/facts.test.tsx} (94%)
 create mode 100644 packages/k8s-ui/src/components/workspace/facts.tsx
 create mode 100644 packages/k8s-ui/src/components/workspace/index.ts
 create mode 100644 packages/k8s-ui/src/components/workspace/problems.test.tsx
 create mode 100644 packages/k8s-ui/src/components/workspace/problems.tsx
 create mode 100644 packages/k8s-ui/src/components/workspace/sections.tsx

diff --git a/DESIGN.md b/DESIGN.md
index 0241ad5e62..d33301fa08 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -100,6 +100,7 @@ Standard Tailwind type scale. No custom sizes or tracking. Use Tailwind utilitie
 | `.btn-brand` | Primary CTAs — brand-colored bg, white text, 10px radius |
 | `.btn-brand-muted` | Secondary brand actions — dimmed brand bg, white text |
 | `.btn-brand-toggle` | Toggle buttons — 50% brand bg, primary text |
+| `.btn-secondary` | Secondary actions beside a `.btn-brand` — bordered surface bg, primary text, 10px radius |
 
 Hover/disabled states are built into the classes. For non-brand buttons, use shadcn/ui `<Button>` variants.
 
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
index ad1f2bfb38..b54e282b8a 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
@@ -9,7 +9,6 @@ import {
 import type { CNPGWorkspaceResponse } from './workspace'
 import { cnpgScheduleBasisNote, formatCNPGRunTime, type CNPGSchedulePreview } from './schedule'
 import { Tooltip } from '../ui/Tooltip'
-import { FactGrid, FactRow, RefLink, SummaryHeading, toneTextClass, type CNPGNavigate } from './primitives'
 import { ClusterLink, NotReported, Note, ObjectProblems, PhaseBadge, SummaryShell, TimeAgo } from './CNPGSharedSummary'
 import {
   backupDestination,
@@ -21,11 +20,14 @@ import {
   scheduledBackupOf,
   workspaceList,
 } from './relations'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, SectionHeading } from '../workspace'
 
 interface SummaryProps {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }
 
 const RECENT_RUNS = 5
@@ -89,7 +91,7 @@ export function CNPGBackupSummary({ resource, workspace, onNavigate }: SummaryPr
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'Backup')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Outcome</SummaryHeading>
+      <SectionHeading>Outcome</SectionHeading>
       <FactGrid>
         <FactRow label="Phase">
           <PhaseBadge status={status} />
@@ -111,7 +113,7 @@ export function CNPGBackupSummary({ resource, workspace, onNavigate }: SummaryPr
         )}
       </FactGrid>
 
-      <SummaryHeading>Relationships</SummaryHeading>
+      <SectionHeading>Relationships</SectionHeading>
       <FactGrid>
         <FactRow label="Cluster">
           <ClusterLink resource={resource} workspace={workspace} onNavigate={onNavigate} />
@@ -204,7 +206,7 @@ export function CNPGScheduledBackupSummary({
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'ScheduledBackup')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Schedule</SummaryHeading>
+      <SectionHeading>Schedule</SectionHeading>
       <FactGrid>
         <FactRow label="Status">
           <PhaseBadge status={getCNPGScheduledBackupStatus(resource)} />
@@ -230,7 +232,7 @@ export function CNPGScheduledBackupSummary({
         <FactRow label="Method">{methodText(resource) ?? 'Barman object store (in-tree) · default'}</FactRow>
       </FactGrid>
 
-      <SummaryHeading hint={runs.length > shown.length ? `${shown.length} of ${runs.length}` : undefined}>Recent runs</SummaryHeading>
+      <SectionHeading hint={runs.length > shown.length ? `${shown.length} of ${runs.length}` : undefined}>Recent runs</SectionHeading>
       {runsUnavailable ? (
         <div className="text-sm">
           <NotReported text={runsUnavailable} />
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
index 467612c582..985abc8c1b 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
@@ -2,7 +2,7 @@ import { clsx } from 'clsx'
 import { Badge } from '../ui/Badge'
 import { Tooltip } from '../ui/Tooltip'
 import { formatAge } from '../resources/resource-utils'
-import { FactGrid, FactRow, FactValue, FoldSection, PrimaryConflictNote, RefLink, SummaryHeading, ToneDot, toneTextClass, type CNPGNavigate } from './primitives'
+import { PrimaryConflictNote } from './primitives'
 import {
   CNPG_ROLE_DETAIL_TEXT,
   cnpgCertificateViews,
@@ -21,6 +21,9 @@ import {
   type CNPGHALease,
   type CNPGInstanceLive,
 } from './ha'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { StatusDot, toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactValue, FoldSection, SectionHeading } from '../workspace'
 
 function Unknown({ text }: { text: string }) {
   return <span className="text-theme-text-tertiary">{text}</span>
@@ -75,12 +78,12 @@ export function CNPGClusterHASection({
   liveUnavailable?: string
   loading?: boolean
   error?: string
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }) {
   if (!ha) {
     return (
       <>
-        <SummaryHeading>HA and instances</SummaryHeading>
+        <SectionHeading>HA and instances</SectionHeading>
         <div className="text-sm text-theme-text-tertiary">{loading ? 'Reading HA facts…' : `HA facts could not be read${error ? `: ${error}` : ''}`}</div>
       </>
     )
@@ -142,7 +145,7 @@ export function CNPGClusterHASection({
                   const l = liveBy.get(i.pod)
                   return (
                     <div key={i.pod} className="flex flex-wrap items-center gap-x-2 gap-y-0.5 text-xs">
-                      <ToneDot tone={i.ready ? 'healthy' : 'unhealthy'} />
+                      <StatusDot tone={i.ready ? 'healthy' : 'unhealthy'} />
                       <RefLink refTo={{ kind: 'Pod', group: '', namespace: ns, name: i.pod }} onNavigate={onNavigate} mono />
                       <span className="text-theme-text-secondary">
                         {l?.roleDetail ? CNPG_ROLE_DETAIL_TEXT[l.roleDetail] : i.role === 'unknown' ? 'role unknown' : i.role}
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
index ed7a14d49c..525081f069 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
@@ -3,9 +3,9 @@ import { act, type ReactNode } from 'react'
 import { createRoot } from 'react-dom/client'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { CNPGClusterSummary } from './CNPGClusterSummary'
-import { CNPGOpenIssueContext } from './primitives'
 import type { CNPGFleetRow, CNPGProblem } from './workspace'
 import type { CNPGDimension } from './ha'
+import { OpenIssueContext } from '../workspace'
 
 ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
 
@@ -130,9 +130,9 @@ describe('problem provenance', () => {
       attention: true,
     })
     const root = render(
-      <CNPGOpenIssueContext.Provider value={open}>
+      <OpenIssueContext.Provider value={open}>
         <CNPGClusterSummary row={r} />
-      </CNPGOpenIssueContext.Provider>,
+      </OpenIssueContext.Provider>,
     )
     expect(document.body.textContent).toContain('Reported by CNPG')
     expect(document.body.textContent).not.toContain('Radar issue')
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
index 63eaf84ffb..b05b1be21a 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
@@ -1,27 +1,16 @@
 import { useState, type ReactNode } from 'react'
 import { clsx } from 'clsx'
 import { Badge } from '../ui/Badge'
+import { healthToSeverity } from '../../utils/badge-colors'
 import { Tooltip } from '../ui/Tooltip'
 import { Collapse, CollapseChevron, useDisclosure } from '../ui/Collapse'
 import { CNPG_BARMAN_OBJECTSTORE_GROUP, CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import { cnpgReadyInstances, type CNPGFleetRow, type CNPGInstance } from './workspace'
 import type { CNPGDimension } from './ha'
-import {
-  FactGrid,
-  FactRow,
-  FactSource,
-  FactValue,
-  PrimaryConflictNote,
-  ProblemCallout,
-  ProblemList,
-  RefLink,
-  SummaryHeading,
-  ToneDot,
-  toneTextClass,
-  CNPG_PRIMARY_BUTTON,
-  CNPG_SECONDARY_BUTTON,
-  type CNPGNavigate,
-} from './primitives'
+import { PrimaryConflictNote } from './primitives'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { StatusDot, toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactSource, FactValue, ProblemCallout, ProblemList, SectionHeading } from '../workspace'
 
 function ReadyCount({ row }: { row: CNPGFleetRow }) {
   const r = cnpgReadyInstances(row)
@@ -41,7 +30,7 @@ export interface CNPGSummaryAction {
   primary?: boolean
 }
 
-function InstancePill({ pod, namespace, onNavigate }: { pod: CNPGInstance; namespace: string; onNavigate?: CNPGNavigate }) {
+function InstancePill({ pod, namespace, onNavigate }: { pod: CNPGInstance; namespace: string; onNavigate?: NavigateToRef }) {
   const tone = pod.ready === true ? 'healthy' : pod.ready === false ? 'unhealthy' : 'unknown'
   const role = pod.role === 'primary' ? 'Primary' : pod.role === 'replica' ? 'Replica' : 'Role unknown'
   const readiness = pod.ready === true ? 'Ready' : pod.ready === false ? 'Not ready' : 'Readiness unknown'
@@ -55,7 +44,7 @@ function InstancePill({ pod, namespace, onNavigate }: { pod: CNPGInstance; names
           onNavigate ? 'hover:border-accent' : 'cursor-default',
         )}
       >
-        <ToneDot tone={tone} />
+        <StatusDot tone={tone} />
         <span className="font-mono">{pod.name}</span>
         <span className="text-theme-text-tertiary">{pod.role === 'primary' ? 'P' : pod.role === 'replica' ? 'R' : '?'}</span>
       </button>
@@ -71,7 +60,7 @@ function DimensionChips({ dimensions, onSelect }: { dimensions: CNPGDimension[];
       {dimensions.map((d) => {
         const body = (
           <>
-            <ToneDot tone={d.tone} />
+            <StatusDot tone={d.tone} />
             <span className="text-theme-text-secondary">{d.label}</span>
             <span className={toneTextClass(d.tone)}>{d.text}</span>
           </>
@@ -127,7 +116,7 @@ export function CNPGClusterSummary({
   stateFacts,
 }: {
   row: CNPGFleetRow
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
   actions?: CNPGSummaryAction[]
   /** Link to the complete list of this cluster's findings, shown when more than one exists. */
   problemsLink?: (count: number) => ReactNode
@@ -159,6 +148,7 @@ export function CNPGClusterSummary({
       {dimensions && dimensions.length > 0 && <DimensionChips dimensions={dimensions} onSelect={onSelectDimension} />}
       {top && (
         <ProblemCallout
+          rootKind="Cluster"
           problem={top}
           onNavigate={onNavigate}
           more={
@@ -173,7 +163,7 @@ export function CNPGClusterSummary({
       {top && rest > 0 && !problemsLink && (
         <Collapse open={showRest} id={restDisclosure.panelId}>
           <div className="mb-4 rounded-lg border border-theme-border bg-theme-base p-3">
-            <ProblemList problems={row.problems.slice(1)} onNavigate={onNavigate} />
+            <ProblemList rootKind="Cluster" problems={row.problems.slice(1)} onNavigate={onNavigate} />
           </div>
         </Collapse>
       )}
@@ -181,18 +171,18 @@ export function CNPGClusterSummary({
       {actions && actions.length > 0 && (
         <div className="mb-4 flex flex-wrap gap-2">
           {actions.map((a) => (
-            <button key={a.label} type="button" onClick={a.onClick} className={a.primary ? CNPG_PRIMARY_BUTTON : CNPG_SECONDARY_BUTTON}>
+            <button key={a.label} type="button" onClick={a.onClick} className={clsx(a.primary ? 'btn-brand' : 'btn-secondary', 'inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-3 py-1.5 text-sm font-medium')}>
               {a.label}
             </button>
           ))}
         </div>
       )}
 
-      <SummaryHeading>State</SummaryHeading>
+      <SectionHeading>State</SectionHeading>
       <FactGrid>
         <FactRow label="Controller phase">
           <span className="inline-flex flex-wrap items-center gap-2">
-            <Badge severity={row.controllerStatus.level === 'healthy' ? 'success' : row.controllerStatus.level === 'unhealthy' ? 'error' : row.controllerStatus.level === 'degraded' || row.controllerStatus.level === 'alert' ? 'warning' : 'neutral'} size="sm">
+            <Badge severity={healthToSeverity(row.controllerStatus.level)} size="sm">
               {row.controllerStatus.text}
             </Badge>
             <span className="text-xs text-theme-text-tertiary">
@@ -271,7 +261,7 @@ export function CNPGClusterSummary({
         {stateFacts}
       </FactGrid>
 
-      <SummaryHeading>Protection</SummaryHeading>
+      <SectionHeading>Protection</SectionHeading>
       <FactGrid>
         <FactRow label="Schedule">
           <FactValue fact={p.schedule} />
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx b/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
index 8c40184de5..04174a58fa 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
@@ -3,7 +3,8 @@ import { Check, Copy } from 'lucide-react'
 import { Tooltip } from '../ui/Tooltip'
 import { CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import { cnpgConnectionURI, cnpgConnectInfo, cnpgPsqlCommand, type CNPGConnectEndpoint } from './connect'
-import { FactGrid, FactRow, RefLink, SummaryHeading, type CNPGNavigate } from './primitives'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { FactGrid, FactRow, SectionHeading } from '../workspace'
 
 function CopyButton({ text, label }: { text: string; label: string }) {
   const [copied, setCopied] = useState(false)
@@ -57,8 +58,6 @@ const ROLE_LABEL: Record<CNPGConnectEndpoint['role'], string> = {
  * id: a drawer summary can sit over a page summary of the same kind, so a host
  * scrolls to it within its own summary's element.
  */
-export const CNPG_CONNECT_SELECTOR = '[data-cnpg-anchor="connect"]'
-
 export function CNPGConnectSection({
   cluster,
   poolers,
@@ -70,7 +69,7 @@ export function CNPGConnectSection({
   poolers?: any[]
   /** False when Poolers could not be listed, so a Pooler may exist that is not shown. */
   poolersKnown?: boolean
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
   /** False where the host already titles it (e.g. the Connect dialog). */
   showHeading?: boolean
 }) {
@@ -79,7 +78,7 @@ export function CNPGConnectSection({
   const primary = info.endpoints[0]
   return (
     <>
-      {showHeading && <SummaryHeading anchor="connect" hint="from the Cluster spec · hosts resolve inside the Kubernetes cluster">Connect</SummaryHeading>}
+      {showHeading && <SectionHeading hint="from the Cluster spec · hosts resolve inside the Kubernetes cluster">Connect</SectionHeading>}
       <FactGrid>
         <FactRow label="Services">
           <ul className="space-y-1">
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
index fd40dc35dd..4d775d27d6 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
@@ -1,10 +1,10 @@
 import type { ReactNode } from 'react'
 import { getCNPGDeclarativeMessage, getCNPGReclaimPolicy } from '../resources/resource-utils-cnpg'
-import type { CNPGFact, CNPGWorkspaceResponse } from './workspace'
+import type { CNPGWorkspaceResponse } from './workspace'
+import type { Fact } from '../workspace'
 import { cnpgLogicalPaths, type CNPGLogicalPath } from './logicalReplication'
 import { CNPGLogicalPathView } from './CNPGLogicalPath'
 import { cnpgDatabaseRoleFacts } from './databaseRole'
-import { FactGrid, FactRow, FactValue, RefLink, SummaryHeading, toneTextClass, type CNPGNavigate } from './primitives'
 import { ClusterLink, NotReported, ObjectProblems, SummaryShell } from './CNPGSharedSummary'
 import {
   appliedFact,
@@ -19,11 +19,14 @@ import {
   targetCluster,
   workspaceList,
 } from './relations'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
 
 interface SummaryProps {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }
 
 function ReclaimRow({ resource }: { resource: any }) {
@@ -44,7 +47,7 @@ function Reconciled({ resource, extra }: { resource: any; extra?: ReactNode }) {
   const applied = appliedFact(resource)
   return (
     <>
-      <SummaryHeading>Reconciled</SummaryHeading>
+      <SectionHeading>Reconciled</SectionHeading>
       <FactGrid>
         <FactRow label="Applied">
           <FactValue fact={applied} />
@@ -95,7 +98,7 @@ function DatabaseRef({ resource, workspace, onNavigate }: SummaryProps) {
   )
 }
 
-function LinkList({ items, kind, onNavigate }: { items: any[]; kind: string; onNavigate?: CNPGNavigate }) {
+function LinkList({ items, kind, onNavigate }: { items: any[]; kind: string; onNavigate?: NavigateToRef }) {
   return (
     <span className="flex flex-wrap gap-x-3">
       {items.map((o) => (
@@ -117,7 +120,7 @@ export function CNPGDatabaseSummary({ resource, workspace, onNavigate }: Summary
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'Database')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Declared</SummaryHeading>
+      <SectionHeading>Declared</SectionHeading>
       <FactGrid>
         <FactRow label="PostgreSQL database">
           {resource?.spec?.name ? <span className="font-mono">{resource.spec.name}</span> : <NotReported text="Not set" />}
@@ -140,7 +143,7 @@ export function CNPGDatabaseSummary({ resource, workspace, onNavigate }: Summary
         }
       />
 
-      <SummaryHeading>Source and target</SummaryHeading>
+      <SectionHeading>Source and target</SectionHeading>
       <FactGrid>
         <FactRow label="Declared in">
           <DeclaredIn resource={resource} />
@@ -203,7 +206,7 @@ function workspacePaths(workspace: CNPGWorkspaceResponse | null | undefined, sub
 export interface CNPGLogicalPathReading {
   path: CNPGLogicalPath
   /** The publisher primary's report of the slot; absent when not read. */
-  slot?: CNPGFact
+  slot?: Fact
   notice?: ReactNode
 }
 
@@ -226,7 +229,7 @@ export function CNPGPublicationSummary({
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'Publication')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Declared</SummaryHeading>
+      <SectionHeading>Declared</SectionHeading>
       <FactGrid>
         <FactRow label="Publication">
           {resource?.spec?.name ? <span className="font-mono">{resource.spec.name}</span> : <NotReported text="Not set" />}
@@ -246,7 +249,7 @@ export function CNPGPublicationSummary({
 
       <Reconciled resource={resource} />
 
-      <SummaryHeading hint="Subscription objects Radar can see">Subscribers</SummaryHeading>
+      <SectionHeading hint="Subscription objects Radar can see">Subscribers</SectionHeading>
       {readings.length === 0 ? (
         <div className="text-sm text-theme-text-tertiary">
           {subsUnavailable ?? 'No visible Subscription object reads this publication. Subscribers outside Radar\'s view, or created in SQL, are not listed.'}
@@ -271,7 +274,7 @@ export function CNPGDatabaseRoleSummary({ resource, workspace, onNavigate }: Sum
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'DatabaseRole')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Declared</SummaryHeading>
+      <SectionHeading>Declared</SectionHeading>
       <FactGrid>
         <FactRow label="PostgreSQL role">{f.pgName ? <span className="font-mono">{f.pgName}</span> : <NotReported text="Not set" />}</FactRow>
         <FactRow label="Cluster">
@@ -350,7 +353,7 @@ export function CNPGSubscriptionSummary({
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'Subscription')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Declared</SummaryHeading>
+      <SectionHeading>Declared</SectionHeading>
       <FactGrid>
         <FactRow label="Subscription">
           {resource?.spec?.name ? <span className="font-mono">{resource.spec.name}</span> : <NotReported text="Not set" />}
@@ -386,7 +389,7 @@ export function CNPGSubscriptionSummary({
 
       {reading.path && (
         <>
-          <SummaryHeading>Replication path</SummaryHeading>
+          <SectionHeading>Replication path</SectionHeading>
           <CNPGLogicalPathView path={reading.path} slot={reading.slot} notice={reading.notice} onNavigate={onNavigate} />
         </>
       )}
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
index c7e05904ee..ccff25fde4 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
@@ -1,8 +1,10 @@
 import { CNPG_GROUP, getCNPGImageCatalogEntries } from '../resources/resource-utils-cnpg'
 import type { CNPGWorkspaceResponse } from './workspace'
-import { FactGrid, FactRow, RefLink, SummaryHeading, toneTextClass, type CNPGNavigate } from './primitives'
 import { NotReported, Note, ObjectProblems, SummaryShell } from './CNPGSharedSummary'
 import { clustersIn, clustersUsingCatalog, refOf, relationUnavailable } from './relations'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, SectionHeading } from '../workspace'
 
 export function CNPGImageCatalogSummary({
   resource,
@@ -11,7 +13,7 @@ export function CNPGImageCatalogSummary({
 }: {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }) {
   const clusterScoped = resource?.kind === 'ClusterImageCatalog'
   const ns = resource?.metadata?.namespace ?? ''
@@ -27,7 +29,7 @@ export function CNPGImageCatalogSummary({
     <SummaryShell>
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, resource?.kind ?? 'ImageCatalog')} onNavigate={onNavigate} />
 
-      <SummaryHeading>Images</SummaryHeading>
+      <SectionHeading>Images</SectionHeading>
       {entries.length === 0 ? (
         <div className="text-sm">
           <NotReported text="No images listed" />
@@ -42,7 +44,7 @@ export function CNPGImageCatalogSummary({
         </FactGrid>
       )}
 
-      <SummaryHeading>Used by</SummaryHeading>
+      <SectionHeading>Used by</SectionHeading>
       {unavailable ? (
         <div className="text-sm">
           <NotReported text={unavailable} />
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx b/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
index f7e575acbb..b09e5ef2fd 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
@@ -1,9 +1,11 @@
 import type { ReactNode } from 'react'
 import { ArrowRight } from 'lucide-react'
 import { CNPG_GROUP } from '../resources/resource-utils-cnpg'
-import type { CNPGFact } from './workspace'
+import type { Fact } from '../workspace'
 import { cnpgLogicalLocation, type CNPGLogicalPath } from './logicalReplication'
-import { FactGrid, FactRow, FactSource, FactValue, RefLink, toneTextClass, type CNPGNavigate } from './primitives'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactSource, FactValue } from '../workspace'
 
 // A hop after the first carries its arrow, so a wrapped line never ends on an
 // arrow pointing at nothing.
@@ -33,8 +35,8 @@ export function CNPGLogicalPathView({
   notice,
 }: {
   path: CNPGLogicalPath
-  slot?: CNPGFact
-  onNavigate?: CNPGNavigate
+  slot?: Fact
+  onNavigate?: NavigateToRef
   compact?: boolean
   /** The host's word on the slot reading, e.g. that its latest refresh failed. */
   notice?: ReactNode
@@ -42,7 +44,7 @@ export function CNPGLogicalPathView({
   const s = path.subscription
   const pub = path.publication
   const publisher = path.publisher
-  const slotFact: CNPGFact = slot ?? { text: path.slot.name ? `Slot ${path.slot.name}: not read` : path.slot.reason ?? 'No slot', tone: 'unknown' }
+  const slotFact: Fact = slot ?? { text: path.slot.name ? `Slot ${path.slot.name}: not read` : path.slot.reason ?? 'No slot', tone: 'unknown' }
   const chain = (
     <div className="flex flex-wrap items-start gap-x-2 gap-y-1">
       <Hop label="Subscription">
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
index 39e1556ea9..1a5f18309f 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
@@ -8,9 +8,11 @@ import {
   getCNPGObjectStoreRetention,
 } from '../resources/resource-utils-cnpg'
 import type { CNPGWorkspaceResponse } from './workspace'
-import { FactGrid, FactRow, FactValue, RefLink, SummaryHeading, toneTextClass, type CNPGNavigate } from './primitives'
 import { NotReported, Note, ObjectProblems, SummaryShell, TimeAgo } from './CNPGSharedSummary'
 import { clustersIn, inferredObjectStoreHealth, refOf, relationUnavailable, usersOfObjectStore } from './relations'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
 
 function utc(at: string | undefined): string {
   if (!at || !Number.isFinite(Date.parse(at))) return 'unknown'
@@ -24,7 +26,7 @@ export function CNPGObjectStoreSummary({
 }: {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }) {
   const ns = resource?.metadata?.namespace ?? ''
   const clustersUnavailable = relationUnavailable(workspace, 'clusters', ns, 'Clusters')
@@ -46,7 +48,7 @@ export function CNPGObjectStoreSummary({
         onNavigate={onNavigate}
       />
 
-      <SummaryHeading hint="inferred">Upload health</SummaryHeading>
+      <SectionHeading hint="inferred">Upload health</SectionHeading>
       {clustersUnavailable ? (
         <div className="text-sm">
           <NotReported text={`Unknown · ${clustersUnavailable}, which are the only evidence`} />
@@ -89,7 +91,7 @@ export function CNPGObjectStoreSummary({
         </>
       )}
 
-      <SummaryHeading hint="ObjectStore status">Recovery window</SummaryHeading>
+      <SectionHeading hint="ObjectStore status">Recovery window</SectionHeading>
       {windows.length === 0 ? (
         <div className="text-sm">
           <NotReported text="No server has reported a recovery window" />
@@ -136,7 +138,7 @@ export function CNPGObjectStoreSummary({
         </FactGrid>
       )}
 
-      <SummaryHeading>Destination</SummaryHeading>
+      <SectionHeading>Destination</SectionHeading>
       <FactGrid>
         <FactRow label="Path">{destination !== '-' ? <span className="font-mono">{destination}</span> : <NotReported text="Not set" />}</FactRow>
         <FactRow label="Provider">{provider ?? <NotReported />}</FactRow>
@@ -152,7 +154,7 @@ export function CNPGObjectStoreSummary({
         <FactRow label="Retention">{retention ?? <NotReported text="Not set" />}</FactRow>
       </FactGrid>
 
-      <SummaryHeading>Used by</SummaryHeading>
+      <SectionHeading>Used by</SectionHeading>
       {clustersUnavailable ? (
         <div className="text-sm">
           <NotReported text={clustersUnavailable} />
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
index a6ebddb8c6..7a2f6e5d72 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
@@ -1,7 +1,6 @@
 import type { ReactNode } from 'react'
 import { getCNPGPoolerDeploymentName, getCNPGPoolerMode, getCNPGPoolerStatus, isCNPGPoolerPaused } from '../resources/resource-utils-cnpg'
 import type { CNPGWorkspaceResponse } from './workspace'
-import { FactGrid, FactRow, FactValue, RefLink, SummaryHeading, toneTextClass, type CNPGNavigate } from './primitives'
 import { ClusterLink, NotReported, Note, ObjectProblems, PhaseBadge, SummaryShell } from './CNPGSharedSummary'
 import { refOf } from './relations'
 import {
@@ -14,6 +13,9 @@ import {
   type CNPGPoolerLive,
   type CNPGPoolerPoolRow,
 } from './pooler'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { toneTextClass } from '../ui/status-tone'
+import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
 
 const TYPE_LABEL: Record<string, string> = {
   rw: 'rw · routes to the primary',
@@ -31,7 +33,7 @@ export function CNPGPoolerSummary({
 }: {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
   /** Live reads a host adds (Deployment readiness, PgBouncer metrics and state). */
   live?: CNPGPoolerLive
   /** Operations rendered beside the paused state (pause / resume). */
@@ -53,7 +55,7 @@ export function CNPGPoolerSummary({
       {lead}
       <ObjectProblems issues={workspace?.issues} subject={refOf(resource, 'Pooler')} onNavigate={onNavigate} />
 
-      <SummaryHeading>State</SummaryHeading>
+      <SectionHeading>State</SectionHeading>
       <FactGrid>
         <FactRow label="Status">
           {readiness ? (
@@ -102,7 +104,7 @@ export function CNPGPoolerSummary({
         </FactRow>
       </FactGrid>
 
-      <SummaryHeading hint={live?.pressure ? 'live from each PgBouncer' : undefined}>Connections</SummaryHeading>
+      <SectionHeading hint={live?.pressure ? 'live from each PgBouncer' : undefined}>Connections</SectionHeading>
       {live?.pressure ? (
         <PoolerPressure pressure={live.pressure} />
       ) : (
@@ -113,7 +115,7 @@ export function CNPGPoolerSummary({
         </FactGrid>
       )}
 
-      <SummaryHeading>Limits</SummaryHeading>
+      <SectionHeading>Limits</SectionHeading>
       <FactGrid>
         <FactRow label="Pool mode">
           {resource?.spec?.pgbouncer?.poolMode ? getCNPGPoolerMode(resource) : <span>session <span className="text-theme-text-tertiary">(default)</span></span>}
@@ -137,7 +139,7 @@ export function CNPGPoolerSummary({
         })}
       </FactGrid>
 
-      <SummaryHeading>Routing</SummaryHeading>
+      <SectionHeading>Routing</SectionHeading>
       <FactGrid>
         <FactRow label="Cluster">
           <ClusterLink resource={resource} workspace={workspace} onNavigate={onNavigate} />
@@ -153,7 +155,7 @@ export function CNPGPoolerSummary({
   )
 }
 
-function PoolerPath({ resource, live, onNavigate }: { resource: any; live: CNPGPoolerLive; onNavigate?: CNPGNavigate }) {
+function PoolerPath({ resource, live, onNavigate }: { resource: any; live: CNPGPoolerLive; onNavigate?: NavigateToRef }) {
   const ns = resource?.metadata?.namespace ?? ''
   const svc = live.service!
   const backend = poolerBackendService(resource?.spec?.cluster?.name, resource?.spec?.type)
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
index 301ee5ad23..625f02c2e9 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
@@ -3,8 +3,10 @@ import { Badge } from '../ui/Badge'
 import type { StatusBadge as StatusBadgeValue } from '../resources/resource-utils'
 import { CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import type { CNPGWorkspaceIssue, CNPGWorkspaceResponse } from './workspace'
-import { FactValue, ProblemCallout, RefLink, type CNPGNavigate } from './primitives'
-import { clustersIn, healthSeverity, problemsForObject, relationUnavailable, targetCluster, type CNPGObjectRef } from './relations'
+import { healthToSeverity } from '../../utils/badge-colors'
+import { clustersIn, problemsForObject, relationUnavailable, targetCluster, type CNPGObjectRef } from './relations'
+import { type NavigateToRef, RefLink } from '../ui/RefLink'
+import { FactValue, ProblemCallout } from '../workspace'
 
 const MAX_PROBLEMS = 3
 
@@ -20,7 +22,7 @@ export function ObjectProblems({
 }: {
   issues: CNPGWorkspaceIssue[] | undefined
   subject: CNPGObjectRef
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }) {
   const problems = problemsForObject(issues, subject)
   if (problems.length === 0) return null
@@ -30,6 +32,7 @@ export function ObjectProblems({
     <div className="mb-4 space-y-2">
       {shown.map((p, i) => (
         <ProblemCallout
+          rootKind="Cluster"
           key={p.id}
           problem={p}
           onNavigate={onNavigate}
@@ -43,7 +46,7 @@ export function ObjectProblems({
 
 export function PhaseBadge({ status }: { status: StatusBadgeValue }) {
   return (
-    <Badge severity={healthSeverity(status.level)} size="sm">
+    <Badge severity={healthToSeverity(status.level)} size="sm">
       {status.text}
     </Badge>
   )
@@ -71,7 +74,7 @@ export function ClusterLink({
 }: {
   resource: any
   workspace: CNPGWorkspaceResponse | null
-  onNavigate?: CNPGNavigate
+  onNavigate?: NavigateToRef
 }) {
   const name = resource?.spec?.cluster?.name
   if (!name) return <NotReported text="Not set" />
diff --git a/packages/k8s-ui/src/components/cnpg/ha.ts b/packages/k8s-ui/src/components/cnpg/ha.ts
index 4e905655b8..75587c5367 100644
--- a/packages/k8s-ui/src/components/cnpg/ha.ts
+++ b/packages/k8s-ui/src/components/cnpg/ha.ts
@@ -4,7 +4,9 @@
 // unavailable source is "unknown", never none or healthy.
 
 import type { HealthLevel } from '../resources/resource-utils'
-import { cnpgFormatLag, cnpgLagTone, cnpgReplicationTone, cnpgSustainedLagProblemId, cnpgWorseTone, type CNPGFact, type CNPGFleetRow } from './workspace'
+import { cnpgFormatLag, cnpgLagTone, cnpgReplicationTone, cnpgSustainedLagProblemId, type CNPGFleetRow } from './workspace'
+import type { Fact, FoldSummary } from '../workspace'
+import { worseTone } from '../ui/status-tone'
 
 export type CNPGHASourceState = 'ok' | 'denied' | 'notFound' | 'notInstalled' | 'unavailable' | 'error'
 
@@ -209,7 +211,7 @@ export function cnpgZoneSpread(ha: CNPGClusterHA | undefined): CNPGZoneSpread {
 // ---------------------------------------------------------------------------
 // Quorum, PDB, images, certificates
 
-export function cnpgQuorumFact(q: CNPGHAQuorum | undefined): CNPGFact {
+export function cnpgQuorumFact(q: CNPGHAQuorum | undefined): Fact {
   if (!q) return { text: 'Unknown', tone: 'unknown' }
   if (!q.enabled) {
     if (q.number !== undefined || q.method) {
@@ -237,7 +239,7 @@ export function cnpgQuorumFact(q: CNPGHAQuorum | undefined): CNPGFact {
   }
 }
 
-export function cnpgPDBFact(pdbs: CNPGClusterHA['pdbs'] | undefined): CNPGFact {
+export function cnpgPDBFact(pdbs: CNPGClusterHA['pdbs'] | undefined): Fact {
   if (!pdbs) return { text: 'Unknown', tone: 'unknown' }
   if (pdbs.state !== 'ok') return { text: cnpgHASourceText(pdbs, 'PodDisruptionBudgets'), tone: 'unknown' }
   if (pdbs.items.length === 0) {
@@ -284,13 +286,6 @@ export function cnpgCertificateViews(certs: CNPGHACertificate[] | undefined, now
   })
 }
 
-/** A folded section's one-line summary, and whether it opens on its own. */
-export interface CNPGFoldSummary {
-  text: string
-  /** Something in the section needs a look: it opens itself. */
-  attention: boolean
-}
-
 /**
  * "HA and instances" in one line: what is wrong when something is, otherwise
  * the readiness and placement facts that are known. Unknown facts never read
@@ -300,7 +295,7 @@ export function cnpgHASummary(
   ha: CNPGClusterHA | undefined,
   live: CNPGInstanceLive[] | undefined,
   primaryConflict?: { status: string; labelled: string },
-): CNPGFoldSummary {
+): FoldSummary {
   if (!ha) return { text: 'Not read', attention: false }
   const issues: string[] = []
   const calm: string[] = []
@@ -350,7 +345,7 @@ export function cnpgHASummary(
 }
 
 /** Certificates in one line: the nearest expiry and who renews them. */
-export function cnpgCertificatesSummary(certs: CNPGHACertificate[] | undefined, now = Date.now()): CNPGFoldSummary {
+export function cnpgCertificatesSummary(certs: CNPGHACertificate[] | undefined, now = Date.now()): FoldSummary {
   const views = cnpgCertificateViews(certs, now)
   if (views.length === 0) return { text: 'No expiry reported by the operator', attention: false }
   const dated = views.filter((c) => Number.isFinite(c.daysLeft)).sort((a, b) => (a.daysLeft ?? 0) - (b.daysLeft ?? 0))
@@ -483,7 +478,7 @@ function replicationDimension(row: CNPGFleetRow, live?: CNPGReplicationLive, gap
   const tone: HealthLevel = sustained.severity === 'critical' ? 'unhealthy' : 'degraded'
   return {
     ...dim,
-    tone: cnpgWorseTone(dim.tone, tone),
+    tone: worseTone(dim.tone, tone),
     text: dim.tone === 'unknown' ? 'sustained lag' : `${dim.text} · sustained lag`,
     source: sustained.title,
   }
diff --git a/packages/k8s-ui/src/components/cnpg/logicalReplication.ts b/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
index d7dbf59155..f5755b8fc3 100644
--- a/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
+++ b/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
@@ -1,4 +1,4 @@
-import type { CNPGFact } from './workspace'
+import type { Fact } from '../workspace'
 
 /** Where a Subscription's publisher lives, as far as the subscriber's spec shows. */
 export type CNPGPublisher =
@@ -19,7 +19,7 @@ export interface CNPGLogicalPath {
   }
   /** The slot PostgreSQL creates for the subscription: `slot_name`, else the subscription's name. */
   slot: { name?: string; reason?: string }
-  failover: CNPGFact
+  failover: Fact
 }
 
 const SERVICE_SUFFIXES = ['-rw', '-ro', '-r']
@@ -91,7 +91,7 @@ const FAILOVER_SOURCE = "Publisher's spec.replicationSlots.highAvailability (ena
  * so a failover of the publisher does not lose it. Declared configuration
  * only: CloudNativePG does not report which slots were actually synchronized.
  */
-export function cnpgSlotFailover(publisher: CNPGPublisher, subscription: any): CNPGFact {
+export function cnpgSlotFailover(publisher: CNPGPublisher, subscription: any): Fact {
   if (publisher.kind !== 'cluster') {
     return { text: 'Unknown: the publisher is not a CloudNativePG Cluster Radar can see', tone: 'unknown', source: FAILOVER_SOURCE }
   }
@@ -228,7 +228,7 @@ function bytesText(n: number): string {
 
 const SLOT_SOURCE = "Publisher primary's instance manager (/pg/status replicationSlotsInfo) and exporter (retained WAL)"
 
-export function cnpgLogicalSlotFact(path: CNPGLogicalPath, observed: CNPGPublisherSlots): CNPGFact {
+export function cnpgLogicalSlotFact(path: CNPGLogicalPath, observed: CNPGPublisherSlots): Fact {
   if (!path.slot.name) return { text: path.slot.reason ?? 'No slot', tone: 'neutral' }
   if (path.publisher.kind !== 'cluster') return { text: `Slot ${path.slot.name}: not observable (publisher outside this cluster's view)`, tone: 'unknown' }
   if (observed.state === 'denied') return { text: `Slot ${path.slot.name}: no access (needs get pods/proxy on the publisher)`, tone: 'unknown', source: SLOT_SOURCE }
diff --git a/packages/k8s-ui/src/components/cnpg/primitives.tsx b/packages/k8s-ui/src/components/cnpg/primitives.tsx
index 180ac4d366..2c753cb1f6 100644
--- a/packages/k8s-ui/src/components/cnpg/primitives.tsx
+++ b/packages/k8s-ui/src/components/cnpg/primitives.tsx
@@ -1,261 +1,5 @@
-import { createContext, useContext, useEffect, useState, type ReactNode } from 'react'
 import { clsx } from 'clsx'
-import type { HealthLevel } from '../resources/resource-utils'
-import { formatAge } from '../resources/resource-utils'
-import { StatusDot } from '../ui/status-tone'
-import { Tooltip } from '../ui/Tooltip'
-import { Collapse, CollapseChevron, useDisclosure } from '../ui/Collapse'
-import { AlertBanner } from '../ui/drawer-components'
-import { TONE_TEXT_CLASS } from '../ui/severity-tone'
-import type { CNPGFact, CNPGProblem } from './workspace'
-
-export interface CNPGRef {
-  kind: string
-  group?: string
-  namespace: string
-  name: string
-}
-
-export type CNPGNavigate = (ref: CNPGRef) => void
-
-const TONE_TEXT: Record<HealthLevel, string> = {
-  healthy: 'text-theme-text-primary',
-  degraded: TONE_TEXT_CLASS.amber,
-  alert: TONE_TEXT_CLASS.orange,
-  unhealthy: TONE_TEXT_CLASS.red,
-  unknown: 'text-theme-text-tertiary',
-  neutral: 'text-theme-text-secondary',
-}
-
-export const CNPG_PRIMARY_BUTTON = 'btn-brand inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-3 py-1.5 text-sm font-medium'
-export const CNPG_SECONDARY_BUTTON =
-  'inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-3 py-1.5 text-sm text-theme-text-primary transition-colors hover:bg-theme-hover'
-
-export function toneTextClass(tone: HealthLevel): string {
-  return TONE_TEXT[tone]
-}
-
-export function FactValue({ fact, className }: { fact: CNPGFact; className?: string }) {
-  const age = fact.at ? formatAge(fact.at) : null
-  const body = (
-    <span className={clsx(toneTextClass(fact.tone), className)}>
-      {fact.text}
-      {age && fact.atMeaning === 'since' && <span className="text-theme-text-secondary"> for {age}</span>}
-      {age && fact.atMeaning !== 'since' && <span className="text-theme-text-secondary">{fact.text ? ' · ' : ''}{age} ago</span>}
-    </span>
-  )
-  if (!fact.source && !fact.at && !fact.detail) return body
-  return (
-    <Tooltip content={[fact.at ? `${fact.atMeaning === 'since' ? 'since ' : ''}${new Date(fact.at).toUTCString()}` : null, fact.source, fact.detail].filter(Boolean).join(' · ')} position="top">
-      {body}
-    </Tooltip>
-  )
-}
-
-export function FactSource({ fact }: { fact: CNPGFact }) {
-  if (!fact.source) return null
-  return <div className="mt-0.5 text-[11.5px] text-theme-text-tertiary">{fact.source}</div>
-}
-
-export function FactGrid({ children }: { children: ReactNode }) {
-  return <dl className="grid grid-cols-[9.5rem_minmax(0,1fr)] gap-x-4 gap-y-2 text-sm">{children}</dl>
-}
-
-export function FactRow({ label, children }: { label: ReactNode; children: ReactNode }) {
-  return (
-    <>
-      <dt className="text-theme-text-tertiary">{label}</dt>
-      <dd className="min-w-0 break-words text-theme-text-primary">{children}</dd>
-    </>
-  )
-}
-
-export function SummaryHeading({ children, hint, anchor }: { children: ReactNode; hint?: ReactNode; anchor?: string }) {
-  return (
-    <div data-cnpg-anchor={anchor} className="mb-2 mt-5 flex scroll-mt-4 items-baseline gap-2 first:mt-0">
-      <h3 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{children}</h3>
-      {hint && <span className="text-[11px] text-theme-text-tertiary">{hint}</span>}
-    </div>
-  )
-}
-
-/**
- * A section folded to one summary line. It opens itself when `attention`
- * turns true (data arriving after the first render included), and stays as
- * the reader left it otherwise.
- */
-export function FoldSection({
-  title,
-  hint,
-  summary,
-  attention,
-  anchor,
-  children,
-}: {
-  title: ReactNode
-  hint?: ReactNode
-  summary: ReactNode
-  attention: boolean
-  anchor?: string
-  children: ReactNode
-}) {
-  const [open, setOpen] = useState(attention)
-  useEffect(() => {
-    if (attention) setOpen(true)
-  }, [attention])
-  const d = useDisclosure(open)
-  return (
-    <div data-cnpg-anchor={anchor} className="mt-5 scroll-mt-4 first:mt-0">
-      <button
-        type="button"
-        {...d.buttonProps}
-        onClick={() => setOpen((v) => !v)}
-        className="flex w-full flex-wrap items-baseline gap-x-2 gap-y-0.5 rounded text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent"
-      >
-        <CollapseChevron open={open} className="h-3 w-3 shrink-0 self-center text-theme-text-tertiary" />
-        <h3 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{title}</h3>
-        {hint && <span className="text-[11px] text-theme-text-tertiary">{hint}</span>}
-        {!open && <span className={clsx('min-w-0 text-sm', attention ? toneTextClass('degraded') : 'text-theme-text-secondary')}>{summary}</span>}
-      </button>
-      <Collapse open={open} id={d.panelId}>
-        <div className="pt-2">{children}</div>
-      </Collapse>
-    </div>
-  )
-}
-
-export function RefLink({ refTo, onNavigate, children, mono }: { refTo: CNPGRef; onNavigate?: CNPGNavigate; children?: ReactNode; mono?: boolean }) {
-  const label = children ?? refTo.name
-  if (!onNavigate) return <span className={clsx(mono && 'font-mono')}>{label}</span>
-  return (
-    <button
-      type="button"
-      onClick={() => onNavigate(refTo)}
-      className={clsx('text-accent-text hover:underline text-left break-all', mono && 'font-mono')}
-    >
-      {label}
-    </button>
-  )
-}
-
-const PROBLEM_VARIANT: Record<CNPGProblem['severity'], 'error' | 'warning' | 'info'> = {
-  critical: 'error',
-  warning: 'warning',
-  posture: 'info',
-}
-
-/** Where a problem's evidence is and what produced it, shared by the callout and the full list. */
-/** A problem's provenance label: where its evidence comes from, never a generic "Radar issue". */
-export function cnpgProblemOriginLabel(problem: CNPGProblem): { label: string; detail?: string } {
-  switch (problem.source) {
-    case 'audit':
-      return { label: 'Best-practice check', detail: problem.sourceDetail }
-    case 'measurement':
-      return { label: problem.measuredBy ? `Measured by ${problem.measuredBy}` : 'Measured', detail: problem.sourceDetail }
-  }
-  return problem.origin ?? { label: 'Detected by Radar' }
-}
-
-/**
- * How a host opens a problem on its Issues page. Supplied by context so every
- * CNPG summary and drawer gets the link without threading a prop through each.
- */
-export const CNPGOpenIssueContext = createContext<((problem: CNPGProblem) => void) | undefined>(undefined)
-
-export function ProblemMeta({ problem, onNavigate, subjectIsSelf, children }: { problem: CNPGProblem; onNavigate?: CNPGNavigate; subjectIsSelf?: boolean; children?: ReactNode }) {
-  const openIssue = useContext(CNPGOpenIssueContext)
-  const origin = cnpgProblemOriginLabel(problem)
-  const aboutChild = !subjectIsSelf && problem.subject.kind !== 'Cluster'
-  return (
-    <div className="mt-1.5 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-theme-text-tertiary">
-      {aboutChild && (
-        <span>
-          {problem.subject.kind}{' '}
-          <RefLink refTo={problem.subject} onNavigate={onNavigate} mono />
-          {problem.alsoAbout && problem.alsoAbout.length > 0 && ' '}
-          {problem.alsoAbout && problem.alsoAbout.length > 0 && (
-            <Tooltip
-              content={
-                <ul>
-                  {problem.alsoAbout.map((o) => (
-                    <li key={`${o.kind}/${o.name}`} className="font-mono">
-                      {o.kind} {o.name}
-                    </li>
-                  ))}
-                </ul>
-              }
-            >
-              <span>and {problem.alsoAbout.length} more</span>
-            </Tooltip>
-          )}
-        </span>
-      )}
-      <Tooltip content={origin.detail} disabled={!origin.detail}>
-        <span>{origin.label}</span>
-      </Tooltip>
-      {openIssue && problem.source === 'issue' && (
-        <button type="button" onClick={() => openIssue(problem)} className="whitespace-nowrap text-accent-text hover:underline">
-          See in Issues →
-        </button>
-      )}
-      {children}
-    </div>
-  )
-}
-
-export const CNPG_PROBLEM_TONE: Record<CNPGProblem['severity'], HealthLevel> = {
-  critical: 'unhealthy',
-  warning: 'degraded',
-  posture: 'neutral',
-}
-
-export function ProblemCallout({
-  problem,
-  more,
-  onNavigate,
-  action,
-  subjectIsSelf,
-}: {
-  problem: CNPGProblem
-  more?: ReactNode
-  onNavigate?: CNPGNavigate
-  action?: ReactNode
-  /** The callout sits on the subject's own page, so linking to it would loop. */
-  subjectIsSelf?: boolean
-}) {
-  return (
-    <AlertBanner variant={PROBLEM_VARIANT[problem.severity]} title={problem.title} message={problem.detail}>
-      <ProblemMeta problem={problem} onNavigate={onNavigate} subjectIsSelf={subjectIsSelf}>
-        {action}
-        {more}
-      </ProblemMeta>
-    </AlertBanner>
-  )
-}
-
-/** The problems a callout does not show, as a compact list with the callout's tone, title and source. */
-export function ProblemList({ problems, onNavigate }: { problems: CNPGProblem[]; onNavigate?: CNPGNavigate }) {
-  return (
-    <ul className="space-y-2">
-      {problems.map((p) => (
-        <li key={p.id} className="flex items-start gap-2 text-sm">
-          <span className="mt-1.5 shrink-0">
-            <StatusDot tone={CNPG_PROBLEM_TONE[p.severity]} size="sm" />
-          </span>
-          <div className="min-w-0">
-            <div className={clsx('font-medium break-words', toneTextClass(CNPG_PROBLEM_TONE[p.severity]))}>{p.title}</div>
-            {p.detail && <div className="text-xs text-theme-text-secondary break-words">{p.detail}</div>}
-            <ProblemMeta problem={p} onNavigate={onNavigate} />
-          </div>
-        </li>
-      ))}
-    </ul>
-  )
-}
-
-export function ToneDot({ tone }: { tone: HealthLevel }) {
-  return <StatusDot tone={tone} size="sm" />
-}
+import { toneTextClass } from '../ui/status-tone'
 
 /** status.currentPrimary and the primary role label disagree: both are named rather than one silently winning. */
 export function PrimaryConflictNote({ conflict }: { conflict: { status: string; labelled: string } }) {
diff --git a/packages/k8s-ui/src/components/cnpg/relations.ts b/packages/k8s-ui/src/components/cnpg/relations.ts
index 3543c1b198..78f4324843 100644
--- a/packages/k8s-ui/src/components/cnpg/relations.ts
+++ b/packages/k8s-ui/src/components/cnpg/relations.ts
@@ -2,8 +2,6 @@
 // payload. Each helper answers only from what the objects record; a relation
 // that cannot be established returns null or an empty list, never a guess.
 
-import type { BadgeSeverity } from '../ui/Badge'
-import type { HealthLevel } from '../resources/resource-utils'
 import {
   CNPG_BARMAN_PLUGIN_NAME,
   CNPG_GROUP,
@@ -12,15 +10,8 @@ import {
   isApiGroup,
   type CNPGObjectStoreRecoveryWindow,
 } from '../resources/resource-utils-cnpg'
-import {
-  cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText,
-  coverageReadable,
-  type CNPGFact,
-  type CNPGProblem,
-  type CNPGWorkspaceIssue,
-  type CNPGWorkspaceKey,
-  type CNPGWorkspaceResponse,
-} from './workspace'
+import { cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText, coverageReadable, type CNPGProblem, type CNPGWorkspaceIssue, type CNPGWorkspaceKey, type CNPGWorkspaceResponse } from './workspace'
+import type { Fact } from '../workspace'
 
 export interface CNPGObjectRef {
   kind: string
@@ -58,21 +49,6 @@ export function refOf(obj: any, kind: string, group: string = CNPG_GROUP): CNPGO
   return { kind, group, namespace: nsOf(obj), name: nameOf(obj) }
 }
 
-export function healthSeverity(level: HealthLevel): BadgeSeverity {
-  switch (level) {
-    case 'healthy':
-      return 'success'
-    case 'unhealthy':
-      return 'error'
-    case 'alert':
-      return 'alert'
-    case 'degraded':
-      return 'warning'
-    default:
-      return 'neutral'
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Workspace access
 // ---------------------------------------------------------------------------
@@ -256,16 +232,16 @@ export function usersOfObjectStore(store: any, clusters: any[]): CNPGObjectStore
 export interface CNPGObjectStoreEvidence {
   cluster: CNPGObjectRef
   serverName: string
-  archiving: CNPGFact
+  archiving: Fact
   window: CNPGObjectStoreRecoveryWindow | null
 }
 
 export interface CNPGObjectStoreHealth {
-  summary: CNPGFact
+  summary: Fact
   evidence: CNPGObjectStoreEvidence[]
 }
 
-function archivingFact(cluster: any): CNPGFact {
+function archivingFact(cluster: any): Fact {
   const conds = cluster?.status?.conditions
   const c = Array.isArray(conds) ? conds.find((x: any) => x?.type === 'ContinuousArchiving') : null
   if (!c) return { text: 'WAL archiving not reported', tone: 'unknown' }
@@ -319,14 +295,14 @@ export function inferredObjectStoreHealth(store: any, users: CNPGObjectStoreUser
 // Declarative objects
 // ---------------------------------------------------------------------------
 
-export function appliedFact(obj: any): CNPGFact {
+export function appliedFact(obj: any): Fact {
   const applied = obj?.status?.applied
   if (applied === true) return { text: 'Applied', tone: 'healthy' }
   if (applied === false) return { text: 'Not applied', tone: 'unhealthy' }
   return { text: 'Pending · the operator has not reported a result yet', tone: 'unknown' }
 }
 
-export function observedGenerationFact(obj: any): CNPGFact {
+export function observedGenerationFact(obj: any): Fact {
   const observed = obj?.status?.observedGeneration
   const generation = obj?.metadata?.generation
   if (typeof observed !== 'number') return { text: 'Not reported', tone: 'unknown' }
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index 176e986299..0cef2dd842 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -3,6 +3,8 @@
 // does not report something the value is "unknown", never zero or healthy.
 
 import { formatAge, type HealthLevel } from '../resources/resource-utils'
+import { worseTone } from '../ui/status-tone'
+import type { Fact, ProblemOrigin, WorkspaceProblem } from '../workspace'
 import { formatBytes } from '../../utils/format'
 import {
   CNPG_BARMAN_PLUGIN_NAME,
@@ -99,22 +101,6 @@ export function isCNPGWorkspaceKind(kind: string, group: string | undefined): bo
   return Object.values(CNPG_KIND_BY_KEY).some((k) => k.group !== '' && k.group === (group ?? '') && k.kind === kind)
 }
 
-/** The value is observed, derived, or not available from the cluster. */
-export type CNPGFactTone = HealthLevel
-
-export interface CNPGFact {
-  text: string
-  tone: CNPGFactTone
-  /** Where the value comes from, shown next to it so claims carry their source. */
-  source?: string
-  /** A timestamp the text refers to; the UI renders it as an age. */
-  at?: string
-  /** `since`: `at` is when a still-current state began, rendered "Failing for 2d" rather than "· 2d ago". */
-  atMeaning?: 'since'
-  /** The full explanation behind a short `source`, shown on hover only. */
-  detail?: string
-}
-
 export type CNPGProblemCategory = 'availability' | 'protection' | 'declarations' | 'pooling'
 
 export const CNPG_PROBLEM_CATEGORIES: { id: CNPGProblemCategory; label: string }[] = [
@@ -124,33 +110,8 @@ export const CNPG_PROBLEM_CATEGORIES: { id: CNPGProblemCategory; label: string }
   { id: 'pooling', label: 'Pooling' },
 ]
 
-export interface CNPGProblem {
-  /** Stable identity for keys. */
-  id: string
-  severity: 'critical' | 'warning' | 'posture'
-  category: CNPGProblemCategory
-  title: string
-  detail?: string
-  /** The object the evidence is about (may be the Cluster or a child object). */
-  subject: { kind: string; group: string; namespace: string; name: string }
-  /**
-   * measurement: derived here from a reading only callers holding its grants
-   * receive (disk use, instance Pod readiness).
-   */
-  source: 'issue' | 'audit' | 'measurement'
-  /** What took the measurement, e.g. "Prometheus" (shown as "Measured by Prometheus"). */
-  measuredBy?: string
-  /** The measurement's series were matched to this cluster by name only (see `measuredBy`). */
-  unverifiedMatch?: boolean
-  /** How it was measured (queries, metric names), shown on hover over the source. */
-  sourceDetail?: string
-  /** A shorter headline for tight places (the fleet cell); `title` stays the precise one. */
-  shortTitle?: string
-  /** Where an issue's evidence comes from, in user terms (see cnpgIssueOrigin). */
-  origin?: CNPGProblemOrigin
-  /** Other objects the same problem is about, e.g. earlier Backups that failed the same way. */
-  alsoAbout?: { kind: string; name: string }[]
-}
+/** A problem in the CloudNativePG workspace, categorised by the workspace's four screens. */
+export type CNPGProblem = WorkspaceProblem<CNPGProblemCategory>
 
 export interface CNPGInstance {
   name: string
@@ -161,15 +122,15 @@ export interface CNPGInstance {
 }
 
 export interface CNPGProtectionFacts {
-  schedule: CNPGFact & { names: string[] }
-  destination: CNPGFact & {
+  schedule: Fact & { names: string[] }
+  destination: Fact & {
     method: 'plugin' | 'barmanObjectStore' | 'volumeSnapshot' | 'none'
     objectStore?: string
   }
-  lastSuccessfulBackup: CNPGFact
-  walArchiving: CNPGFact
-  recoveryWindow: CNPGFact & { from?: string }
-  restoreValidation: CNPGFact & { restoredInto?: { namespace: string; name: string } }
+  lastSuccessfulBackup: Fact
+  walArchiving: Fact
+  recoveryWindow: Fact & { from?: string }
+  restoreValidation: Fact & { restoredInto?: { namespace: string; name: string } }
 }
 
 export interface CNPGFleetRow {
@@ -193,9 +154,9 @@ export interface CNPGFleetRow {
   hibernated: boolean
   pgVersion: string | null
   catalog: { kind: string; name: string } | null
-  replication: CNPGFact
-  protection: CNPGProtectionFacts & { summary: CNPGFact }
-  declarations: { summary: CNPGFact; total: number; failed: number; pending: number }
+  replication: Fact
+  protection: CNPGProtectionFacts & { summary: Fact }
+  declarations: { summary: Fact; total: number; failed: number; pending: number }
   poolers: string[]
   /** The Pooler objects behind `poolers`, for their type and Service port. */
   poolerObjects?: any[]
@@ -208,9 +169,9 @@ export interface CNPGFleetRow {
   /** GitOps owner recorded on the Cluster, when it carries the standard labels. */
   gitops: CNPGGitOpsSource | null
   /** Fullest measured volume, set by applyCNPGDisk; absent when no disk reading was requested. */
-  disk?: CNPGFact
+  disk?: Fact
   /** Growth of the fastest-growing volume, set by applyCNPGFleetMetrics when measured. */
-  diskGrowth?: CNPGFact
+  diskGrowth?: Fact
 }
 
 export interface CNPGFleet {
@@ -353,11 +314,6 @@ function backupTimesOf(cluster: any, backups: any[]): Map<string, number> {
   return out
 }
 
-export interface CNPGProblemOrigin {
-  label: string
-  /** The exact field or condition, shown on hover. */
-  detail?: string
-}
 
 // Each entry names what the Go detector (internal/issues/source_cnpg*.go and
 // the Pod detector) actually reads. "Reported by CNPG" only where the operator
@@ -373,7 +329,7 @@ const CNPG_CONDITION_ORIGINS: Record<string, string> = {
   CNPGDeclarativeNotApplied: 'status.applied and status.message',
 }
 
-const POD_ORIGINS: Record<string, CNPGProblemOrigin> = {
+const POD_ORIGINS: Record<string, ProblemOrigin> = {
   ReadinessProbeFailed: { label: 'Pod readiness probe', detail: 'Kubelet probe-failure events and the Pod\'s Ready condition' },
   LivenessProbeFailed: { label: 'Pod liveness probe', detail: 'Kubelet probe-failure events and container restarts' },
   ReadinessProbeInvalid: { label: 'Radar check of the probe', detail: 'The readiness probe names a port the container does not declare' },
@@ -387,7 +343,7 @@ const POD_ORIGINS: Record<string, CNPGProblemOrigin> = {
  * reported, a Backup's or Pod's own status, or Radar's own check. A reason this
  * does not know reads "Detected by Radar" rather than a guessed source.
  */
-export function cnpgIssueOrigin(issue: Pick<CNPGWorkspaceIssue, 'kind' | 'reason'>): CNPGProblemOrigin {
+export function cnpgIssueOrigin(issue: Pick<CNPGWorkspaceIssue, 'kind' | 'reason'>): ProblemOrigin {
   const condition = CNPG_CONDITION_ORIGINS[issue.reason]
   if (condition) return { label: 'Reported by CNPG', detail: condition }
   switch (issue.reason) {
@@ -624,7 +580,7 @@ function lastBackupFact(
 const ARCHIVING_RECENT_MS = 24 * 3_600_000
 const ARCHIVING_SETTLE_MS = 10 * 60_000
 
-function walFact(cluster: any, now = Date.now()): CNPGFact {
+function walFact(cluster: any, now = Date.now()): Fact {
   const conds = cluster?.status?.conditions
   const c = Array.isArray(conds) ? conds.find((x: any) => x?.type === 'ContinuousArchiving') : null
   if (!c) return { text: 'Not reported', tone: 'unknown', source: 'Cluster status' }
@@ -749,7 +705,7 @@ function restoreValidationFact(
   }
 }
 
-function protectionSummary(p: CNPGProtectionFacts): CNPGFact {
+function protectionSummary(p: CNPGProtectionFacts): Fact {
   if (p.walArchiving.tone === 'unhealthy') return { text: 'WAL archiving failing', tone: 'unhealthy' }
   if (p.destination.method === 'none' && p.schedule.names.length === 0 && p.schedule.tone !== 'unknown') {
     return { text: 'No backup destination or schedule', tone: 'neutral' }
@@ -775,7 +731,7 @@ function pgVersion(cluster: any): string | null {
   return typeof major === 'number' ? String(major) : null
 }
 
-function replicationFact(cluster: any, pods: CNPGInstance[], hibernated: boolean, podsCov: CNPGKindCoverage): CNPGFact {
+function replicationFact(cluster: any, pods: CNPGInstance[], hibernated: boolean, podsCov: CNPGKindCoverage): Fact {
   if (hibernated) return { text: 'Hibernated', tone: 'neutral' }
   const desired = cluster?.spec?.instances
   if (desired === 1) return { text: 'Single instance', tone: 'neutral' }
@@ -981,7 +937,7 @@ function declarationsFor(cluster: any, resp: CNPGWorkspaceResponse): CNPGFleetRo
     if (failedRoles.has(r.name)) failed++
     else if (!reconciledRoles.has(r.name)) pending++
   }
-  let summary: CNPGFact
+  let summary: Fact
   if (total === 0) {
     summary = unreadable ? { text: 'No access to some declarations', tone: 'unknown' } : { text: 'None declared', tone: 'neutral' }
   } else if (failed > 0) {
@@ -1182,7 +1138,7 @@ export function cnpgDiskTone(ratio: number): HealthLevel {
 }
 
 /** The fleet and summary "Storage" fact: the fullest measured volume, or why there is none. */
-export function cnpgDiskFact(r: CNPGDiskReading | undefined): CNPGFact {
+export function cnpgDiskFact(r: CNPGDiskReading | undefined): Fact {
   if (!r) return { text: 'Not read', tone: 'unknown' }
   if (r.max && (r.state === 'ok' || r.state === 'partial')) {
     const partial = r.state === 'partial' ? ` · ${r.measured} of ${r.claims} volumes measured` : ''
@@ -1289,13 +1245,6 @@ export function cnpgLagTone(seconds: number): HealthLevel {
   return 'healthy'
 }
 
-const CNPG_TONE_SEVERITY: Record<HealthLevel, number> = { healthy: 0, neutral: 0, unknown: 1, degraded: 2, alert: 3, unhealthy: 4 }
-
-/** The more severe of two tones. */
-export function cnpgWorseTone(a: HealthLevel, b: HealthLevel): HealthLevel {
-  return CNPG_TONE_SEVERITY[b] > CNPG_TONE_SEVERITY[a] ? b : a
-}
-
 /**
  * Replication's tone from the primary's pg_stat_replication: a missing
  * standby is degraded, and the lag of the ones that do stream can make it
@@ -1303,7 +1252,7 @@ export function cnpgWorseTone(a: HealthLevel, b: HealthLevel): HealthLevel {
  */
 export function cnpgReplicationTone(streaming: number, expected: number, maxLagSeconds: number | undefined): HealthLevel {
   const missing: HealthLevel = streaming < expected ? 'degraded' : 'healthy'
-  return maxLagSeconds === undefined ? missing : cnpgWorseTone(missing, cnpgLagTone(maxLagSeconds))
+  return maxLagSeconds === undefined ? missing : worseTone(missing, cnpgLagTone(maxLagSeconds))
 }
 
 /**
@@ -1322,7 +1271,7 @@ export function cnpgFormatLag(s: number): string {
   return m === 0 ? `${Math.floor(minutes / 60)} h` : `${Math.floor(minutes / 60)} h ${m} min`
 }
 
-function measuredReplication(base: CNPGFact, reading: CNPGFleetMetricsReading | undefined, src: CNPGFleetMetricsSources): CNPGFact {
+function measuredReplication(base: Fact, reading: CNPGFleetMetricsReading | undefined, src: CNPGFleetMetricsSources): Fact {
   const prefix = base.text.replace(/ · lag unknown$/, '')
   if (src.source === 'none') {
     return { text: `${prefix} · lag unknown`, tone: 'unknown', source: CNPG_PROMETHEUS_NOT_CONNECTED, detail: src.reason }
@@ -1345,7 +1294,7 @@ function measuredReplication(base: CNPGFact, reading: CNPGFleetMetricsReading |
 }
 
 /** Volume growth of the fastest-growing claim, as a fact. */
-export function cnpgDiskGrowthFact(reading: CNPGFleetMetricsReading | undefined, src: CNPGFleetMetricsSources): CNPGFact | undefined {
+export function cnpgDiskGrowthFact(reading: CNPGFleetMetricsReading | undefined, src: CNPGFleetMetricsSources): Fact | undefined {
   const g = reading?.growth
   if (src.source === 'none' || !g || g.state !== 'ok' || g.bytesPerHour === undefined) return undefined
   const perDay = g.bytesPerHour * 24
diff --git a/packages/k8s-ui/src/components/ui/RefLink.tsx b/packages/k8s-ui/src/components/ui/RefLink.tsx
new file mode 100644
index 0000000000..ccdd63ac9d
--- /dev/null
+++ b/packages/k8s-ui/src/components/ui/RefLink.tsx
@@ -0,0 +1,20 @@
+import type { ReactNode } from 'react'
+import { clsx } from 'clsx'
+import type { ResourceRef } from '../../types/core'
+
+export type NavigateToRef = (ref: ResourceRef) => void
+
+/** A reference to another object: a link when the host can navigate, plain text otherwise. */
+export function RefLink({ refTo, onNavigate, children, mono }: { refTo: ResourceRef; onNavigate?: NavigateToRef; children?: ReactNode; mono?: boolean }) {
+  const label = children ?? refTo.name
+  if (!onNavigate) return <span className={clsx(mono && 'font-mono')}>{label}</span>
+  return (
+    <button
+      type="button"
+      onClick={() => onNavigate(refTo)}
+      className={clsx('text-accent-text hover:underline text-left break-all', mono && 'font-mono')}
+    >
+      {label}
+    </button>
+  )
+}
diff --git a/packages/k8s-ui/src/components/ui/index.ts b/packages/k8s-ui/src/components/ui/index.ts
index ac7da1b923..2a57acd04a 100644
--- a/packages/k8s-ui/src/components/ui/index.ts
+++ b/packages/k8s-ui/src/components/ui/index.ts
@@ -19,7 +19,9 @@ export type { SelectMenuOption } from './SelectMenu'
 export { Input } from './Input'
 export { FilterPill } from './FilterPill'
 export type { FilterPillTone } from './FilterPill'
-export { StatusDot, mapHealthToTone, toneFillClass } from './status-tone'
+export { StatusDot, mapHealthToTone, toneFillClass, toneTextClass, worseTone } from './status-tone'
+export { RefLink } from './RefLink'
+export type { NavigateToRef } from './RefLink'
 export type { StatusTone, StatusDotProps } from './status-tone'
 export { DialogPortal } from './DialogPortal'
 export { ConfirmDialog } from './ConfirmDialog'
diff --git a/packages/k8s-ui/src/components/ui/status-tone.test.ts b/packages/k8s-ui/src/components/ui/status-tone.test.ts
index 2caff63154..e5dbb25a5e 100644
--- a/packages/k8s-ui/src/components/ui/status-tone.test.ts
+++ b/packages/k8s-ui/src/components/ui/status-tone.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { mapHealthToTone } from './status-tone'
+import { mapHealthToTone, worseTone } from './status-tone'
 
 // Inputs flow in from heterogeneous sources (Problems API, Audit findings,
 // multi-cluster aggregation). A regression here is a silent visual
@@ -51,3 +51,12 @@ describe('mapHealthToTone', () => {
     expect(mapHealthToTone('HIGH')).toBe('alert')
   })
 })
+
+describe('worseTone', () => {
+  it('never reads calmer than a part that could not be read', () => {
+    expect(worseTone('healthy', 'unknown')).toBe('unknown')
+    expect(worseTone('unknown', 'degraded')).toBe('degraded')
+    expect(worseTone('alert', 'unhealthy')).toBe('unhealthy')
+    expect(worseTone('neutral', 'healthy')).toBe('neutral')
+  })
+})
diff --git a/packages/k8s-ui/src/components/ui/status-tone.tsx b/packages/k8s-ui/src/components/ui/status-tone.tsx
index 5ce08501ab..5c3274d892 100644
--- a/packages/k8s-ui/src/components/ui/status-tone.tsx
+++ b/packages/k8s-ui/src/components/ui/status-tone.tsx
@@ -1,4 +1,5 @@
 import { type HealthLevel } from '../resources/resource-utils';
+import { TONE_TEXT_CLASS } from './severity-tone';
 
 // StatusDot + mapHealthToTone are typed helpers over the canonical OSS
 // status vocabulary defined in `packages/k8s-ui/src/theme/components.css`.
@@ -53,6 +54,30 @@ export function toneFillClass(tone: StatusTone): string {
   return DOT_CLASS[tone]
 }
 
+// Text for a value read in a tone. Healthy reads as plain primary text: only
+// what needs a look is coloured.
+const TEXT_CLASS: Record<StatusTone, string> = {
+  healthy: 'text-theme-text-primary',
+  degraded: TONE_TEXT_CLASS.amber,
+  alert: TONE_TEXT_CLASS.orange,
+  unhealthy: TONE_TEXT_CLASS.red,
+  unknown: 'text-theme-text-tertiary',
+  neutral: 'text-theme-text-secondary',
+}
+
+export function toneTextClass(tone: StatusTone): string {
+  return TEXT_CLASS[tone]
+}
+
+// Unknown ranks above healthy: a combined reading never looks calmer than a
+// part that could not be read.
+const TONE_RANK: Record<StatusTone, number> = { healthy: 0, neutral: 0, unknown: 1, degraded: 2, alert: 3, unhealthy: 4 }
+
+/** The more severe of two tones. */
+export function worseTone(a: StatusTone, b: StatusTone): StatusTone {
+  return TONE_RANK[b] > TONE_RANK[a] ? b : a
+}
+
 // Normalize the variety of severity / health vocabularies that flow in
 // from APIs (Problems, Audit, multi-cluster aggregation endpoints) onto
 // a single tone. Inputs are case-insensitive. Returns 'unknown' for
diff --git a/packages/k8s-ui/src/components/cnpg/primitives.test.tsx b/packages/k8s-ui/src/components/workspace/facts.test.tsx
similarity index 94%
rename from packages/k8s-ui/src/components/cnpg/primitives.test.tsx
rename to packages/k8s-ui/src/components/workspace/facts.test.tsx
index 87ed2a49aa..a560d293f2 100644
--- a/packages/k8s-ui/src/components/cnpg/primitives.test.tsx
+++ b/packages/k8s-ui/src/components/workspace/facts.test.tsx
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { renderToStaticMarkup } from 'react-dom/server'
-import { FactValue } from './primitives'
+import { FactValue } from './facts'
 
 describe('FactValue', () => {
   const twoDaysAgo = new Date(Date.now() - 2 * 24 * 3600 * 1000 - 60_000).toISOString()
diff --git a/packages/k8s-ui/src/components/workspace/facts.tsx b/packages/k8s-ui/src/components/workspace/facts.tsx
new file mode 100644
index 0000000000..30c7bfcf94
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/facts.tsx
@@ -0,0 +1,60 @@
+import type { ReactNode } from 'react'
+import { clsx } from 'clsx'
+import type { HealthLevel } from '../resources/resource-utils'
+import { formatAge } from '../resources/resource-utils'
+import { toneTextClass } from '../ui/status-tone'
+import { Tooltip } from '../ui/Tooltip'
+
+/**
+ * One observed value and where it came from. A value the cluster does not
+ * report is a fact too: its text says so and its tone is `unknown`, never a
+ * zero or a calm default.
+ */
+export interface Fact {
+  text: string
+  tone: HealthLevel
+  /** Where the value comes from, shown next to it so claims carry their source. */
+  source?: string
+  /** A timestamp the text refers to; the UI renders it as an age. */
+  at?: string
+  /** `since`: `at` is when a still-current state began, rendered "Failing for 2d" rather than "· 2d ago". */
+  atMeaning?: 'since'
+  /** The full explanation behind a short `source`, shown on hover only. */
+  detail?: string
+}
+
+export function FactValue({ fact, className }: { fact: Fact; className?: string }) {
+  const age = fact.at ? formatAge(fact.at) : null
+  const body = (
+    <span className={clsx(toneTextClass(fact.tone), className)}>
+      {fact.text}
+      {age && fact.atMeaning === 'since' && <span className="text-theme-text-secondary"> for {age}</span>}
+      {age && fact.atMeaning !== 'since' && <span className="text-theme-text-secondary">{fact.text ? ' · ' : ''}{age} ago</span>}
+    </span>
+  )
+  if (!fact.source && !fact.at && !fact.detail) return body
+  return (
+    <Tooltip content={[fact.at ? `${fact.atMeaning === 'since' ? 'since ' : ''}${new Date(fact.at).toUTCString()}` : null, fact.source, fact.detail].filter(Boolean).join(' · ')} position="top">
+      {body}
+    </Tooltip>
+  )
+}
+
+export function FactSource({ fact }: { fact: Fact }) {
+  if (!fact.source) return null
+  return <div className="mt-0.5 text-[11.5px] text-theme-text-tertiary">{fact.source}</div>
+}
+
+/** Label/value rows. Empty values stay visible: an unread value is shown as unread, not hidden. */
+export function FactGrid({ children }: { children: ReactNode }) {
+  return <dl className="grid grid-cols-[9.5rem_minmax(0,1fr)] gap-x-4 gap-y-2 text-sm">{children}</dl>
+}
+
+export function FactRow({ label, children }: { label: ReactNode; children: ReactNode }) {
+  return (
+    <>
+      <dt className="text-theme-text-tertiary">{label}</dt>
+      <dd className="min-w-0 break-words text-theme-text-primary">{children}</dd>
+    </>
+  )
+}
diff --git a/packages/k8s-ui/src/components/workspace/index.ts b/packages/k8s-ui/src/components/workspace/index.ts
new file mode 100644
index 0000000000..344b64a688
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/index.ts
@@ -0,0 +1,5 @@
+// Building blocks for workspace integrations: several related CRDs with a
+// composed UI (see docs/INTEGRATION_GUIDE.md, "Workspace integrations").
+export * from './facts'
+export * from './sections'
+export * from './problems'
diff --git a/packages/k8s-ui/src/components/workspace/problems.test.tsx b/packages/k8s-ui/src/components/workspace/problems.test.tsx
new file mode 100644
index 0000000000..3ee59efc6c
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/problems.test.tsx
@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { ProblemMeta, problemOriginLabel, type WorkspaceProblem } from './problems'
+
+const problem = (kind: string): WorkspaceProblem => ({
+  id: 'p',
+  severity: 'warning',
+  category: 'availability',
+  title: 'Something needs a look',
+  subject: { kind, group: 'example.io', namespace: 'ns', name: 'child-1' },
+  source: 'issue',
+})
+
+describe('ProblemMeta', () => {
+  it('names the subject only when it is not the workspace root kind', () => {
+    expect(renderToStaticMarkup(<ProblemMeta problem={problem('Backup')} rootKind="Cluster" />)).toContain('Backup')
+    expect(renderToStaticMarkup(<ProblemMeta problem={problem('Cluster')} rootKind="Cluster" />)).not.toContain('child-1')
+  })
+})
+
+describe('problemOriginLabel', () => {
+  it('says who measured a measurement, and never calls an issue generic', () => {
+    expect(problemOriginLabel({ ...problem('Cluster'), source: 'measurement', measuredBy: 'Prometheus' }).label).toBe('Measured by Prometheus')
+    expect(problemOriginLabel(problem('Cluster')).label).toBe('Detected by Radar')
+  })
+})
diff --git a/packages/k8s-ui/src/components/workspace/problems.tsx b/packages/k8s-ui/src/components/workspace/problems.tsx
new file mode 100644
index 0000000000..21ca4cdb1a
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/problems.tsx
@@ -0,0 +1,175 @@
+import { createContext, useContext, type ReactNode } from 'react'
+import { clsx } from 'clsx'
+import type { HealthLevel } from '../resources/resource-utils'
+import { StatusDot, toneTextClass } from '../ui/status-tone'
+import { Tooltip } from '../ui/Tooltip'
+import { AlertBanner } from '../ui/drawer-components'
+import { RefLink, type NavigateToRef } from '../ui/RefLink'
+
+/** Where a problem's evidence comes from, in user terms. */
+export interface ProblemOrigin {
+  label: string
+  /** The exact field or condition, shown on hover. */
+  detail?: string
+}
+
+/**
+ * Something about a workspace object that needs a look. `C` is the
+ * integration's own category set.
+ */
+export interface WorkspaceProblem<C extends string = string> {
+  /** Stable identity for keys. */
+  id: string
+  severity: 'critical' | 'warning' | 'posture'
+  category: C
+  title: string
+  detail?: string
+  /** The object the evidence is about: the workspace's root object or one of its children. */
+  subject: { kind: string; group: string; namespace: string; name: string }
+  /**
+   * issue: the Issues engine. audit: a best-practice check. measurement:
+   * derived from a reading only callers holding its grants receive.
+   */
+  source: 'issue' | 'audit' | 'measurement'
+  /** What took the measurement, e.g. "Prometheus" (shown as "Measured by Prometheus"). */
+  measuredBy?: string
+  /** The measurement's series were matched to the subject by name only (see `measuredBy`). */
+  unverifiedMatch?: boolean
+  /** How it was measured (queries, metric names), shown on hover over the source. */
+  sourceDetail?: string
+  /** A shorter headline for tight places (a fleet cell); `title` stays the precise one. */
+  shortTitle?: string
+  /** Where an issue's evidence comes from. */
+  origin?: ProblemOrigin
+  /** Other objects the same problem is about, e.g. earlier runs that failed the same way. */
+  alsoAbout?: { kind: string; name: string }[]
+}
+
+export const PROBLEM_TONE: Record<WorkspaceProblem['severity'], HealthLevel> = {
+  critical: 'unhealthy',
+  warning: 'degraded',
+  posture: 'neutral',
+}
+
+const PROBLEM_VARIANT: Record<WorkspaceProblem['severity'], 'error' | 'warning' | 'info'> = {
+  critical: 'error',
+  warning: 'warning',
+  posture: 'info',
+}
+
+/** A problem's provenance label: where its evidence comes from, never a generic "Radar issue". */
+export function problemOriginLabel(problem: WorkspaceProblem): ProblemOrigin {
+  switch (problem.source) {
+    case 'audit':
+      return { label: 'Best-practice check', detail: problem.sourceDetail }
+    case 'measurement':
+      return { label: problem.measuredBy ? `Measured by ${problem.measuredBy}` : 'Measured', detail: problem.sourceDetail }
+  }
+  return problem.origin ?? { label: 'Detected by Radar' }
+}
+
+/**
+ * How a host opens a problem on its Issues page. Supplied by context so every
+ * summary and drawer gets the link without threading a prop through each.
+ */
+export const OpenIssueContext = createContext<((problem: WorkspaceProblem) => void) | undefined>(undefined)
+
+export function ProblemMeta({
+  problem,
+  rootKind,
+  onNavigate,
+  subjectIsSelf,
+  children,
+}: {
+  problem: WorkspaceProblem
+  /** The workspace's root kind: a problem about another kind names its subject. */
+  rootKind: string
+  onNavigate?: NavigateToRef
+  subjectIsSelf?: boolean
+  children?: ReactNode
+}) {
+  const openIssue = useContext(OpenIssueContext)
+  const origin = problemOriginLabel(problem)
+  const aboutChild = !subjectIsSelf && problem.subject.kind !== rootKind
+  return (
+    <div className="mt-1.5 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-theme-text-tertiary">
+      {aboutChild && (
+        <span>
+          {problem.subject.kind}{' '}
+          <RefLink refTo={problem.subject} onNavigate={onNavigate} mono />
+          {problem.alsoAbout && problem.alsoAbout.length > 0 && ' '}
+          {problem.alsoAbout && problem.alsoAbout.length > 0 && (
+            <Tooltip
+              content={
+                <ul>
+                  {problem.alsoAbout.map((o) => (
+                    <li key={`${o.kind}/${o.name}`} className="font-mono">
+                      {o.kind} {o.name}
+                    </li>
+                  ))}
+                </ul>
+              }
+            >
+              <span>and {problem.alsoAbout.length} more</span>
+            </Tooltip>
+          )}
+        </span>
+      )}
+      <Tooltip content={origin.detail} disabled={!origin.detail}>
+        <span>{origin.label}</span>
+      </Tooltip>
+      {openIssue && problem.source === 'issue' && (
+        <button type="button" onClick={() => openIssue(problem)} className="whitespace-nowrap text-accent-text hover:underline">
+          See in Issues →
+        </button>
+      )}
+      {children}
+    </div>
+  )
+}
+
+export function ProblemCallout({
+  problem,
+  rootKind,
+  more,
+  onNavigate,
+  action,
+  subjectIsSelf,
+}: {
+  problem: WorkspaceProblem
+  rootKind: string
+  more?: ReactNode
+  onNavigate?: NavigateToRef
+  action?: ReactNode
+  /** The callout sits on the subject's own page, so linking to it would loop. */
+  subjectIsSelf?: boolean
+}) {
+  return (
+    <AlertBanner variant={PROBLEM_VARIANT[problem.severity]} title={problem.title} message={problem.detail}>
+      <ProblemMeta problem={problem} rootKind={rootKind} onNavigate={onNavigate} subjectIsSelf={subjectIsSelf}>
+        {action}
+        {more}
+      </ProblemMeta>
+    </AlertBanner>
+  )
+}
+
+/** The problems a callout does not show, as a compact list with the callout's tone, title and source. */
+export function ProblemList({ problems, rootKind, onNavigate }: { problems: WorkspaceProblem[]; rootKind: string; onNavigate?: NavigateToRef }) {
+  return (
+    <ul className="space-y-2">
+      {problems.map((p) => (
+        <li key={p.id} className="flex items-start gap-2 text-sm">
+          <span className="mt-1.5 shrink-0">
+            <StatusDot tone={PROBLEM_TONE[p.severity]} size="sm" />
+          </span>
+          <div className="min-w-0">
+            <div className={clsx('font-medium break-words', toneTextClass(PROBLEM_TONE[p.severity]))}>{p.title}</div>
+            {p.detail && <div className="text-xs text-theme-text-secondary break-words">{p.detail}</div>}
+            <ProblemMeta problem={p} rootKind={rootKind} onNavigate={onNavigate} />
+          </div>
+        </li>
+      ))}
+    </ul>
+  )
+}
diff --git a/packages/k8s-ui/src/components/workspace/sections.tsx b/packages/k8s-ui/src/components/workspace/sections.tsx
new file mode 100644
index 0000000000..eb2539ee3c
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/sections.tsx
@@ -0,0 +1,63 @@
+import { useEffect, useState, type ReactNode } from 'react'
+import { clsx } from 'clsx'
+import { toneTextClass } from '../ui/status-tone'
+import { Collapse, CollapseChevron, useDisclosure } from '../ui/Collapse'
+
+/** A folded section's one-line summary, and whether it opens on its own. */
+export interface FoldSummary {
+  text: string
+  /** Something in the section needs a look: it opens itself. */
+  attention: boolean
+}
+
+export function SectionHeading({ children, hint }: { children: ReactNode; hint?: ReactNode }) {
+  return (
+    <div className="mb-2 mt-5 flex items-baseline gap-2 first:mt-0">
+      <h3 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{children}</h3>
+      {hint && <span className="text-[11px] text-theme-text-tertiary">{hint}</span>}
+    </div>
+  )
+}
+
+/**
+ * A section folded to one summary line. It opens itself when `attention`
+ * turns true (data arriving after the first render included), and stays as
+ * the reader left it otherwise.
+ */
+export function FoldSection({
+  title,
+  hint,
+  summary,
+  attention,
+  children,
+}: {
+  title: ReactNode
+  hint?: ReactNode
+  summary: ReactNode
+  attention: boolean
+  children: ReactNode
+}) {
+  const [open, setOpen] = useState(attention)
+  useEffect(() => {
+    if (attention) setOpen(true)
+  }, [attention])
+  const d = useDisclosure(open)
+  return (
+    <div className="mt-5 first:mt-0">
+      <button
+        type="button"
+        {...d.buttonProps}
+        onClick={() => setOpen((v) => !v)}
+        className="flex w-full flex-wrap items-baseline gap-x-2 gap-y-0.5 rounded text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent"
+      >
+        <CollapseChevron open={open} className="h-3 w-3 shrink-0 self-center text-theme-text-tertiary" />
+        <h3 className="text-[11px] font-semibold uppercase tracking-wide text-theme-text-tertiary">{title}</h3>
+        {hint && <span className="text-[11px] text-theme-text-tertiary">{hint}</span>}
+        {!open && <span className={clsx('min-w-0 text-sm', attention ? toneTextClass('degraded') : 'text-theme-text-secondary')}>{summary}</span>}
+      </button>
+      <Collapse open={open} id={d.panelId}>
+        <div className="pt-2">{children}</div>
+      </Collapse>
+    </div>
+  )
+}
diff --git a/packages/k8s-ui/src/index.ts b/packages/k8s-ui/src/index.ts
index 7354c75027..156b4453af 100644
--- a/packages/k8s-ui/src/index.ts
+++ b/packages/k8s-ui/src/index.ts
@@ -55,7 +55,10 @@ export * from './components/checks'
 // queue)
 export * from './components/issues'
 
-// CloudNativePG workspace model (fleet derivation over /api/cnpg/workspace)
+// Workspace building blocks: facts, sections and problems shared by multi-CRD integrations
+export * from './components/workspace'
+
+// CloudNativePG workspace model (fleet derivation over /api/cnpg/workspace) and summaries
 export * from './components/cnpg'
 
 // Cluster switcher (shared trigger+dropdown for OSS Radar and Radar Hub)
diff --git a/packages/k8s-ui/src/theme/components.css b/packages/k8s-ui/src/theme/components.css
index da31dc1ff6..4468656c94 100644
--- a/packages/k8s-ui/src/theme/components.css
+++ b/packages/k8s-ui/src/theme/components.css
@@ -35,6 +35,21 @@
     opacity: 0.5;
   }
 
+  /* Bordered surface button for secondary actions next to a .btn-brand. */
+  .btn-secondary {
+    border: 1px solid var(--border-default);
+    background-color: var(--bg-surface);
+    color: var(--text-primary);
+    border-radius: 0.625rem;
+    transition: background-color 0.15s ease;
+  }
+  .btn-secondary:hover {
+    background-color: var(--bg-hover);
+  }
+  .btn-secondary:disabled {
+    opacity: 0.5;
+  }
+
   .btn-brand-toggle {
     background-color: color-mix(in srgb, var(--color-brand) 50%, transparent);
     color: var(--text-primary);
diff --git a/web/src/components/cnpg/CNPGDetailPage.tsx b/web/src/components/cnpg/CNPGDetailPage.tsx
index 29748aff55..f04dcb907d 100644
--- a/web/src/components/cnpg/CNPGDetailPage.tsx
+++ b/web/src/components/cnpg/CNPGDetailPage.tsx
@@ -242,7 +242,7 @@ function NotInContext({
             <button
               type="button"
               onClick={() => navigate(homePath)}
-              className="rounded-lg border border-theme-border bg-theme-surface px-3 py-1.5 text-sm text-theme-text-primary hover:bg-theme-hover"
+              className="btn-secondary px-3 py-1.5 text-sm"
             >
               Go to {homeLabel === 'Overview' ? 'CloudNativePG Overview' : homeLabel}
             </button>
diff --git a/web/src/components/cnpg/CNPGOverview.tsx b/web/src/components/cnpg/CNPGOverview.tsx
index 25dfcda4b2..d0f04ea6a7 100644
--- a/web/src/components/cnpg/CNPGOverview.tsx
+++ b/web/src/components/cnpg/CNPGOverview.tsx
@@ -4,7 +4,7 @@ import { clsx } from 'clsx'
 import { ArrowRight, Database, FileText, Search } from 'lucide-react'
 import {
   CNPG_PROBLEM_CATEGORIES,
-  CNPG_PROBLEM_TONE,
+  PROBLEM_TONE,
   cnpgReadyInstances,
   FactValue,
   StatusDot,
@@ -112,7 +112,7 @@ function AttentionCell({ row, onOpenAll }: { row: CNPGFleetRow; onOpenAll: () =>
   return (
     <div className="min-w-0">
       <Tooltip content={problemTip(top)} wrapperClassName="w-full">
-        <div className={clsx('[overflow-wrap:normal]', unbreakable ? 'truncate' : 'line-clamp-3', toneTextClass(CNPG_PROBLEM_TONE[top.severity]))}>{headline}</div>
+        <div className={clsx('[overflow-wrap:normal]', unbreakable ? 'truncate' : 'line-clamp-3', toneTextClass(PROBLEM_TONE[top.severity]))}>{headline}</div>
       </Tooltip>
       {top.unverifiedMatch && (
         <div className="text-[11px] text-theme-text-tertiary">measured by {top.measuredBy}</div>
@@ -124,7 +124,7 @@ function AttentionCell({ row, onOpenAll }: { row: CNPGFleetRow; onOpenAll: () =>
               {others.map((p) => (
                 <li key={p.id} className="flex items-start gap-1.5">
                   <span className="mt-1 shrink-0">
-                    <StatusDot tone={CNPG_PROBLEM_TONE[p.severity]} size="xs" />
+                    <StatusDot tone={PROBLEM_TONE[p.severity]} size="xs" />
                   </span>
                   <span>{problemTip(p)}</span>
                 </li>
diff --git a/web/src/components/cnpg/CNPGStorage.tsx b/web/src/components/cnpg/CNPGStorage.tsx
index 9f7be11cec..9c39e1c3d5 100644
--- a/web/src/components/cnpg/CNPGStorage.tsx
+++ b/web/src/components/cnpg/CNPGStorage.tsx
@@ -463,7 +463,7 @@ function ExpansionCard({ data, volumes, onResize }: { data: CNPGClusterStorageRe
               <button
                 type="button"
                 onClick={() => onResize(t)}
-                className="inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover"
+                className="btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium"
               >
                 Edit size…
               </button>
diff --git a/web/src/components/cnpg/CNPGSummaryHost.tsx b/web/src/components/cnpg/CNPGSummaryHost.tsx
index 6f817362ba..2c41135364 100644
--- a/web/src/components/cnpg/CNPGSummaryHost.tsx
+++ b/web/src/components/cnpg/CNPGSummaryHost.tsx
@@ -2,7 +2,7 @@ import type { ReactNode } from 'react'
 import { useLocation, useNavigate, useSearchParams } from 'react-router-dom'
 import {
   CNPG_BARMAN_OBJECTSTORE_GROUP,
-  CNPGOpenIssueContext,
+  OpenIssueContext,
   CNPG_GROUP,
   CNPGBackupSummary,
   CNPGClusterSummary,
@@ -26,8 +26,8 @@ import {
   PaneLoader,
   isApiGroup,
   refToSelectedResource,
-  type CNPGNavigate,
-  type CNPGRef,
+  type NavigateToRef,
+  type ResourceRef,
   type CNPGLogicalPath,
   type CNPGWorkspaceResponse,
   type NavigateToResource,
@@ -101,7 +101,7 @@ function ClusterSummaryHost({ namespace, name, context, onNavigate }: SummaryCon
       </div>
     )
   }
-  const goRef = onNavigate ? (ref: CNPGRef) => onNavigate(refToSelectedResource(ref)) : undefined
+  const goRef = onNavigate ? (ref: ResourceRef) => onNavigate(refToSelectedResource(ref)) : undefined
   // On the Cluster's own page this is a tab change, applied like a tab click;
   // anywhere else (the drawer, another page) it is a push to the full page
   // with a return label.
@@ -189,9 +189,9 @@ function ClusterSummaryHost({ namespace, name, context, onNavigate }: SummaryCon
   )
 }
 
-type ObjectSummary = (props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: CNPGNavigate }) => ReactNode
+type ObjectSummary = (props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) => ReactNode
 
-function ScheduledBackupSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: CNPGNavigate }) {
+function ScheduledBackupSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) {
   const ns = props.resource?.metadata?.namespace ?? ''
   const name = props.resource?.metadata?.name ?? ''
   const caps = useCNPGScheduleCapabilities(ns, name)
@@ -217,14 +217,14 @@ function LogicalPathSlot({ path, children }: { path: CNPGLogicalPath; children:
   return <>{children(cnpgLogicalSlotFact(path, observed), <CNPGRefreshFailedNotice queries={[query]} />)}</>
 }
 
-function SubscriptionSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: CNPGNavigate }) {
+function SubscriptionSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) {
   const lw = useLogicalWorkspace(props.workspace, [props.resource])
   const path = props.workspace ? cnpgLogicalPaths([props.resource], lw.clusters, lw.publications, lw.poolers, lw.publicationsUnavailable)[0] : undefined
   if (!path) return <CNPGSubscriptionSummary {...props} />
   return <LogicalPathSlot path={path}>{(slot, notice) => <CNPGSubscriptionSummary {...props} logicalPath={{ path, slot, notice }} />}</LogicalPathSlot>
 }
 
-function PublicationSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: CNPGNavigate }) {
+function PublicationSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) {
   // Subscribers are the Subscriptions in view; the publisher's own runtime
   // answers for every slot.
   const pubCluster = props.resource?.spec?.cluster?.name
@@ -261,7 +261,7 @@ function ObjectSummaryHost({ ctx, Summary }: { ctx: SummaryContext; Summary: Obj
   const { query } = useCNPGFleet(clusterScoped ? [] : [ctx.namespace])
   if (query.isLoading) return <PaneLoader label="Loading summary…" className="h-40" />
   const workspace = query.data?.installed ? query.data : null
-  const go = ctx.onNavigate ? (ref: CNPGRef) => ctx.onNavigate?.(refToSelectedResource(ref)) : undefined
+  const go = ctx.onNavigate ? (ref: ResourceRef) => ctx.onNavigate?.(refToSelectedResource(ref)) : undefined
   return <Summary resource={ctx.resource} workspace={workspace} onNavigate={go} />
 }
 
@@ -270,7 +270,7 @@ function PoolerSummaryHost({ ctx }: { ctx: SummaryContext }) {
   const { live, queries } = useCNPGPoolerLive(ctx.namespace, ctx.name)
   if (query.isLoading) return <PaneLoader label="Loading summary…" className="h-40" />
   const workspace = query.data?.installed ? query.data : null
-  const go = ctx.onNavigate ? (ref: CNPGRef) => ctx.onNavigate?.(refToSelectedResource(ref)) : undefined
+  const go = ctx.onNavigate ? (ref: ResourceRef) => ctx.onNavigate?.(refToSelectedResource(ref)) : undefined
   return <CNPGPoolerSummary resource={ctx.resource} workspace={workspace} onNavigate={go} live={live} lead={<CNPGRefreshFailedNotice queries={queries} />} />
 }
 
@@ -313,12 +313,12 @@ function IssueLinks({ children }: { children: ReactNode }) {
   const [searchParams] = useSearchParams()
   const issuesTakenOver = !!useNavCustomization().fleetTakeoverHref?.('issues')
   return (
-    <CNPGOpenIssueContext.Provider
+    <OpenIssueContext.Provider
       value={issuesTakenOver ? undefined : (p) =>
         navigate(cnpgIssuesPath(p.subject, searchParams.get('namespaces')))
       }
     >
       {children}
-    </CNPGOpenIssueContext.Provider>
+    </OpenIssueContext.Provider>
   )
 }
diff --git a/web/src/components/cnpg/actions/CNPGClusterActions.tsx b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
index 4b39cbe7f4..96e3dc84c0 100644
--- a/web/src/components/cnpg/actions/CNPGClusterActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
@@ -108,7 +108,7 @@ export function CNPGClusterActions({ namespace, name, compact = false }: { names
           type="button"
           disabled={!actions?.backup.allowed}
           onClick={() => setOpen('backup')}
-          className="inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-50"
+          className="btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium disabled:cursor-not-allowed"
         >
           <DatabaseBackup className="h-3.5 w-3.5" />
           {!compact && 'Back up now'}
@@ -120,7 +120,7 @@ export function CNPGClusterActions({ namespace, name, compact = false }: { names
             type="button"
             disabled={!actions?.switchover.allowed}
             onClick={() => setOpen('switchover')}
-            className="inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-50"
+            className="btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium disabled:cursor-not-allowed"
           >
             <Repeat className="h-3.5 w-3.5" />
             Switchover
@@ -133,7 +133,7 @@ export function CNPGClusterActions({ namespace, name, compact = false }: { names
         aria-expanded={menu}
         aria-label="More cluster actions"
         onClick={() => setMenu((v) => !v)}
-        className="inline-flex items-center gap-0.5 rounded-lg border border-theme-border bg-theme-surface px-2 py-1.5 text-xs text-theme-text-primary hover:bg-theme-hover"
+        className="btn-secondary inline-flex items-center gap-0.5 px-2 py-1.5 text-xs"
       >
         <MoreHorizontal className="h-3.5 w-3.5" />
         <ChevronDown className="h-3 w-3" />
diff --git a/web/src/components/cnpg/actions/CNPGConnectButton.tsx b/web/src/components/cnpg/actions/CNPGConnectButton.tsx
index 2dca892d35..4eb7c0346a 100644
--- a/web/src/components/cnpg/actions/CNPGConnectButton.tsx
+++ b/web/src/components/cnpg/actions/CNPGConnectButton.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useId, useMemo, useState } from 'react'
 import { useLocation, useSearchParams } from 'react-router-dom'
 import { Plug, X } from 'lucide-react'
-import { CNPGConnectSection, DialogPortal, Tooltip, type CNPGRef, type NavigateToResource } from '@skyhook-io/k8s-ui'
+import { CNPGConnectSection, DialogPortal, Tooltip, type ResourceRef, type NavigateToResource } from '@skyhook-io/k8s-ui'
 import { refToSelectedResource } from '../../../utils/navigation'
 import { useCNPGFleet } from '../useCNPGSidebarWorkspace'
 
@@ -70,7 +70,7 @@ export function CNPGConnectButton({
   const { fleet } = useCNPGFleet([namespace], open)
   const row = fleet?.rows.find((r) => r.namespace === namespace && r.name === name)
   const go = onNavigate
-    ? (ref: CNPGRef) => {
+    ? (ref: ResourceRef) => {
         setOpen(false)
         onNavigate(refToSelectedResource(ref))
       }
@@ -83,7 +83,7 @@ export function CNPGConnectButton({
           type="button"
           onClick={() => setOpen(true)}
           aria-label={compact ? 'Connect' : undefined}
-          className="inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover"
+          className="btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium"
         >
           <Plug className="h-3.5 w-3.5" />
           {!compact && 'Connect'}
diff --git a/web/src/components/cnpg/actions/CNPGPoolerActions.tsx b/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
index f14eed0b11..9c4a235ed4 100644
--- a/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
@@ -7,7 +7,7 @@ import { useToast } from '../../ui/Toast'
 import { useCNPGWriteGuard } from './useCNPGWriteGuard'
 
 const BUTTON =
-  'inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-50'
+  'btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium disabled:cursor-not-allowed'
 
 /** Pause or resume a Pooler's PgBouncers (spec.pgbouncer.paused). */
 export function CNPGPoolerActions({ namespace, name }: { namespace: string; name: string }) {
diff --git a/web/src/components/cnpg/actions/CNPGScheduleActions.tsx b/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
index 2c23d72a83..bd1a8058dc 100644
--- a/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
@@ -13,7 +13,7 @@ import { cnpgOperatorActionNote } from '../operatorStatus'
 import { trackCNPGOperation } from '../operations/store'
 
 const BUTTON =
-  'inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-50'
+  'btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium disabled:cursor-not-allowed'
 
 /** Suspend, resume, run a ScheduledBackup's settings once, or change its schedule. */
 export function CNPGScheduleActions({ namespace, name }: { namespace: string; name: string }) {
diff --git a/web/src/components/cnpg/baseBackup.ts b/web/src/components/cnpg/baseBackup.ts
index 682d50ae09..a039019c64 100644
--- a/web/src/components/cnpg/baseBackup.ts
+++ b/web/src/components/cnpg/baseBackup.ts
@@ -1,4 +1,4 @@
-import type { CNPGFact } from '@skyhook-io/k8s-ui'
+import type { Fact } from '@skyhook-io/k8s-ui'
 import type { CNPGRuntimeBaseBackup, CNPGRuntimeResponse } from '../../api/cnpg'
 import { formatBytes } from './lsn'
 
@@ -18,7 +18,7 @@ export function describeCNPGBaseBackup(bb: CNPGRuntimeBaseBackup): string {
  * The primary's running base backups. Undefined when the primary's report was
  * not read, so the Overview omits the fact rather than claiming none.
  */
-export function cnpgBaseBackupFacts(rt: CNPGRuntimeResponse | undefined): { fact: CNPGFact; rows: CNPGRuntimeBaseBackup[] } | undefined {
+export function cnpgBaseBackupFacts(rt: CNPGRuntimeResponse | undefined): { fact: Fact; rows: CNPGRuntimeBaseBackup[] } | undefined {
   if (!rt || rt.permission.proxy === 'denied') return undefined
   const primary = rt.instances.find((i) => i.role === 'primary')
   if (!primary || (primary.status.state !== 'ok' && primary.status.state !== 'partial')) return undefined
diff --git a/web/src/components/cnpg/operations/CNPGOperationTracker.tsx b/web/src/components/cnpg/operations/CNPGOperationTracker.tsx
index f1d87ea655..2ebc7c7e6f 100644
--- a/web/src/components/cnpg/operations/CNPGOperationTracker.tsx
+++ b/web/src/components/cnpg/operations/CNPGOperationTracker.tsx
@@ -155,7 +155,7 @@ export function CNPGOperationTracker({ namespace, name }: { namespace: string; n
         aria-haspopup="dialog"
         aria-expanded={open}
         onClick={() => setOpen((v) => !v)}
-        className="inline-flex max-w-[22rem] items-center gap-1.5 rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs text-theme-text-primary hover:bg-theme-hover"
+        className="btn-secondary inline-flex max-w-[22rem] items-center gap-1.5 px-2.5 py-1.5 text-xs"
       >
         <StatusDot tone={STATE_TONE[lead.state]} />
         <span className="truncate">{lead.label}</span>
diff --git a/web/src/components/cnpg/recovery/CNPGRestoreButton.tsx b/web/src/components/cnpg/recovery/CNPGRestoreButton.tsx
index ba9ba9b987..c788254a31 100644
--- a/web/src/components/cnpg/recovery/CNPGRestoreButton.tsx
+++ b/web/src/components/cnpg/recovery/CNPGRestoreButton.tsx
@@ -14,7 +14,7 @@ export function CNPGRestoreButton({ namespace, entry, disabledReason, compact }:
           type="button"
           disabled={!!disabledReason}
           onClick={() => setOpen(true)}
-          className="inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap rounded-lg border border-theme-border bg-theme-surface px-2.5 py-1.5 text-xs font-medium text-theme-text-primary hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-50"
+          className="btn-secondary inline-flex shrink-0 items-center gap-1.5 whitespace-nowrap px-2.5 py-1.5 text-xs font-medium disabled:cursor-not-allowed"
         >
           <History className="h-3.5 w-3.5" />
           {!compact && label}
diff --git a/web/src/components/cnpg/runtimeModel.ts b/web/src/components/cnpg/runtimeModel.ts
index e3b06cab94..ecd8e11006 100644
--- a/web/src/components/cnpg/runtimeModel.ts
+++ b/web/src/components/cnpg/runtimeModel.ts
@@ -1,4 +1,4 @@
-import { cnpgLagTone, cnpgWorseTone, type HealthLevel } from '@skyhook-io/k8s-ui'
+import { cnpgLagTone, worseTone, type HealthLevel } from '@skyhook-io/k8s-ui'
 import type { CNPGRuntimeInstance, CNPGRuntimeReplication } from '../../api/cnpg'
 import type { CNPGSessionsResponse } from '../../api/cnpg-sessions'
 import { cnpgConnectionFigure } from './blocking'
@@ -70,7 +70,7 @@ const CNPG_BACKLOG_UNHEALTHY = 1024 * 1024 * 1024
 export function cnpgStandbyBacklogTone(bytes: number | undefined, replayLag: number | undefined): HealthLevel {
   if (bytes === undefined) return 'unknown'
   const byBytes: HealthLevel = bytes >= CNPG_BACKLOG_UNHEALTHY ? 'unhealthy' : bytes >= CNPG_BACKLOG_DEGRADED ? 'degraded' : 'healthy'
-  return replayLag === undefined ? byBytes : cnpgWorseTone(byBytes, cnpgLagTone(replayLag))
+  return replayLag === undefined ? byBytes : worseTone(byBytes, cnpgLagTone(replayLag))
 }
 
 export interface CNPGStandbyHeadline {
@@ -94,7 +94,7 @@ export function cnpgStandbyHeadline(
   const streaming = rep ? [rep.state, rep.syncState].filter(Boolean).join(' · ') : undefined
   if (inst.status.roleDetail === 'replayPaused' || inst.status.replayPaused) {
     const secondary = streaming ?? (ctx.primaryRead && !ctx.fenced ? 'not connected to the primary' : undefined)
-    return { text: 'replay paused', tone: cnpgWorseTone('degraded', backlogTone), secondary }
+    return { text: 'replay paused', tone: worseTone('degraded', backlogTone), secondary }
   }
   if (streaming !== undefined) return { text: streaming, tone: backlogTone }
   // The fence asks the operator to stop PostgreSQL; only the instance manager

From 78d35ba9efc314390f880fcc256e86130805bd12 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 00:52:08 +0300
Subject: [PATCH 02/26] Move Prometheus series-scope isolation out of the CNPG
 history file

The cluster-identity scope that keeps a query to this cluster's series
already serves PVC usage and the single-claim chart, so it moves to
series_scope.go under neutral names: SeriesIsolation, ErrScopeAmbiguous,
ErrScopeMismatch, ClaimSelectors. JSON tags and decisions are unchanged.
---
 internal/prometheus/cnpg_history.go      | 174 +---------------------
 internal/prometheus/cnpg_history_test.go |  10 +-
 internal/prometheus/pvc_usage.go         |  12 +-
 internal/prometheus/series_scope.go      | 181 +++++++++++++++++++++++
 internal/server/cnpg_history.go          |  48 +++---
 internal/server/cnpg_history_test.go     |   4 +-
 internal/server/cnpg_storage.go          |  30 ++--
 internal/server/cnpg_storage_test.go     |   2 +-
 8 files changed, 240 insertions(+), 221 deletions(-)
 create mode 100644 internal/prometheus/series_scope.go

diff --git a/internal/prometheus/cnpg_history.go b/internal/prometheus/cnpg_history.go
index 1604dc6e18..c17b3375fa 100644
--- a/internal/prometheus/cnpg_history.go
+++ b/internal/prometheus/cnpg_history.go
@@ -12,7 +12,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/skyhook-io/radar/internal/k8s"
 	"github.com/skyhook-io/radar/pkg/prom"
 )
 
@@ -32,27 +31,10 @@ const (
 	CNPGHistoryStateNotRead   = "notRead"
 	CNPGHistoryStateAmbiguous = "ambiguous"
 
-	CNPGIsolationConfigured = "configured"
-	CNPGIsolationVerified   = "verified"
-	CNPGIsolationUnverified = "unverified"
-
 	cnpgHistoryMaxSeries   = 12
 	cnpgHistoryConcurrency = 4
 )
 
-// ErrCNPGScopeAmbiguous means the selected series exist under more than one
-// cluster identity in this Prometheus, so any answer could mix clusters.
-var ErrCNPGScopeAmbiguous = errors.New("cnpg metrics: the selected series appear under more than one cluster identity")
-
-// ErrCNPGScopeMismatch means the verified cluster identity labels select none
-// of the probed series although unscoped ones exist.
-var ErrCNPGScopeMismatch = errors.New("cnpg metrics: cluster identity labels do not appear on the selected series")
-
-type cnpgQuerier interface {
-	Query(ctx context.Context, query string) (*prom.QueryResult, error)
-	QueryRange(ctx context.Context, query string, start, end time.Time, step time.Duration) (*prom.QueryResult, error)
-}
-
 // CNPGHistoryRange is one of the ranges the history endpoint accepts. Steps
 // keep every chart at 60–144 points.
 type CNPGHistoryRange struct {
@@ -81,13 +63,6 @@ func ParseCNPGHistoryRange(raw string) (CNPGHistoryRange, bool) {
 	return CNPGHistoryRange{}, false
 }
 
-// CNPGIsolation says how the queries keep to this Kubernetes cluster's series.
-type CNPGIsolation struct {
-	Mode   string            `json:"mode"`
-	Labels map[string]string `json:"labels,omitempty"`
-	Note   string            `json:"note"`
-}
-
 // CNPGInstanceSelector is the matcher set for a Cluster's instance series.
 func CNPGInstanceSelector(namespace, cluster string) string {
 	return CNPGInstancesSelector(namespace, []string{cluster})
@@ -120,149 +95,12 @@ func CNPGClusterOfPod(pod string, clusters map[string]bool) string {
 	return m[1]
 }
 
-func withScope(selector, matchers string) string {
-	if matchers == "" {
-		return selector
-	}
-	return selector + "," + matchers
-}
-
-// scopeProbe names the series whose identity labels decide a scope: one
-// selector per batch and, for a chart over a range, the window every identity
-// is collected over (an instant check would miss one that stopped reporting
-// minutes ago but still fills the chart).
-type scopeProbe struct {
-	metric string
-	// key is the label one Kubernetes object's series share (pod, claim).
-	key       string
-	selectors []string
-	window    time.Duration
-}
-
-func (p scopeProbe) over(sel string) string {
-	if p.window <= 0 {
-		return p.metric + "{" + sel + "}"
-	}
-	return "count_over_time(" + p.metric + "{" + sel + "}[" + p.window.String() + "])"
-}
-
 // ResolveCNPGScope decides the cluster-identity matchers for one namespace's
 // CNPG exporter series over window (0 for an instant read).
-func ResolveCNPGScope(ctx context.Context, namespace, selector string, anchors []prom.WorkloadPodIdentity, window time.Duration) (string, CNPGIsolation, error) {
+func ResolveCNPGScope(ctx context.Context, namespace, selector string, anchors []prom.WorkloadPodIdentity, window time.Duration) (string, SeriesIsolation, error) {
 	return resolveScope(ctx, namespace, scopeProbe{metric: "cnpg_collector_up", key: "pod", selectors: []string{selector}, window: window}, anchors, nil)
 }
 
-// ResolvePVCScope decides the cluster-identity matchers for the named claims'
-// kubelet volume stats over window (0 for an instant read).
-func ResolvePVCScope(ctx context.Context, namespace string, claims []string, anchors []prom.WorkloadPodIdentity, window time.Duration) (string, CNPGIsolation, error) {
-	m, iso, err := resolveScope(ctx, namespace, pvcScopeProbe(namespace, claims, window), anchors, nil)
-	return m, iso.forClaims(), err
-}
-
-// forClaims words an unverified match for volume stats, which are matched by
-// claim name rather than Pod name.
-func (iso CNPGIsolation) forClaims() CNPGIsolation {
-	if iso.Mode == CNPGIsolationUnverified {
-		iso.Note = "Matched by namespace and claim names. Radar couldn't confirm these volume stats belong to this exact cluster (no cluster label it could check)"
-	}
-	return iso
-}
-
-func pvcScopeProbe(namespace string, claims []string, window time.Duration) scopeProbe {
-	return scopeProbe{metric: "kubelet_volume_stats_capacity_bytes", key: "persistentvolumeclaim", selectors: CNPGClaimSelectors(namespace, claims), window: window}
-}
-
-// CNPGClaimSelectors selects the named claims of one namespace, in batches
-// that keep each regex matcher small.
-func CNPGClaimSelectors(namespace string, claims []string) []string {
-	names := make([]string, len(claims))
-	for i, c := range claims {
-		names[i] = regexp.QuoteMeta(c)
-	}
-	sort.Strings(names)
-	var out []string
-	for start := 0; start < len(names); start += pvcUsageBatchSize {
-		end := min(start+pvcUsageBatchSize, len(names))
-		out = append(out, "namespace="+strconv.Quote(namespace)+",persistentvolumeclaim=~"+strconv.Quote(strings.Join(names[start:end], "|")))
-	}
-	return out
-}
-
-// resolveScope applies an operator-configured scope first, then identity
-// labels proven by kube-state-metrics Pod UIDs. Only those two may add
-// matchers: labels merely seen on the series are not identity (the CNPG
-// exporter's own `cluster` label is the database cluster's name).
-// With no anchors, a cache lets the proof use the namespace's current Pods.
-func resolveScope(ctx context.Context, namespace string, probe scopeProbe, anchors []prom.WorkloadPodIdentity, cache *k8s.ResourceCache) (string, CNPGIsolation, error) {
-	client := GetClient()
-	if client == nil {
-		return "", CNPGIsolation{}, errors.New("Prometheus client not initialized")
-	}
-	if config, _, configured := client.workloadMetricsConfig(); configured {
-		m, err := config.Matchers()
-		if err != nil {
-			return "", CNPGIsolation{}, err
-		}
-		iso := CNPGIsolation{Mode: CNPGIsolationConfigured, Labels: config.ClusterLabels, Note: "Matched by the cluster labels an operator configured"}
-		if config.SingleCluster {
-			iso.Note = "An operator declared this Prometheus single-cluster"
-		}
-		return m, iso, nil
-	}
-	var verified map[string]string
-	if len(anchors) > 0 || cache != nil {
-		if cfg, err := client.historicalClusterScope(ctx, PodScope{Namespace: namespace, Identities: anchors}, cache); err == nil {
-			verified = cfg.ClusterLabels
-		}
-	}
-	return decideScope(ctx, client, probe, verified)
-}
-
-func decideScope(ctx context.Context, q cnpgQuerier, probe scopeProbe, verified map[string]string) (string, CNPGIsolation, error) {
-	if len(verified) > 0 {
-		m, err := prom.WorkloadMetricsScope{ClusterLabels: verified}.Matchers()
-		if err != nil {
-			return "", CNPGIsolation{}, err
-		}
-		for _, sel := range probe.selectors {
-			scoped, err := q.Query(ctx, "count("+probe.over(withScope(sel, m))+")")
-			if err != nil {
-				return "", CNPGIsolation{}, err
-			}
-			if len(scoped.Series) > 0 {
-				return m, cnpgVerifiedIsolation(verified), nil
-			}
-		}
-		for _, sel := range probe.selectors {
-			all, err := q.Query(ctx, "count("+probe.over(sel)+")")
-			if err != nil {
-				return "", CNPGIsolation{}, err
-			}
-			if len(all.Series) > 0 {
-				return "", CNPGIsolation{}, ErrCNPGScopeMismatch
-			}
-		}
-		return m, cnpgVerifiedIsolation(verified), nil
-	}
-	// Unproven: nothing is pinned. One object (Pod, claim) whose series carry
-	// more than one set of partition labels over the range may be two
-	// clusters' objects of the same name, so that is refused.
-	for _, sel := range probe.selectors {
-		res, err := q.Query(ctx, "max(count by ("+probe.key+") (count by ("+probe.key+","+strings.Join(partitionLabels, ",")+") ("+probe.over(sel)+")))")
-		if err != nil {
-			return "", CNPGIsolation{}, err
-		}
-		if len(res.Series) > 0 && len(res.Series[0].DataPoints) > 0 && res.Series[0].DataPoints[0].Value > 1 {
-			return "", CNPGIsolation{}, ErrCNPGScopeAmbiguous
-		}
-	}
-	return "", CNPGIsolation{Mode: CNPGIsolationUnverified, Note: "Matched by namespace and Pod names. Radar couldn't confirm these series belong to this exact cluster (no cluster label it could check)"}, nil
-}
-
-func cnpgVerifiedIsolation(labels map[string]string) CNPGIsolation {
-	return CNPGIsolation{Mode: CNPGIsolationVerified, Labels: labels, Note: "Matched by cluster labels confirmed against this cluster's Pods"}
-}
-
 // CNPGHistoryThreshold is a reference line on a chart.
 type CNPGHistoryThreshold struct {
 	Value float64 `json:"value"`
@@ -432,7 +270,7 @@ func QueryCNPGHistory(ctx context.Context, req CNPGHistoryRequest) ([]CNPGHistor
 	return queryCNPGHistory(ctx, client, req), nil
 }
 
-func queryCNPGHistory(ctx context.Context, q cnpgQuerier, req CNPGHistoryRequest) []CNPGHistoryChart {
+func queryCNPGHistory(ctx context.Context, q seriesQuerier, req CNPGHistoryRequest) []CNPGHistoryChart {
 	sel := withScope(CNPGInstanceSelector(req.Namespace, req.Cluster), req.Matchers)
 	pvcSel := ""
 	if len(req.Claims) > 0 {
@@ -483,7 +321,7 @@ func queryCNPGHistory(ctx context.Context, q cnpgQuerier, req CNPGHistoryRequest
 	return charts
 }
 
-func runCNPGHistoryChart(ctx context.Context, q cnpgQuerier, d cnpgHistoryDef, start, end time.Time, step time.Duration, c *CNPGHistoryChart) {
+func runCNPGHistoryChart(ctx context.Context, q seriesQuerier, d cnpgHistoryDef, start, end time.Time, step time.Duration, c *CNPGHistoryChart) {
 	series := []prom.Series{}
 	for _, query := range d.queries {
 		res, err := q.QueryRange(ctx, query.expr, start, end, step)
@@ -574,7 +412,7 @@ func QueryCNPGFleetLag(ctx context.Context, namespace string, clusters []string,
 
 // A Pod scraped but not in recovery answers -1 through the `or` branch, so one
 // query carries both lag and presence.
-func queryCNPGFleetLag(ctx context.Context, q cnpgQuerier, namespace string, clusters []string, matchers string) (CNPGFleetLag, error) {
+func queryCNPGFleetLag(ctx context.Context, q seriesQuerier, namespace string, clusters []string, matchers string) (CNPGFleetLag, error) {
 	sel := withScope(CNPGInstancesSelector(namespace, clusters), matchers)
 	query := "(max by (pod) (cnpg_pg_replication_lag{" + sel + "}) and on (pod) (max by (pod) (cnpg_pg_replication_in_recovery{" + sel + "}) == 1)) or (-1 * count by (pod) (cnpg_collector_up{" + sel + "}))"
 	res, err := q.Query(ctx, query)
@@ -610,7 +448,7 @@ func queryCNPGFleetLag(ctx context.Context, q cnpgQuerier, namespace string, clu
 
 // querySustainedCNPGLag is best effort: without it the fleet still shows the
 // current lag, it just raises no sustained-lag problem.
-func querySustainedCNPGLag(ctx context.Context, q cnpgQuerier, sel string, known map[string]bool) map[string]CNPGLagReading {
+func querySustainedCNPGLag(ctx context.Context, q seriesQuerier, sel string, known map[string]bool) map[string]CNPGLagReading {
 	// Exact on Prometheus 2.x and 3.x alike: every raw sample in the window is
 	// at least the reported floor, and the series already existed when the
 	// window began (it answers at offset 10m), so a standby that appeared a
@@ -653,7 +491,7 @@ func QueryCNPGDiskGrowth(ctx context.Context, namespace string, claims []string,
 	return queryCNPGDiskGrowth(ctx, client, namespace, claims, window, matchers)
 }
 
-func queryCNPGDiskGrowth(ctx context.Context, q cnpgQuerier, namespace string, claims []string, window time.Duration, matchers string) (map[string]float64, error) {
+func queryCNPGDiskGrowth(ctx context.Context, q seriesQuerier, namespace string, claims []string, window time.Duration, matchers string) (map[string]float64, error) {
 	out := map[string]float64{}
 	if len(claims) == 0 {
 		return out, nil
diff --git a/internal/prometheus/cnpg_history_test.go b/internal/prometheus/cnpg_history_test.go
index aec56b8068..f2c2daaafc 100644
--- a/internal/prometheus/cnpg_history_test.go
+++ b/internal/prometheus/cnpg_history_test.go
@@ -83,14 +83,14 @@ func TestDecideScopeRefusesAmbiguousIdentity(t *testing.T) {
 	q := &fakeCNPGQuerier{instant: func(string) (*prom.QueryResult, error) {
 		return &prom.QueryResult{Series: []prom.Series{vec(nil, 2)}}, nil
 	}}
-	if _, _, err := decideScope(context.Background(), q, cnpgProbe(0), nil); !errors.Is(err, ErrCNPGScopeAmbiguous) {
+	if _, _, err := decideScope(context.Background(), q, cnpgProbe(0), nil); !errors.Is(err, ErrScopeAmbiguous) {
 		t.Fatalf("err = %v, want ambiguous", err)
 	}
 	q.instant = func(string) (*prom.QueryResult, error) {
 		return &prom.QueryResult{Series: []prom.Series{vec(nil, 1)}}, nil
 	}
 	m, iso, err := decideScope(context.Background(), q, cnpgProbe(0), nil)
-	if err != nil || m != "" || iso.Mode != CNPGIsolationUnverified {
+	if err != nil || m != "" || iso.Mode != SeriesIsolationUnverified {
 		t.Fatalf("single identity: m=%q iso=%+v err=%v", m, iso, err)
 	}
 }
@@ -105,7 +105,7 @@ func TestDecideScopeChecksIdentitiesOverTheWholeRange(t *testing.T) {
 		}
 		return &prom.QueryResult{Series: []prom.Series{vec(nil, v)}}, nil
 	}}
-	if _, _, err := decideScope(context.Background(), q, cnpgProbe(time.Hour), nil); !errors.Is(err, ErrCNPGScopeAmbiguous) {
+	if _, _, err := decideScope(context.Background(), q, cnpgProbe(time.Hour), nil); !errors.Is(err, ErrScopeAmbiguous) {
 		t.Fatalf("err = %v, want ambiguous over the range; queries %v", err, q.queries)
 	}
 }
@@ -151,14 +151,14 @@ func TestDecideScopeVerifiedLabelsMustReachProbedSeries(t *testing.T) {
 		}
 		return &prom.QueryResult{Series: []prom.Series{vec(nil, 3)}}, nil
 	}}
-	if _, _, err := decideScope(context.Background(), q, cnpgProbe(0), map[string]string{"k8s_cluster_name": "east"}); !errors.Is(err, ErrCNPGScopeMismatch) {
+	if _, _, err := decideScope(context.Background(), q, cnpgProbe(0), map[string]string{"k8s_cluster_name": "east"}); !errors.Is(err, ErrScopeMismatch) {
 		t.Fatalf("err = %v, want mismatch", err)
 	}
 	q.instant = func(string) (*prom.QueryResult, error) {
 		return &prom.QueryResult{Series: []prom.Series{vec(nil, 3)}}, nil
 	}
 	m, iso, err := decideScope(context.Background(), q, cnpgProbe(0), map[string]string{"k8s_cluster_name": "east"})
-	if err != nil || m != `k8s_cluster_name="east"` || iso.Mode != CNPGIsolationVerified {
+	if err != nil || m != `k8s_cluster_name="east"` || iso.Mode != SeriesIsolationVerified {
 		t.Fatalf("verified: m=%q iso=%+v err=%v", m, iso, err)
 	}
 }
diff --git a/internal/prometheus/pvc_usage.go b/internal/prometheus/pvc_usage.go
index 93388af2cc..19aa5a8672 100644
--- a/internal/prometheus/pvc_usage.go
+++ b/internal/prometheus/pvc_usage.go
@@ -37,7 +37,7 @@ type PVCUsageBatch struct {
 	Usage   map[string]PVCUsage
 	Invalid map[string]bool
 	// Isolation says how the series were tied to this cluster.
-	Isolation CNPGIsolation
+	Isolation SeriesIsolation
 }
 
 // Claims per query: keeps the regex matcher and the answer small whatever the
@@ -76,9 +76,9 @@ func pvcScopeFailure(err error) (PVCUsageBatch, bool) {
 	switch {
 	case err == nil:
 		return out, false
-	case errors.Is(err, ErrCNPGScopeAmbiguous):
+	case errors.Is(err, ErrScopeAmbiguous):
 		out.Status, out.Error = PVCUsageAmbiguous, "these claim names have volume stats under more than one cluster identity in this Prometheus"
-	case errors.Is(err, ErrCNPGScopeMismatch):
+	case errors.Is(err, ErrScopeMismatch):
 		out.Status, out.Error = PVCUsageScopeMismatch, "the cluster identity proven for this cluster does not appear on these claims' volume stats"
 	default:
 		out.Status, out.Error = PVCUsageQueryFailed, err.Error()
@@ -86,9 +86,9 @@ func pvcScopeFailure(err error) (PVCUsageBatch, bool) {
 	return out, true
 }
 
-func queryPVCUsage(ctx context.Context, q cnpgQuerier, namespace string, claims []string, matchers string) PVCUsageBatch {
+func queryPVCUsage(ctx context.Context, q seriesQuerier, namespace string, claims []string, matchers string) PVCUsageBatch {
 	out := PVCUsageBatch{Status: PVCUsageAvailable, Usage: map[string]PVCUsage{}, Invalid: map[string]bool{}}
-	for _, sel := range CNPGClaimSelectors(namespace, claims) {
+	for _, sel := range ClaimSelectors(namespace, claims) {
 		if err := queryPVCUsageBatch(ctx, q, withScope(sel, matchers), &out); err != nil {
 			return PVCUsageBatch{Status: PVCUsageQueryFailed, Error: err.Error(), Usage: map[string]PVCUsage{}, Invalid: map[string]bool{}}
 		}
@@ -96,7 +96,7 @@ func queryPVCUsage(ctx context.Context, q cnpgQuerier, namespace string, claims
 	return out
 }
 
-func queryPVCUsageBatch(ctx context.Context, q cnpgQuerier, selector string, out *PVCUsageBatch) error {
+func queryPVCUsageBatch(ctx context.Context, q seriesQuerier, selector string, out *PVCUsageBatch) error {
 	used, err := q.Query(ctx, fmt.Sprintf(`max by (persistentvolumeclaim) (kubelet_volume_stats_used_bytes{%s})`, selector))
 	if err != nil {
 		return err
diff --git a/internal/prometheus/series_scope.go b/internal/prometheus/series_scope.go
new file mode 100644
index 0000000000..8186c04f5c
--- /dev/null
+++ b/internal/prometheus/series_scope.go
@@ -0,0 +1,181 @@
+package prometheus
+
+import (
+	"context"
+	"errors"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/skyhook-io/radar/internal/k8s"
+	"github.com/skyhook-io/radar/pkg/prom"
+)
+
+// A series scope keeps a query to this Kubernetes cluster's series in a
+// Prometheus that may hold several clusters' series under the same namespace
+// and object names.
+
+const (
+	SeriesIsolationConfigured = "configured"
+	SeriesIsolationVerified   = "verified"
+	SeriesIsolationUnverified = "unverified"
+)
+
+// ErrScopeAmbiguous means the selected series exist under more than one
+// cluster identity in this Prometheus, so any answer could mix clusters.
+var ErrScopeAmbiguous = errors.New("prometheus series scope: the selected series appear under more than one cluster identity")
+
+// ErrScopeMismatch means the verified cluster identity labels select none
+// of the probed series although unscoped ones exist.
+var ErrScopeMismatch = errors.New("prometheus series scope: cluster identity labels do not appear on the selected series")
+
+type seriesQuerier interface {
+	Query(ctx context.Context, query string) (*prom.QueryResult, error)
+	QueryRange(ctx context.Context, query string, start, end time.Time, step time.Duration) (*prom.QueryResult, error)
+}
+
+// SeriesIsolation says how the queries keep to this Kubernetes cluster's series.
+type SeriesIsolation struct {
+	Mode   string            `json:"mode"`
+	Labels map[string]string `json:"labels,omitempty"`
+	Note   string            `json:"note"`
+}
+
+func withScope(selector, matchers string) string {
+	if matchers == "" {
+		return selector
+	}
+	return selector + "," + matchers
+}
+
+// scopeProbe names the series whose identity labels decide a scope: one
+// selector per batch and, for a chart over a range, the window every identity
+// is collected over (an instant check would miss one that stopped reporting
+// minutes ago but still fills the chart).
+type scopeProbe struct {
+	metric string
+	// key is the label one Kubernetes object's series share (pod, claim).
+	key       string
+	selectors []string
+	window    time.Duration
+}
+
+func (p scopeProbe) over(sel string) string {
+	if p.window <= 0 {
+		return p.metric + "{" + sel + "}"
+	}
+	return "count_over_time(" + p.metric + "{" + sel + "}[" + p.window.String() + "])"
+}
+
+// ResolvePVCScope decides the cluster-identity matchers for the named claims'
+// kubelet volume stats over window (0 for an instant read).
+func ResolvePVCScope(ctx context.Context, namespace string, claims []string, anchors []prom.WorkloadPodIdentity, window time.Duration) (string, SeriesIsolation, error) {
+	m, iso, err := resolveScope(ctx, namespace, pvcScopeProbe(namespace, claims, window), anchors, nil)
+	return m, iso.forClaims(), err
+}
+
+// forClaims words an unverified match for volume stats, which are matched by
+// claim name rather than Pod name.
+func (iso SeriesIsolation) forClaims() SeriesIsolation {
+	if iso.Mode == SeriesIsolationUnverified {
+		iso.Note = "Matched by namespace and claim names. Radar couldn't confirm these volume stats belong to this exact cluster (no cluster label it could check)"
+	}
+	return iso
+}
+
+func pvcScopeProbe(namespace string, claims []string, window time.Duration) scopeProbe {
+	return scopeProbe{metric: "kubelet_volume_stats_capacity_bytes", key: "persistentvolumeclaim", selectors: ClaimSelectors(namespace, claims), window: window}
+}
+
+// ClaimSelectors selects the named claims of one namespace, in batches that
+// keep each regex matcher small.
+func ClaimSelectors(namespace string, claims []string) []string {
+	names := make([]string, len(claims))
+	for i, c := range claims {
+		names[i] = regexp.QuoteMeta(c)
+	}
+	sort.Strings(names)
+	var out []string
+	for start := 0; start < len(names); start += pvcUsageBatchSize {
+		end := min(start+pvcUsageBatchSize, len(names))
+		out = append(out, "namespace="+strconv.Quote(namespace)+",persistentvolumeclaim=~"+strconv.Quote(strings.Join(names[start:end], "|")))
+	}
+	return out
+}
+
+// resolveScope applies an operator-configured scope first, then identity
+// labels proven by kube-state-metrics Pod UIDs. Only those two may add
+// matchers: labels merely seen on the series are not identity (the CNPG
+// exporter's own `cluster` label is the database cluster's name).
+// With no anchors, a cache lets the proof use the namespace's current Pods.
+func resolveScope(ctx context.Context, namespace string, probe scopeProbe, anchors []prom.WorkloadPodIdentity, cache *k8s.ResourceCache) (string, SeriesIsolation, error) {
+	client := GetClient()
+	if client == nil {
+		return "", SeriesIsolation{}, errors.New("Prometheus client not initialized")
+	}
+	if config, _, configured := client.workloadMetricsConfig(); configured {
+		m, err := config.Matchers()
+		if err != nil {
+			return "", SeriesIsolation{}, err
+		}
+		iso := SeriesIsolation{Mode: SeriesIsolationConfigured, Labels: config.ClusterLabels, Note: "Matched by the cluster labels an operator configured"}
+		if config.SingleCluster {
+			iso.Note = "An operator declared this Prometheus single-cluster"
+		}
+		return m, iso, nil
+	}
+	var verified map[string]string
+	if len(anchors) > 0 || cache != nil {
+		if cfg, err := client.historicalClusterScope(ctx, PodScope{Namespace: namespace, Identities: anchors}, cache); err == nil {
+			verified = cfg.ClusterLabels
+		}
+	}
+	return decideScope(ctx, client, probe, verified)
+}
+
+func decideScope(ctx context.Context, q seriesQuerier, probe scopeProbe, verified map[string]string) (string, SeriesIsolation, error) {
+	if len(verified) > 0 {
+		m, err := prom.WorkloadMetricsScope{ClusterLabels: verified}.Matchers()
+		if err != nil {
+			return "", SeriesIsolation{}, err
+		}
+		for _, sel := range probe.selectors {
+			scoped, err := q.Query(ctx, "count("+probe.over(withScope(sel, m))+")")
+			if err != nil {
+				return "", SeriesIsolation{}, err
+			}
+			if len(scoped.Series) > 0 {
+				return m, verifiedIsolation(verified), nil
+			}
+		}
+		for _, sel := range probe.selectors {
+			all, err := q.Query(ctx, "count("+probe.over(sel)+")")
+			if err != nil {
+				return "", SeriesIsolation{}, err
+			}
+			if len(all.Series) > 0 {
+				return "", SeriesIsolation{}, ErrScopeMismatch
+			}
+		}
+		return m, verifiedIsolation(verified), nil
+	}
+	// Unproven: nothing is pinned. One object (Pod, claim) whose series carry
+	// more than one set of partition labels over the range may be two
+	// clusters' objects of the same name, so that is refused.
+	for _, sel := range probe.selectors {
+		res, err := q.Query(ctx, "max(count by ("+probe.key+") (count by ("+probe.key+","+strings.Join(partitionLabels, ",")+") ("+probe.over(sel)+")))")
+		if err != nil {
+			return "", SeriesIsolation{}, err
+		}
+		if len(res.Series) > 0 && len(res.Series[0].DataPoints) > 0 && res.Series[0].DataPoints[0].Value > 1 {
+			return "", SeriesIsolation{}, ErrScopeAmbiguous
+		}
+	}
+	return "", SeriesIsolation{Mode: SeriesIsolationUnverified, Note: "Matched by namespace and Pod names. Radar couldn't confirm these series belong to this exact cluster (no cluster label it could check)"}, nil
+}
+
+func verifiedIsolation(labels map[string]string) SeriesIsolation {
+	return SeriesIsolation{Mode: SeriesIsolationVerified, Labels: labels, Note: "Matched by cluster labels confirmed against this cluster's Pods"}
+}
diff --git a/internal/server/cnpg_history.go b/internal/server/cnpg_history.go
index 941ba2f28f..3c06fde97c 100644
--- a/internal/server/cnpg_history.go
+++ b/internal/server/cnpg_history.go
@@ -44,18 +44,18 @@ var cnpgHistoryMemoTTL = 15 * time.Second
 // in-browser samples. State describes the query as a whole; each chart
 // carries its own state when the whole succeeded.
 type CNPGClusterHistoryResponse struct {
-	Cluster     CNPGRuntimeObjectRef         `json:"cluster"`
-	Source      string                       `json:"source"`
-	State       string                       `json:"state,omitempty"`
-	Reason      string                       `json:"reason,omitempty"`
-	Range       string                       `json:"range"`
-	Start       string                       `json:"start,omitempty"`
-	End         string                       `json:"end,omitempty"`
-	StepSeconds int                          `json:"stepSeconds,omitempty"`
-	Selector    string                       `json:"selector,omitempty"`
-	Isolation   *prometheuspkg.CNPGIsolation `json:"isolation,omitempty"`
+	Cluster     CNPGRuntimeObjectRef           `json:"cluster"`
+	Source      string                         `json:"source"`
+	State       string                         `json:"state,omitempty"`
+	Reason      string                         `json:"reason,omitempty"`
+	Range       string                         `json:"range"`
+	Start       string                         `json:"start,omitempty"`
+	End         string                         `json:"end,omitempty"`
+	StepSeconds int                            `json:"stepSeconds,omitempty"`
+	Selector    string                         `json:"selector,omitempty"`
+	Isolation   *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 	// PVCIsolation is the volume chart's own: claims are matched apart from Pods.
-	PVCIsolation *prometheuspkg.CNPGIsolation     `json:"pvcIsolation,omitempty"`
+	PVCIsolation *prometheuspkg.SeriesIsolation   `json:"pvcIsolation,omitempty"`
 	SampledAt    string                           `json:"sampledAt"`
 	Charts       []prometheuspkg.CNPGHistoryChart `json:"charts"`
 }
@@ -217,9 +217,9 @@ func cnpgNoPrometheusReason(msg string) string {
 
 func cnpgHistoryScopeFailure(err error) (string, string) {
 	switch {
-	case errors.Is(err, prometheuspkg.ErrCNPGScopeAmbiguous):
+	case errors.Is(err, prometheuspkg.ErrScopeAmbiguous):
 		return cnpgHistoryStateAmbiguous, "This Prometheus holds series for these Pod names under more than one cluster identity, so history could mix clusters. An operator can configure the cluster identity labels Radar should require."
-	case errors.Is(err, prometheuspkg.ErrCNPGScopeMismatch):
+	case errors.Is(err, prometheuspkg.ErrScopeMismatch):
 		return cnpgHistoryStateScopeMismatch, "The cluster identity labels proven for this cluster do not appear on the CNPG exporter series, so Radar cannot tell this cluster's history from another's."
 	}
 	return cnpgHistoryStateError, "Prometheus query failed: " + truncateCNPGRuntimeError(err.Error())
@@ -228,9 +228,9 @@ func cnpgHistoryScopeFailure(err error) (string, string) {
 // cnpgUsageScopeFailure is cnpgHistoryScopeFailure for kubelet volume stats.
 func cnpgUsageScopeFailure(err error) (string, string) {
 	switch {
-	case errors.Is(err, prometheuspkg.ErrCNPGScopeAmbiguous):
+	case errors.Is(err, prometheuspkg.ErrScopeAmbiguous):
 		return cnpgHistoryStateAmbiguous, "This Prometheus holds volume stats for these claim names under more than one cluster identity, so a value could be another cluster's. An operator can configure the cluster identity labels Radar should require."
-	case errors.Is(err, prometheuspkg.ErrCNPGScopeMismatch):
+	case errors.Is(err, prometheuspkg.ErrScopeMismatch):
 		return cnpgHistoryStateScopeMismatch, "The cluster identity labels proven for this cluster do not appear on these claims' volume stats, so Radar cannot tell this cluster's volumes from another's."
 	}
 	return cnpgHistoryStateError, "Prometheus query failed: " + truncateCNPGRuntimeError(err.Error())
@@ -293,19 +293,19 @@ type CNPGFleetLag struct {
 	SustainedPod     string   `json:"sustainedPod,omitempty"`
 	SustainedWindow  string   `json:"sustainedWindow,omitempty"`
 	// Isolation says how the series were tied to this cluster.
-	Isolation *prometheuspkg.CNPGIsolation `json:"isolation,omitempty"`
+	Isolation *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 }
 
 // CNPGFleetGrowth State: ok (BytesPerHour of the fastest-growing claim),
 // noSeries, denied, unavailable, error or notRead.
 type CNPGFleetGrowth struct {
-	State        string                       `json:"state"`
-	Grant        string                       `json:"grant,omitempty"`
-	Reason       string                       `json:"reason,omitempty"`
-	BytesPerHour *float64                     `json:"bytesPerHour,omitempty"`
-	Claim        string                       `json:"claim,omitempty"`
-	Instance     string                       `json:"instance,omitempty"`
-	Isolation    *prometheuspkg.CNPGIsolation `json:"isolation,omitempty"`
+	State        string                         `json:"state"`
+	Grant        string                         `json:"grant,omitempty"`
+	Reason       string                         `json:"reason,omitempty"`
+	BytesPerHour *float64                       `json:"bytesPerHour,omitempty"`
+	Claim        string                         `json:"claim,omitempty"`
+	Instance     string                         `json:"instance,omitempty"`
+	Isolation    *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 }
 
 func (s *Server) handleCNPGFleetMetrics(w http.ResponseWriter, r *http.Request) {
@@ -413,7 +413,7 @@ func (s *Server) cnpgNamespaceFleetMetrics(r *http.Request, cache *k8s.ResourceC
 	claimsByCluster, growthCov := s.cnpgFleetClaims(r, cache, namespace, clusters)
 
 	matchers, scopeErr := "", error(nil)
-	var lagIso prometheuspkg.CNPGIsolation
+	var lagIso prometheuspkg.SeriesIsolation
 	if podsAllowed {
 		matchers, lagIso, scopeErr = prometheuspkg.ResolveCNPGScope(ctx, namespace, prometheuspkg.CNPGInstancesSelector(namespace, names), anchors, prometheuspkg.CNPGSustainedLagWindow)
 	}
diff --git a/internal/server/cnpg_history_test.go b/internal/server/cnpg_history_test.go
index 6bf8ce9a59..84a93806b5 100644
--- a/internal/server/cnpg_history_test.go
+++ b/internal/server/cnpg_history_test.go
@@ -98,11 +98,11 @@ func TestCNPGClusterHistory_ChartsFromPrometheus(t *testing.T) {
 	if status != http.StatusOK {
 		t.Fatalf("status = %d: %s", status, body)
 	}
-	if got.Source != cnpgHistorySourcePrometheus || got.State != cnpgHistoryStateOK || got.StepSeconds != 30 || got.Isolation == nil || got.Isolation.Mode != prometheuspkg.CNPGIsolationUnverified {
+	if got.Source != cnpgHistorySourcePrometheus || got.State != cnpgHistoryStateOK || got.StepSeconds != 30 || got.Isolation == nil || got.Isolation.Mode != prometheuspkg.SeriesIsolationUnverified {
 		t.Fatalf("got %+v", got)
 	}
 	// The volume chart's claims are matched apart from the instance Pods, and say so.
-	if got.PVCIsolation == nil || got.PVCIsolation.Mode != prometheuspkg.CNPGIsolationUnverified || !strings.Contains(got.PVCIsolation.Note, "claim names") {
+	if got.PVCIsolation == nil || got.PVCIsolation.Mode != prometheuspkg.SeriesIsolationUnverified || !strings.Contains(got.PVCIsolation.Note, "claim names") {
 		t.Errorf("pvcIsolation = %+v", got.PVCIsolation)
 	}
 	by := map[string]prometheuspkg.CNPGHistoryChart{}
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index 389d099e26..f99b00d007 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -64,7 +64,7 @@ type CNPGStorageCoverage struct {
 	Grant  string `json:"grant,omitempty"`
 	Reason string `json:"reason,omitempty"`
 	// Isolation, on usage read from Prometheus: how the series were tied to this cluster.
-	Isolation *prometheuspkg.CNPGIsolation `json:"isolation,omitempty"`
+	Isolation *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 }
 
 // CNPGClusterStorageResponse is GET /api/cnpg/clusters/{namespace}/{name}/storage.
@@ -507,10 +507,10 @@ func (s *Server) cnpgClaimUsage(r *http.Request, namespace string, claims []stri
 	case prometheuspkg.PVCUsageQueryFailed:
 		return CNPGStorageCoverage{State: cnpgUsageStateError, Reason: "Prometheus query failed: " + truncateCNPGRuntimeError(batch.Error)}, batch
 	case prometheuspkg.PVCUsageAmbiguous:
-		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrCNPGScopeAmbiguous)
+		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrScopeAmbiguous)
 		return CNPGStorageCoverage{State: cnpgHistoryStateAmbiguous, Reason: reason}, batch
 	case prometheuspkg.PVCUsageScopeMismatch:
-		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrCNPGScopeMismatch)
+		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrScopeMismatch)
 		return CNPGStorageCoverage{State: cnpgHistoryStateScopeMismatch, Reason: reason}, batch
 	}
 	iso := &batch.Isolation
@@ -525,8 +525,8 @@ func (s *Server) cnpgClaimUsage(r *http.Request, namespace string, claims []stri
 
 // cnpgUnverifiedCaveat qualifies a measurement stated as this cluster's when
 // its series were matched by name alone.
-func cnpgUnverifiedCaveat(iso *prometheuspkg.CNPGIsolation) string {
-	if iso == nil || iso.Mode != prometheuspkg.CNPGIsolationUnverified {
+func cnpgUnverifiedCaveat(iso *prometheuspkg.SeriesIsolation) string {
+	if iso == nil || iso.Mode != prometheuspkg.SeriesIsolationUnverified {
 		return ""
 	}
 	return ". " + iso.Note
@@ -562,7 +562,7 @@ func cnpgVolumeLabel(role, tablespace string) string {
 
 // cnpgDiskFindings reports volumes whose measured use crosses the thresholds.
 // Only a measurement can raise one; an unmeasured volume says nothing.
-func cnpgDiskFindings(instance string, volumes []CNPGStorageVolume, iso *prometheuspkg.CNPGIsolation) []CNPGStorageFinding {
+func cnpgDiskFindings(instance string, volumes []CNPGStorageVolume, iso *prometheuspkg.SeriesIsolation) []CNPGStorageFinding {
 	var out []CNPGStorageFinding
 	for _, v := range volumes {
 		if v.Usage.Ratio == nil || *v.Usage.Ratio < cnpgDiskWarningRatio {
@@ -763,15 +763,15 @@ type CNPGFleetDiskResponse struct {
 // noPrometheus, denied (Grant names what is missing), unavailable, error, or
 // notRead (the request's namespace bound was reached).
 type CNPGClusterDisk struct {
-	Namespace string                       `json:"namespace"`
-	Name      string                       `json:"name"`
-	State     string                       `json:"state"`
-	Grant     string                       `json:"grant,omitempty"`
-	Reason    string                       `json:"reason,omitempty"`
-	Claims    int                          `json:"claims"`
-	Measured  int                          `json:"measured"`
-	Max       *CNPGDiskUsage               `json:"max,omitempty"`
-	Isolation *prometheuspkg.CNPGIsolation `json:"isolation,omitempty"`
+	Namespace string                         `json:"namespace"`
+	Name      string                         `json:"name"`
+	State     string                         `json:"state"`
+	Grant     string                         `json:"grant,omitempty"`
+	Reason    string                         `json:"reason,omitempty"`
+	Claims    int                            `json:"claims"`
+	Measured  int                            `json:"measured"`
+	Max       *CNPGDiskUsage                 `json:"max,omitempty"`
+	Isolation *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 }
 
 type CNPGDiskUsage struct {
diff --git a/internal/server/cnpg_storage_test.go b/internal/server/cnpg_storage_test.go
index f3588f49b7..705d3066de 100644
--- a/internal/server/cnpg_storage_test.go
+++ b/internal/server/cnpg_storage_test.go
@@ -435,7 +435,7 @@ func TestCNPGDiskFindingsThresholds(t *testing.T) {
 	if got[1].Message != "The tablespace archive volume of pg-1 is 90% full" {
 		t.Errorf("message = %q", got[1].Message)
 	}
-	unverified := cnpgDiskFindings("pg-1", vols, &prometheuspkg.CNPGIsolation{Mode: prometheuspkg.CNPGIsolationUnverified, Note: "Radar couldn't confirm these volume stats belong to this exact cluster"})
+	unverified := cnpgDiskFindings("pg-1", vols, &prometheuspkg.SeriesIsolation{Mode: prometheuspkg.SeriesIsolationUnverified, Note: "Radar couldn't confirm these volume stats belong to this exact cluster"})
 	if !strings.Contains(unverified[1].Message, "couldn't confirm these volume stats belong to this exact cluster") {
 		t.Errorf("an unverified match must say so: %q", unverified[1].Message)
 	}

From 10eea3802ef41b70a2e3e00fd0a8b164f8b2da40 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 00:56:58 +0300
Subject: [PATCH 03/26] Name the informer cache-scope intersection for what it
 is

namespacesWithinCache, cacheCoversNamespace and the informerScope interface
move from capacity_auth.go to cache_scope.go: Capacity and CloudNativePG
both use them to tell what Radar's informer holds from what the caller
asked for. Behaviour, including nil (all namespaces) versus empty, is
unchanged.
---
 internal/server/cache_scope.go        | 58 +++++++++++++++++++++++++++
 internal/server/capacity.go           |  4 +-
 internal/server/capacity_auth.go      | 50 -----------------------
 internal/server/capacity_auth_test.go |  8 ++--
 internal/server/capacity_groups.go    |  4 +-
 internal/server/cnpg_cluster_ha.go    |  4 +-
 internal/server/cnpg_operator.go      |  2 +-
 internal/server/cnpg_storage.go       |  2 +-
 internal/server/cnpg_workspace.go     |  2 +-
 9 files changed, 71 insertions(+), 63 deletions(-)
 create mode 100644 internal/server/cache_scope.go

diff --git a/internal/server/cache_scope.go b/internal/server/cache_scope.go
new file mode 100644
index 0000000000..5f14b63391
--- /dev/null
+++ b/internal/server/cache_scope.go
@@ -0,0 +1,58 @@
+package server
+
+import "slices"
+
+// informerScope is the part of Radar's informer cache that says which
+// namespaces it holds for a resource.
+type informerScope interface {
+	IsKindClusterWide(string) bool
+	KindNamespaces(string) []string
+	IsKindReady(string) bool
+}
+
+type cacheNamespaceResult struct {
+	namespaces  []string
+	limited     bool
+	partial     bool
+	unavailable bool
+}
+
+// namespacesWithinCache narrows requested (nil = all namespaces) to what the
+// informer for resource holds. limited: the informer is not cluster-wide;
+// partial: some requested namespaces are not held; unavailable: none are.
+func namespacesWithinCache(cache informerScope, resource string, requested []string) cacheNamespaceResult {
+	result := cacheNamespaceResult{namespaces: requested}
+	if cache == nil || cache.IsKindClusterWide(resource) {
+		return result
+	}
+	result.limited = true
+	if noNamespaceAccess(requested) {
+		return result
+	}
+	cached := cache.KindNamespaces(resource)
+	if len(cached) == 0 {
+		result.namespaces = []string{}
+		result.unavailable = true
+		return result
+	}
+	result.namespaces = intersectNamespaces(cached, requested)
+	if requested == nil {
+		result.partial = true
+		return result
+	}
+	for _, namespace := range requested {
+		if !slices.Contains(cached, namespace) {
+			if len(result.namespaces) == 0 {
+				result.unavailable = true
+			} else {
+				result.partial = true
+			}
+			return result
+		}
+	}
+	return result
+}
+
+func cacheCoversNamespace(cache informerScope, resource, namespace string) bool {
+	return cache != nil && cache.IsKindReady(resource) && (cache.IsKindClusterWide(resource) || slices.Contains(cache.KindNamespaces(resource), namespace))
+}
diff --git a/internal/server/capacity.go b/internal/server/capacity.go
index 735a7b06ae..f79b99f3b3 100644
--- a/internal/server/capacity.go
+++ b/internal/server/capacity.go
@@ -441,7 +441,7 @@ func (s *Server) loadCapacityModel(w http.ResponseWriter, r *http.Request, ident
 	result.meta.Provider = capacityProvider(result.meta.Provider, nodePools, nodeClaims, nodeClasses, result.meta.Coverage)
 	resourceCache := k8s.GetResourceCache()
 	ownerResolutionAllowed, workloadAttributionPartial := capacityOwnerResolutionPermissions(pods, func(group, resource, namespace string) bool {
-		return s.canRead(r, group, resource, namespace, "list") && capacityCacheCoversNamespace(resourceCache, resource, namespace)
+		return s.canRead(r, group, resource, namespace, "list") && cacheCoversNamespace(resourceCache, resource, namespace)
 	})
 	if workloadAttributionPartial {
 		coverage := result.meta.Coverage[capacityapi.CoverageWorkloads]
@@ -712,7 +712,7 @@ func (s *Server) loadCapacityPods(r *http.Request, meta *capacityapi.ResponseMet
 		return nil
 	}
 	sourceNamespaces := namespaces
-	cacheNamespaces := capacityNamespacesWithinCache(cache, "pods", sourceNamespaces)
+	cacheNamespaces := namespacesWithinCache(cache, "pods", sourceNamespaces)
 	namespaces = cacheNamespaces.namespaces
 	if cacheNamespaces.unavailable {
 		coverage := unavailableCoverage("pod_cache_scope_unavailable", []string{"scheduledRequests", "aggregateDemand", "workloads", "summary.actions", "demand.summary"})
diff --git a/internal/server/capacity_auth.go b/internal/server/capacity_auth.go
index e2b4619f0e..40ff2bfbfc 100644
--- a/internal/server/capacity_auth.go
+++ b/internal/server/capacity_auth.go
@@ -37,53 +37,3 @@ func (s *Server) capacityNamespacesForSource(r *http.Request, namespaces []strin
 	}
 	return s.filterNamespacesByCanRead(r, group, resource, "list", namespaces)
 }
-
-type capacityInformerScope interface {
-	IsKindClusterWide(string) bool
-	KindNamespaces(string) []string
-	IsKindReady(string) bool
-}
-
-type capacityCacheNamespaceResult struct {
-	namespaces  []string
-	limited     bool
-	partial     bool
-	unavailable bool
-}
-
-func capacityNamespacesWithinCache(cache capacityInformerScope, resource string, requested []string) capacityCacheNamespaceResult {
-	result := capacityCacheNamespaceResult{namespaces: requested}
-	if cache == nil || cache.IsKindClusterWide(resource) {
-		return result
-	}
-	result.limited = true
-	if noNamespaceAccess(requested) {
-		return result
-	}
-	cached := cache.KindNamespaces(resource)
-	if len(cached) == 0 {
-		result.namespaces = []string{}
-		result.unavailable = true
-		return result
-	}
-	result.namespaces = intersectNamespaces(cached, requested)
-	if requested == nil {
-		result.partial = true
-		return result
-	}
-	for _, namespace := range requested {
-		if !slices.Contains(cached, namespace) {
-			if len(result.namespaces) == 0 {
-				result.unavailable = true
-			} else {
-				result.partial = true
-			}
-			return result
-		}
-	}
-	return result
-}
-
-func capacityCacheCoversNamespace(cache capacityInformerScope, resource, namespace string) bool {
-	return cache != nil && cache.IsKindReady(resource) && (cache.IsKindClusterWide(resource) || slices.Contains(cache.KindNamespaces(resource), namespace))
-}
diff --git a/internal/server/capacity_auth_test.go b/internal/server/capacity_auth_test.go
index ac548f06f0..414211b198 100644
--- a/internal/server/capacity_auth_test.go
+++ b/internal/server/capacity_auth_test.go
@@ -99,7 +99,7 @@ func TestCapacityNamespacesHonorInformerCoverage(t *testing.T) {
 	limited := capacityTestInformerScope{namespaces: map[string][]string{"pods": {"team-a", "team-b"}}}
 	tests := []struct {
 		name            string
-		cache           capacityInformerScope
+		cache           informerScope
 		requested       []string
 		want            []string
 		wantLimited     bool
@@ -115,7 +115,7 @@ func TestCapacityNamespacesHonorInformerCoverage(t *testing.T) {
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			got := capacityNamespacesWithinCache(test.cache, "pods", test.requested)
+			got := namespacesWithinCache(test.cache, "pods", test.requested)
 			if !slices.Equal(got.namespaces, test.want) || got.limited != test.wantLimited || got.partial != test.wantPartial || got.unavailable != test.wantUnavailable {
 				t.Fatalf("cache namespaces = %#v, want namespaces=%v limited=%v partial=%v unavailable=%v", got, test.want, test.wantLimited, test.wantPartial, test.wantUnavailable)
 			}
@@ -132,13 +132,13 @@ func TestCapacityOwnerResolutionHonorsInformerCoverage(t *testing.T) {
 		"jobs":        {"team-b"},
 	}}
 	permissions, partial := capacityOwnerResolutionPermissions([]*corev1.Pod{replicaPod, jobPod}, func(_ string, resource, namespace string) bool {
-		return capacityCacheCoversNamespace(cache, resource, namespace)
+		return cacheCoversNamespace(cache, resource, namespace)
 	})
 	if permissions[replicaPod] || !permissions[jobPod] || !partial {
 		t.Fatalf("owner permissions = %#v partial=%v, want ReplicaSet denied and Job allowed", permissions, partial)
 	}
 	cache.notReady = map[string]bool{"jobs": true}
-	if capacityCacheCoversNamespace(cache, "jobs", "team-b") {
+	if cacheCoversNamespace(cache, "jobs", "team-b") {
 		t.Fatal("owner resolution used an informer that has not synced")
 	}
 }
diff --git a/internal/server/capacity_groups.go b/internal/server/capacity_groups.go
index 7c97d70b5e..2ab315bbfd 100644
--- a/internal/server/capacity_groups.go
+++ b/internal/server/capacity_groups.go
@@ -21,7 +21,7 @@ const (
 // needs: informer scope plus the ConfigMap lister. Narrowed to an interface so
 // the coverage-verdict/detection pairing is testable without an informer.
 type capacityConfigMapSource interface {
-	capacityInformerScope
+	informerScope
 	ConfigMaps() corelisters.ConfigMapLister
 }
 
@@ -53,7 +53,7 @@ func capacityAutoscalerStatus(allowed bool, cache capacityConfigMapSource) (*aut
 	if !allowed {
 		return unavailable(deniedCoverage("autoscaler_status_configmap_denied", impact))
 	}
-	if cache == nil || !capacityCacheCoversNamespace(cache, "configmaps", autoscalerStatusNamespace) {
+	if cache == nil || !cacheCoversNamespace(cache, "configmaps", autoscalerStatusNamespace) {
 		return unavailable(unavailableCoverage("autoscaler_status_cache_scope", impact))
 	}
 	lister := cache.ConfigMaps()
diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index 0a03a602e3..47b7dee4e0 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -500,7 +500,7 @@ func (s *Server) cnpgHAPDBs(r *http.Request, cache *k8s.ResourceCache, cluster *
 		return out
 	}
 	lister := cache.PodDisruptionBudgets()
-	within := capacityNamespacesWithinCache(cache, "poddisruptionbudgets", []string{namespace})
+	within := namespacesWithinCache(cache, "poddisruptionbudgets", []string{namespace})
 	if reason := cnpgUncachedReason("Disruption budgets", "PodDisruptionBudgets", namespace, lister == nil, within.unavailable, cache.IsKindReady("poddisruptionbudgets")); reason != "" {
 		out.CNPGHASource = CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
 		return out
@@ -643,7 +643,7 @@ func (s *Server) cnpgHAJobs(r *http.Request, cache *k8s.ResourceCache, cluster *
 		return out
 	}
 	lister := cache.Jobs()
-	within := capacityNamespacesWithinCache(cache, "jobs", []string{namespace})
+	within := namespacesWithinCache(cache, "jobs", []string{namespace})
 	if reason := cnpgUncachedReason("Instance Jobs", "Jobs", namespace, lister == nil, within.unavailable, cache.IsKindReady("jobs")); reason != "" {
 		out.CNPGHASource = CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
 		return out
diff --git a/internal/server/cnpg_operator.go b/internal/server/cnpg_operator.go
index 803a1e06ca..911d7eb1c6 100644
--- a/internal/server/cnpg_operator.go
+++ b/internal/server/cnpg_operator.go
@@ -343,7 +343,7 @@ func (s *Server) cnpgOperatorConfigMap(r *http.Request, cache *k8s.ResourceCache
 		state.Reason = "ConfigMaps are still loading"
 		return ref
 	}
-	if !capacityCacheCoversNamespace(cache, "configmaps", namespace) {
+	if !cacheCoversNamespace(cache, "configmaps", namespace) {
 		state.Reason = "Radar does not watch ConfigMaps in " + namespace
 		return ref
 	}
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index f99b00d007..99b5689927 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -298,7 +298,7 @@ func cnpgCachedClaims(cache *k8s.ResourceCache, namespace string, selector label
 	if lister == nil {
 		return nil, "Radar's own identity cannot list persistentvolumeclaims"
 	}
-	if within := capacityNamespacesWithinCache(cache, "persistentvolumeclaims", []string{namespace}); within.unavailable {
+	if within := namespacesWithinCache(cache, "persistentvolumeclaims", []string{namespace}); within.unavailable {
 		return nil, "Radar's own identity cannot list persistentvolumeclaims in " + namespace
 	}
 	items, err := lister.PersistentVolumeClaims(namespace).List(selector)
diff --git a/internal/server/cnpg_workspace.go b/internal/server/cnpg_workspace.go
index 4cc2dddc18..5faaed28de 100644
--- a/internal/server/cnpg_workspace.go
+++ b/internal/server/cnpg_workspace.go
@@ -523,7 +523,7 @@ func (s *Server) cnpgTypedScope(r *http.Request, cache *k8s.ResourceCache, names
 	if !ok {
 		return cnpgKindAccess{state: cnpgCoverageDenied}, nil, []string{}
 	}
-	within := capacityNamespacesWithinCache(cache, resource, allowed)
+	within := namespacesWithinCache(cache, resource, allowed)
 	if within.unavailable {
 		log.Printf("[cnpg] %s cache does not cover the requested scope", resource)
 		return cnpgKindAccess{state: cnpgCoverageError}, nil, []string{}

From 7a5912e2e489bdc6b8ed9d93794055dca861d764 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:10:33 +0300
Subject: [PATCH 04/26] Share workspace screen primitives between Capacity and
 CloudNativePG

web/src/components/workspace holds what both workspaces' screens are built
from: Notice, ScreenEmptyState, ScreenBody, Segments, FilterChips,
SectionTable, the shared table classes, text helpers and the
refresh-failed notice. CloudNativePG no longer imports Capacity's internals,
and keeps only its own header, gate and coverage wrappers.

The drawer-trail URL codec moves to utils/drawer-trail, the back label and
the subject-filtered Issues link to utils/page-links, and CloudNativePG's
detail kinds take kind and group from the workspace kind table.
---
 web/src/App.tsx                               |   2 +-
 .../components/capacity/CapacityActivity.tsx  |  34 +--
 .../components/capacity/CapacityDemand.tsx    |  40 +--
 .../components/capacity/CapacityOverview.tsx  |  47 +---
 .../capacity/CapacityPoolDetail.tsx           |  60 +---
 .../capacity/ClusterSchedulingCard.tsx        |  11 +-
 .../capacity/certaintyGlyph.test.tsx          |  10 +-
 web/src/components/capacity/shared.tsx        |  56 +---
 .../components/cnpg/CNPGBlockingSessions.tsx  |   4 +-
 .../components/cnpg/CNPGClusterActivity.tsx   |   3 +-
 .../components/cnpg/CNPGClusterRuntime.tsx    |   7 +-
 web/src/components/cnpg/CNPGDeclarations.tsx  |  23 +-
 web/src/components/cnpg/CNPGDetailPage.tsx    |   6 +-
 web/src/components/cnpg/CNPGDrawerTrail.tsx   |   4 +-
 web/src/components/cnpg/CNPGOperator.tsx      |  15 +-
 .../components/cnpg/CNPGOperatorDiagnosis.tsx |   2 +-
 web/src/components/cnpg/CNPGOverview.tsx      |  14 +-
 web/src/components/cnpg/CNPGPooling.tsx       |  15 +-
 web/src/components/cnpg/CNPGProtection.tsx    |  17 +-
 web/src/components/cnpg/CNPGStorage.tsx       |   5 +-
 web/src/components/cnpg/CNPGSummaryHost.tsx   |  15 +-
 web/src/components/cnpg/CNPGTrends.tsx        |   3 +-
 web/src/components/cnpg/CNPGView.tsx          |   7 +-
 web/src/components/cnpg/grantText.test.tsx    |   2 +-
 web/src/components/cnpg/paths.test.ts         |  13 +-
 web/src/components/cnpg/paths.ts              |  22 --
 .../components/cnpg/refreshNotice.test.tsx    |  10 +-
 web/src/components/cnpg/routes.test.ts        |   7 +-
 web/src/components/cnpg/routes.ts             |  69 ++---
 web/src/components/cnpg/shared.tsx            | 230 +---------------
 web/src/components/workspace/layout.tsx       | 260 ++++++++++++++++++
 web/src/components/workspace/table.ts         |   8 +
 web/src/utils/drawer-trail.ts                 |  35 +++
 web/src/utils/page-links.ts                   |  21 ++
 34 files changed, 437 insertions(+), 640 deletions(-)
 create mode 100644 web/src/components/workspace/layout.tsx
 create mode 100644 web/src/components/workspace/table.ts
 create mode 100644 web/src/utils/drawer-trail.ts
 create mode 100644 web/src/utils/page-links.ts

diff --git a/web/src/App.tsx b/web/src/App.tsx
index fba17fd1d6..0ba540f3e8 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -40,7 +40,7 @@ import type { FleetTakeoverTarget } from './context/NavCustomization'
 import { PrimaryNavRail } from './components/nav/PrimaryNavRail'
 import { CNPGView } from './components/cnpg/CNPGView'
 import { CNPG_SCREENS, cnpgDetailKindFor, cnpgDetailPath, parseCNPGRoute } from './components/cnpg/routes'
-import { currentPageLabel } from './components/cnpg/paths'
+import { currentPageLabel } from './utils/page-links'
 import { navigateFromPrimaryRail } from './components/nav/navigation'
 import { useNavRailPinned } from './hooks/useNavRailPinned'
 import { useMediaQuery } from './hooks/useMediaQuery'
diff --git a/web/src/components/capacity/CapacityActivity.tsx b/web/src/components/capacity/CapacityActivity.tsx
index 49168872fb..a7e2cc7d74 100644
--- a/web/src/components/capacity/CapacityActivity.tsx
+++ b/web/src/components/capacity/CapacityActivity.tsx
@@ -17,37 +17,9 @@ import {
   useCapacityActivity,
 } from "../../api/client";
 import type { SelectedResource } from "../../types";
-import {
-  ActivityStateBadge,
-  CapacityFreshness,
-  InlineEmpty,
-  LinkButton,
-  Notice,
-  PageControls,
-  PoolSelector,
-  ROW_HOVER,
-  ScopeBadges,
-  ScrollableContent,
-  TABLE_HEAD,
-  TABLE_WRAP,
-  TBODY,
-  TD,
-  TH,
-  activityTypeLabel,
-  activityWindowPreset,
-  coverageHasObservations,
-  coverageIsLowerBound,
-  coverageMessage,
-  errorMessage,
-  formatTimestamp,
-  identityKey,
-  identityToSelectedResource,
-  integrationBlock,
-  relativeTime,
-  retentionLabel,
-  useCapacityCursorRecovery,
-  useCapacityPagination,
-} from "./shared";
+import { ActivityStateBadge, CapacityFreshness, InlineEmpty, LinkButton, PageControls, PoolSelector, ScopeBadges, ScrollableContent, activityTypeLabel, activityWindowPreset, coverageHasObservations, coverageIsLowerBound, coverageMessage, errorMessage, formatTimestamp, identityKey, identityToSelectedResource, integrationBlock, relativeTime, retentionLabel, useCapacityCursorRecovery, useCapacityPagination } from "./shared";
+import { Notice } from "../workspace/layout";
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
 const WINDOW_PILLS: [number | undefined, string][] = [
   [undefined, "Retained"],
diff --git a/web/src/components/capacity/CapacityDemand.tsx b/web/src/components/capacity/CapacityDemand.tsx
index 7dfe268fdb..4e092a8b46 100644
--- a/web/src/components/capacity/CapacityDemand.tsx
+++ b/web/src/components/capacity/CapacityDemand.tsx
@@ -21,41 +21,9 @@ import {
 } from "../../api/client";
 import type { SelectedResource } from "../../types";
 import { refToSelectedResource } from "../../utils/navigation";
-import {
-  CapacityFreshness,
-  CapacityIssueEvidence,
-  DemandStateBadge,
-  EmptyState,
-  InlineEmpty,
-  LinkButton,
-  Notice,
-  PageControls,
-  PoolEvaluationBadge,
-  PoolSelector,
-  QuantityInline,
-  ResourceLink,
-  ROW_HOVER,
-  ScopeBadges,
-  ScrollableContent,
-  TABLE_HEAD,
-  TABLE_WRAP,
-  TBODY,
-  TD,
-  TH,
-  coverageHasObservations,
-  coverageIsLowerBound,
-  coverageMessage,
-  demandStateLabel,
-  errorMessage,
-  formatTimestamp,
-  humanizeCode,
-  identityKey,
-  integrationBlock,
-  namespaceCoverageDescription,
-  quantityText,
-  useCapacityCursorRecovery,
-  useCapacityPagination,
-} from "./shared";
+import { CapacityFreshness, CapacityIssueEvidence, DemandStateBadge, InlineEmpty, LinkButton, PageControls, PoolEvaluationBadge, PoolSelector, QuantityInline, ResourceLink, ScopeBadges, ScrollableContent, coverageHasObservations, coverageIsLowerBound, coverageMessage, demandStateLabel, errorMessage, formatTimestamp, humanizeCode, identityKey, integrationBlock, namespaceCoverageDescription, quantityText, useCapacityCursorRecovery, useCapacityPagination } from "./shared";
+import { Notice, ScreenEmptyState } from "../workspace/layout";
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
 const STATE_PILLS: [CapacityDemandState | undefined, string][] = [
   [undefined, "All states"],
@@ -184,7 +152,7 @@ export function CapacityDemand({
   const clearPodFilter = () => updateSearchParam("pod", undefined);
   if (poolFilter && !responseData && isNotFoundError(query.error)) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={AlertTriangle}
         title="NodePool not found"
         detail={`This link evaluates demand against NodePool “${poolFilter}”, which no longer exists. It may have been removed or belongs to another cluster context.`}
diff --git a/web/src/components/capacity/CapacityOverview.tsx b/web/src/components/capacity/CapacityOverview.tsx
index a4af33d511..90c46150b7 100644
--- a/web/src/components/capacity/CapacityOverview.tsx
+++ b/web/src/components/capacity/CapacityOverview.tsx
@@ -25,48 +25,9 @@ import { ClusterSchedulingCard } from "./ClusterSchedulingCard";
 import { Badge } from "@skyhook-io/k8s-ui/components/ui/Badge";
 import type { useCapacityOverview } from "../../api/client";
 import type { SelectedResource } from "../../types";
-import {
-  actionSeverity,
-  CapacityFreshness,
-  capacityManagerLabel,
-  coverageHasObservations,
-  coverageIsDenied,
-  coverageIsLowerBound,
-  CertaintyGlyph,
-  formatQuantity,
-  coverageMessage,
-  DeniedBadge,
-  EmptyState,
-  errorMessage,
-  formatTimestamp,
-  humanizeCode,
-  identityToSelectedResource,
-  InlineEmpty,
-  integrationBlock,
-  InventoryQuantityCell,
-  KpiTile,
-  LinkButton,
-  managerStatusTone,
-  Notice,
-  pickWorstPressure,
-  PoolReadyBadge,
-  poolReadinessDetail,
-  RefreshError,
-  relativeTime,
-  ROW_HOVER,
-  ScopeBadges,
-  ScrollableContent,
-  SectionCard,
-  shortResourceLabel,
-  sortedResourceEntries,
-  TABLE_HEAD,
-  TABLE_WRAP,
-  TBODY,
-  TD,
-  TH,
-  worstManagerStatus,
-  type CapacityConnectionState,
-} from "./shared";
+import { actionSeverity, CapacityFreshness, capacityManagerLabel, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, CertaintyGlyph, formatQuantity, coverageMessage, DeniedBadge, errorMessage, formatTimestamp, humanizeCode, identityToSelectedResource, InlineEmpty, integrationBlock, InventoryQuantityCell, KpiTile, LinkButton, managerStatusTone, pickWorstPressure, PoolReadyBadge, poolReadinessDetail, RefreshError, relativeTime, ScopeBadges, ScrollableContent, SectionCard, shortResourceLabel, sortedResourceEntries, worstManagerStatus, type CapacityConnectionState } from "./shared";
+import { Notice, ScreenEmptyState } from "../workspace/layout";
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
 const EXPLAIN_CARDS: { term: string; body: string }[] = [
   {
@@ -337,7 +298,7 @@ export function CapacityOverview({
   // NodePool coverage by definition — that is not an error to block on.
   if (karpenterActive && !coverageHasObservations(data.coverage.nodePools)) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={Layers3}
         title="NodePool inventory unavailable"
         detail={coverageMessage(data.coverage.nodePools, "NodePool inventory")}
diff --git a/web/src/components/capacity/CapacityPoolDetail.tsx b/web/src/components/capacity/CapacityPoolDetail.tsx
index 28d83f3782..d6f96073a8 100644
--- a/web/src/components/capacity/CapacityPoolDetail.tsx
+++ b/web/src/components/capacity/CapacityPoolDetail.tsx
@@ -19,59 +19,9 @@ import {
 } from "../../api/client";
 import type { SelectedResource } from "../../types";
 import { refToSelectedResource } from "../../utils/navigation";
-import {
-  ActualUsageDetail,
-  ActualUsageInline,
-  CapacityFreshness,
-  CapacityIssueEvidence,
-  CertaintyGlyph,
-  ClaimStageBadge,
-  conditionSummary,
-  ConditionBadge,
-  coverageHasObservations,
-  coverageIsDenied,
-  coverageIsLowerBound,
-  coverageMessage,
-  DeniedBadge,
-  EmptyState,
-  errorMessage,
-  formatQuantity,
-  formatTaint,
-  humanizeCode,
-  identityKey,
-  identityToSelectedResource,
-  InlineEmpty,
-  integrationBlock,
-  KeyValueRows,
-  LinkButton,
-  memberCoverageSource,
-  MiniCount,
-  NodeReadyBadge,
-  Notice,
-  observationTitle,
-  PoolReadyBadge,
-  POOL_SECTIONS,
-  PressureDetail,
-  quantityResourceRank,
-  QuantityInline,
-  RefreshError,
-  resourceLabel,
-  ResourceLink,
-  ROW_HOVER,
-  ScopeBadges,
-  ScrollableContent,
-  SectionCard,
-  TABLE_HEAD,
-  TABLE_WRAP,
-  TBODY,
-  TD,
-  TH,
-  TokenGroup,
-  useCapacityCursorRecovery,
-  useCapacityPagination,
-  type CapacityConnectionState,
-  type PoolSection,
-} from "./shared";
+import { ActualUsageDetail, ActualUsageInline, CapacityFreshness, CapacityIssueEvidence, CertaintyGlyph, ClaimStageBadge, conditionSummary, ConditionBadge, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, coverageMessage, DeniedBadge, errorMessage, formatQuantity, formatTaint, humanizeCode, identityKey, identityToSelectedResource, InlineEmpty, integrationBlock, KeyValueRows, LinkButton, memberCoverageSource, MiniCount, NodeReadyBadge, observationTitle, PoolReadyBadge, POOL_SECTIONS, PressureDetail, quantityResourceRank, QuantityInline, RefreshError, resourceLabel, ResourceLink, ScopeBadges, ScrollableContent, SectionCard, TokenGroup, useCapacityCursorRecovery, useCapacityPagination, type CapacityConnectionState, type PoolSection } from "./shared";
+import { Notice, ScreenEmptyState } from "../workspace/layout";
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
 export function CapacityPoolDetail({
   name,
@@ -123,7 +73,7 @@ export function CapacityPoolDetail({
   const response = query.data;
   if (response && !coverageHasObservations(response.coverage.nodePools)) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={Layers3}
         title="NodePool inventory unavailable"
         detail={coverageMessage(
@@ -136,7 +86,7 @@ export function CapacityPoolDetail({
   const pool = response?.pool;
   if (!response || !pool) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={CircleHelp}
         title="NodePool unavailable"
         detail="The Capacity API did not return an observation for this NodePool."
diff --git a/web/src/components/capacity/ClusterSchedulingCard.tsx b/web/src/components/capacity/ClusterSchedulingCard.tsx
index 395e34bbe9..c9506f7cf4 100644
--- a/web/src/components/capacity/ClusterSchedulingCard.tsx
+++ b/web/src/components/capacity/ClusterSchedulingCard.tsx
@@ -9,16 +9,7 @@ import {
   parseCPUToNanocores,
   parseQuantityToNumber,
 } from "@skyhook-io/k8s-ui/utils/format";
-import {
-  CertaintyGlyph,
-  LinkButton,
-  SectionCard,
-  certaintyGlyph,
-  certaintyValueLabel,
-  formatQuantity,
-  quantityResourceRank,
-  resourceLabel,
-} from "./shared";
+import { CertaintyGlyph, LinkButton, SectionCard, certaintyGlyph, certaintyValueLabel, formatQuantity, quantityResourceRank, resourceLabel } from "./shared";
 
 // Karpenter scheduling capacity — the fleet-level "how full is Karpenter, and
 // how much is knocking at the door" bar. Karpenter-pooled nodes only: on mixed
diff --git a/web/src/components/capacity/certaintyGlyph.test.tsx b/web/src/components/capacity/certaintyGlyph.test.tsx
index 154b6dbb52..841d339671 100644
--- a/web/src/components/capacity/certaintyGlyph.test.tsx
+++ b/web/src/components/capacity/certaintyGlyph.test.tsx
@@ -4,15 +4,7 @@ import type {
   CapacityActivityState,
   CapacityQuantityObservation,
 } from "@skyhook-io/k8s-ui";
-import {
-  DeniedCapacityState,
-  ActivityStateBadge,
-  CertaintyGlyph,
-  InventoryQuantityCell,
-  QuantityInline,
-  certaintyGlyph,
-  managerStatusRank,
-} from "./shared";
+import { DeniedCapacityState, ActivityStateBadge, CertaintyGlyph, InventoryQuantityCell, QuantityInline, certaintyGlyph, managerStatusRank } from "./shared";
 
 function observation(
   certainty: CapacityQuantityObservation["certainty"],
diff --git a/web/src/components/capacity/shared.tsx b/web/src/components/capacity/shared.tsx
index 4c4e5c1b64..c6b1db51d2 100644
--- a/web/src/components/capacity/shared.tsx
+++ b/web/src/components/capacity/shared.tsx
@@ -2,7 +2,6 @@ import {
   useCallback,
   useEffect,
   useState,
-  type ComponentType,
   type ReactNode,
 } from "react";
 import {
@@ -59,6 +58,7 @@ import {
 } from "../../api/client";
 import type { SelectedResource } from "../../types";
 import { refToSelectedResource } from "../../utils/navigation";
+import { Notice, ScreenEmptyState } from "../workspace/layout";
 
 // ============================================================================
 // Route model + navigation
@@ -1250,15 +1250,6 @@ export function TokenGroup({
   );
 }
 
-export function Notice({ children }: { children: ReactNode }) {
-  return (
-    <div className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-surface px-3 py-2 text-sm text-theme-text-secondary">
-      <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-theme-text-tertiary" />
-      <div>{children}</div>
-    </div>
-  );
-}
-
 export function RefreshError({ message }: { message: string }) {
   return (
     <Notice>
@@ -1336,31 +1327,6 @@ export function InlineEmpty({
   );
 }
 
-export function EmptyState({
-  icon: Icon,
-  title,
-  detail,
-  action,
-}: {
-  icon: ComponentType<{ className?: string }>;
-  title: string;
-  detail: ReactNode;
-  action?: ReactNode;
-}) {
-  return (
-    <div className="flex min-h-0 flex-1 items-center justify-center bg-theme-base p-6">
-      <div className="max-w-md text-center">
-        <Icon className="mx-auto h-9 w-9 text-theme-text-tertiary/50" />
-        <h2 className="mt-3 text-lg font-medium text-theme-text-primary">
-          {title}
-        </h2>
-        <p className="mt-1 text-sm text-theme-text-secondary">{detail}</p>
-        {action}
-      </div>
-    </div>
-  );
-}
-
 export function ScrollableContent({ children }: { children: ReactNode }) {
   // Expanding/collapsing cards can toggle the scrollbar; a stable gutter
   // keeps the centered column from shifting sideways when that happens.
@@ -1469,7 +1435,7 @@ rules:
 export function DeniedCapacityState({ detail }: { detail: string }) {
   const [copied, setCopied] = useState(false);
   return (
-    <EmptyState
+    <ScreenEmptyState
       icon={Shield}
       title="Capacity access denied"
       detail={detail}
@@ -1528,7 +1494,7 @@ export function integrationBlock(
     const upgrade = getRadarUpgradeRequirement(error);
     if (upgrade)
       return (
-        <EmptyState
+        <ScreenEmptyState
           icon={Gauge}
           title={radarUpgradeHeadline("Capacity")}
           detail={radarUpgradeDetail(upgrade)}
@@ -1540,7 +1506,7 @@ export function integrationBlock(
         />
       );
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={AlertTriangle}
         title="Capacity unavailable"
         detail={errorMessage(error)}
@@ -1558,7 +1524,7 @@ export function integrationBlock(
     );
   if (response.state === "not_detected")
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={Gauge}
         title="Karpenter not detected"
         detail="Capacity appears automatically when this cluster exposes Karpenter NodePools."
@@ -1847,15 +1813,3 @@ export function PoolSelector({
     </div>
   );
 }
-
-// ============================================================================
-// Shared table cell classes (keeps every capacity table visually identical)
-// ============================================================================
-
-export const TABLE_WRAP = "overflow-x-auto";
-export const TABLE_HEAD =
-  "border-b border-theme-border bg-theme-base/60 text-[11px] uppercase tracking-wide text-theme-text-tertiary";
-export const TH = "px-3 py-2.5 text-left font-medium whitespace-nowrap";
-export const TD = "px-3 py-2.5 align-top text-sm text-theme-text-primary";
-export const TBODY = "table-divide-subtle";
-export const ROW_HOVER = "transition-colors hover:bg-theme-hover/50";
diff --git a/web/src/components/cnpg/CNPGBlockingSessions.tsx b/web/src/components/cnpg/CNPGBlockingSessions.tsx
index 12f372dcde..36a66d4779 100644
--- a/web/src/components/cnpg/CNPGBlockingSessions.tsx
+++ b/web/src/components/cnpg/CNPGBlockingSessions.tsx
@@ -9,7 +9,7 @@ import { cnpgActionOutcomeLocked, useCNPGAction, useCNPGClusterCapabilities } fr
 import { useCNPGSessions, type CNPGBackend, type CNPGSessionInstance, type CNPGSessionsResponse } from '../../api/cnpg-sessions'
 import { useToast } from '../ui/Toast'
 import { buildBlockingTree, cnpgConnectionFigure, cnpgNoMetricsReadings, countVictims, type BlockingNode } from './blocking'
-import { CNPGRefreshFailedNotice } from './shared'
+import { RefreshFailedNotice } from '../workspace/layout'
 
 function age(s?: number): string {
   if (s === undefined || s === null) return '—'
@@ -53,7 +53,7 @@ export function CNPGBlockingSessions({
       <div className="space-y-4 p-4">
         {!data && q.isLoading && <PaneLoader label="Reading pg_stat_activity…" className="h-20" />}
         {!data && !q.isLoading && <div className="text-sm text-theme-text-tertiary">Sessions could not be read: {q.error instanceof Error ? q.error.message : 'unknown error'}</div>}
-        <CNPGRefreshFailedNotice queries={[q]} />
+        <RefreshFailedNotice queries={[q]} />
         {data && <Body namespace={namespace} cluster={cluster} data={data} aggregatesGap={aggregatesGap} headroom={headroom} />}
       </div>
       <div className="border-t border-theme-border px-4 py-2 text-xs text-theme-text-tertiary">
diff --git a/web/src/components/cnpg/CNPGClusterActivity.tsx b/web/src/components/cnpg/CNPGClusterActivity.tsx
index 6e1dd900f8..58f19bd6f3 100644
--- a/web/src/components/cnpg/CNPGClusterActivity.tsx
+++ b/web/src/components/cnpg/CNPGClusterActivity.tsx
@@ -3,8 +3,7 @@ import { PaneLoader, TimelineList, formatAge, type NavigateToResource } from '@s
 import { useCNPGClusterActivity } from '../../api/cnpg'
 import { useCNPGClusterActivityWindow } from '../../api/cnpg-history'
 import { CNPGIntervalBanner, useCNPGIntervalParams } from './CNPGTrends'
-import { Notice } from '../capacity/shared'
-import { Segments } from './shared'
+import { Notice, Segments } from '../workspace/layout'
 
 const RANGES = [
   { id: '6', label: '6 h' },
diff --git a/web/src/components/cnpg/CNPGClusterRuntime.tsx b/web/src/components/cnpg/CNPGClusterRuntime.tsx
index 3262f317c9..16733fa863 100644
--- a/web/src/components/cnpg/CNPGClusterRuntime.tsx
+++ b/web/src/components/cnpg/CNPGClusterRuntime.tsx
@@ -6,8 +6,6 @@ import { PaneLoader, Tooltip, formatAge, toneTextClass } from '@skyhook-io/k8s-u
 import { useCNPGRuntime, type CNPGRuntimeInstance } from '../../api/cnpg'
 import { useCNPGSessions, type CNPGSessionsResponse } from '../../api/cnpg-sessions'
 import { useCNPGClusterHistory } from '../../api/cnpg-history'
-import { Notice } from '../capacity/shared'
-import { CNPGRefreshFailedNotice, Segments } from './shared'
 import { CNPGStorage } from './CNPGStorage'
 import { CNPGBlockingSessions } from './CNPGBlockingSessions'
 import { cnpgConnectionFigure } from './blocking'
@@ -16,6 +14,7 @@ import { cnpgCheckpointView, cnpgDatabaseHealthRows, cnpgIdAge, cnpgPickedInstan
 import { formatBytes } from './lsn'
 import { historyLatest, latestRate } from './trendSamples'
 import { CNPGTrends, useSampleBuffer, type CNPGIntervalTarget, type Sample } from './CNPGTrends'
+import { Notice, RefreshFailedNotice, Segments } from '../workspace/layout'
 
 type Section = 'replication' | 'sessions' | 'transactions' | 'storage' | 'slots' | 'trends'
 
@@ -132,7 +131,7 @@ export function CNPGClusterRuntime({
           </span>
         )}
       </div>
-      <CNPGRefreshFailedNotice queries={[q]} />
+      <RefreshFailedNotice queries={[q]} />
 
       {section === 'replication' &&
         (denied ? (
@@ -307,7 +306,7 @@ function TransactionsView({
   )
   return (
     <div className="space-y-4">
-      <CNPGRefreshFailedNotice queries={[history]} />
+      <RefreshFailedNotice queries={[history]} />
       {!deniedGrant && picker}
       {deniedGrant ? (
         <>
diff --git a/web/src/components/cnpg/CNPGDeclarations.tsx b/web/src/components/cnpg/CNPGDeclarations.tsx
index 4a8e890d48..2feee03057 100644
--- a/web/src/components/cnpg/CNPGDeclarations.tsx
+++ b/web/src/components/cnpg/CNPGDeclarations.tsx
@@ -18,22 +18,9 @@ import {
 } from '@skyhook-io/k8s-ui'
 import { useCNPGPublisherSlots } from './logicalSlots'
 import type { SelectedResource } from '../../types'
-import {
-  CNPGRefreshFailedNotice,
-  CNPGWorkspaceHeader,
-  CoverageNotice,
-  FilterChips,
-  ScreenBody,
-  Segments,
-  Sub,
-  clusterResource,
-  cnpgResource,
-  coverageEmpty,
-  worstCoverage,
-  namespaceChip,
-  type CNPGScreenProps,
-} from './shared'
-import { sameResource } from './routes'
+import { CNPGWorkspaceHeader, CoverageNotice, clusterResource, cnpgResource, coverageEmpty, worstCoverage, type CNPGScreenProps } from './shared'
+import { FilterChips, namespaceChip, RefreshFailedNotice, ScreenBody, Segments, Sub } from '../workspace/layout'
+import { sameSelectedResource } from '../../utils/drawer-trail'
 
 type State = 'applied' | 'failed' | 'pending'
 
@@ -309,7 +296,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
                       key={i.key}
                       item={i}
                       sourceStated={noSources}
-                      active={!i.isField && sameResource(inspected, i.resource)}
+                      active={!i.isField && sameSelectedResource(inspected, i.resource)}
                       onInspect={() => onInspect(i.resource)}
                     />
                   ))}
@@ -346,7 +333,7 @@ function LogicalPathRow({ path, onInspect }: { path: CNPGLogicalPath; onInspect:
       <CNPGLogicalPathView
         path={path}
         slot={cnpgLogicalSlotFact(path, observed)}
-        notice={<CNPGRefreshFailedNotice queries={[query]} />}
+        notice={<RefreshFailedNotice queries={[query]} />}
         onNavigate={(ref) => onInspect(refToSelectedResource(ref))}
         compact
       />
diff --git a/web/src/components/cnpg/CNPGDetailPage.tsx b/web/src/components/cnpg/CNPGDetailPage.tsx
index f04dcb907d..797df66862 100644
--- a/web/src/components/cnpg/CNPGDetailPage.tsx
+++ b/web/src/components/cnpg/CNPGDetailPage.tsx
@@ -7,16 +7,16 @@ import { useConnection } from '../../context/ConnectionContext'
 import { useContexts } from '../../api/client'
 import { useContextSwitchFlow } from '../useContextSwitchFlow'
 import { WorkloadView } from '../workload/WorkloadView'
-import { EmptyState } from '../capacity/shared'
 import { CNPGClusterActivity } from './CNPGClusterActivity'
 import { CNPGClusterRuntime } from './CNPGClusterRuntime'
 import { CNPGProtection } from './CNPGProtection'
 import { CNPGRestoreValidation } from './recovery/CNPGRestoreValidation'
 import { CNPGScreenGate } from './shared'
 import { CNPG_DETAIL_KINDS, CNPG_SCREENS, cnpgDetailKindFor, cnpgDetailPath, cnpgScreenPath, type CNPGDetailTarget } from './routes'
-import { currentPageLabel } from './paths'
+import { currentPageLabel } from '../../utils/page-links'
 import { useCNPGFleet } from './useCNPGSidebarWorkspace'
 import { CNPGOperatorBanner } from './CNPGOperatorBanner'
+import { ScreenEmptyState } from '../workspace/layout'
 
 interface ReturnState {
   returnLabel?: string
@@ -228,7 +228,7 @@ function NotInContext({
   const pinned = contexts?.find((c) => c.name === pinnedContext)
   return (
     <>
-      <EmptyState
+      <ScreenEmptyState
         icon={Unplug}
         title={`${target.name} is not in ${activeContext}`}
         detail={`This link points at ${CNPG_DETAIL_KINDS[target.plural].kind} ${target.name} in context ${pinnedContext}. Radar does not open a same-named object from another cluster.`}
diff --git a/web/src/components/cnpg/CNPGDrawerTrail.tsx b/web/src/components/cnpg/CNPGDrawerTrail.tsx
index 55d3d9dfe7..a7dc47fa5b 100644
--- a/web/src/components/cnpg/CNPGDrawerTrail.tsx
+++ b/web/src/components/cnpg/CNPGDrawerTrail.tsx
@@ -2,7 +2,7 @@ import { useLocation, useSearchParams } from 'react-router-dom'
 import { ArrowLeft } from 'lucide-react'
 import { CNPG_KIND_BY_KEY } from '@skyhook-io/k8s-ui'
 import type { SelectedResource } from '../../types'
-import { decodeDrawerTrail, encodeDrawerTrail, sameResource } from './routes'
+import { decodeDrawerTrail, encodeDrawerTrail, sameSelectedResource } from '../../utils/drawer-trail'
 
 const KIND_BY_PLURAL: Record<string, string> = Object.fromEntries(
   Object.values(CNPG_KIND_BY_KEY).map((k) => [k.plural, k.kind]),
@@ -19,7 +19,7 @@ export function CNPGDrawerTrailBack({ resource }: { resource: SelectedResource }
   const [searchParams, setSearchParams] = useSearchParams()
   if (!location.pathname.startsWith('/cnpg')) return null
   const trail = decodeDrawerTrail(searchParams.get('drawer'))
-  if (trail.length < 2 || !sameResource(trail[trail.length - 1], resource)) return null
+  if (trail.length < 2 || !sameSelectedResource(trail[trail.length - 1], resource)) return null
   const prev = trail[trail.length - 2]
   const back = () => {
     const params = new URLSearchParams(searchParams)
diff --git a/web/src/components/cnpg/CNPGOperator.tsx b/web/src/components/cnpg/CNPGOperator.tsx
index 19bdf2a95d..e97632ec96 100644
--- a/web/src/components/cnpg/CNPGOperator.tsx
+++ b/web/src/components/cnpg/CNPGOperator.tsx
@@ -1,20 +1,9 @@
 import { useMemo } from 'react'
 import { Badge, getCNPGImageCatalogEntries, isApiGroup, PaneLoader, Tooltip } from '@skyhook-io/k8s-ui'
 import { useCNPGOperator, type CNPGOperatorComponent, type CNPGOperatorConfig } from '../../api/cnpg'
-import { Notice } from '../capacity/shared'
 import { CNPGOperatorDiagnosisSection } from './CNPGOperatorDiagnosis'
-import {
-  CNPGWorkspaceHeader,
-  CoverageNotice,
-  coverageEmpty,
-  worstCoverage,
-  Mono,
-  ScreenBody,
-  SectionTable,
-  Sub,
-  cnpgResource,
-  type CNPGScreenProps,
-} from './shared'
+import { CNPGWorkspaceHeader, CoverageNotice, coverageEmpty, worstCoverage, cnpgResource, type CNPGScreenProps } from './shared'
+import { Mono, Notice, ScreenBody, SectionTable, Sub } from '../workspace/layout'
 
 interface CatalogRow {
   key: string
diff --git a/web/src/components/cnpg/CNPGOperatorDiagnosis.tsx b/web/src/components/cnpg/CNPGOperatorDiagnosis.tsx
index 3de4126fe7..266886bd10 100644
--- a/web/src/components/cnpg/CNPGOperatorDiagnosis.tsx
+++ b/web/src/components/cnpg/CNPGOperatorDiagnosis.tsx
@@ -3,7 +3,7 @@ import { useNavigate } from 'react-router-dom'
 import { Badge, formatAge, type CNPGFleet } from '@skyhook-io/k8s-ui'
 import type { CNPGOperatorDiagnosis, CNPGOperatorReconcilePod, CNPGReadCoverage } from '../../api/cnpg-recovery'
 import { buildWorkloadPath } from '../../utils/navigation'
-import { GrantText, Mono, Sub } from './shared'
+import { GrantText, Mono, Sub } from '../workspace/layout'
 
 function Row({ label, children }: { label: string; children: ReactNode }) {
   return (
diff --git a/web/src/components/cnpg/CNPGOverview.tsx b/web/src/components/cnpg/CNPGOverview.tsx
index d0f04ea6a7..721b8d6bb5 100644
--- a/web/src/components/cnpg/CNPGOverview.tsx
+++ b/web/src/components/cnpg/CNPGOverview.tsx
@@ -15,12 +15,14 @@ import {
 } from '@skyhook-io/k8s-ui'
 import type { SelectedResource } from '../../types'
 import { useConnection } from '../../context/ConnectionContext'
-import { EmptyState, ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from '../capacity/shared'
-import { BreakText, CNPGWorkspaceHeader, CoverageNotice, FilterChips, type CNPGScreenProps } from './shared'
-import { cnpgClusterFullPath, cnpgClusterProblemsPath, currentPageLabel } from './paths'
-import { sameResource } from './routes'
+import { CNPGWorkspaceHeader, CoverageNotice, type CNPGScreenProps } from './shared'
+import { cnpgClusterFullPath, cnpgClusterProblemsPath } from './paths'
+import { currentPageLabel } from '../../utils/page-links'
 import { CNPGOperatorBanner } from './CNPGOperatorBanner'
 import { cnpgInstancePillLabel, cnpgPillsToShow, cnpgRowStatus } from './fleetStatus'
+import { BreakText, FilterChips, ScreenEmptyState } from '../workspace/layout'
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from '../workspace/table'
+import { sameSelectedResource } from '../../utils/drawer-trail'
 
 type Filter = 'attention' | 'all'
 
@@ -198,7 +200,7 @@ export function CNPGOverview({
     return (
       <div className="flex min-h-0 flex-1 flex-col">
         <CNPGWorkspaceHeader title="Overview" />
-        <EmptyState
+        <ScreenEmptyState
           icon={Database}
           title={empty.title}
           detail={empty.detail}
@@ -325,7 +327,7 @@ export function CNPGOverview({
                 <tbody className={TBODY}>
                   {rows.map((row) => {
                     const ref: SelectedResource = { kind: 'clusters', group: 'postgresql.cnpg.io', namespace: row.namespace, name: row.name }
-                    const active = sameResource(inspected, ref)
+                    const active = sameSelectedResource(inspected, ref)
                     return (
                       <tr
                         key={row.key}
diff --git a/web/src/components/cnpg/CNPGPooling.tsx b/web/src/components/cnpg/CNPGPooling.tsx
index 375e6f8b79..be83d552d3 100644
--- a/web/src/components/cnpg/CNPGPooling.tsx
+++ b/web/src/components/cnpg/CNPGPooling.tsx
@@ -12,19 +12,8 @@ import {
 } from '@skyhook-io/k8s-ui'
 import { useCNPGPoolerRuntime } from '../../api/cnpg'
 import { useCNPGPoolerCapabilities } from '../../api/cnpg-sessions'
-import {
-  CNPGWorkspaceHeader,
-  CoverageNotice,
-  FilterChips,
-  Mono,
-  ScreenBody,
-  SectionTable,
-  Sub,
-  cnpgResource,
-  coverageEmpty,
-  namespaceChip,
-  type CNPGScreenProps,
-} from './shared'
+import { CNPGWorkspaceHeader, CoverageNotice, cnpgResource, coverageEmpty, type CNPGScreenProps } from './shared'
+import { FilterChips, Mono, namespaceChip, ScreenBody, SectionTable, Sub } from '../workspace/layout'
 
 const SEVERITY: Record<HealthLevel, 'success' | 'warning' | 'alert' | 'error' | 'neutral'> = {
   healthy: 'success',
diff --git a/web/src/components/cnpg/CNPGProtection.tsx b/web/src/components/cnpg/CNPGProtection.tsx
index 764b113cd5..d0db12357e 100644
--- a/web/src/components/cnpg/CNPGProtection.tsx
+++ b/web/src/components/cnpg/CNPGProtection.tsx
@@ -15,21 +15,8 @@ import {
   type HealthLevel,
   Tooltip,
 } from '@skyhook-io/k8s-ui'
-import {
-  CNPGWorkspaceHeader,
-  CoverageNotice,
-  FilterChips,
-  Mono,
-  PathText,
-  ScreenBody,
-  SectionTable,
-  Sub,
-  clusterResource,
-  coverageEmpty,
-  cnpgResource,
-  namespaceChip,
-  type CNPGScreenProps,
-} from './shared'
+import { CNPGWorkspaceHeader, CoverageNotice, clusterResource, coverageEmpty, cnpgResource, type CNPGScreenProps } from './shared'
+import { FilterChips, Mono, namespaceChip, PathText, ScreenBody, SectionTable, Sub } from '../workspace/layout'
 
 const SEVERITY: Record<HealthLevel, 'success' | 'warning' | 'alert' | 'error' | 'neutral'> = {
   healthy: 'success',
diff --git a/web/src/components/cnpg/CNPGStorage.tsx b/web/src/components/cnpg/CNPGStorage.tsx
index 9c39e1c3d5..5a19ec10b6 100644
--- a/web/src/components/cnpg/CNPGStorage.tsx
+++ b/web/src/components/cnpg/CNPGStorage.tsx
@@ -27,13 +27,12 @@ import {
   type CNPGStorageVolume,
   type CNPGStorageWAL,
 } from '../../api/cnpg-storage'
-import { Notice } from '../capacity/shared'
 import { CreateResourceDialog } from '../shared/CreateResourceDialog'
 import { useCNPGWriteGuard } from './actions/useCNPGWriteGuard'
 import { buildResizeManifest, cnpgFloorTone, cnpgInstanceDiskTone, cnpgSharedExpansionGap, cnpgSlotRetentionText, cnpgWALUsageFloor } from './storageModel'
 // Binary units throughout, matching claim capacities such as 1Gi.
 import { formatBytes } from './lsn'
-import { CNPGRefreshFailedNotice } from './shared'
+import { Notice, RefreshFailedNotice } from '../workspace/layout'
 
 const CNPG_GROUP = 'postgresql.cnpg.io'
 
@@ -358,7 +357,7 @@ export function CNPGStorage({ namespace, name, primary }: { namespace: string; n
 
   return (
     <div className="space-y-4">
-      <CNPGRefreshFailedNotice queries={[q]} />
+      <RefreshFailedNotice queries={[q]} />
       {data.findings.map((f) => (
         <AlertBanner
           key={f.claim}
diff --git a/web/src/components/cnpg/CNPGSummaryHost.tsx b/web/src/components/cnpg/CNPGSummaryHost.tsx
index 2c41135364..762f2cd0af 100644
--- a/web/src/components/cnpg/CNPGSummaryHost.tsx
+++ b/web/src/components/cnpg/CNPGSummaryHost.tsx
@@ -41,13 +41,14 @@ import { cnpgInstanceLive, cnpgInstanceLiveUnavailable, cnpgReplicationGap, cnpg
 import { CNPGMaintenanceBanner } from './actions/CNPGMaintenanceBanner'
 import { CNPG_CONNECT_PARAM, cnpgConnectParamValue } from './actions/CNPGConnectButton'
 import { CNPGOperatorBanner } from './CNPGOperatorBanner'
-import { CNPGRefreshFailedNotice } from './shared'
 
-import { cnpgClusterFullPath, cnpgDimensionPath, cnpgIssuesPath, cnpgWithinDetail, currentPageLabel } from './paths'
+import { cnpgClusterFullPath, cnpgDimensionPath, cnpgWithinDetail } from './paths'
+import { currentPageLabel, issuesPathForSubject } from '../../utils/page-links'
 import { CNPGRestoreProgress } from './recovery/CNPGRestoreProgress'
 import { restoreBackupDeclared } from './recovery/restoreModel'
 import { useConnection } from '../../context/ConnectionContext'
 import { useNavCustomization } from '../../context/NavCustomization'
+import { RefreshFailedNotice } from '../workspace/layout'
 
 interface SummaryContext {
   apiKind: string
@@ -117,7 +118,7 @@ function ClusterSummaryHost({ namespace, name, context, onNavigate }: SummaryCon
         onNavigate={goRef}
         lead={
           <>
-            <CNPGRefreshFailedNotice queries={[runtime, ha]} />
+            <RefreshFailedNotice queries={[runtime, ha]} />
             {context === 'drawer' && <CNPGOperatorBanner namespaces={[namespace]} />}
             <CNPGMaintenanceBanner namespace={namespace} name={name} maintenance={ha.data?.maintenance} />
             {row.cluster?.spec?.bootstrap?.recovery && (
@@ -214,7 +215,7 @@ function useLogicalWorkspace(ws: CNPGWorkspaceResponse | null, subscriptions: an
 
 function LogicalPathSlot({ path, children }: { path: CNPGLogicalPath; children: (slot: ReturnType<typeof cnpgLogicalSlotFact>, notice: ReactNode) => ReactNode }) {
   const { observed, query } = useCNPGPublisherSlots(path.publisher)
-  return <>{children(cnpgLogicalSlotFact(path, observed), <CNPGRefreshFailedNotice queries={[query]} />)}</>
+  return <>{children(cnpgLogicalSlotFact(path, observed), <RefreshFailedNotice queries={[query]} />)}</>
 }
 
 function SubscriptionSummaryHost(props: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) {
@@ -238,7 +239,7 @@ function PublicationSummaryHost(props: { resource: any; workspace: CNPGWorkspace
       )
     : []
   const observed = cnpgPublisherSlotsFrom(runtime.data, runtime.error, runtime.isRefetchError)
-  const notice = <CNPGRefreshFailedNotice queries={[runtime]} />
+  const notice = <RefreshFailedNotice queries={[runtime]} />
   return <CNPGPublicationSummary {...props} subscribers={paths.map((path) => ({ path, slot: cnpgLogicalSlotFact(path, observed), notice }))} />
 }
 
@@ -271,7 +272,7 @@ function PoolerSummaryHost({ ctx }: { ctx: SummaryContext }) {
   if (query.isLoading) return <PaneLoader label="Loading summary…" className="h-40" />
   const workspace = query.data?.installed ? query.data : null
   const go = ctx.onNavigate ? (ref: ResourceRef) => ctx.onNavigate?.(refToSelectedResource(ref)) : undefined
-  return <CNPGPoolerSummary resource={ctx.resource} workspace={workspace} onNavigate={go} live={live} lead={<CNPGRefreshFailedNotice queries={queries} />} />
+  return <CNPGPoolerSummary resource={ctx.resource} workspace={workspace} onNavigate={go} live={live} lead={<RefreshFailedNotice queries={queries} />} />
 }
 
 // The object's own apiVersion decides: Velero also ships a Backup kind.
@@ -315,7 +316,7 @@ function IssueLinks({ children }: { children: ReactNode }) {
   return (
     <OpenIssueContext.Provider
       value={issuesTakenOver ? undefined : (p) =>
-        navigate(cnpgIssuesPath(p.subject, searchParams.get('namespaces')))
+        navigate(issuesPathForSubject(p.subject, searchParams.get('namespaces')))
       }
     >
       {children}
diff --git a/web/src/components/cnpg/CNPGTrends.tsx b/web/src/components/cnpg/CNPGTrends.tsx
index b68d1b9644..f54b4cc81e 100644
--- a/web/src/components/cnpg/CNPGTrends.tsx
+++ b/web/src/components/cnpg/CNPGTrends.tsx
@@ -11,9 +11,8 @@ import {
   type CNPGHistoryRange,
   type CNPGClusterHistoryResponse,
 } from '../../api/cnpg-history'
-import { Notice } from '../capacity/shared'
-import { Segments } from './shared'
 import { cacheHitSeries, chartedDatabases, rateSeries, sampleFrom, sessionStateSeries, SAMPLE_BUFFER_LIMIT, type Sample } from './trendSamples'
+import { Notice, Segments } from '../workspace/layout'
 
 const COLOR = '#60a5fa'
 const FILL = '#60a5fa22'
diff --git a/web/src/components/cnpg/CNPGView.tsx b/web/src/components/cnpg/CNPGView.tsx
index 0dc899d196..7498c5db61 100644
--- a/web/src/components/cnpg/CNPGView.tsx
+++ b/web/src/components/cnpg/CNPGView.tsx
@@ -12,8 +12,9 @@ import { CNPGPooling } from './CNPGPooling'
 import { CNPGOperator } from './CNPGOperator'
 import { CNPGScreenGate } from './shared'
 import { CNPGDetailPage } from './CNPGDetailPage'
-import { decodeDrawerTrail, encodeDrawerTrail, parseCNPGRoute, sameResource } from './routes'
+import { parseCNPGRoute } from './routes'
 import { useCNPGFleet, useCNPGSidebarWorkspace } from './useCNPGSidebarWorkspace'
+import { decodeDrawerTrail, encodeDrawerTrail, sameSelectedResource } from '../../utils/drawer-trail'
 
 interface CNPGViewProps {
   namespaces: string[]
@@ -59,7 +60,7 @@ export function CNPGView({ namespaces, selectedResource, onOpenResource, onClose
   useEffect(() => {
     if (targetKey !== (lastSynced.current ?? '')) {
       lastSynced.current = targetKey
-      if (drawerTarget && !sameResource(drawerTarget, selectedResource)) onOpenResource(drawerTarget)
+      if (drawerTarget && !sameSelectedResource(drawerTarget, selectedResource)) onOpenResource(drawerTarget)
       else if (!drawerTarget && selectedResource) onCloseResource()
       return
     }
@@ -69,7 +70,7 @@ export function CNPGView({ namespaces, selectedResource, onOpenResource, onClose
       if (!selectedResource) {
         params.delete('drawer')
       } else {
-        const idx = trail.findIndex((r) => sameResource(r, selectedResource))
+        const idx = trail.findIndex((r) => sameSelectedResource(r, selectedResource))
         const next = idx >= 0 ? trail.slice(0, idx + 1) : [...trail, selectedResource]
         params.set('drawer', encodeDrawerTrail(next))
       }
diff --git a/web/src/components/cnpg/grantText.test.tsx b/web/src/components/cnpg/grantText.test.tsx
index f9dadda8a3..ee19383185 100644
--- a/web/src/components/cnpg/grantText.test.tsx
+++ b/web/src/components/cnpg/grantText.test.tsx
@@ -1,6 +1,6 @@
 import { renderToStaticMarkup } from 'react-dom/server'
 import { describe, expect, it } from 'vitest'
-import { GrantText } from './shared'
+import { GrantText } from '../workspace/layout'
 
 describe('GrantText', () => {
   it('keeps the verb and resource together, with the scope as plain text', () => {
diff --git a/web/src/components/cnpg/paths.test.ts b/web/src/components/cnpg/paths.test.ts
index cda57e4aa6..fdbf4f13af 100644
--- a/web/src/components/cnpg/paths.test.ts
+++ b/web/src/components/cnpg/paths.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
-import { cnpgClusterProblemsPath, cnpgDimensionPath, cnpgIssuesPath, cnpgWithinDetail } from './paths'
+import { cnpgClusterProblemsPath, cnpgDimensionPath, cnpgWithinDetail } from './paths'
+import { issuesPathForSubject } from '../../utils/page-links'
 
 describe('cnpgDimensionPath', () => {
   it('opens each health dimension where it is explained', () => {
@@ -32,15 +33,15 @@ describe('cnpgClusterProblemsPath', () => {
   })
 })
 
-describe('cnpgIssuesPath', () => {
+describe('issuesPathForSubject', () => {
   it('links to the Issues page narrowed to the subject', () => {
-    expect(cnpgIssuesPath({ kind: 'Backup', namespace: 'pg', name: 'b-1' })).toBe('/issues?kind=Backup&resource=pg%2Fb-1')
-    expect(cnpgIssuesPath({ kind: 'ClusterImageCatalog', namespace: '', name: 'pg' })).toBe('/issues?kind=ClusterImageCatalog&resource=pg')
+    expect(issuesPathForSubject({ kind: 'Backup', namespace: 'pg', name: 'b-1' })).toBe('/issues?kind=Backup&resource=pg%2Fb-1')
+    expect(issuesPathForSubject({ kind: 'ClusterImageCatalog', namespace: '', name: 'pg' })).toBe('/issues?kind=ClusterImageCatalog&resource=pg')
   })
   it('keeps the current namespace view filter', () => {
-    expect(cnpgIssuesPath({ kind: 'Cluster', namespace: 'pg', name: 'main' }, 'pg,app')).toBe('/issues?namespaces=pg%2Capp&kind=Cluster&resource=pg%2Fmain')
+    expect(issuesPathForSubject({ kind: 'Cluster', namespace: 'pg', name: 'main' }, 'pg,app')).toBe('/issues?namespaces=pg%2Capp&kind=Cluster&resource=pg%2Fmain')
   })
   it('carries the API group, so a CNPG Cluster is not a CAPI one', () => {
-    expect(cnpgIssuesPath({ kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'main' })).toBe('/issues?kind=Cluster&group=postgresql.cnpg.io&resource=pg%2Fmain')
+    expect(issuesPathForSubject({ kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'main' })).toBe('/issues?kind=Cluster&group=postgresql.cnpg.io&resource=pg%2Fmain')
   })
 })
diff --git a/web/src/components/cnpg/paths.ts b/web/src/components/cnpg/paths.ts
index 885d24e6f4..3acbad61e1 100644
--- a/web/src/components/cnpg/paths.ts
+++ b/web/src/components/cnpg/paths.ts
@@ -11,14 +11,6 @@ export function cnpgClusterProblemsPath(namespace: string, name: string, ctx?: s
   return `${path}${path.includes('?') ? '&' : '?'}problems=all`
 }
 
-/**
- * The label for "← back" on the page a push lands on: the title of the page
- * being left, which Radar keeps in the document title.
- */
-export function currentPageLabel(): string {
-  return document.title.replace(/\s*·\s*Radar$/, '') || 'previous page'
-}
-
 /**
  * Where a Cluster's health dimension is explained: Serving and Replication in
  * Runtime's Replication view (instances and their roles), Storage in Runtime's
@@ -53,17 +45,3 @@ export function cnpgWithinDetail(currentPathname: string, currentSearch: string,
   const qs = params.toString()
   return qs ? `${path}?${qs}` : path
 }
-
-/**
- * Radar's Issues page narrowed to one subject (it has no link to a single issue).
- * The subject travels as `resource=ns/name`, never `namespace=`: App reads a bare
- * `namespace` as the view filter, and a URL without `namespaces` clears it.
- */
-export function cnpgIssuesPath(subject: { kind: string; group?: string; namespace: string; name: string }, viewNamespaces?: string | null): string {
-  const params = new URLSearchParams()
-  if (viewNamespaces) params.set('namespaces', viewNamespaces)
-  params.set('kind', subject.kind)
-  if (subject.group) params.set('group', subject.group)
-  params.set('resource', subject.namespace ? `${subject.namespace}/${subject.name}` : subject.name)
-  return `/issues?${params}`
-}
diff --git a/web/src/components/cnpg/refreshNotice.test.tsx b/web/src/components/cnpg/refreshNotice.test.tsx
index 86019c2288..10cc1fd899 100644
--- a/web/src/components/cnpg/refreshNotice.test.tsx
+++ b/web/src/components/cnpg/refreshNotice.test.tsx
@@ -1,18 +1,18 @@
 import { renderToStaticMarkup } from 'react-dom/server'
 import { describe, expect, it } from 'vitest'
-import { CNPGRefreshFailedNotice } from './shared'
+import { RefreshFailedNotice } from '../workspace/layout'
 
-describe('CNPGRefreshFailedNotice', () => {
+describe('RefreshFailedNotice', () => {
   it('says a refresh failed and how old the data on screen is', () => {
     const html = renderToStaticMarkup(
-      <CNPGRefreshFailedNotice queries={[{ isRefetchError: true, error: new Error('Gateway Timeout'), dataUpdatedAt: Date.now() - 5 * 60_000 }]} />,
+      <RefreshFailedNotice queries={[{ isRefetchError: true, error: new Error('Gateway Timeout'), dataUpdatedAt: Date.now() - 5 * 60_000 }]} />,
     )
     expect(html).toContain('Last refresh failed: Gateway Timeout')
     expect(html).toContain('showing data from 5m ago')
   })
   it('names the oldest of several failed reads', () => {
     const html = renderToStaticMarkup(
-      <CNPGRefreshFailedNotice
+      <RefreshFailedNotice
         queries={[
           { isRefetchError: true, error: new Error('recent'), dataUpdatedAt: Date.now() - 60_000 },
           { isRefetchError: true, error: new Error('older'), dataUpdatedAt: Date.now() - 3 * 3_600_000 },
@@ -24,6 +24,6 @@ describe('CNPGRefreshFailedNotice', () => {
     expect(html).toContain('3h ago')
   })
   it('renders nothing while refreshes succeed', () => {
-    expect(renderToStaticMarkup(<CNPGRefreshFailedNotice queries={[{ isRefetchError: false, error: null, dataUpdatedAt: Date.now() }]} />)).toBe('')
+    expect(renderToStaticMarkup(<RefreshFailedNotice queries={[{ isRefetchError: false, error: null, dataUpdatedAt: Date.now() }]} />)).toBe('')
   })
 })
diff --git a/web/src/components/cnpg/routes.test.ts b/web/src/components/cnpg/routes.test.ts
index ea390980ab..d455bf7b5c 100644
--- a/web/src/components/cnpg/routes.test.ts
+++ b/web/src/components/cnpg/routes.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
-import { cnpgDetailKindFor, cnpgDetailPath, decodeDrawerTrail, encodeDrawerTrail, parseCNPGRoute, sameResource } from './routes'
+import { cnpgDetailKindFor, cnpgDetailPath, parseCNPGRoute } from './routes'
+import { decodeDrawerTrail, encodeDrawerTrail, sameSelectedResource } from '../../utils/drawer-trail'
 
 describe('CNPG routes', () => {
   it('parses workspace screens and falls back to Overview for unknown or unavailable ones', () => {
@@ -30,8 +31,8 @@ describe('CNPG routes', () => {
   it('distinguishes same-named kinds from different groups', () => {
     const cnpg = { kind: 'clusters', group: 'postgresql.cnpg.io', namespace: 'a', name: 'x' }
     const capi = { kind: 'clusters', group: 'cluster.x-k8s.io', namespace: 'a', name: 'x' }
-    expect(sameResource(cnpg, capi)).toBe(false)
-    expect(sameResource(cnpg, { ...cnpg })).toBe(true)
+    expect(sameSelectedResource(cnpg, capi)).toBe(false)
+    expect(sameSelectedResource(cnpg, { ...cnpg })).toBe(true)
   })
 
   it('parses full-detail routes for every CNPG kind and the cluster-scoped placeholder', () => {
diff --git a/web/src/components/cnpg/routes.ts b/web/src/components/cnpg/routes.ts
index f2e039d3ea..9116c32d03 100644
--- a/web/src/components/cnpg/routes.ts
+++ b/web/src/components/cnpg/routes.ts
@@ -1,4 +1,4 @@
-import type { SelectedResource } from '../../types'
+import { CNPG_KIND_BY_KEY, type CNPGWorkspaceKey } from '@skyhook-io/k8s-ui'
 
 export type CNPGScreen = 'overview' | 'protection' | 'declarations' | 'pooling' | 'operator'
 
@@ -23,21 +23,29 @@ export interface CNPGRoute {
 }
 
 // The CNPG kinds that have a CNPG-framed full detail, with the workspace
-// destination each one lives under.
-export const CNPG_DETAIL_KINDS: Record<string, { group: string; kind: string; home: CNPGScreen; clusterScoped?: boolean }> = {
-  clusters: { group: 'postgresql.cnpg.io', kind: 'Cluster', home: 'overview' },
-  backups: { group: 'postgresql.cnpg.io', kind: 'Backup', home: 'protection' },
-  scheduledbackups: { group: 'postgresql.cnpg.io', kind: 'ScheduledBackup', home: 'protection' },
-  objectstores: { group: 'barmancloud.cnpg.io', kind: 'ObjectStore', home: 'protection' },
-  databases: { group: 'postgresql.cnpg.io', kind: 'Database', home: 'declarations' },
-  publications: { group: 'postgresql.cnpg.io', kind: 'Publication', home: 'declarations' },
-  subscriptions: { group: 'postgresql.cnpg.io', kind: 'Subscription', home: 'declarations' },
-  databaseroles: { group: 'postgresql.cnpg.io', kind: 'DatabaseRole', home: 'declarations' },
-  poolers: { group: 'postgresql.cnpg.io', kind: 'Pooler', home: 'pooling' },
-  imagecatalogs: { group: 'postgresql.cnpg.io', kind: 'ImageCatalog', home: 'operator' },
-  clusterimagecatalogs: { group: 'postgresql.cnpg.io', kind: 'ClusterImageCatalog', home: 'operator', clusterScoped: true },
+// destination each one lives under. Kind and group come from the workspace's
+// kind table, so the two never disagree.
+const CNPG_DETAIL_HOMES: Partial<Record<CNPGWorkspaceKey, CNPGScreen>> = {
+  clusters: 'overview',
+  backups: 'protection',
+  scheduledBackups: 'protection',
+  objectStores: 'protection',
+  databases: 'declarations',
+  publications: 'declarations',
+  subscriptions: 'declarations',
+  databaseRoles: 'declarations',
+  poolers: 'pooling',
+  imageCatalogs: 'operator',
+  clusterImageCatalogs: 'operator',
 }
 
+export const CNPG_DETAIL_KINDS: Record<string, { group: string; kind: string; home: CNPGScreen; clusterScoped?: boolean }> = Object.fromEntries(
+  (Object.entries(CNPG_DETAIL_HOMES) as [CNPGWorkspaceKey, CNPGScreen][]).map(([key, home]) => {
+    const k = CNPG_KIND_BY_KEY[key]
+    return [k.plural, { group: k.group, kind: k.kind, home, ...(key === 'clusterImageCatalogs' ? { clusterScoped: true } : {}) }]
+  }),
+)
+
 export function cnpgDetailKindFor(plural: string, group: string | undefined): string | null {
   const p = plural.toLowerCase()
   const spec = CNPG_DETAIL_KINDS[p]
@@ -78,36 +86,3 @@ export function cnpgDetailPath(target: Omit<CNPGDetailTarget, 'group'>, ctx?: st
 export function cnpgScreenPath(screen: CNPGScreen): string {
   return CNPG_SCREENS.find((s) => s.id === screen)?.path ?? '/cnpg'
 }
-
-// Drawer identity in the URL: kind:group:namespace:name, chained with "~" for
-// the in-drawer trail (last entry is the one shown). Kubernetes names and API
-// groups cannot contain ":" or "~", and the group is mandatory — CNPG's Cluster
-// and Backup collide with CAPI, KubeBlocks and Velero kinds.
-export function encodeDrawerRef(r: SelectedResource): string {
-  return [r.kind, r.group ?? '', r.namespace ?? '', r.name].join(':')
-}
-
-export function decodeDrawerRef(s: string): SelectedResource | null {
-  const parts = s.split(':')
-  if (parts.length !== 4 || !parts[0] || !parts[3]) return null
-  return { kind: parts[0], group: parts[1], namespace: parts[2], name: parts[3] }
-}
-
-export function decodeDrawerTrail(param: string | null): SelectedResource[] {
-  if (!param) return []
-  return param.split('~').map(decodeDrawerRef).filter((r): r is SelectedResource => r !== null)
-}
-
-export function encodeDrawerTrail(trail: SelectedResource[]): string {
-  return trail.map(encodeDrawerRef).join('~')
-}
-
-export function sameResource(a: SelectedResource | null | undefined, b: SelectedResource | null | undefined): boolean {
-  if (!a || !b) return false
-  return (
-    a.kind.toLowerCase() === b.kind.toLowerCase() &&
-    (a.group ?? '') === (b.group ?? '') &&
-    (a.namespace ?? '') === (b.namespace ?? '') &&
-    a.name === b.name
-  )
-}
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index 93f1e3e9c8..fb54a166fa 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -1,21 +1,16 @@
 import type { ReactNode } from 'react'
 import type { UseQueryResult } from '@tanstack/react-query'
-import { clsx } from 'clsx'
-import { AlertTriangle, Database, X } from 'lucide-react'
+import { Database } from 'lucide-react'
 import {
   CNPG_KIND_BY_KEY,
   PaneLoader,
-  Tooltip,
-  formatUpdatedAgo,
-  toneTextClass,
   type CNPGFleet,
   type CNPGKindCoverage,
   type CNPGWorkspaceResponse,
 } from '@skyhook-io/k8s-ui'
 import type { SelectedResource } from '../../types'
 import { useConnection } from '../../context/ConnectionContext'
-import { EmptyState, Notice, ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from '../capacity/shared'
-import { sameResource } from './routes'
+import { Notice, ScreenEmptyState } from '../workspace/layout'
 
 export interface CNPGScreenProps {
   data: CNPGWorkspaceResponse
@@ -85,7 +80,7 @@ export function CNPGScreenGate({
   if (!data && query.isLoading) return <PaneLoader label="Loading CloudNativePG…" className="flex-1" />
   if (!data) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={Database}
         title="CloudNativePG workspace unavailable"
         detail={query.error instanceof Error ? query.error.message : 'The workspace could not be loaded.'}
@@ -94,7 +89,7 @@ export function CNPGScreenGate({
   }
   if (!data.installed || !fleet) {
     return (
-      <EmptyState
+      <ScreenEmptyState
         icon={Database}
         title="CloudNativePG is not installed"
         detail={`No postgresql.cnpg.io resources are served in ${connection.context || 'this cluster'}.`}
@@ -104,154 +99,6 @@ export function CNPGScreenGate({
   return <>{children(data, fleet)}</>
 }
 
-export function ScreenBody({ children }: { children: ReactNode }) {
-  return (
-    <div className="min-h-0 flex-1 overflow-y-auto [scrollbar-gutter:stable]">
-      <div className="space-y-5 px-5 pb-6 pt-3 xl:px-7">{children}</div>
-    </div>
-  )
-}
-
-export function FilterChips({ chips }: { chips: { label: string; onClear: () => void }[] }) {
-  if (chips.length === 0) return null
-  return (
-    <div className="flex flex-wrap gap-1.5">
-      {chips.map((c) => (
-        <span key={c.label} className="inline-flex items-center gap-1 rounded-full bg-theme-elevated px-2.5 py-0.5 text-xs text-theme-text-secondary">
-          {c.label}
-          <button type="button" onClick={c.onClear} aria-label={`Remove ${c.label}`} className="rounded-full p-0.5 hover:bg-theme-hover">
-            <X className="h-3 w-3" />
-          </button>
-        </span>
-      ))}
-    </div>
-  )
-}
-
-export function namespaceChip(namespaces: string[], onClear: () => void) {
-  return namespaces.length > 0 ? [{ label: `Namespace: ${namespaces.join(', ')}`, onClear }] : []
-}
-
-export function Segments<T extends string>({
-  value,
-  options,
-  onChange,
-  label,
-}: {
-  value: T
-  options: { id: T; label: string; count?: number }[]
-  onChange: (id: T) => void
-  label: string
-}) {
-  return (
-    <div role="tablist" aria-label={label} className="inline-flex rounded-lg bg-theme-elevated p-0.5">
-      {options.map((o) => {
-        const on = o.id === value
-        return (
-          <button
-            key={o.id}
-            type="button"
-            role="tab"
-            aria-selected={on}
-            onClick={() => onChange(o.id)}
-            className={clsx(
-              'inline-flex items-center gap-1.5 rounded-md px-3 py-1 text-sm font-medium transition-colors',
-              on ? 'bg-theme-surface text-theme-text-primary shadow-theme-sm' : 'text-theme-text-secondary hover:text-theme-text-primary',
-            )}
-          >
-            {o.label}
-            {o.count !== undefined && <span className="font-mono text-xs text-theme-text-tertiary">{o.count}</span>}
-          </button>
-        )
-      })}
-    </div>
-  )
-}
-
-export interface TableColumn<T> {
-  header: ReactNode
-  width?: string
-  cell: (row: T) => ReactNode
-  className?: string
-}
-
-/** A workspace table. Rows inspect in the drawer; the inspected row is highlighted. */
-export function SectionTable<T>({
-  title,
-  subtitle,
-  columns,
-  rows,
-  rowKey,
-  rowResource,
-  onInspect,
-  inspected,
-  empty,
-  minWidth = 760,
-  footer,
-}: {
-  title: ReactNode
-  subtitle?: ReactNode
-  columns: TableColumn<T>[]
-  rows: T[]
-  rowKey: (row: T) => string
-  rowResource?: (row: T) => SelectedResource | null
-  onInspect?: (resource: SelectedResource) => void
-  inspected?: SelectedResource | null
-  empty: ReactNode
-  minWidth?: number
-  footer?: ReactNode
-}) {
-  return (
-    <section>
-      <div className="mb-2 flex flex-wrap items-baseline gap-x-2.5 gap-y-1">
-        <h2 className="text-sm font-semibold text-theme-text-primary">{title}</h2>
-        {subtitle && <span className="text-xs text-theme-text-tertiary">{subtitle}</span>}
-      </div>
-      <div className="overflow-hidden rounded-xl border border-theme-border bg-theme-surface shadow-theme-sm">
-        {rows.length === 0 ? (
-          <div className="px-4 py-5 text-sm text-theme-text-tertiary">{empty}</div>
-        ) : (
-          <div className={TABLE_WRAP}>
-            <table className="w-full table-fixed" style={{ minWidth }}>
-              <colgroup>
-                {columns.map((c, i) => (
-                  <col key={i} style={c.width ? { width: c.width } : undefined} />
-                ))}
-              </colgroup>
-              <thead className={TABLE_HEAD}>
-                <tr>
-                  {columns.map((c, i) => (
-                    <th key={i} className={TH}>{c.header}</th>
-                  ))}
-                </tr>
-              </thead>
-              <tbody className={TBODY}>
-                {rows.map((row) => {
-                  const res = rowResource?.(row) ?? null
-                  const active = !!res && sameResource(inspected, res)
-                  return (
-                    <tr
-                      key={rowKey(row)}
-                      onClick={res && onInspect ? () => onInspect(res) : undefined}
-                      className={clsx(res && onInspect && 'cursor-pointer', ROW_HOVER, active && 'selection')}
-                      aria-selected={res ? active : undefined}
-                    >
-                      {columns.map((c, i) => (
-                        <td key={i} className={clsx(TD, c.className)}>{c.cell(row)}</td>
-                      ))}
-                    </tr>
-                  )
-                })}
-              </tbody>
-            </table>
-          </div>
-        )}
-      </div>
-      {footer && <div className="mt-1.5 text-xs text-theme-text-tertiary">{footer}</div>}
-    </section>
-  )
-}
-
 /** Empty-state text for a collection, derived from how much of it was readable. */
 export function coverageEmpty(cov: CNPGKindCoverage | undefined, noun: string): string {
   switch (cov?.state) {
@@ -276,54 +123,6 @@ export function worstCoverage(...covs: (CNPGKindCoverage | undefined)[]): CNPGKi
   return covs.filter(Boolean).sort((a, b) => (rank[a!.state] ?? 9) - (rank[b!.state] ?? 9))[0]
 }
 
-/**
- * Text that wraps only after `after` ("/" for a path, "-" for a resource
- * name), never mid-word; a single segment too long for its cell is cut with an
- * ellipsis. The whole value shows on hover.
- */
-export function BreakText({ value, after, className }: { value: string; after: '/' | '-'; className?: string }) {
-  const parts = value.split(after === '/' ? /(?<=\/)/ : /(?<=-)/)
-  return (
-    <Tooltip content={value} wrapperClassName="max-w-full">
-      <span className={clsx('block max-w-full', className)}>
-        {parts.map((p, i) => (
-          <span key={i} className="inline-block max-w-full truncate align-top">
-            {p}
-          </span>
-        ))}
-      </span>
-    </Tooltip>
-  )
-}
-
-/** A URL or path; see BreakText. */
-export function PathText({ value, className }: { value: string; className?: string }) {
-  return <BreakText value={value} after="/" className={clsx('font-mono text-[12.5px]', className)} />
-}
-
-/**
- * A grant as one unit: the verb and resource in a code span that does not
- * wrap, its scope ("cluster-wide", "in namespace pg") as plain text after it.
- */
-export function GrantText({ grant }: { grant: string }) {
-  const m = /^(.*?)( cluster-wide| in namespace \S+)$/.exec(grant)
-  const [what, scope] = m ? [m[1], m[2]] : [grant, '']
-  return (
-    <>
-      <code className="whitespace-nowrap rounded bg-theme-elevated px-1 font-mono text-[12px]">{what}</code>
-      {scope}
-    </>
-  )
-}
-
-export function Mono({ children }: { children: ReactNode }) {
-  return <span className="font-mono text-[12.5px] break-all">{children}</span>
-}
-
-export function Sub({ children }: { children: ReactNode }) {
-  return <div className="mt-0.5 text-xs text-theme-text-tertiary break-words">{children}</div>
-}
-
 export function clusterResource(namespace: string, name: string): SelectedResource {
   return { kind: 'clusters', group: 'postgresql.cnpg.io', namespace, name }
 }
@@ -331,24 +130,3 @@ export function clusterResource(namespace: string, name: string): SelectedResour
 export function cnpgResource(plural: string, namespace: string, name: string, group = 'postgresql.cnpg.io'): SelectedResource {
   return { kind: plural, group, namespace, name }
 }
-
-type RefreshableQuery = Pick<UseQueryResult<unknown>, 'isRefetchError' | 'error' | 'dataUpdatedAt'>
-
-/**
- * A refetch failed while the last good answer stays on screen: say so, why,
- * and how old that answer is, so cached values are not read as current.
- */
-export function CNPGRefreshFailedNotice({ queries, className }: { queries: RefreshableQuery[]; className?: string }) {
-  const failed = queries.filter((q) => q.isRefetchError)
-  if (failed.length === 0) return null
-  const oldest = failed.reduce((a, b) => (b.dataUpdatedAt < a.dataUpdatedAt ? b : a))
-  const reason = oldest.error instanceof Error ? oldest.error.message : 'unknown error'
-  return (
-    <div role="status" className={clsx('flex items-start gap-1.5 text-xs text-theme-text-secondary', className)}>
-      <AlertTriangle className={clsx('mt-px h-3.5 w-3.5 shrink-0', toneTextClass('degraded'))} />
-      <span>
-        Last refresh failed: {reason.length > 160 ? `${reason.slice(0, 160)}…` : reason} · showing data from {formatUpdatedAgo(Date.now() - oldest.dataUpdatedAt)}
-      </span>
-    </div>
-  )
-}
diff --git a/web/src/components/workspace/layout.tsx b/web/src/components/workspace/layout.tsx
new file mode 100644
index 0000000000..2fe65f9535
--- /dev/null
+++ b/web/src/components/workspace/layout.tsx
@@ -0,0 +1,260 @@
+import type { ComponentType, ReactNode } from 'react'
+import type { UseQueryResult } from '@tanstack/react-query'
+import { clsx } from 'clsx'
+import { AlertTriangle, X } from 'lucide-react'
+import { Tooltip, formatUpdatedAgo, toneTextClass } from '@skyhook-io/k8s-ui'
+import type { SelectedResource } from '../../types'
+import { sameSelectedResource } from '../../utils/drawer-trail'
+import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from './table'
+
+export function Notice({ children }: { children: ReactNode }) {
+  return (
+    <div className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-surface px-3 py-2 text-sm text-theme-text-secondary">
+      <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-theme-text-tertiary" />
+      <div>{children}</div>
+    </div>
+  );
+}
+
+/** A whole screen with nothing to show: not installed, unreadable, or empty. */
+export function ScreenEmptyState({
+  icon: Icon,
+  title,
+  detail,
+  action,
+}: {
+  icon: ComponentType<{ className?: string }>;
+  title: string;
+  detail: ReactNode;
+  action?: ReactNode;
+}) {
+  return (
+    <div className="flex min-h-0 flex-1 items-center justify-center bg-theme-base p-6">
+      <div className="max-w-md text-center">
+        <Icon className="mx-auto h-9 w-9 text-theme-text-tertiary/50" />
+        <h2 className="mt-3 text-lg font-medium text-theme-text-primary">
+          {title}
+        </h2>
+        <p className="mt-1 text-sm text-theme-text-secondary">{detail}</p>
+        {action}
+      </div>
+    </div>
+  );
+}
+
+export function ScreenBody({ children }: { children: ReactNode }) {
+  return (
+    <div className="min-h-0 flex-1 overflow-y-auto [scrollbar-gutter:stable]">
+      <div className="space-y-5 px-5 pb-6 pt-3 xl:px-7">{children}</div>
+    </div>
+  )
+}
+
+export function FilterChips({ chips }: { chips: { label: string; onClear: () => void }[] }) {
+  if (chips.length === 0) return null
+  return (
+    <div className="flex flex-wrap gap-1.5">
+      {chips.map((c) => (
+        <span key={c.label} className="inline-flex items-center gap-1 rounded-full bg-theme-elevated px-2.5 py-0.5 text-xs text-theme-text-secondary">
+          {c.label}
+          <button type="button" onClick={c.onClear} aria-label={`Remove ${c.label}`} className="rounded-full p-0.5 hover:bg-theme-hover">
+            <X className="h-3 w-3" />
+          </button>
+        </span>
+      ))}
+    </div>
+  )
+}
+
+export function namespaceChip(namespaces: string[], onClear: () => void) {
+  return namespaces.length > 0 ? [{ label: `Namespace: ${namespaces.join(', ')}`, onClear }] : []
+}
+
+export function Segments<T extends string>({
+  value,
+  options,
+  onChange,
+  label,
+}: {
+  value: T
+  options: { id: T; label: string; count?: number }[]
+  onChange: (id: T) => void
+  label: string
+}) {
+  return (
+    <div role="tablist" aria-label={label} className="inline-flex rounded-lg bg-theme-elevated p-0.5">
+      {options.map((o) => {
+        const on = o.id === value
+        return (
+          <button
+            key={o.id}
+            type="button"
+            role="tab"
+            aria-selected={on}
+            onClick={() => onChange(o.id)}
+            className={clsx(
+              'inline-flex items-center gap-1.5 rounded-md px-3 py-1 text-sm font-medium transition-colors',
+              on ? 'bg-theme-surface text-theme-text-primary shadow-theme-sm' : 'text-theme-text-secondary hover:text-theme-text-primary',
+            )}
+          >
+            {o.label}
+            {o.count !== undefined && <span className="font-mono text-xs text-theme-text-tertiary">{o.count}</span>}
+          </button>
+        )
+      })}
+    </div>
+  )
+}
+
+export interface TableColumn<T> {
+  header: ReactNode
+  width?: string
+  cell: (row: T) => ReactNode
+  className?: string
+}
+
+/** A workspace table. Rows inspect in the drawer; the inspected row is highlighted. */
+export function SectionTable<T>({
+  title,
+  subtitle,
+  columns,
+  rows,
+  rowKey,
+  rowResource,
+  onInspect,
+  inspected,
+  empty,
+  minWidth = 760,
+  footer,
+}: {
+  title: ReactNode
+  subtitle?: ReactNode
+  columns: TableColumn<T>[]
+  rows: T[]
+  rowKey: (row: T) => string
+  rowResource?: (row: T) => SelectedResource | null
+  onInspect?: (resource: SelectedResource) => void
+  inspected?: SelectedResource | null
+  empty: ReactNode
+  minWidth?: number
+  footer?: ReactNode
+}) {
+  return (
+    <section>
+      <div className="mb-2 flex flex-wrap items-baseline gap-x-2.5 gap-y-1">
+        <h2 className="text-sm font-semibold text-theme-text-primary">{title}</h2>
+        {subtitle && <span className="text-xs text-theme-text-tertiary">{subtitle}</span>}
+      </div>
+      <div className="overflow-hidden rounded-xl border border-theme-border bg-theme-surface shadow-theme-sm">
+        {rows.length === 0 ? (
+          <div className="px-4 py-5 text-sm text-theme-text-tertiary">{empty}</div>
+        ) : (
+          <div className={TABLE_WRAP}>
+            <table className="w-full table-fixed" style={{ minWidth }}>
+              <colgroup>
+                {columns.map((c, i) => (
+                  <col key={i} style={c.width ? { width: c.width } : undefined} />
+                ))}
+              </colgroup>
+              <thead className={TABLE_HEAD}>
+                <tr>
+                  {columns.map((c, i) => (
+                    <th key={i} className={TH}>{c.header}</th>
+                  ))}
+                </tr>
+              </thead>
+              <tbody className={TBODY}>
+                {rows.map((row) => {
+                  const res = rowResource?.(row) ?? null
+                  const active = !!res && sameSelectedResource(inspected, res)
+                  return (
+                    <tr
+                      key={rowKey(row)}
+                      onClick={res && onInspect ? () => onInspect(res) : undefined}
+                      className={clsx(res && onInspect && 'cursor-pointer', ROW_HOVER, active && 'selection')}
+                      aria-selected={res ? active : undefined}
+                    >
+                      {columns.map((c, i) => (
+                        <td key={i} className={clsx(TD, c.className)}>{c.cell(row)}</td>
+                      ))}
+                    </tr>
+                  )
+                })}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </div>
+      {footer && <div className="mt-1.5 text-xs text-theme-text-tertiary">{footer}</div>}
+    </section>
+  )
+}
+
+/**
+ * Text that wraps only after `after` ("/" for a path, "-" for a resource
+ * name), never mid-word; a single segment too long for its cell is cut with an
+ * ellipsis. The whole value shows on hover.
+ */
+export function BreakText({ value, after, className }: { value: string; after: '/' | '-'; className?: string }) {
+  const parts = value.split(after === '/' ? /(?<=\/)/ : /(?<=-)/)
+  return (
+    <Tooltip content={value} wrapperClassName="max-w-full">
+      <span className={clsx('block max-w-full', className)}>
+        {parts.map((p, i) => (
+          <span key={i} className="inline-block max-w-full truncate align-top">
+            {p}
+          </span>
+        ))}
+      </span>
+    </Tooltip>
+  )
+}
+
+/** A URL or path; see BreakText. */
+export function PathText({ value, className }: { value: string; className?: string }) {
+  return <BreakText value={value} after="/" className={clsx('font-mono text-[12.5px]', className)} />
+}
+
+/**
+ * A grant as one unit: the verb and resource in a code span that does not
+ * wrap, its scope ("cluster-wide", "in namespace pg") as plain text after it.
+ */
+export function GrantText({ grant }: { grant: string }) {
+  const m = /^(.*?)( cluster-wide| in namespace \S+)$/.exec(grant)
+  const [what, scope] = m ? [m[1], m[2]] : [grant, '']
+  return (
+    <>
+      <code className="whitespace-nowrap rounded bg-theme-elevated px-1 font-mono text-[12px]">{what}</code>
+      {scope}
+    </>
+  )
+}
+
+export function Mono({ children }: { children: ReactNode }) {
+  return <span className="font-mono text-[12.5px] break-all">{children}</span>
+}
+
+export function Sub({ children }: { children: ReactNode }) {
+  return <div className="mt-0.5 text-xs text-theme-text-tertiary break-words">{children}</div>
+}
+
+type RefreshableQuery = Pick<UseQueryResult<unknown>, 'isRefetchError' | 'error' | 'dataUpdatedAt'>
+
+/**
+ * A refetch failed while the last good answer stays on screen: say so, why,
+ * and how old that answer is, so cached values are not read as current.
+ */
+export function RefreshFailedNotice({ queries, className }: { queries: RefreshableQuery[]; className?: string }) {
+  const failed = queries.filter((q) => q.isRefetchError)
+  if (failed.length === 0) return null
+  const oldest = failed.reduce((a, b) => (b.dataUpdatedAt < a.dataUpdatedAt ? b : a))
+  const reason = oldest.error instanceof Error ? oldest.error.message : 'unknown error'
+  return (
+    <div role="status" className={clsx('flex items-start gap-1.5 text-xs text-theme-text-secondary', className)}>
+      <AlertTriangle className={clsx('mt-px h-3.5 w-3.5 shrink-0', toneTextClass('degraded'))} />
+      <span>
+        Last refresh failed: {reason.length > 160 ? `${reason.slice(0, 160)}…` : reason} · showing data from {formatUpdatedAgo(Date.now() - oldest.dataUpdatedAt)}
+      </span>
+    </div>
+  )
+}
diff --git a/web/src/components/workspace/table.ts b/web/src/components/workspace/table.ts
new file mode 100644
index 0000000000..96f4054c30
--- /dev/null
+++ b/web/src/components/workspace/table.ts
@@ -0,0 +1,8 @@
+// Shared table cell classes: every workspace table (Capacity, CloudNativePG) looks the same.
+export const TABLE_WRAP = 'overflow-x-auto';
+export const TABLE_HEAD =
+  'border-b border-theme-border bg-theme-base/60 text-[11px] uppercase tracking-wide text-theme-text-tertiary';
+export const TH = 'px-3 py-2.5 text-left font-medium whitespace-nowrap';
+export const TD = 'px-3 py-2.5 align-top text-sm text-theme-text-primary';
+export const TBODY = 'table-divide-subtle';
+export const ROW_HOVER = 'transition-colors hover:bg-theme-hover/50';
diff --git a/web/src/utils/drawer-trail.ts b/web/src/utils/drawer-trail.ts
new file mode 100644
index 0000000000..d7963f4657
--- /dev/null
+++ b/web/src/utils/drawer-trail.ts
@@ -0,0 +1,35 @@
+import type { SelectedResource } from '../types'
+
+// Drawer identity in the URL: kind:group:namespace:name, chained with "~" for
+// the in-drawer trail (last entry is the one shown). Kubernetes names and API
+// groups cannot contain ":" or "~", and the group is mandatory: CRD kinds
+// collide across groups (CloudNativePG's Cluster and Backup with CAPI,
+// KubeBlocks and Velero kinds).
+export function encodeDrawerRef(r: SelectedResource): string {
+  return [r.kind, r.group ?? '', r.namespace ?? '', r.name].join(':')
+}
+
+export function decodeDrawerRef(s: string): SelectedResource | null {
+  const parts = s.split(':')
+  if (parts.length !== 4 || !parts[0] || !parts[3]) return null
+  return { kind: parts[0], group: parts[1], namespace: parts[2], name: parts[3] }
+}
+
+export function decodeDrawerTrail(param: string | null): SelectedResource[] {
+  if (!param) return []
+  return param.split('~').map(decodeDrawerRef).filter((r): r is SelectedResource => r !== null)
+}
+
+export function encodeDrawerTrail(trail: SelectedResource[]): string {
+  return trail.map(encodeDrawerRef).join('~')
+}
+
+export function sameSelectedResource(a: SelectedResource | null | undefined, b: SelectedResource | null | undefined): boolean {
+  if (!a || !b) return false
+  return (
+    a.kind.toLowerCase() === b.kind.toLowerCase() &&
+    (a.group ?? '') === (b.group ?? '') &&
+    (a.namespace ?? '') === (b.namespace ?? '') &&
+    a.name === b.name
+  )
+}
diff --git a/web/src/utils/page-links.ts b/web/src/utils/page-links.ts
new file mode 100644
index 0000000000..72e41abed1
--- /dev/null
+++ b/web/src/utils/page-links.ts
@@ -0,0 +1,21 @@
+/**
+ * The label for "← back" on the page a push lands on: the title of the page
+ * being left, which Radar keeps in the document title.
+ */
+export function currentPageLabel(): string {
+  return document.title.replace(/\s*·\s*Radar$/, '') || 'previous page'
+}
+
+/**
+ * Radar's Issues page narrowed to one subject (it has no link to a single issue).
+ * The subject travels as `resource=ns/name`, never `namespace=`: App reads a bare
+ * `namespace` as the view filter, and a URL without `namespaces` clears it.
+ */
+export function issuesPathForSubject(subject: { kind: string; group?: string; namespace: string; name: string }, viewNamespaces?: string | null): string {
+  const params = new URLSearchParams()
+  if (viewNamespaces) params.set('namespaces', viewNamespaces)
+  params.set('kind', subject.kind)
+  if (subject.group) params.set('group', subject.group)
+  params.set('resource', subject.namespace ? `${subject.namespace}/${subject.name}` : subject.name)
+  return `/issues?${params}`
+}

From 4aa160484106e8e6362c02e78d2359c5628b4888 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:14:37 +0300
Subject: [PATCH 05/26] Move per-kind access and coverage out of the CNPG
 workspace

listScope, typedKindScope, accessFromScope, kindAccess (with covers and
coverage), KindCoverage and its states, readWorkspaceKind and keepGroups
move to kind_access.go so the next workspace reads its kinds the same way.
The group filter takes its groups as a parameter; CloudNativePG passes its
two groups through cnpgWorkspaceReadKind and filterCNPGGroup. kindAccess
now carries its denied namespaces instead of returning them alongside.
Group filtering, the namespace-disclosure rule and every state are
unchanged.
---
 internal/server/cnpg_cluster_ha.go      |   4 +-
 internal/server/cnpg_history.go         |   6 +-
 internal/server/cnpg_operator.go        |  42 ++--
 internal/server/cnpg_operator_status.go |   6 +-
 internal/server/cnpg_operator_test.go   |   6 +-
 internal/server/cnpg_storage.go         |   6 +-
 internal/server/cnpg_workspace.go       | 252 ++++--------------------
 internal/server/cnpg_workspace_test.go  |  28 +--
 internal/server/kind_access.go          | 224 +++++++++++++++++++++
 9 files changed, 307 insertions(+), 267 deletions(-)
 create mode 100644 internal/server/kind_access.go

diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index 47b7dee4e0..0a384c68f5 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -596,7 +596,7 @@ func (s *Server) cnpgHAPrimaryLease(ctx context.Context, r *http.Request, c cnpg
 // namespace of a visible operator Deployment. Which operator replica leads is
 // a different fact from which instance is primary.
 func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnpgHAClients, cache *k8s.ResourceCache, now time.Time) CNPGHALease {
-	acc, _, deployments := s.cnpgOperatorDeployments(r, cache, s.cnpgOperatorScope(r))
+	acc, deployments := s.cnpgOperatorDeployments(r, cache, s.cnpgOperatorScope(r))
 	var namespace string
 	for _, d := range deployments {
 		if d.Labels[cnpgOperatorNameLabel] == cnpgOperatorNameValue {
@@ -606,7 +606,7 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 	}
 	if namespace == "" {
 		reason := "The operator Deployment is not visible to you, so its namespace is unknown"
-		if acc.state == cnpgCoverageFull {
+		if acc.state == kindCoverageFull {
 			reason = "No operator Deployment labelled " + cnpgOperatorNameLabel + "=" + cnpgOperatorNameValue + " was found"
 		}
 		return CNPGHALease{CNPGHASource: CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}, Name: cnpgOperatorLeaseName}
diff --git a/internal/server/cnpg_history.go b/internal/server/cnpg_history.go
index 3c06fde97c..3f01fce587 100644
--- a/internal/server/cnpg_history.go
+++ b/internal/server/cnpg_history.go
@@ -328,14 +328,14 @@ func (s *Server) handleCNPGFleetMetrics(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	var clusterKind cnpgWorkspaceKind
+	var clusterKind workspaceKind
 	for _, k := range cnpgWorkspaceKinds {
 		if k.key == cnpgWorkspaceClusterKey {
 			clusterKind = k
 		}
 	}
-	acc, _, clusters := s.cnpgWorkspaceReadKind(r, cache, clusterKind, namespaces)
-	if acc.state != cnpgCoverageFull && acc.state != cnpgCoveragePartial {
+	acc, clusters := s.cnpgWorkspaceReadKind(r, cache, clusterKind, namespaces)
+	if acc.state != kindCoverageFull && acc.state != kindCoveragePartial {
 		s.writeJSON(w, resp)
 		return
 	}
diff --git a/internal/server/cnpg_operator.go b/internal/server/cnpg_operator.go
index 911d7eb1c6..6d95e282c7 100644
--- a/internal/server/cnpg_operator.go
+++ b/internal/server/cnpg_operator.go
@@ -65,9 +65,9 @@ type CNPGOperatorConfigRef struct {
 
 // CNPGOperatorResponse is GET /api/cnpg/operator.
 type CNPGOperatorResponse struct {
-	Coverage   map[string]CNPGWorkspaceCoverage `json:"coverage"`
-	Components []CNPGOperatorComponent          `json:"components"`
-	Config     []CNPGOperatorConfigRef          `json:"config"`
+	Coverage   map[string]KindCoverage `json:"coverage"`
+	Components []CNPGOperatorComponent `json:"components"`
+	Config     []CNPGOperatorConfigRef `json:"config"`
 	// Diagnosis is one entry per operator Deployment: leader Lease, watched
 	// namespaces, webhook reachability, reconcile counters and recent events.
 	Diagnosis []CNPGOperatorDiagnosis `json:"diagnosis"`
@@ -93,15 +93,15 @@ func (s *Server) handleCNPGOperator(w http.ResponseWriter, r *http.Request) {
 
 	scope := s.cnpgOperatorScope(r)
 	resp := CNPGOperatorResponse{
-		Coverage:   map[string]CNPGWorkspaceCoverage{},
+		Coverage:   map[string]KindCoverage{},
 		Components: []CNPGOperatorComponent{},
 		Config:     []CNPGOperatorConfigRef{},
 	}
 
-	depAcc, depDenied, deployments := s.cnpgOperatorDeployments(r, cache, scope)
-	resp.Coverage["deployments"] = cnpgCoverageOf(depAcc, depDenied)
-	svcAcc, svcDenied, services := s.cnpgOperatorServices(r, cache, scope)
-	resp.Coverage["services"] = cnpgCoverageOf(svcAcc, svcDenied)
+	depAcc, deployments := s.cnpgOperatorDeployments(r, cache, scope)
+	resp.Coverage["deployments"] = depAcc.coverage()
+	svcAcc, services := s.cnpgOperatorServices(r, cache, scope)
+	resp.Coverage["services"] = svcAcc.coverage()
 
 	var operators []*appsv1.Deployment
 	for _, d := range deployments {
@@ -165,14 +165,14 @@ func (s *Server) cnpgOperatorScope(r *http.Request) []string {
 	return s.getUserNamespaces(r, nil)
 }
 
-func (s *Server) cnpgOperatorDeployments(r *http.Request, cache *k8s.ResourceCache, scope []string) (cnpgKindAccess, []string, []*appsv1.Deployment) {
-	acc, denied, read := s.cnpgTypedScope(r, cache, scope, "apps", "deployments")
-	if acc.state == cnpgCoverageDenied || acc.state == cnpgCoverageError {
-		return acc, denied, nil
+func (s *Server) cnpgOperatorDeployments(r *http.Request, cache *k8s.ResourceCache, scope []string) (kindAccess, []*appsv1.Deployment) {
+	acc, read := s.typedKindScope(r, cache, scope, "apps", "deployments")
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+		return acc, nil
 	}
 	lister := cache.Deployments()
 	if lister == nil || !cache.IsKindReady("deployments") {
-		return cnpgKindAccess{state: cnpgCoverageSyncing}, nil, nil
+		return kindAccess{state: kindCoverageSyncing}, nil
 	}
 	var out []*appsv1.Deployment
 	if read == nil {
@@ -189,22 +189,22 @@ func (s *Server) cnpgOperatorDeployments(r *http.Request, cache *k8s.ResourceCac
 		}
 		return out[i].Name < out[j].Name
 	})
-	return acc, denied, out
+	return acc, out
 }
 
-func (s *Server) cnpgOperatorServices(r *http.Request, cache *k8s.ResourceCache, scope []string) (cnpgKindAccess, []string, []*corev1.Service) {
-	acc, denied, read := s.cnpgTypedScope(r, cache, scope, "", "services")
-	if acc.state == cnpgCoverageDenied || acc.state == cnpgCoverageError {
-		return acc, denied, nil
+func (s *Server) cnpgOperatorServices(r *http.Request, cache *k8s.ResourceCache, scope []string) (kindAccess, []*corev1.Service) {
+	acc, read := s.typedKindScope(r, cache, scope, "", "services")
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+		return acc, nil
 	}
 	lister := cache.Services()
 	if lister == nil || !cache.IsKindReady("services") {
-		return cnpgKindAccess{state: cnpgCoverageSyncing}, nil, nil
+		return kindAccess{state: kindCoverageSyncing}, nil
 	}
 	hasPlugin, err := labels.Parse(cnpgPluginNameLabel)
 	if err != nil {
 		log.Printf("[cnpg] Failed to build plugin selector: %v", err)
-		return cnpgKindAccess{state: cnpgCoverageError}, nil, nil
+		return kindAccess{state: kindCoverageError}, nil
 	}
 	var out []*corev1.Service
 	if read == nil {
@@ -215,7 +215,7 @@ func (s *Server) cnpgOperatorServices(r *http.Request, cache *k8s.ResourceCache,
 			out = append(out, items...)
 		}
 	}
-	return acc, denied, out
+	return acc, out
 }
 
 func cnpgOperatorContainerOf(d *appsv1.Deployment) *corev1.Container {
diff --git a/internal/server/cnpg_operator_status.go b/internal/server/cnpg_operator_status.go
index b570bb2d0f..d6ece27a80 100644
--- a/internal/server/cnpg_operator_status.go
+++ b/internal/server/cnpg_operator_status.go
@@ -149,10 +149,10 @@ func (s *Server) readCNPGOperatorFacts(r *http.Request) cnpgOperatorFacts {
 		out.webhookUnknown = out.deploymentsUnknown
 		return out
 	}
-	acc, _, deployments := s.cnpgOperatorDeployments(r, cache, s.cnpgOperatorScope(r))
-	if acc.state != cnpgCoverageFull {
+	acc, deployments := s.cnpgOperatorDeployments(r, cache, s.cnpgOperatorScope(r))
+	if acc.state != kindCoverageFull {
 		out.deploymentsUnknown = "Radar cannot list Deployments in every namespace, so the operator may be out of view"
-		if acc.state == cnpgCoverageSyncing {
+		if acc.state == kindCoverageSyncing {
 			out.deploymentsUnknown = "Deployments are still syncing"
 		}
 	}
diff --git a/internal/server/cnpg_operator_test.go b/internal/server/cnpg_operator_test.go
index b1f8e49af6..436c8a25b0 100644
--- a/internal/server/cnpg_operator_test.go
+++ b/internal/server/cnpg_operator_test.go
@@ -191,7 +191,7 @@ func TestCNPGOperator_DiscoversOperatorPluginAndConfig(t *testing.T) {
 
 	got, body := getCNPGOperatorNoAuth(t, "")
 	for _, key := range []string{"deployments", "services"} {
-		if got.Coverage[key].State != cnpgCoverageFull {
+		if got.Coverage[key].State != kindCoverageFull {
 			t.Errorf("coverage[%s] = %+v, want full", key, got.Coverage[key])
 		}
 	}
@@ -339,7 +339,7 @@ func TestCNPGOperator_DeniedDeploymentsWithholdComponents(t *testing.T) {
 
 	got, _ := readCNPGOperator(t, env.authGet(t, "/api/cnpg/operator", "partial", ""))
 	cov := got.Coverage["deployments"]
-	if cov.State != cnpgCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "cnpg-system" {
+	if cov.State != kindCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "cnpg-system" {
 		t.Errorf("deployments coverage = %+v, want partial denied [cnpg-system]", cov)
 	}
 	for _, c := range got.Components {
@@ -359,7 +359,7 @@ func TestCNPGOperator_DeniedDeploymentsWithholdComponents(t *testing.T) {
 	env.srv.permCache.Set("none", nil, none)
 
 	got, _ = readCNPGOperator(t, env.authGet(t, "/api/cnpg/operator", "none", ""))
-	if got.Coverage["deployments"].State != cnpgCoverageDenied || got.Coverage["services"].State != cnpgCoverageDenied {
+	if got.Coverage["deployments"].State != kindCoverageDenied || got.Coverage["services"].State != kindCoverageDenied {
 		t.Errorf("coverage = %+v, want both denied", got.Coverage)
 	}
 	if got.Components == nil || len(got.Components) != 0 || got.Config == nil {
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index 99b5689927..d0e7b58031 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -796,14 +796,14 @@ func (s *Server) handleCNPGFleetDisk(w http.ResponseWriter, r *http.Request) {
 	namespaces := s.parseNamespacesForUser(r)
 	resp := CNPGFleetDiskResponse{SampledAt: time.Now().UTC().Format(time.RFC3339), Source: cnpgUsageSource, Clusters: []CNPGClusterDisk{}}
 
-	var clusterKind cnpgWorkspaceKind
+	var clusterKind workspaceKind
 	for _, k := range cnpgWorkspaceKinds {
 		if k.key == cnpgWorkspaceClusterKey {
 			clusterKind = k
 		}
 	}
-	acc, _, clusters := s.cnpgWorkspaceReadKind(r, cache, clusterKind, namespaces)
-	if acc.state != cnpgCoverageFull && acc.state != cnpgCoveragePartial {
+	acc, clusters := s.cnpgWorkspaceReadKind(r, cache, clusterKind, namespaces)
+	if acc.state != kindCoverageFull && acc.state != kindCoveragePartial {
 		s.writeJSON(w, resp)
 		return
 	}
diff --git a/internal/server/cnpg_workspace.go b/internal/server/cnpg_workspace.go
index 5faaed28de..c29347b4bd 100644
--- a/internal/server/cnpg_workspace.go
+++ b/internal/server/cnpg_workspace.go
@@ -1,11 +1,8 @@
 package server
 
 import (
-	"context"
-	"errors"
 	"log"
 	"net/http"
-	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -24,15 +21,6 @@ import (
 
 const cnpgBarmanGroup = "barmancloud.cnpg.io"
 
-const (
-	cnpgCoverageFull         = "full"
-	cnpgCoveragePartial      = "partial"
-	cnpgCoverageDenied       = "denied"
-	cnpgCoverageNotInstalled = "notInstalled"
-	cnpgCoverageSyncing      = "syncing"
-	cnpgCoverageError        = "error"
-)
-
 const (
 	cnpgWorkspacePodsKey    = "pods"
 	cnpgWorkspaceBackupsKey = "backups"
@@ -47,15 +35,11 @@ const cnpgBackupWindow = 7 * 24 * time.Hour
 
 const cnpgNoDeclarativeBackupCheckID = "cnpgNoDeclarativeBackup"
 
-type cnpgWorkspaceKind struct {
-	key           string
-	group         string
-	kind          string
-	resource      string
-	clusterScoped bool
-}
+// cnpgGroups are the API groups CloudNativePG objects are read from; a kind
+// listed by name keeps only objects of these groups.
+var cnpgGroups = []string{cnpgGroup, cnpgBarmanGroup}
 
-var cnpgWorkspaceKinds = []cnpgWorkspaceKind{
+var cnpgWorkspaceKinds = []workspaceKind{
 	{key: cnpgWorkspaceClusterKey, group: cnpgGroup, kind: "Cluster", resource: "clusters"},
 	{key: cnpgWorkspaceBackupsKey, group: cnpgGroup, kind: "Backup", resource: "backups"},
 	{key: cnpgWorkspaceSchedKey, group: cnpgGroup, kind: "ScheduledBackup", resource: "scheduledbackups"},
@@ -69,28 +53,6 @@ var cnpgWorkspaceKinds = []cnpgWorkspaceKind{
 	{key: "objectStores", group: cnpgBarmanGroup, kind: "ObjectStore", resource: "objectstores"},
 }
 
-// CNPGWorkspaceCoverage states how much of one kind the caller could see.
-// DeniedNamespaces lists only namespaces already in the caller's scope, so it
-// may be omitted on a partial state; AllowedNamespaces is always set on a
-// partial state and is the authority for which namespaces were read.
-type CNPGWorkspaceCoverage struct {
-	State             string   `json:"state"`
-	DeniedNamespaces  []string `json:"deniedNamespaces,omitempty"`
-	AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
-}
-
-func cnpgCoverageOf(acc cnpgKindAccess, denied []string) CNPGWorkspaceCoverage {
-	cov := CNPGWorkspaceCoverage{State: acc.state, DeniedNamespaces: denied}
-	if acc.state == cnpgCoveragePartial {
-		cov.AllowedNamespaces = make([]string, 0, len(acc.namespaces))
-		for ns := range acc.namespaces {
-			cov.AllowedNamespaces = append(cov.AllowedNamespaces, ns)
-		}
-		sort.Strings(cov.AllowedNamespaces)
-	}
-	return cov
-}
-
 // CNPGWorkspaceIssue is the subset of issuesapi.Issue the workspace renders.
 type CNPGWorkspaceIssue struct {
 	ID        string             `json:"id"`
@@ -120,49 +82,34 @@ type CNPGWorkspaceAuditFinding struct {
 
 // CNPGWorkspaceResponse is GET /api/cnpg/workspace.
 type CNPGWorkspaceResponse struct {
-	Installed      bool                             `json:"installed"`
-	Context        string                           `json:"context"`
-	Namespaces     []string                         `json:"namespaces"`
-	Coverage       map[string]CNPGWorkspaceCoverage `json:"coverage"`
-	Objects        map[string][]any                 `json:"objects"`
-	Issues         []CNPGWorkspaceIssue             `json:"issues"`
-	Audit          []CNPGWorkspaceAuditFinding      `json:"audit"`
-	BackupsOmitted int                              `json:"backupsOmitted"`
+	Installed      bool                        `json:"installed"`
+	Context        string                      `json:"context"`
+	Namespaces     []string                    `json:"namespaces"`
+	Coverage       map[string]KindCoverage     `json:"coverage"`
+	Objects        map[string][]any            `json:"objects"`
+	Issues         []CNPGWorkspaceIssue        `json:"issues"`
+	Audit          []CNPGWorkspaceAuditFinding `json:"audit"`
+	BackupsOmitted int                         `json:"backupsOmitted"`
 	// ScheduleReadings words each readable ScheduledBackup's schedule as the
 	// operator reads it, keyed "namespace/name"; a schedule the operator
 	// cannot parse has no entry.
 	ScheduleReadings map[string]string `json:"scheduleReadings,omitempty"`
 }
 
-// cnpgKindAccess is the resolved read scope for one kind. all means every
-// namespace in the request's scope (or the cluster-scoped kind itself).
-type cnpgKindAccess struct {
-	state      string
-	all        bool
-	namespaces map[string]bool
-}
-
-func (a cnpgKindAccess) covers(namespace string) bool {
-	if a.state != cnpgCoverageFull && a.state != cnpgCoveragePartial {
-		return false
-	}
-	return a.all || a.namespaces[namespace]
-}
-
 func newCNPGWorkspaceResponse(namespaces []string) CNPGWorkspaceResponse {
 	resp := CNPGWorkspaceResponse{
 		Context:    k8s.ActiveClusterContext(),
 		Namespaces: namespaces,
-		Coverage:   map[string]CNPGWorkspaceCoverage{},
+		Coverage:   map[string]KindCoverage{},
 		Objects:    map[string][]any{},
 		Issues:     []CNPGWorkspaceIssue{},
 		Audit:      []CNPGWorkspaceAuditFinding{},
 	}
 	for _, k := range cnpgWorkspaceKinds {
-		resp.Coverage[k.key] = CNPGWorkspaceCoverage{State: cnpgCoverageNotInstalled}
+		resp.Coverage[k.key] = KindCoverage{State: kindCoverageNotInstalled}
 		resp.Objects[k.key] = []any{}
 	}
-	resp.Coverage[cnpgWorkspacePodsKey] = CNPGWorkspaceCoverage{State: cnpgCoverageNotInstalled}
+	resp.Coverage[cnpgWorkspacePodsKey] = KindCoverage{State: kindCoverageNotInstalled}
 	resp.Objects[cnpgWorkspacePodsKey] = []any{}
 	return resp
 }
@@ -198,22 +145,22 @@ func (s *Server) handleCNPGWorkspace(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	access := map[string]cnpgKindAccess{}
+	access := map[string]kindAccess{}
 	items := map[string][]*unstructured.Unstructured{}
 	for _, k := range cnpgWorkspaceKinds {
 		if disc != nil {
 			if _, ok := disc.GetGVRWithGroup(k.kind, k.group); !ok {
-				access[k.key] = cnpgKindAccess{state: cnpgCoverageNotInstalled}
+				access[k.key] = kindAccess{state: kindCoverageNotInstalled}
 				continue
 			}
 		}
-		acc, denied, list := s.cnpgWorkspaceReadKind(r, cache, k, namespaces)
-		if acc.state != cnpgCoverageNotInstalled {
+		acc, list := s.cnpgWorkspaceReadKind(r, cache, k, namespaces)
+		if acc.state != kindCoverageNotInstalled {
 			resp.Installed = true
 		}
 		access[k.key] = acc
 		items[k.key] = list
-		resp.Coverage[k.key] = cnpgCoverageOf(acc, denied)
+		resp.Coverage[k.key] = acc.coverage()
 	}
 	if !resp.Installed {
 		s.writeJSON(w, resp)
@@ -236,9 +183,9 @@ func (s *Server) handleCNPGWorkspace(w http.ResponseWriter, r *http.Request) {
 		resp.Objects[k.key] = out
 	}
 
-	podAccess, podDenied, pods, instancePods := s.cnpgWorkspaceReadPods(r, cache, namespaces, cnpgClusterUIDs(items[cnpgWorkspaceClusterKey]))
+	podAccess, pods, instancePods := s.cnpgWorkspaceReadPods(r, cache, namespaces, cnpgClusterUIDs(items[cnpgWorkspaceClusterKey]))
 	access[cnpgWorkspacePodsKey] = podAccess
-	resp.Coverage[cnpgWorkspacePodsKey] = cnpgCoverageOf(podAccess, podDenied)
+	resp.Coverage[cnpgWorkspacePodsKey] = podAccess.coverage()
 	resp.Objects[cnpgWorkspacePodsKey] = pods
 
 	resp.Issues = s.cnpgWorkspaceIssues(r, namespaces, access, instancePods)
@@ -248,98 +195,8 @@ func (s *Server) handleCNPGWorkspace(w http.ResponseWriter, r *http.Request) {
 	s.writeJSON(w, resp)
 }
 
-// cnpgWorkspaceScope resolves where the caller may list one namespaced
-// resource: nil allowed means the whole request scope.
-//
-// denied names namespaces only when the candidate set came from the caller —
-// their view filter or their RBAC-allowed list. When the scope is "all" the
-// candidates are every namespace in Radar's cache, and naming the denied ones
-// would disclose namespaces the caller was never shown; partial then carries
-// the fact without the names.
-func (s *Server) cnpgWorkspaceScope(r *http.Request, namespaces []string, group, resource string) (allowed, denied []string, partial, any bool) {
-	if noNamespaceAccess(namespaces) {
-		return []string{}, nil, false, false
-	}
-	if s.canRead(r, group, resource, "", "list") {
-		return namespaces, nil, false, true
-	}
-	candidates := namespaces
-	if candidates == nil {
-		candidates = allNamespaceNames()
-	}
-	if len(candidates) == 0 {
-		return []string{}, nil, false, false
-	}
-	allowed = s.filterNamespacesByCanRead(r, group, resource, "list", candidates)
-	partial = len(allowed) < len(candidates)
-	if namespaces != nil {
-		for _, ns := range candidates {
-			if !slices.Contains(allowed, ns) {
-				denied = append(denied, ns)
-			}
-		}
-		sort.Strings(denied)
-	}
-	return allowed, denied, partial, len(allowed) > 0
-}
-
-func accessFromScope(allowed []string, partial bool) cnpgKindAccess {
-	acc := cnpgKindAccess{state: cnpgCoverageFull, all: allowed == nil}
-	if partial {
-		acc.state = cnpgCoveragePartial
-	}
-	if allowed != nil {
-		acc.namespaces = make(map[string]bool, len(allowed))
-		for _, ns := range allowed {
-			acc.namespaces[ns] = true
-		}
-	}
-	return acc
-}
-
-func (s *Server) cnpgWorkspaceReadKind(r *http.Request, cache *k8s.ResourceCache, k cnpgWorkspaceKind, namespaces []string) (cnpgKindAccess, []string, []*unstructured.Unstructured) {
-	var acc cnpgKindAccess
-	var denied, readNamespaces []string
-	if k.clusterScoped {
-		if !s.canRead(r, k.group, k.resource, "", "list") {
-			return cnpgKindAccess{state: cnpgCoverageDenied}, nil, nil
-		}
-		acc = cnpgKindAccess{state: cnpgCoverageFull, all: true}
-	} else {
-		allowed, d, partial, ok := s.cnpgWorkspaceScope(r, namespaces, k.group, k.resource)
-		if !ok {
-			return cnpgKindAccess{state: cnpgCoverageDenied}, nil, nil
-		}
-		acc, denied, readNamespaces = accessFromScope(allowed, partial), d, allowed
-	}
-
-	list, err := readCNPGKind(r.Context(), cache, k, readNamespaces)
-	switch {
-	case err == nil:
-		return acc, denied, list
-	case errors.Is(err, k8s.ErrUnknownDynamicKind):
-		return cnpgKindAccess{state: cnpgCoverageNotInstalled}, nil, nil
-	case errors.Is(err, errDynamicNotSynced):
-		return cnpgKindAccess{state: cnpgCoverageSyncing}, nil, nil
-	default:
-		log.Printf("[cnpg] Failed to list %s.%s for workspace: %v", k.kind, k.group, err)
-		return cnpgKindAccess{state: cnpgCoverageError}, nil, nil
-	}
-}
-
-func readCNPGKind(ctx context.Context, cache *k8s.ResourceCache, k cnpgWorkspaceKind, namespaces []string) ([]*unstructured.Unstructured, error) {
-	if namespaces == nil {
-		return filterCNPGGroup(listDynamicSynced(ctx, cache, k.kind, k.group, ""))
-	}
-	var out []*unstructured.Unstructured
-	for _, ns := range namespaces {
-		list, err := filterCNPGGroup(listDynamicSynced(ctx, cache, k.kind, k.group, ns))
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, list...)
-	}
-	return out, nil
+func (s *Server) cnpgWorkspaceReadKind(r *http.Request, cache *k8s.ResourceCache, k workspaceKind, namespaces []string) (kindAccess, []*unstructured.Unstructured) {
+	return s.readWorkspaceKind(r, cache, k, namespaces, cnpgGroups)
 }
 
 // filterCNPGGroup drops anything whose apiVersion is not a CNPG group, so a
@@ -348,17 +205,7 @@ func filterCNPGGroup(items []*unstructured.Unstructured, err error) ([]*unstruct
 	if err != nil {
 		return nil, err
 	}
-	out := items[:0:0]
-	for _, u := range items {
-		if u == nil {
-			continue
-		}
-		if g := u.GroupVersionKind().Group; g != cnpgGroup && g != cnpgBarmanGroup {
-			continue
-		}
-		out = append(out, u)
-	}
-	return out, nil
+	return keepGroups(items, cnpgGroups), nil
 }
 
 func sortCNPGObjects(items []*unstructured.Unstructured) {
@@ -513,50 +360,19 @@ func trimCNPGPod(p *corev1.Pod) cnpgWorkspacePod {
 	return out
 }
 
-// cnpgTypedScope resolves where the caller may list a typed kind and which of
-// those namespaces Radar's informer actually holds. The informer may itself be
-// namespace-scoped when Radar's own identity cannot list the kind
-// cluster-wide; what it does not hold is unread, not empty. read is nil for
-// "every namespace".
-func (s *Server) cnpgTypedScope(r *http.Request, cache *k8s.ResourceCache, namespaces []string, group, resource string) (acc cnpgKindAccess, denied, read []string) {
-	allowed, denied, partial, ok := s.cnpgWorkspaceScope(r, namespaces, group, resource)
-	if !ok {
-		return cnpgKindAccess{state: cnpgCoverageDenied}, nil, []string{}
-	}
-	within := namespacesWithinCache(cache, resource, allowed)
-	if within.unavailable {
-		log.Printf("[cnpg] %s cache does not cover the requested scope", resource)
-		return cnpgKindAccess{state: cnpgCoverageError}, nil, []string{}
-	}
-	if allowed != nil {
-		for _, ns := range allowed {
-			if slices.Contains(within.namespaces, ns) {
-				continue
-			}
-			partial = true
-			if namespaces != nil {
-				denied = append(denied, ns)
-			}
-		}
-		sort.Strings(denied)
-	}
-	acc = accessFromScope(within.namespaces, partial || within.partial)
-	return acc, denied, within.namespaces
-}
-
 // cnpgWorkspaceReadPods returns the instance Pods of visible Clusters, plus
 // the namespace/name set of what it returned — the only Pods whose issues the
 // response may carry.
-func (s *Server) cnpgWorkspaceReadPods(r *http.Request, cache *k8s.ResourceCache, namespaces []string, clusterUIDs map[string]types.UID) (cnpgKindAccess, []string, []any, map[string]bool) {
+func (s *Server) cnpgWorkspaceReadPods(r *http.Request, cache *k8s.ResourceCache, namespaces []string, clusterUIDs map[string]types.UID) (kindAccess, []any, map[string]bool) {
 	out := []any{}
 	returned := map[string]bool{}
-	acc, denied, read := s.cnpgTypedScope(r, cache, namespaces, "", "pods")
-	if acc.state == cnpgCoverageDenied || acc.state == cnpgCoverageError {
-		return acc, nil, out, returned
+	acc, read := s.typedKindScope(r, cache, namespaces, "", "pods")
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+		return acc, out, returned
 	}
 	if cache.Pods() == nil {
 		log.Printf("[cnpg] Pod cache unavailable for workspace")
-		return cnpgKindAccess{state: cnpgCoverageError}, nil, out, returned
+		return kindAccess{state: kindCoverageError}, out, returned
 	}
 
 	pods := listPodsScoped(cache.Pods(), read)
@@ -572,7 +388,7 @@ func (s *Server) cnpgWorkspaceReadPods(r *http.Request, cache *k8s.ResourceCache
 			returned[p.Namespace+"/"+p.Name] = true
 		}
 	}
-	return acc, denied, out, returned
+	return acc, out, returned
 }
 
 var cnpgWorkspaceKeyByGroupKind = func() map[string]string {
@@ -589,7 +405,7 @@ var cnpgWorkspaceKeyByGroupKind = func() map[string]string {
 // who may list Clusters but not Pods. A row is kept only when its own subject
 // is visible here — a CNPG kind covered in its namespace, or an instance Pod
 // this response returned. IDs are the subject-derived IDs /api/issues uses.
-func (s *Server) cnpgWorkspaceIssues(r *http.Request, namespaces []string, access map[string]cnpgKindAccess, instancePods map[string]bool) []CNPGWorkspaceIssue {
+func (s *Server) cnpgWorkspaceIssues(r *http.Request, namespaces []string, access map[string]kindAccess, instancePods map[string]bool) []CNPGWorkspaceIssue {
 	out := []CNPGWorkspaceIssue{}
 	if noNamespaceAccess(namespaces) {
 		return out
@@ -626,7 +442,7 @@ func (s *Server) cnpgWorkspaceIssues(r *http.Request, namespaces []string, acces
 	return out
 }
 
-func cnpgWorkspaceIssueVisible(iss issues.Issue, access map[string]cnpgKindAccess, instancePods map[string]bool) bool {
+func cnpgWorkspaceIssueVisible(iss issues.Issue, access map[string]kindAccess, instancePods map[string]bool) bool {
 	if iss.Group == "" && iss.Kind == "Pod" {
 		return access[cnpgWorkspacePodsKey].covers(iss.Namespace) && instancePods[iss.Namespace+"/"+iss.Name]
 	}
@@ -643,7 +459,7 @@ func cnpgWorkspaceIssueVisible(iss issues.Issue, access map[string]cnpgKindAcces
 // cnpgWorkspaceAudit reports the declarative-backup posture finding only for
 // Clusters whose namespace had its ScheduledBackups read: without that list,
 // "no schedule targets this cluster" is an absence nobody established.
-func cnpgWorkspaceAudit(clusters, scheduled []*unstructured.Unstructured, schedAccess cnpgKindAccess) []CNPGWorkspaceAuditFinding {
+func cnpgWorkspaceAudit(clusters, scheduled []*unstructured.Unstructured, schedAccess kindAccess) []CNPGWorkspaceAuditFinding {
 	out := []CNPGWorkspaceAuditFinding{}
 	var subjects []*unstructured.Unstructured
 	for _, c := range clusters {
diff --git a/internal/server/cnpg_workspace_test.go b/internal/server/cnpg_workspace_test.go
index f03a1de4c7..4ff69256dd 100644
--- a/internal/server/cnpg_workspace_test.go
+++ b/internal/server/cnpg_workspace_test.go
@@ -138,7 +138,7 @@ func TestCNPGWorkspace_NotInstalled(t *testing.T) {
 	}
 	assertEveryKey(t, got)
 	for k, c := range got.Coverage {
-		if c.State != cnpgCoverageNotInstalled {
+		if c.State != kindCoverageNotInstalled {
 			t.Errorf("coverage[%s] = %q, want notInstalled", k, c.State)
 		}
 	}
@@ -216,7 +216,7 @@ func TestCNPGWorkspace_AuthDisabledReturnsEverythingAndOnlyOwnedInstancePods(t *
 	}
 	assertEveryKey(t, got)
 	for k, c := range got.Coverage {
-		if c.State != cnpgCoverageFull {
+		if c.State != kindCoverageFull {
 			t.Errorf("coverage[%s] = %+v, want full with auth disabled", k, c)
 		}
 	}
@@ -297,7 +297,7 @@ func TestCNPGWorkspace_DeniedKindAndItsIssuesAreWithheld(t *testing.T) {
 	}
 
 	control := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "reader", ""))
-	if control.Coverage["backups"].State != cnpgCoverageFull || !containsName(control.Objects["backups"], "pg-orders-broken") {
+	if control.Coverage["backups"].State != kindCoverageFull || !containsName(control.Objects["backups"], "pg-orders-broken") {
 		t.Fatalf("control: backups coverage=%+v objects=%v", control.Coverage["backups"], objectNames(control.Objects["backups"]))
 	}
 	if !hasBackupIssue(control) {
@@ -305,7 +305,7 @@ func TestCNPGWorkspace_DeniedKindAndItsIssuesAreWithheld(t *testing.T) {
 	}
 
 	got := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "no-backups", ""))
-	if got.Coverage["backups"].State != cnpgCoverageDenied {
+	if got.Coverage["backups"].State != kindCoverageDenied {
 		t.Errorf("backups coverage = %+v, want denied", got.Coverage["backups"])
 	}
 	if len(got.Objects["backups"]) != 0 {
@@ -314,7 +314,7 @@ func TestCNPGWorkspace_DeniedKindAndItsIssuesAreWithheld(t *testing.T) {
 	if hasBackupIssue(got) {
 		t.Error("an issue on a Backup the caller cannot list was returned")
 	}
-	if got.Coverage["clusters"].State != cnpgCoverageFull || !containsName(got.Objects["clusters"], "pg-orders") {
+	if got.Coverage["clusters"].State != kindCoverageFull || !containsName(got.Objects["clusters"], "pg-orders") {
 		t.Errorf("clusters coverage=%+v objects=%v, want full", got.Coverage["clusters"], objectNames(got.Objects["clusters"]))
 	}
 }
@@ -334,7 +334,7 @@ func TestCNPGWorkspace_PartialNamespaceCoverage(t *testing.T) {
 
 	got := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "scoped", ""))
 	cov := got.Coverage["clusters"]
-	if cov.State != cnpgCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "b" {
+	if cov.State != kindCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "b" {
 		t.Errorf("clusters coverage = %+v, want partial denied [b]", cov)
 	}
 	if len(cov.AllowedNamespaces) != 1 || cov.AllowedNamespaces[0] != "a" {
@@ -347,7 +347,7 @@ func TestCNPGWorkspace_PartialNamespaceCoverage(t *testing.T) {
 
 	// A view filter narrows the scope; the denied list never grows past it.
 	filtered := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace?namespaces=a", "scoped", ""))
-	if filtered.Coverage["clusters"].State != cnpgCoverageFull {
+	if filtered.Coverage["clusters"].State != kindCoverageFull {
 		t.Errorf("filtered to a: coverage = %+v, want full", filtered.Coverage["clusters"])
 	}
 	if len(filtered.Namespaces) != 1 || filtered.Namespaces[0] != "a" {
@@ -370,12 +370,12 @@ func TestCNPGWorkspace_ClusterImageCatalogNeedsClusterScopeGrant(t *testing.T) {
 	env.srv.permCache.Set("cluster-wide", nil, clusterWide)
 
 	got := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "ns-only", ""))
-	if got.Coverage["clusterImageCatalogs"].State != cnpgCoverageDenied || len(got.Objects["clusterImageCatalogs"]) != 0 {
+	if got.Coverage["clusterImageCatalogs"].State != kindCoverageDenied || len(got.Objects["clusterImageCatalogs"]) != 0 {
 		t.Errorf("namespace-level grant exposed ClusterImageCatalogs: %+v %v", got.Coverage["clusterImageCatalogs"], objectNames(got.Objects["clusterImageCatalogs"]))
 	}
 
 	got = decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace?namespaces=pg", "cluster-wide", ""))
-	if got.Coverage["clusterImageCatalogs"].State != cnpgCoverageFull || !containsName(got.Objects["clusterImageCatalogs"], "pg-fleet") {
+	if got.Coverage["clusterImageCatalogs"].State != kindCoverageFull || !containsName(got.Objects["clusterImageCatalogs"], "pg-fleet") {
 		t.Errorf("cluster-scope grant: %+v %v, want full with pg-fleet regardless of the view filter", got.Coverage["clusterImageCatalogs"], objectNames(got.Objects["clusterImageCatalogs"]))
 	}
 }
@@ -450,7 +450,7 @@ func TestCNPGWorkspace_AuditNeedsScheduledBackupEvidence(t *testing.T) {
 	}
 
 	got = decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "no-schedules", ""))
-	if got.Coverage["scheduledBackups"].State != cnpgCoverageDenied {
+	if got.Coverage["scheduledBackups"].State != kindCoverageDenied {
 		t.Errorf("scheduledBackups coverage = %+v, want denied", got.Coverage["scheduledBackups"])
 	}
 	if len(got.Audit) != 0 {
@@ -532,7 +532,7 @@ func TestCNPGWorkspace_PodEvidenceFollowsPodAccess(t *testing.T) {
 	}
 
 	got := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "clusters-only", ""))
-	if got.Coverage["pods"].State != cnpgCoverageDenied || len(got.Objects["pods"]) != 0 {
+	if got.Coverage["pods"].State != kindCoverageDenied || len(got.Objects["pods"]) != 0 {
 		t.Errorf("pods coverage=%+v objects=%v, want denied and []", got.Coverage["pods"], objectNames(got.Objects["pods"]))
 	}
 	for _, iss := range got.Issues {
@@ -560,7 +560,7 @@ func TestCNPGWorkspace_DeniedNamespacesNeverComeFromTheServerInventory(t *testin
 
 	got := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "wide", ""))
 	cov := got.Coverage["clusters"]
-	if cov.State != cnpgCoveragePartial {
+	if cov.State != kindCoveragePartial {
 		t.Errorf("unfiltered: clusters coverage = %+v, want partial", cov)
 	}
 	if len(cov.DeniedNamespaces) != 0 {
@@ -575,7 +575,7 @@ func TestCNPGWorkspace_DeniedNamespacesNeverComeFromTheServerInventory(t *testin
 
 	got = decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace?namespaces=default,broken", "wide", ""))
 	cov = got.Coverage["clusters"]
-	if cov.State != cnpgCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "broken" {
+	if cov.State != kindCoveragePartial || len(cov.DeniedNamespaces) != 1 || cov.DeniedNamespaces[0] != "broken" {
 		t.Errorf("filtered: clusters coverage = %+v, want partial naming broken", cov)
 	}
 	if len(cov.AllowedNamespaces) != 1 || cov.AllowedNamespaces[0] != "default" {
@@ -612,7 +612,7 @@ func TestCNPGWorkspace_ScheduleReadingsFollowScheduledBackupAccess(t *testing.T)
 	}
 
 	partial := decodeWorkspace(t, env.authGet(t, "/api/cnpg/workspace", "only-a", ""))
-	if partial.Coverage["scheduledBackups"].State != cnpgCoveragePartial {
+	if partial.Coverage["scheduledBackups"].State != kindCoveragePartial {
 		t.Errorf("coverage = %+v, want partial", partial.Coverage["scheduledBackups"])
 	}
 	if partial.ScheduleReadings["a/nightly-a"] == "" {
diff --git a/internal/server/kind_access.go b/internal/server/kind_access.go
new file mode 100644
index 0000000000..fc76c810b7
--- /dev/null
+++ b/internal/server/kind_access.go
@@ -0,0 +1,224 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"slices"
+	"sort"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/skyhook-io/radar/internal/k8s"
+)
+
+// Coverage states for one kind a workspace lists.
+const (
+	kindCoverageFull         = "full"
+	kindCoveragePartial      = "partial"
+	kindCoverageDenied       = "denied"
+	kindCoverageNotInstalled = "notInstalled"
+	kindCoverageSyncing      = "syncing"
+	kindCoverageError        = "error"
+)
+
+// KindCoverage states how much of one kind the caller could see.
+// DeniedNamespaces lists only namespaces already in the caller's scope, so it
+// may be omitted on a partial state; AllowedNamespaces is always set on a
+// partial state and is the authority for which namespaces were read.
+type KindCoverage struct {
+	State             string   `json:"state"`
+	DeniedNamespaces  []string `json:"deniedNamespaces,omitempty"`
+	AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
+}
+
+// kindAccess is the resolved read scope for one kind. all means every
+// namespace in the request's scope (or the cluster-scoped kind itself).
+// denied names the in-scope namespaces left unread, under the disclosure rule
+// of listScope.
+type kindAccess struct {
+	state      string
+	all        bool
+	namespaces map[string]bool
+	denied     []string
+}
+
+func (a kindAccess) covers(namespace string) bool {
+	if a.state != kindCoverageFull && a.state != kindCoveragePartial {
+		return false
+	}
+	return a.all || a.namespaces[namespace]
+}
+
+func (a kindAccess) coverage() KindCoverage {
+	cov := KindCoverage{State: a.state, DeniedNamespaces: a.denied}
+	if a.state == kindCoveragePartial {
+		cov.AllowedNamespaces = make([]string, 0, len(a.namespaces))
+		for ns := range a.namespaces {
+			cov.AllowedNamespaces = append(cov.AllowedNamespaces, ns)
+		}
+		sort.Strings(cov.AllowedNamespaces)
+	}
+	return cov
+}
+
+// listScope resolves where the caller may list one namespaced resource: nil
+// allowed means the whole request scope.
+//
+// denied names namespaces only when the candidate set came from the caller —
+// their view filter or their RBAC-allowed list. When the scope is "all" the
+// candidates are every namespace in Radar's cache, and naming the denied ones
+// would disclose namespaces the caller was never shown; partial then carries
+// the fact without the names.
+func (s *Server) listScope(r *http.Request, namespaces []string, group, resource string) (allowed, denied []string, partial, any bool) {
+	if noNamespaceAccess(namespaces) {
+		return []string{}, nil, false, false
+	}
+	if s.canRead(r, group, resource, "", "list") {
+		return namespaces, nil, false, true
+	}
+	candidates := namespaces
+	if candidates == nil {
+		candidates = allNamespaceNames()
+	}
+	if len(candidates) == 0 {
+		return []string{}, nil, false, false
+	}
+	allowed = s.filterNamespacesByCanRead(r, group, resource, "list", candidates)
+	partial = len(allowed) < len(candidates)
+	if namespaces != nil {
+		for _, ns := range candidates {
+			if !slices.Contains(allowed, ns) {
+				denied = append(denied, ns)
+			}
+		}
+		sort.Strings(denied)
+	}
+	return allowed, denied, partial, len(allowed) > 0
+}
+
+func accessFromScope(allowed []string, partial bool) kindAccess {
+	acc := kindAccess{state: kindCoverageFull, all: allowed == nil}
+	if partial {
+		acc.state = kindCoveragePartial
+	}
+	if allowed != nil {
+		acc.namespaces = make(map[string]bool, len(allowed))
+		for _, ns := range allowed {
+			acc.namespaces[ns] = true
+		}
+	}
+	return acc
+}
+
+// typedKindScope resolves where the caller may list a typed kind and which of
+// those namespaces Radar's informer actually holds. The informer may itself be
+// namespace-scoped when Radar's own identity cannot list the kind
+// cluster-wide; what it does not hold is unread, not empty. read is nil for
+// "every namespace".
+func (s *Server) typedKindScope(r *http.Request, cache informerScope, namespaces []string, group, resource string) (acc kindAccess, read []string) {
+	allowed, denied, partial, ok := s.listScope(r, namespaces, group, resource)
+	if !ok {
+		return kindAccess{state: kindCoverageDenied}, []string{}
+	}
+	within := namespacesWithinCache(cache, resource, allowed)
+	if within.unavailable {
+		log.Printf("[workspace] %s cache does not cover the requested scope", resource)
+		return kindAccess{state: kindCoverageError}, []string{}
+	}
+	if allowed != nil {
+		for _, ns := range allowed {
+			if slices.Contains(within.namespaces, ns) {
+				continue
+			}
+			partial = true
+			if namespaces != nil {
+				denied = append(denied, ns)
+			}
+		}
+		sort.Strings(denied)
+	}
+	acc = accessFromScope(within.namespaces, partial || within.partial)
+	acc.denied = denied
+	return acc, within.namespaces
+}
+
+// workspaceKind is one kind a workspace lists from Radar's dynamic cache.
+type workspaceKind struct {
+	key           string
+	group         string
+	kind          string
+	resource      string
+	clusterScoped bool
+}
+
+// readWorkspaceKind authorizes and lists one kind, keeping only objects of
+// groups. A namespaced kind falls back to the namespaces the caller may list
+// when a cluster-wide list is denied; a cluster-scoped kind needs the
+// cluster-scope list.
+func (s *Server) readWorkspaceKind(r *http.Request, cache *k8s.ResourceCache, k workspaceKind, namespaces, groups []string) (kindAccess, []*unstructured.Unstructured) {
+	var acc kindAccess
+	var readNamespaces []string
+	if k.clusterScoped {
+		if !s.canRead(r, k.group, k.resource, "", "list") {
+			return kindAccess{state: kindCoverageDenied}, nil
+		}
+		acc = kindAccess{state: kindCoverageFull, all: true}
+	} else {
+		allowed, denied, partial, ok := s.listScope(r, namespaces, k.group, k.resource)
+		if !ok {
+			return kindAccess{state: kindCoverageDenied}, nil
+		}
+		acc, readNamespaces = accessFromScope(allowed, partial), allowed
+		acc.denied = denied
+	}
+
+	list, err := listKindInGroups(r.Context(), cache, k, readNamespaces, groups)
+	switch {
+	case err == nil:
+		return acc, list
+	case errors.Is(err, k8s.ErrUnknownDynamicKind):
+		return kindAccess{state: kindCoverageNotInstalled}, nil
+	case errors.Is(err, errDynamicNotSynced):
+		return kindAccess{state: kindCoverageSyncing}, nil
+	default:
+		log.Printf("[workspace] Failed to list %s.%s: %v", k.kind, k.group, err)
+		return kindAccess{state: kindCoverageError}, nil
+	}
+}
+
+// listKindInGroups lists k in namespaces (nil = all), keeping only objects of
+// groups.
+func listKindInGroups(ctx context.Context, cache *k8s.ResourceCache, k workspaceKind, namespaces, groups []string) ([]*unstructured.Unstructured, error) {
+	if namespaces == nil {
+		list, err := listDynamicSynced(ctx, cache, k.kind, k.group, "")
+		if err != nil {
+			return nil, err
+		}
+		return keepGroups(list, groups), nil
+	}
+	var out []*unstructured.Unstructured
+	for _, ns := range namespaces {
+		list, err := listDynamicSynced(ctx, cache, k.kind, k.group, ns)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, keepGroups(list, groups)...)
+	}
+	return out, nil
+}
+
+// keepGroups drops anything whose apiVersion is not one of groups, so an
+// object of another group can never ride along on a kind-name match (a Velero
+// Backup on a CloudNativePG Backup, a CAPI Cluster on a CNPG Cluster).
+func keepGroups(items []*unstructured.Unstructured, groups []string) []*unstructured.Unstructured {
+	out := items[:0:0]
+	for _, u := range items {
+		if u == nil || !slices.Contains(groups, u.GroupVersionKind().Group) {
+			continue
+		}
+		out = append(out, u)
+	}
+	return out
+}

From afc3ed4504aab928865f041ba65513198a7c6efc Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:15:21 +0300
Subject: [PATCH 06/26] Read grants as structured objects in the client

A grant arrives as {verb, group, resource, subresource, namespace} instead
of a sentence the client had to split back apart. formatGrant and
grantParts in k8s-ui word it exactly as the server's Grant.String does,
GrantText renders the parts without a regex, and every CloudNativePG type
and message that carries a grant takes the object.
---
 .../k8s-ui/src/components/cnpg/ha.test.ts     |  6 ++--
 packages/k8s-ui/src/components/cnpg/ha.ts     |  5 +--
 .../k8s-ui/src/components/cnpg/pooler.test.ts |  2 +-
 packages/k8s-ui/src/components/cnpg/pooler.ts |  5 +--
 .../components/cnpg/workspace-disk.test.ts    |  2 +-
 .../cnpg/workspace-fleet-metrics.test.ts      |  4 +--
 .../k8s-ui/src/components/cnpg/workspace.ts   | 11 +++---
 packages/k8s-ui/src/utils/grant.test.ts       | 18 ++++++++++
 packages/k8s-ui/src/utils/grant.ts            | 36 +++++++++++++++++++
 packages/k8s-ui/src/utils/index.ts            |  1 +
 web/src/api/cnpg-ha.test.ts                   | 10 +++---
 web/src/api/cnpg-ha.ts                        |  4 +--
 web/src/api/cnpg-history.ts                   |  4 +--
 web/src/api/cnpg-recovery.ts                  |  3 +-
 web/src/api/cnpg-sessions.ts                  |  5 +--
 web/src/api/cnpg-storage.ts                   |  4 +--
 web/src/api/cnpg.ts                           |  8 ++---
 .../cnpg/CNPGBlockingSessions.test.tsx        |  2 +-
 .../components/cnpg/CNPGBlockingSessions.tsx  |  6 ++--
 .../components/cnpg/CNPGClusterRuntime.tsx    |  4 +--
 web/src/components/cnpg/CNPGStorage.tsx       |  8 +++--
 web/src/components/cnpg/CNPGTrends.tsx        |  4 +--
 .../cnpg/actions/CNPGClusterActions.tsx       |  4 +--
 .../cnpg/actions/actionModel.test.ts          |  2 +-
 web/src/components/cnpg/grantText.test.tsx    |  4 +--
 web/src/components/cnpg/logicalSlots.test.ts  |  2 +-
 web/src/components/cnpg/logicalSlots.ts       |  3 +-
 .../components/cnpg/operations/model.test.ts  |  2 +-
 web/src/components/cnpg/operations/model.ts   |  3 +-
 .../cnpg/recovery/CNPGRestoreProgress.tsx     |  4 +--
 .../cnpg/recovery/restoreModel.test.ts        |  4 +--
 .../components/cnpg/recovery/restoreModel.ts  | 10 +++---
 web/src/components/cnpg/useCNPGPoolerLive.ts  |  3 +-
 web/src/components/workspace/layout.tsx       |  7 ++--
 34 files changed, 132 insertions(+), 68 deletions(-)
 create mode 100644 packages/k8s-ui/src/utils/grant.test.ts
 create mode 100644 packages/k8s-ui/src/utils/grant.ts

diff --git a/packages/k8s-ui/src/components/cnpg/ha.test.ts b/packages/k8s-ui/src/components/cnpg/ha.test.ts
index 569e522729..20d4f57773 100644
--- a/packages/k8s-ui/src/components/cnpg/ha.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/ha.test.ts
@@ -96,7 +96,7 @@ describe('cnpgZoneSpread', () => {
     expect(s.sharedNode).toBe(true)
   })
   it('is unknown, not single-zone, when Nodes are not readable', () => {
-    const s = cnpgZoneSpread(ha({ nodes: { state: 'denied', grant: 'get nodes' } }))
+    const s = cnpgZoneSpread(ha({ nodes: { state: 'denied', grant: { verb: 'get', resource: 'nodes' } } }))
     expect(s.known).toBe(false)
     expect(s.singleZone).toBe(false)
   })
@@ -118,7 +118,7 @@ describe('cnpgQuorumFact', () => {
     expect(cnpgQuorumFact(q({ status: { standbyNames: [], standbyNumber: 0 } })).text).toContain('no synchronous configuration recorded')
   })
   it('an unreadable object is unknown', () => {
-    expect(cnpgQuorumFact(q({ object: { state: 'denied', grant: 'get failoverquorums' } })).tone).toBe('unknown')
+    expect(cnpgQuorumFact(q({ object: { state: 'denied', grant: { verb: 'get', group: 'postgresql.cnpg.io', resource: 'failoverquorums', namespace: 'db' } } })).tone).toBe('unknown')
   })
 })
 
@@ -266,7 +266,7 @@ describe('folded HA and certificates summaries', () => {
   })
 
   it('names what it could not read instead of reading calm', () => {
-    const denied = { state: 'denied' as const, grant: 'x' }
+    const denied = { state: 'denied' as const, grant: { verb: 'list', resource: 'pods', namespace: 'db' } }
     const unread = ha({ pods: denied, nodes: denied, pdbs: { ...denied, enabled: true, items: [] }, primaryLease: denied, operatorLease: denied, jobs: { ...denied, items: [] } } as never)
     expect(cnpgHASummary(unread, undefined)).toEqual({
       text: 'Not read: Pods, zones, disruption budgets, primary lease, operator lease, Jobs, pending restarts',
diff --git a/packages/k8s-ui/src/components/cnpg/ha.ts b/packages/k8s-ui/src/components/cnpg/ha.ts
index 75587c5367..5271bf96a7 100644
--- a/packages/k8s-ui/src/components/cnpg/ha.ts
+++ b/packages/k8s-ui/src/components/cnpg/ha.ts
@@ -4,6 +4,7 @@
 // unavailable source is "unknown", never none or healthy.
 
 import type { HealthLevel } from '../resources/resource-utils'
+import { formatGrant, type Grant } from '../../utils/grant'
 import { cnpgFormatLag, cnpgLagTone, cnpgReplicationTone, cnpgSustainedLagProblemId, type CNPGFleetRow } from './workspace'
 import type { Fact, FoldSummary } from '../workspace'
 import { worseTone } from '../ui/status-tone'
@@ -13,7 +14,7 @@ export type CNPGHASourceState = 'ok' | 'denied' | 'notFound' | 'notInstalled' |
 export interface CNPGHASource {
   state: CNPGHASourceState
   reason?: string
-  grant?: string
+  grant?: Grant
 }
 
 export interface CNPGHAInstance {
@@ -145,7 +146,7 @@ export function cnpgHASourceText(src: CNPGHASource | undefined, what: string): s
     case 'ok':
       return ''
     case 'denied':
-      return `No access to ${what}${src.grant ? ` (needs ${src.grant})` : ''}`
+      return `No access to ${what}${src.grant ? ` (needs ${formatGrant(src.grant)})` : ''}`
     case 'notInstalled':
       return src.reason ?? `${what}: not available in this CloudNativePG version`
     case 'notFound':
diff --git a/packages/k8s-ui/src/components/cnpg/pooler.test.ts b/packages/k8s-ui/src/components/cnpg/pooler.test.ts
index 7434f5c1a2..ed4e1f1a9e 100644
--- a/packages/k8s-ui/src/components/cnpg/pooler.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/pooler.test.ts
@@ -30,7 +30,7 @@ describe('observedPause', () => {
     expect(observedPause({ state: 'ok', pods: [{ pod: 'a', state: 'ok', paused: true }, { pod: 'b', state: 'ok', paused: true }] })?.text).toBe('Paused on 2 of 2 PgBouncers')
     expect(observedPause({ state: 'ok', pods: [{ pod: 'a', state: 'ok', paused: true }, { pod: 'b', state: 'ok', paused: false }] })?.level).toBe('alert')
     expect(observedPause({ state: 'ok', pods: [{ pod: 'a', state: 'ok', paused: false }, { pod: 'b', state: 'error' }] })?.text).toBe('Serving (not paused) on 1 of 2 PgBouncers · 1 not read')
-    expect(observedPause({ state: 'denied', grant: 'create pods/exec in namespace x', pods: [] })?.text).toContain('create pods/exec')
+    expect(observedPause({ state: 'denied', grant: { verb: 'create', resource: 'pods', subresource: 'exec', namespace: 'x' }, pods: [] })?.text).toContain('create pods/exec')
   })
 })
 
diff --git a/packages/k8s-ui/src/components/cnpg/pooler.ts b/packages/k8s-ui/src/components/cnpg/pooler.ts
index f7b3f63058..b6e7a997d2 100644
--- a/packages/k8s-ui/src/components/cnpg/pooler.ts
+++ b/packages/k8s-ui/src/components/cnpg/pooler.ts
@@ -1,4 +1,5 @@
 import type { HealthLevel } from '../resources/resource-utils'
+import { formatGrant, type Grant } from '../../utils/grant'
 
 /** The Deployment a Pooler runs, as the host read it. */
 export interface CNPGPoolerDeploymentLive {
@@ -39,7 +40,7 @@ export interface CNPGPoolerPressureLive {
 /** Each PgBouncer's own SHOW STATE. */
 export interface CNPGPoolerObservedLive {
   state: 'loading' | 'denied' | 'error' | 'ok'
-  grant?: string
+  grant?: Grant
   reason?: string
   pods: { pod: string; state: string; paused?: boolean; error?: string }[]
 }
@@ -178,7 +179,7 @@ export function poolerBackendService(cluster: string | undefined, type: string |
 export function observedPause(o: CNPGPoolerObservedLive | undefined): { text: string; level: HealthLevel } | null {
   if (!o) return null
   if (o.state === 'loading') return { text: 'Reading…', level: 'unknown' }
-  if (o.state === 'denied') return { text: `Not observable: needs ${o.grant ?? 'create pods/exec'}`, level: 'unknown' }
+  if (o.state === 'denied') return { text: `Not observable: needs ${formatGrant(o.grant) ?? 'create pods/exec'}`, level: 'unknown' }
   if (o.state === 'error') return { text: `Not observable: ${o.reason ?? 'read failed'}`, level: 'unknown' }
   if (o.pods.length === 0) return { text: 'No PgBouncer Pods', level: 'unknown' }
   const read = o.pods.filter((p) => p.state === 'ok' && p.paused !== undefined)
diff --git a/packages/k8s-ui/src/components/cnpg/workspace-disk.test.ts b/packages/k8s-ui/src/components/cnpg/workspace-disk.test.ts
index 64e25b7e10..54850a0087 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace-disk.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace-disk.test.ts
@@ -52,7 +52,7 @@ describe('cnpgDiskFact', () => {
   })
 
   it('names the missing grant when denied', () => {
-    expect(cnpgDiskFact(reading('pg', { state: 'denied', grant: 'list persistentvolumeclaims in db', measured: 0 })).source).toBe('Needs list persistentvolumeclaims in db')
+    expect(cnpgDiskFact(reading('pg', { state: 'denied', grant: { verb: 'list', resource: 'persistentvolumeclaims', namespace: 'db' }, measured: 0 })).source).toBe('Needs list persistentvolumeclaims in namespace db')
   })
 })
 
diff --git a/packages/k8s-ui/src/components/cnpg/workspace-fleet-metrics.test.ts b/packages/k8s-ui/src/components/cnpg/workspace-fleet-metrics.test.ts
index 5fdba63953..d68a539d85 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace-fleet-metrics.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace-fleet-metrics.test.ts
@@ -59,9 +59,9 @@ describe('applyCNPGFleetMetrics', () => {
     expect(row(f, 'dark').replication.tone).toBe('unknown')
     expect(row(f, 'solo').replication.text).toBe('Single instance')
 
-    const denied = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'denied', grant: 'get pods in db' })], { source: 'prometheus' })
+    const denied = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'denied', grant: { verb: 'get', resource: 'pods', namespace: 'db' } })], { source: 'prometheus' })
     expect(row(denied, 'ha').replication.text).toBe('1/1 Pods ready · lag unknown')
-    expect(row(denied, 'ha').replication.source).toBe('Needs get pods in db')
+    expect(row(denied, 'ha').replication.source).toBe('Needs get pods in namespace db')
 
     const none = applyCNPGFleetMetrics(fleet(), undefined, { source: 'none', reason: 'Radar is not connected to Prometheus' })
     expect(row(none, 'ha').replication.text).toBe('1/1 Pods ready · lag unknown')
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index 0cef2dd842..92ff5464af 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -6,6 +6,7 @@ import { formatAge, type HealthLevel } from '../resources/resource-utils'
 import { worseTone } from '../ui/status-tone'
 import type { Fact, ProblemOrigin, WorkspaceProblem } from '../workspace'
 import { formatBytes } from '../../utils/format'
+import { formatGrant, type Grant } from '../../utils/grant'
 import {
   CNPG_BARMAN_PLUGIN_NAME,
   getCNPGClusterBackupConfig,
@@ -1097,7 +1098,7 @@ export interface CNPGDiskReading {
   name: string
   /** ok | partial | noSeries | noPrometheus | denied | unavailable | error | notRead | ambiguous | scopeMismatch */
   state: string
-  grant?: string
+  grant?: Grant
   reason?: string
   claims: number
   measured: number
@@ -1150,7 +1151,7 @@ export function cnpgDiskFact(r: CNPGDiskReading | undefined): Fact {
   }
   switch (r.state) {
     case 'denied':
-      return { text: 'No access', tone: 'unknown', source: r.grant ? `Needs ${r.grant}` : r.reason }
+      return { text: 'No access', tone: 'unknown', source: r.grant ? `Needs ${formatGrant(r.grant)}` : r.reason }
     case 'noPrometheus':
       return { text: 'No usage metrics', tone: 'unknown', source: CNPG_PROMETHEUS_NOT_CONNECTED, detail: r.reason }
     case 'noSeries':
@@ -1206,7 +1207,7 @@ export interface CNPGFleetMetricsReading {
   /** ok | noStandby | noSeries | denied | ambiguous | scopeMismatch | error | notRead */
   lag: {
     state: string
-    grant?: string
+    grant?: Grant
     reason?: string
     seconds?: number
     pod?: string
@@ -1217,7 +1218,7 @@ export interface CNPGFleetMetricsReading {
     isolation?: CNPGMetricIsolation
   }
   /** ok | noSeries | denied | unavailable | error | notRead */
-  growth: { state: string; grant?: string; reason?: string; bytesPerHour?: number; claim?: string; instance?: string; isolation?: CNPGMetricIsolation }
+  growth: { state: string; grant?: Grant; reason?: string; bytesPerHour?: number; claim?: string; instance?: string; isolation?: CNPGMetricIsolation }
 }
 
 /** How Prometheus series were tied to one cluster; `unverified` matched only by namespace and Pod or claim names. */
@@ -1288,7 +1289,7 @@ function measuredReplication(base: Fact, reading: CNPGFleetMetricsReading | unde
     case 'noStandby':
       return { text: `${prefix} · lag unknown`, tone: 'unknown', source: `No standby reports lag: ${lag.reason ?? 'no instance reports being a standby'} · ${src.lagSource ?? 'Prometheus'}` }
     case 'denied':
-      return { text: `${prefix} · lag unknown`, tone: 'unknown', source: lag.grant ? `Needs ${lag.grant}` : lag.reason }
+      return { text: `${prefix} · lag unknown`, tone: 'unknown', source: lag.grant ? `Needs ${formatGrant(lag.grant)}` : lag.reason }
   }
   return { text: `${prefix} · lag unknown`, tone: 'unknown', source: lag?.reason ?? 'Replication lag needs Prometheus scraping the CNPG exporter' }
 }
diff --git a/packages/k8s-ui/src/utils/grant.test.ts b/packages/k8s-ui/src/utils/grant.test.ts
new file mode 100644
index 0000000000..e1a675e32e
--- /dev/null
+++ b/packages/k8s-ui/src/utils/grant.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { formatGrant } from './grant'
+
+describe('formatGrant', () => {
+  it('words a namespaced grant like the server', () => {
+    expect(formatGrant({ verb: 'patch', group: 'postgresql.cnpg.io', resource: 'clusters', subresource: 'status', namespace: 'pg' })).toBe(
+      'patch clusters/status (postgresql.cnpg.io) in namespace pg',
+    )
+    expect(formatGrant({ verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'pg' })).toBe('get pods/proxy in namespace pg')
+  })
+  it('words a cluster-wide grant with the group as resource.group', () => {
+    expect(formatGrant({ verb: 'get', resource: 'nodes' })).toBe('get nodes cluster-wide')
+    expect(formatGrant({ verb: 'list', group: 'postgresql.cnpg.io', resource: 'clusters' })).toBe('list clusters.postgresql.cnpg.io cluster-wide')
+  })
+  it('is undefined without a grant', () => {
+    expect(formatGrant(undefined)).toBeUndefined()
+  })
+})
diff --git a/packages/k8s-ui/src/utils/grant.ts b/packages/k8s-ui/src/utils/grant.ts
new file mode 100644
index 0000000000..75f2a73014
--- /dev/null
+++ b/packages/k8s-ui/src/utils/grant.ts
@@ -0,0 +1,36 @@
+/**
+ * One RBAC permission a read or action needs, as the server sends it. An
+ * empty namespace means cluster-wide (a cluster-scoped resource, or a list
+ * across every namespace).
+ */
+export interface Grant {
+  verb: string
+  group?: string
+  resource: string
+  subresource?: string
+  namespace?: string
+}
+
+function grantResource(g: Grant): string {
+  return g.subresource ? `${g.resource}/${g.subresource}` : g.resource
+}
+
+/**
+ * The grant's two halves for display: what ("patch clusters/status
+ * (postgresql.cnpg.io)") and where (" in namespace pg", " cluster-wide").
+ * Worded like the server's Grant.String so the two never disagree.
+ */
+export function grantParts(g: Grant): { what: string; scope: string } {
+  if (g.namespace) {
+    return { what: `${g.verb} ${grantResource(g)}${g.group ? ` (${g.group})` : ''}`, scope: ` in namespace ${g.namespace}` }
+  }
+  return { what: `${g.verb} ${grantResource(g)}${g.group ? `.${g.group}` : ''}`, scope: ' cluster-wide' }
+}
+
+export function formatGrant(g: Grant): string
+export function formatGrant(g: Grant | undefined): string | undefined
+export function formatGrant(g: Grant | undefined): string | undefined {
+  if (!g) return undefined
+  const { what, scope } = grantParts(g)
+  return what + scope
+}
diff --git a/packages/k8s-ui/src/utils/index.ts b/packages/k8s-ui/src/utils/index.ts
index 094d399c2a..5aa6c33207 100644
--- a/packages/k8s-ui/src/utils/index.ts
+++ b/packages/k8s-ui/src/utils/index.ts
@@ -32,3 +32,4 @@ export * from './bulk-workload-actions'
 export * from './inClusterConsent'
 export * from './workflow-execution'
 export * from './network-policy'
+export * from './grant'
diff --git a/web/src/api/cnpg-ha.test.ts b/web/src/api/cnpg-ha.test.ts
index 68f7ab0f01..84c24edfd5 100644
--- a/web/src/api/cnpg-ha.test.ts
+++ b/web/src/api/cnpg-ha.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import type { CNPGFleetRow } from '@skyhook-io/k8s-ui'
+import type { CNPGFleetRow, Grant } from '@skyhook-io/k8s-ui'
 import type { CNPGRuntimeResponse } from './cnpg'
 import { cnpgInstanceLiveUnavailable, cnpgReplicationGap, withLiveReplication } from './cnpg-ha'
 
@@ -40,9 +40,9 @@ describe('withLiveReplication', () => {
 })
 
 describe('cnpgInstanceLiveUnavailable', () => {
-  const rt = (proxy: 'allowed' | 'denied', grant?: string) => ({ permission: { proxy, grant }, instances: [] }) as unknown as CNPGRuntimeResponse
+  const rt = (proxy: 'allowed' | 'denied', grant?: Grant) => ({ permission: { proxy, grant }, instances: [] }) as unknown as CNPGRuntimeResponse
   it('names the grant only when the proxy is denied', () => {
-    expect(cnpgInstanceLiveUnavailable(rt('denied', 'get pods/proxy in db'), undefined)).toBe('needs get pods/proxy in db')
+    expect(cnpgInstanceLiveUnavailable(rt('denied', { verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'db' }), undefined)).toBe('needs get pods/proxy in namespace db')
     expect(cnpgInstanceLiveUnavailable(rt('allowed'), undefined)).toBeUndefined()
     expect(cnpgInstanceLiveUnavailable(undefined, undefined)).toBe('instance managers not read yet')
     expect(cnpgInstanceLiveUnavailable(undefined, new Error('boom'))).toBe('the runtime read failed: boom')
@@ -56,8 +56,8 @@ describe('cnpgReplicationGap', () => {
       'pg-1 did not report (PostgreSQL is not running on this instance)',
     )
     expect(cnpgReplicationGap(rt([{ pod: 'pg-1', role: 'primary', status: { state: 'ok', replication: [] } }]), undefined)).toBeUndefined()
-    expect(cnpgReplicationGap({ permission: { proxy: 'denied', grant: 'get pods/proxy in db' }, instances: [] } as unknown as CNPGRuntimeResponse, undefined)).toBe(
-      'needs get pods/proxy in db',
+    expect(cnpgReplicationGap({ permission: { proxy: 'denied', grant: { verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'db' } }, instances: [] } as unknown as CNPGRuntimeResponse, undefined)).toBe(
+      'needs get pods/proxy in namespace db',
     )
   })
 })
diff --git a/web/src/api/cnpg-ha.ts b/web/src/api/cnpg-ha.ts
index 689555922e..6d42bf4338 100644
--- a/web/src/api/cnpg-ha.ts
+++ b/web/src/api/cnpg-ha.ts
@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query'
-import { cnpgFormatLag, cnpgReplicationTone, type CNPGClusterHA, type CNPGFleetRow, type CNPGInstanceLive, type CNPGReplicationLive } from '@skyhook-io/k8s-ui'
+import { cnpgFormatLag, cnpgReplicationTone, formatGrant, type CNPGClusterHA, type CNPGFleetRow, type CNPGInstanceLive, type CNPGReplicationLive } from '@skyhook-io/k8s-ui'
 import { fetchJSON } from './client'
 import type { CNPGRuntimeResponse } from './cnpg'
 
@@ -36,7 +36,7 @@ export function cnpgInstanceLive(rt: CNPGRuntimeResponse | undefined): CNPGInsta
 
 /** Why the HA section has no instance-manager facts at all; undefined when it has them. */
 export function cnpgInstanceLiveUnavailable(rt: CNPGRuntimeResponse | undefined, error: unknown): string | undefined {
-  if (rt?.permission.proxy === 'denied') return `needs ${rt.permission.grant ?? 'get pods/proxy'}`
+  if (rt?.permission.proxy === 'denied') return `needs ${formatGrant(rt.permission.grant) ?? 'get pods/proxy'}`
   if (rt) return undefined
   return error instanceof Error ? `the runtime read failed: ${error.message}` : 'instance managers not read yet'
 }
diff --git a/web/src/api/cnpg-history.ts b/web/src/api/cnpg-history.ts
index 9a89b59e7a..0a92734b9f 100644
--- a/web/src/api/cnpg-history.ts
+++ b/web/src/api/cnpg-history.ts
@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query'
-import type { CNPGFleetMetricsReading } from '@skyhook-io/k8s-ui'
+import type { CNPGFleetMetricsReading, Grant } from '@skyhook-io/k8s-ui'
 import { fetchJSON } from './client'
 import type { CNPGClusterActivityResponse } from './cnpg'
 
@@ -33,7 +33,7 @@ export interface CNPGHistoryChart {
   /** ok | empty (scraped, nothing to plot) | noSeries (not scraped) | denied | error | notRead */
   state: string
   reason?: string
-  grant?: string
+  grant?: Grant
   thresholds?: { value: number; label: string }[]
   series: CNPGHistorySeries[]
   omitted?: number
diff --git a/web/src/api/cnpg-recovery.ts b/web/src/api/cnpg-recovery.ts
index f34575c26e..02b9425a91 100644
--- a/web/src/api/cnpg-recovery.ts
+++ b/web/src/api/cnpg-recovery.ts
@@ -1,4 +1,5 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import type { Grant } from '@skyhook-io/k8s-ui'
 import { apiFetch, ApiError, fetchJSON } from './client'
 import type { CNPGActionCapability } from './cnpg'
 import { getApiBase } from './config'
@@ -7,7 +8,7 @@ export type CNPGReadState = 'ok' | 'denied' | 'notFound' | 'error' | 'skipped' |
 
 export interface CNPGReadCoverage {
   state: CNPGReadState
-  grant?: string
+  grant?: Grant
   reason?: string
 }
 
diff --git a/web/src/api/cnpg-sessions.ts b/web/src/api/cnpg-sessions.ts
index 747bb9d2ea..f94f2e056d 100644
--- a/web/src/api/cnpg-sessions.ts
+++ b/web/src/api/cnpg-sessions.ts
@@ -1,4 +1,5 @@
 import { useQuery } from '@tanstack/react-query'
+import type { Grant } from '@skyhook-io/k8s-ui'
 import { fetchJSON } from './client'
 import type { CNPGActionCapability, CNPGClusterFacts, CNPGRuntimeSourceState } from './cnpg'
 
@@ -40,7 +41,7 @@ export interface CNPGSessionsResponse {
   podUID?: string
   role?: string
   sampledAt: string
-  permission: { exec: 'allowed' | 'denied' | 'unknown'; grant: string }
+  permission: { exec: 'allowed' | 'denied' | 'unknown'; grant?: Grant }
   state: CNPGRuntimeSourceState
   error?: string
   capturedAt?: string
@@ -149,7 +150,7 @@ export function useCNPGPoolerCapabilities(namespace: string, name: string, enabl
 export interface CNPGPgBouncerStateResponse {
   pooler: { namespace: string; name: string; uid: string }
   sampledAt: string
-  permission: { exec: 'allowed' | 'denied' | 'unknown'; grant: string }
+  permission: { exec: 'allowed' | 'denied' | 'unknown'; grant?: Grant }
   pods: { pod: string; state: CNPGRuntimeSourceState; error?: string; paused?: boolean; suspended?: boolean; active?: boolean }[]
 }
 
diff --git a/web/src/api/cnpg-storage.ts b/web/src/api/cnpg-storage.ts
index 0bccaa9f49..0ab8ee0830 100644
--- a/web/src/api/cnpg-storage.ts
+++ b/web/src/api/cnpg-storage.ts
@@ -1,12 +1,12 @@
 import { useQuery } from '@tanstack/react-query'
-import type { CNPGDiskReading, CNPGMetricIsolation } from '@skyhook-io/k8s-ui'
+import type { CNPGDiskReading, CNPGMetricIsolation, Grant } from '@skyhook-io/k8s-ui'
 import { fetchJSON } from './client'
 
 export type CNPGPVCRole = 'PG_DATA' | 'PG_WAL' | 'PG_TABLESPACE'
 
 export interface CNPGStorageCoverage {
   state: string
-  grant?: string
+  grant?: Grant
   reason?: string
   /** On Prometheus usage: how the series were tied to this cluster. */
   isolation?: CNPGMetricIsolation
diff --git a/web/src/api/cnpg.ts b/web/src/api/cnpg.ts
index 2278ad8899..ce234342be 100644
--- a/web/src/api/cnpg.ts
+++ b/web/src/api/cnpg.ts
@@ -1,5 +1,5 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
-import type { CNPGSchedulePreview, CNPGWorkspaceResponse, TimelineEvent } from '@skyhook-io/k8s-ui'
+import type { CNPGSchedulePreview, CNPGWorkspaceResponse, Grant, TimelineEvent } from '@skyhook-io/k8s-ui'
 import { ApiError, fetchJSON } from './client'
 import type { CNPGOperatorDiagnosis } from './cnpg-recovery'
 
@@ -129,7 +129,7 @@ export interface CNPGActionCapability {
   allowed: boolean
   reason?: string
   permission: 'allowed' | 'denied' | 'unknown'
-  grant?: string
+  grant?: Grant
 }
 
 export interface CNPGInstanceFact {
@@ -455,7 +455,7 @@ export interface CNPGRuntimeInstance {
 export interface CNPGRuntimeResponse {
   cluster: { namespace: string; name: string; uid: string }
   sampledAt: string
-  permission: { proxy: 'allowed' | 'denied'; grant?: string }
+  permission: { proxy: 'allowed' | 'denied'; grant?: Grant }
   instances: CNPGRuntimeInstance[]
 }
 
@@ -476,7 +476,7 @@ export function useCNPGRuntime(namespace: string, name: string, enabled = true)
 export interface CNPGPoolerRuntimeResponse {
   pooler: { namespace: string; name: string; uid: string }
   sampledAt: string
-  permission: { proxy: 'allowed' | 'denied'; grant?: string }
+  permission: { proxy: 'allowed' | 'denied'; grant?: Grant }
   pods: {
     pod: string
     state: CNPGRuntimeSourceState
diff --git a/web/src/components/cnpg/CNPGBlockingSessions.test.tsx b/web/src/components/cnpg/CNPGBlockingSessions.test.tsx
index 666835af64..ae26006c4a 100644
--- a/web/src/components/cnpg/CNPGBlockingSessions.test.tsx
+++ b/web/src/components/cnpg/CNPGBlockingSessions.test.tsx
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest'
 
 vi.mock('../../api/cnpg-sessions', () => ({
   useCNPGSessions: () => ({
-    data: { pod: 'pg-1', state: 'denied', permission: { exec: 'denied', grant: 'create pods/exec in db' }, instances: [] },
+    data: { pod: 'pg-1', state: 'denied', permission: { exec: 'denied', grant: { verb: 'create', resource: 'pods', subresource: 'exec', namespace: 'db' } }, instances: [] },
     isLoading: false,
     error: null,
     isRefetchError: false,
diff --git a/web/src/components/cnpg/CNPGBlockingSessions.tsx b/web/src/components/cnpg/CNPGBlockingSessions.tsx
index 36a66d4779..5d0e95e86b 100644
--- a/web/src/components/cnpg/CNPGBlockingSessions.tsx
+++ b/web/src/components/cnpg/CNPGBlockingSessions.tsx
@@ -2,7 +2,7 @@ import { useState, type ReactNode } from 'react'
 import { useQueries } from '@tanstack/react-query'
 import { clsx } from 'clsx'
 import { Lock } from 'lucide-react'
-import { ActionConfirmDialog, PaneLoader, Tooltip, formatAge, toneFillClass, toneTextClass } from '@skyhook-io/k8s-ui'
+import { ActionConfirmDialog, PaneLoader, Tooltip, formatAge, toneFillClass, toneTextClass, formatGrant } from '@skyhook-io/k8s-ui'
 import { formatCPUString, formatMemoryString, parseCPUToNanocores, parseMemoryToBytes } from '@skyhook-io/k8s-ui/utils/format'
 import { podMetricsQuery, usePodMetrics } from '../../api/client'
 import { cnpgActionOutcomeLocked, useCNPGAction, useCNPGClusterCapabilities } from '../../api/cnpg'
@@ -82,7 +82,7 @@ function Body({
       <div className="rounded-lg border border-dashed border-theme-border p-4">
         <div className="flex items-center gap-2 text-sm font-medium text-theme-text-primary">
           <Lock className="h-4 w-4" />
-          Blocking detail needs {data.permission.grant}
+          Blocking detail needs {formatGrant(data.permission.grant) ?? 'create pods/exec'}
         </div>
         <p className="mt-1 text-sm text-theme-text-secondary">
           Who blocks whom is read inside PostgreSQL, which needs exec into the instance.{' '}
@@ -341,7 +341,7 @@ function SignalDialog({
       typedConfirmation={terminate ? String(session.pid) : undefined}
       confirmLabel={terminate ? 'Terminate backend' : 'Stop query'}
       disruptive={terminate}
-      disabledReason={caps.data && data.permission.exec === 'denied' ? `Needs ${data.permission.grant}` : undefined}
+      disabledReason={caps.data && data.permission.exec === 'denied' ? `Needs ${formatGrant(data.permission.grant) ?? 'create pods/exec'}` : undefined}
       incompleteReason={!caps.data ? 'Reading the cluster…' : undefined}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
diff --git a/web/src/components/cnpg/CNPGClusterRuntime.tsx b/web/src/components/cnpg/CNPGClusterRuntime.tsx
index 16733fa863..235445244c 100644
--- a/web/src/components/cnpg/CNPGClusterRuntime.tsx
+++ b/web/src/components/cnpg/CNPGClusterRuntime.tsx
@@ -2,7 +2,7 @@ import type { ReactNode } from 'react'
 import { useLocation, useSearchParams } from 'react-router-dom'
 import { clsx } from 'clsx'
 import { Lock } from 'lucide-react'
-import { PaneLoader, Tooltip, formatAge, toneTextClass } from '@skyhook-io/k8s-ui'
+import { PaneLoader, Tooltip, formatAge, toneTextClass, formatGrant } from '@skyhook-io/k8s-ui'
 import { useCNPGRuntime, type CNPGRuntimeInstance } from '../../api/cnpg'
 import { useCNPGSessions, type CNPGSessionsResponse } from '../../api/cnpg-sessions'
 import { useCNPGClusterHistory } from '../../api/cnpg-history'
@@ -85,7 +85,7 @@ export function CNPGClusterRuntime({
   }
   const data = q.data
   const denied = data.permission.proxy === 'denied'
-  const grant = data.permission.grant ?? `get pods/proxy in ${namespace}`
+  const grant = formatGrant(data.permission.grant) ?? `get pods/proxy in namespace ${namespace}`
   const primary = data.instances.find((i) => i.role === 'primary')
   const replicas = data.instances.filter((i) => i.role !== 'primary')
   // Sessions and Transactions read one instance's exporter; the primary
diff --git a/web/src/components/cnpg/CNPGStorage.tsx b/web/src/components/cnpg/CNPGStorage.tsx
index 5a19ec10b6..2f880af4d2 100644
--- a/web/src/components/cnpg/CNPGStorage.tsx
+++ b/web/src/components/cnpg/CNPGStorage.tsx
@@ -16,6 +16,8 @@ import {
   parseQuantityToNumber,
   toneFillClass,
   toneTextClass,
+  formatGrant,
+  type Grant,
 } from '@skyhook-io/k8s-ui'
 import { useResource } from '../../api/client'
 import type { CNPGRuntimeInstance } from '../../api/cnpg'
@@ -317,7 +319,7 @@ function InstanceCard({ inst, walCoverage, stated }: { inst: CNPGStorageInstance
           walCoverage.state === 'ok' ? (
             <div className="text-xs text-theme-text-tertiary">No running instance to read</div>
           ) : (
-            <Tooltip content={walCoverage.state === 'denied' ? `No access: needs ${walCoverage.grant}` : walCoverage.reason ?? walCoverage.state}>
+            <Tooltip content={walCoverage.state === 'denied' ? `No access: needs ${formatGrant(walCoverage.grant)}` : walCoverage.reason ?? walCoverage.state}>
               <div className="text-xs text-theme-text-tertiary">Unknown</div>
             </Tooltip>
           )
@@ -328,11 +330,11 @@ function InstanceCard({ inst, walCoverage, stated }: { inst: CNPGStorageInstance
 }
 
 // "<label> needs …" lines; `plural` for a label that takes "need".
-function coverageLine(label: string, c: { state: string; grant?: string; reason?: string }, plural = false): string | null {
+function coverageLine(label: string, c: { state: string; grant?: Grant; reason?: string }, plural = false): string | null {
   const needs = plural ? 'need' : 'needs'
   if (c.state === 'ok') return null
   if (c.state === 'noPrometheus') return `${label} ${needs} Prometheus. ${c.reason ?? 'Radar is not connected to one'}.`
-  if (c.state === 'denied') return `${label} ${needs} ${c.grant ?? 'a grant you do not have'}.`
+  if (c.state === 'denied') return `${label} ${needs} ${formatGrant(c.grant) ?? 'a grant you do not have'}.`
   return `${label}: ${c.reason ?? c.state}`
 }
 
diff --git a/web/src/components/cnpg/CNPGTrends.tsx b/web/src/components/cnpg/CNPGTrends.tsx
index f54b4cc81e..c4ed3ec970 100644
--- a/web/src/components/cnpg/CNPGTrends.tsx
+++ b/web/src/components/cnpg/CNPGTrends.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { useLocation, useSearchParams } from 'react-router-dom'
 import { X } from 'lucide-react'
-import { Tooltip } from '@skyhook-io/k8s-ui'
+import { Tooltip, formatGrant } from '@skyhook-io/k8s-ui'
 import { AreaChart, SeriesLegend, type ChartTimeRange, type ReferenceLine, type TimeSeries } from '@skyhook-io/k8s-ui/components/charts'
 import type { CNPGRuntimeResponse } from '../../api/cnpg'
 import {
@@ -122,7 +122,7 @@ function stateText(chart: CNPGHistoryChart): string {
     case 'noSeries':
       return chart.reason ? chart.reason.charAt(0).toUpperCase() + chart.reason.slice(1) + '.' : 'Not scraped.'
     case 'denied':
-      return `No access: needs ${chart.grant ?? 'more permissions'}.`
+      return `No access: needs ${formatGrant(chart.grant) ?? 'more permissions'}.`
     case 'notRead':
       return `Not read: ${chart.reason ?? 'no source'}.`
     default:
diff --git a/web/src/components/cnpg/actions/CNPGClusterActions.tsx b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
index 96e3dc84c0..bb35885619 100644
--- a/web/src/components/cnpg/actions/CNPGClusterActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useMemo, useState, type ReactNode } from 'react'
 import { ChevronDown, DatabaseBackup, MoreHorizontal, Repeat } from 'lucide-react'
 import { clsx } from 'clsx'
-import { ActionConfirmDialog, Tooltip, cnpgPDBFact, cnpgQuorumFact, toneTextClass, type ActionWrite, type CNPGClusterHA } from '@skyhook-io/k8s-ui'
+import { ActionConfirmDialog, Tooltip, cnpgPDBFact, cnpgQuorumFact, toneTextClass, type ActionWrite, type CNPGClusterHA, formatGrant } from '@skyhook-io/k8s-ui'
 import {
   cnpgActionOutcomeLocked,
   useCNPGAction,
@@ -48,7 +48,7 @@ function EffectItem({ list, label }: { list: { available: boolean; reason?: stri
 function capabilityTitle(cap: CNPGActionCapability | undefined): string | undefined {
   if (!cap) return 'Checking permissions…'
   if (cap.allowed) return undefined
-  return cap.reason ?? (cap.permission === 'denied' ? `Your account may not do this (${cap.grant ?? 'permission denied'})` : 'Not available')
+  return cap.reason ?? (cap.permission === 'denied' ? `Your account may not do this (${formatGrant(cap.grant) ?? 'permission denied'})` : 'Not available')
 }
 
 /**
diff --git a/web/src/components/cnpg/actions/actionModel.test.ts b/web/src/components/cnpg/actions/actionModel.test.ts
index 149a095488..07eb4f7f0e 100644
--- a/web/src/components/cnpg/actions/actionModel.test.ts
+++ b/web/src/components/cnpg/actions/actionModel.test.ts
@@ -25,7 +25,7 @@ describe('cnpgDestroyBlocker', () => {
     expect(cnpgDestroyBlocker(fence, 'pg-2', false)).toBe(fence.reason)
   })
   it('keeps real blockers as the alert', () => {
-    expect(cnpgDestroyBlocker({ allowed: false, permission: 'denied', reason: 'Needs delete pods in db', grant: 'delete pods in db' }, 'pg-2', true)).toBe('Needs delete pods in db')
+    expect(cnpgDestroyBlocker({ allowed: false, permission: 'denied', reason: 'Needs delete pods in db', grant: { verb: 'delete', resource: 'pods', namespace: 'db' } }, 'pg-2', true)).toBe('Needs delete pods in db')
     expect(cnpgDestroyBlocker({ allowed: false, permission: 'allowed', reason: 'The cluster is hibernated' }, 'pg-2', true)).toBe('The cluster is hibernated')
     expect(cnpgDestroyBlocker({ allowed: true, permission: 'allowed' }, 'pg-2', true)).toBeUndefined()
   })
diff --git a/web/src/components/cnpg/grantText.test.tsx b/web/src/components/cnpg/grantText.test.tsx
index ee19383185..80dcd798ce 100644
--- a/web/src/components/cnpg/grantText.test.tsx
+++ b/web/src/components/cnpg/grantText.test.tsx
@@ -4,8 +4,8 @@ import { GrantText } from '../workspace/layout'
 
 describe('GrantText', () => {
   it('keeps the verb and resource together, with the scope as plain text', () => {
-    const html = renderToStaticMarkup(<GrantText grant="get mutatingwebhookconfigurations.admissionregistration.k8s.io cluster-wide" />)
+    const html = renderToStaticMarkup(<GrantText grant={{ verb: 'get', group: 'admissionregistration.k8s.io', resource: 'mutatingwebhookconfigurations' }} />)
     expect(html).toMatch(/<code[^>]*whitespace-nowrap[^>]*>get mutatingwebhookconfigurations.admissionregistration.k8s.io<\/code> cluster-wide/)
-    expect(renderToStaticMarkup(<GrantText grant="get pods/proxy in namespace pgrt" />)).toMatch(/>get pods\/proxy<\/code> in namespace pgrt/)
+    expect(renderToStaticMarkup(<GrantText grant={{ verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'pgrt' }} />)).toMatch(/>get pods\/proxy<\/code> in namespace pgrt/)
   })
 })
diff --git a/web/src/components/cnpg/logicalSlots.test.ts b/web/src/components/cnpg/logicalSlots.test.ts
index 5a0091967a..fb8530b537 100644
--- a/web/src/components/cnpg/logicalSlots.test.ts
+++ b/web/src/components/cnpg/logicalSlots.test.ts
@@ -5,7 +5,7 @@ import { cnpgPublisherSlotsFrom } from './logicalSlots'
 const rt = (status: any, proxy: 'allowed' | 'denied' = 'allowed', role: 'primary' | 'replica' = 'primary'): CNPGRuntimeResponse => ({
   cluster: { namespace: 'src', name: 'src', uid: 'u' },
   sampledAt: '2026-09-30T10:00:00Z',
-  permission: { proxy, grant: 'get pods/proxy in src' },
+  permission: { proxy, grant: { verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'src' } },
   instances: [{ pod: 'src-1', role, status, metrics: { state: 'ok' } }],
 })
 
diff --git a/web/src/components/cnpg/logicalSlots.ts b/web/src/components/cnpg/logicalSlots.ts
index 3227f0da73..0ad43e19d3 100644
--- a/web/src/components/cnpg/logicalSlots.ts
+++ b/web/src/components/cnpg/logicalSlots.ts
@@ -1,12 +1,13 @@
 import type { UseQueryResult } from '@tanstack/react-query'
 import type { CNPGPublisher, CNPGPublisherSlots } from '@skyhook-io/k8s-ui'
 import { useCNPGRuntime, type CNPGRuntimeResponse } from '../../api/cnpg'
+import { formatGrant } from '@skyhook-io/k8s-ui'
 
 /** The publisher primary's replication slots from its runtime answer, never read as "no slots" when unread. */
 export function cnpgPublisherSlotsFrom(rt: CNPGRuntimeResponse | undefined, error?: unknown, refetchFailed = false): CNPGPublisherSlots {
   if (!rt) return { state: 'notRead', reason: error instanceof Error ? error.message : undefined }
   const stale = refetchFailed || undefined
-  if (rt.permission.proxy === 'denied') return { state: 'denied', reason: rt.permission.grant }
+  if (rt.permission.proxy === 'denied') return { state: 'denied', reason: formatGrant(rt.permission.grant) }
   const primary = rt.instances.find((i) => i.role === 'primary')
   if (!primary) return { state: 'unavailable', reason: 'no primary reported' }
   const st = primary.status
diff --git a/web/src/components/cnpg/operations/model.test.ts b/web/src/components/cnpg/operations/model.test.ts
index 0499e3d775..5482a511a1 100644
--- a/web/src/components/cnpg/operations/model.test.ts
+++ b/web/src/components/cnpg/operations/model.test.ts
@@ -287,7 +287,7 @@ describe('switchover without readable endpoints', () => {
       obs({
         facts: facts({ currentPrimary: 'pg-2', targetPrimary: 'pg-2' }),
         runtime: runtime('pg-2', [{ pod: 'pg-1', state: 'streaming' }]),
-        ha: ha({ rwEndpoints: { state: 'denied', grant: 'list endpointslices in db', service: 'pg-rw', pods: [] } }),
+        ha: ha({ rwEndpoints: { state: 'denied', grant: { verb: 'list', group: 'discovery.k8s.io', resource: 'endpointslices', namespace: 'db' }, service: 'pg-rw', pods: [] } }),
       }),
     )
     expect(o.state).toBe('unobservable')
diff --git a/web/src/components/cnpg/operations/model.ts b/web/src/components/cnpg/operations/model.ts
index 0e809d45cc..6ea7df724d 100644
--- a/web/src/components/cnpg/operations/model.ts
+++ b/web/src/components/cnpg/operations/model.ts
@@ -1,5 +1,6 @@
 import type { CNPGClusterHA } from '@skyhook-io/k8s-ui'
 import type { CNPGClusterFacts, CNPGRuntimeResponse } from '../../../api/cnpg'
+import { formatGrant } from '@skyhook-io/k8s-ui'
 
 // Follow-through for CloudNativePG actions. A successful POST only means the
 // write was accepted; the operator acts on it later. A tracked operation is
@@ -276,7 +277,7 @@ registerCNPGOperationObserver('switchover', (op, obs) => {
   steps.push({ label: 'Cluster reports a healthy state again', done: promoted && f.phase === 'Cluster in healthy state' })
   let state = summarizeSteps(steps)
   if (requested && !promoted) state = 'observed'
-  const rwUnverified = `the read-write Service is unverified${rw?.grant ? ` (needs ${rw.grant})` : rw?.reason ? ` (${rw.reason})` : ''}`
+  const rwUnverified = `the read-write Service is unverified${rw?.grant ? ` (needs ${formatGrant(rw.grant)})` : rw?.reason ? ` (${rw.reason})` : ''}`
   const detail =
     rejoined === null && promoted
       ? `Primary changed; whether ${oldPrimary} rejoined needs runtime access (get pods/proxy)${rwReadable ? '' : `; ${rwUnverified}`}`
diff --git a/web/src/components/cnpg/recovery/CNPGRestoreProgress.tsx b/web/src/components/cnpg/recovery/CNPGRestoreProgress.tsx
index cb6574c86c..8b4bf7a446 100644
--- a/web/src/components/cnpg/recovery/CNPGRestoreProgress.tsx
+++ b/web/src/components/cnpg/recovery/CNPGRestoreProgress.tsx
@@ -1,6 +1,6 @@
 import { useMemo } from 'react'
 import { useNavigate } from 'react-router-dom'
-import { Badge, StatusDot, formatAge, toneTextClass, type HealthLevel } from '@skyhook-io/k8s-ui'
+import { Badge, StatusDot, formatAge, toneTextClass, type HealthLevel, formatGrant } from '@skyhook-io/k8s-ui'
 import { useCNPGRecovery, type CNPGContainerState, type CNPGRecoveryResponse, type CNPGRecoverySpec } from '../../../api/cnpg-recovery'
 import { buildWorkloadPath } from '../../../utils/navigation'
 import { observeRestore, restoreNextSteps, type RestoreBackupDeclared, type RestoreNextStep, type RestoreNextStepId, type RestoreObservation } from './restoreModel'
@@ -155,7 +155,7 @@ export function CNPGRestoreProgress({ namespace, name, nextSteps }: { namespace:
           </button>
         )}
         {snapshot.coverage.pods?.state !== 'ok' && (
-          <div className="text-xs text-theme-text-tertiary">Recovery Pods not visible: {snapshot.coverage.pods?.grant ? `needs ${snapshot.coverage.pods.grant}` : snapshot.coverage.pods?.reason}</div>
+          <div className="text-xs text-theme-text-tertiary">Recovery Pods not visible: {snapshot.coverage.pods?.grant ? `needs ${formatGrant(snapshot.coverage.pods.grant)}` : snapshot.coverage.pods?.reason}</div>
         )}
         {warnings.length > 0 && (
           <div>
diff --git a/web/src/components/cnpg/recovery/restoreModel.test.ts b/web/src/components/cnpg/recovery/restoreModel.test.ts
index 00d7b721a6..202ec8af9d 100644
--- a/web/src/components/cnpg/recovery/restoreModel.test.ts
+++ b/web/src/components/cnpg/recovery/restoreModel.test.ts
@@ -182,7 +182,7 @@ describe('observeRestore', () => {
   })
 
   it('never reads missing access as progress or failure', () => {
-    const o = observeRestore(snapshot({ coverage: { pods: { state: 'denied', grant: 'list pods in namespace db' }, jobs: { state: 'denied' }, events: { state: 'denied' } } }))
+    const o = observeRestore(snapshot({ coverage: { pods: { state: 'denied', grant: { verb: 'list', resource: 'pods', namespace: 'db' } }, jobs: { state: 'denied' }, events: { state: 'denied' } } }))
     expect(o.state).toBe('unobservable')
     expect(o.detail).toContain('list pods')
   })
@@ -224,7 +224,7 @@ describe('restore operation observer', () => {
 
 describe('restorePermission', () => {
   it('blocks review with the grant when create clusters is denied, whichever way the dialog opened', () => {
-    const r = restorePermission('db', { allowed: false, permission: 'denied', grant: 'create clusters (postgresql.cnpg.io) in namespace db', reason: 'x' }, undefined)
+    const r = restorePermission('db', { allowed: false, permission: 'denied', grant: { verb: 'create', group: 'postgresql.cnpg.io', resource: 'clusters', namespace: 'db' }, reason: 'x' }, undefined)
     expect(r.blocked).toContain('needs create clusters (postgresql.cnpg.io) in namespace db')
   })
   it('blocks with the refusal when the operator webhook rejects writes', () => {
diff --git a/web/src/components/cnpg/recovery/restoreModel.ts b/web/src/components/cnpg/recovery/restoreModel.ts
index 7ce36ddb97..4e0b924271 100644
--- a/web/src/components/cnpg/recovery/restoreModel.ts
+++ b/web/src/components/cnpg/recovery/restoreModel.ts
@@ -1,4 +1,4 @@
-import { CNPG_BARMAN_PLUGIN_NAME, getCNPGClusterBarmanPlugin, getCNPGObjectStoreRecoveryWindows, isApiGroup, type HealthLevel } from '@skyhook-io/k8s-ui'
+import { CNPG_BARMAN_PLUGIN_NAME, getCNPGClusterBarmanPlugin, getCNPGObjectStoreRecoveryWindows, isApiGroup, type HealthLevel, formatGrant } from '@skyhook-io/k8s-ui'
 import type { CNPGActionCapability, CNPGRuntimeResponse } from '../../../api/cnpg'
 import type { CNPGRecoveryResponse, CNPGRecoveryPod } from '../../../api/cnpg-recovery'
 
@@ -166,7 +166,7 @@ export function recoveryEvidenceFor(
         !ctx.runtime
           ? 'The last archived WAL time is not loaded'
           : ctx.runtime.permission.proxy === 'denied'
-            ? `The last archived WAL time needs ${ctx.runtime.permission.grant ?? 'get pods/proxy'}`
+            ? `The last archived WAL time needs ${formatGrant(ctx.runtime.permission.grant) ?? 'get pods/proxy'}`
             : !primary
               ? 'No primary is reported, so the last archived WAL time is unknown'
               : primary.status.state !== 'ok'
@@ -414,7 +414,7 @@ export function observeRestore(snap: CNPGRecoveryResponse): RestoreObservation {
     }
   }
   if (!podsVisible && !c.phase) {
-    return { ...base, state: 'unobservable', tone: 'unknown', title: 'Progress not visible', detail: snap.coverage.pods?.grant ? `Following the restore needs ${snap.coverage.pods.grant}` : 'The Cluster has not reported a phase yet' }
+    return { ...base, state: 'unobservable', tone: 'unknown', title: 'Progress not visible', detail: snap.coverage.pods?.grant ? `Following the restore needs ${formatGrant(snap.coverage.pods.grant)}` : 'The Cluster has not reported a phase yet' }
   }
   const starting = instances.find((p) => !p.ready)
   return {
@@ -422,7 +422,7 @@ export function observeRestore(snap: CNPGRecoveryResponse): RestoreObservation {
     state: 'progressing',
     tone: 'neutral',
     title: recoveryPods.some((p) => p.phase === 'Succeeded') ? 'Recovery finished; starting the restored instances' : 'Waiting for the recovery to start',
-    detail: [c.phase, c.readyInstances !== null && c.instances !== null ? `${c.readyInstances}/${c.instances} ready` : null, !podsVisible ? `Pods not visible${snap.coverage.pods?.grant ? ` (needs ${snap.coverage.pods.grant})` : ''}` : null]
+    detail: [c.phase, c.readyInstances !== null && c.instances !== null ? `${c.readyInstances}/${c.instances} ready` : null, !podsVisible ? `Pods not visible${snap.coverage.pods?.grant ? ` (needs ${formatGrant(snap.coverage.pods.grant)})` : ''}` : null]
       .filter(Boolean)
       .join(' · '),
     logsPod: starting ? { name: starting.name, container: 'postgres' } : undefined,
@@ -442,7 +442,7 @@ export function restorePermission(
 ): { blocked?: string; pending?: string; unchecked?: string } {
   if (cap) {
     if (cap.allowed) return {}
-    if (cap.permission === 'denied') return { blocked: `Restoring creates a Cluster in ${namespace}, which needs ${cap.grant ?? 'create clusters (postgresql.cnpg.io)'}.` }
+    if (cap.permission === 'denied') return { blocked: `Restoring creates a Cluster in ${namespace}, which needs ${formatGrant(cap.grant) ?? 'create clusters (postgresql.cnpg.io)'}.` }
     return { blocked: cap.reason ?? 'Restoring is not available right now.' }
   }
   if (error) return { unchecked: `Whether you may create a Cluster in ${namespace} could not be checked (${error instanceof Error ? error.message : 'unknown error'}); the review step will tell.` }
diff --git a/web/src/components/cnpg/useCNPGPoolerLive.ts b/web/src/components/cnpg/useCNPGPoolerLive.ts
index 0efdf1750e..2a698730f9 100644
--- a/web/src/components/cnpg/useCNPGPoolerLive.ts
+++ b/web/src/components/cnpg/useCNPGPoolerLive.ts
@@ -2,6 +2,7 @@ import type { UseQueryResult } from '@tanstack/react-query'
 import type { CNPGPoolerLive } from '@skyhook-io/k8s-ui'
 import { useCNPGPoolerRuntime } from '../../api/cnpg'
 import { useCNPGPgBouncerState, useCNPGPoolerCapabilities } from '../../api/cnpg-sessions'
+import { formatGrant } from '@skyhook-io/k8s-ui'
 
 /**
  * The live reads the Pooler summary shows beside the spec, and the queries
@@ -22,7 +23,7 @@ export function useCNPGPoolerLive(namespace: string, name: string): { live: CNPG
     const denied = runtime.data.permission.proxy === 'denied'
     live.pressure = {
       state: denied ? 'denied' : 'ok',
-      reason: denied ? `needs ${runtime.data.permission.grant ?? 'get pods/proxy'}` : undefined,
+      reason: denied ? `needs ${formatGrant(runtime.data.permission.grant) ?? 'get pods/proxy'}` : undefined,
       pods: runtime.data.pods,
     }
   } else {
diff --git a/web/src/components/workspace/layout.tsx b/web/src/components/workspace/layout.tsx
index 2fe65f9535..440a88ccb8 100644
--- a/web/src/components/workspace/layout.tsx
+++ b/web/src/components/workspace/layout.tsx
@@ -2,7 +2,7 @@ import type { ComponentType, ReactNode } from 'react'
 import type { UseQueryResult } from '@tanstack/react-query'
 import { clsx } from 'clsx'
 import { AlertTriangle, X } from 'lucide-react'
-import { Tooltip, formatUpdatedAgo, toneTextClass } from '@skyhook-io/k8s-ui'
+import { Tooltip, formatUpdatedAgo, grantParts, toneTextClass, type Grant } from '@skyhook-io/k8s-ui'
 import type { SelectedResource } from '../../types'
 import { sameSelectedResource } from '../../utils/drawer-trail'
 import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from './table'
@@ -219,9 +219,8 @@ export function PathText({ value, className }: { value: string; className?: stri
  * A grant as one unit: the verb and resource in a code span that does not
  * wrap, its scope ("cluster-wide", "in namespace pg") as plain text after it.
  */
-export function GrantText({ grant }: { grant: string }) {
-  const m = /^(.*?)( cluster-wide| in namespace \S+)$/.exec(grant)
-  const [what, scope] = m ? [m[1], m[2]] : [grant, '']
+export function GrantText({ grant }: { grant: Grant }) {
+  const { what, scope } = grantParts(grant)
   return (
     <>
       <code className="whitespace-nowrap rounded bg-theme-elevated px-1 font-mono text-[12px]">{what}</code>

From ba0d14ff7fc67406cbe3b928243165bc03ac1bfa Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:15:58 +0300
Subject: [PATCH 07/26] Report namespaces Radar does not cache as uncached, not
 denied

A namespace the caller may list but Radar's informer does not hold was
named in deniedNamespaces, and a scope the cache did not hold at all read
as error. Kind coverage now names such namespaces in uncachedNamespaces,
under the same disclosure rule as deniedNamespaces, and a scope the cache
holds none of has the state uncached. A partial result may carry both
lists. The HA operator-lease reason no longer tells the caller the
Deployment is hidden from them when Radar simply does not watch it.
---
 internal/server/cnpg_cluster_ha.go  |   5 +-
 internal/server/cnpg_operator.go    |   4 +-
 internal/server/cnpg_workspace.go   |   2 +-
 internal/server/kind_access.go      |  49 ++++++-----
 internal/server/kind_access_test.go | 121 ++++++++++++++++++++++++++++
 5 files changed, 156 insertions(+), 25 deletions(-)
 create mode 100644 internal/server/kind_access_test.go

diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index 0a384c68f5..fa4d5445b4 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -606,8 +606,11 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 	}
 	if namespace == "" {
 		reason := "The operator Deployment is not visible to you, so its namespace is unknown"
-		if acc.state == kindCoverageFull {
+		switch acc.state {
+		case kindCoverageFull:
 			reason = "No operator Deployment labelled " + cnpgOperatorNameLabel + "=" + cnpgOperatorNameValue + " was found"
+		case kindCoverageUncached:
+			reason = "Radar does not watch Deployments in the namespaces you can read, so the operator's namespace is unknown"
 		}
 		return CNPGHALease{CNPGHASource: CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}, Name: cnpgOperatorLeaseName}
 	}
diff --git a/internal/server/cnpg_operator.go b/internal/server/cnpg_operator.go
index 6d95e282c7..8735c0f32d 100644
--- a/internal/server/cnpg_operator.go
+++ b/internal/server/cnpg_operator.go
@@ -167,7 +167,7 @@ func (s *Server) cnpgOperatorScope(r *http.Request) []string {
 
 func (s *Server) cnpgOperatorDeployments(r *http.Request, cache *k8s.ResourceCache, scope []string) (kindAccess, []*appsv1.Deployment) {
 	acc, read := s.typedKindScope(r, cache, scope, "apps", "deployments")
-	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageUncached {
 		return acc, nil
 	}
 	lister := cache.Deployments()
@@ -194,7 +194,7 @@ func (s *Server) cnpgOperatorDeployments(r *http.Request, cache *k8s.ResourceCac
 
 func (s *Server) cnpgOperatorServices(r *http.Request, cache *k8s.ResourceCache, scope []string) (kindAccess, []*corev1.Service) {
 	acc, read := s.typedKindScope(r, cache, scope, "", "services")
-	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageUncached {
 		return acc, nil
 	}
 	lister := cache.Services()
diff --git a/internal/server/cnpg_workspace.go b/internal/server/cnpg_workspace.go
index c29347b4bd..8b0fb76487 100644
--- a/internal/server/cnpg_workspace.go
+++ b/internal/server/cnpg_workspace.go
@@ -367,7 +367,7 @@ func (s *Server) cnpgWorkspaceReadPods(r *http.Request, cache *k8s.ResourceCache
 	out := []any{}
 	returned := map[string]bool{}
 	acc, read := s.typedKindScope(r, cache, namespaces, "", "pods")
-	if acc.state == kindCoverageDenied || acc.state == kindCoverageError {
+	if acc.state == kindCoverageDenied || acc.state == kindCoverageUncached {
 		return acc, out, returned
 	}
 	if cache.Pods() == nil {
diff --git a/internal/server/kind_access.go b/internal/server/kind_access.go
index fc76c810b7..5a080b5b5e 100644
--- a/internal/server/kind_access.go
+++ b/internal/server/kind_access.go
@@ -15,33 +15,40 @@ import (
 
 // Coverage states for one kind a workspace lists.
 const (
-	kindCoverageFull         = "full"
-	kindCoveragePartial      = "partial"
-	kindCoverageDenied       = "denied"
+	kindCoverageFull    = "full"
+	kindCoveragePartial = "partial"
+	kindCoverageDenied  = "denied"
+	// kindCoverageUncached: the caller may list the kind, but Radar's informer
+	// holds none of the namespaces in scope, so nothing was read.
+	kindCoverageUncached     = "uncached"
 	kindCoverageNotInstalled = "notInstalled"
 	kindCoverageSyncing      = "syncing"
 	kindCoverageError        = "error"
 )
 
 // KindCoverage states how much of one kind the caller could see.
-// DeniedNamespaces lists only namespaces already in the caller's scope, so it
-// may be omitted on a partial state; AllowedNamespaces is always set on a
-// partial state and is the authority for which namespaces were read.
+// DeniedNamespaces (the caller may not list there) and UncachedNamespaces
+// (the caller may, but Radar's informer does not hold them) list only
+// namespaces already in the caller's scope, so either may be omitted on a
+// partial state; AllowedNamespaces is always set on a partial state and is
+// the authority for which namespaces were read.
 type KindCoverage struct {
-	State             string   `json:"state"`
-	DeniedNamespaces  []string `json:"deniedNamespaces,omitempty"`
-	AllowedNamespaces []string `json:"allowedNamespaces,omitempty"`
+	State              string   `json:"state"`
+	DeniedNamespaces   []string `json:"deniedNamespaces,omitempty"`
+	UncachedNamespaces []string `json:"uncachedNamespaces,omitempty"`
+	AllowedNamespaces  []string `json:"allowedNamespaces,omitempty"`
 }
 
 // kindAccess is the resolved read scope for one kind. all means every
 // namespace in the request's scope (or the cluster-scoped kind itself).
-// denied names the in-scope namespaces left unread, under the disclosure rule
-// of listScope.
+// denied and uncached name the in-scope namespaces left unread, under the
+// disclosure rule of listScope.
 type kindAccess struct {
 	state      string
 	all        bool
 	namespaces map[string]bool
 	denied     []string
+	uncached   []string
 }
 
 func (a kindAccess) covers(namespace string) bool {
@@ -52,7 +59,7 @@ func (a kindAccess) covers(namespace string) bool {
 }
 
 func (a kindAccess) coverage() KindCoverage {
-	cov := KindCoverage{State: a.state, DeniedNamespaces: a.denied}
+	cov := KindCoverage{State: a.state, DeniedNamespaces: a.denied, UncachedNamespaces: a.uncached}
 	if a.state == kindCoveragePartial {
 		cov.AllowedNamespaces = make([]string, 0, len(a.namespaces))
 		for ns := range a.namespaces {
@@ -115,18 +122,15 @@ func accessFromScope(allowed []string, partial bool) kindAccess {
 // typedKindScope resolves where the caller may list a typed kind and which of
 // those namespaces Radar's informer actually holds. The informer may itself be
 // namespace-scoped when Radar's own identity cannot list the kind
-// cluster-wide; what it does not hold is unread, not empty. read is nil for
-// "every namespace".
+// cluster-wide; what it does not hold is unread, not empty, and not denied.
+// read is nil for "every namespace".
 func (s *Server) typedKindScope(r *http.Request, cache informerScope, namespaces []string, group, resource string) (acc kindAccess, read []string) {
 	allowed, denied, partial, ok := s.listScope(r, namespaces, group, resource)
 	if !ok {
 		return kindAccess{state: kindCoverageDenied}, []string{}
 	}
 	within := namespacesWithinCache(cache, resource, allowed)
-	if within.unavailable {
-		log.Printf("[workspace] %s cache does not cover the requested scope", resource)
-		return kindAccess{state: kindCoverageError}, []string{}
-	}
+	var uncached []string
 	if allowed != nil {
 		for _, ns := range allowed {
 			if slices.Contains(within.namespaces, ns) {
@@ -134,13 +138,16 @@ func (s *Server) typedKindScope(r *http.Request, cache informerScope, namespaces
 			}
 			partial = true
 			if namespaces != nil {
-				denied = append(denied, ns)
+				uncached = append(uncached, ns)
 			}
 		}
-		sort.Strings(denied)
+		sort.Strings(uncached)
+	}
+	if within.unavailable {
+		return kindAccess{state: kindCoverageUncached, denied: denied, uncached: uncached}, []string{}
 	}
 	acc = accessFromScope(within.namespaces, partial || within.partial)
-	acc.denied = denied
+	acc.denied, acc.uncached = denied, uncached
 	return acc, within.namespaces
 }
 
diff --git a/internal/server/kind_access_test.go b/internal/server/kind_access_test.go
new file mode 100644
index 0000000000..42445d9980
--- /dev/null
+++ b/internal/server/kind_access_test.go
@@ -0,0 +1,121 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/skyhook-io/radar/internal/auth"
+)
+
+func kindScopeRequest(env *authTestEnv, user string, perms *auth.UserPermissions) *http.Request {
+	env.srv.permCache.Set(user, nil, perms)
+	r := httptest.NewRequest(http.MethodGet, "/api/cnpg/workspace", nil)
+	return r.WithContext(auth.ContextWithUser(r.Context(), &auth.User{Username: user}))
+}
+
+// A namespace the caller may list but Radar's informer does not hold was not
+// read, and it is not a denial: the caller has the permission.
+func TestTypedKindScope_UncachedIsNotDenied(t *testing.T) {
+	env := newAuthTestServer(t)
+	cache := capacityTestInformerScope{namespaces: map[string][]string{"pods": {"a"}}}
+
+	perms := &auth.UserPermissions{}
+	allow(perms, "", "pods", "", false)
+	allow(perms, "", "pods", "a", true)
+	allow(perms, "", "pods", "b", true)
+	allow(perms, "", "pods", "c", false)
+	r := kindScopeRequest(env, "alice", perms)
+
+	t.Run("readable but uncached", func(t *testing.T) {
+		acc, read := env.srv.typedKindScope(r, cache, []string{"a", "b"}, "", "pods")
+		cov := acc.coverage()
+		if cov.State != kindCoveragePartial || len(cov.DeniedNamespaces) != 0 || !slices.Equal(cov.UncachedNamespaces, []string{"b"}) || !slices.Equal(cov.AllowedNamespaces, []string{"a"}) {
+			t.Errorf("coverage = %+v, want partial, uncached [b], allowed [a], nothing denied", cov)
+		}
+		if !slices.Equal(read, []string{"a"}) {
+			t.Errorf("read = %v, want [a]", read)
+		}
+	})
+
+	t.Run("wholly uncached", func(t *testing.T) {
+		acc, read := env.srv.typedKindScope(r, cache, []string{"b"}, "", "pods")
+		cov := acc.coverage()
+		if cov.State != kindCoverageUncached || len(cov.DeniedNamespaces) != 0 || !slices.Equal(cov.UncachedNamespaces, []string{"b"}) || cov.AllowedNamespaces != nil {
+			t.Errorf("coverage = %+v, want uncached naming b, nothing denied", cov)
+		}
+		if read == nil || len(read) != 0 {
+			t.Errorf("read = %#v, want an empty non-nil scope (nil reads every namespace)", read)
+		}
+		if acc.covers("b") {
+			t.Error("an uncached namespace counts as covered")
+		}
+	})
+
+	t.Run("denied and uncached together", func(t *testing.T) {
+		acc, read := env.srv.typedKindScope(r, cache, []string{"a", "b", "c"}, "", "pods")
+		cov := acc.coverage()
+		if cov.State != kindCoveragePartial || !slices.Equal(cov.DeniedNamespaces, []string{"c"}) || !slices.Equal(cov.UncachedNamespaces, []string{"b"}) || !slices.Equal(cov.AllowedNamespaces, []string{"a"}) {
+			t.Errorf("coverage = %+v, want partial, denied [c], uncached [b], allowed [a]", cov)
+		}
+		if !slices.Equal(read, []string{"a"}) {
+			t.Errorf("read = %v, want [a]", read)
+		}
+	})
+
+	t.Run("wholly uncached with a denial", func(t *testing.T) {
+		acc, _ := env.srv.typedKindScope(r, cache, []string{"b", "c"}, "", "pods")
+		cov := acc.coverage()
+		if cov.State != kindCoverageUncached || !slices.Equal(cov.DeniedNamespaces, []string{"c"}) || !slices.Equal(cov.UncachedNamespaces, []string{"b"}) {
+			t.Errorf("coverage = %+v, want uncached, denied [c], uncached [b]", cov)
+		}
+	})
+}
+
+// Uncached namespaces follow the same disclosure rule as denied ones: named
+// only when the caller supplied the candidates.
+func TestTypedKindScope_UncachedNamesFollowTheDisclosureRule(t *testing.T) {
+	env := newAuthTestServer(t)
+	perms := &auth.UserPermissions{}
+	allow(perms, "", "pods", "", true)
+	r := kindScopeRequest(env, "wide", perms)
+
+	limited := capacityTestInformerScope{namespaces: map[string][]string{"pods": {"a"}}}
+	acc, read := env.srv.typedKindScope(r, limited, nil, "", "pods")
+	cov := acc.coverage()
+	if cov.State != kindCoveragePartial || len(cov.UncachedNamespaces) != 0 || !slices.Equal(cov.AllowedNamespaces, []string{"a"}) {
+		t.Errorf("unfiltered: coverage = %+v, want partial with allowed [a] and no uncached names", cov)
+	}
+	if !slices.Equal(read, []string{"a"}) {
+		t.Errorf("unfiltered: read = %v, want [a]", read)
+	}
+
+	empty := capacityTestInformerScope{namespaces: map[string][]string{}}
+	acc, _ = env.srv.typedKindScope(r, empty, nil, "", "pods")
+	if cov := acc.coverage(); cov.State != kindCoverageUncached || len(cov.UncachedNamespaces) != 0 {
+		t.Errorf("unfiltered, nothing cached: coverage = %+v, want uncached without names", cov)
+	}
+
+	clusterWide := capacityTestInformerScope{clusterWide: map[string]bool{"pods": true}}
+	acc, read = env.srv.typedKindScope(r, clusterWide, nil, "", "pods")
+	if cov := acc.coverage(); cov.State != kindCoverageFull || read != nil {
+		t.Errorf("cluster-wide informer: coverage = %+v read = %v, want full over every namespace", cov, read)
+	}
+}
+
+func TestKindCoverageJSON(t *testing.T) {
+	b, err := json.Marshal(kindAccess{state: kindCoverageUncached, uncached: []string{"b"}}.coverage())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := string(b); got != `{"state":"uncached","uncachedNamespaces":["b"]}` {
+		t.Errorf("json = %s", got)
+	}
+	b, _ = json.Marshal(kindAccess{state: kindCoverageFull, all: true}.coverage())
+	if strings.Contains(string(b), "Namespaces") {
+		t.Errorf("full coverage carries namespace lists: %s", b)
+	}
+}

From fad04d45ab900dd4ef1eff2bb9bdbd2aeac6d603 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:26:50 +0300
Subject: [PATCH 08/26] Move the action contract out of the CloudNativePG
 actions

actions.go now holds what any integration's write actions share:
ActionCapability and ActionRequest, actionError with refuseAction,
changedAction, blockedAction and partialAction, the changed /
context_changed / blocked / partial codes, decodeActionRequest (bounded
body, required fields, the caller's dynamic client, reviewed-context
check), decodeActionParams, the generic half of the error writer, and
mergePatchAtVersion.

The permission machinery moves with it: a Grant (verb, group, resource,
subresource, namespace) in internal/auth so Prometheus-backed reads can
name one too, grantPermission/grantDecision (the per-user SAR cache with
resource/subresource keys under auth, the 30s SelfSubjectAccessReview
memo locally), and capabilityVerdict. Grant.String() words a namespaced
grant and a cluster-wide one exactly as the two CNPG methods did.

CloudNativePG keeps its result fields, its all_fenced /
operator_webhook_unavailable / invalid_schedule / outcome_unknown codes,
the webhook wording, facts, guards, runners and grant templates. The wire
is unchanged.
---
 internal/auth/grant.go                        |  43 ++
 internal/auth/grant_test.go                   |  46 ++
 internal/server/actions.go                    | 353 +++++++++++
 internal/server/cnpg_actions.go               | 580 ++++--------------
 internal/server/cnpg_actions_maintenance.go   |  12 +-
 .../server/cnpg_actions_maintenance_test.go   |   4 +-
 internal/server/cnpg_actions_test.go          |  56 +-
 internal/server/cnpg_cluster_ha.go            |  30 +-
 internal/server/cnpg_destroy.go               |  69 ++-
 internal/server/cnpg_errors_test.go           |   6 +-
 internal/server/cnpg_local_cani_test.go       |  12 +-
 internal/server/cnpg_operator_diagnosis.go    |  32 +-
 internal/server/cnpg_operator_status.go       |   2 +-
 internal/server/cnpg_operator_status_test.go  |   4 +-
 internal/server/cnpg_pooler_actions.go        |  37 +-
 internal/server/cnpg_recovery.go              |  50 +-
 internal/server/cnpg_recovery_test.go         |  10 +-
 internal/server/cnpg_report.go                |  16 +-
 internal/server/cnpg_runtime.go               |   4 +-
 internal/server/cnpg_runtime_test.go          |   6 +-
 internal/server/cnpg_schedule_test.go         |   8 +-
 internal/server/cnpg_sessions.go              |  30 +-
 internal/server/cnpg_sessions_test.go         |  34 +-
 internal/server/cnpg_storage.go               |   2 +-
 24 files changed, 777 insertions(+), 669 deletions(-)
 create mode 100644 internal/auth/grant.go
 create mode 100644 internal/auth/grant_test.go
 create mode 100644 internal/server/actions.go

diff --git a/internal/auth/grant.go b/internal/auth/grant.go
new file mode 100644
index 0000000000..99bdd146e9
--- /dev/null
+++ b/internal/auth/grant.go
@@ -0,0 +1,43 @@
+package auth
+
+// Grant is one Kubernetes RBAC permission a read or an action needs, as the
+// caller would have to be given it. An empty Namespace means cluster-wide.
+type Grant struct {
+	Verb        string `json:"verb"`
+	Group       string `json:"group,omitempty"`
+	Resource    string `json:"resource"`
+	Subresource string `json:"subresource,omitempty"`
+	Namespace   string `json:"namespace,omitempty"`
+}
+
+// In returns g bound to namespace ("" for cluster-wide).
+func (g Grant) In(namespace string) Grant {
+	g.Namespace = namespace
+	return g
+}
+
+// Ref returns a copy of g for an optional field.
+func (g Grant) Ref() *Grant {
+	return &g
+}
+
+// String words the grant for a person: "patch clusters/status
+// (postgresql.cnpg.io) in namespace pg", or for a cluster-wide grant "get
+// pods/proxy cluster-wide", where the group is written resource.group so the
+// text reads without nested parentheses when quoted inside "(needs …)".
+func (g Grant) String() string {
+	res := g.Resource
+	if g.Subresource != "" {
+		res += "/" + g.Subresource
+	}
+	if g.Namespace == "" {
+		if g.Group != "" {
+			res += "." + g.Group
+		}
+		return g.Verb + " " + res + " cluster-wide"
+	}
+	if g.Group != "" {
+		res += " (" + g.Group + ")"
+	}
+	return g.Verb + " " + res + " in namespace " + g.Namespace
+}
diff --git a/internal/auth/grant_test.go b/internal/auth/grant_test.go
new file mode 100644
index 0000000000..a704f4ce70
--- /dev/null
+++ b/internal/auth/grant_test.go
@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestGrantString(t *testing.T) {
+	for _, c := range []struct {
+		grant Grant
+		want  string
+	}{
+		{Grant{Verb: "patch", Group: "postgresql.cnpg.io", Resource: "clusters", Subresource: "status", Namespace: "pg"}, "patch clusters/status (postgresql.cnpg.io) in namespace pg"},
+		{Grant{Verb: "create", Group: "postgresql.cnpg.io", Resource: "backups", Namespace: "db"}, "create backups (postgresql.cnpg.io) in namespace db"},
+		{Grant{Verb: "get", Resource: "pods", Subresource: "proxy", Namespace: "pgrt"}, "get pods/proxy in namespace pgrt"},
+		{Grant{Verb: "get", Resource: "pods", Subresource: "proxy"}, "get pods/proxy cluster-wide"},
+		{Grant{Verb: "get", Resource: "nodes"}, "get nodes cluster-wide"},
+		{Grant{Verb: "get", Group: "admissionregistration.k8s.io", Resource: "mutatingwebhookconfigurations"}, "get mutatingwebhookconfigurations.admissionregistration.k8s.io cluster-wide"},
+	} {
+		if got := c.grant.String(); got != c.want {
+			t.Errorf("%+v.String() = %q, want %q", c.grant, got, c.want)
+		}
+	}
+}
+
+func TestGrantInBindsWithoutMutating(t *testing.T) {
+	template := Grant{Verb: "list", Resource: "pods"}
+	bound := template.In("pg")
+	if template.Namespace != "" || bound.Namespace != "pg" || bound.In("").Namespace != "" {
+		t.Errorf("template=%+v bound=%+v", template, bound)
+	}
+}
+
+func TestGrantJSON(t *testing.T) {
+	b, err := json.Marshal(Grant{Verb: "get", Resource: "pods", Subresource: "proxy", Namespace: "pg"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := string(b); got != `{"verb":"get","resource":"pods","subresource":"proxy","namespace":"pg"}` {
+		t.Errorf("namespaced = %s", got)
+	}
+	b, _ = json.Marshal(Grant{Verb: "patch", Group: "postgresql.cnpg.io", Resource: "clusters"})
+	if got := string(b); got != `{"verb":"patch","group":"postgresql.cnpg.io","resource":"clusters"}` {
+		t.Errorf("cluster-wide = %s", got)
+	}
+}
diff --git a/internal/server/actions.go b/internal/server/actions.go
new file mode 100644
index 0000000000..91187fae6c
--- /dev/null
+++ b/internal/server/actions.go
@@ -0,0 +1,353 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/dynamic"
+
+	"github.com/skyhook-io/radar/internal/auth"
+	"github.com/skyhook-io/radar/internal/k8s"
+	"github.com/skyhook-io/radar/pkg/k8score"
+)
+
+// The action contract shared by integrations that write to the cluster on the
+// caller's behalf. A capability says whether an action is offered and why
+// not; a POST binds the context and facts the caller reviewed and is refused
+// with a stable code when they no longer hold. Writes are made with the
+// caller's impersonated client and are never retried automatically.
+
+// Grant lives in auth because Prometheus-backed reads report the grant they
+// lacked too.
+type Grant = auth.Grant
+
+const (
+	actionBodyLimit = 64 << 10
+
+	actionCodeChanged        = "changed"
+	actionCodeContextChanged = "context_changed"
+	actionCodeBlocked        = "blocked"
+	actionCodePartial        = "partial"
+
+	permissionAllowed = "allowed"
+	permissionDenied  = "denied"
+	permissionUnknown = "unknown"
+)
+
+// ActionCapability is one action's verdict: allowed only when the state
+// guards pass and the caller's grant is not known to be missing. An unknown
+// grant (the SubjectAccessReview itself failed) leaves the apiserver to decide.
+type ActionCapability struct {
+	Allowed    bool   `json:"allowed"`
+	Reason     string `json:"reason,omitempty"`
+	Permission string `json:"permission"`
+	Grant      string `json:"grant,omitempty"`
+}
+
+// ActionRequest is the POST body of every action.
+type ActionRequest struct {
+	ReviewedContext string          `json:"reviewedContext"`
+	UID             string          `json:"uid"`
+	Facts           json.RawMessage `json:"facts,omitempty"`
+	Params          json.RawMessage `json:"params,omitempty"`
+}
+
+// actionError is a refusal with a stable code; Current carries the facts as
+// they are now when a confirmation no longer matches.
+type actionError struct {
+	Status  int
+	Code    string
+	Message string
+	Current any
+	// Completed lists the mutations that took effect before a multi-step
+	// action stopped (code partial).
+	Completed []string
+}
+
+func (e *actionError) Error() string { return e.Message }
+
+func refuseAction(status int, code, format string, args ...any) *actionError {
+	return &actionError{Status: status, Code: code, Message: fmt.Sprintf(format, args...)}
+}
+
+// changedAction refuses a confirmation whose reviewed facts no longer hold.
+func changedAction(current any, format string, args ...any) *actionError {
+	e := refuseAction(http.StatusConflict, actionCodeChanged, format, args...)
+	e.Current = current
+	return e
+}
+
+func blockedAction(reason string) error {
+	return refuseAction(http.StatusConflict, actionCodeBlocked, "%s", reason)
+}
+
+// partialAction reports a multi-step action that stopped after some of its
+// mutations took effect; retrying it blindly would act on a changed target.
+func partialAction(completed []string, cause error) *actionError {
+	status := http.StatusInternalServerError
+	var ae *actionError
+	switch {
+	case errors.As(cause, &ae):
+		status = ae.Status
+	case apierrors.IsForbidden(cause):
+		status = http.StatusForbidden
+	case apierrors.IsConflict(cause), apierrors.IsNotFound(cause):
+		status = http.StatusConflict
+	case errors.Is(cause, context.DeadlineExceeded) || apierrors.IsTimeout(cause) || apierrors.IsServerTimeout(cause):
+		status = http.StatusGatewayTimeout
+	}
+	e := &actionError{
+		Status: status, Code: actionCodePartial, Completed: append([]string(nil), completed...),
+		Message: fmt.Sprintf("Stopped part-way: %s. Already done: %s", cause.Error(), strings.Join(completed, ", ")),
+	}
+	if ae != nil {
+		e.Current = ae.Current
+	}
+	return e
+}
+
+// decodeActionRequest reads the body and checks the reviewed context. The
+// dynamic client is the caller's, snapshotted with the context it belongs to.
+// The error is already written when ok is false.
+func (s *Server) decodeActionRequest(w http.ResponseWriter, r *http.Request) (ActionRequest, dynamic.Interface, bool) {
+	var req ActionRequest
+	if err := decodeBoundedJSONBody(w, r, actionBodyLimit, &req); err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			s.writeError(w, http.StatusRequestEntityTooLarge, "request body is too large")
+			return req, nil, false
+		}
+		s.writeError(w, http.StatusBadRequest, "invalid request body: "+err.Error())
+		return req, nil, false
+	}
+	if req.ReviewedContext == "" || req.UID == "" {
+		s.writeError(w, http.StatusBadRequest, "reviewedContext and uid are required")
+		return req, nil, false
+	}
+	dyn, contextName := s.getDynamicClientSnapshotForRequest(r)
+	if dyn == nil {
+		s.writeError(w, http.StatusServiceUnavailable, "cluster client not available — check cluster connection")
+		return req, nil, false
+	}
+	if err := checkReviewedContext(req.ReviewedContext, contextName); err != nil {
+		s.writeActionError(w, "actions", err, "context", "", "", nil)
+		return req, nil, false
+	}
+	return req, dyn, true
+}
+
+func checkReviewedContext(reviewed, active string) error {
+	if reviewed != active {
+		return refuseAction(http.StatusConflict, actionCodeContextChanged,
+			"The active cluster context is %q, not the %q you reviewed; review the action again", active, reviewed)
+	}
+	return nil
+}
+
+// decodeActionParams decodes an action's params strictly: an unknown field is
+// a client that means something this server does not do.
+func decodeActionParams(raw json.RawMessage, into any) error {
+	trimmed := bytes.TrimSpace(raw)
+	if len(trimmed) == 0 || string(trimmed) == "null" {
+		trimmed = []byte("{}")
+	}
+	dec := json.NewDecoder(bytes.NewReader(trimmed))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(into); err != nil {
+		return refuseAction(http.StatusBadRequest, "", "invalid params: %v", err)
+	}
+	return nil
+}
+
+// writeActionError answers a failed action. A refusal keeps its status, code,
+// current facts and completed steps; an apiserver error maps to its status,
+// and a Forbidden one names the grant needs(action) returns, bound to
+// namespace. tag prefixes the log lines.
+func (s *Server) writeActionError(w http.ResponseWriter, tag string, err error, action, namespace, name string, needs func(action string) (Grant, bool)) {
+	var ae *actionError
+	if errors.As(err, &ae) {
+		log.Printf("[%s] %q %s/%s refused %d: %s", tag, action, sanitizeForLog(namespace), sanitizeForLog(name), ae.Status, ae.Message)
+		body := map[string]any{"error": ae.Message}
+		if ae.Code != "" {
+			body["code"] = ae.Code
+		}
+		if ae.Current != nil {
+			body["current"] = ae.Current
+		}
+		if len(ae.Completed) > 0 {
+			body["completed"] = ae.Completed
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(ae.Status)
+		if encErr := json.NewEncoder(w).Encode(body); encErr != nil {
+			log.Printf("Failed to encode error response: %v", encErr)
+		}
+		return
+	}
+	msg := err.Error()
+	status := http.StatusInternalServerError
+	switch {
+	case errors.Is(err, context.DeadlineExceeded) || apierrors.IsTimeout(err) || apierrors.IsServerTimeout(err):
+		status = http.StatusGatewayTimeout
+	case apierrors.IsNotFound(err):
+		status = http.StatusNotFound
+	case apierrors.IsForbidden(err):
+		status = http.StatusForbidden
+		if needs != nil {
+			if g, ok := needs(action); ok {
+				msg = "This needs " + g.In(namespace).String() + ": " + msg
+			}
+		}
+	case apierrors.IsAlreadyExists(err), apierrors.IsConflict(err):
+		status = http.StatusConflict
+	case apierrors.IsInvalid(err):
+		status = http.StatusUnprocessableEntity
+	}
+	log.Printf("[%s] Failed to %s %s/%s (%d): %v", tag, sanitizeForLog(action), sanitizeForLog(namespace), sanitizeForLog(name), status, err)
+	s.writeError(w, status, msg)
+}
+
+// mergePatchAtVersion merge-patches obj bound to the resourceVersion it was
+// read at, so a write the caller did not review is refused with a Conflict
+// rather than applied over. Callers turn the Conflict into "changed"; it is
+// never retried.
+func mergePatchAtVersion(ctx context.Context, dyn dynamic.Interface, gvr schema.GroupVersionResource, obj *unstructured.Unstructured, body map[string]any, subresources ...string) error {
+	meta, _ := body["metadata"].(map[string]any)
+	if meta == nil {
+		meta = map[string]any{}
+		body["metadata"] = meta
+	}
+	meta["resourceVersion"] = obj.GetResourceVersion()
+	data, err := json.Marshal(body)
+	if err != nil {
+		return err
+	}
+	_, err = dyn.Resource(gvr).Namespace(obj.GetNamespace()).Patch(ctx, obj.GetName(), types.MergePatchType, data, metav1.PatchOptions{}, subresources...)
+	return err
+}
+
+// grantPermission answers one grant for the caller: allowed, denied, or
+// unknown when the SubjectAccessReview itself failed.
+func (s *Server) grantPermission(r *http.Request, g Grant) string {
+	allowed, authoritative := s.grantDecision(r, g)
+	switch {
+	case !authoritative:
+		return permissionUnknown
+	case allowed:
+		return permissionAllowed
+	default:
+		return permissionDenied
+	}
+}
+
+// grantDecision asks for g as the caller. Subresource answers are memoized on
+// the same per-user cache as canRead, keyed resource/subresource.
+func (s *Server) grantDecision(r *http.Request, g Grant) (bool, bool) {
+	if auth.UserFromContext(r.Context()) == nil {
+		return localCanI(r.Context(), g)
+	}
+	if g.Subresource == "" {
+		return s.canReadDecision(r, g.Group, g.Resource, g.Namespace, g.Verb)
+	}
+	key := g.Resource + "/" + g.Subresource
+	var perms *auth.UserPermissions
+	if user := auth.UserFromContext(r.Context()); user != nil && s.permCache != nil {
+		perms = s.permCache.Get(user.Username, user.Groups)
+	}
+	if perms != nil {
+		if v, ok := perms.CanI(g.Verb, g.Group, key, g.Namespace); ok {
+			return v, true
+		}
+	}
+	allowed, authoritative := s.canReadSubresourceDecision(r, g.Group, g.Resource, g.Subresource, g.Namespace, g.Verb)
+	if authoritative && perms != nil {
+		perms.SetCanI(g.Verb, g.Group, key, g.Namespace, allowed)
+	}
+	return allowed, authoritative
+}
+
+// Without auth the apiserver still enforces the kubeconfig identity's RBAC on
+// every write and proxy read; asking it first lets capabilities name a missing
+// grant instead of offering an action that will fail.
+var (
+	localCanIMu   sync.Mutex
+	localCanIMemo = map[string]localCanIEntry{}
+	localCanITTL  = 30 * time.Second
+)
+
+type localCanIEntry struct {
+	allowed bool
+	expires time.Time
+}
+
+func localCanI(ctx context.Context, g Grant) (bool, bool) {
+	resource := g.Resource
+	if g.Subresource != "" {
+		resource += "/" + g.Subresource
+	}
+	key := strings.Join([]string{k8s.GetContextName(), g.Verb, g.Group, resource, g.Namespace}, "\x00")
+	now := time.Now()
+	localCanIMu.Lock()
+	if e, ok := localCanIMemo[key]; ok && now.Before(e.expires) {
+		localCanIMu.Unlock()
+		return e.allowed, true
+	}
+	localCanIMu.Unlock()
+	client := k8s.GetClient()
+	if client == nil {
+		return true, true
+	}
+	allowed, apiErr := k8score.CanI(ctx, client, g.Namespace, g.Group, resource, g.Verb)
+	if apiErr {
+		return false, false
+	}
+	localCanIMu.Lock()
+	localCanIMemo[key] = localCanIEntry{allowed: allowed, expires: now.Add(localCanITTL)}
+	localCanIMu.Unlock()
+	return allowed, true
+}
+
+// capabilityVerdict folds a guard reason and the permission of each grant
+// (perms[i] answers grants[i]) into a verdict. The first denied grant is
+// named; an unknown grant leaves the action offered.
+func capabilityVerdict(guard string, perms []string, grants []Grant) ActionCapability {
+	out := ActionCapability{Permission: permissionAllowed}
+	for i, p := range perms {
+		if p == permissionDenied {
+			out.Permission = permissionDenied
+			out.Grant = grants[i].String()
+			break
+		}
+		if p == permissionUnknown {
+			out.Permission = permissionUnknown
+			if out.Grant == "" {
+				out.Grant = grants[i].String()
+			}
+		}
+	}
+	if out.Permission == permissionAllowed {
+		out.Grant = ""
+	}
+	switch {
+	case out.Permission == permissionDenied:
+		out.Reason = "You are not allowed to " + out.Grant
+	case guard != "":
+		out.Reason = guard
+	default:
+		out.Allowed = true
+	}
+	return out
+}
diff --git a/internal/server/cnpg_actions.go b/internal/server/cnpg_actions.go
index be84d5ebed..7b7da5ce12 100644
--- a/internal/server/cnpg_actions.go
+++ b/internal/server/cnpg_actions.go
@@ -12,7 +12,6 @@ import (
 	"regexp"
 	"sort"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -28,8 +27,6 @@ import (
 	"k8s.io/client-go/kubernetes"
 
 	"github.com/skyhook-io/radar/internal/auth"
-	"github.com/skyhook-io/radar/internal/k8s"
-	"github.com/skyhook-io/radar/pkg/k8score"
 )
 
 // CloudNativePG write actions. Every write mirrors what `kubectl cnpg` does
@@ -65,34 +62,16 @@ const (
 	cnpgPhaseInplaceRestart = "Primary instance is being restarted in-place"
 	cnpgInplaceReason       = "Requested by the user"
 
-	cnpgActionBodyLimit = 64 << 10
 	// The compact UTC stamp CloudNativePG itself uses for scheduled runs.
 	cnpgCompactStamp = "20060102150405"
 
-	cnpgCodeChanged         = "changed"
-	cnpgCodeContextChanged  = "context_changed"
-	cnpgCodeBlocked         = "blocked"
+	// Refusal codes beyond the shared action contract's.
 	cnpgCodeAllFenced       = "all_fenced"
 	cnpgCodeWebhook         = "operator_webhook_unavailable"
 	cnpgCodeAmbiguous       = "outcome_unknown"
-	cnpgCodePartial         = "partial"
 	cnpgCodeInvalidSchedule = "invalid_schedule"
-
-	cnpgPermAllowed = "allowed"
-	cnpgPermDenied  = "denied"
-	cnpgPermUnknown = "unknown"
 )
 
-// CNPGActionCapability is one action's verdict: allowed only when the state
-// guards pass and the caller's grant is not known to be missing. An unknown
-// grant (the SubjectAccessReview itself failed) leaves the apiserver to decide.
-type CNPGActionCapability struct {
-	Allowed    bool   `json:"allowed"`
-	Reason     string `json:"reason,omitempty"`
-	Permission string `json:"permission"`
-	Grant      string `json:"grant,omitempty"`
-}
-
 // CNPGFencedFacts is the parsed cnpg.io/fencedInstances annotation. Raw is the
 // annotation exactly as stored ("" when unset) and is what a confirmation binds.
 type CNPGFencedFacts struct {
@@ -149,22 +128,22 @@ type CNPGClusterFacts struct {
 }
 
 type CNPGClusterActions struct {
-	Backup          CNPGActionCapability `json:"backup"`
-	Switchover      CNPGActionCapability `json:"switchover"`
-	Restart         CNPGActionCapability `json:"restart"`
-	RestartInstance CNPGActionCapability `json:"restartInstance"`
-	Reload          CNPGActionCapability `json:"reload"`
-	Fence           CNPGActionCapability `json:"fence"`
-	Unfence         CNPGActionCapability `json:"unfence"`
-	Hibernate       CNPGActionCapability `json:"hibernate"`
-	Rehydrate       CNPGActionCapability `json:"rehydrate"`
+	Backup          ActionCapability `json:"backup"`
+	Switchover      ActionCapability `json:"switchover"`
+	Restart         ActionCapability `json:"restart"`
+	RestartInstance ActionCapability `json:"restartInstance"`
+	Reload          ActionCapability `json:"reload"`
+	Fence           ActionCapability `json:"fence"`
+	Unfence         ActionCapability `json:"unfence"`
+	Hibernate       ActionCapability `json:"hibernate"`
+	Rehydrate       ActionCapability `json:"rehydrate"`
 	// Psql is opening psql on the primary; DestroyInstance is the first
 	// instance that may be destroyed (per-instance verdicts are authoritative).
-	Psql            CNPGActionCapability `json:"psql"`
-	DestroyInstance CNPGActionCapability `json:"destroyInstance"`
+	Psql            ActionCapability `json:"psql"`
+	DestroyInstance ActionCapability `json:"destroyInstance"`
 	// Restore is creating a new Cluster in this namespace that bootstraps
 	// from this one's backups; the source is only read.
-	Restore CNPGActionCapability `json:"restore"`
+	Restore ActionCapability `json:"restore"`
 	CNPGMaintenanceActions
 }
 
@@ -172,12 +151,12 @@ type CNPGClusterActions struct {
 // instance: a primary restarts in place (status write) where a standby's Pod
 // is deleted, so the two carry different guards and grants.
 type CNPGInstanceActions struct {
-	Restart          CNPGActionCapability `json:"restart"`
-	SwitchoverTarget CNPGActionCapability `json:"switchoverTarget"`
-	Fence            CNPGActionCapability `json:"fence"`
-	Unfence          CNPGActionCapability `json:"unfence"`
-	Psql             CNPGActionCapability `json:"psql"`
-	Destroy          CNPGActionCapability `json:"destroy"`
+	Restart          ActionCapability `json:"restart"`
+	SwitchoverTarget ActionCapability `json:"switchoverTarget"`
+	Fence            ActionCapability `json:"fence"`
+	Unfence          ActionCapability `json:"unfence"`
+	Psql             ActionCapability `json:"psql"`
+	Destroy          ActionCapability `json:"destroy"`
 }
 
 // CNPGRestartStep is one instance's fate in a cluster restart, in the order
@@ -265,10 +244,10 @@ type CNPGScheduleFacts struct {
 }
 
 type CNPGScheduleActions struct {
-	Suspend     CNPGActionCapability `json:"suspend"`
-	Resume      CNPGActionCapability `json:"resume"`
-	Run         CNPGActionCapability `json:"run"`
-	SetSchedule CNPGActionCapability `json:"setSchedule"`
+	Suspend     ActionCapability `json:"suspend"`
+	Resume      ActionCapability `json:"resume"`
+	Run         ActionCapability `json:"run"`
+	SetSchedule ActionCapability `json:"setSchedule"`
 }
 
 // CNPGScheduleCapabilitiesResponse is GET /api/cnpg/scheduledbackups/{ns}/{name}/capabilities.
@@ -281,14 +260,6 @@ type CNPGScheduleCapabilitiesResponse struct {
 	Operator        CNPGOperatorVerdict `json:"operator"`
 }
 
-// CNPGActionRequest is the POST body of every CNPG action.
-type CNPGActionRequest struct {
-	ReviewedContext string          `json:"reviewedContext"`
-	UID             string          `json:"uid"`
-	Facts           json.RawMessage `json:"facts,omitempty"`
-	Params          json.RawMessage `json:"params,omitempty"`
-}
-
 // cnpgReviewedFacts is the subset of facts a confirmation can bind. Decoded
 // leniently: a client may echo the whole facts object it was served.
 type cnpgReviewedFacts struct {
@@ -322,49 +293,6 @@ type CNPGActionResult struct {
 	Target *CNPGActionTarget `json:"target,omitempty"`
 }
 
-// cnpgActionError is a refusal with a stable code; Current carries the facts
-// as they are now when a confirmation no longer matches.
-type cnpgActionError struct {
-	Status  int
-	Code    string
-	Message string
-	Current any
-	// Completed lists the mutations that took effect before a multi-step
-	// action stopped (code partial).
-	Completed []string
-}
-
-func (e *cnpgActionError) Error() string { return e.Message }
-
-func cnpgRefuse(status int, code, format string, args ...any) *cnpgActionError {
-	return &cnpgActionError{Status: status, Code: code, Message: fmt.Sprintf(format, args...)}
-}
-
-// cnpgPartial reports a multi-step action that stopped after some of its
-// mutations took effect; retrying it blindly would act on a changed target.
-func cnpgPartial(completed []string, cause error) *cnpgActionError {
-	status := http.StatusInternalServerError
-	var ae *cnpgActionError
-	switch {
-	case errors.As(cause, &ae):
-		status = ae.Status
-	case apierrors.IsForbidden(cause):
-		status = http.StatusForbidden
-	case apierrors.IsConflict(cause), apierrors.IsNotFound(cause):
-		status = http.StatusConflict
-	case errors.Is(cause, context.DeadlineExceeded) || apierrors.IsTimeout(cause) || apierrors.IsServerTimeout(cause):
-		status = http.StatusGatewayTimeout
-	}
-	e := &cnpgActionError{
-		Status: status, Code: cnpgCodePartial, Completed: append([]string(nil), completed...),
-		Message: fmt.Sprintf("Stopped part-way: %s. Already done: %s", cause.Error(), strings.Join(completed, ", ")),
-	}
-	if ae != nil {
-		e.Current = ae.Current
-	}
-	return e
-}
-
 type cnpgActionClients struct {
 	dyn   dynamic.Interface
 	typed kubernetes.Interface
@@ -770,158 +698,19 @@ func cnpgGuardRehydrate(f CNPGClusterFacts) string {
 
 // ---------- permissions ----------
 
-type cnpgGrant struct {
-	verb, group, resource, subresource string
-}
-
-// ClusterString words a grant on a cluster-scoped resource (or a cluster-wide
-// list), naming the group in resource.group form so it reads without nested
-// parentheses where it is quoted inside "(needs …)".
-func (g cnpgGrant) ClusterString() string {
-	res := g.resource
-	if g.subresource != "" {
-		res += "/" + g.subresource
-	}
-	if g.group != "" {
-		res += "." + g.group
-	}
-	return g.verb + " " + res + " cluster-wide"
-}
-
-func (g cnpgGrant) String(namespace string) string {
-	res := g.resource
-	if g.subresource != "" {
-		res += "/" + g.subresource
-	}
-	if g.group != "" {
-		res += " (" + g.group + ")"
-	}
-	return fmt.Sprintf("%s %s in namespace %s", g.verb, res, namespace)
-}
-
 var (
-	cnpgGrantCreateBackups    = cnpgGrant{"create", cnpgGroup, "backups", ""}
-	cnpgGrantCreateClusters   = cnpgGrant{"create", cnpgGroup, "clusters", ""}
-	cnpgGrantPatchStatus      = cnpgGrant{"patch", cnpgGroup, "clusters", "status"}
-	cnpgGrantPatchClusters    = cnpgGrant{"patch", cnpgGroup, "clusters", ""}
-	cnpgGrantDeletePods       = cnpgGrant{"delete", "", "pods", ""}
-	cnpgGrantGetPods          = cnpgGrant{"get", "", "pods", ""}
-	cnpgGrantPatchSchedules   = cnpgGrant{"patch", cnpgGroup, "scheduledbackups", ""}
-	cnpgClusterActionGrants   = map[string]cnpgGrant{"backup": cnpgGrantCreateBackups, "switchover": cnpgGrantPatchStatus, "restart": cnpgGrantPatchClusters, "reload": cnpgGrantPatchClusters, "fence": cnpgGrantPatchClusters, "unfence": cnpgGrantPatchClusters, "hibernate": cnpgGrantPatchClusters, "rehydrate": cnpgGrantPatchClusters}
-	cnpgScheduleActionGrants  = map[string]cnpgGrant{"suspend": cnpgGrantPatchSchedules, "resume": cnpgGrantPatchSchedules, "run": cnpgGrantCreateBackups, "setSchedule": cnpgGrantPatchSchedules}
+	cnpgGrantCreateBackups    = Grant{Verb: "create", Group: cnpgGroup, Resource: "backups"}
+	cnpgGrantCreateClusters   = Grant{Verb: "create", Group: cnpgGroup, Resource: "clusters"}
+	cnpgGrantPatchStatus      = Grant{Verb: "patch", Group: cnpgGroup, Resource: "clusters", Subresource: "status"}
+	cnpgGrantPatchClusters    = Grant{Verb: "patch", Group: cnpgGroup, Resource: "clusters"}
+	cnpgGrantDeletePods       = Grant{Verb: "delete", Resource: "pods"}
+	cnpgGrantGetPods          = Grant{Verb: "get", Resource: "pods"}
+	cnpgGrantPatchSchedules   = Grant{Verb: "patch", Group: cnpgGroup, Resource: "scheduledbackups"}
+	cnpgClusterActionGrants   = map[string]Grant{"backup": cnpgGrantCreateBackups, "switchover": cnpgGrantPatchStatus, "restart": cnpgGrantPatchClusters, "reload": cnpgGrantPatchClusters, "fence": cnpgGrantPatchClusters, "unfence": cnpgGrantPatchClusters, "hibernate": cnpgGrantPatchClusters, "rehydrate": cnpgGrantPatchClusters}
+	cnpgScheduleActionGrants  = map[string]Grant{"suspend": cnpgGrantPatchSchedules, "resume": cnpgGrantPatchSchedules, "run": cnpgGrantCreateBackups, "setSchedule": cnpgGrantPatchSchedules}
 	cnpgClusterActionsOrdered = []string{"backup", "switchover", "restart", "restartInstance", "reload", "fence", "unfence", "hibernate", "rehydrate", "cancelBackend", "terminateBackend", "destroyInstance"}
 )
 
-// cnpgPermission answers one grant for the caller. Subresource answers are
-// memoized on the same per-user cache as canRead, keyed resource/subresource.
-func (s *Server) cnpgPermission(r *http.Request, g cnpgGrant, namespace string) string {
-	allowed, authoritative := s.cnpgGrantDecision(r, g, namespace)
-	switch {
-	case !authoritative:
-		return cnpgPermUnknown
-	case allowed:
-		return cnpgPermAllowed
-	default:
-		return cnpgPermDenied
-	}
-}
-
-func (s *Server) cnpgGrantDecision(r *http.Request, g cnpgGrant, namespace string) (bool, bool) {
-	if auth.UserFromContext(r.Context()) == nil {
-		return cnpgLocalCanI(r.Context(), g, namespace)
-	}
-	if g.subresource == "" {
-		return s.canReadDecision(r, g.group, g.resource, namespace, g.verb)
-	}
-	key := g.resource + "/" + g.subresource
-	var perms *auth.UserPermissions
-	if user := auth.UserFromContext(r.Context()); user != nil && s.permCache != nil {
-		perms = s.permCache.Get(user.Username, user.Groups)
-	}
-	if perms != nil {
-		if v, ok := perms.CanI(g.verb, g.group, key, namespace); ok {
-			return v, true
-		}
-	}
-	allowed, authoritative := s.canReadSubresourceDecision(r, g.group, g.resource, g.subresource, namespace, g.verb)
-	if authoritative && perms != nil {
-		perms.SetCanI(g.verb, g.group, key, namespace, allowed)
-	}
-	return allowed, authoritative
-}
-
-// Without auth the apiserver still enforces the kubeconfig identity's RBAC on
-// every write and proxy read; asking it first lets capabilities name a missing
-// grant instead of offering an action that will fail.
-var (
-	cnpgLocalCanIMu   sync.Mutex
-	cnpgLocalCanIMemo = map[string]cnpgLocalCanIEntry{}
-	cnpgLocalCanITTL  = 30 * time.Second
-)
-
-type cnpgLocalCanIEntry struct {
-	allowed bool
-	expires time.Time
-}
-
-func cnpgLocalCanI(ctx context.Context, g cnpgGrant, namespace string) (bool, bool) {
-	resource := g.resource
-	if g.subresource != "" {
-		resource += "/" + g.subresource
-	}
-	key := strings.Join([]string{k8s.GetContextName(), g.verb, g.group, resource, namespace}, "\x00")
-	now := time.Now()
-	cnpgLocalCanIMu.Lock()
-	if e, ok := cnpgLocalCanIMemo[key]; ok && now.Before(e.expires) {
-		cnpgLocalCanIMu.Unlock()
-		return e.allowed, true
-	}
-	cnpgLocalCanIMu.Unlock()
-	client := k8s.GetClient()
-	if client == nil {
-		return true, true
-	}
-	allowed, apiErr := k8score.CanI(ctx, client, namespace, g.group, resource, g.verb)
-	if apiErr {
-		return false, false
-	}
-	cnpgLocalCanIMu.Lock()
-	cnpgLocalCanIMemo[key] = cnpgLocalCanIEntry{allowed: allowed, expires: now.Add(cnpgLocalCanITTL)}
-	cnpgLocalCanIMu.Unlock()
-	return allowed, true
-}
-
-// cnpgCapability folds a guard reason and one or more grants into a verdict.
-// The first denied grant is named; an unknown grant leaves the action offered.
-func cnpgCapability(guard string, namespace string, perms []string, grants []cnpgGrant) CNPGActionCapability {
-	out := CNPGActionCapability{Permission: cnpgPermAllowed}
-	for i, p := range perms {
-		if p == cnpgPermDenied {
-			out.Permission = cnpgPermDenied
-			out.Grant = grants[i].String(namespace)
-			break
-		}
-		if p == cnpgPermUnknown {
-			out.Permission = cnpgPermUnknown
-			if out.Grant == "" {
-				out.Grant = grants[i].String(namespace)
-			}
-		}
-	}
-	if out.Permission == cnpgPermAllowed {
-		out.Grant = ""
-	}
-	switch {
-	case out.Permission == cnpgPermDenied:
-		out.Reason = "You are not allowed to " + out.Grant
-	case guard != "":
-		out.Reason = guard
-	default:
-		out.Allowed = true
-	}
-	return out
-}
-
 // ---------- capabilities ----------
 
 func (s *Server) handleCNPGClusterCapabilities(w http.ResponseWriter, r *http.Request) {
@@ -952,21 +741,23 @@ func (s *Server) cnpgClusterCapabilities(r *http.Request, c cnpgActionClients, c
 	}
 	facts, _ := cnpgClusterFactsOf(ctx, c.typed, cluster)
 
-	perm := map[cnpgGrant]string{}
-	permOf := func(g cnpgGrant) string {
+	perm := map[Grant]string{}
+	permOf := func(g Grant) string {
 		if v, ok := perm[g]; ok {
 			return v
 		}
-		v := s.cnpgPermission(r, g, namespace)
+		v := s.grantPermission(r, g.In(namespace))
 		perm[g] = v
 		return v
 	}
-	one := func(guard string, gs ...cnpgGrant) CNPGActionCapability {
+	one := func(guard string, gs ...Grant) ActionCapability {
 		ps := make([]string, len(gs))
+		bound := make([]Grant, len(gs))
 		for i, g := range gs {
 			ps[i] = permOf(g)
+			bound[i] = g.In(namespace)
 		}
-		return cnpgCapability(guard, namespace, ps, gs)
+		return capabilityVerdict(guard, ps, bound)
 	}
 
 	instanceActions := map[string]CNPGInstanceActions{}
@@ -1059,7 +850,7 @@ func (s *Server) cnpgClusterCapabilities(r *http.Request, c cnpgActionClients, c
 // webhook rejects writes. Status patches and Pod deletes bypass it.
 func cnpgApplyOperatorGuard(resp *CNPGClusterCapabilitiesResponse) {
 	v, a := resp.Operator, &resp.Actions
-	for _, c := range []*CNPGActionCapability{&a.Backup, &a.Restart, &a.Reload, &a.Fence, &a.Unfence, &a.Hibernate, &a.Rehydrate, &a.SetMaintenance, &a.UnsetMaintenance} {
+	for _, c := range []*ActionCapability{&a.Backup, &a.Restart, &a.Reload, &a.Fence, &a.Unfence, &a.Hibernate, &a.Rehydrate, &a.SetMaintenance, &a.UnsetMaintenance} {
 		*c = cnpgOperatorWebhookGuard(v, *c)
 	}
 	for pod, ia := range resp.InstanceActions {
@@ -1278,8 +1069,9 @@ func (s *Server) cnpgScheduleCapabilities(r *http.Request, c cnpgActionClients,
 		return nil, err
 	}
 	f := cnpgScheduleFactsOf(r.Context(), c, sched)
-	one := func(guard string, g cnpgGrant) CNPGActionCapability {
-		return cnpgCapability(guard, namespace, []string{s.cnpgPermission(r, g, namespace)}, []cnpgGrant{g})
+	one := func(guard string, g Grant) ActionCapability {
+		g = g.In(namespace)
+		return capabilityVerdict(guard, []string{s.grantPermission(r, g)}, []Grant{g})
 	}
 	suspendGuard, resumeGuard := "", ""
 	if f.Terminating {
@@ -1307,43 +1099,6 @@ func (s *Server) cnpgScheduleCapabilities(r *http.Request, c cnpgActionClients,
 
 // ---------- POST ----------
 
-// decodeCNPGActionRequest reads the body and checks the reviewed context.
-// The error is already written when ok is false.
-func (s *Server) decodeCNPGActionRequest(w http.ResponseWriter, r *http.Request) (CNPGActionRequest, dynamic.Interface, bool) {
-	var req CNPGActionRequest
-	if err := decodeBoundedJSONBody(w, r, cnpgActionBodyLimit, &req); err != nil {
-		var tooLarge *http.MaxBytesError
-		if errors.As(err, &tooLarge) {
-			s.writeError(w, http.StatusRequestEntityTooLarge, "request body is too large")
-			return req, nil, false
-		}
-		s.writeError(w, http.StatusBadRequest, "invalid request body: "+err.Error())
-		return req, nil, false
-	}
-	if req.ReviewedContext == "" || req.UID == "" {
-		s.writeError(w, http.StatusBadRequest, "reviewedContext and uid are required")
-		return req, nil, false
-	}
-	dyn, contextName := s.getDynamicClientSnapshotForRequest(r)
-	if dyn == nil {
-		s.writeError(w, http.StatusServiceUnavailable, "cluster client not available — check cluster connection")
-		return req, nil, false
-	}
-	if err := cnpgCheckReviewedContext(req.ReviewedContext, contextName); err != nil {
-		s.writeCNPGActionError(w, err, "context", "", "")
-		return req, nil, false
-	}
-	return req, dyn, true
-}
-
-func cnpgCheckReviewedContext(reviewed, active string) error {
-	if reviewed != active {
-		return cnpgRefuse(http.StatusConflict, cnpgCodeContextChanged,
-			"The active cluster context is %q, not the %q you reviewed; review the action again", active, reviewed)
-	}
-	return nil
-}
-
 func (s *Server) handleCNPGClusterAction(w http.ResponseWriter, r *http.Request) {
 	if !s.requireConnected(w) {
 		return
@@ -1355,7 +1110,7 @@ func (s *Server) handleCNPGClusterAction(w http.ResponseWriter, r *http.Request)
 		s.writeError(w, http.StatusBadRequest, fmt.Sprintf("unknown CloudNativePG cluster action %q: must be one of %s", action, strings.Join(cnpgClusterActionsOrdered, ", ")))
 		return
 	}
-	req, dyn, ok := s.decodeCNPGActionRequest(w, r)
+	req, dyn, ok := s.decodeActionRequest(w, r)
 	if !ok {
 		return
 	}
@@ -1385,7 +1140,7 @@ func (s *Server) handleCNPGScheduleAction(w http.ResponseWriter, r *http.Request
 		s.writeError(w, http.StatusBadRequest, fmt.Sprintf("unknown ScheduledBackup action %q: must be suspend, resume, run or setSchedule", action))
 		return
 	}
-	req, dyn, ok := s.decodeCNPGActionRequest(w, r)
+	req, dyn, ok := s.decodeActionRequest(w, r)
 	if !ok {
 		return
 	}
@@ -1480,20 +1235,14 @@ func cnpgFactsDiffer(binds []string, reviewed cnpgReviewedFacts, now CNPGCluster
 	return changed, ""
 }
 
-func cnpgChanged(current any, format string, args ...any) *cnpgActionError {
-	e := cnpgRefuse(http.StatusConflict, cnpgCodeChanged, format, args...)
-	e.Current = current
-	return e
-}
-
-func runCNPGClusterAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req CNPGActionRequest) (*CNPGActionResult, error) {
+func runCNPGClusterAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req ActionRequest) (*CNPGActionResult, error) {
 	runner, ok := cnpgClusterActionRunners[action]
 	if !ok {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "unknown action %q", action)
+		return nil, refuseAction(http.StatusBadRequest, "", "unknown action %q", action)
 	}
 	reviewed, err := decodeCNPGReviewedFacts(req.Facts)
 	if err != nil {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "%v", err)
+		return nil, refuseAction(http.StatusBadRequest, "", "%v", err)
 	}
 	cluster, err := c.dyn.Resource(cnpgClusterGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
@@ -1505,14 +1254,14 @@ func runCNPGClusterAction(ctx context.Context, c cnpgActionClients, namespace, n
 	}
 	facts, pods := cnpgClusterFactsOf(ctx, typed, cluster)
 	if string(cluster.GetUID()) != req.UID {
-		return nil, cnpgChanged(facts, "Cluster %s/%s was deleted and recreated since you reviewed it", namespace, name)
+		return nil, changedAction(facts, "Cluster %s/%s was deleted and recreated since you reviewed it", namespace, name)
 	}
 	changed, missing := cnpgFactsDiffer(runner.binds, reviewed, facts)
 	if missing != "" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "facts.%s is required for %s: the confirmation must bind what the dialog showed", missing, action)
+		return nil, refuseAction(http.StatusBadRequest, "", "facts.%s is required for %s: the confirmation must bind what the dialog showed", missing, action)
 	}
 	if len(changed) > 0 {
-		return nil, cnpgChanged(facts, "Cluster %s/%s changed since you confirmed (%s); review the action again", namespace, name, strings.Join(changed, ", "))
+		return nil, changedAction(facts, "Cluster %s/%s changed since you confirmed (%s); review the action again", namespace, name, strings.Join(changed, ", "))
 	}
 	x := &cnpgClusterRun{c: c, cluster: cluster, facts: facts, reviewed: reviewed, pods: pods, params: req.Params}
 	res, err := runner.run(ctx, x)
@@ -1524,7 +1273,7 @@ func runCNPGClusterAction(ctx context.Context, c cnpgActionClients, namespace, n
 			if fresh, gerr := c.dyn.Resource(cnpgClusterGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}); gerr == nil {
 				current, _ = cnpgClusterFactsOf(ctx, typed, fresh)
 			}
-			return nil, cnpgChanged(current, "Cluster %s/%s changed while the request was being sent; review the action again", namespace, name)
+			return nil, changedAction(current, "Cluster %s/%s changed while the request was being sent; review the action again", namespace, name)
 		}
 		return nil, err
 	}
@@ -1532,38 +1281,6 @@ func runCNPGClusterAction(ctx context.Context, c cnpgActionClients, namespace, n
 	return res, nil
 }
 
-func decodeCNPGParams(raw json.RawMessage, into any) error {
-	trimmed := bytes.TrimSpace(raw)
-	if len(trimmed) == 0 || string(trimmed) == "null" {
-		trimmed = []byte("{}")
-	}
-	dec := json.NewDecoder(bytes.NewReader(trimmed))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(into); err != nil {
-		return cnpgRefuse(http.StatusBadRequest, "", "invalid params: %v", err)
-	}
-	return nil
-}
-
-func cnpgBlocked(reason string) error {
-	return cnpgRefuse(http.StatusConflict, cnpgCodeBlocked, "%s", reason)
-}
-
-func cnpgMergePatch(ctx context.Context, dyn dynamic.Interface, gvr schema.GroupVersionResource, obj *unstructured.Unstructured, body map[string]any, subresources ...string) error {
-	meta, _ := body["metadata"].(map[string]any)
-	if meta == nil {
-		meta = map[string]any{}
-		body["metadata"] = meta
-	}
-	meta["resourceVersion"] = obj.GetResourceVersion()
-	data, err := json.Marshal(body)
-	if err != nil {
-		return err
-	}
-	_, err = dyn.Resource(gvr).Namespace(obj.GetNamespace()).Patch(ctx, obj.GetName(), types.MergePatchType, data, metav1.PatchOptions{}, subresources...)
-	return err
-}
-
 // cnpgConditionsWithReady returns status.conditions with the Ready condition
 // set from phase, exactly as the operator's SetClusterReadyCondition does. The
 // merge patch replaces the whole list, as upstream's MergeFrom does.
@@ -1604,11 +1321,11 @@ func cnpgStatusPatch(ctx context.Context, x *cnpgClusterRun, status map[string]a
 		return err
 	}
 	status["conditions"] = conds
-	return cnpgMergePatch(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{"status": status}, "status")
+	return mergePatchAtVersion(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{"status": status}, "status")
 }
 
 func cnpgAnnotationPatch(ctx context.Context, x *cnpgClusterRun, key string, value any) error {
-	return cnpgMergePatch(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{
+	return mergePatchAtVersion(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{
 		"metadata": map[string]any{"annotations": map[string]any{key: value}},
 	})
 }
@@ -1626,11 +1343,11 @@ type cnpgBackupParams struct {
 
 func cnpgRunBackup(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgBackupParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	if r := cnpgGuardBackup(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	var chosen *CNPGBackupMethodFact
 	for i, m := range x.facts.BackupMethods {
@@ -1640,16 +1357,16 @@ func cnpgRunBackup(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, e
 		}
 	}
 	if chosen == nil {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "method %q%s is not a backup method this cluster declares", p.Method, cnpgPluginSuffix(p.PluginName))
+		return nil, refuseAction(http.StatusBadRequest, "", "method %q%s is not a backup method this cluster declares", p.Method, cnpgPluginSuffix(p.PluginName))
 	}
 	if chosen.Capability == "none" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "plugin %s reports no backup capability", chosen.PluginName)
+		return nil, refuseAction(http.StatusBadRequest, "", "plugin %s reports no backup capability", chosen.PluginName)
 	}
 	if len(p.PluginParameters) > 0 && chosen.Method != "plugin" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "pluginParameters apply only to the plugin method")
+		return nil, refuseAction(http.StatusBadRequest, "", "pluginParameters apply only to the plugin method")
 	}
 	if p.Target != "" && p.Target != "primary" && p.Target != "prefer-standby" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "target must be primary or prefer-standby (or omitted to inherit the cluster's)")
+		return nil, refuseAction(http.StatusBadRequest, "", "target must be primary or prefer-standby (or omitted to inherit the cluster's)")
 	}
 	// A Backup without its own target inherits the cluster's, so the one the
 	// confirmation showed is bound. The facts omit it when unset.
@@ -1659,7 +1376,7 @@ func cnpgRunBackup(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, e
 			reviewedTarget = *x.reviewed.BackupTarget
 		}
 		if reviewedTarget != x.facts.BackupTarget {
-			return nil, cnpgChanged(x.facts, "Cluster %s/%s's backup target changed since you confirmed (backupTarget); review the action again", x.cluster.GetNamespace(), x.cluster.GetName())
+			return nil, changedAction(x.facts, "Cluster %s/%s's backup target changed since you confirmed (backupTarget); review the action again", x.cluster.GetNamespace(), x.cluster.GetName())
 		}
 	}
 	clusterName := x.cluster.GetName()
@@ -1724,14 +1441,14 @@ func cnpgBackupObject(namespace, name, cluster string, annotations map[string]an
 // already exists.
 func cnpgValidateBackupName(ctx context.Context, dyn dynamic.Interface, namespace, name string) error {
 	if errs := validation.IsDNS1123Subdomain(name); len(errs) > 0 {
-		return cnpgRefuse(http.StatusBadRequest, "", "backup name %q is invalid: %s", name, strings.Join(errs, "; "))
+		return refuseAction(http.StatusBadRequest, "", "backup name %q is invalid: %s", name, strings.Join(errs, "; "))
 	}
 	if cnpgScheduleRunR.MatchString(name) {
 		schedule := name[:len(name)-15]
 		_, err := dyn.Resource(cnpgScheduleGVR).Namespace(namespace).Get(ctx, schedule, metav1.GetOptions{})
 		switch {
 		case err == nil:
-			return cnpgRefuse(http.StatusBadRequest, "", "backup name %q has the form of a run of ScheduledBackup %s: the operator would skip that run", name, schedule)
+			return refuseAction(http.StatusBadRequest, "", "backup name %q has the form of a run of ScheduledBackup %s: the operator would skip that run", name, schedule)
 		case apierrors.IsNotFound(err):
 		default:
 			return fmt.Errorf("cannot check the name against ScheduledBackup %s: %w", schedule, err)
@@ -1740,7 +1457,7 @@ func cnpgValidateBackupName(ctx context.Context, dyn dynamic.Interface, namespac
 	_, err := dyn.Resource(cnpgBackupGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
 	switch {
 	case err == nil:
-		return cnpgRefuse(http.StatusConflict, "", "a Backup named %s already exists", name)
+		return refuseAction(http.StatusConflict, "", "a Backup named %s already exists", name)
 	case apierrors.IsNotFound(err):
 		return nil
 	default:
@@ -1776,7 +1493,7 @@ func cnpgCreateBackup(ctx context.Context, dyn dynamic.Interface, backup *unstru
 			return &CNPGActionResult{Backup: name, ResolvedAfterTimeout: true, Message: "Backup " + name + " created (confirmed by reading it back after the request timed out)"}, nil
 		}
 	}
-	return nil, cnpgRefuse(http.StatusGatewayTimeout, cnpgCodeAmbiguous,
+	return nil, refuseAction(http.StatusGatewayTimeout, cnpgCodeAmbiguous,
 		"The create of Backup %s timed out and reading it back did not find it; it may still appear. Check the cluster's backups before trying again: %v", name, err)
 }
 
@@ -1789,24 +1506,24 @@ type cnpgSwitchoverParams struct {
 
 func cnpgRunSwitchover(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgSwitchoverParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	if p.Target == "" || p.TargetPodUID == "" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "params.target and params.targetPodUID are required")
+		return nil, refuseAction(http.StatusBadRequest, "", "params.target and params.targetPodUID are required")
 	}
 	if r := cnpgGuardSwitchover(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	inst, ok := x.facts.instance(p.Target)
 	if !ok {
-		return nil, cnpgChanged(x.facts, "%s is not an instance of this cluster", p.Target)
+		return nil, changedAction(x.facts, "%s is not an instance of this cluster", p.Target)
 	}
 	if inst.PodExists && inst.PodUID != p.TargetPodUID {
-		return nil, cnpgChanged(x.facts, "Pod %s was recreated since you reviewed it", p.Target)
+		return nil, changedAction(x.facts, "Pod %s was recreated since you reviewed it", p.Target)
 	}
 	if r := cnpgGuardSwitchoverTarget(x.facts, inst); r != "" {
-		return nil, cnpgBlocked(p.Target + " cannot be promoted: " + r)
+		return nil, blockedAction(p.Target + " cannot be promoted: " + r)
 	}
 	err := cnpgStatusPatch(ctx, x, map[string]any{
 		"targetPrimary": p.Target,
@@ -1824,11 +1541,11 @@ func cnpgRunSwitchover(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResul
 // --- restart / reload ---
 
 func cnpgRunRestart(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
-	if err := decodeCNPGParams(x.params, &struct{}{}); err != nil {
+	if err := decodeActionParams(x.params, &struct{}{}); err != nil {
 		return nil, err
 	}
 	if r := cnpgGuardRestart(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	if err := cnpgAnnotationPatch(ctx, x, cnpgRestartAnnotation, x.c.clock().Format(time.RFC3339)); err != nil {
 		return nil, err
@@ -1837,11 +1554,11 @@ func cnpgRunRestart(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 }
 
 func cnpgRunReload(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
-	if err := decodeCNPGParams(x.params, &struct{}{}); err != nil {
+	if err := decodeActionParams(x.params, &struct{}{}); err != nil {
 		return nil, err
 	}
 	if r := cnpgGuardReload(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	if err := cnpgAnnotationPatch(ctx, x, cnpgReloadAnnotation, x.c.clock().Format(metav1.RFC3339Micro)); err != nil {
 		return nil, err
@@ -1856,24 +1573,24 @@ type cnpgRestartInstanceParams struct {
 
 func cnpgRunRestartInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgRestartInstanceParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	if p.Pod == "" || p.PodUID == "" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "params.pod and params.podUID are required")
+		return nil, refuseAction(http.StatusBadRequest, "", "params.pod and params.podUID are required")
 	}
 	inst, ok := x.facts.instance(p.Pod)
 	if !ok {
-		return nil, cnpgChanged(x.facts, "%s is not an instance of this cluster", p.Pod)
+		return nil, changedAction(x.facts, "%s is not an instance of this cluster", p.Pod)
 	}
 	if r := cnpgGuardRestartInstance(x.facts, inst); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	if !inst.PodReadable {
-		return nil, cnpgRefuse(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
+		return nil, refuseAction(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
 	}
 	if !inst.PodExists || inst.PodUID != p.PodUID {
-		return nil, cnpgChanged(x.facts, "Pod %s was recreated since you reviewed it", p.Pod)
+		return nil, changedAction(x.facts, "Pod %s was recreated since you reviewed it", p.Pod)
 	}
 	if inst.Pod == x.facts.CurrentPrimary {
 		err := cnpgStatusPatch(ctx, x, map[string]any{
@@ -1908,12 +1625,12 @@ func cnpgFenceTargets(raw json.RawMessage) (all bool, names []string, err error)
 	var s string
 	if json.Unmarshal(raw, &s) == nil {
 		if s != cnpgAllInstances {
-			return false, nil, cnpgRefuse(http.StatusBadRequest, "", `params.instances must be "*" or a list of instance names`)
+			return false, nil, refuseAction(http.StatusBadRequest, "", `params.instances must be "*" or a list of instance names`)
 		}
 		return true, nil, nil
 	}
 	if err := json.Unmarshal(raw, &names); err != nil || len(names) == 0 {
-		return false, nil, cnpgRefuse(http.StatusBadRequest, "", `params.instances must be "*" or a non-empty list of instance names`)
+		return false, nil, refuseAction(http.StatusBadRequest, "", `params.instances must be "*" or a non-empty list of instance names`)
 	}
 	for _, n := range names {
 		if n == cnpgAllInstances {
@@ -1939,18 +1656,18 @@ func cnpgFencedValue(all bool, names []string) (any, error) {
 
 func cnpgRunFence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgFenceParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	if p.ConvertFromAll || len(p.Remaining) > 0 {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "convertFromAll and remaining apply only to unfence")
+		return nil, refuseAction(http.StatusBadRequest, "", "convertFromAll and remaining apply only to unfence")
 	}
 	all, names, err := cnpgFenceTargets(p.Instances)
 	if err != nil {
 		return nil, err
 	}
 	if r := cnpgGuardFence(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	next := map[string]bool{}
 	for _, n := range x.facts.FencedInstances.Instances {
@@ -1958,10 +1675,10 @@ func cnpgRunFence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, er
 	}
 	for _, n := range names {
 		if _, ok := x.facts.instance(n); !ok {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "%s is not an instance of this cluster", n)
+			return nil, refuseAction(http.StatusBadRequest, "", "%s is not an instance of this cluster", n)
 		}
 		if next[n] {
-			return nil, cnpgBlocked(n + " is fenced already")
+			return nil, blockedAction(n + " is fenced already")
 		}
 		next[n] = true
 	}
@@ -1977,7 +1694,7 @@ func cnpgRunFence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, er
 
 func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgFenceParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	all, names, err := cnpgFenceTargets(p.Instances)
@@ -1985,7 +1702,7 @@ func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 		return nil, err
 	}
 	if r := cnpgGuardUnfence(x.facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	var value any
 	switch {
@@ -1993,7 +1710,7 @@ func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 		value = nil
 	case x.facts.FencedInstances.All:
 		if !p.ConvertFromAll {
-			return nil, cnpgRefuse(http.StatusConflict, cnpgCodeAllFenced,
+			return nil, refuseAction(http.StatusConflict, cnpgCodeAllFenced,
 				`Every instance is fenced with ["*"]: lifting one instance means rewriting the fence as the explicit list of the others. Lift every fence, or confirm the conversion with convertFromAll and the remaining list`)
 		}
 		// The reviewer must have seen the full explicit set that stays fenced.
@@ -2003,12 +1720,12 @@ func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 		}
 		for _, n := range names {
 			if _, ok := x.facts.instance(n); !ok {
-				return nil, cnpgRefuse(http.StatusBadRequest, "", "%s is not an instance of this cluster", n)
+				return nil, refuseAction(http.StatusBadRequest, "", "%s is not an instance of this cluster", n)
 			}
 			delete(want, n)
 		}
 		if !cnpgSameStringSet(p.Remaining, cnpgSortedKeys(want)) {
-			return nil, cnpgChanged(x.facts, "The instances that stay fenced are %s, not %s; review the conversion again",
+			return nil, changedAction(x.facts, "The instances that stay fenced are %s, not %s; review the conversion again",
 				strings.Join(cnpgSortedKeys(want), ", "), strings.Join(p.Remaining, ", "))
 		}
 		if value, err = cnpgFencedValue(false, cnpgSortedKeys(want)); err != nil {
@@ -2016,7 +1733,7 @@ func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 		}
 	default:
 		if p.ConvertFromAll {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", `convertFromAll applies only while ["*"] fences every instance`)
+			return nil, refuseAction(http.StatusBadRequest, "", `convertFromAll applies only while ["*"] fences every instance`)
 		}
 		next := map[string]bool{}
 		for _, n := range x.facts.FencedInstances.Instances {
@@ -2024,7 +1741,7 @@ func cnpgRunUnfence(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult,
 		}
 		for _, n := range names {
 			if !next[n] {
-				return nil, cnpgBlocked(n + " is not fenced")
+				return nil, blockedAction(n + " is not fenced")
 			}
 			delete(next, n)
 		}
@@ -2072,7 +1789,7 @@ func cnpgSameStringSet(a, b []string) bool {
 
 func cnpgRunHibernation(value string) func(context.Context, *cnpgClusterRun) (*CNPGActionResult, error) {
 	return func(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
-		if err := decodeCNPGParams(x.params, &struct{}{}); err != nil {
+		if err := decodeActionParams(x.params, &struct{}{}); err != nil {
 			return nil, err
 		}
 		guard, msg := cnpgGuardHibernate, "Hibernation requested"
@@ -2080,7 +1797,7 @@ func cnpgRunHibernation(value string) func(context.Context, *cnpgClusterRun) (*C
 			guard, msg = cnpgGuardRehydrate, "Rehydration requested"
 		}
 		if r := guard(x.facts); r != "" {
-			return nil, cnpgBlocked(r)
+			return nil, blockedAction(r)
 		}
 		if err := cnpgAnnotationPatch(ctx, x, cnpgHibernateAnnotation, value); err != nil {
 			return nil, err
@@ -2091,25 +1808,25 @@ func cnpgRunHibernation(value string) func(context.Context, *cnpgClusterRun) (*C
 
 // --- scheduled backups ---
 
-func runCNPGScheduleAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req CNPGActionRequest) (*CNPGActionResult, error) {
+func runCNPGScheduleAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req ActionRequest) (*CNPGActionResult, error) {
 	reviewed, err := decodeCNPGReviewedFacts(req.Facts)
 	if err != nil {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "%v", err)
+		return nil, refuseAction(http.StatusBadRequest, "", "%v", err)
 	}
 	var params struct {
 		Schedule *string `json:"schedule"`
 	}
 	if action == "setSchedule" {
-		if err := decodeCNPGParams(req.Params, &params); err != nil {
+		if err := decodeActionParams(req.Params, &params); err != nil {
 			return nil, err
 		}
 		if params.Schedule == nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "params.schedule is required for setSchedule")
+			return nil, refuseAction(http.StatusBadRequest, "", "params.schedule is required for setSchedule")
 		}
 		if p := cnpgSchedulePreview(*params.Schedule, nil, false, c.clock()); !p.Valid {
-			return nil, cnpgRefuse(http.StatusBadRequest, cnpgCodeInvalidSchedule, "invalid schedule %q: %s", *params.Schedule, p.Error)
+			return nil, refuseAction(http.StatusBadRequest, cnpgCodeInvalidSchedule, "invalid schedule %q: %s", *params.Schedule, p.Error)
 		}
-	} else if err := decodeCNPGParams(req.Params, &struct{}{}); err != nil {
+	} else if err := decodeActionParams(req.Params, &struct{}{}); err != nil {
 		return nil, err
 	}
 	sched, err := c.dyn.Resource(cnpgScheduleGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
@@ -2118,46 +1835,46 @@ func runCNPGScheduleAction(ctx context.Context, c cnpgActionClients, namespace,
 	}
 	facts := cnpgScheduleFactsOf(ctx, c, sched)
 	if string(sched.GetUID()) != req.UID {
-		return nil, cnpgChanged(facts, "ScheduledBackup %s/%s was deleted and recreated since you reviewed it", namespace, name)
+		return nil, changedAction(facts, "ScheduledBackup %s/%s was deleted and recreated since you reviewed it", namespace, name)
 	}
 	switch action {
 	case "setSchedule":
 		if reviewed.Schedule == nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "facts.schedule is required for setSchedule: the confirmation must bind what the dialog showed")
+			return nil, refuseAction(http.StatusBadRequest, "", "facts.schedule is required for setSchedule: the confirmation must bind what the dialog showed")
 		}
 		if *reviewed.Schedule != facts.Schedule {
-			return nil, cnpgChanged(facts, "ScheduledBackup %s/%s schedule changed since you reviewed it; review the action again", namespace, name)
+			return nil, changedAction(facts, "ScheduledBackup %s/%s schedule changed since you reviewed it; review the action again", namespace, name)
 		}
 	case "run":
 		if reviewed.Generation == nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "facts.generation is required for run")
+			return nil, refuseAction(http.StatusBadRequest, "", "facts.generation is required for run")
 		}
 		if *reviewed.Generation != facts.Generation {
-			return nil, cnpgChanged(facts, "ScheduledBackup %s/%s settings changed since you confirmed; review the action again", namespace, name)
+			return nil, changedAction(facts, "ScheduledBackup %s/%s settings changed since you confirmed; review the action again", namespace, name)
 		}
 	default:
 		if reviewed.Suspended == nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "facts.suspended is required for %s", action)
+			return nil, refuseAction(http.StatusBadRequest, "", "facts.suspended is required for %s", action)
 		}
 		if *reviewed.Suspended != facts.Suspended {
-			return nil, cnpgChanged(facts, "ScheduledBackup %s/%s changed since you confirmed (suspended); review the action again", namespace, name)
+			return nil, changedAction(facts, "ScheduledBackup %s/%s changed since you confirmed (suspended); review the action again", namespace, name)
 		}
 	}
 	if facts.Terminating {
-		return nil, cnpgBlocked("The schedule is being deleted")
+		return nil, blockedAction("The schedule is being deleted")
 	}
 
 	switch action {
 	case "setSchedule":
 		if *params.Schedule == facts.Schedule {
-			return nil, cnpgBlocked("The schedule is already " + facts.Schedule)
+			return nil, blockedAction("The schedule is already " + facts.Schedule)
 		}
-		err := cnpgMergePatch(ctx, c.dyn, cnpgScheduleGVR, sched, map[string]any{"spec": map[string]any{"schedule": *params.Schedule}})
+		err := mergePatchAtVersion(ctx, c.dyn, cnpgScheduleGVR, sched, map[string]any{"spec": map[string]any{"schedule": *params.Schedule}})
 		if apierrors.IsConflict(err) {
 			if fresh, gerr := c.dyn.Resource(cnpgScheduleGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}); gerr == nil {
 				facts = cnpgScheduleFactsOf(ctx, c, fresh)
 			}
-			return nil, cnpgChanged(facts, "ScheduledBackup %s/%s changed while the request was being sent; review the action again", namespace, name)
+			return nil, changedAction(facts, "ScheduledBackup %s/%s changed while the request was being sent; review the action again", namespace, name)
 		}
 		if err != nil {
 			return nil, err
@@ -2167,14 +1884,14 @@ func runCNPGScheduleAction(ctx context.Context, c cnpgActionClients, namespace,
 	case "suspend", "resume":
 		want := action == "suspend"
 		if facts.Suspended == want {
-			return nil, cnpgBlocked(map[bool]string{true: "The schedule is suspended already", false: "The schedule is not suspended"}[want])
+			return nil, blockedAction(map[bool]string{true: "The schedule is suspended already", false: "The schedule is not suspended"}[want])
 		}
-		err := cnpgMergePatch(ctx, c.dyn, cnpgScheduleGVR, sched, map[string]any{"spec": map[string]any{"suspend": want}})
+		err := mergePatchAtVersion(ctx, c.dyn, cnpgScheduleGVR, sched, map[string]any{"spec": map[string]any{"suspend": want}})
 		if apierrors.IsConflict(err) {
 			if fresh, gerr := c.dyn.Resource(cnpgScheduleGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}); gerr == nil {
 				facts = cnpgScheduleFactsOf(ctx, c, fresh)
 			}
-			return nil, cnpgChanged(facts, "ScheduledBackup %s/%s changed while the request was being sent; review the action again", namespace, name)
+			return nil, changedAction(facts, "ScheduledBackup %s/%s changed while the request was being sent; review the action again", namespace, name)
 		}
 		if err != nil {
 			return nil, err
@@ -2188,11 +1905,11 @@ func runCNPGScheduleAction(ctx context.Context, c cnpgActionClients, namespace,
 	}
 
 	if r := cnpgGuardScheduleRun(facts); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	backupName := name + "-manual-" + c.clock().Format(cnpgCompactStamp)
 	if errs := validation.IsDNS1123Subdomain(backupName); len(errs) > 0 {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "backup name %q is invalid: %s", backupName, strings.Join(errs, "; "))
+		return nil, refuseAction(http.StatusBadRequest, "", "backup name %q is invalid: %s", backupName, strings.Join(errs, "; "))
 	}
 	backup := cnpgBackupObject(namespace, backupName, facts.Cluster, map[string]any{cnpgRequestedFromAnno: name}, cnpgBackupSpecFromSchedule(sched))
 	res, err := cnpgCreateBackup(ctx, c.dyn, backup, facts.Cluster)
@@ -2219,60 +1936,17 @@ func cnpgBackupSpecFromSchedule(sched *unstructured.Unstructured) map[string]any
 
 // ---------- errors ----------
 
+// writeCNPGActionError adds the CloudNativePG reading of an admission-webhook
+// failure to the shared action error answer.
 func (s *Server) writeCNPGActionError(w http.ResponseWriter, err error, action, namespace, name string) {
-	var ae *cnpgActionError
-	if errors.As(err, &ae) {
-		log.Printf("[cnpg] %q %s/%s refused %d: %s", action, sanitizeForLog(namespace), sanitizeForLog(name), ae.Status, ae.Message)
-		body := map[string]any{"error": ae.Message}
-		if ae.Code != "" {
-			body["code"] = ae.Code
-		}
-		if ae.Current != nil {
-			body["current"] = ae.Current
-		}
-		if len(ae.Completed) > 0 {
-			body["completed"] = ae.Completed
-		}
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(ae.Status)
-		if encErr := json.NewEncoder(w).Encode(body); encErr != nil {
-			log.Printf("Failed to encode error response: %v", encErr)
-		}
-		return
-	}
-	msg := err.Error()
-	status := http.StatusInternalServerError
-	code := ""
-	switch {
-	case strings.Contains(msg, "failed calling webhook"):
-		status, code = http.StatusServiceUnavailable, cnpgCodeWebhook
-		msg = "The CloudNativePG operator's admission webhook did not answer — the operator may be down: " + msg
-	case errors.Is(err, context.DeadlineExceeded) || apierrors.IsTimeout(err) || apierrors.IsServerTimeout(err):
-		status = http.StatusGatewayTimeout
-	case apierrors.IsNotFound(err):
-		status = http.StatusNotFound
-	case apierrors.IsForbidden(err):
-		status = http.StatusForbidden
-		if g, ok := cnpgGrantFor(action); ok {
-			msg = "This needs " + g.String(namespace) + ": " + msg
-		}
-	case apierrors.IsAlreadyExists(err), apierrors.IsConflict(err):
-		status = http.StatusConflict
-	case apierrors.IsInvalid(err):
-		status = http.StatusUnprocessableEntity
-	}
-	log.Printf("[cnpg] Failed to %s %s/%s (%d): %v", sanitizeForLog(action), sanitizeForLog(namespace), sanitizeForLog(name), status, err)
-	if code != "" {
-		body := map[string]any{"error": msg, "code": code}
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(status)
-		_ = json.NewEncoder(w).Encode(body)
-		return
+	var ae *actionError
+	if !errors.As(err, &ae) && strings.Contains(err.Error(), "failed calling webhook") {
+		err = refuseAction(http.StatusServiceUnavailable, cnpgCodeWebhook, "%s", "The CloudNativePG operator's admission webhook did not answer — the operator may be down: "+err.Error())
 	}
-	s.writeError(w, status, msg)
+	s.writeActionError(w, "cnpg", err, action, namespace, name, cnpgGrantFor)
 }
 
-func cnpgGrantFor(action string) (cnpgGrant, bool) {
+func cnpgGrantFor(action string) (Grant, bool) {
 	if g, ok := cnpgClusterActionGrants[action]; ok {
 		return g, true
 	}
@@ -2282,5 +1956,5 @@ func cnpgGrantFor(action string) (cnpgGrant, bool) {
 	if g, ok := cnpgExtraActionGrants[action]; ok {
 		return g, true
 	}
-	return cnpgGrant{}, false
+	return Grant{}, false
 }
diff --git a/internal/server/cnpg_actions_maintenance.go b/internal/server/cnpg_actions_maintenance.go
index 1de0d505fa..08a6eaf84e 100644
--- a/internal/server/cnpg_actions_maintenance.go
+++ b/internal/server/cnpg_actions_maintenance.go
@@ -22,8 +22,8 @@ type CNPGMaintenanceFacts struct {
 }
 
 type CNPGMaintenanceActions struct {
-	SetMaintenance   CNPGActionCapability `json:"setMaintenance"`
-	UnsetMaintenance CNPGActionCapability `json:"unsetMaintenance"`
+	SetMaintenance   ActionCapability `json:"setMaintenance"`
+	UnsetMaintenance ActionCapability `json:"unsetMaintenance"`
 }
 
 func init() {
@@ -82,20 +82,20 @@ type cnpgMaintenanceParams struct {
 func cnpgRunMaintenance(inProgress bool) func(context.Context, *cnpgClusterRun) (*CNPGActionResult, error) {
 	return func(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 		var p cnpgMaintenanceParams
-		if err := decodeCNPGParams(x.params, &p); err != nil {
+		if err := decodeActionParams(x.params, &p); err != nil {
 			return nil, err
 		}
 		if p.ReusePVC == nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "params.reusePVC is required")
+			return nil, refuseAction(http.StatusBadRequest, "", "params.reusePVC is required")
 		}
 		guard, msg := cnpgGuardSetMaintenance, "Maintenance mode set"
 		if !inProgress {
 			guard, msg = cnpgGuardUnsetMaintenance, "Maintenance mode lifted"
 		}
 		if r := guard(x.facts); r != "" {
-			return nil, cnpgBlocked(r)
+			return nil, blockedAction(r)
 		}
-		err := cnpgMergePatch(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{
+		err := mergePatchAtVersion(ctx, x.c.dyn, cnpgClusterGVR, x.cluster, map[string]any{
 			"spec": map[string]any{"nodeMaintenanceWindow": map[string]any{
 				"inProgress": inProgress,
 				"reusePVC":   *p.ReusePVC,
diff --git a/internal/server/cnpg_actions_maintenance_test.go b/internal/server/cnpg_actions_maintenance_test.go
index 6bd2ebf847..7db0de1f2c 100644
--- a/internal/server/cnpg_actions_maintenance_test.go
+++ b/internal/server/cnpg_actions_maintenance_test.go
@@ -57,12 +57,12 @@ func TestCNPGActionMaintenanceGuardsAndBinding(t *testing.T) {
 
 	// Nothing is in progress: unset is refused.
 	_, err := runCNPGClusterAction(ctx, env.clients(), "db", "pg", "unsetMaintenance", cnpgActionReq(t, cnpgMaintenanceFactsMap(false, false, true), map[string]any{"reusePVC": true}))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 		t.Errorf("unset while not in progress = %v, want blocked", err)
 	}
 	// The reviewed values differ from the cluster's: 409 changed, nothing written.
 	_, err = runCNPGClusterAction(ctx, env.clients(), "db", "pg", "setMaintenance", cnpgActionReq(t, cnpgMaintenanceFactsMap(true, false, false), map[string]any{"reusePVC": true}))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeChanged {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeChanged {
 		t.Errorf("stale maintenance facts = %v, want 409 changed", err)
 	}
 	// Missing binding or missing reusePVC is a malformed request.
diff --git a/internal/server/cnpg_actions_test.go b/internal/server/cnpg_actions_test.go
index 41c8b27adc..7789c62653 100644
--- a/internal/server/cnpg_actions_test.go
+++ b/internal/server/cnpg_actions_test.go
@@ -132,9 +132,9 @@ func newCNPGActionEnv(t *testing.T, objs []runtime.Object, pods ...runtime.Objec
 	return env
 }
 
-func cnpgActionReq(t *testing.T, facts map[string]any, params any) CNPGActionRequest {
+func cnpgActionReq(t *testing.T, facts map[string]any, params any) ActionRequest {
 	t.Helper()
-	req := CNPGActionRequest{ReviewedContext: "kind-test", UID: cnpgActionTestUID}
+	req := ActionRequest{ReviewedContext: "kind-test", UID: cnpgActionTestUID}
 	if facts != nil {
 		b, _ := json.Marshal(facts)
 		req.Facts = b
@@ -179,9 +179,9 @@ func cnpgActionAnnotations(t *testing.T, body map[string]any) map[string]any {
 	return a
 }
 
-func cnpgActionStatus(t *testing.T, err error) (*cnpgActionError, bool) {
+func cnpgActionStatus(t *testing.T, err error) (*actionError, bool) {
 	t.Helper()
-	var ae *cnpgActionError
+	var ae *actionError
 	ok := errors.As(err, &ae)
 	return ae, ok
 }
@@ -250,7 +250,7 @@ func TestCNPGActionBackupBindsInheritedTarget(t *testing.T) {
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "backup",
 		cnpgActionReq(t, cnpgActionFacts(), map[string]any{"method": "volumeSnapshot", "name": "manual-one"}))
 	ae, ok := cnpgActionStatus(t, err)
-	if !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeChanged {
+	if !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeChanged {
 		t.Fatalf("err = %v, want 409 changed", err)
 	}
 	if len(env.creates) != 0 {
@@ -375,7 +375,7 @@ func TestCNPGActionSwitchoverTargetChecks(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{fencedPg2}, cnpgActionPod("pg-2", "u2", true))
 		_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "switchover",
 			cnpgActionReq(t, facts, map[string]any{"target": "pg-2", "targetPodUID": "u2"}))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeBlocked {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeBlocked {
 			t.Fatalf("err = %v, want 409 blocked", err)
 		}
 	})
@@ -383,7 +383,7 @@ func TestCNPGActionSwitchoverTargetChecks(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil)}, cnpgActionPod("pg-2", "u2-new", true))
 		_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "switchover",
 			cnpgActionReq(t, cnpgActionFacts(), map[string]any{"target": "pg-2", "targetPodUID": "u2"}))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 			t.Fatalf("err = %v, want 409 changed", err)
 		}
 	})
@@ -391,7 +391,7 @@ func TestCNPGActionSwitchoverTargetChecks(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil)}, cnpgActionPod("pg-2", "u2", false))
 		_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "switchover",
 			cnpgActionReq(t, cnpgActionFacts(), map[string]any{"target": "pg-2", "targetPodUID": "u2"}))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 			t.Fatalf("err = %v, want 409 blocked", err)
 		}
 	})
@@ -414,7 +414,7 @@ func TestCNPGActionFactMismatchReturnsCurrentFacts(t *testing.T) {
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "switchover",
 		cnpgActionReq(t, facts, map[string]any{"target": "pg-2", "targetPodUID": "u2"}))
 	ae, ok := cnpgActionStatus(t, err)
-	if !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeChanged {
+	if !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeChanged {
 		t.Fatalf("err = %v, want 409 changed", err)
 	}
 	if cur, ok := ae.Current.(CNPGClusterFacts); !ok || cur.CurrentPrimary != "pg-1" {
@@ -430,7 +430,7 @@ func TestCNPGActionUIDMismatchAndMissingFacts(t *testing.T) {
 	req := cnpgActionReq(t, cnpgActionFacts(), nil)
 	req.UID = "old-uid"
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "restart", req)
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 		t.Fatalf("err = %v, want 409 changed for a recreated Cluster", err)
 	}
 	_, err = runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "restart", cnpgActionReq(t, map[string]any{}, nil))
@@ -440,11 +440,11 @@ func TestCNPGActionUIDMismatchAndMissingFacts(t *testing.T) {
 }
 
 func TestCNPGActionReviewedContext(t *testing.T) {
-	if err := cnpgCheckReviewedContext("kind-a", "kind-a"); err != nil {
+	if err := checkReviewedContext("kind-a", "kind-a"); err != nil {
 		t.Errorf("matching context refused: %v", err)
 	}
-	ae, ok := cnpgActionStatus(t, cnpgCheckReviewedContext("kind-a", "prod"))
-	if !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeContextChanged {
+	ae, ok := cnpgActionStatus(t, checkReviewedContext("kind-a", "prod"))
+	if !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeContextChanged {
 		t.Errorf("mismatch = %v, want 409 context_changed", ae)
 	}
 }
@@ -560,7 +560,7 @@ func TestCNPGActionRestartInstance(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{upgrading}, cnpgActionPod("pg-1", "u1", true))
 		_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "restartInstance",
 			cnpgActionReq(t, cnpgActionFacts(), map[string]any{"pod": "pg-1", "podUID": "u1"}))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 			t.Fatalf("err = %v, want 409 blocked", err)
 		}
 	})
@@ -643,14 +643,14 @@ func TestCNPGActionFencing(t *testing.T) {
 	})
 	t.Run("conversion with a stale remaining list", func(t *testing.T) {
 		_, err := run(t, `["*"]`, "unfence", map[string]any{"instances": []string{"pg-2"}, "convertFromAll": true, "remaining": []string{"pg-1"}})
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 			t.Fatalf("err = %v, want 409 changed", err)
 		}
 	})
 	t.Run("malformed annotation blocks writes", func(t *testing.T) {
 		for _, action := range []string{"fence", "unfence"} {
 			_, err := run(t, `pg-2`, action, map[string]any{"instances": "*"})
-			if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+			if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 				t.Errorf("%s: err = %v, want 409 blocked", action, err)
 			}
 		}
@@ -698,13 +698,13 @@ func TestCNPGActionCapabilitiesPermissionDenied(t *testing.T) {
 		t.Fatal(err)
 	}
 	sw := resp.Actions.Switchover
-	if sw.Allowed || sw.Permission != cnpgPermDenied || !strings.Contains(sw.Grant, "clusters/status") || !strings.Contains(sw.Reason, "patch clusters/status") {
+	if sw.Allowed || sw.Permission != permissionDenied || !strings.Contains(sw.Grant, "clusters/status") || !strings.Contains(sw.Reason, "patch clusters/status") {
 		t.Errorf("switchover = %+v, want denied naming patch clusters/status", sw)
 	}
 	if b := resp.Actions.Backup; b.Allowed || !strings.Contains(b.Grant, "create backups") {
 		t.Errorf("backup = %+v, want denied naming create backups", b)
 	}
-	if !resp.Actions.Restart.Allowed || resp.Actions.Restart.Permission != cnpgPermAllowed {
+	if !resp.Actions.Restart.Allowed || resp.Actions.Restart.Permission != permissionAllowed {
 		t.Errorf("restart = %+v, want allowed", resp.Actions.Restart)
 	}
 	// The primary's in-place restart needs the status grant; a standby's needs delete pods.
@@ -815,7 +815,7 @@ func cnpgActionSchedule(mut func(o map[string]any)) *unstructured.Unstructured {
 
 func TestCNPGActionScheduleRunCopiesSettings(t *testing.T) {
 	env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
-	req := CNPGActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"generation":3}`)}
+	req := ActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"generation":3}`)}
 	res, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "run", req)
 	if err != nil {
 		t.Fatalf("run: %v", err)
@@ -840,9 +840,9 @@ func TestCNPGActionScheduleRunCopiesSettings(t *testing.T) {
 
 func TestCNPGActionScheduleRunBindsReviewedSettings(t *testing.T) {
 	env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
-	req := CNPGActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"generation":2}`)}
+	req := ActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"generation":2}`)}
 	_, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "run", req)
-	var ae *cnpgActionError
+	var ae *actionError
 	if !errors.As(err, &ae) || ae.Status != http.StatusConflict {
 		t.Fatalf("stale generation: err = %v, want 409", err)
 	}
@@ -860,7 +860,7 @@ func TestCNPGActionScheduleSuspendResume(t *testing.T) {
 		suspended := cnpgActionSchedule(func(o map[string]any) { o["spec"].(map[string]any)["suspend"] = true })
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), suspended})
 		res, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "resume",
-			CNPGActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"suspended":true}`)})
+			ActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"suspended":true}`)})
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -875,8 +875,8 @@ func TestCNPGActionScheduleSuspendResume(t *testing.T) {
 	t.Run("suspend binds the reviewed state", func(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
 		_, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "suspend",
-			CNPGActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"suspended":true}`)})
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+			ActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: json.RawMessage(`{"suspended":true}`)})
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 			t.Fatalf("err = %v, want 409 changed", err)
 		}
 	})
@@ -890,7 +890,7 @@ func TestCNPGActionApiserverConflictIsNotRetried(t *testing.T) {
 		return true, nil, apierrors.NewConflict(schema.GroupResource{Group: cnpgGroup, Resource: "clusters"}, "pg", errors.New("the object has been modified"))
 	})
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "hibernate", cnpgActionReq(t, cnpgActionFacts(), nil))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged || ae.Current == nil {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged || ae.Current == nil {
 		t.Fatalf("err = %v, want 409 changed with current facts", err)
 	}
 	if calls != 1 {
@@ -915,7 +915,7 @@ func TestCNPGActionErrorMapping(t *testing.T) {
 			[]string{"admission webhook did not answer", "connection refused"}},
 		{"invalid", "backup", apierrors.NewInvalid(schema.GroupKind{Group: cnpgGroup, Kind: "Backup"}, "b", nil), http.StatusUnprocessableEntity, "", []string{"is invalid"}},
 		{"not found", "restart", apierrors.NewNotFound(gr, "pg"), http.StatusNotFound, "", []string{"not found"}},
-		{"refusal", "fence", cnpgBlocked("It is fenced already"), http.StatusConflict, cnpgCodeBlocked, []string{"fenced already"}},
+		{"refusal", "fence", blockedAction("It is fenced already"), http.StatusConflict, actionCodeBlocked, []string{"fenced already"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			w := httptest.NewRecorder()
@@ -954,12 +954,12 @@ func TestCNPGActionCapabilitiesRestoreNeedsCreateClusters(t *testing.T) {
 		}
 		got := resp.Actions.Restore
 		if allowed {
-			if !got.Allowed || got.Permission != cnpgPermAllowed {
+			if !got.Allowed || got.Permission != permissionAllowed {
 				t.Errorf("restore with create clusters = %+v, want allowed", got)
 			}
 			continue
 		}
-		if got.Allowed || got.Permission != cnpgPermDenied || !strings.Contains(got.Reason, "create clusters (postgresql.cnpg.io) in namespace db") {
+		if got.Allowed || got.Permission != permissionDenied || !strings.Contains(got.Reason, "create clusters (postgresql.cnpg.io) in namespace db") {
 			t.Errorf("restore without create clusters = %+v, want denied naming the grant", got)
 		}
 	}
diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index fa4d5445b4..8ca2ccf799 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -275,7 +275,7 @@ func (s *Server) cnpgClusterHA(r *http.Request, c cnpgHAClients, cache *k8s.Reso
 			resp.Pods = CNPGHASource{State: cnpgHAStateOK}
 		}
 	} else {
-		resp.Pods = cnpgHADenied(cnpgGrant{"list", "", "pods", ""}, namespace)
+		resp.Pods = cnpgHADenied(Grant{Verb: "list", Resource: "pods"}, namespace)
 	}
 	resp.Nodes = s.cnpgHANodesSource(r, cache)
 	resp.Instances = cnpgHAInstances(cache, pods, resp.DesiredImage, resp.Nodes.State == cnpgHAStateOK)
@@ -290,18 +290,18 @@ func (s *Server) cnpgClusterHA(r *http.Request, c cnpgHAClients, cache *k8s.Reso
 	return resp
 }
 
-func cnpgHADenied(g cnpgGrant, namespace string) CNPGHASource {
-	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.String(namespace), Reason: "You are not allowed to " + g.String(namespace)}
+func cnpgHADenied(g Grant, namespace string) CNPGHASource {
+	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.In(namespace).String(), Reason: "You are not allowed to " + g.In(namespace).String()}
 }
 
-func cnpgHAClusterDenied(g cnpgGrant) CNPGHASource {
-	grant := g.ClusterString()
+func cnpgHAClusterDenied(g Grant) CNPGHASource {
+	grant := g.String()
 	return CNPGHASource{State: cnpgHAStateDenied, Grant: grant, Reason: "You are not allowed to " + grant}
 }
 
 // cnpgHAReadError classifies an impersonated read's failure. NotFound is left
 // to the caller: its meaning differs per object.
-func cnpgHAReadError(err error, g cnpgGrant, namespace string) CNPGHASource {
+func cnpgHAReadError(err error, g Grant, namespace string) CNPGHASource {
 	switch {
 	case apierrors.IsForbidden(err):
 		return cnpgHADenied(g, namespace)
@@ -311,7 +311,7 @@ func cnpgHAReadError(err error, g cnpgGrant, namespace string) CNPGHASource {
 		return CNPGHASource{State: cnpgHAStateUnavailable, Reason: "no answer within " + cnpgHAReadTimeout.String()}
 	default:
 		if plain, ok := cnpgTransportSentence(err, 0, cnpgHAReadTimeout); ok {
-			log.Printf("[cnpg] Failed to read %s: %v", g.String(namespace), err)
+			log.Printf("[cnpg] Failed to read %s: %v", g.In(namespace).String(), err)
 			return CNPGHASource{State: cnpgHAStateUnavailable, Reason: plain}
 		}
 		return CNPGHASource{State: cnpgHAStateError, Reason: truncateCNPGRuntimeError(err.Error())}
@@ -347,7 +347,7 @@ func cnpgUncachedReason(fact, kind, namespace string, uncached, outOfScope, read
 
 func (s *Server) cnpgHANodesSource(r *http.Request, cache *k8s.ResourceCache) CNPGHASource {
 	if !s.canRead(r, "", "nodes", "", "get") {
-		return cnpgHAClusterDenied(cnpgGrant{"get", "", "nodes", ""})
+		return cnpgHAClusterDenied(Grant{Verb: "get", Resource: "nodes"})
 	}
 	if reason := cnpgUncachedReason("Zones", "Nodes", "", cache.Nodes() == nil, false, cache.IsKindReady("nodes")); reason != "" {
 		return CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
@@ -427,7 +427,7 @@ func (s *Server) cnpgHAQuorum(ctx context.Context, r *http.Request, c cnpgHAClie
 			return q
 		}
 	}
-	grant := cnpgGrant{"get", cnpgGroup, "failoverquorums", ""}
+	grant := Grant{Verb: "get", Group: cnpgGroup, Resource: "failoverquorums"}
 	if !s.canRead(r, cnpgGroup, "failoverquorums", namespace, "get") {
 		q.Object = cnpgHADenied(grant, namespace)
 		return q
@@ -494,7 +494,7 @@ func (s *Server) cnpgHAPDBs(r *http.Request, cache *k8s.ResourceCache, cluster *
 	if v, ok, _ := unstructured.NestedBool(cluster.Object, "spec", "enablePDB"); ok {
 		out.Enabled = v
 	}
-	grant := cnpgGrant{"list", "policy", "poddisruptionbudgets", ""}
+	grant := Grant{Verb: "list", Group: "policy", Resource: "poddisruptionbudgets"}
 	if !s.canRead(r, "policy", "poddisruptionbudgets", namespace, "list") {
 		out.CNPGHASource = cnpgHADenied(grant, namespace)
 		return out
@@ -566,7 +566,7 @@ type leaseView struct {
 
 func (s *Server) cnpgHAPrimaryLease(ctx context.Context, r *http.Request, c cnpgHAClients, cluster *unstructured.Unstructured, now time.Time) CNPGHALease {
 	namespace, name := cluster.GetNamespace(), cluster.GetName()
-	grant := cnpgGrant{"get", "coordination.k8s.io", "leases", ""}
+	grant := Grant{Verb: "get", Group: "coordination.k8s.io", Resource: "leases"}
 	if !s.canRead(r, "coordination.k8s.io", "leases", namespace, "get") {
 		return CNPGHALease{CNPGHASource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: name}
 	}
@@ -614,7 +614,7 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 		}
 		return CNPGHALease{CNPGHASource: CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}, Name: cnpgOperatorLeaseName}
 	}
-	grant := cnpgGrant{"get", "coordination.k8s.io", "leases", ""}
+	grant := Grant{Verb: "get", Group: "coordination.k8s.io", Resource: "leases"}
 	if !s.canRead(r, "coordination.k8s.io", "leases", namespace, "get") {
 		return CNPGHALease{CNPGHASource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: cnpgOperatorLeaseName}
 	}
@@ -640,7 +640,7 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 func (s *Server) cnpgHAJobs(r *http.Request, cache *k8s.ResourceCache, cluster *unstructured.Unstructured) CNPGHAJobs {
 	namespace := cluster.GetNamespace()
 	out := CNPGHAJobs{Items: []CNPGHAJob{}}
-	grant := cnpgGrant{"list", "batch", "jobs", ""}
+	grant := Grant{Verb: "list", Group: "batch", Resource: "jobs"}
 	if !s.canRead(r, "batch", "jobs", namespace, "list") {
 		out.CNPGHASource = cnpgHADenied(grant, namespace)
 		return out
@@ -704,7 +704,7 @@ func (s *Server) cnpgHARWEndpoints(ctx context.Context, r *http.Request, c cnpgH
 	namespace := cluster.GetNamespace()
 	svc := cluster.GetName() + "-rw"
 	out := CNPGHAEndpoints{Service: svc, Pods: []string{}}
-	grant := cnpgGrant{"list", "discovery.k8s.io", "endpointslices", ""}
+	grant := Grant{Verb: "list", Group: "discovery.k8s.io", Resource: "endpointslices"}
 	if !s.canRead(r, "discovery.k8s.io", "endpointslices", namespace, "list") {
 		out.CNPGHASource = cnpgHADenied(grant, namespace)
 		return out
@@ -753,7 +753,7 @@ func (s *Server) cnpgHACertificates(ctx context.Context, r *http.Request, c cnpg
 	}
 	user := issues.CNPGUserCertificateSecrets(cluster)
 	canGetSecrets := s.canRead(r, "", "secrets", namespace, "get")
-	grant := cnpgGrant{"get", "", "secrets", ""}
+	grant := Grant{Verb: "get", Resource: "secrets"}
 
 	out := make([]CNPGHACertificate, 0, len(exp))
 	for secret, raw := range exp {
diff --git a/internal/server/cnpg_destroy.go b/internal/server/cnpg_destroy.go
index 9e82d0a802..a15df287fc 100644
--- a/internal/server/cnpg_destroy.go
+++ b/internal/server/cnpg_destroy.go
@@ -38,14 +38,14 @@ const (
 )
 
 var (
-	cnpgGrantDeletePVCs = cnpgGrant{"delete", "", "persistentvolumeclaims", ""}
-	cnpgGrantUpdatePVCs = cnpgGrant{"update", "", "persistentvolumeclaims", ""}
-	cnpgGrantListPVCs   = cnpgGrant{"list", "", "persistentvolumeclaims", ""}
-	cnpgGrantListJobs   = cnpgGrant{"list", "batch", "jobs", ""}
-	cnpgGrantDeleteJobs = cnpgGrant{"delete", "batch", "jobs", ""}
-	cnpgGrantPatchPool  = cnpgGrant{"patch", cnpgGroup, "poolers", ""}
+	cnpgGrantDeletePVCs = Grant{Verb: "delete", Resource: "persistentvolumeclaims"}
+	cnpgGrantUpdatePVCs = Grant{Verb: "update", Resource: "persistentvolumeclaims"}
+	cnpgGrantListPVCs   = Grant{Verb: "list", Resource: "persistentvolumeclaims"}
+	cnpgGrantListJobs   = Grant{Verb: "list", Group: "batch", Resource: "jobs"}
+	cnpgGrantDeleteJobs = Grant{Verb: "delete", Group: "batch", Resource: "jobs"}
+	cnpgGrantPatchPool  = Grant{Verb: "patch", Group: cnpgGroup, Resource: "poolers"}
 
-	cnpgExtraActionGrants = map[string]cnpgGrant{
+	cnpgExtraActionGrants = map[string]Grant{
 		"cancelBackend":    cnpgGrantCreateExec,
 		"terminateBackend": cnpgGrantCreateExec,
 		"destroyInstance":  cnpgGrantDeletePods,
@@ -56,12 +56,12 @@ var (
 
 // cnpgDestroyGrants: with keepPVC the PVCs are updated (detached), otherwise
 // deleted; the fence on the destroyed name is lifted last (patch clusters).
-func cnpgDestroyGrants(keepPVC bool) []cnpgGrant {
+func cnpgDestroyGrants(keepPVC bool) []Grant {
 	pvc := cnpgGrantDeletePVCs
 	if keepPVC {
 		pvc = cnpgGrantUpdatePVCs
 	}
-	return []cnpgGrant{cnpgGrantDeletePods, cnpgGrantListPVCs, pvc, cnpgGrantListJobs, cnpgGrantDeleteJobs, cnpgGrantPatchClusters}
+	return []Grant{cnpgGrantDeletePods, cnpgGrantListPVCs, pvc, cnpgGrantListJobs, cnpgGrantDeleteJobs, cnpgGrantPatchClusters}
 }
 
 // cnpgDestroyPreflight asks the apiserver, as the caller, for every grant the
@@ -70,16 +70,16 @@ func cnpgDestroyGrants(keepPVC bool) []cnpgGrant {
 func cnpgDestroyPreflight(ctx context.Context, x *cnpgClusterRun, keepPVC bool) error {
 	namespace := x.cluster.GetNamespace()
 	for _, g := range cnpgDestroyGrants(keepPVC) {
-		resource := g.resource
-		if g.subresource != "" {
-			resource += "/" + g.subresource
+		resource := g.Resource
+		if g.Subresource != "" {
+			resource += "/" + g.Subresource
 		}
-		allowed, apiErr := k8score.CanI(ctx, x.c.typed, namespace, g.group, resource, g.verb)
+		allowed, apiErr := k8score.CanI(ctx, x.c.typed, namespace, g.Group, resource, g.Verb)
 		switch {
 		case apiErr:
-			return cnpgRefuse(http.StatusServiceUnavailable, "", "Could not confirm you may %s; nothing was changed", g.String(namespace))
+			return refuseAction(http.StatusServiceUnavailable, "", "Could not confirm you may %s; nothing was changed", g.In(namespace).String())
 		case !allowed:
-			return cnpgRefuse(http.StatusForbidden, "", "Destroying needs %s; nothing was changed", g.String(namespace))
+			return refuseAction(http.StatusForbidden, "", "Destroying needs %s; nothing was changed", g.In(namespace).String())
 		}
 	}
 	return nil
@@ -145,8 +145,8 @@ type CNPGDestroyPlan struct {
 	JobsReadable bool             `json:"jobsReadable"`
 	Jobs         []string         `json:"jobs"`
 	Actions      struct {
-		Delete CNPGActionCapability `json:"delete"`
-		Keep   CNPGActionCapability `json:"keep"`
+		Delete ActionCapability `json:"delete"`
+		Keep   ActionCapability `json:"keep"`
 	} `json:"actions"`
 }
 
@@ -248,7 +248,7 @@ func (s *Server) cnpgDestroyPlan(r *http.Request, c cnpgActionClients, contextNa
 	facts, _ := cnpgClusterFactsOf(ctx, c.typed, cluster)
 	inst, ok := facts.instance(pod)
 	if !ok {
-		return nil, cnpgRefuse(http.StatusNotFound, "", "%s is not an instance of Cluster %s/%s", pod, namespace, name)
+		return nil, refuseAction(http.StatusNotFound, "", "%s is not an instance of Cluster %s/%s", pod, namespace, name)
 	}
 	plan := &CNPGDestroyPlan{
 		UID: string(cluster.GetUID()), Context: contextName, Facts: facts,
@@ -270,13 +270,14 @@ func (s *Server) cnpgDestroyPlan(r *http.Request, c cnpgActionClients, contextNa
 	if guard == "" && !plan.PVCsReadable {
 		guard = "The instance's PVCs cannot be read (" + plan.PVCReason + "), so they cannot be reviewed"
 	}
-	cap := func(keep bool) CNPGActionCapability {
+	cap := func(keep bool) ActionCapability {
 		gs := cnpgDestroyGrants(keep)
 		ps := make([]string, len(gs))
 		for i, g := range gs {
-			ps[i] = s.cnpgPermission(r, g, namespace)
+			gs[i] = g.In(namespace)
+			ps[i] = s.grantPermission(r, gs[i])
 		}
-		return cnpgCapability(guard, namespace, ps, gs)
+		return capabilityVerdict(guard, ps, gs)
 	}
 	plan.Actions.Delete = cap(false)
 	plan.Actions.Keep = cap(true)
@@ -299,24 +300,24 @@ type cnpgDestroyParams struct {
 
 func cnpgRunDestroyInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 	var p cnpgDestroyParams
-	if err := decodeCNPGParams(x.params, &p); err != nil {
+	if err := decodeActionParams(x.params, &p); err != nil {
 		return nil, err
 	}
 	if p.Pod == "" || p.PVCs == nil {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "params.pod, params.podUID and params.pvcs are required: the confirmation must bind the Pod and volumes reviewed")
+		return nil, refuseAction(http.StatusBadRequest, "", "params.pod, params.podUID and params.pvcs are required: the confirmation must bind the Pod and volumes reviewed")
 	}
 	inst, ok := x.facts.instance(p.Pod)
 	if !ok {
-		return nil, cnpgChanged(x.facts, "%s is not an instance of this cluster", p.Pod)
+		return nil, changedAction(x.facts, "%s is not an instance of this cluster", p.Pod)
 	}
 	if r := cnpgGuardDestroyInstance(x.facts, inst); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
 	if !inst.PodReadable {
-		return nil, cnpgRefuse(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
+		return nil, refuseAction(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
 	}
 	if inst.PodUID != p.PodUID {
-		return nil, cnpgChanged(x.facts, "Pod %s changed since you reviewed it", p.Pod)
+		return nil, changedAction(x.facts, "Pod %s changed since you reviewed it", p.Pod)
 	}
 	if err := cnpgDestroyPreflight(ctx, x, p.KeepPVC); err != nil {
 		return nil, err
@@ -331,7 +332,7 @@ func cnpgRunDestroyInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGAction
 		now = append(now, cnpgReviewedPVC{Name: v.Name, UID: string(v.UID)})
 	}
 	if !cnpgSamePVCs(now, *p.PVCs) {
-		return nil, cnpgChanged(x.facts, "The volumes of %s changed since you reviewed them (now: %s); review the action again", p.Pod, cnpgPVCList(now))
+		return nil, changedAction(x.facts, "The volumes of %s changed since you reviewed them (now: %s); review the action again", p.Pod, cnpgPVCList(now))
 	}
 
 	// CloudNativePG offers no lock against a failover, so the instance is
@@ -343,7 +344,7 @@ func cnpgRunDestroyInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGAction
 		if len(completed) == 0 {
 			return err
 		}
-		return cnpgPartial(completed, err)
+		return partialAction(completed, err)
 	}
 	recheck := func() error {
 		fresh, err := x.c.dyn.Resource(cnpgClusterGVR).Namespace(namespace).Get(ctx, cluster, metav1.GetOptions{})
@@ -352,10 +353,10 @@ func cnpgRunDestroyInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGAction
 		}
 		facts, _ := cnpgClusterFactsOf(ctx, nil, fresh)
 		if fresh.GetUID() != clusterUID {
-			return cnpgChanged(facts, "Cluster %s/%s was deleted and recreated; nothing further was done", namespace, cluster)
+			return changedAction(facts, "Cluster %s/%s was deleted and recreated; nothing further was done", namespace, cluster)
 		}
 		if r := cnpgGuardDestroyInstance(facts, CNPGInstanceFact{Pod: p.Pod}); r != "" {
-			return cnpgChanged(facts, "%s can no longer be destroyed: %s", p.Pod, r)
+			return changedAction(facts, "%s can no longer be destroyed: %s", p.Pod, r)
 		}
 		pod, err := x.c.typed.CoreV1().Pods(namespace).Get(ctx, p.Pod, metav1.GetOptions{})
 		switch {
@@ -366,9 +367,9 @@ func cnpgRunDestroyInstance(ctx context.Context, x *cnpgClusterRun) (*CNPGAction
 		case podDeleted:
 			return nil
 		case string(pod.UID) != p.PodUID:
-			return cnpgChanged(facts, "Pod %s was replaced since you reviewed it", p.Pod)
+			return changedAction(facts, "Pod %s was replaced since you reviewed it", p.Pod)
 		case cnpgPodLabelledPrimary(pod):
-			return cnpgChanged(facts, "%s is now labelled primary: it can no longer be destroyed", p.Pod)
+			return changedAction(facts, "%s is now labelled primary: it can no longer be destroyed", p.Pod)
 		}
 		return nil
 	}
@@ -516,7 +517,7 @@ func cnpgLiftDestroyedFence(ctx context.Context, x *cnpgClusterRun, pod string)
 	if err != nil {
 		return false, err
 	}
-	err = cnpgMergePatch(ctx, x.c.dyn, cnpgClusterGVR, fresh, map[string]any{
+	err = mergePatchAtVersion(ctx, x.c.dyn, cnpgClusterGVR, fresh, map[string]any{
 		"metadata": map[string]any{"annotations": map[string]any{cnpgFencedAnnotation: value}},
 	})
 	return err == nil, err
diff --git a/internal/server/cnpg_errors_test.go b/internal/server/cnpg_errors_test.go
index 9be4db9ae7..462d01b5af 100644
--- a/internal/server/cnpg_errors_test.go
+++ b/internal/server/cnpg_errors_test.go
@@ -194,11 +194,11 @@ func TestCNPGNoPrometheusReasonIsOneSentence(t *testing.T) {
 }
 
 func TestCNPGGrantClusterStringHasNoNestedParentheses(t *testing.T) {
-	g := cnpgGrant{"get", "admissionregistration.k8s.io", "mutatingwebhookconfigurations", ""}
-	if got := g.ClusterString(); got != "get mutatingwebhookconfigurations.admissionregistration.k8s.io cluster-wide" {
+	g := Grant{Verb: "get", Group: "admissionregistration.k8s.io", Resource: "mutatingwebhookconfigurations"}
+	if got := g.String(); got != "get mutatingwebhookconfigurations.admissionregistration.k8s.io cluster-wide" {
 		t.Errorf("ClusterString = %q", got)
 	}
-	if got := (cnpgGrant{"get", "", "nodes", ""}).ClusterString(); got != "get nodes cluster-wide" {
+	if got := (Grant{Verb: "get", Resource: "nodes"}).String(); got != "get nodes cluster-wide" {
 		t.Errorf("core = %q", got)
 	}
 }
diff --git a/internal/server/cnpg_local_cani_test.go b/internal/server/cnpg_local_cani_test.go
index 7735787722..f8e72fddbc 100644
--- a/internal/server/cnpg_local_cani_test.go
+++ b/internal/server/cnpg_local_cani_test.go
@@ -33,17 +33,17 @@ func TestCNPGLocalCanIAsksTheKubeconfigIdentity(t *testing.T) {
 	}
 	previous := k8s.SetTestClient(client)
 	t.Cleanup(func() { k8s.SetTestClient(previous) })
-	cnpgLocalCanIMu.Lock()
-	cnpgLocalCanIMemo = map[string]cnpgLocalCanIEntry{}
-	cnpgLocalCanIMu.Unlock()
+	localCanIMu.Lock()
+	localCanIMemo = map[string]localCanIEntry{}
+	localCanIMu.Unlock()
 
-	if allowed, known := cnpgLocalCanI(context.Background(), cnpgGrantGetPodsProxy, "pgrt"); allowed || !known {
+	if allowed, known := localCanI(context.Background(), cnpgGrantGetPodsProxy.In("pgrt")); allowed || !known {
 		t.Fatalf("pods/proxy = %v known=%v, want denied", allowed, known)
 	}
-	if allowed, known := cnpgLocalCanI(context.Background(), cnpgGrantCreateBackups, "pgrt"); !allowed || !known {
+	if allowed, known := localCanI(context.Background(), cnpgGrantCreateBackups.In("pgrt")); !allowed || !known {
 		t.Fatalf("create backups = %v known=%v, want allowed", allowed, known)
 	}
-	cnpgLocalCanI(context.Background(), cnpgGrantGetPodsProxy, "pgrt")
+	localCanI(context.Background(), cnpgGrantGetPodsProxy.In("pgrt"))
 	if calls.Load() != 2 {
 		t.Errorf("reviews = %d, want the repeat answered from the memo", calls.Load())
 	}
diff --git a/internal/server/cnpg_operator_diagnosis.go b/internal/server/cnpg_operator_diagnosis.go
index b4522f4f13..20e362c030 100644
--- a/internal/server/cnpg_operator_diagnosis.go
+++ b/internal/server/cnpg_operator_diagnosis.go
@@ -38,12 +38,12 @@ const (
 )
 
 var (
-	cnpgGrantGetLeases        = cnpgGrant{"get", "coordination.k8s.io", "leases", ""}
-	cnpgGrantListLeases       = cnpgGrant{"list", "coordination.k8s.io", "leases", ""}
-	cnpgGrantGetMutatingWH    = cnpgGrant{"get", "admissionregistration.k8s.io", "mutatingwebhookconfigurations", ""}
-	cnpgGrantGetValidatingWH  = cnpgGrant{"get", "admissionregistration.k8s.io", "validatingwebhookconfigurations", ""}
-	cnpgGrantListEndpointSlcs = cnpgGrant{"list", "discovery.k8s.io", "endpointslices", ""}
-	cnpgGrantGetPodsProxy     = cnpgGrant{"get", "", "pods", "proxy"}
+	cnpgGrantGetLeases        = Grant{Verb: "get", Group: "coordination.k8s.io", Resource: "leases"}
+	cnpgGrantListLeases       = Grant{Verb: "list", Group: "coordination.k8s.io", Resource: "leases"}
+	cnpgGrantGetMutatingWH    = Grant{Verb: "get", Group: "admissionregistration.k8s.io", Resource: "mutatingwebhookconfigurations"}
+	cnpgGrantGetValidatingWH  = Grant{Verb: "get", Group: "admissionregistration.k8s.io", Resource: "validatingwebhookconfigurations"}
+	cnpgGrantListEndpointSlcs = Grant{Verb: "list", Group: "discovery.k8s.io", Resource: "endpointslices"}
+	cnpgGrantGetPodsProxy     = Grant{Verb: "get", Resource: "pods", Subresource: "proxy"}
 )
 
 type CNPGOperatorPod struct {
@@ -143,13 +143,6 @@ type CNPGOperatorDiagnosis struct {
 	Events      CNPGOperatorEvents           `json:"events"`
 }
 
-func cnpgGrantText(g cnpgGrant, namespace string) string {
-	if namespace == "" {
-		return g.ClusterString()
-	}
-	return g.String(namespace)
-}
-
 func (s *Server) cnpgOperatorDiagnoses(r *http.Request, operators []*appsv1.Deployment) []CNPGOperatorDiagnosis {
 	out := []CNPGOperatorDiagnosis{}
 	typed := s.getClientForRequest(r)
@@ -346,18 +339,15 @@ func (s *Server) cnpgOperatorWebhooks(r *http.Request, typed kubernetes.Interfac
 	configs := []CNPGOperatorWebhookConfig{}
 	type svcKey struct{ ns, name string }
 	svcs := map[svcKey]bool{}
-	add := func(kind, name string, g cnpgGrant, read func() ([]admissionv1.WebhookClientConfig, []string, []string, error)) {
+	add := func(kind, name string, g Grant, read func() ([]admissionv1.WebhookClientConfig, []string, []string, error)) {
 		cfg := CNPGOperatorWebhookConfig{Kind: kind, Name: name, Webhooks: []CNPGOperatorWebhook{}}
-		if s.cnpgPermission(r, g, "") == cnpgPermDenied {
-			cfg.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantText(g, "")}
+		if s.grantPermission(r, g) == permissionDenied {
+			cfg.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadDenied, Grant: g.String()}
 			configs = append(configs, cfg)
 			return
 		}
 		clients, names, policies, err := read()
 		cfg.CNPGReadCoverage = cnpgReadOutcome(err, g, "")
-		if cfg.State == cnpgReadDenied {
-			cfg.Grant = cnpgGrantText(g, "")
-		}
 		for i, cc := range clients {
 			wh := CNPGOperatorWebhook{Name: names[i], FailurePolicy: policies[i], CABundleSet: len(cc.CABundle) > 0, URL: cc.URL != nil}
 			if cc.Service != nil {
@@ -461,7 +451,7 @@ func (s *Server) cnpgOperatorReconcile(r *http.Request, d *appsv1.Deployment, po
 	if len(pods) == 0 {
 		return out
 	}
-	allowed := s.cnpgPermission(r, cnpgGrantGetPodsProxy, d.Namespace) != cnpgPermDenied
+	allowed := s.grantPermission(r, cnpgGrantGetPodsProxy.In(d.Namespace)) != permissionDenied
 	var client kubernetes.Interface
 	if allowed {
 		client = cnpgRuntimeClient(r)
@@ -476,7 +466,7 @@ func (s *Server) cnpgOperatorReconcile(r *http.Request, d *appsv1.Deployment, po
 		res.StartedAt = cnpgOperatorProcessStart(p, container)
 		switch {
 		case !allowed:
-			res.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgRuntimeStateDenied, Error: "reading the operator's metrics needs " + cnpgGrantGetPodsProxy.String(d.Namespace)}
+			res.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgRuntimeStateDenied, Error: "reading the operator's metrics needs " + cnpgGrantGetPodsProxy.In(d.Namespace).String()}
 			continue
 		case client == nil:
 			res.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgRuntimeStateError, Error: "cluster client unavailable"}
diff --git a/internal/server/cnpg_operator_status.go b/internal/server/cnpg_operator_status.go
index d6ece27a80..b320254bfa 100644
--- a/internal/server/cnpg_operator_status.go
+++ b/internal/server/cnpg_operator_status.go
@@ -340,7 +340,7 @@ func (f cnpgOperatorFacts) verdict(namespace string) CNPGOperatorVerdict {
 // cnpgOperatorWebhookGuard refuses a write that goes through a CNPG admission
 // webhook the API server cannot reach; status subresource patches and Pod
 // deletes do not, so those actions keep their verdict.
-func cnpgOperatorWebhookGuard(v CNPGOperatorVerdict, capability CNPGActionCapability) CNPGActionCapability {
+func cnpgOperatorWebhookGuard(v CNPGOperatorVerdict, capability ActionCapability) ActionCapability {
 	if !capability.Allowed || v.WebhookRejects == nil || !*v.WebhookRejects {
 		return capability
 	}
diff --git a/internal/server/cnpg_operator_status_test.go b/internal/server/cnpg_operator_status_test.go
index 642d4aac2c..83106a50ff 100644
--- a/internal/server/cnpg_operator_status_test.go
+++ b/internal/server/cnpg_operator_status_test.go
@@ -135,8 +135,8 @@ func TestCNPGOperatorFactsVerdict(t *testing.T) {
 }
 
 func TestCNPGApplyOperatorGuard(t *testing.T) {
-	allowed := CNPGActionCapability{Allowed: true, Permission: cnpgPermAllowed}
-	refused := CNPGActionCapability{Reason: "The cluster is hibernated", Permission: cnpgPermAllowed}
+	allowed := ActionCapability{Allowed: true, Permission: permissionAllowed}
+	refused := ActionCapability{Reason: "The cluster is hibernated", Permission: permissionAllowed}
 	rejects := true
 	resp := &CNPGClusterCapabilitiesResponse{
 		Operator: CNPGOperatorVerdict{State: cnpgOperatorNotReconciling, WebhookRejects: &rejects, WebhookReason: "the admission webhook Service cnpg-system/cnpg-webhook-service has no ready endpoint"},
diff --git a/internal/server/cnpg_pooler_actions.go b/internal/server/cnpg_pooler_actions.go
index bc5bcd33d3..0cc907ce61 100644
--- a/internal/server/cnpg_pooler_actions.go
+++ b/internal/server/cnpg_pooler_actions.go
@@ -58,10 +58,10 @@ type CNPGPoolerFacts struct {
 }
 
 type CNPGPoolerActions struct {
-	Pause  CNPGActionCapability `json:"pause"`
-	Resume CNPGActionCapability `json:"resume"`
+	Pause  ActionCapability `json:"pause"`
+	Resume ActionCapability `json:"resume"`
 	// ObserveState is reading each PgBouncer's paused state (pods/exec).
-	ObserveState CNPGActionCapability `json:"observeState"`
+	ObserveState ActionCapability `json:"observeState"`
 }
 
 // CNPGPoolerCapabilitiesResponse is GET /api/cnpg/poolers/{ns}/{name}/capabilities.
@@ -170,8 +170,9 @@ func (s *Server) cnpgPoolerCapabilities(r *http.Request, c cnpgActionClients, co
 		return nil, err
 	}
 	f := cnpgPoolerFactsOf(r.Context(), c, pooler)
-	one := func(guard string, g cnpgGrant) CNPGActionCapability {
-		return cnpgCapability(guard, namespace, []string{s.cnpgPermission(r, g, namespace)}, []cnpgGrant{g})
+	one := func(guard string, g Grant) ActionCapability {
+		g = g.In(namespace)
+		return capabilityVerdict(guard, []string{s.grantPermission(r, g)}, []Grant{g})
 	}
 	return &CNPGPoolerCapabilitiesResponse{
 		UID:             string(pooler.GetUID()),
@@ -199,7 +200,7 @@ func (s *Server) handleCNPGPoolerAction(w http.ResponseWriter, r *http.Request)
 		s.writeError(w, http.StatusBadRequest, fmt.Sprintf("unknown Pooler action %q: must be pause or resume", action))
 		return
 	}
-	req, dyn, ok := s.decodeCNPGActionRequest(w, r)
+	req, dyn, ok := s.decodeActionRequest(w, r)
 	if !ok {
 		return
 	}
@@ -214,17 +215,17 @@ func (s *Server) handleCNPGPoolerAction(w http.ResponseWriter, r *http.Request)
 	s.writeJSON(w, res)
 }
 
-func runCNPGPoolerAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req CNPGActionRequest) (*CNPGActionResult, error) {
+func runCNPGPoolerAction(ctx context.Context, c cnpgActionClients, namespace, name, action string, req ActionRequest) (*CNPGActionResult, error) {
 	var reviewed cnpgPoolerReviewed
 	if len(req.Facts) > 0 {
 		if err := json.Unmarshal(req.Facts, &reviewed); err != nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "facts: %v", err)
+			return nil, refuseAction(http.StatusBadRequest, "", "facts: %v", err)
 		}
 	}
 	if reviewed.Paused == nil {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "facts.paused is required for %s: the confirmation must bind what the dialog showed", action)
+		return nil, refuseAction(http.StatusBadRequest, "", "facts.paused is required for %s: the confirmation must bind what the dialog showed", action)
 	}
-	if err := decodeCNPGParams(req.Params, &struct{}{}); err != nil {
+	if err := decodeActionParams(req.Params, &struct{}{}); err != nil {
 		return nil, err
 	}
 	pooler, err := c.dyn.Resource(cnpgPoolerGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
@@ -233,21 +234,21 @@ func runCNPGPoolerAction(ctx context.Context, c cnpgActionClients, namespace, na
 	}
 	facts := cnpgPoolerFactsOf(ctx, cnpgActionClients{dyn: c.dyn}, pooler)
 	if string(pooler.GetUID()) != req.UID {
-		return nil, cnpgChanged(facts, "Pooler %s/%s was deleted and recreated since you reviewed it", namespace, name)
+		return nil, changedAction(facts, "Pooler %s/%s was deleted and recreated since you reviewed it", namespace, name)
 	}
 	if *reviewed.Paused != facts.Paused {
-		return nil, cnpgChanged(facts, "Pooler %s/%s changed since you confirmed (paused); review the action again", namespace, name)
+		return nil, changedAction(facts, "Pooler %s/%s changed since you confirmed (paused); review the action again", namespace, name)
 	}
 	pause := action == "pause"
 	if r := cnpgGuardPooler(facts, pause); r != "" {
-		return nil, cnpgBlocked(r)
+		return nil, blockedAction(r)
 	}
-	err = cnpgMergePatch(ctx, c.dyn, cnpgPoolerGVR, pooler, map[string]any{"spec": map[string]any{"pgbouncer": map[string]any{"paused": pause}}})
+	err = mergePatchAtVersion(ctx, c.dyn, cnpgPoolerGVR, pooler, map[string]any{"spec": map[string]any{"pgbouncer": map[string]any{"paused": pause}}})
 	if apierrors.IsConflict(err) {
 		if fresh, gerr := c.dyn.Resource(cnpgPoolerGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}); gerr == nil {
 			facts = cnpgPoolerFactsOf(ctx, cnpgActionClients{dyn: c.dyn}, fresh)
 		}
-		return nil, cnpgChanged(facts, "Pooler %s/%s changed while the request was being sent; review the action again", namespace, name)
+		return nil, changedAction(facts, "Pooler %s/%s changed while the request was being sent; review the action again", namespace, name)
 	}
 	if err != nil {
 		return nil, err
@@ -332,13 +333,13 @@ func (s *Server) handleCNPGPgBouncerState(w http.ResponseWriter, r *http.Request
 	resp := CNPGPgBouncerStateResponse{
 		Pooler:     CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: pooler.GetUID()},
 		SampledAt:  time.Now().UTC().Format(time.RFC3339),
-		Permission: CNPGExecPermission{Exec: s.cnpgPermission(r, cnpgGrantCreateExec, namespace), Grant: cnpgGrantCreateExec.String(namespace)},
+		Permission: CNPGExecPermission{Exec: s.grantPermission(r, cnpgGrantCreateExec.In(namespace)), Grant: cnpgGrantCreateExec.In(namespace).String()},
 		Pods:       make([]CNPGPgBouncerState, len(pods)),
 	}
 	for i, p := range pods {
 		resp.Pods[i].Pod = p.Name
 	}
-	if resp.Permission.Exec == cnpgPermDenied {
+	if resp.Permission.Exec == permissionDenied {
 		for i := range resp.Pods {
 			resp.Pods[i].CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading PgBouncer state needs " + resp.Permission.Grant}
 		}
@@ -361,7 +362,7 @@ func (s *Server) handleCNPGPgBouncerState(w http.ResponseWriter, r *http.Request
 	run.wait()
 	for _, p := range resp.Pods {
 		if p.State == cnpgExecStateDenied {
-			resp.Permission.Exec = cnpgPermDenied
+			resp.Permission.Exec = permissionDenied
 		}
 	}
 	s.writeJSON(w, resp)
diff --git a/internal/server/cnpg_recovery.go b/internal/server/cnpg_recovery.go
index c6e2e6d2f2..4552da7f5e 100644
--- a/internal/server/cnpg_recovery.go
+++ b/internal/server/cnpg_recovery.go
@@ -46,9 +46,9 @@ const (
 )
 
 var (
-	cnpgGrantListPods   = cnpgGrant{"list", "", "pods", ""}
-	cnpgGrantListEvents = cnpgGrant{"list", "", "events", ""}
-	cnpgGrantGetCluster = cnpgGrant{"get", cnpgGroup, "clusters", ""}
+	cnpgGrantListPods   = Grant{Verb: "list", Resource: "pods"}
+	cnpgGrantListEvents = Grant{Verb: "list", Resource: "events"}
+	cnpgGrantGetCluster = Grant{Verb: "get", Group: cnpgGroup, Resource: "clusters"}
 )
 
 // CNPGReadCoverage is one read's outcome. Grant names what a denied read
@@ -62,19 +62,19 @@ type CNPGReadCoverage struct {
 // cnpgGatedRead runs read when the caller holds g in namespace. The SAR comes
 // first so a denial names the grant; the read itself is made with the caller's
 // client, so the apiserver has the final say either way.
-func (s *Server) cnpgGatedRead(r *http.Request, g cnpgGrant, namespace string, read func() error) CNPGReadCoverage {
-	if s.cnpgPermission(r, g, namespace) == cnpgPermDenied {
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.String(namespace)}
+func (s *Server) cnpgGatedRead(r *http.Request, g Grant, namespace string, read func() error) CNPGReadCoverage {
+	if s.grantPermission(r, g.In(namespace)) == permissionDenied {
+		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).String()}
 	}
 	return cnpgReadOutcome(read(), g, namespace)
 }
 
-func cnpgReadOutcome(err error, g cnpgGrant, namespace string) CNPGReadCoverage {
+func cnpgReadOutcome(err error, g Grant, namespace string) CNPGReadCoverage {
 	switch {
 	case err == nil:
 		return CNPGReadCoverage{State: cnpgReadOK}
 	case apierrors.IsForbidden(err):
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.String(namespace)}
+		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).String()}
 	case apierrors.IsNotFound(err):
 		return CNPGReadCoverage{State: cnpgReadNotFound, Reason: err.Error()}
 	default:
@@ -224,12 +224,12 @@ func (s *Server) handleCNPGClusterRecovery(w http.ResponseWriter, r *http.Reques
 	s.writeJSON(w, resp)
 }
 
-func (s *Server) writeCNPGReadError(w http.ResponseWriter, err error, g cnpgGrant, namespace, name string) {
+func (s *Server) writeCNPGReadError(w http.ResponseWriter, err error, g Grant, namespace, name string) {
 	switch {
 	case apierrors.IsNotFound(err):
 		s.writeError(w, http.StatusNotFound, fmt.Sprintf("CloudNativePG Cluster %s/%s not found", namespace, name))
 	case apierrors.IsForbidden(err):
-		s.writeError(w, http.StatusForbidden, "This needs "+g.String(namespace))
+		s.writeError(w, http.StatusForbidden, "This needs "+g.In(namespace).String())
 	default:
 		log.Printf("[cnpg] Failed to read Cluster %s/%s: %v", sanitizeForLog(namespace), sanitizeForLog(name), err)
 		s.writeError(w, http.StatusInternalServerError, "failed to read CloudNativePG Cluster: "+err.Error())
@@ -534,13 +534,13 @@ func (s *Server) handleCNPGRestoreValidation(w http.ResponseWriter, r *http.Requ
 		return
 	}
 	namespace, name := chi.URLParam(r, "namespace"), chi.URLParam(r, "name")
-	req, dyn, ok := s.decodeCNPGActionRequest(w, r)
+	req, dyn, ok := s.decodeActionRequest(w, r)
 	if !ok {
 		return
 	}
 	auth.AuditLog(r, namespace, name)
-	if s.cnpgPermission(r, cnpgGrantPatchClusters, namespace) == cnpgPermDenied {
-		s.writeError(w, http.StatusForbidden, "Recording a validation note needs "+cnpgGrantPatchClusters.String(namespace))
+	if s.grantPermission(r, cnpgGrantPatchClusters.In(namespace)) == permissionDenied {
+		s.writeError(w, http.StatusForbidden, "Recording a validation note needs "+cnpgGrantPatchClusters.In(namespace).String())
 		return
 	}
 	recordedBy := ""
@@ -556,21 +556,21 @@ func (s *Server) handleCNPGRestoreValidation(w http.ResponseWriter, r *http.Requ
 	s.writeJSON(w, note)
 }
 
-func recordCNPGRestoreValidation(ctx context.Context, dyn dynamic.Interface, namespace, name string, req CNPGActionRequest, recordedBy string, now time.Time) (*CNPGRestoreValidation, error) {
+func recordCNPGRestoreValidation(ctx context.Context, dyn dynamic.Interface, namespace, name string, req ActionRequest, recordedBy string, now time.Time) (*CNPGRestoreValidation, error) {
 	var params cnpgRestoreValidationParams
-	if err := decodeCNPGParams(req.Params, &params); err != nil {
+	if err := decodeActionParams(req.Params, &params); err != nil {
 		return nil, err
 	}
 	checked := strings.TrimSpace(params.Checked)
 	if checked == "" {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "params.checked is required: say what you checked")
+		return nil, refuseAction(http.StatusBadRequest, "", "params.checked is required: say what you checked")
 	}
 	if utf8.RuneCountInString(checked) > cnpgRestoreValidationMax {
-		return nil, cnpgRefuse(http.StatusBadRequest, "", "params.checked is longer than %d characters", cnpgRestoreValidationMax)
+		return nil, refuseAction(http.StatusBadRequest, "", "params.checked is longer than %d characters", cnpgRestoreValidationMax)
 	}
 	if params.TargetTime != "" {
 		if _, err := time.Parse(time.RFC3339, params.TargetTime); err != nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "params.targetTime must be RFC 3339")
+			return nil, refuseAction(http.StatusBadRequest, "", "params.targetTime must be RFC 3339")
 		}
 	}
 	cluster, err := dyn.Resource(cnpgClusterGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
@@ -578,10 +578,10 @@ func recordCNPGRestoreValidation(ctx context.Context, dyn dynamic.Interface, nam
 		return nil, err
 	}
 	if string(cluster.GetUID()) != req.UID {
-		return nil, cnpgChanged(nil, "Cluster %s/%s was deleted and recreated since you reviewed it", namespace, name)
+		return nil, changedAction(nil, "Cluster %s/%s was deleted and recreated since you reviewed it", namespace, name)
 	}
 	if cnpgRecoverySpecOf(cluster) == nil {
-		return nil, cnpgBlocked("This Cluster was not bootstrapped from a backup (spec.bootstrap.recovery is not set)")
+		return nil, blockedAction("This Cluster was not bootstrapped from a backup (spec.bootstrap.recovery is not set)")
 	}
 	note := &CNPGRestoreValidation{
 		Version:    1,
@@ -606,11 +606,11 @@ func recordCNPGRestoreValidation(ctx context.Context, dyn dynamic.Interface, nam
 	if err != nil {
 		return nil, err
 	}
-	if err := cnpgMergePatch(ctx, dyn, cnpgClusterGVR, cluster, map[string]any{
+	if err := mergePatchAtVersion(ctx, dyn, cnpgClusterGVR, cluster, map[string]any{
 		"metadata": map[string]any{"annotations": map[string]any{cnpgRestoreValidationAnno: string(data)}},
 	}); err != nil {
 		if apierrors.IsConflict(err) {
-			return nil, cnpgChanged(nil, "Cluster %s/%s changed while the note was being recorded; try again", namespace, name)
+			return nil, changedAction(nil, "Cluster %s/%s changed while the note was being recorded; try again", namespace, name)
 		}
 		return nil, err
 	}
@@ -633,8 +633,8 @@ func (s *Server) handleCNPGRestoreCapability(w http.ResponseWriter, r *http.Requ
 	s.writeJSON(w, s.cnpgRestoreCapability(r, namespace))
 }
 
-func (s *Server) cnpgRestoreCapability(r *http.Request, namespace string) CNPGActionCapability {
-	g := cnpgGrantCreateClusters
-	c := cnpgCapability("", namespace, []string{s.cnpgPermission(r, g, namespace)}, []cnpgGrant{g})
+func (s *Server) cnpgRestoreCapability(r *http.Request, namespace string) ActionCapability {
+	g := cnpgGrantCreateClusters.In(namespace)
+	c := capabilityVerdict("", []string{s.grantPermission(r, g)}, []Grant{g})
 	return cnpgOperatorWebhookGuard(s.cnpgOperatorVerdictFor(r, namespace), c)
 }
diff --git a/internal/server/cnpg_recovery_test.go b/internal/server/cnpg_recovery_test.go
index c054328aa2..06a2a29913 100644
--- a/internal/server/cnpg_recovery_test.go
+++ b/internal/server/cnpg_recovery_test.go
@@ -172,7 +172,7 @@ func TestRecordCNPGRestoreValidationRefusals(t *testing.T) {
 	now := time.Now()
 	if _, err := recordCNPGRestoreValidation(context.Background(), env.dyn, "db", "pg", cnpgActionReq(t, nil, map[string]any{"checked": "x"}), "", now); err == nil {
 		t.Fatal("a Cluster that was not restored cannot carry a validation note")
-	} else if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+	} else if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 		t.Fatalf("want blocked, got %v", err)
 	}
 	env = newCNPGActionEnv(t, []runtime.Object{cnpgRestoredCluster()})
@@ -456,14 +456,14 @@ func TestHandleCNPGRestoreCapability(t *testing.T) {
 		if w.Code != http.StatusOK {
 			t.Fatalf("status %d: %s", w.Code, w.Body.String())
 		}
-		var got CNPGActionCapability
+		var got ActionCapability
 		if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
 			t.Fatal(err)
 		}
-		if allowed && (!got.Allowed || got.Permission != cnpgPermAllowed) {
+		if allowed && (!got.Allowed || got.Permission != permissionAllowed) {
 			t.Errorf("allowed = %+v", got)
 		}
-		if !allowed && (got.Allowed || got.Permission != cnpgPermDenied || got.Grant != "create clusters (postgresql.cnpg.io) in namespace db" || !strings.Contains(got.Reason, got.Grant)) {
+		if !allowed && (got.Allowed || got.Permission != permissionDenied || got.Grant != "create clusters (postgresql.cnpg.io) in namespace db" || !strings.Contains(got.Reason, got.Grant)) {
 			t.Errorf("denied = %+v, want the grant named", got)
 		}
 	}
@@ -479,7 +479,7 @@ func TestHandleCNPGRestoreCapability(t *testing.T) {
 func TestCNPGRestoreCapabilityRefusedWhileWebhookRejects(t *testing.T) {
 	rejects := true
 	got := cnpgOperatorWebhookGuard(CNPGOperatorVerdict{WebhookRejects: &rejects, WebhookReason: "the validating webhook has no ready endpoint"},
-		cnpgCapability("", "db", []string{cnpgPermAllowed}, []cnpgGrant{cnpgGrantCreateClusters}))
+		capabilityVerdict("", []string{permissionAllowed}, []Grant{cnpgGrantCreateClusters.In("db")}))
 	if got.Allowed || !strings.Contains(got.Reason, "no ready endpoint") {
 		t.Errorf("restore while the webhook rejects = %+v", got)
 	}
diff --git a/internal/server/cnpg_report.go b/internal/server/cnpg_report.go
index 0699e6a536..745b42c203 100644
--- a/internal/server/cnpg_report.go
+++ b/internal/server/cnpg_report.go
@@ -54,11 +54,11 @@ const (
 var (
 	errCNPGReportFull        = errors.New("report size bound reached")
 	cnpgObjectStoreGVR       = schema.GroupVersionResource{Group: cnpgBarmanGroup, Version: "v1", Resource: "objectstores"}
-	cnpgGrantListBackups     = cnpgGrant{"list", cnpgGroup, "backups", ""}
-	cnpgGrantListSchedules   = cnpgGrant{"list", cnpgGroup, "scheduledbackups", ""}
-	cnpgGrantListPoolers     = cnpgGrant{"list", cnpgGroup, "poolers", ""}
-	cnpgGrantGetObjectStores = cnpgGrant{"get", cnpgBarmanGroup, "objectstores", ""}
-	cnpgGrantGetPodLogs      = cnpgGrant{"get", "", "pods", "log"}
+	cnpgGrantListBackups     = Grant{Verb: "list", Group: cnpgGroup, Resource: "backups"}
+	cnpgGrantListSchedules   = Grant{Verb: "list", Group: cnpgGroup, Resource: "scheduledbackups"}
+	cnpgGrantListPoolers     = Grant{Verb: "list", Group: cnpgGroup, Resource: "poolers"}
+	cnpgGrantGetObjectStores = Grant{Verb: "get", Group: cnpgBarmanGroup, Resource: "objectstores"}
+	cnpgGrantGetPodLogs      = Grant{Verb: "get", Resource: "pods", Subresource: "log"}
 )
 
 type cnpgReportOptions struct {
@@ -363,7 +363,7 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 	for _, child := range []struct {
 		item, file string
 		gvr        schema.GroupVersionResource
-		grant      cnpgGrant
+		grant      Grant
 		kind       string
 	}{
 		{"Backups", "manifests/backups.yaml", cnpgBackupGVR, cnpgGrantListBackups, "Backup"},
@@ -562,8 +562,8 @@ func cnpgReportStripOperatorConfig(body []byte) []byte {
 
 func (b *cnpgReportBuilder) logs(pods []corev1.Pod, opts cnpgReportOptions) {
 	namespace := b.cluster.GetNamespace()
-	if b.s.cnpgPermission(b.r, cnpgGrantGetPodLogs, namespace) == cnpgPermDenied {
-		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.String(namespace)}})
+	if b.s.grantPermission(b.r, cnpgGrantGetPodLogs.In(namespace)) == permissionDenied {
+		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.In(namespace).String()}})
 		return
 	}
 	note := "query text inside PostgreSQL log records is omitted"
diff --git a/internal/server/cnpg_runtime.go b/internal/server/cnpg_runtime.go
index 38df0f52cb..a08ede7086 100644
--- a/internal/server/cnpg_runtime.go
+++ b/internal/server/cnpg_runtime.go
@@ -490,7 +490,7 @@ func (s *Server) handleCNPGClusterRuntime(w http.ResponseWriter, r *http.Request
 		return
 	}
 
-	proxyAllowed := s.cnpgPermission(r, cnpgGrantGetPodsProxy, namespace) != cnpgPermDenied
+	proxyAllowed := s.grantPermission(r, cnpgGrantGetPodsProxy.In(namespace)) != permissionDenied
 	fenced := parseCNPGFenced(cluster.GetAnnotations()[cnpgFencedAnnotation])
 	resp := CNPGClusterRuntimeResponse{
 		Cluster:    CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: cluster.GetUID()},
@@ -594,7 +594,7 @@ func (s *Server) handleCNPGPoolerRuntime(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	proxyAllowed := s.cnpgPermission(r, cnpgGrantGetPodsProxy, namespace) != cnpgPermDenied
+	proxyAllowed := s.grantPermission(r, cnpgGrantGetPodsProxy.In(namespace)) != permissionDenied
 	resp := CNPGPoolerRuntimeResponse{
 		Pooler:     CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: pooler.GetUID()},
 		SampledAt:  time.Now().UTC().Format(time.RFC3339),
diff --git a/internal/server/cnpg_runtime_test.go b/internal/server/cnpg_runtime_test.go
index dd0dc31018..6872693d9b 100644
--- a/internal/server/cnpg_runtime_test.go
+++ b/internal/server/cnpg_runtime_test.go
@@ -405,9 +405,9 @@ func useCNPGProxyAPIServer(t *testing.T, handle func(w http.ResponseWriter, c cn
 	}
 	previousClient := k8s.SetTestClient(client)
 	t.Cleanup(func() { k8s.SetTestClient(previousClient) })
-	cnpgLocalCanIMu.Lock()
-	cnpgLocalCanIMemo = map[string]cnpgLocalCanIEntry{}
-	cnpgLocalCanIMu.Unlock()
+	localCanIMu.Lock()
+	localCanIMemo = map[string]localCanIEntry{}
+	localCanIMu.Unlock()
 	resetCNPGRuntimeMemo(t)
 	return f
 }
diff --git a/internal/server/cnpg_schedule_test.go b/internal/server/cnpg_schedule_test.go
index 893b7cc1bc..c419039e7b 100644
--- a/internal/server/cnpg_schedule_test.go
+++ b/internal/server/cnpg_schedule_test.go
@@ -86,10 +86,10 @@ func TestDescribeCNPGSchedule(t *testing.T) {
 }
 
 func TestCNPGActionSetSchedule(t *testing.T) {
-	req := func(reviewed, next string) CNPGActionRequest {
+	req := func(reviewed, next string) ActionRequest {
 		facts, _ := json.Marshal(map[string]any{"schedule": reviewed})
 		params, _ := json.Marshal(map[string]any{"schedule": next})
-		return CNPGActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: facts, Params: params}
+		return ActionRequest{ReviewedContext: "kind-test", UID: "sched-uid", Facts: facts, Params: params}
 	}
 	t.Run("merge-patches spec.schedule bound to the resourceVersion", func(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
@@ -108,7 +108,7 @@ func TestCNPGActionSetSchedule(t *testing.T) {
 	t.Run("refuses a schedule changed since review", func(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
 		_, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "setSchedule", req("0 0 1 * * *", "0 30 2 * * *"))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged || len(env.patches) != 0 {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged || len(env.patches) != 0 {
 			t.Fatalf("err = %v, want 409 changed and no write", err)
 		}
 	})
@@ -133,7 +133,7 @@ func TestCNPGActionSetSchedule(t *testing.T) {
 	t.Run("an unchanged schedule is blocked", func(t *testing.T) {
 		env := newCNPGActionEnv(t, []runtime.Object{cnpgActionCluster(nil), cnpgActionSchedule(nil)})
 		_, err := runCNPGScheduleAction(context.Background(), env.clients(), "db", "nightly", "setSchedule", req("0 0 0 * * *", "0 0 0 * * *"))
-		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked {
+		if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked {
 			t.Fatalf("err = %v, want blocked", err)
 		}
 	})
diff --git a/internal/server/cnpg_sessions.go b/internal/server/cnpg_sessions.go
index c2c1a7edad..3395edcafb 100644
--- a/internal/server/cnpg_sessions.go
+++ b/internal/server/cnpg_sessions.go
@@ -43,7 +43,7 @@ const (
 	cnpgSQLTimeoutPrelude = "SET statement_timeout = '5s';\n"
 )
 
-var cnpgGrantCreateExec = cnpgGrant{"create", "", "pods", "exec"}
+var cnpgGrantCreateExec = Grant{Verb: "create", Resource: "pods", Subresource: "exec"}
 
 // cnpgExecSlots bounds concurrent execs across all callers: each one holds a
 // streaming connection to a kubelet.
@@ -319,7 +319,7 @@ func (s *Server) handleCNPGClusterSessions(w http.ResponseWriter, r *http.Reques
 		Cluster:    CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: cluster.GetUID()},
 		Pod:        want,
 		SampledAt:  time.Now().UTC().Format(time.RFC3339),
-		Permission: CNPGExecPermission{Exec: cnpgPermAllowed, Grant: cnpgGrantCreateExec.String(namespace)},
+		Permission: CNPGExecPermission{Exec: permissionAllowed, Grant: cnpgGrantCreateExec.In(namespace).String()},
 		Instances:  make([]CNPGSessionInstance, 0, len(pods)),
 	}
 	var target *corev1.Pod
@@ -341,8 +341,8 @@ func (s *Server) handleCNPGClusterSessions(w http.ResponseWriter, r *http.Reques
 	resp.PodUID = target.UID
 	resp.Role = cnpgRuntimeRole(target)
 
-	resp.Permission.Exec = s.cnpgPermission(r, cnpgGrantCreateExec, namespace)
-	if resp.Permission.Exec == cnpgPermDenied {
+	resp.Permission.Exec = s.grantPermission(r, cnpgGrantCreateExec.In(namespace))
+	if resp.Permission.Exec == permissionDenied {
 		resp.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading sessions needs " + resp.Permission.Grant}
 		s.writeJSON(w, resp)
 		return
@@ -354,7 +354,7 @@ func (s *Server) handleCNPGClusterSessions(w http.ResponseWriter, r *http.Reques
 	}
 	resp.CNPGRuntimeSource, resp.CNPGSessionFacts = readCNPGSessions(r.Context(), exec, namespace, target.Name)
 	if resp.State == cnpgExecStateDenied {
-		resp.Permission.Exec = cnpgPermDenied
+		resp.Permission.Exec = permissionDenied
 	}
 	s.writeJSON(w, resp)
 }
@@ -406,30 +406,30 @@ func cnpgSignalArgv(pid int, backendStart string) []string {
 func cnpgRunSignalBackend(signal string) func(context.Context, *cnpgClusterRun) (*CNPGActionResult, error) {
 	return func(ctx context.Context, x *cnpgClusterRun) (*CNPGActionResult, error) {
 		var p cnpgSignalParams
-		if err := decodeCNPGParams(x.params, &p); err != nil {
+		if err := decodeActionParams(x.params, &p); err != nil {
 			return nil, err
 		}
 		if p.Pod == "" || p.PodUID == "" || p.PID <= 0 || p.BackendStart == "" {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "params.pod, params.podUID, params.pid and params.backendStart are required")
+			return nil, refuseAction(http.StatusBadRequest, "", "params.pod, params.podUID, params.pid and params.backendStart are required")
 		}
 		if _, err := time.Parse(time.RFC3339Nano, p.BackendStart); err != nil {
-			return nil, cnpgRefuse(http.StatusBadRequest, "", "params.backendStart must be the backend_start the sessions view returned")
+			return nil, refuseAction(http.StatusBadRequest, "", "params.backendStart must be the backend_start the sessions view returned")
 		}
 		if r := cnpgGuardCommon(x.facts); r != "" {
-			return nil, cnpgBlocked(r)
+			return nil, blockedAction(r)
 		}
 		inst, ok := x.facts.instance(p.Pod)
 		if !ok {
-			return nil, cnpgChanged(x.facts, "%s is not an instance of this cluster", p.Pod)
+			return nil, changedAction(x.facts, "%s is not an instance of this cluster", p.Pod)
 		}
 		if !inst.PodReadable {
-			return nil, cnpgRefuse(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
+			return nil, refuseAction(http.StatusForbidden, "", "Pod %s cannot be read, so it cannot be verified as this cluster's instance", p.Pod)
 		}
 		if !inst.PodExists || inst.PodUID != p.PodUID {
-			return nil, cnpgChanged(x.facts, "Pod %s was recreated since you reviewed it; the backend is gone", p.Pod)
+			return nil, changedAction(x.facts, "Pod %s was recreated since you reviewed it; the backend is gone", p.Pod)
 		}
 		if x.c.exec == nil {
-			return nil, cnpgRefuse(http.StatusServiceUnavailable, "", "cluster client not available — check cluster connection")
+			return nil, refuseAction(http.StatusServiceUnavailable, "", "cluster client not available — check cluster connection")
 		}
 		fn, verb := "pg_cancel_backend", "Cancel of the running query"
 		if signal == cnpgSignalTerminate {
@@ -438,7 +438,7 @@ func cnpgRunSignalBackend(signal string) func(context.Context, *cnpgClusterRun)
 		out, err := x.c.exec(ctx, x.cluster.GetNamespace(), p.Pod, cnpgDefaultLogContainer, cnpgSignalArgv(p.PID, p.BackendStart), cnpgSignalSQL(fn))
 		if err != nil {
 			if src := cnpgExecSourceState(err); src.State == cnpgExecStateDenied {
-				return nil, cnpgRefuse(http.StatusForbidden, "", "This needs %s: %s", cnpgGrantCreateExec.String(x.cluster.GetNamespace()), src.Error)
+				return nil, refuseAction(http.StatusForbidden, "", "This needs %s: %s", cnpgGrantCreateExec.In(x.cluster.GetNamespace()).String(), src.Error)
 			}
 			return nil, fmt.Errorf("psql on %s: %w", p.Pod, err)
 		}
@@ -450,7 +450,7 @@ func cnpgRunSignalBackend(signal string) func(context.Context, *cnpgClusterRun)
 			return nil, fmt.Errorf("unexpected psql output: %w", err)
 		}
 		if res.Found == 0 || !res.Signalled {
-			return nil, cnpgChanged(nil, "Backend %d on %s ended or was replaced since you reviewed it; nothing was signalled", p.PID, p.Pod)
+			return nil, changedAction(nil, "Backend %d on %s ended or was replaced since you reviewed it; nothing was signalled", p.PID, p.Pod)
 		}
 		return &CNPGActionResult{
 			Message: fmt.Sprintf("%s for backend %d on %s sent", verb, p.PID, p.Pod),
diff --git a/internal/server/cnpg_sessions_test.go b/internal/server/cnpg_sessions_test.go
index 192178ab7f..77e2a38c6d 100644
--- a/internal/server/cnpg_sessions_test.go
+++ b/internal/server/cnpg_sessions_test.go
@@ -149,7 +149,7 @@ func TestCNPGActionCancelBackendRefusals(t *testing.T) {
 
 	c.exec = cnpgFakeExec(&calls, `{"found" : 0, "signalled" : false}`, nil)
 	_, err := runCNPGClusterAction(context.Background(), c, "db", "pg", "cancelBackend", cnpgActionReq(t, nil, cnpgSignalParamsFor("u1")))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != cnpgCodeChanged {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusConflict || ae.Code != actionCodeChanged {
 		t.Errorf("gone backend = %v, want 409 changed", err)
 	}
 
@@ -274,13 +274,13 @@ func TestCNPGActionDestroyInstanceRefusals(t *testing.T) {
 	primary := cnpgDestroyParamsFor(false, "pg-1=pvc-1")
 	primary["pod"], primary["podUID"] = "pg-1", "u1"
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance", cnpgActionReq(t, cnpgDestroyFacts(), primary))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked || !strings.Contains(ae.Message, "primary") {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked || !strings.Contains(ae.Message, "primary") {
 		t.Errorf("primary = %v, want blocked", err)
 	}
 
 	_, err = runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2")))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 		t.Errorf("unreviewed WAL volume = %v, want 409 changed", err)
 	}
 
@@ -314,7 +314,7 @@ func TestCNPGActionDestroyInstanceStopsWhenPromotedMidway(t *testing.T) {
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
 	ae, ok := cnpgActionStatus(t, err)
-	if !ok || ae.Code != cnpgCodePartial || ae.Status != http.StatusConflict || strings.Join(ae.Completed, ",") != "deleted PVC pg-2" {
+	if !ok || ae.Code != actionCodePartial || ae.Status != http.StatusConflict || strings.Join(ae.Completed, ",") != "deleted PVC pg-2" {
 		t.Fatalf("promotion mid-destroy = %+v, want 409 partial after the first PVC only", err)
 	}
 	if _, err := env.typed.CoreV1().PersistentVolumeClaims("db").Get(context.Background(), "pg-2-wal", metav1.GetOptions{}); err != nil {
@@ -334,7 +334,7 @@ func TestCNPGActionDestroyInstanceRefusesPodLabelledPrimary(t *testing.T) {
 	}
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged || len(ae.Completed) != 0 {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged || len(ae.Completed) != 0 {
 		t.Fatalf("pod labelled primary = %v, want 409 changed before any write", err)
 	}
 	if _, err := env.typed.CoreV1().PersistentVolumeClaims("db").Get(context.Background(), "pg-2", metav1.GetOptions{}); err != nil {
@@ -350,7 +350,7 @@ func TestCNPGActionDestroyInstanceReportsPartialOutcome(t *testing.T) {
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
 	ae, ok := cnpgActionStatus(t, err)
-	if !ok || ae.Code != cnpgCodePartial || ae.Status != http.StatusForbidden ||
+	if !ok || ae.Code != actionCodePartial || ae.Status != http.StatusForbidden ||
 		strings.Join(ae.Completed, ",") != "deleted PVC pg-2,deleted PVC pg-2-wal" {
 		t.Fatalf("pod delete refused after PVCs = %+v, want 403 partial listing both PVCs", err)
 	}
@@ -370,7 +370,7 @@ func TestCNPGActionDestroyInstanceRequiresFence(t *testing.T) {
 	}
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgActionFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeBlocked || !strings.HasPrefix(ae.Message, "Fence pg-2 first") {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeBlocked || !strings.HasPrefix(ae.Message, "Fence pg-2 first") {
 		t.Fatalf("unfenced destroy = %v, want blocked asking to fence first", err)
 	}
 	if _, err := env.typed.CoreV1().PersistentVolumeClaims("db").Get(context.Background(), "pg-2", metav1.GetOptions{}); err != nil || len(env.deletes) != 0 {
@@ -394,7 +394,7 @@ func TestCNPGActionDestroyInstanceStopsWhenUnfencedMidway(t *testing.T) {
 	})
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodePartial || strings.Join(ae.Completed, ",") != "deleted PVC pg-2" {
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodePartial || strings.Join(ae.Completed, ",") != "deleted PVC pg-2" {
 		t.Fatalf("fence lifted mid-destroy = %v, want partial after the first PVC", err)
 	}
 	if len(env.deletes) != 0 {
@@ -447,7 +447,7 @@ func TestCNPGActionDestroyInstanceFailedFenceLiftIsPartial(t *testing.T) {
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
 	ae, ok := cnpgActionStatus(t, err)
-	if !ok || ae.Code != cnpgCodePartial || !strings.Contains(ae.Message, "Unfence") || !slices.Contains(ae.Completed, "deleted Pod pg-2") {
+	if !ok || ae.Code != actionCodePartial || !strings.Contains(ae.Message, "Unfence") || !slices.Contains(ae.Completed, "deleted Pod pg-2") {
 		t.Fatalf("failed fence lift = %v, want partial naming Unfence", err)
 	}
 }
@@ -518,7 +518,7 @@ func TestCNPGPoolerPauseBindsReviewedState(t *testing.T) {
 		Status:     appsv1.DeploymentStatus{ReadyReplicas: 1, UpdatedReplicas: 2, AvailableReplicas: 1},
 	}
 	env := newCNPGActionEnv(t, []runtime.Object{cnpgTestPooler(false)}, deploy)
-	req := CNPGActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid", Facts: []byte(`{"paused":false}`)}
+	req := ActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid", Facts: []byte(`{"paused":false}`)}
 
 	res, err := runCNPGPoolerAction(context.Background(), env.clients(), "db", "pool", "pause", req)
 	if err != nil {
@@ -533,11 +533,11 @@ func TestCNPGPoolerPauseBindsReviewedState(t *testing.T) {
 		t.Errorf("target = %+v", res.Target)
 	}
 
-	_, err = runCNPGPoolerAction(context.Background(), env.clients(), "db", "pool", "resume", CNPGActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid", Facts: []byte(`{"paused":true}`)})
-	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != cnpgCodeChanged {
+	_, err = runCNPGPoolerAction(context.Background(), env.clients(), "db", "pool", "resume", ActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid", Facts: []byte(`{"paused":true}`)})
+	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Code != actionCodeChanged {
 		t.Errorf("stale paused = %v, want 409 changed", err)
 	}
-	_, err = runCNPGPoolerAction(context.Background(), env.clients(), "db", "pool", "pause", CNPGActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid"})
+	_, err = runCNPGPoolerAction(context.Background(), env.clients(), "db", "pool", "pause", ActionRequest{ReviewedContext: "kind-test", UID: "pooler-uid"})
 	if ae, ok := cnpgActionStatus(t, err); !ok || ae.Status != http.StatusBadRequest {
 		t.Errorf("missing facts = %v, want 400", err)
 	}
@@ -584,8 +584,8 @@ func TestCNPGActionDestroyInstanceRefusesWithoutEveryGrantBeforeAnyWrite(t *test
 	env.denied = map[string]bool{"patch clusters": true}
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
-	var ae *cnpgActionError
-	if !errors.As(err, &ae) || ae.Status != http.StatusForbidden || ae.Code == cnpgCodePartial {
+	var ae *actionError
+	if !errors.As(err, &ae) || ae.Status != http.StatusForbidden || ae.Code == actionCodePartial {
 		t.Fatalf("err = %v, want a plain 403 naming patch clusters", err)
 	}
 	if !strings.Contains(ae.Message, "patch clusters") {
@@ -609,8 +609,8 @@ func TestCNPGActionDestroyInstanceLeavesARecreatedClustersFences(t *testing.T) {
 	})
 	_, err := runCNPGClusterAction(context.Background(), env.clients(), "db", "pg", "destroyInstance",
 		cnpgActionReq(t, cnpgDestroyFacts(), cnpgDestroyParamsFor(false, "pg-2=pvc-2", "pg-2-wal=pvc-2w")))
-	var ae *cnpgActionError
-	if !errors.As(err, &ae) || ae.Code != cnpgCodePartial {
+	var ae *actionError
+	if !errors.As(err, &ae) || ae.Code != actionCodePartial {
 		t.Fatalf("err = %v, want partial", err)
 	}
 	for _, p := range env.patches {
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index d0e7b58031..de991f4137 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -623,7 +623,7 @@ func (s *Server) cnpgStorageWAL(w http.ResponseWriter, r *http.Request, cache *k
 		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: "list pods in " + namespace}
 	}
 	grant := "get pods/proxy in " + namespace
-	if s.cnpgPermission(r, cnpgGrantGetPodsProxy, namespace) == cnpgPermDenied {
+	if s.grantPermission(r, cnpgGrantGetPodsProxy.In(namespace)) == permissionDenied {
 		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: grant}
 	}
 	pods, err := cnpgClusterInstancePods(cache, cluster)

From cd42b72bc59754af6e7a98e8c2af04795cad50d4 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:38:23 +0300
Subject: [PATCH 09/26] Send grants as structured objects instead of worded
 strings

Every grant on the wire is now {verb, group?, resource, subresource?,
namespace?} (no namespace means cluster-wide) rather than a sentence the
client had to split apart: action capabilities, HA, recovery, storage,
fleet disk/lag/growth and history coverage, the runtime proxy and exec
permissions, and the Prometheus history charts. Grants that were built
as literal strings now come from grant templates too. Reason strings
still embed the worded grant, with unchanged text where it came from a
template; grantText words an optional one.
---
 internal/prometheus/cnpg_history.go          | 11 ++++++-----
 internal/prometheus/cnpg_history_test.go     |  7 ++++---
 internal/server/actions.go                   | 20 ++++++++++++++------
 internal/server/cnpg_actions_test.go         |  4 ++--
 internal/server/cnpg_cluster_ha.go           |  8 ++++----
 internal/server/cnpg_cluster_ha_test.go      |  2 +-
 internal/server/cnpg_destroy.go              |  1 +
 internal/server/cnpg_history.go              | 18 +++++++++---------
 internal/server/cnpg_history_test.go         |  2 +-
 internal/server/cnpg_operator_diagnosis.go   |  2 +-
 internal/server/cnpg_operator_status.go      |  8 ++++----
 internal/server/cnpg_operator_status_test.go |  4 ++--
 internal/server/cnpg_pooler_actions.go       |  4 ++--
 internal/server/cnpg_recovery.go             |  6 +++---
 internal/server/cnpg_recovery_test.go        |  4 ++--
 internal/server/cnpg_report.go               |  2 +-
 internal/server/cnpg_runtime.go              |  4 ++--
 internal/server/cnpg_runtime_test.go         |  2 +-
 internal/server/cnpg_sessions.go             |  6 +++---
 internal/server/cnpg_storage.go              | 14 +++++++-------
 internal/server/cnpg_storage_test.go         |  4 ++--
 21 files changed, 72 insertions(+), 61 deletions(-)

diff --git a/internal/prometheus/cnpg_history.go b/internal/prometheus/cnpg_history.go
index c17b3375fa..0fcb9761ad 100644
--- a/internal/prometheus/cnpg_history.go
+++ b/internal/prometheus/cnpg_history.go
@@ -12,6 +12,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/skyhook-io/radar/internal/auth"
 	"github.com/skyhook-io/radar/pkg/prom"
 )
 
@@ -117,7 +118,7 @@ type CNPGHistoryChart struct {
 	SeriesBy   string                 `json:"seriesBy"`
 	State      string                 `json:"state"`
 	Reason     string                 `json:"reason,omitempty"`
-	Grant      string                 `json:"grant,omitempty"`
+	Grant      *auth.Grant            `json:"grant,omitempty"`
 	Thresholds []CNPGHistoryThreshold `json:"thresholds,omitempty"`
 	Series     []prom.Series          `json:"series"`
 	Omitted    int                    `json:"omitted,omitempty"`
@@ -254,8 +255,8 @@ type CNPGHistoryRequest struct {
 	// PVCAmbiguous says why the claims' identity could not be settled.
 	PVCAmbiguous string
 	// PodsDenied / PVCDenied carry the grant that is missing, empty when allowed.
-	PodsDenied string
-	PVCDenied  string
+	PodsDenied *auth.Grant
+	PVCDenied  *auth.Grant
 	// PVCReason explains an empty Claims when the claims were not denied.
 	PVCReason string
 	Claims    []string
@@ -288,10 +289,10 @@ func queryCNPGHistory(ctx context.Context, q seriesQuerier, req CNPGHistoryReque
 		c := &charts[i]
 		*c = CNPGHistoryChart{ID: d.id, Title: d.title, Unit: d.unit, Source: d.source, SeriesBy: d.seriesBy, Thresholds: d.thresholds, Series: []prom.Series{}, Steps: steps}
 		switch {
-		case d.pvc && req.PVCDenied != "":
+		case d.pvc && req.PVCDenied != nil:
 			c.State, c.Grant = CNPGHistoryStateDenied, req.PVCDenied
 			continue
-		case !d.pvc && req.PodsDenied != "":
+		case !d.pvc && req.PodsDenied != nil:
 			c.State, c.Grant = CNPGHistoryStateDenied, req.PodsDenied
 			continue
 		case d.pvc && req.PVCAmbiguous != "":
diff --git a/internal/prometheus/cnpg_history_test.go b/internal/prometheus/cnpg_history_test.go
index f2c2daaafc..fd99c19146 100644
--- a/internal/prometheus/cnpg_history_test.go
+++ b/internal/prometheus/cnpg_history_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/skyhook-io/radar/internal/auth"
 	"github.com/skyhook-io/radar/pkg/prom"
 )
 
@@ -210,7 +211,7 @@ func TestQueryCNPGHistoryStatesPerChart(t *testing.T) {
 	}
 	charts := queryCNPGHistory(context.Background(), q, CNPGHistoryRequest{
 		Namespace: "pg", Cluster: "pg", Range: r, End: time.Unix(1_700_000_000, 0), Matchers: `cluster_id="a"`,
-		PVCDenied: "get persistentvolumeclaims in pg",
+		PVCDenied: &auth.Grant{Verb: "get", Resource: "persistentvolumeclaims", Namespace: "pg"},
 	})
 	by := map[string]CNPGHistoryChart{}
 	for _, c := range charts {
@@ -223,7 +224,7 @@ func TestQueryCNPGHistoryStatesPerChart(t *testing.T) {
 	if by["deadlocks"].State != CNPGHistoryStateError {
 		t.Errorf("deadlocks state = %s", by["deadlocks"].State)
 	}
-	if by["pvcUsed"].State != CNPGHistoryStateDenied || by["pvcUsed"].Grant == "" {
+	if by["pvcUsed"].State != CNPGHistoryStateDenied || by["pvcUsed"].Grant == nil || *by["pvcUsed"].Grant != (auth.Grant{Verb: "get", Resource: "persistentvolumeclaims", Namespace: "pg"}) {
 		t.Errorf("pvc chart = %+v", by["pvcUsed"])
 	}
 	if by["walSize"].State != CNPGHistoryStateNoSeries || !strings.HasPrefix(by["walSize"].Reason, "not scraped") {
@@ -254,7 +255,7 @@ func TestQueryCNPGHistoryCapsSeries(t *testing.T) {
 		}
 		return &prom.QueryResult{Series: out}, nil
 	}}
-	charts := queryCNPGHistory(context.Background(), q, CNPGHistoryRequest{Namespace: "pg", Cluster: "pg", Range: r, End: time.Now(), PodsDenied: ""})
+	charts := queryCNPGHistory(context.Background(), q, CNPGHistoryRequest{Namespace: "pg", Cluster: "pg", Range: r, End: time.Now()})
 	for _, c := range charts {
 		if c.ID == "databaseSize" && (len(c.Series) != cnpgHistoryMaxSeries || c.Omitted != 20-cnpgHistoryMaxSeries) {
 			t.Fatalf("databaseSize kept %d, omitted %d", len(c.Series), c.Omitted)
diff --git a/internal/server/actions.go b/internal/server/actions.go
index 91187fae6c..beff41b610 100644
--- a/internal/server/actions.go
+++ b/internal/server/actions.go
@@ -54,7 +54,7 @@ type ActionCapability struct {
 	Allowed    bool   `json:"allowed"`
 	Reason     string `json:"reason,omitempty"`
 	Permission string `json:"permission"`
-	Grant      string `json:"grant,omitempty"`
+	Grant      *Grant `json:"grant,omitempty"`
 }
 
 // ActionRequest is the POST body of every action.
@@ -239,6 +239,14 @@ func mergePatchAtVersion(ctx context.Context, dyn dynamic.Interface, gvr schema.
 	return err
 }
 
+// grantText words an optional grant, "" when there is none.
+func grantText(g *Grant) string {
+	if g == nil {
+		return ""
+	}
+	return g.String()
+}
+
 // grantPermission answers one grant for the caller: allowed, denied, or
 // unknown when the SubjectAccessReview itself failed.
 func (s *Server) grantPermission(r *http.Request, g Grant) string {
@@ -328,22 +336,22 @@ func capabilityVerdict(guard string, perms []string, grants []Grant) ActionCapab
 	for i, p := range perms {
 		if p == permissionDenied {
 			out.Permission = permissionDenied
-			out.Grant = grants[i].String()
+			out.Grant = grants[i].Ref()
 			break
 		}
 		if p == permissionUnknown {
 			out.Permission = permissionUnknown
-			if out.Grant == "" {
-				out.Grant = grants[i].String()
+			if out.Grant == nil {
+				out.Grant = grants[i].Ref()
 			}
 		}
 	}
 	if out.Permission == permissionAllowed {
-		out.Grant = ""
+		out.Grant = nil
 	}
 	switch {
 	case out.Permission == permissionDenied:
-		out.Reason = "You are not allowed to " + out.Grant
+		out.Reason = "You are not allowed to " + out.Grant.String()
 	case guard != "":
 		out.Reason = guard
 	default:
diff --git a/internal/server/cnpg_actions_test.go b/internal/server/cnpg_actions_test.go
index 7789c62653..a7e1ebcd05 100644
--- a/internal/server/cnpg_actions_test.go
+++ b/internal/server/cnpg_actions_test.go
@@ -698,10 +698,10 @@ func TestCNPGActionCapabilitiesPermissionDenied(t *testing.T) {
 		t.Fatal(err)
 	}
 	sw := resp.Actions.Switchover
-	if sw.Allowed || sw.Permission != permissionDenied || !strings.Contains(sw.Grant, "clusters/status") || !strings.Contains(sw.Reason, "patch clusters/status") {
+	if sw.Allowed || sw.Permission != permissionDenied || sw.Grant == nil || *sw.Grant != cnpgGrantPatchStatus.In("db") || !strings.Contains(sw.Reason, "patch clusters/status") {
 		t.Errorf("switchover = %+v, want denied naming patch clusters/status", sw)
 	}
-	if b := resp.Actions.Backup; b.Allowed || !strings.Contains(b.Grant, "create backups") {
+	if b := resp.Actions.Backup; b.Allowed || b.Grant == nil || *b.Grant != cnpgGrantCreateBackups.In("db") {
 		t.Errorf("backup = %+v, want denied naming create backups", b)
 	}
 	if !resp.Actions.Restart.Allowed || resp.Actions.Restart.Permission != permissionAllowed {
diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index 8ca2ccf799..a44e64dfc3 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -63,7 +63,7 @@ var (
 type CNPGHASource struct {
 	State  string `json:"state"`
 	Reason string `json:"reason,omitempty"`
-	Grant  string `json:"grant,omitempty"`
+	Grant  *Grant `json:"grant,omitempty"`
 }
 
 type CNPGClusterHAResponse struct {
@@ -291,12 +291,12 @@ func (s *Server) cnpgClusterHA(r *http.Request, c cnpgHAClients, cache *k8s.Reso
 }
 
 func cnpgHADenied(g Grant, namespace string) CNPGHASource {
-	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.In(namespace).String(), Reason: "You are not allowed to " + g.In(namespace).String()}
+	g = g.In(namespace)
+	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
 }
 
 func cnpgHAClusterDenied(g Grant) CNPGHASource {
-	grant := g.String()
-	return CNPGHASource{State: cnpgHAStateDenied, Grant: grant, Reason: "You are not allowed to " + grant}
+	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
 }
 
 // cnpgHAReadError classifies an impersonated read's failure. NotFound is left
diff --git a/internal/server/cnpg_cluster_ha_test.go b/internal/server/cnpg_cluster_ha_test.go
index d3b52744fd..c92097ab57 100644
--- a/internal/server/cnpg_cluster_ha_test.go
+++ b/internal/server/cnpg_cluster_ha_test.go
@@ -346,7 +346,7 @@ func TestCNPGClusterHA_EachReadIsAuthorizedOnItsOwn(t *testing.T) {
 		"nodes": got.Nodes, "quorum": got.Quorum.Object, "pdbs": got.PDBs.CNPGHASource,
 		"primaryLease": got.PrimaryLease.CNPGHASource, "jobs": got.Jobs.CNPGHASource, "rwEndpoints": got.RWEndpoints.CNPGHASource,
 	} {
-		if src.State != cnpgHAStateDenied || src.Grant == "" {
+		if src.State != cnpgHAStateDenied || src.Grant == nil {
 			t.Errorf("%s = %+v, want denied naming the grant", name, src)
 		}
 	}
diff --git a/internal/server/cnpg_destroy.go b/internal/server/cnpg_destroy.go
index a15df287fc..f7a5405c6e 100644
--- a/internal/server/cnpg_destroy.go
+++ b/internal/server/cnpg_destroy.go
@@ -41,6 +41,7 @@ var (
 	cnpgGrantDeletePVCs = Grant{Verb: "delete", Resource: "persistentvolumeclaims"}
 	cnpgGrantUpdatePVCs = Grant{Verb: "update", Resource: "persistentvolumeclaims"}
 	cnpgGrantListPVCs   = Grant{Verb: "list", Resource: "persistentvolumeclaims"}
+	cnpgGrantGetPVCs    = Grant{Verb: "get", Resource: "persistentvolumeclaims"}
 	cnpgGrantListJobs   = Grant{Verb: "list", Group: "batch", Resource: "jobs"}
 	cnpgGrantDeleteJobs = Grant{Verb: "delete", Group: "batch", Resource: "jobs"}
 	cnpgGrantPatchPool  = Grant{Verb: "patch", Group: cnpgGroup, Resource: "poolers"}
diff --git a/internal/server/cnpg_history.go b/internal/server/cnpg_history.go
index 3f01fce587..b8e7b1f4c7 100644
--- a/internal/server/cnpg_history.go
+++ b/internal/server/cnpg_history.go
@@ -140,7 +140,7 @@ func (s *Server) handleCNPGClusterHistory(w http.ResponseWriter, r *http.Request
 
 	req := prometheuspkg.CNPGHistoryRequest{Namespace: namespace, Cluster: name, Range: rng, End: end}
 	if !s.prometheusAuthGate(r, "", "pods", namespace, "get") {
-		req.PodsDenied = "get pods in " + namespace
+		req.PodsDenied = cnpgGrantGetPods.In(namespace).Ref()
 	}
 	claims, _, claimCov := s.cnpgClusterClaims(r, cache, cluster)
 	switch {
@@ -149,13 +149,13 @@ func (s *Server) handleCNPGClusterHistory(w http.ResponseWriter, r *http.Request
 	case claimCov.State != cnpgStorageStateOK:
 		req.PVCReason = claimCov.Reason
 	case !s.prometheusAuthGate(r, "", "persistentvolumeclaims", namespace, "get"):
-		req.PVCDenied = "get persistentvolumeclaims in " + namespace
+		req.PVCDenied = cnpgGrantGetPVCs.In(namespace).Ref()
 	default:
 		req.Claims = claimNames(claims)
 	}
 
 	anchors := cnpgHistoryAnchors(cache, cluster)
-	if req.PodsDenied == "" {
+	if req.PodsDenied == nil {
 		matchers, iso, err := prometheuspkg.ResolveCNPGScope(r.Context(), namespace, selector, anchors, rng.Duration)
 		if err != nil {
 			resp.State, resp.Reason = cnpgHistoryScopeFailure(err)
@@ -173,7 +173,7 @@ func (s *Server) handleCNPGClusterHistory(w http.ResponseWriter, r *http.Request
 		}
 	}
 
-	key := strings.Join([]string{namespace, name, string(cluster.GetUID()), rng.Name, end.Format(time.RFC3339), req.Matchers, req.PVCMatchers, req.PVCAmbiguous, req.PodsDenied, req.PVCDenied, req.PVCReason, strings.Join(req.Claims, ",")}, "\x00")
+	key := strings.Join([]string{namespace, name, string(cluster.GetUID()), rng.Name, end.Format(time.RFC3339), req.Matchers, req.PVCMatchers, req.PVCAmbiguous, grantText(req.PodsDenied), grantText(req.PVCDenied), req.PVCReason, strings.Join(req.Claims, ",")}, "\x00")
 	charts, hit := cnpgHistoryMemoGet(key, now)
 	if !hit {
 		var err error
@@ -283,7 +283,7 @@ type CNPGClusterFleetMetrics struct {
 // scopeMismatch, error or notRead.
 type CNPGFleetLag struct {
 	State   string   `json:"state"`
-	Grant   string   `json:"grant,omitempty"`
+	Grant   *Grant   `json:"grant,omitempty"`
 	Reason  string   `json:"reason,omitempty"`
 	Seconds *float64 `json:"seconds,omitempty"`
 	Pod     string   `json:"pod,omitempty"`
@@ -300,7 +300,7 @@ type CNPGFleetLag struct {
 // noSeries, denied, unavailable, error or notRead.
 type CNPGFleetGrowth struct {
 	State        string                         `json:"state"`
-	Grant        string                         `json:"grant,omitempty"`
+	Grant        *Grant                         `json:"grant,omitempty"`
 	Reason       string                         `json:"reason,omitempty"`
 	BytesPerHour *float64                       `json:"bytesPerHour,omitempty"`
 	Claim        string                         `json:"claim,omitempty"`
@@ -419,7 +419,7 @@ func (s *Server) cnpgNamespaceFleetMetrics(r *http.Request, cache *k8s.ResourceC
 	}
 
 	if !podsAllowed {
-		fillLag(CNPGFleetLag{State: cnpgHistoryStateDenied, Grant: "get pods in " + namespace})
+		fillLag(CNPGFleetLag{State: cnpgHistoryStateDenied, Grant: cnpgGrantGetPods.In(namespace).Ref()})
 	} else if scopeErr != nil {
 		state, reason := cnpgHistoryScopeFailure(scopeErr)
 		fillLag(CNPGFleetLag{State: state, Reason: reason})
@@ -488,10 +488,10 @@ func (s *Server) cnpgNamespaceFleetMetrics(r *http.Request, cache *k8s.ResourceC
 // A non-empty returned State says why growth is not read for the namespace.
 func (s *Server) cnpgFleetClaims(r *http.Request, cache *k8s.ResourceCache, namespace string, clusters []*unstructured.Unstructured) (map[string][]*corev1.PersistentVolumeClaim, CNPGFleetGrowth) {
 	if !s.canRead(r, "", "persistentvolumeclaims", namespace, "list") {
-		return nil, CNPGFleetGrowth{State: cnpgStorageStateDenied, Grant: "list persistentvolumeclaims in " + namespace}
+		return nil, CNPGFleetGrowth{State: cnpgStorageStateDenied, Grant: cnpgGrantListPVCs.In(namespace).Ref()}
 	}
 	if !s.prometheusAuthGate(r, "", "persistentvolumeclaims", namespace, "get") {
-		return nil, CNPGFleetGrowth{State: cnpgStorageStateDenied, Grant: "get persistentvolumeclaims in " + namespace}
+		return nil, CNPGFleetGrowth{State: cnpgStorageStateDenied, Grant: cnpgGrantGetPVCs.In(namespace).Ref()}
 	}
 	req, err := labels.NewRequirement(cnpgClusterLabel, selection.Exists, nil)
 	if err != nil {
diff --git a/internal/server/cnpg_history_test.go b/internal/server/cnpg_history_test.go
index 84a93806b5..2519ee7960 100644
--- a/internal/server/cnpg_history_test.go
+++ b/internal/server/cnpg_history_test.go
@@ -150,7 +150,7 @@ func TestCNPGClusterHistory_GatesPerSource(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, c := range got.Charts {
-		if c.State != prometheuspkg.CNPGHistoryStateDenied || len(c.Series) != 0 || c.Grant == "" {
+		if c.State != prometheuspkg.CNPGHistoryStateDenied || len(c.Series) != 0 || c.Grant == nil {
 			t.Errorf("%s = %+v, want denied without series", c.ID, c)
 		}
 	}
diff --git a/internal/server/cnpg_operator_diagnosis.go b/internal/server/cnpg_operator_diagnosis.go
index 20e362c030..9cfe117db2 100644
--- a/internal/server/cnpg_operator_diagnosis.go
+++ b/internal/server/cnpg_operator_diagnosis.go
@@ -342,7 +342,7 @@ func (s *Server) cnpgOperatorWebhooks(r *http.Request, typed kubernetes.Interfac
 	add := func(kind, name string, g Grant, read func() ([]admissionv1.WebhookClientConfig, []string, []string, error)) {
 		cfg := CNPGOperatorWebhookConfig{Kind: kind, Name: name, Webhooks: []CNPGOperatorWebhook{}}
 		if s.grantPermission(r, g) == permissionDenied {
-			cfg.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadDenied, Grant: g.String()}
+			cfg.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadDenied, Grant: g.Ref()}
 			configs = append(configs, cfg)
 			return
 		}
diff --git a/internal/server/cnpg_operator_status.go b/internal/server/cnpg_operator_status.go
index b320254bfa..2ebe710b5d 100644
--- a/internal/server/cnpg_operator_status.go
+++ b/internal/server/cnpg_operator_status.go
@@ -194,7 +194,7 @@ func cnpgOperatorLeading(d *appsv1.Deployment, leader CNPGOperatorLeader) (*bool
 		}
 		return &t, ""
 	case cnpgReadDenied:
-		return nil, "its leader lease is not readable (needs " + leader.Grant + ")"
+		return nil, "its leader lease is not readable (needs " + grantText(leader.Grant) + ")"
 	default:
 		if leader.Reason != "" {
 			log.Printf("[cnpg] Operator %s/%s leader lease unread: %s", d.Namespace, d.Name, leader.Reason)
@@ -219,7 +219,7 @@ func cnpgWebhookRejects(configs []CNPGOperatorWebhookConfig, services []CNPGOper
 		case cnpgReadNotFound:
 			continue
 		case cnpgReadDenied:
-			unknown = append(unknown, cfg.Kind+" "+cfg.Name+" is not readable (needs "+cfg.Grant+")")
+			unknown = append(unknown, cfg.Kind+" "+cfg.Name+" is not readable (needs "+grantText(cfg.Grant)+")")
 			continue
 		default:
 			unknown = append(unknown, cfg.Kind+" "+cfg.Name+" could not be read")
@@ -233,8 +233,8 @@ func cnpgWebhookRejects(configs []CNPGOperatorWebhookConfig, services []CNPGOper
 			switch {
 			case !ok || svc.ReadyEndpoints == nil:
 				grant := ""
-				if ok && svc.Grant != "" {
-					grant = " (needs " + svc.Grant + ")"
+				if ok && svc.Grant != nil {
+					grant = " (needs " + svc.Grant.String() + ")"
 				}
 				unknown = append(unknown, "the endpoints of webhook Service "+wh.Service+" are not readable"+grant)
 			case *svc.ReadyEndpoints == 0:
diff --git a/internal/server/cnpg_operator_status_test.go b/internal/server/cnpg_operator_status_test.go
index 83106a50ff..7ac637bfc4 100644
--- a/internal/server/cnpg_operator_status_test.go
+++ b/internal/server/cnpg_operator_status_test.go
@@ -25,7 +25,7 @@ func TestCNPGOperatorLeading(t *testing.T) {
 	ok := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadOK}}
 	stale := ok
 	stale.Stale = true
-	denied := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: "get leases in cnpg-system"}}
+	denied := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetLeases.In("cnpg-system").Ref()}}
 	cases := []struct {
 		name    string
 		d       *appsv1.Deployment
@@ -75,7 +75,7 @@ func TestCNPGWebhookRejects(t *testing.T) {
 	if got, _, unknown := cnpgWebhookRejects(cfg("Fail"), svc(nil)); got != nil || unknown == "" {
 		t.Errorf("unreadable endpoints must be unknown: %v %q", got, unknown)
 	}
-	denied := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: "get validatingwebhookconfigurations"}}}
+	denied := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetValidatingWH.Ref()}}}
 	if got, _, unknown := cnpgWebhookRejects(denied, nil); got != nil || !strings.Contains(unknown, "get validatingwebhookconfigurations") {
 		t.Errorf("denied config: %v %q", got, unknown)
 	}
diff --git a/internal/server/cnpg_pooler_actions.go b/internal/server/cnpg_pooler_actions.go
index 0cc907ce61..4bdc5351b8 100644
--- a/internal/server/cnpg_pooler_actions.go
+++ b/internal/server/cnpg_pooler_actions.go
@@ -333,7 +333,7 @@ func (s *Server) handleCNPGPgBouncerState(w http.ResponseWriter, r *http.Request
 	resp := CNPGPgBouncerStateResponse{
 		Pooler:     CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: pooler.GetUID()},
 		SampledAt:  time.Now().UTC().Format(time.RFC3339),
-		Permission: CNPGExecPermission{Exec: s.grantPermission(r, cnpgGrantCreateExec.In(namespace)), Grant: cnpgGrantCreateExec.In(namespace).String()},
+		Permission: CNPGExecPermission{Exec: s.grantPermission(r, cnpgGrantCreateExec.In(namespace)), Grant: cnpgGrantCreateExec.In(namespace).Ref()},
 		Pods:       make([]CNPGPgBouncerState, len(pods)),
 	}
 	for i, p := range pods {
@@ -341,7 +341,7 @@ func (s *Server) handleCNPGPgBouncerState(w http.ResponseWriter, r *http.Request
 	}
 	if resp.Permission.Exec == permissionDenied {
 		for i := range resp.Pods {
-			resp.Pods[i].CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading PgBouncer state needs " + resp.Permission.Grant}
+			resp.Pods[i].CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading PgBouncer state needs " + grantText(resp.Permission.Grant)}
 		}
 		s.writeJSON(w, resp)
 		return
diff --git a/internal/server/cnpg_recovery.go b/internal/server/cnpg_recovery.go
index 4552da7f5e..1babf3eed2 100644
--- a/internal/server/cnpg_recovery.go
+++ b/internal/server/cnpg_recovery.go
@@ -55,7 +55,7 @@ var (
 // needs; Reason carries the error for anything else.
 type CNPGReadCoverage struct {
 	State  string `json:"state"`
-	Grant  string `json:"grant,omitempty"`
+	Grant  *Grant `json:"grant,omitempty"`
 	Reason string `json:"reason,omitempty"`
 }
 
@@ -64,7 +64,7 @@ type CNPGReadCoverage struct {
 // client, so the apiserver has the final say either way.
 func (s *Server) cnpgGatedRead(r *http.Request, g Grant, namespace string, read func() error) CNPGReadCoverage {
 	if s.grantPermission(r, g.In(namespace)) == permissionDenied {
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).String()}
+		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
 	}
 	return cnpgReadOutcome(read(), g, namespace)
 }
@@ -74,7 +74,7 @@ func cnpgReadOutcome(err error, g Grant, namespace string) CNPGReadCoverage {
 	case err == nil:
 		return CNPGReadCoverage{State: cnpgReadOK}
 	case apierrors.IsForbidden(err):
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).String()}
+		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
 	case apierrors.IsNotFound(err):
 		return CNPGReadCoverage{State: cnpgReadNotFound, Reason: err.Error()}
 	default:
diff --git a/internal/server/cnpg_recovery_test.go b/internal/server/cnpg_recovery_test.go
index 06a2a29913..2053f60b5f 100644
--- a/internal/server/cnpg_recovery_test.go
+++ b/internal/server/cnpg_recovery_test.go
@@ -124,7 +124,7 @@ func TestCNPGRecoverySnapshotReportsDeniedReads(t *testing.T) {
 		return true, nil, apiForbidden("pods")
 	})
 	snap := (&Server{}).cnpgRecoverySnapshot(httptest.NewRequest(http.MethodGet, "/", nil), typed, cnpgRestoredCluster())
-	if snap.Coverage["pods"].State != cnpgReadDenied || !strings.Contains(snap.Coverage["pods"].Grant, "list pods") {
+	if g := snap.Coverage["pods"].Grant; snap.Coverage["pods"].State != cnpgReadDenied || g == nil || g.Verb != "list" || g.Resource != "pods" {
 		t.Fatalf("a denied Pod list must be reported with its grant: %+v", snap.Coverage["pods"])
 	}
 	if len(snap.Pods) != 0 {
@@ -463,7 +463,7 @@ func TestHandleCNPGRestoreCapability(t *testing.T) {
 		if allowed && (!got.Allowed || got.Permission != permissionAllowed) {
 			t.Errorf("allowed = %+v", got)
 		}
-		if !allowed && (got.Allowed || got.Permission != permissionDenied || got.Grant != "create clusters (postgresql.cnpg.io) in namespace db" || !strings.Contains(got.Reason, got.Grant)) {
+		if !allowed && (got.Allowed || got.Permission != permissionDenied || got.Grant == nil || *got.Grant != cnpgGrantCreateClusters.In("db") || got.Grant.String() != "create clusters (postgresql.cnpg.io) in namespace db" || !strings.Contains(got.Reason, got.Grant.String())) {
 			t.Errorf("denied = %+v, want the grant named", got)
 		}
 	}
diff --git a/internal/server/cnpg_report.go b/internal/server/cnpg_report.go
index 745b42c203..6fba5d2e2c 100644
--- a/internal/server/cnpg_report.go
+++ b/internal/server/cnpg_report.go
@@ -563,7 +563,7 @@ func cnpgReportStripOperatorConfig(body []byte) []byte {
 func (b *cnpgReportBuilder) logs(pods []corev1.Pod, opts cnpgReportOptions) {
 	namespace := b.cluster.GetNamespace()
 	if b.s.grantPermission(b.r, cnpgGrantGetPodLogs.In(namespace)) == permissionDenied {
-		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.In(namespace).String()}})
+		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.In(namespace).Ref()}})
 		return
 	}
 	note := "query text inside PostgreSQL log records is omitted"
diff --git a/internal/server/cnpg_runtime.go b/internal/server/cnpg_runtime.go
index a08ede7086..586d26f23e 100644
--- a/internal/server/cnpg_runtime.go
+++ b/internal/server/cnpg_runtime.go
@@ -128,7 +128,7 @@ type CNPGRuntimeObjectRef struct {
 
 type CNPGRuntimePermission struct {
 	Proxy string `json:"proxy"`
-	Grant string `json:"grant"`
+	Grant *Grant `json:"grant,omitempty"`
 }
 
 // CNPGRuntimeSource describes one read. State is ok | partial | denied |
@@ -431,7 +431,7 @@ func (s *Server) authorizeCNPGRuntime(w http.ResponseWriter, r *http.Request, na
 }
 
 func cnpgRuntimePermission(namespace string, allowed bool) CNPGRuntimePermission {
-	p := CNPGRuntimePermission{Proxy: "allowed", Grant: "get pods/proxy in " + namespace}
+	p := CNPGRuntimePermission{Proxy: "allowed", Grant: cnpgGrantGetPodsProxy.In(namespace).Ref()}
 	if !allowed {
 		p.Proxy = "denied"
 	}
diff --git a/internal/server/cnpg_runtime_test.go b/internal/server/cnpg_runtime_test.go
index 6872693d9b..e718e48fc6 100644
--- a/internal/server/cnpg_runtime_test.go
+++ b/internal/server/cnpg_runtime_test.go
@@ -492,7 +492,7 @@ func TestCNPGClusterRuntime_OK(t *testing.T) {
 	if status != http.StatusOK {
 		t.Fatalf("status = %d: %s", status, body)
 	}
-	if got.Cluster.UID != "pgrt-uid" || got.SampledAt == "" || got.Permission.Proxy != "allowed" || got.Permission.Grant != "get pods/proxy in pgrt" {
+	if got.Cluster.UID != "pgrt-uid" || got.SampledAt == "" || got.Permission.Proxy != "allowed" || got.Permission.Grant == nil || *got.Permission.Grant != cnpgGrantGetPodsProxy.In("pgrt") {
 		t.Errorf("envelope = %+v", got)
 	}
 	if len(got.Instances) != 2 || got.Instances[0].Pod != "pg-orders-1" || got.Instances[1].Pod != "pg-orders-2" {
diff --git a/internal/server/cnpg_sessions.go b/internal/server/cnpg_sessions.go
index 3395edcafb..3b94c0be32 100644
--- a/internal/server/cnpg_sessions.go
+++ b/internal/server/cnpg_sessions.go
@@ -146,7 +146,7 @@ func cnpgExecSourceState(err error) CNPGRuntimeSource {
 
 type CNPGExecPermission struct {
 	Exec  string `json:"exec"`
-	Grant string `json:"grant"`
+	Grant *Grant `json:"grant,omitempty"`
 }
 
 // CNPGSessionsResponse is GET /api/cnpg/clusters/{ns}/{name}/sessions.
@@ -319,7 +319,7 @@ func (s *Server) handleCNPGClusterSessions(w http.ResponseWriter, r *http.Reques
 		Cluster:    CNPGRuntimeObjectRef{Namespace: namespace, Name: name, UID: cluster.GetUID()},
 		Pod:        want,
 		SampledAt:  time.Now().UTC().Format(time.RFC3339),
-		Permission: CNPGExecPermission{Exec: permissionAllowed, Grant: cnpgGrantCreateExec.In(namespace).String()},
+		Permission: CNPGExecPermission{Exec: permissionAllowed, Grant: cnpgGrantCreateExec.In(namespace).Ref()},
 		Instances:  make([]CNPGSessionInstance, 0, len(pods)),
 	}
 	var target *corev1.Pod
@@ -343,7 +343,7 @@ func (s *Server) handleCNPGClusterSessions(w http.ResponseWriter, r *http.Reques
 
 	resp.Permission.Exec = s.grantPermission(r, cnpgGrantCreateExec.In(namespace))
 	if resp.Permission.Exec == permissionDenied {
-		resp.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading sessions needs " + resp.Permission.Grant}
+		resp.CNPGRuntimeSource = CNPGRuntimeSource{State: cnpgExecStateDenied, Error: "reading sessions needs " + grantText(resp.Permission.Grant)}
 		s.writeJSON(w, resp)
 		return
 	}
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index de991f4137..ecf93138bc 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -61,7 +61,7 @@ var (
 // the grant that would allow it.
 type CNPGStorageCoverage struct {
 	State  string `json:"state"`
-	Grant  string `json:"grant,omitempty"`
+	Grant  *Grant `json:"grant,omitempty"`
 	Reason string `json:"reason,omitempty"`
 	// Isolation, on usage read from Prometheus: how the series were tied to this cluster.
 	Isolation *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
@@ -279,7 +279,7 @@ func (s *Server) handleCNPGClusterStorage(w http.ResponseWriter, r *http.Request
 // list grant — reading a Cluster never implies reading its claims.
 func (s *Server) cnpgClusterClaims(r *http.Request, cache *k8s.ResourceCache, cluster *unstructured.Unstructured) ([]*corev1.PersistentVolumeClaim, []CNPGStorageExcludedPV, CNPGStorageCoverage) {
 	namespace := cluster.GetNamespace()
-	grant := "list persistentvolumeclaims in " + namespace
+	grant := cnpgGrantListPVCs.In(namespace).Ref()
 	if !s.canRead(r, "", "persistentvolumeclaims", namespace, "list") {
 		return nil, nil, CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: grant}
 	}
@@ -496,7 +496,7 @@ func cnpgStorageVolumeOf(pvc *corev1.PersistentVolumeClaim, classes map[string]C
 // cnpgClaimUsage reads kubelet volume stats for the claims, behind the same
 // gate as the single-claim PVC chart.
 func (s *Server) cnpgClaimUsage(r *http.Request, namespace string, claims []string, anchors []prom.WorkloadPodIdentity) (CNPGStorageCoverage, prometheuspkg.PVCUsageBatch) {
-	grant := "get persistentvolumeclaims in " + namespace
+	grant := cnpgGrantGetPVCs.In(namespace).Ref()
 	if !s.prometheusAuthGate(r, "", "persistentvolumeclaims", namespace, "get") {
 		return CNPGStorageCoverage{State: cnpgUsageStateDenied, Grant: grant}, prometheuspkg.PVCUsageBatch{}
 	}
@@ -620,9 +620,9 @@ func cnpgStorageTargetOf(obj map[string]any, role, tablespace, base string, path
 func (s *Server) cnpgStorageWAL(w http.ResponseWriter, r *http.Request, cache *k8s.ResourceCache, cluster *unstructured.Unstructured, byInstance map[string]*CNPGStorageInstance) CNPGStorageCoverage {
 	namespace := cluster.GetNamespace()
 	if !s.canRead(r, "", "pods", namespace, "list") {
-		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: "list pods in " + namespace}
+		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: cnpgGrantListPods.In(namespace).Ref()}
 	}
-	grant := "get pods/proxy in " + namespace
+	grant := cnpgGrantGetPodsProxy.In(namespace).Ref()
 	if s.grantPermission(r, cnpgGrantGetPodsProxy.In(namespace)) == permissionDenied {
 		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: grant}
 	}
@@ -766,7 +766,7 @@ type CNPGClusterDisk struct {
 	Namespace string                         `json:"namespace"`
 	Name      string                         `json:"name"`
 	State     string                         `json:"state"`
-	Grant     string                         `json:"grant,omitempty"`
+	Grant     *Grant                         `json:"grant,omitempty"`
 	Reason    string                         `json:"reason,omitempty"`
 	Claims    int                            `json:"claims"`
 	Measured  int                            `json:"measured"`
@@ -865,7 +865,7 @@ func (s *Server) cnpgNamespaceDisk(r *http.Request, cache *k8s.ResourceCache, na
 		return out
 	}
 	if !s.canRead(r, "", "persistentvolumeclaims", namespace, "list") {
-		return all(CNPGClusterDisk{State: cnpgStorageStateDenied, Grant: "list persistentvolumeclaims in " + namespace})
+		return all(CNPGClusterDisk{State: cnpgStorageStateDenied, Grant: cnpgGrantListPVCs.In(namespace).Ref()})
 	}
 	req, err := labels.NewRequirement(cnpgClusterLabel, selection.Exists, nil)
 	if err != nil {
diff --git a/internal/server/cnpg_storage_test.go b/internal/server/cnpg_storage_test.go
index 705d3066de..594c68c936 100644
--- a/internal/server/cnpg_storage_test.go
+++ b/internal/server/cnpg_storage_test.go
@@ -337,10 +337,10 @@ func TestCNPGClusterStorage_ReadingTheClusterDoesNotImplyItsClaims(t *testing.T)
 	if err := json.NewDecoder(resp.Body).Decode(&got); err != nil {
 		t.Fatal(err)
 	}
-	if got.Volumes.State != cnpgStorageStateDenied || got.Volumes.Grant != "list persistentvolumeclaims in pgst3" {
+	if got.Volumes.State != cnpgStorageStateDenied || got.Volumes.Grant == nil || *got.Volumes.Grant != cnpgGrantListPVCs.In("pgst3") {
 		t.Errorf("volumes = %+v", got.Volumes)
 	}
-	if got.WAL.State != cnpgStorageStateDenied || got.WAL.Grant != "list pods in pgst3" {
+	if got.WAL.State != cnpgStorageStateDenied || got.WAL.Grant == nil || *got.WAL.Grant != cnpgGrantListPods.In("pgst3") {
 		t.Errorf("wal = %+v", got.WAL)
 	}
 	for _, in := range got.Instances {

From 7643c56c43abdf0363e671682d303e5d44c7cbf4 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:43:43 +0300
Subject: [PATCH 10/26] Share one read-outcome shape across HA, recovery and
 storage

CNPGHASource, CNPGReadCoverage and CNPGStorageCoverage were the same
{state, grant, reason} struct under three names; ReadSource replaces the
first two and storage coverage embeds it beside its isolation field. Each
source keeps its own state constants and classifier, including how it
reads a timeout. JSON is unchanged.
---
 internal/server/cnpg_cluster_ha.go           | 94 +++++++++-----------
 internal/server/cnpg_cluster_ha_test.go      |  6 +-
 internal/server/cnpg_operator_diagnosis.go   | 24 ++---
 internal/server/cnpg_operator_status_test.go | 16 ++--
 internal/server/cnpg_recovery.go             | 42 ++++-----
 internal/server/cnpg_report.go               | 30 +++----
 internal/server/cnpg_storage.go              | 38 ++++----
 internal/server/read_source.go               | 12 +++
 8 files changed, 128 insertions(+), 134 deletions(-)
 create mode 100644 internal/server/read_source.go

diff --git a/internal/server/cnpg_cluster_ha.go b/internal/server/cnpg_cluster_ha.go
index a44e64dfc3..b2168e3c5c 100644
--- a/internal/server/cnpg_cluster_ha.go
+++ b/internal/server/cnpg_cluster_ha.go
@@ -58,21 +58,13 @@ var (
 	cnpgSecretsGVR        = schema.GroupVersionResource{Version: "v1", Resource: "secrets"}
 )
 
-// CNPGHASource is one sub-read's outcome. Grant names what a denied read
-// needs; Reason explains anything other than ok.
-type CNPGHASource struct {
-	State  string `json:"state"`
-	Reason string `json:"reason,omitempty"`
-	Grant  *Grant `json:"grant,omitempty"`
-}
-
 type CNPGClusterHAResponse struct {
 	Cluster       CNPGRuntimeObjectRef `json:"cluster"`
 	SampledAt     string               `json:"sampledAt"`
 	DesiredImage  string               `json:"desiredImage,omitempty"`
 	Instances     []CNPGHAInstance     `json:"instances"`
-	Pods          CNPGHASource         `json:"pods"`
-	Nodes         CNPGHASource         `json:"nodes"`
+	Pods          ReadSource           `json:"pods"`
+	Nodes         ReadSource           `json:"nodes"`
 	Quorum        CNPGHAQuorum         `json:"quorum"`
 	PDBs          CNPGHAPDBs           `json:"pdbs"`
 	PrimaryLease  CNPGHALease          `json:"primaryLease"`
@@ -112,7 +104,7 @@ type CNPGHAQuorum struct {
 	Method         string              `json:"method,omitempty"`
 	Number         *int64              `json:"number,omitempty"`
 	DataDurability string              `json:"dataDurability,omitempty"`
-	Object         CNPGHASource        `json:"object"`
+	Object         ReadSource          `json:"object"`
 	Status         *CNPGHAQuorumStatus `json:"status,omitempty"`
 	N              *int                `json:"n,omitempty"`
 	W              *int                `json:"w,omitempty"`
@@ -132,7 +124,7 @@ type CNPGHAQuorumStatus struct {
 // spec.enablePDB (default true); an absent budget under enablePDB false is
 // the declared state, not a fault.
 type CNPGHAPDBs struct {
-	CNPGHASource
+	ReadSource
 	Enabled bool        `json:"enabled"`
 	Items   []CNPGHAPDB `json:"items"`
 }
@@ -153,7 +145,7 @@ type CNPGHAPDB struct {
 
 // CNPGHALease is one Lease. Expired compares renewTime + duration with now.
 type CNPGHALease struct {
-	CNPGHASource
+	ReadSource
 	Namespace           string `json:"namespace,omitempty"`
 	Name                string `json:"name,omitempty"`
 	Holder              string `json:"holder,omitempty"`
@@ -164,7 +156,7 @@ type CNPGHALease struct {
 }
 
 type CNPGHAJobs struct {
-	CNPGHASource
+	ReadSource
 	Items []CNPGHAJob `json:"items"`
 }
 
@@ -181,7 +173,7 @@ type CNPGHAJob struct {
 
 // CNPGHAEndpoints are the ready endpoints behind the -rw Service, named by Pod.
 type CNPGHAEndpoints struct {
-	CNPGHASource
+	ReadSource
 	Service string   `json:"service"`
 	Pods    []string `json:"pods"`
 }
@@ -197,7 +189,7 @@ type CNPGHACertificate struct {
 	Raw         string              `json:"raw"`
 	ExpiresAt   string              `json:"expiresAt,omitempty"`
 	Renewal     string              `json:"renewal"`
-	Metadata    *CNPGHASource       `json:"metadata,omitempty"`
+	Metadata    *ReadSource         `json:"metadata,omitempty"`
 	CertManager *CNPGCertManagerRef `json:"certManager,omitempty"`
 }
 
@@ -270,9 +262,9 @@ func (s *Server) cnpgClusterHA(r *http.Request, c cnpgHAClients, cache *k8s.Reso
 		var err error
 		pods, err = cnpgClusterInstancePods(cache, cluster)
 		if err != nil {
-			resp.Pods = CNPGHASource{State: cnpgHAStateUnavailable, Reason: err.Error()}
+			resp.Pods = ReadSource{State: cnpgHAStateUnavailable, Reason: err.Error()}
 		} else {
-			resp.Pods = CNPGHASource{State: cnpgHAStateOK}
+			resp.Pods = ReadSource{State: cnpgHAStateOK}
 		}
 	} else {
 		resp.Pods = cnpgHADenied(Grant{Verb: "list", Resource: "pods"}, namespace)
@@ -290,31 +282,31 @@ func (s *Server) cnpgClusterHA(r *http.Request, c cnpgHAClients, cache *k8s.Reso
 	return resp
 }
 
-func cnpgHADenied(g Grant, namespace string) CNPGHASource {
+func cnpgHADenied(g Grant, namespace string) ReadSource {
 	g = g.In(namespace)
-	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
+	return ReadSource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
 }
 
-func cnpgHAClusterDenied(g Grant) CNPGHASource {
-	return CNPGHASource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
+func cnpgHAClusterDenied(g Grant) ReadSource {
+	return ReadSource{State: cnpgHAStateDenied, Grant: g.Ref(), Reason: "You are not allowed to " + g.String()}
 }
 
 // cnpgHAReadError classifies an impersonated read's failure. NotFound is left
 // to the caller: its meaning differs per object.
-func cnpgHAReadError(err error, g Grant, namespace string) CNPGHASource {
+func cnpgHAReadError(err error, g Grant, namespace string) ReadSource {
 	switch {
 	case apierrors.IsForbidden(err):
 		return cnpgHADenied(g, namespace)
 	case apierrors.IsNotFound(err):
-		return CNPGHASource{State: cnpgHAStateNotFound}
+		return ReadSource{State: cnpgHAStateNotFound}
 	case errors.Is(err, context.DeadlineExceeded) || apierrors.IsTimeout(err):
-		return CNPGHASource{State: cnpgHAStateUnavailable, Reason: "no answer within " + cnpgHAReadTimeout.String()}
+		return ReadSource{State: cnpgHAStateUnavailable, Reason: "no answer within " + cnpgHAReadTimeout.String()}
 	default:
 		if plain, ok := cnpgTransportSentence(err, 0, cnpgHAReadTimeout); ok {
 			log.Printf("[cnpg] Failed to read %s: %v", g.In(namespace).String(), err)
-			return CNPGHASource{State: cnpgHAStateUnavailable, Reason: plain}
+			return ReadSource{State: cnpgHAStateUnavailable, Reason: plain}
 		}
-		return CNPGHASource{State: cnpgHAStateError, Reason: truncateCNPGRuntimeError(err.Error())}
+		return ReadSource{State: cnpgHAStateError, Reason: truncateCNPGRuntimeError(err.Error())}
 	}
 }
 
@@ -345,14 +337,14 @@ func cnpgUncachedReason(fact, kind, namespace string, uncached, outOfScope, read
 	return ""
 }
 
-func (s *Server) cnpgHANodesSource(r *http.Request, cache *k8s.ResourceCache) CNPGHASource {
+func (s *Server) cnpgHANodesSource(r *http.Request, cache *k8s.ResourceCache) ReadSource {
 	if !s.canRead(r, "", "nodes", "", "get") {
 		return cnpgHAClusterDenied(Grant{Verb: "get", Resource: "nodes"})
 	}
 	if reason := cnpgUncachedReason("Zones", "Nodes", "", cache.Nodes() == nil, false, cache.IsKindReady("nodes")); reason != "" {
-		return CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
+		return ReadSource{State: cnpgHAStateUnavailable, Reason: reason}
 	}
-	return CNPGHASource{State: cnpgHAStateOK}
+	return ReadSource{State: cnpgHAStateOK}
 }
 
 func cnpgHAInstances(cache *k8s.ResourceCache, pods []*corev1.Pod, desiredImage string, nodesReadable bool) []CNPGHAInstance {
@@ -423,7 +415,7 @@ func (s *Server) cnpgHAQuorum(ctx context.Context, r *http.Request, c cnpgHAClie
 
 	if disc := k8s.GetResourceDiscovery(); disc != nil {
 		if _, ok := disc.GetGVRWithGroup("FailoverQuorum", cnpgGroup); !ok {
-			q.Object = CNPGHASource{State: cnpgHAStateNotInstalled, Reason: "this CloudNativePG version has no FailoverQuorum resource"}
+			q.Object = ReadSource{State: cnpgHAStateNotInstalled, Reason: "this CloudNativePG version has no FailoverQuorum resource"}
 			return q
 		}
 	}
@@ -438,10 +430,10 @@ func (s *Server) cnpgHAQuorum(ctx context.Context, r *http.Request, c cnpgHAClie
 		return q
 	}
 	if !cnpgControlledBy(obj.GetOwnerReferences(), cnpgGroup, "Cluster", name, cluster.GetUID()) {
-		q.Object = CNPGHASource{State: cnpgHAStateError, Reason: "a FailoverQuorum of this name exists but this Cluster does not own it"}
+		q.Object = ReadSource{State: cnpgHAStateError, Reason: "a FailoverQuorum of this name exists but this Cluster does not own it"}
 		return q
 	}
-	q.Object = CNPGHASource{State: cnpgHAStateOK}
+	q.Object = ReadSource{State: cnpgHAStateOK}
 	st := &CNPGHAQuorumStatus{StandbyNames: []string{}}
 	st.Method, _, _ = unstructured.NestedString(obj.Object, "status", "method")
 	st.Primary, _, _ = unstructured.NestedString(obj.Object, "status", "primary")
@@ -496,21 +488,21 @@ func (s *Server) cnpgHAPDBs(r *http.Request, cache *k8s.ResourceCache, cluster *
 	}
 	grant := Grant{Verb: "list", Group: "policy", Resource: "poddisruptionbudgets"}
 	if !s.canRead(r, "policy", "poddisruptionbudgets", namespace, "list") {
-		out.CNPGHASource = cnpgHADenied(grant, namespace)
+		out.ReadSource = cnpgHADenied(grant, namespace)
 		return out
 	}
 	lister := cache.PodDisruptionBudgets()
 	within := namespacesWithinCache(cache, "poddisruptionbudgets", []string{namespace})
 	if reason := cnpgUncachedReason("Disruption budgets", "PodDisruptionBudgets", namespace, lister == nil, within.unavailable, cache.IsKindReady("poddisruptionbudgets")); reason != "" {
-		out.CNPGHASource = CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
+		out.ReadSource = ReadSource{State: cnpgHAStateUnavailable, Reason: reason}
 		return out
 	}
 	list, err := lister.PodDisruptionBudgets(namespace).List(labels.SelectorFromSet(labels.Set{cnpgClusterLabel: cluster.GetName()}))
 	if err != nil {
-		out.CNPGHASource = CNPGHASource{State: cnpgHAStateError, Reason: err.Error()}
+		out.ReadSource = ReadSource{State: cnpgHAStateError, Reason: err.Error()}
 		return out
 	}
-	out.CNPGHASource = CNPGHASource{State: cnpgHAStateOK}
+	out.ReadSource = ReadSource{State: cnpgHAStateOK}
 	for _, p := range list {
 		if !cnpgControlledBy(p.OwnerReferences, cnpgGroup, "Cluster", cluster.GetName(), cluster.GetUID()) {
 			continue
@@ -547,7 +539,7 @@ func cnpgHAPDBOf(p *policyv1.PodDisruptionBudget, cluster string) CNPGHAPDB {
 }
 
 func cnpgHALeaseFrom(l *leaseView, now time.Time) CNPGHALease {
-	out := CNPGHALease{CNPGHASource: CNPGHASource{State: cnpgHAStateOK}, Namespace: l.namespace, Name: l.name, Holder: l.holder, DurationSeconds: l.duration}
+	out := CNPGHALease{ReadSource: ReadSource{State: cnpgHAStateOK}, Namespace: l.namespace, Name: l.name, Holder: l.holder, DurationSeconds: l.duration}
 	if l.renew != nil {
 		out.RenewTime = l.renew.UTC().Format(time.RFC3339)
 		if l.duration != nil {
@@ -568,7 +560,7 @@ func (s *Server) cnpgHAPrimaryLease(ctx context.Context, r *http.Request, c cnpg
 	namespace, name := cluster.GetNamespace(), cluster.GetName()
 	grant := Grant{Verb: "get", Group: "coordination.k8s.io", Resource: "leases"}
 	if !s.canRead(r, "coordination.k8s.io", "leases", namespace, "get") {
-		return CNPGHALease{CNPGHASource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: name}
+		return CNPGHALease{ReadSource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: name}
 	}
 	l, err := c.typed.CoordinationV1().Leases(namespace).Get(ctx, name, metav1.GetOptions{})
 	if err != nil {
@@ -576,7 +568,7 @@ func (s *Server) cnpgHAPrimaryLease(ctx context.Context, r *http.Request, c cnpg
 		if src.State == cnpgHAStateNotFound {
 			src.Reason = "No primary Lease: CloudNativePG creates one from 1.30"
 		}
-		return CNPGHALease{CNPGHASource: src, Namespace: namespace, Name: name}
+		return CNPGHALease{ReadSource: src, Namespace: namespace, Name: name}
 	}
 	v := &leaseView{namespace: namespace, name: name, duration: l.Spec.LeaseDurationSeconds}
 	if l.Spec.HolderIdentity != nil {
@@ -612,11 +604,11 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 		case kindCoverageUncached:
 			reason = "Radar does not watch Deployments in the namespaces you can read, so the operator's namespace is unknown"
 		}
-		return CNPGHALease{CNPGHASource: CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}, Name: cnpgOperatorLeaseName}
+		return CNPGHALease{ReadSource: ReadSource{State: cnpgHAStateUnavailable, Reason: reason}, Name: cnpgOperatorLeaseName}
 	}
 	grant := Grant{Verb: "get", Group: "coordination.k8s.io", Resource: "leases"}
 	if !s.canRead(r, "coordination.k8s.io", "leases", namespace, "get") {
-		return CNPGHALease{CNPGHASource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: cnpgOperatorLeaseName}
+		return CNPGHALease{ReadSource: cnpgHADenied(grant, namespace), Namespace: namespace, Name: cnpgOperatorLeaseName}
 	}
 	l, err := c.typed.CoordinationV1().Leases(namespace).Get(ctx, cnpgOperatorLeaseName, metav1.GetOptions{})
 	if err != nil {
@@ -624,7 +616,7 @@ func (s *Server) cnpgHAOperatorLease(ctx context.Context, r *http.Request, c cnp
 		if src.State == cnpgHAStateNotFound {
 			src.Reason = "No leader-election Lease: the operator may run with leader election off"
 		}
-		return CNPGHALease{CNPGHASource: src, Namespace: namespace, Name: cnpgOperatorLeaseName}
+		return CNPGHALease{ReadSource: src, Namespace: namespace, Name: cnpgOperatorLeaseName}
 	}
 	v := &leaseView{namespace: namespace, name: cnpgOperatorLeaseName, duration: l.Spec.LeaseDurationSeconds}
 	if l.Spec.HolderIdentity != nil {
@@ -642,21 +634,21 @@ func (s *Server) cnpgHAJobs(r *http.Request, cache *k8s.ResourceCache, cluster *
 	out := CNPGHAJobs{Items: []CNPGHAJob{}}
 	grant := Grant{Verb: "list", Group: "batch", Resource: "jobs"}
 	if !s.canRead(r, "batch", "jobs", namespace, "list") {
-		out.CNPGHASource = cnpgHADenied(grant, namespace)
+		out.ReadSource = cnpgHADenied(grant, namespace)
 		return out
 	}
 	lister := cache.Jobs()
 	within := namespacesWithinCache(cache, "jobs", []string{namespace})
 	if reason := cnpgUncachedReason("Instance Jobs", "Jobs", namespace, lister == nil, within.unavailable, cache.IsKindReady("jobs")); reason != "" {
-		out.CNPGHASource = CNPGHASource{State: cnpgHAStateUnavailable, Reason: reason}
+		out.ReadSource = ReadSource{State: cnpgHAStateUnavailable, Reason: reason}
 		return out
 	}
 	list, err := lister.Jobs(namespace).List(labels.SelectorFromSet(labels.Set{cnpgClusterLabel: cluster.GetName()}))
 	if err != nil {
-		out.CNPGHASource = CNPGHASource{State: cnpgHAStateError, Reason: err.Error()}
+		out.ReadSource = ReadSource{State: cnpgHAStateError, Reason: err.Error()}
 		return out
 	}
-	out.CNPGHASource = CNPGHASource{State: cnpgHAStateOK}
+	out.ReadSource = ReadSource{State: cnpgHAStateOK}
 	for _, j := range list {
 		if !cnpgControlledBy(j.OwnerReferences, cnpgGroup, "Cluster", cluster.GetName(), cluster.GetUID()) {
 			continue
@@ -706,15 +698,15 @@ func (s *Server) cnpgHARWEndpoints(ctx context.Context, r *http.Request, c cnpgH
 	out := CNPGHAEndpoints{Service: svc, Pods: []string{}}
 	grant := Grant{Verb: "list", Group: "discovery.k8s.io", Resource: "endpointslices"}
 	if !s.canRead(r, "discovery.k8s.io", "endpointslices", namespace, "list") {
-		out.CNPGHASource = cnpgHADenied(grant, namespace)
+		out.ReadSource = cnpgHADenied(grant, namespace)
 		return out
 	}
 	list, err := c.typed.DiscoveryV1().EndpointSlices(namespace).List(ctx, metav1.ListOptions{LabelSelector: discoveryv1.LabelServiceName + "=" + svc})
 	if err != nil {
-		out.CNPGHASource = cnpgHAReadError(err, grant, namespace)
+		out.ReadSource = cnpgHAReadError(err, grant, namespace)
 		return out
 	}
-	out.CNPGHASource = CNPGHASource{State: cnpgHAStateOK}
+	out.ReadSource = ReadSource{State: cnpgHAStateOK}
 	out.Pods = cnpgReadyEndpointPods(list.Items)
 	return out
 }
@@ -763,7 +755,7 @@ func (s *Server) cnpgHACertificates(ctx context.Context, r *http.Request, c cnpg
 		}
 		if _, ok := user[secret]; ok {
 			cert.Renewal = "user"
-			src := CNPGHASource{State: cnpgHAStateOK}
+			src := ReadSource{State: cnpgHAStateOK}
 			switch {
 			case !canGetSecrets:
 				src = cnpgHADenied(grant, namespace)
diff --git a/internal/server/cnpg_cluster_ha_test.go b/internal/server/cnpg_cluster_ha_test.go
index c92097ab57..6a49e317d6 100644
--- a/internal/server/cnpg_cluster_ha_test.go
+++ b/internal/server/cnpg_cluster_ha_test.go
@@ -342,9 +342,9 @@ func TestCNPGClusterHA_EachReadIsAuthorizedOnItsOwn(t *testing.T) {
 	if err := json.Unmarshal(body, &got); err != nil {
 		t.Fatal(err)
 	}
-	for name, src := range map[string]CNPGHASource{
-		"nodes": got.Nodes, "quorum": got.Quorum.Object, "pdbs": got.PDBs.CNPGHASource,
-		"primaryLease": got.PrimaryLease.CNPGHASource, "jobs": got.Jobs.CNPGHASource, "rwEndpoints": got.RWEndpoints.CNPGHASource,
+	for name, src := range map[string]ReadSource{
+		"nodes": got.Nodes, "quorum": got.Quorum.Object, "pdbs": got.PDBs.ReadSource,
+		"primaryLease": got.PrimaryLease.ReadSource, "jobs": got.Jobs.ReadSource, "rwEndpoints": got.RWEndpoints.ReadSource,
 	} {
 		if src.State != cnpgHAStateDenied || src.Grant == nil {
 			t.Errorf("%s = %+v, want denied naming the grant", name, src)
diff --git a/internal/server/cnpg_operator_diagnosis.go b/internal/server/cnpg_operator_diagnosis.go
index 9cfe117db2..cd10300754 100644
--- a/internal/server/cnpg_operator_diagnosis.go
+++ b/internal/server/cnpg_operator_diagnosis.go
@@ -60,7 +60,7 @@ type CNPGOperatorPod struct {
 // denied | error. Stale means the holder has not renewed within the lease
 // duration, so no operator instance is leading.
 type CNPGOperatorLeader struct {
-	CNPGReadCoverage
+	ReadSource
 	Lease                string `json:"lease,omitempty"`
 	Holder               string `json:"holder,omitempty"`
 	HolderPod            string `json:"holderPod,omitempty"`
@@ -93,7 +93,7 @@ type CNPGOperatorWebhook struct {
 type CNPGOperatorWebhookConfig struct {
 	Kind string `json:"kind"`
 	Name string `json:"name"`
-	CNPGReadCoverage
+	ReadSource
 	Webhooks []CNPGOperatorWebhook `json:"webhooks"`
 }
 
@@ -102,7 +102,7 @@ type CNPGOperatorWebhookConfig struct {
 type CNPGOperatorWebhookService struct {
 	Namespace string `json:"namespace"`
 	Name      string `json:"name"`
-	CNPGReadCoverage
+	ReadSource
 	ReadyEndpoints    *int `json:"readyEndpoints"`
 	NotReadyEndpoints *int `json:"notReadyEndpoints"`
 }
@@ -125,7 +125,7 @@ type CNPGOperatorReconcilePod struct {
 }
 
 type CNPGOperatorEvents struct {
-	CNPGReadCoverage
+	ReadSource
 	Items []CNPGRecoveryEvent `json:"items"`
 }
 
@@ -133,7 +133,7 @@ type CNPGOperatorDiagnosis struct {
 	Namespace   string                       `json:"namespace"`
 	Deployment  string                       `json:"deployment"`
 	Pods        []CNPGOperatorPod            `json:"pods"`
-	PodCoverage CNPGReadCoverage             `json:"podCoverage"`
+	PodCoverage ReadSource                   `json:"podCoverage"`
 	Leader      CNPGOperatorLeader           `json:"leader"`
 	Watch       CNPGOperatorWatch            `json:"watch"`
 	Webhooks    []CNPGOperatorWebhookConfig  `json:"webhooks"`
@@ -180,12 +180,12 @@ func cnpgOperatorLeadingPod(l CNPGOperatorLeader) string {
 func (s *Server) cnpgOperatorPods(r *http.Request, typed kubernetes.Interface, d *appsv1.Deployment, diag *CNPGOperatorDiagnosis) []corev1.Pod {
 	var pods []corev1.Pod
 	if d.Spec.Selector == nil {
-		diag.PodCoverage = CNPGReadCoverage{State: cnpgReadError, Reason: "the Deployment has no selector"}
+		diag.PodCoverage = ReadSource{State: cnpgReadError, Reason: "the Deployment has no selector"}
 		return nil
 	}
 	selector, err := metav1.LabelSelectorAsSelector(d.Spec.Selector)
 	if err != nil {
-		diag.PodCoverage = CNPGReadCoverage{State: cnpgReadError, Reason: err.Error()}
+		diag.PodCoverage = ReadSource{State: cnpgReadError, Reason: err.Error()}
 		return nil
 	}
 	diag.PodCoverage = s.cnpgGatedRead(r, cnpgGrantListPods, d.Namespace, func() error {
@@ -295,7 +295,7 @@ func (s *Server) cnpgOperatorLeader(r *http.Request, typed kubernetes.Interface,
 		return out
 	}
 	var lease *coordinationv1.Lease
-	out.CNPGReadCoverage = s.cnpgGatedRead(r, cnpgGrantGetLeases, d.Namespace, func() error {
+	out.ReadSource = s.cnpgGatedRead(r, cnpgGrantGetLeases, d.Namespace, func() error {
 		l, err := typed.CoordinationV1().Leases(d.Namespace).Get(r.Context(), cnpgOperatorLeaseName, metav1.GetOptions{})
 		lease = l
 		return err
@@ -342,12 +342,12 @@ func (s *Server) cnpgOperatorWebhooks(r *http.Request, typed kubernetes.Interfac
 	add := func(kind, name string, g Grant, read func() ([]admissionv1.WebhookClientConfig, []string, []string, error)) {
 		cfg := CNPGOperatorWebhookConfig{Kind: kind, Name: name, Webhooks: []CNPGOperatorWebhook{}}
 		if s.grantPermission(r, g) == permissionDenied {
-			cfg.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadDenied, Grant: g.Ref()}
+			cfg.ReadSource = ReadSource{State: cnpgReadDenied, Grant: g.Ref()}
 			configs = append(configs, cfg)
 			return
 		}
 		clients, names, policies, err := read()
-		cfg.CNPGReadCoverage = cnpgReadOutcome(err, g, "")
+		cfg.ReadSource = cnpgReadOutcome(err, g, "")
 		for i, cc := range clients {
 			wh := CNPGOperatorWebhook{Name: names[i], FailurePolicy: policies[i], CABundleSet: len(cc.CABundle) > 0, URL: cc.URL != nil}
 			if cc.Service != nil {
@@ -398,7 +398,7 @@ func (s *Server) cnpgOperatorWebhooks(r *http.Request, typed kubernetes.Interfac
 	for _, k := range keys {
 		svc := CNPGOperatorWebhookService{Namespace: k.ns, Name: k.name}
 		var slices []discoveryv1.EndpointSlice
-		svc.CNPGReadCoverage = s.cnpgGatedRead(r, cnpgGrantListEndpointSlcs, k.ns, func() error {
+		svc.ReadSource = s.cnpgGatedRead(r, cnpgGrantListEndpointSlcs, k.ns, func() error {
 			list, err := typed.DiscoveryV1().EndpointSlices(k.ns).List(r.Context(), metav1.ListOptions{LabelSelector: cnpgEndpointSliceServiceLabel + "=" + k.name})
 			if err == nil {
 				slices = list.Items
@@ -535,7 +535,7 @@ func cnpgReconcileStats(samples map[string][]cnpgSample) []CNPGOperatorControlle
 func (s *Server) cnpgOperatorEvents(r *http.Request, typed kubernetes.Interface, d *appsv1.Deployment, pods []corev1.Pod) CNPGOperatorEvents {
 	out := CNPGOperatorEvents{Items: []CNPGRecoveryEvent{}}
 	var events []corev1.Event
-	out.CNPGReadCoverage = s.cnpgGatedRead(r, cnpgGrantListEvents, d.Namespace, func() error {
+	out.ReadSource = s.cnpgGatedRead(r, cnpgGrantListEvents, d.Namespace, func() error {
 		list, err := typed.CoreV1().Events(d.Namespace).List(r.Context(), metav1.ListOptions{})
 		if err == nil {
 			events = list.Items
diff --git a/internal/server/cnpg_operator_status_test.go b/internal/server/cnpg_operator_status_test.go
index 7ac637bfc4..23c1810ffa 100644
--- a/internal/server/cnpg_operator_status_test.go
+++ b/internal/server/cnpg_operator_status_test.go
@@ -22,10 +22,10 @@ func operatorDeployment(replicas, ready int32) *appsv1.Deployment {
 }
 
 func TestCNPGOperatorLeading(t *testing.T) {
-	ok := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadOK}}
+	ok := CNPGOperatorLeader{ReadSource: ReadSource{State: cnpgReadOK}}
 	stale := ok
 	stale.Stale = true
-	denied := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetLeases.In("cnpg-system").Ref()}}
+	denied := CNPGOperatorLeader{ReadSource: ReadSource{State: cnpgReadDenied, Grant: cnpgGrantGetLeases.In("cnpg-system").Ref()}}
 	cases := []struct {
 		name    string
 		d       *appsv1.Deployment
@@ -56,8 +56,8 @@ func TestCNPGWebhookRejects(t *testing.T) {
 	cfg := func(policy string) []CNPGOperatorWebhookConfig {
 		return []CNPGOperatorWebhookConfig{{
 			Kind: "ValidatingWebhookConfiguration", Name: "cnpg-validating-webhook-configuration",
-			CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadOK},
-			Webhooks:         []CNPGOperatorWebhook{{Name: "vcluster.cnpg.io", FailurePolicy: policy, Service: "cnpg-system/cnpg-webhook-service"}},
+			ReadSource: ReadSource{State: cnpgReadOK},
+			Webhooks:   []CNPGOperatorWebhook{{Name: "vcluster.cnpg.io", FailurePolicy: policy, Service: "cnpg-system/cnpg-webhook-service"}},
 		}}
 	}
 	svc := func(ready *int) []CNPGOperatorWebhookService {
@@ -75,11 +75,11 @@ func TestCNPGWebhookRejects(t *testing.T) {
 	if got, _, unknown := cnpgWebhookRejects(cfg("Fail"), svc(nil)); got != nil || unknown == "" {
 		t.Errorf("unreadable endpoints must be unknown: %v %q", got, unknown)
 	}
-	denied := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetValidatingWH.Ref()}}}
+	denied := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", ReadSource: ReadSource{State: cnpgReadDenied, Grant: cnpgGrantGetValidatingWH.Ref()}}}
 	if got, _, unknown := cnpgWebhookRejects(denied, nil); got != nil || !strings.Contains(unknown, "get validatingwebhookconfigurations") {
 		t.Errorf("denied config: %v %q", got, unknown)
 	}
-	absent := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadNotFound}}}
+	absent := []CNPGOperatorWebhookConfig{{Kind: "ValidatingWebhookConfiguration", Name: "x", ReadSource: ReadSource{State: cnpgReadNotFound}}}
 	if got, _, _ := cnpgWebhookRejects(absent, nil); got == nil || *got {
 		t.Errorf("absent config rejects nothing: %v", got)
 	}
@@ -166,7 +166,7 @@ func TestCNPGApplyOperatorGuard(t *testing.T) {
 }
 
 func TestCNPGOperatorLeadingPod(t *testing.T) {
-	held := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadOK}, HolderPod: "op-1", HolderIsCurrentPod: true}
+	held := CNPGOperatorLeader{ReadSource: ReadSource{State: cnpgReadOK}, HolderPod: "op-1", HolderIsCurrentPod: true}
 	if got := cnpgOperatorLeadingPod(held); got != "op-1" {
 		t.Errorf("held = %q", got)
 	}
@@ -198,7 +198,7 @@ func TestCNPGOperatorFactsReadOutlivesTheCaller(t *testing.T) {
 }
 
 func TestCNPGOperatorLeadingHidesRawLeaseErrors(t *testing.T) {
-	leader := CNPGOperatorLeader{CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadError, Reason: `Get "https://127.0.0.1:55484/apis/coordination.k8s.io/v1/namespaces/cnpg-system/leases/db9c8771.cnpg.io": context canceled`}}
+	leader := CNPGOperatorLeader{ReadSource: ReadSource{State: cnpgReadError, Reason: `Get "https://127.0.0.1:55484/apis/coordination.k8s.io/v1/namespaces/cnpg-system/leases/db9c8771.cnpg.io": context canceled`}}
 	got, reason := cnpgOperatorLeading(operatorDeployment(1, 1), leader)
 	if got != nil || reason != "couldn't read its leader lease" {
 		t.Errorf("leading = %v, reason = %q", got, reason)
diff --git a/internal/server/cnpg_recovery.go b/internal/server/cnpg_recovery.go
index 1babf3eed2..c1d5edd124 100644
--- a/internal/server/cnpg_recovery.go
+++ b/internal/server/cnpg_recovery.go
@@ -51,34 +51,26 @@ var (
 	cnpgGrantGetCluster = Grant{Verb: "get", Group: cnpgGroup, Resource: "clusters"}
 )
 
-// CNPGReadCoverage is one read's outcome. Grant names what a denied read
-// needs; Reason carries the error for anything else.
-type CNPGReadCoverage struct {
-	State  string `json:"state"`
-	Grant  *Grant `json:"grant,omitempty"`
-	Reason string `json:"reason,omitempty"`
-}
-
 // cnpgGatedRead runs read when the caller holds g in namespace. The SAR comes
 // first so a denial names the grant; the read itself is made with the caller's
 // client, so the apiserver has the final say either way.
-func (s *Server) cnpgGatedRead(r *http.Request, g Grant, namespace string, read func() error) CNPGReadCoverage {
+func (s *Server) cnpgGatedRead(r *http.Request, g Grant, namespace string, read func() error) ReadSource {
 	if s.grantPermission(r, g.In(namespace)) == permissionDenied {
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
+		return ReadSource{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
 	}
 	return cnpgReadOutcome(read(), g, namespace)
 }
 
-func cnpgReadOutcome(err error, g Grant, namespace string) CNPGReadCoverage {
+func cnpgReadOutcome(err error, g Grant, namespace string) ReadSource {
 	switch {
 	case err == nil:
-		return CNPGReadCoverage{State: cnpgReadOK}
+		return ReadSource{State: cnpgReadOK}
 	case apierrors.IsForbidden(err):
-		return CNPGReadCoverage{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
+		return ReadSource{State: cnpgReadDenied, Grant: g.In(namespace).Ref()}
 	case apierrors.IsNotFound(err):
-		return CNPGReadCoverage{State: cnpgReadNotFound, Reason: err.Error()}
+		return ReadSource{State: cnpgReadNotFound, Reason: err.Error()}
 	default:
-		return CNPGReadCoverage{State: cnpgReadError, Reason: cnpgPlainReadError(err.Error())}
+		return ReadSource{State: cnpgReadError, Reason: cnpgPlainReadError(err.Error())}
 	}
 }
 
@@ -193,15 +185,15 @@ type CNPGRestoreValidationRef struct {
 
 // CNPGRecoveryResponse is GET /api/cnpg/clusters/{ns}/{name}/recovery.
 type CNPGRecoveryResponse struct {
-	Cluster         CNPGRecoveryCluster         `json:"cluster"`
-	Recovery        *CNPGRecoverySpec           `json:"recovery"`
-	Pods            []CNPGRecoveryPod           `json:"pods"`
-	Jobs            []CNPGRecoveryJob           `json:"jobs"`
-	Events          []CNPGRecoveryEvent         `json:"events"`
-	Coverage        map[string]CNPGReadCoverage `json:"coverage"`
-	Validation      *CNPGRestoreValidation      `json:"validation,omitempty"`
-	ValidationError string                      `json:"validationError,omitempty"`
-	CapturedAt      string                      `json:"capturedAt"`
+	Cluster         CNPGRecoveryCluster    `json:"cluster"`
+	Recovery        *CNPGRecoverySpec      `json:"recovery"`
+	Pods            []CNPGRecoveryPod      `json:"pods"`
+	Jobs            []CNPGRecoveryJob      `json:"jobs"`
+	Events          []CNPGRecoveryEvent    `json:"events"`
+	Coverage        map[string]ReadSource  `json:"coverage"`
+	Validation      *CNPGRestoreValidation `json:"validation,omitempty"`
+	ValidationError string                 `json:"validationError,omitempty"`
+	CapturedAt      string                 `json:"capturedAt"`
 }
 
 func (s *Server) handleCNPGClusterRecovery(w http.ResponseWriter, r *http.Request) {
@@ -245,7 +237,7 @@ func (s *Server) cnpgRecoverySnapshot(r *http.Request, typed kubernetes.Interfac
 		Pods:       []CNPGRecoveryPod{},
 		Jobs:       []CNPGRecoveryJob{},
 		Events:     []CNPGRecoveryEvent{},
-		Coverage:   map[string]CNPGReadCoverage{},
+		Coverage:   map[string]ReadSource{},
 		CapturedAt: time.Now().UTC().Format(time.RFC3339),
 	}
 	resp.Validation, resp.ValidationError = parseCNPGRestoreValidation(cluster.GetAnnotations()[cnpgRestoreValidationAnno])
diff --git a/internal/server/cnpg_report.go b/internal/server/cnpg_report.go
index 6fba5d2e2c..1ef6d150b6 100644
--- a/internal/server/cnpg_report.go
+++ b/internal/server/cnpg_report.go
@@ -73,7 +73,7 @@ type CNPGReportItem struct {
 	Item  string `json:"item"`
 	File  string `json:"file,omitempty"`
 	Count *int   `json:"count,omitempty"`
-	CNPGReadCoverage
+	ReadSource
 	Note string `json:"note,omitempty"`
 }
 
@@ -222,7 +222,7 @@ func (b *cnpgReportBuilder) record(item CNPGReportItem) {
 func (b *cnpgReportBuilder) write(item CNPGReportItem, file string, v any, count int) {
 	data, err := yaml.Marshal(v)
 	if err != nil {
-		item.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadError, Reason: err.Error()}
+		item.ReadSource = ReadSource{State: cnpgReadError, Reason: err.Error()}
 		b.record(item)
 		return
 	}
@@ -232,7 +232,7 @@ func (b *cnpgReportBuilder) write(item CNPGReportItem, file string, v any, count
 func (b *cnpgReportBuilder) writeBytes(item CNPGReportItem, file string, data []byte, count *int) {
 	if err := b.z.add(file, data); err != nil {
 		b.index.Truncated = b.index.Truncated || errors.Is(err, errCNPGReportFull)
-		item.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadSkipped, Reason: err.Error()}
+		item.ReadSource = ReadSource{State: cnpgReadSkipped, Reason: err.Error()}
 		b.record(item)
 		return
 	}
@@ -321,12 +321,12 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 		}
 		b.write(item, "manifests/cluster-pods.yaml", corev1.PodList{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "PodList"}, Items: keptPods}, len(keptPods))
 	} else {
-		b.record(CNPGReportItem{Item: "Pods", CNPGReadCoverage: podCov})
+		b.record(CNPGReportItem{Item: "Pods", ReadSource: podCov})
 	}
 	if jobCov.State == cnpgReadOK {
 		b.write(CNPGReportItem{Item: "Jobs"}, "manifests/cluster-jobs.yaml", batchv1.JobList{TypeMeta: metav1.TypeMeta{APIVersion: "batch/v1", Kind: "JobList"}, Items: keptJobs}, len(keptJobs))
 	} else {
-		b.record(CNPGReportItem{Item: "Jobs", CNPGReadCoverage: jobCov})
+		b.record(CNPGReportItem{Item: "Jobs", ReadSource: jobCov})
 	}
 
 	var pvcs []corev1.PersistentVolumeClaim
@@ -347,7 +347,7 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 		}
 		b.write(CNPGReportItem{Item: "PersistentVolumeClaims"}, "manifests/cluster-pvcs.yaml", corev1.PersistentVolumeClaimList{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "PersistentVolumeClaimList"}, Items: kept}, len(kept))
 	} else {
-		b.record(CNPGReportItem{Item: "PersistentVolumeClaims", CNPGReadCoverage: pvcCov})
+		b.record(CNPGReportItem{Item: "PersistentVolumeClaims", ReadSource: pvcCov})
 	}
 
 	subjects := map[string]bool{"Cluster/" + name: true}
@@ -379,7 +379,7 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 			return err
 		})
 		if cov.State != cnpgReadOK {
-			b.record(CNPGReportItem{Item: child.item, CNPGReadCoverage: cov})
+			b.record(CNPGReportItem{Item: child.item, ReadSource: cov})
 			continue
 		}
 		var kept []any
@@ -416,7 +416,7 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 		sort.SliceStable(kept, func(i, j int) bool { return cnpgEventTime(&kept[i]).Before(cnpgEventTime(&kept[j])) })
 		b.write(CNPGReportItem{Item: "Events", Note: "Events about the Cluster and the objects in this report"}, "manifests/events.yaml", corev1.EventList{TypeMeta: metav1.TypeMeta{APIVersion: "v1", Kind: "EventList"}, Items: kept}, len(kept))
 	} else {
-		b.record(CNPGReportItem{Item: "Events", CNPGReadCoverage: evCov})
+		b.record(CNPGReportItem{Item: "Events", ReadSource: evCov})
 	}
 
 	b.captured("Operator and plugins", "operator/operator.json", b.s.handleCNPGOperator, cnpgReportStripOperatorConfig)
@@ -426,7 +426,7 @@ func (b *cnpgReportBuilder) build(opts cnpgReportOptions) {
 	if opts.Logs {
 		b.logs(keptPods, opts)
 	} else {
-		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadSkipped, Reason: "not requested"}})
+		b.record(CNPGReportItem{Item: "Logs", ReadSource: ReadSource{State: cnpgReadSkipped, Reason: "not requested"}})
 	}
 }
 
@@ -448,7 +448,7 @@ func (b *cnpgReportBuilder) objectStores() {
 	}
 	namespace := b.cluster.GetNamespace()
 	var kept []any
-	cov := CNPGReadCoverage{State: cnpgReadOK}
+	cov := ReadSource{State: cnpgReadOK}
 	for _, name := range cnpgSortedKeys(stores) {
 		var obj *unstructured.Unstructured
 		c := b.s.cnpgGatedRead(b.r, cnpgGrantGetObjectStores, namespace, func() error {
@@ -466,7 +466,7 @@ func (b *cnpgReportBuilder) objectStores() {
 	}
 	item := CNPGReportItem{Item: "ObjectStores"}
 	if cov.State != cnpgReadOK {
-		item.CNPGReadCoverage = cov
+		item.ReadSource = cov
 		if len(kept) == 0 {
 			b.record(item)
 			return
@@ -508,7 +508,7 @@ func (b *cnpgReportBuilder) captured(item, file string, handler http.HandlerFunc
 		case http.StatusNotFound:
 			state = cnpgReadNotFound
 		}
-		b.record(CNPGReportItem{Item: item, CNPGReadCoverage: CNPGReadCoverage{State: state, Reason: strings.TrimSpace(fmt.Sprintf("HTTP %d %s", rec.status, e.Error))}})
+		b.record(CNPGReportItem{Item: item, ReadSource: ReadSource{State: state, Reason: strings.TrimSpace(fmt.Sprintf("HTTP %d %s", rec.status, e.Error))}})
 		return
 	}
 	if transform != nil {
@@ -563,7 +563,7 @@ func cnpgReportStripOperatorConfig(body []byte) []byte {
 func (b *cnpgReportBuilder) logs(pods []corev1.Pod, opts cnpgReportOptions) {
 	namespace := b.cluster.GetNamespace()
 	if b.s.grantPermission(b.r, cnpgGrantGetPodLogs.In(namespace)) == permissionDenied {
-		b.record(CNPGReportItem{Item: "Logs", CNPGReadCoverage: CNPGReadCoverage{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.In(namespace).Ref()}})
+		b.record(CNPGReportItem{Item: "Logs", ReadSource: ReadSource{State: cnpgReadDenied, Grant: cnpgGrantGetPodLogs.In(namespace).Ref()}})
 		return
 	}
 	note := "query text inside PostgreSQL log records is omitted"
@@ -593,7 +593,7 @@ func (b *cnpgReportBuilder) containerLog(p corev1.Pod, container string, previou
 	item := CNPGReportItem{Item: fmt.Sprintf("Logs %s/%s%s", p.Name, container, suffix), Note: note}
 	if b.z.used >= b.z.limit {
 		b.index.Truncated = true
-		item.CNPGReadCoverage = CNPGReadCoverage{State: cnpgReadSkipped, Reason: errCNPGReportFull.Error()}
+		item.ReadSource = ReadSource{State: cnpgReadSkipped, Reason: errCNPGReportFull.Error()}
 		b.record(item)
 		return
 	}
@@ -603,7 +603,7 @@ func (b *cnpgReportBuilder) containerLog(p corev1.Pod, container string, previou
 		Container: container, Previous: previous, Timestamps: true, TailLines: &tail, LimitBytes: &limit,
 	}).Stream(b.ctx)
 	if err != nil {
-		item.CNPGReadCoverage = cnpgReadOutcome(err, cnpgGrantGetPodLogs, p.Namespace)
+		item.ReadSource = cnpgReadOutcome(err, cnpgGrantGetPodLogs, p.Namespace)
 		b.record(item)
 		return
 	}
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index ecf93138bc..f6581252cb 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -60,9 +60,7 @@ var (
 // CNPGStorageCoverage states whether one source could be read and, when not,
 // the grant that would allow it.
 type CNPGStorageCoverage struct {
-	State  string `json:"state"`
-	Grant  *Grant `json:"grant,omitempty"`
-	Reason string `json:"reason,omitempty"`
+	ReadSource
 	// Isolation, on usage read from Prometheus: how the series were tied to this cluster.
 	Isolation *prometheuspkg.SeriesIsolation `json:"isolation,omitempty"`
 }
@@ -228,7 +226,7 @@ func (s *Server) handleCNPGClusterStorage(w http.ResponseWriter, r *http.Request
 	classes := s.cnpgStorageClasses(r, cache, claims)
 	states := cnpgClusterPVCStates(cluster)
 
-	usage := CNPGStorageCoverage{State: cnpgUsageStateNotRead, Reason: "no volumes to measure"}
+	usage := CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateNotRead, Reason: "no volumes to measure"}}
 	var batch prometheuspkg.PVCUsageBatch
 	if len(claims) > 0 {
 		usage, batch = s.cnpgClaimUsage(r, namespace, claimNames(claims), cnpgHistoryAnchors(cache, cluster))
@@ -281,14 +279,14 @@ func (s *Server) cnpgClusterClaims(r *http.Request, cache *k8s.ResourceCache, cl
 	namespace := cluster.GetNamespace()
 	grant := cnpgGrantListPVCs.In(namespace).Ref()
 	if !s.canRead(r, "", "persistentvolumeclaims", namespace, "list") {
-		return nil, nil, CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: grant}
+		return nil, nil, CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateDenied, Grant: grant}}
 	}
 	candidates, reason := cnpgCachedClaims(cache, namespace, labels.SelectorFromSet(labels.Set{cnpgClusterLabel: cluster.GetName()}))
 	if reason != "" {
-		return nil, nil, CNPGStorageCoverage{State: cnpgStorageStateUnavailable, Grant: grant, Reason: reason}
+		return nil, nil, CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateUnavailable, Grant: grant, Reason: reason}}
 	}
 	owned, excluded := cnpgOwnedClaims(candidates, cluster)
-	return owned, excluded, CNPGStorageCoverage{State: cnpgStorageStateOK, Grant: grant}
+	return owned, excluded, CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateOK, Grant: grant}}
 }
 
 // cnpgCachedClaims reads claims from Radar's informer. What the informer does
@@ -498,29 +496,29 @@ func cnpgStorageVolumeOf(pvc *corev1.PersistentVolumeClaim, classes map[string]C
 func (s *Server) cnpgClaimUsage(r *http.Request, namespace string, claims []string, anchors []prom.WorkloadPodIdentity) (CNPGStorageCoverage, prometheuspkg.PVCUsageBatch) {
 	grant := cnpgGrantGetPVCs.In(namespace).Ref()
 	if !s.prometheusAuthGate(r, "", "persistentvolumeclaims", namespace, "get") {
-		return CNPGStorageCoverage{State: cnpgUsageStateDenied, Grant: grant}, prometheuspkg.PVCUsageBatch{}
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateDenied, Grant: grant}}, prometheuspkg.PVCUsageBatch{}
 	}
 	batch := prometheuspkg.QueryPVCUsage(r.Context(), namespace, claims, anchors)
 	switch batch.Status {
 	case prometheuspkg.PVCUsageNoPrometheus:
-		return CNPGStorageCoverage{State: cnpgUsageStateNoPrometheus, Reason: cnpgNoPrometheusReason(batch.Error)}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateNoPrometheus, Reason: cnpgNoPrometheusReason(batch.Error)}}, batch
 	case prometheuspkg.PVCUsageQueryFailed:
-		return CNPGStorageCoverage{State: cnpgUsageStateError, Reason: "Prometheus query failed: " + truncateCNPGRuntimeError(batch.Error)}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateError, Reason: "Prometheus query failed: " + truncateCNPGRuntimeError(batch.Error)}}, batch
 	case prometheuspkg.PVCUsageAmbiguous:
 		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrScopeAmbiguous)
-		return CNPGStorageCoverage{State: cnpgHistoryStateAmbiguous, Reason: reason}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgHistoryStateAmbiguous, Reason: reason}}, batch
 	case prometheuspkg.PVCUsageScopeMismatch:
 		_, reason := cnpgUsageScopeFailure(prometheuspkg.ErrScopeMismatch)
-		return CNPGStorageCoverage{State: cnpgHistoryStateScopeMismatch, Reason: reason}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgHistoryStateScopeMismatch, Reason: reason}}, batch
 	}
 	iso := &batch.Isolation
 	switch n := len(batch.Usage); {
 	case n == 0:
-		return CNPGStorageCoverage{State: cnpgUsageStateNoSeries, Reason: "Prometheus has no kubelet volume stats for these claims"}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateNoSeries, Reason: "Prometheus has no kubelet volume stats for these claims"}}, batch
 	case n < len(claims):
-		return CNPGStorageCoverage{State: cnpgStorageStatePartial, Reason: fmt.Sprintf("%d of %d claims have kubelet volume stats", n, len(claims)), Isolation: iso}, batch
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStatePartial, Reason: fmt.Sprintf("%d of %d claims have kubelet volume stats", n, len(claims))}, Isolation: iso}, batch
 	}
-	return CNPGStorageCoverage{State: cnpgUsageStateOK, Isolation: iso}, batch
+	return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgUsageStateOK}, Isolation: iso}, batch
 }
 
 // cnpgUnverifiedCaveat qualifies a measurement stated as this cluster's when
@@ -620,19 +618,19 @@ func cnpgStorageTargetOf(obj map[string]any, role, tablespace, base string, path
 func (s *Server) cnpgStorageWAL(w http.ResponseWriter, r *http.Request, cache *k8s.ResourceCache, cluster *unstructured.Unstructured, byInstance map[string]*CNPGStorageInstance) CNPGStorageCoverage {
 	namespace := cluster.GetNamespace()
 	if !s.canRead(r, "", "pods", namespace, "list") {
-		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: cnpgGrantListPods.In(namespace).Ref()}
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateDenied, Grant: cnpgGrantListPods.In(namespace).Ref()}}
 	}
 	grant := cnpgGrantGetPodsProxy.In(namespace).Ref()
 	if s.grantPermission(r, cnpgGrantGetPodsProxy.In(namespace)) == permissionDenied {
-		return CNPGStorageCoverage{State: cnpgStorageStateDenied, Grant: grant}
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateDenied, Grant: grant}}
 	}
 	pods, err := cnpgClusterInstancePods(cache, cluster)
 	if err != nil {
 		log.Printf("[cnpg] Failed to list instance Pods for %s/%s: %v", namespace, cluster.GetName(), err)
-		return CNPGStorageCoverage{State: cnpgStorageStateUnavailable, Grant: grant, Reason: "instance Pods unavailable"}
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateUnavailable, Grant: grant, Reason: "instance Pods unavailable"}}
 	}
 	if len(pods) == 0 {
-		return CNPGStorageCoverage{State: cnpgStorageStateUnavailable, Grant: grant, Reason: "no instance Pods"}
+		return CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateUnavailable, Grant: grant, Reason: "no instance Pods"}}
 	}
 	client := cnpgRuntimeClient(r)
 	if client == nil {
@@ -688,7 +686,7 @@ func (s *Server) cnpgStorageWAL(w http.ResponseWriter, r *http.Request, cache *k
 	}
 	run.wait()
 
-	cov := CNPGStorageCoverage{State: cnpgStorageStateOK, Grant: grant}
+	cov := CNPGStorageCoverage{ReadSource: ReadSource{State: cnpgStorageStateOK, Grant: grant}}
 	failed, partial := 0, 0
 	for i, p := range pods {
 		wal := results[i]
diff --git a/internal/server/read_source.go b/internal/server/read_source.go
new file mode 100644
index 0000000000..768b938575
--- /dev/null
+++ b/internal/server/read_source.go
@@ -0,0 +1,12 @@
+package server
+
+// ReadSource is the outcome of one read a response depends on. Grant names
+// what a denied read needs; Reason explains any other outcome. The State
+// vocabulary belongs to the caller: sources classify the same failure
+// differently on purpose (a timed-out HA read is unavailable, a timed-out
+// recovery read is an error).
+type ReadSource struct {
+	State  string `json:"state"`
+	Grant  *Grant `json:"grant,omitempty"`
+	Reason string `json:"reason,omitempty"`
+}

From a73adfb3fd9b4b08b34fffd248264ae2f8821e8b Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:46:22 +0300
Subject: [PATCH 11/26] Gate the CloudNativePG workspace on the Radar that
 serves it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Radar Hub embeds the newest frontend against whatever Radar a cluster runs,
so every /api/cnpg endpoint the workspace added, and the GitOps
write-evidence read, now has a capability flag (cnpgWorkspace,
gitopsWriteEvidence) and a radarFeatures entry. Every CloudNativePG hook,
the log fetch and stream, the report download and the write-evidence query
go through the feature guard. On a Radar without the workspace the sidebar
offers no workspace destinations, a /workload link stays on the standard
view, the drawer and detail page drop the composed summary, actions and
extra tabs, and a workspace screen opened directly says it needs a newer
Radar. The two image-catalog lookups that predate the workspace stay
ungated.

A sidebar destination count taken over partly readable data is now a
lower bound on screen as well as in its tooltip: it renders "≥N", and a
zero renders the unknown dash rather than no badge. The certainty glyph
moves into k8s-ui (components/workspace/certainty) for the sidebar and
Capacity to share; CapacityCertainty is the same type under its old name.
---
 internal/k8s/capabilities.go                  |  3 +
 internal/server/server.go                     | 16 ++---
 .../resources/ResourcesSidebar.test.tsx       | 15 +++++
 .../components/resources/ResourcesSidebar.tsx | 10 ++-
 .../src/components/workspace/certainty.tsx    | 36 +++++++++++
 .../k8s-ui/src/components/workspace/index.ts  |  1 +
 packages/k8s-ui/src/types/capacity.ts         |  4 +-
 packages/k8s-ui/src/types/core.ts             |  2 +
 web/src/api/cnpg-ha.ts                        |  7 ++-
 web/src/api/cnpg-history.ts                   | 23 ++++---
 web/src/api/cnpg-recovery.ts                  | 20 +++---
 web/src/api/cnpg-sessions.ts                  | 24 +++++---
 web/src/api/cnpg-storage.ts                   | 12 ++--
 web/src/api/cnpg.ts                           | 61 ++++++++++++-------
 web/src/api/radarFeatures.ts                  |  2 +
 .../components/capacity/CapacityOverview.tsx  |  3 +-
 .../capacity/CapacityPoolDetail.tsx           |  3 +-
 .../capacity/ClusterSchedulingCard.tsx        |  3 +-
 .../capacity/certaintyGlyph.test.tsx          |  3 +-
 web/src/components/capacity/shared.tsx        | 37 +----------
 web/src/components/cnpg/CNPGClusterLogs.tsx   | 10 +--
 web/src/components/cnpg/CNPGDetailPage.tsx    |  8 ++-
 .../cnpg/actions/CNPGReportDialog.tsx         |  4 +-
 web/src/components/cnpg/shared.tsx            | 19 ++++++
 .../cnpg/useCNPGSidebarWorkspace.ts           | 29 +++++----
 web/src/components/workload/WorkloadView.tsx  | 20 ++++--
 web/src/hooks/useGitOpsWriteGuard.ts          | 23 ++++---
 27 files changed, 256 insertions(+), 142 deletions(-)
 create mode 100644 packages/k8s-ui/src/components/workspace/certainty.tsx

diff --git a/internal/k8s/capabilities.go b/internal/k8s/capabilities.go
index aa7a278e37..665fa11764 100644
--- a/internal/k8s/capabilities.go
+++ b/internal/k8s/capabilities.go
@@ -139,6 +139,9 @@ type FeatureCapabilities struct {
 	PodEnvironment  bool `json:"podEnvironment"`  // GET /api/pods/{namespace}/{name}/environment
 	PolicyResource  bool `json:"policyResource"`  // GET /api/policy/resource/{kind}/{namespace}/{name}
 	WorkloadHistory bool `json:"workloadHistory"` // GET /api/workloads/{kind}/{namespace}/{name}/history
+	// Every /api/cnpg/* route except the two image-catalog reverse lookups, which predate it.
+	CNPGWorkspace       bool `json:"cnpgWorkspace"`
+	GitOpsWriteEvidence bool `json:"gitopsWriteEvidence"` // POST /api/gitops/write-evidence
 }
 
 // WorkloadWritePermissions indicates which workload resources the user can patch.
diff --git a/internal/server/server.go b/internal/server/server.go
index 745de1c89b..9882735184 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -1388,13 +1388,15 @@ func (s *Server) handleCapabilities(w http.ResponseWriter, r *http.Request) {
 	caps.Deployment = k8s.DeploymentInfo{Mode: deploymentMode()}
 	caps.CloudConnect = s.cloudConnectCapability()
 	caps.Features = k8s.FeatureCapabilities{
-		YAMLReview:      true,
-		YAMLSchemas:     true,
-		WorkloadImages:  true,
-		ResourceIssues:  true,
-		PodEnvironment:  true,
-		PolicyResource:  true,
-		WorkloadHistory: true,
+		YAMLReview:          true,
+		YAMLSchemas:         true,
+		WorkloadImages:      true,
+		ResourceIssues:      true,
+		PodEnvironment:      true,
+		PolicyResource:      true,
+		WorkloadHistory:     true,
+		CNPGWorkspace:       true,
+		GitOpsWriteEvidence: true,
 	}
 	caps.AuthEnabled = s.authConfig.Enabled()
 	caps.ConfigManagement = s.configManagement()
diff --git a/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx b/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
index f76df8d7f1..2330002b4b 100644
--- a/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
+++ b/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
@@ -153,6 +153,21 @@ describe('ResourcesSidebar category workspaces', () => {
     expect(html).not.toContain('selection-strong selection-text">Pod')
   })
 
+  it('marks a count taken over partly readable data as a lower bound, and never shows its zero as none', () => {
+    const render = (count: number) =>
+      renderToString(
+        <ResourcesSidebar
+          selectedKind={null}
+          onSelectedKindChange={() => {}}
+          apiResources={[cnpgCluster]}
+          resourceCounts={{ 'postgresql.cnpg.io/Cluster': 1 }}
+          categoryWorkspaces={{ CloudNativePG: { destinations: [{ id: 'overview', label: 'Overview', count, countLowerBound: true, onSelect: () => {} }] } }}
+        />,
+      )
+    expect(render(2)).toMatch(/≥(<!-- -->)?2/)
+    expect(render(0)).toContain('–')
+  })
+
   it('keeps a workspace category visible when it has no resources', () => {
     const html = renderToString(
       <ResourcesSidebar
diff --git a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
index c06bc32e2b..076f610ec2 100644
--- a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
+++ b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
@@ -13,6 +13,7 @@ import type { APIResource } from '../../types'
 import { categorizeResources, CORE_RESOURCES } from '../../utils/api-resources'
 import { getResourceIcon } from '../../utils/resource-icons'
 import { Tooltip } from '../ui/Tooltip'
+import { certaintyGlyph } from '../workspace/certainty'
 import { Input } from '../ui/Input'
 
 // Selected resource type info (need both name for API and kind for display)
@@ -36,6 +37,8 @@ export interface SidebarCategoryDestination {
   icon?: ComponentType<{ className?: string }>
   /** Problem count. `undefined` renders no badge; `null` renders the unknown dash. */
   count?: number | null
+  /** The count was taken over data read only in part: rendered "≥N", and a zero is unknown rather than none. */
+  countLowerBound?: boolean
   countTitle?: string
   active?: boolean
   /** The object currently open under this destination, nested beneath it. */
@@ -808,13 +811,16 @@ function WorkspaceDestinations({
             >
               {Icon && <Icon className="w-4 h-4 shrink-0" />}
               <span className="flex-1 text-left truncate">{d.label}</span>
-              {d.count === null ? (
+              {d.count === null || (d.count === 0 && d.countLowerBound) ? (
                 <Tooltip content={d.countTitle ?? COUNT_UNAVAILABLE_MESSAGE} position="left">
                   <span className="text-xs py-0.5 rounded text-center font-mono w-8 bg-theme-elevated text-theme-text-disabled">–</span>
                 </Tooltip>
               ) : d.count !== undefined && d.count > 0 ? (
                 <Tooltip content={d.countTitle ?? `${d.count}`} position="left">
-                  <span className="text-xs py-0.5 rounded text-center font-mono w-8 status-degraded">{d.count}</span>
+                  <span className="text-xs py-0.5 rounded text-center font-mono min-w-8 px-1 status-degraded">
+                    {d.countLowerBound && certaintyGlyph('lower_bound')}
+                    {d.count}
+                  </span>
                 </Tooltip>
               ) : null}
             </button>
diff --git a/packages/k8s-ui/src/components/workspace/certainty.tsx b/packages/k8s-ui/src/components/workspace/certainty.tsx
new file mode 100644
index 0000000000..c33d2ffbfb
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/certainty.tsx
@@ -0,0 +1,36 @@
+import { WithTooltip } from '../ui/Tooltip'
+
+/**
+ * How exactly a value is known. A value read only in part is a lower bound,
+ * never shown as if exact.
+ */
+export type Certainty = 'exact' | 'lower_bound' | 'upper_bound' | 'unknown'
+
+export function certaintyGlyph(certainty: Certainty): string {
+  if (certainty === 'exact') return '='
+  if (certainty === 'lower_bound') return '≥'
+  if (certainty === 'upper_bound') return '≤'
+  return '?'
+}
+
+export function certaintyValueLabel(certainty: Certainty): string {
+  if (certainty === 'exact') return 'Exact'
+  if (certainty === 'lower_bound') return 'Lower bound'
+  if (certainty === 'upper_bound') return 'Upper bound'
+  return 'Unknown certainty'
+}
+
+export function CertaintyGlyph({ certainty, title }: { certainty: Certainty; title?: string }) {
+  return (
+    <WithTooltip tip={title ?? certaintyValueLabel(certainty)}>
+      <span
+        tabIndex={0}
+        role="note"
+        aria-label={title ?? certaintyValueLabel(certainty)}
+        className="cursor-help rounded border border-theme-border-light px-1 font-mono text-[10px] leading-tight text-theme-text-tertiary focus-visible:outline focus-visible:outline-2 focus-visible:outline-skyhook-500"
+      >
+        {certaintyGlyph(certainty)}
+      </span>
+    </WithTooltip>
+  )
+}
diff --git a/packages/k8s-ui/src/components/workspace/index.ts b/packages/k8s-ui/src/components/workspace/index.ts
index 344b64a688..f0275d0cff 100644
--- a/packages/k8s-ui/src/components/workspace/index.ts
+++ b/packages/k8s-ui/src/components/workspace/index.ts
@@ -3,3 +3,4 @@
 export * from './facts'
 export * from './sections'
 export * from './problems'
+export * from './certainty'
diff --git a/packages/k8s-ui/src/types/capacity.ts b/packages/k8s-ui/src/types/capacity.ts
index 4490d86965..a9104bce3d 100644
--- a/packages/k8s-ui/src/types/capacity.ts
+++ b/packages/k8s-ui/src/types/capacity.ts
@@ -1,4 +1,5 @@
 import type { Issue } from "../components/issues/types";
+import type { Certainty } from "../components/workspace/certainty";
 
 export const CAPACITY_SCHEMA_VERSION = "v1alpha1" as const;
 
@@ -15,8 +16,7 @@ export interface CapacityResourceIdentity {
   uid?: string;
 }
 
-export type CapacityCertainty =
-  "exact" | "lower_bound" | "upper_bound" | "unknown";
+export type CapacityCertainty = Certainty;
 export type CapacityGranularity =
   "aggregate" | "aggregate_not_binpacked" | "per_node";
 export type CapacityResourceVector = Record<string, string>;
diff --git a/packages/k8s-ui/src/types/core.ts b/packages/k8s-ui/src/types/core.ts
index 2feb82b4b7..677ae739ec 100644
--- a/packages/k8s-ui/src/types/core.ts
+++ b/packages/k8s-ui/src/types/core.ts
@@ -167,6 +167,8 @@ export interface FeatureCapabilities {
   podEnvironment?: boolean
   policyResource?: boolean
   workloadHistory?: boolean
+  cnpgWorkspace?: boolean
+  gitopsWriteEvidence?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
diff --git a/web/src/api/cnpg-ha.ts b/web/src/api/cnpg-ha.ts
index 6d42bf4338..6ac600f3dd 100644
--- a/web/src/api/cnpg-ha.ts
+++ b/web/src/api/cnpg-ha.ts
@@ -1,15 +1,16 @@
 import { useQuery } from '@tanstack/react-query'
 import { cnpgFormatLag, cnpgReplicationTone, formatGrant, type CNPGClusterHA, type CNPGFleetRow, type CNPGInstanceLive, type CNPGReplicationLive } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from './client'
+import { fetchJSON, useRadarFeature } from './client'
 import type { CNPGRuntimeResponse } from './cnpg'
 
 // /api/cnpg/clusters/{ns}/{name}/ha — quorum, disruption budgets, Leases,
 // failure domains, Jobs, image drift and certificate renewal ownership. Each
 // part is authorized on its own and says when it could not be read.
 export function useCNPGClusterHA(namespace: string, name: string, options?: { enabled?: boolean; refetchInterval?: number | false }) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterHA>({
-    queryKey: ['cnpg', 'ha', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGClusterHA>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/ha`, signal),
+    queryKey: ['cnpg', 'ha', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGClusterHA>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/ha`, signal)),
     enabled: (options?.enabled ?? true) && !!name,
     staleTime: 10_000,
     refetchInterval: options?.refetchInterval ?? 30_000,
diff --git a/web/src/api/cnpg-history.ts b/web/src/api/cnpg-history.ts
index 0a92734b9f..2701d14eaf 100644
--- a/web/src/api/cnpg-history.ts
+++ b/web/src/api/cnpg-history.ts
@@ -1,6 +1,7 @@
 import { useQuery } from '@tanstack/react-query'
 import type { CNPGFleetMetricsReading, Grant } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from './client'
+import { fetchJSON, useRadarFeature } from './client'
+import { shouldRetryRadarQuery } from './radarFeatures'
 import type { CNPGClusterActivityResponse } from './cnpg'
 
 export type CNPGHistoryRange = '15m' | '1h' | '6h' | '24h'
@@ -63,13 +64,14 @@ export interface CNPGClusterHistoryResponse {
 // /api/cnpg/clusters/{ns}/{name}/history — server-built Prometheus range
 // queries for the Runtime Trends section.
 export function useCNPGClusterHistory(namespace: string, name: string, range: CNPGHistoryRange, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterHistoryResponse>({
-    queryKey: ['cnpg', 'history', namespace, name, range],
-    queryFn: ({ signal }) =>
+    queryKey: ['cnpg', 'history', namespace, name, range, ...gatedKey],
+    queryFn: ({ signal }) => guard(() =>
       fetchJSON<CNPGClusterHistoryResponse>(
         `/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/history?range=${range}`,
         signal,
-      ),
+      )),
     enabled: enabled && !!name,
     refetchInterval: range === '15m' ? 30_000 : 60_000,
     refetchIntervalInBackground: false,
@@ -91,10 +93,11 @@ export interface CNPGFleetMetricsResponse {
 // /api/cnpg/fleet-metrics — each visible Cluster's largest standby replay lag
 // and volume growth, read with the workspace's namespace set.
 export function useCNPGFleetMetrics(namespaces: string[], enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   const ns = [...namespaces].sort().join(',')
   return useQuery<CNPGFleetMetricsResponse>({
-    queryKey: ['cnpg', 'fleet-metrics', ns],
-    queryFn: ({ signal }) => fetchJSON<CNPGFleetMetricsResponse>(`/cnpg/fleet-metrics${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal),
+    queryKey: ['cnpg', 'fleet-metrics', ns, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGFleetMetricsResponse>(`/cnpg/fleet-metrics${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal)),
     enabled,
     staleTime: 20_000,
     refetchInterval: 60_000,
@@ -105,14 +108,16 @@ export function useCNPGFleetMetrics(namespaces: string[], enabled = true) {
 
 // The Cluster's activity inside one interval, both bounds applied server-side.
 export function useCNPGClusterActivityWindow(namespace: string, name: string, since: string, until: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterActivityResponse>({
-    queryKey: ['cnpg', 'activity-window', namespace, name, since, until],
-    queryFn: ({ signal }) =>
+    queryKey: ['cnpg', 'activity-window', namespace, name, since, until, ...gatedKey],
+    queryFn: ({ signal }) => guard(() =>
       fetchJSON<CNPGClusterActivityResponse>(
         `/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/activity?since=${encodeURIComponent(since)}&until=${encodeURIComponent(until)}&limit=500`,
         signal,
-      ),
+      )),
     enabled: enabled && !!name,
     staleTime: 30_000,
+    retry: shouldRetryRadarQuery,
   })
 }
diff --git a/web/src/api/cnpg-recovery.ts b/web/src/api/cnpg-recovery.ts
index 02b9425a91..ce84978933 100644
--- a/web/src/api/cnpg-recovery.ts
+++ b/web/src/api/cnpg-recovery.ts
@@ -1,8 +1,9 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import type { Grant } from '@skyhook-io/k8s-ui'
-import { apiFetch, ApiError, fetchJSON } from './client'
+import { apiFetch, ApiError, fetchJSON, useRadarFeature } from './client'
 import type { CNPGActionCapability } from './cnpg'
 import { getApiBase } from './config'
+import { shouldRetryRadarQuery } from './radarFeatures'
 
 export type CNPGReadState = 'ok' | 'denied' | 'notFound' | 'error' | 'skipped' | 'partial'
 
@@ -109,16 +110,17 @@ const clusterPath = (namespace: string, name: string) => `/cnpg/clusters/${encod
 // phase, the recovery Job's Pods and their init containers, the instances and
 // Warning events about them. Polled every 5s until the Cluster reports healthy.
 export function useCNPGRecovery(namespace: string, name: string, options?: { enabled?: boolean }) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGRecoveryResponse>({
-    queryKey: ['cnpg', 'recovery', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGRecoveryResponse>(`${clusterPath(namespace, name)}/recovery`, signal),
+    queryKey: ['cnpg', 'recovery', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGRecoveryResponse>(`${clusterPath(namespace, name)}/recovery`, signal)),
     enabled: options?.enabled ?? true,
     staleTime: 3_000,
     refetchInterval: (query) => {
       const d = query.state.data
       return d?.recovery && d.cluster.phase !== 'Cluster in healthy state' ? 5_000 : 30_000
     },
-    retry: (count, err) => !(err instanceof ApiError && (err.status === 403 || err.status === 404)) && count < 2,
+    retry: (count, err) => shouldRetryRadarQuery(count, err) && !(err instanceof ApiError && (err.status === 403 || err.status === 404)) && count < 2,
   })
 }
 
@@ -129,14 +131,15 @@ export interface CNPGRestoreValidationRequest {
 }
 
 export function useRecordCNPGRestoreValidation(namespace: string, name: string) {
+  const { guard } = useRadarFeature('cnpgWorkspace')
   const queryClient = useQueryClient()
   return useMutation({
-    mutationFn: (body: CNPGRestoreValidationRequest) =>
+    mutationFn: (body: CNPGRestoreValidationRequest) => guard(() =>
       fetchJSON<CNPGRestoreValidation>(`${clusterPath(namespace, name)}/restore-validation`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(body),
-      }),
+      })),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['cnpg', 'recovery', namespace, name] })
       queryClient.invalidateQueries({ queryKey: ['cnpg', 'workspace'] })
@@ -237,9 +240,10 @@ export interface CNPGOperatorDiagnosis {
 // Cluster in `namespace` (create clusters, and the operator's webhook admits
 // writes), for every way into the restore dialog.
 export function useCNPGRestoreCapability(namespace: string) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGActionCapability>({
-    queryKey: ['cnpg', 'restore-capability', namespace],
-    queryFn: ({ signal }) => fetchJSON<CNPGActionCapability>(`/cnpg/restore/capability?namespace=${encodeURIComponent(namespace)}`, signal),
+    queryKey: ['cnpg', 'restore-capability', namespace, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGActionCapability>(`/cnpg/restore/capability?namespace=${encodeURIComponent(namespace)}`, signal)),
     enabled: !!namespace,
     staleTime: 15_000,
     retry: false,
diff --git a/web/src/api/cnpg-sessions.ts b/web/src/api/cnpg-sessions.ts
index f94f2e056d..47a81255c4 100644
--- a/web/src/api/cnpg-sessions.ts
+++ b/web/src/api/cnpg-sessions.ts
@@ -1,6 +1,6 @@
 import { useQuery } from '@tanstack/react-query'
 import type { Grant } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from './client'
+import { fetchJSON, useRadarFeature } from './client'
 import type { CNPGActionCapability, CNPGClusterFacts, CNPGRuntimeSourceState } from './cnpg'
 
 const enc = encodeURIComponent
@@ -59,10 +59,11 @@ export interface CNPGSessionsResponse {
 // /api/cnpg/clusters/{ns}/{name}/sessions — who blocks whom on one instance,
 // read with fixed SQL over the caller's pods/exec. Denied is a state, not an error.
 export function useCNPGSessions(namespace: string, name: string, pod?: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGSessionsResponse>({
-    queryKey: ['cnpg', 'sessions', namespace, name, pod ?? ''],
-    queryFn: ({ signal }) =>
-      fetchJSON<CNPGSessionsResponse>(`/cnpg/clusters/${enc(namespace)}/${enc(name)}/sessions${pod ? `?pod=${enc(pod)}` : ''}`, signal),
+    queryKey: ['cnpg', 'sessions', namespace, name, pod ?? '', ...gatedKey],
+    queryFn: ({ signal }) => guard(() =>
+      fetchJSON<CNPGSessionsResponse>(`/cnpg/clusters/${enc(namespace)}/${enc(name)}/sessions${pod ? `?pod=${enc(pod)}` : ''}`, signal)),
     enabled: enabled && !!name,
     refetchInterval: (q) => (q.state.data?.state === 'denied' ? false : 10_000),
     refetchIntervalInBackground: false,
@@ -98,9 +99,10 @@ export interface CNPGDestroyPlan {
 }
 
 export function useCNPGDestroyPlan(namespace: string, name: string, pod: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGDestroyPlan>({
-    queryKey: ['cnpg', 'destroy-plan', namespace, name, pod],
-    queryFn: ({ signal }) => fetchJSON<CNPGDestroyPlan>(`/cnpg/clusters/${enc(namespace)}/${enc(name)}/instances/${enc(pod)}/destroy-plan`, signal),
+    queryKey: ['cnpg', 'destroy-plan', namespace, name, pod, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGDestroyPlan>(`/cnpg/clusters/${enc(namespace)}/${enc(name)}/instances/${enc(pod)}/destroy-plan`, signal)),
     enabled: enabled && !!pod,
     staleTime: 0,
     retry: false,
@@ -137,9 +139,10 @@ export interface CNPGPoolerCapabilities {
 }
 
 export function useCNPGPoolerCapabilities(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGPoolerCapabilities>({
-    queryKey: ['cnpg', 'capabilities', 'poolers', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGPoolerCapabilities>(`/cnpg/poolers/${enc(namespace)}/${enc(name)}/capabilities`, signal),
+    queryKey: ['cnpg', 'capabilities', 'poolers', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGPoolerCapabilities>(`/cnpg/poolers/${enc(namespace)}/${enc(name)}/capabilities`, signal)),
     enabled: enabled && !!name,
     staleTime: 5_000,
     refetchInterval: 30_000,
@@ -157,9 +160,10 @@ export interface CNPGPgBouncerStateResponse {
 // /api/cnpg/poolers/{ns}/{name}/pgbouncer-state — each PgBouncer's own SHOW
 // STATE, the only place "paused" is observed rather than requested.
 export function useCNPGPgBouncerState(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGPgBouncerStateResponse>({
-    queryKey: ['cnpg', 'pgbouncer-state', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGPgBouncerStateResponse>(`/cnpg/poolers/${enc(namespace)}/${enc(name)}/pgbouncer-state`, signal),
+    queryKey: ['cnpg', 'pgbouncer-state', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGPgBouncerStateResponse>(`/cnpg/poolers/${enc(namespace)}/${enc(name)}/pgbouncer-state`, signal)),
     enabled: enabled && !!name,
     refetchInterval: (q) => (q.state.data?.permission.exec === 'denied' ? false : 15_000),
     refetchIntervalInBackground: false,
diff --git a/web/src/api/cnpg-storage.ts b/web/src/api/cnpg-storage.ts
index 0ab8ee0830..cee85f8239 100644
--- a/web/src/api/cnpg-storage.ts
+++ b/web/src/api/cnpg-storage.ts
@@ -1,6 +1,6 @@
 import { useQuery } from '@tanstack/react-query'
 import type { CNPGDiskReading, CNPGMetricIsolation, Grant } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from './client'
+import { fetchJSON, useRadarFeature } from './client'
 
 export type CNPGPVCRole = 'PG_DATA' | 'PG_WAL' | 'PG_TABLESPACE'
 
@@ -100,9 +100,10 @@ export interface CNPGClusterStorageResponse {
 // /api/cnpg/clusters/{ns}/{name}/storage — the Cluster's claims, their
 // measured use and each instance's WAL, every source with its own coverage.
 export function useCNPGClusterStorage(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterStorageResponse>({
-    queryKey: ['cnpg', 'storage', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGClusterStorageResponse>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/storage`, signal),
+    queryKey: ['cnpg', 'storage', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGClusterStorageResponse>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/storage`, signal)),
     enabled: enabled && !!name,
     refetchInterval: 30_000,
     refetchIntervalInBackground: false,
@@ -121,10 +122,11 @@ export interface CNPGFleetDiskResponse {
 // /api/cnpg/disk — the fullest measured volume of each visible Cluster. Read
 // with the same namespace set as the workspace so the two join row for row.
 export function useCNPGFleetDisk(namespaces: string[], enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   const ns = [...namespaces].sort().join(',')
   return useQuery<CNPGFleetDiskResponse>({
-    queryKey: ['cnpg', 'disk', ns],
-    queryFn: ({ signal }) => fetchJSON<CNPGFleetDiskResponse>(`/cnpg/disk${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal),
+    queryKey: ['cnpg', 'disk', ns, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGFleetDiskResponse>(`/cnpg/disk${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal)),
     enabled,
     staleTime: 20_000,
     refetchInterval: 60_000,
diff --git a/web/src/api/cnpg.ts b/web/src/api/cnpg.ts
index ce234342be..5cc74f7eb3 100644
--- a/web/src/api/cnpg.ts
+++ b/web/src/api/cnpg.ts
@@ -1,6 +1,7 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import type { CNPGSchedulePreview, CNPGWorkspaceResponse, Grant, TimelineEvent } from '@skyhook-io/k8s-ui'
-import { ApiError, fetchJSON } from './client'
+import { ApiError, fetchJSON, useRadarFeature } from './client'
+import { shouldRetryRadarQuery } from './radarFeatures'
 import type { CNPGOperatorDiagnosis } from './cnpg-recovery'
 
 // /api/cnpg/workspace
@@ -10,14 +11,16 @@ import type { CNPGOperatorDiagnosis } from './cnpg-recovery'
 // workspace screens, the Resources sidebar counts and the composed summaries,
 // so they can never disagree about what they count.
 export function useCNPGWorkspace(namespaces: string[], options?: { enabled?: boolean }) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   const ns = [...namespaces].sort().join(',')
   return useQuery<CNPGWorkspaceResponse>({
-    queryKey: ['cnpg', 'workspace', ns],
-    queryFn: ({ signal }) => fetchJSON<CNPGWorkspaceResponse>(`/cnpg/workspace${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal),
+    queryKey: ['cnpg', 'workspace', ns, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGWorkspaceResponse>(`/cnpg/workspace${ns ? `?namespaces=${encodeURIComponent(ns)}` : ''}`, signal)),
     enabled: options?.enabled ?? true,
     staleTime: 10_000,
     refetchInterval: 30_000,
     placeholderData: (prev) => prev,
+    retry: shouldRetryRadarQuery,
   })
 }
 
@@ -61,12 +64,14 @@ export interface CNPGOperatorResponse {
 // Deliberately not filtered by the namespace view filter: the operator runs in
 // its own namespace, which users rarely have selected.
 export function useCNPGOperator(options?: { enabled?: boolean }) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGOperatorResponse>({
-    queryKey: ['cnpg', 'operator'],
-    queryFn: ({ signal }) => fetchJSON<CNPGOperatorResponse>('/cnpg/operator', signal),
+    queryKey: ['cnpg', 'operator', ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGOperatorResponse>('/cnpg/operator', signal)),
     enabled: options?.enabled ?? true,
     staleTime: 30_000,
     refetchInterval: 60_000,
+    retry: shouldRetryRadarQuery,
   })
 }
 
@@ -88,14 +93,16 @@ export interface CNPGOperatorVerdict {
 //
 // The cheap operator verdict for the fleet and cluster pages, keyed by namespace.
 export function useCNPGOperatorStatus(namespaces: string[], options?: { enabled?: boolean }) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   const ns = [...new Set(namespaces)].sort().join(',')
   return useQuery<{ namespaces: Record<string, CNPGOperatorVerdict> }>({
-    queryKey: ['cnpg', 'operator-status', ns],
-    queryFn: ({ signal }) => fetchJSON<{ namespaces: Record<string, CNPGOperatorVerdict> }>(`/cnpg/operator/status?namespaces=${encodeURIComponent(ns)}`, signal),
+    queryKey: ['cnpg', 'operator-status', ns, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<{ namespaces: Record<string, CNPGOperatorVerdict> }>(`/cnpg/operator/status?namespaces=${encodeURIComponent(ns)}`, signal)),
     enabled: (options?.enabled ?? true) && ns !== '',
     staleTime: 10_000,
     refetchInterval: 30_000,
     placeholderData: (prev) => prev,
+    retry: shouldRetryRadarQuery,
   })
 }
 
@@ -111,17 +118,19 @@ export interface CNPGClusterActivityResponse {
 // The Cluster's history together with its instance Pods and every CNPG object
 // attributed to it, including ones since deleted.
 export function useCNPGClusterActivity(namespace: string, name: string, sinceHours = 24) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterActivityResponse>({
-    queryKey: ['cnpg', 'activity', namespace, name, sinceHours],
-    queryFn: ({ signal }) => {
+    queryKey: ['cnpg', 'activity', namespace, name, sinceHours, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => {
       const since = new Date(Date.now() - sinceHours * 3600_000).toISOString()
       return fetchJSON<CNPGClusterActivityResponse>(
         `/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/activity?since=${encodeURIComponent(since)}&limit=500`,
         signal,
       )
-    },
+    }),
     staleTime: 10_000,
     refetchInterval: 30_000,
+    retry: shouldRetryRadarQuery,
   })
 }
 
@@ -242,9 +251,10 @@ function cnpgPath(kind: 'clusters' | 'scheduledbackups' | 'poolers', namespace:
 }
 
 export function useCNPGClusterCapabilities(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGClusterCapabilities>({
-    queryKey: ['cnpg', 'capabilities', 'clusters', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGClusterCapabilities>(`${cnpgPath('clusters', namespace, name)}/capabilities`, signal),
+    queryKey: ['cnpg', 'capabilities', 'clusters', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGClusterCapabilities>(`${cnpgPath('clusters', namespace, name)}/capabilities`, signal)),
     enabled: enabled && !!name,
     staleTime: 5_000,
     retry: false,
@@ -254,10 +264,11 @@ export function useCNPGClusterCapabilities(namespace: string, name: string, enab
 // Parsed server-side with the operator's cron semantics; runs counted from the
 // schedule's own lastCheckTime. Pure computation: writes nothing.
 export function useCNPGSchedulePreview(namespace: string, name: string, schedule: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGSchedulePreview>({
-    queryKey: ['cnpg', 'schedule-preview', namespace, name, schedule],
-    queryFn: ({ signal }) =>
-      fetchJSON<CNPGSchedulePreview>(`${cnpgPath('scheduledbackups', namespace, name)}/schedule-preview?schedule=${encodeURIComponent(schedule)}`, signal),
+    queryKey: ['cnpg', 'schedule-preview', namespace, name, schedule, ...gatedKey],
+    queryFn: ({ signal }) => guard(() =>
+      fetchJSON<CNPGSchedulePreview>(`${cnpgPath('scheduledbackups', namespace, name)}/schedule-preview?schedule=${encodeURIComponent(schedule)}`, signal)),
     enabled: enabled && !!name,
     staleTime: 30_000,
     retry: false,
@@ -266,9 +277,10 @@ export function useCNPGSchedulePreview(namespace: string, name: string, schedule
 }
 
 export function useCNPGScheduleCapabilities(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGScheduleCapabilities>({
-    queryKey: ['cnpg', 'capabilities', 'scheduledbackups', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGScheduleCapabilities>(`${cnpgPath('scheduledbackups', namespace, name)}/capabilities`, signal),
+    queryKey: ['cnpg', 'capabilities', 'scheduledbackups', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGScheduleCapabilities>(`${cnpgPath('scheduledbackups', namespace, name)}/capabilities`, signal)),
     enabled: enabled && !!name,
     staleTime: 5_000,
     retry: false,
@@ -295,14 +307,15 @@ export interface CNPGActionResult {
 // No mutation meta: errors stay with the dialog (shown inline so the user can
 // adjust and retry), and the caller toasts success worded from the result.
 export function useCNPGAction(kind: 'clusters' | 'scheduledbackups' | 'poolers', namespace: string, name: string) {
+  const { guard } = useRadarFeature('cnpgWorkspace')
   const queryClient = useQueryClient()
   return useMutation<CNPGActionResult, Error, { action: string; request: CNPGActionRequest }>({
-    mutationFn: ({ action, request }) =>
+    mutationFn: ({ action, request }) => guard(() =>
       fetchJSON<CNPGActionResult>(`${cnpgPath(kind, namespace, name)}/actions/${action}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(request),
-      }),
+      })),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['cnpg'] })
       queryClient.invalidateQueries({ queryKey: ['resource'] })
@@ -462,9 +475,10 @@ export interface CNPGRuntimeResponse {
 // /api/cnpg/clusters/{ns}/{name}/runtime — live instance-manager status and
 // exporter metrics read through pods/proxy. Polled only while visible.
 export function useCNPGRuntime(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGRuntimeResponse>({
-    queryKey: ['cnpg', 'runtime', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGRuntimeResponse>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/runtime`, signal),
+    queryKey: ['cnpg', 'runtime', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGRuntimeResponse>(`/cnpg/clusters/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/runtime`, signal)),
     enabled: enabled && !!name,
     refetchInterval: (q) => (q.state.data?.permission.proxy === 'denied' ? false : 5_000),
     refetchIntervalInBackground: false,
@@ -488,9 +502,10 @@ export interface CNPGPoolerRuntimeResponse {
 }
 
 export function useCNPGPoolerRuntime(namespace: string, name: string, enabled = true) {
+  const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
   return useQuery<CNPGPoolerRuntimeResponse>({
-    queryKey: ['cnpg', 'pooler-runtime', namespace, name],
-    queryFn: ({ signal }) => fetchJSON<CNPGPoolerRuntimeResponse>(`/cnpg/poolers/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/runtime`, signal),
+    queryKey: ['cnpg', 'pooler-runtime', namespace, name, ...gatedKey],
+    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGPoolerRuntimeResponse>(`/cnpg/poolers/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/runtime`, signal)),
     enabled: enabled && !!name,
     refetchInterval: (q) => (q.state.data?.permission.proxy === 'denied' ? false : 30_000),
     refetchIntervalInBackground: false,
diff --git a/web/src/api/radarFeatures.ts b/web/src/api/radarFeatures.ts
index 0d92149b61..072daddc47 100644
--- a/web/src/api/radarFeatures.ts
+++ b/web/src/api/radarFeatures.ts
@@ -35,6 +35,8 @@ export const RADAR_FEATURES = {
   drainPlan: { label: 'Drain plans', minimumVersion: 'v1.14.0' },
   applications: { label: 'Applications', minimumVersion: 'v1.7.7' },
   workloadHistory: { label: 'Workload history', flag: 'workloadHistory', flagShippedWithEndpoint: true },
+  cnpgWorkspace: { label: 'The CloudNativePG workspace', flag: 'cnpgWorkspace', flagShippedWithEndpoint: true },
+  gitopsWriteEvidence: { label: 'GitOps revert warnings', flag: 'gitopsWriteEvidence', flagShippedWithEndpoint: true },
 } as const satisfies Record<string, RadarFeatureSpec>
 
 export type RadarFeature = keyof typeof RADAR_FEATURES
diff --git a/web/src/components/capacity/CapacityOverview.tsx b/web/src/components/capacity/CapacityOverview.tsx
index 90c46150b7..3ebe6d8c80 100644
--- a/web/src/components/capacity/CapacityOverview.tsx
+++ b/web/src/components/capacity/CapacityOverview.tsx
@@ -25,7 +25,8 @@ import { ClusterSchedulingCard } from "./ClusterSchedulingCard";
 import { Badge } from "@skyhook-io/k8s-ui/components/ui/Badge";
 import type { useCapacityOverview } from "../../api/client";
 import type { SelectedResource } from "../../types";
-import { actionSeverity, CapacityFreshness, capacityManagerLabel, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, CertaintyGlyph, formatQuantity, coverageMessage, DeniedBadge, errorMessage, formatTimestamp, humanizeCode, identityToSelectedResource, InlineEmpty, integrationBlock, InventoryQuantityCell, KpiTile, LinkButton, managerStatusTone, pickWorstPressure, PoolReadyBadge, poolReadinessDetail, RefreshError, relativeTime, ScopeBadges, ScrollableContent, SectionCard, shortResourceLabel, sortedResourceEntries, worstManagerStatus, type CapacityConnectionState } from "./shared";
+import { actionSeverity, CapacityFreshness, capacityManagerLabel, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, formatQuantity, coverageMessage, DeniedBadge, errorMessage, formatTimestamp, humanizeCode, identityToSelectedResource, InlineEmpty, integrationBlock, InventoryQuantityCell, KpiTile, LinkButton, managerStatusTone, pickWorstPressure, PoolReadyBadge, poolReadinessDetail, RefreshError, relativeTime, ScopeBadges, ScrollableContent, SectionCard, shortResourceLabel, sortedResourceEntries, worstManagerStatus, type CapacityConnectionState } from "./shared";
+import { CertaintyGlyph } from "@skyhook-io/k8s-ui";
 import { Notice, ScreenEmptyState } from "../workspace/layout";
 import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
diff --git a/web/src/components/capacity/CapacityPoolDetail.tsx b/web/src/components/capacity/CapacityPoolDetail.tsx
index d6f96073a8..c00b88e437 100644
--- a/web/src/components/capacity/CapacityPoolDetail.tsx
+++ b/web/src/components/capacity/CapacityPoolDetail.tsx
@@ -19,7 +19,8 @@ import {
 } from "../../api/client";
 import type { SelectedResource } from "../../types";
 import { refToSelectedResource } from "../../utils/navigation";
-import { ActualUsageDetail, ActualUsageInline, CapacityFreshness, CapacityIssueEvidence, CertaintyGlyph, ClaimStageBadge, conditionSummary, ConditionBadge, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, coverageMessage, DeniedBadge, errorMessage, formatQuantity, formatTaint, humanizeCode, identityKey, identityToSelectedResource, InlineEmpty, integrationBlock, KeyValueRows, LinkButton, memberCoverageSource, MiniCount, NodeReadyBadge, observationTitle, PoolReadyBadge, POOL_SECTIONS, PressureDetail, quantityResourceRank, QuantityInline, RefreshError, resourceLabel, ResourceLink, ScopeBadges, ScrollableContent, SectionCard, TokenGroup, useCapacityCursorRecovery, useCapacityPagination, type CapacityConnectionState, type PoolSection } from "./shared";
+import { ActualUsageDetail, ActualUsageInline, CapacityFreshness, CapacityIssueEvidence, ClaimStageBadge, conditionSummary, ConditionBadge, coverageHasObservations, coverageIsDenied, coverageIsLowerBound, coverageMessage, DeniedBadge, errorMessage, formatQuantity, formatTaint, humanizeCode, identityKey, identityToSelectedResource, InlineEmpty, integrationBlock, KeyValueRows, LinkButton, memberCoverageSource, MiniCount, NodeReadyBadge, observationTitle, PoolReadyBadge, POOL_SECTIONS, PressureDetail, quantityResourceRank, QuantityInline, RefreshError, resourceLabel, ResourceLink, ScopeBadges, ScrollableContent, SectionCard, TokenGroup, useCapacityCursorRecovery, useCapacityPagination, type CapacityConnectionState, type PoolSection } from "./shared";
+import { CertaintyGlyph } from "@skyhook-io/k8s-ui";
 import { Notice, ScreenEmptyState } from "../workspace/layout";
 import { ROW_HOVER, TABLE_HEAD, TABLE_WRAP, TBODY, TD, TH } from "../workspace/table";
 
diff --git a/web/src/components/capacity/ClusterSchedulingCard.tsx b/web/src/components/capacity/ClusterSchedulingCard.tsx
index c9506f7cf4..21df9e7e36 100644
--- a/web/src/components/capacity/ClusterSchedulingCard.tsx
+++ b/web/src/components/capacity/ClusterSchedulingCard.tsx
@@ -9,7 +9,8 @@ import {
   parseCPUToNanocores,
   parseQuantityToNumber,
 } from "@skyhook-io/k8s-ui/utils/format";
-import { CertaintyGlyph, LinkButton, SectionCard, certaintyGlyph, certaintyValueLabel, formatQuantity, quantityResourceRank, resourceLabel } from "./shared";
+import { LinkButton, SectionCard, formatQuantity, quantityResourceRank, resourceLabel } from "./shared";
+import { CertaintyGlyph, certaintyGlyph, certaintyValueLabel } from "@skyhook-io/k8s-ui";
 
 // Karpenter scheduling capacity — the fleet-level "how full is Karpenter, and
 // how much is knocking at the door" bar. Karpenter-pooled nodes only: on mixed
diff --git a/web/src/components/capacity/certaintyGlyph.test.tsx b/web/src/components/capacity/certaintyGlyph.test.tsx
index 841d339671..e1dc60a6dd 100644
--- a/web/src/components/capacity/certaintyGlyph.test.tsx
+++ b/web/src/components/capacity/certaintyGlyph.test.tsx
@@ -4,7 +4,8 @@ import type {
   CapacityActivityState,
   CapacityQuantityObservation,
 } from "@skyhook-io/k8s-ui";
-import { DeniedCapacityState, ActivityStateBadge, CertaintyGlyph, InventoryQuantityCell, QuantityInline, certaintyGlyph, managerStatusRank } from "./shared";
+import { DeniedCapacityState, ActivityStateBadge, InventoryQuantityCell, QuantityInline, managerStatusRank } from "./shared";
+import { CertaintyGlyph, certaintyGlyph } from "@skyhook-io/k8s-ui";
 
 function observation(
   certainty: CapacityQuantityObservation["certainty"],
diff --git a/web/src/components/capacity/shared.tsx b/web/src/components/capacity/shared.tsx
index c6b1db51d2..6b68573a9b 100644
--- a/web/src/components/capacity/shared.tsx
+++ b/web/src/components/capacity/shared.tsx
@@ -23,6 +23,8 @@ import {
   ResourceBar,
   Tooltip,
   WithTooltip,
+  certaintyValueLabel,
+  CertaintyGlyph,
   type CapacityActivityEpisode,
   type CapacityCertainty,
   type CapacityClaimStage,
@@ -264,20 +266,6 @@ function missingUsageMessage(coverage?: CapacitySourceCoverage): string {
 // = exact · ≥ lower bound · ≤ upper bound · ? unknown
 // ============================================================================
 
-export function certaintyGlyph(certainty: CapacityCertainty): string {
-  if (certainty === "exact") return "=";
-  if (certainty === "lower_bound") return "≥";
-  if (certainty === "upper_bound") return "≤";
-  return "?";
-}
-
-export function certaintyValueLabel(certainty: CapacityCertainty): string {
-  if (certainty === "exact") return "Exact";
-  if (certainty === "lower_bound") return "Lower bound";
-  if (certainty === "upper_bound") return "Upper bound";
-  return "Unknown certainty";
-}
-
 export function observationTitle(
   observation: CapacityQuantityObservation,
   definition?: string,
@@ -294,27 +282,6 @@ export function observationTitle(
 }
 
 /** Small bordered mono glyph chip; hover reveals certainty/source/asOf. */
-export function CertaintyGlyph({
-  certainty,
-  title,
-}: {
-  certainty: CapacityCertainty;
-  title?: string;
-}) {
-  return (
-    <WithTooltip tip={title ?? certaintyValueLabel(certainty)}>
-      <span
-        tabIndex={0}
-        role="note"
-        aria-label={title ?? certaintyValueLabel(certainty)}
-        className="cursor-help rounded border border-theme-border-light px-1 font-mono text-[10px] leading-tight text-theme-text-tertiary focus-visible:outline focus-visible:outline-2 focus-visible:outline-skyhook-500"
-      >
-        {certaintyGlyph(certainty)}
-      </span>
-    </WithTooltip>
-  );
-}
-
 // ============================================================================
 // Quantity / resource formatting
 // ============================================================================
diff --git a/web/src/components/cnpg/CNPGClusterLogs.tsx b/web/src/components/cnpg/CNPGClusterLogs.tsx
index afda7930a9..d8055771b8 100644
--- a/web/src/components/cnpg/CNPGClusterLogs.tsx
+++ b/web/src/components/cnpg/CNPGClusterLogs.tsx
@@ -1,7 +1,7 @@
 import { useCallback } from 'react'
 import { useSearchParams } from 'react-router-dom'
 import { WorkloadLogsViewer, type WorkloadLogsFetchParams, type WorkloadLogsResult } from '@skyhook-io/k8s-ui'
-import { fetchJSON } from '../../api/client'
+import { fetchJSON, useRadarFeature } from '../../api/client'
 import { getApiBase, getCredentialsMode } from '../../api/config'
 import { useDesktopDownload } from '../../hooks/useDesktopDownload'
 import { useTheme } from '../../context/ThemeContext'
@@ -43,18 +43,20 @@ export function CNPGClusterLogs({ namespace, name }: { namespace: string; name:
   const since = interval?.since
   const until = interval?.until
 
+  const { guard, support } = useRadarFeature('cnpgWorkspace')
   const fetchAll = useCallback(
     (params: WorkloadLogsFetchParams) =>
-      fetchJSON<WorkloadLogsResult>(`${logsPath(namespace, name)}${since && until ? intervalQuery(params, since, until) : query(params)}`, { signal: params.signal }),
-    [namespace, name, since, until],
+      guard(() => fetchJSON<WorkloadLogsResult>(`${logsPath(namespace, name)}${since && until ? intervalQuery(params, since, until) : query(params)}`, { signal: params.signal })),
+    [guard, namespace, name, since, until],
   )
-  const createStream = useCallback(
+  const stream = useCallback(
     (params: WorkloadLogsFetchParams) =>
       new EventSource(`${getApiBase()}${logsPath(namespace, name)}/stream${query(params, 50)}`, {
         withCredentials: getCredentialsMode() === 'include',
       }),
     [namespace, name],
   )
+  const createStream = support === 'unsupported' ? undefined : stream
 
   return (
     <div className="flex h-full flex-col">
diff --git a/web/src/components/cnpg/CNPGDetailPage.tsx b/web/src/components/cnpg/CNPGDetailPage.tsx
index 797df66862..35887b29c8 100644
--- a/web/src/components/cnpg/CNPGDetailPage.tsx
+++ b/web/src/components/cnpg/CNPGDetailPage.tsx
@@ -4,7 +4,7 @@ import { Activity, ArrowLeft, Database, Gauge, ShieldCheck, Unplug } from 'lucid
 import type { WorkloadExtraTab } from '@skyhook-io/k8s-ui'
 import type { SelectedResource } from '../../types'
 import { useConnection } from '../../context/ConnectionContext'
-import { useContexts } from '../../api/client'
+import { useContexts, useRadarFeature } from '../../api/client'
 import { useContextSwitchFlow } from '../useContextSwitchFlow'
 import { WorkloadView } from '../workload/WorkloadView'
 import { CNPGClusterActivity } from './CNPGClusterActivity'
@@ -103,8 +103,10 @@ export function CNPGDetailPage({
     [navigate, activeContext, onOpenResource],
   )
 
+  // A Radar without the workspace endpoints shows the standard detail.
+  const cnpgWorkspace = useRadarFeature('cnpgWorkspace').support !== 'unsupported'
   const extraTabs = useMemo<WorkloadExtraTab[] | undefined>(() => {
-    if (target.plural !== 'clusters') return undefined
+    if (target.plural !== 'clusters' || !cnpgWorkspace) return undefined
     return [
       {
         id: 'runtime',
@@ -141,7 +143,7 @@ export function CNPGDetailPage({
         ),
       },
     ]
-  }, [target.plural, target.namespace, target.name, onOpenResource, openRelated, searchParams, setSearchParams, location.state])
+  }, [target.plural, target.namespace, target.name, cnpgWorkspace, onOpenResource, openRelated, searchParams, setSearchParams, location.state])
 
   if (pinnedContext && activeContext && pinnedContext !== activeContext) {
     return <NotInContext target={target} pinnedContext={pinnedContext} activeContext={activeContext} homeLabel={home.label} homePath={home.path} />
diff --git a/web/src/components/cnpg/actions/CNPGReportDialog.tsx b/web/src/components/cnpg/actions/CNPGReportDialog.tsx
index 6241d265ce..7353570a44 100644
--- a/web/src/components/cnpg/actions/CNPGReportDialog.tsx
+++ b/web/src/components/cnpg/actions/CNPGReportDialog.tsx
@@ -1,6 +1,7 @@
 import { useState } from 'react'
 import { ActionConfirmDialog } from '@skyhook-io/k8s-ui'
 import { downloadCNPGReport } from '../../../api/cnpg-recovery'
+import { useRadarFeature } from '../../../api/client'
 import { useConnection } from '../../../context/ConnectionContext'
 import { downloadBlob } from '../../resources/file-browser-utils'
 
@@ -24,6 +25,7 @@ export function CNPGReportDialog({ namespace, name, onClose }: { namespace: stri
   const [queryText, setQueryText] = useState(false)
   const [tailLines, setTailLines] = useState(1000)
   const [busy, setBusy] = useState(false)
+  const { guard } = useRadarFeature('cnpgWorkspace')
   const [error, setError] = useState<string | null>(null)
 
   return (
@@ -34,7 +36,7 @@ export function CNPGReportDialog({ namespace, name, onClose }: { namespace: stri
         setBusy(true)
         setError(null)
         try {
-          const { blob, filename } = await downloadCNPGReport(namespace, name, { logs, queryText: logs && queryText, tailLines })
+          const { blob, filename } = await guard(() => downloadCNPGReport(namespace, name, { logs, queryText: logs && queryText, tailLines }))
           await downloadBlob(blob, filename)
           onClose()
         } catch (e) {
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index fb54a166fa..2b82fdc52e 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -4,6 +4,10 @@ import { Database } from 'lucide-react'
 import {
   CNPG_KIND_BY_KEY,
   PaneLoader,
+  RadarUpgradeAction,
+  getRadarUpgradeRequirement,
+  radarUpgradeDetail,
+  radarUpgradeHeadline,
   type CNPGFleet,
   type CNPGKindCoverage,
   type CNPGWorkspaceResponse,
@@ -79,6 +83,21 @@ export function CNPGScreenGate({
   const data = query.data
   if (!data && query.isLoading) return <PaneLoader label="Loading CloudNativePG…" className="flex-1" />
   if (!data) {
+    const upgrade = getRadarUpgradeRequirement(query.error)
+    if (upgrade) {
+      return (
+        <ScreenEmptyState
+          icon={Database}
+          title={radarUpgradeHeadline('The CloudNativePG workspace')}
+          detail={radarUpgradeDetail(upgrade)}
+          action={
+            <div className="mt-3 text-sm">
+              <RadarUpgradeAction requirement={upgrade} />
+            </div>
+          }
+        />
+      )
+    }
     return (
       <ScreenEmptyState
         icon={Database}
diff --git a/web/src/components/cnpg/useCNPGSidebarWorkspace.ts b/web/src/components/cnpg/useCNPGSidebarWorkspace.ts
index f41b8fee57..813c11ef9c 100644
--- a/web/src/components/cnpg/useCNPGSidebarWorkspace.ts
+++ b/web/src/components/cnpg/useCNPGSidebarWorkspace.ts
@@ -4,6 +4,7 @@ import { Database, FileCheck2, Settings2, ShieldCheck, Waypoints } from 'lucide-
 import { applyCNPGDisk, applyCNPGFleetMetrics, buildCNPGFleet, type CNPGDiskReading, type CNPGFleet, type SidebarCategoryWorkspace } from '@skyhook-io/k8s-ui'
 import type { APIResource } from '../../types'
 import { useCNPGWorkspace } from '../../api/cnpg'
+import { useRadarFeature } from '../../api/client'
 import { useCNPGFleetDisk } from '../../api/cnpg-storage'
 import { useCNPGFleetMetrics } from '../../api/cnpg-history'
 import { CNPG_SCREENS, type CNPGScreen } from './routes'
@@ -50,18 +51,20 @@ function diskFailed(clusters: any[], err: unknown): CNPGDiskReading[] {
   return clusters.map((c) => ({ namespace: c?.metadata?.namespace ?? '', name: c?.metadata?.name ?? '', state: 'error', reason, claims: 0, measured: 0 }))
 }
 
-function destinationCount(screen: CNPGScreen, fleet: CNPGFleet | null): { count?: number | null; title?: string } {
+function destinationCount(screen: CNPGScreen, fleet: CNPGFleet | null): { count?: number | null; lowerBound?: boolean; title?: string } {
   if (!fleet) return {}
-  const lowerBound = fleet.incompleteKinds.length > 0 ? ' Some CloudNativePG data is not readable, so this is a lower bound.' : ''
+  const partial = fleet.incompleteKinds.length > 0
+  const note = partial ? ' Some CloudNativePG data is not readable, so this is a lower bound.' : ''
+  const at = (count: number, what: string) => ({ count, lowerBound: partial, title: `${partial ? 'At least ' : ''}${count} ${what}.${note}` })
   switch (screen) {
     case 'overview':
-      return { count: fleet.attentionCount, title: `${fleet.attentionCount} clusters need attention.${lowerBound}` }
+      return at(fleet.attentionCount, 'clusters need attention')
     case 'protection':
-      return { count: fleet.categoryCounts.protection, title: `${fleet.categoryCounts.protection} clusters with failing backups or WAL archiving.${lowerBound}` }
+      return at(fleet.categoryCounts.protection, 'clusters with failing backups or WAL archiving')
     case 'declarations':
-      return { count: fleet.categoryCounts.declarations, title: `${fleet.categoryCounts.declarations} clusters with declarations that are not reconciled.${lowerBound}` }
+      return at(fleet.categoryCounts.declarations, 'clusters with declarations that are not reconciled')
     case 'pooling':
-      return { count: fleet.categoryCounts.pooling, title: `${fleet.categoryCounts.pooling} clusters with Pooler problems.${lowerBound}` }
+      return at(fleet.categoryCounts.pooling, 'clusters with Pooler problems')
     default:
       return {}
   }
@@ -82,19 +85,23 @@ export function useCNPGSidebarWorkspace({
   active?: { screen: CNPGScreen; child?: { label: string; title?: string } }
 }): Record<string, SidebarCategoryWorkspace> | undefined {
   const navigate = useNavigate()
-  const discovered = cnpgDiscovered(apiResources)
-  const { fleet } = useCNPGFleet(namespaces, discovered)
+  // A Radar that predates the workspace serves none of its endpoints: no
+  // destinations rather than ones that fail when opened.
+  const { support } = useRadarFeature('cnpgWorkspace')
+  const available = cnpgDiscovered(apiResources) && support !== 'unsupported'
+  const { fleet } = useCNPGFleet(namespaces, available)
   const nsKey = namespaces.join(',')
 
   return useMemo(() => {
-    if (!discovered) return undefined
+    if (!available) return undefined
     const destinations = CNPG_SCREENS.map((s) => {
-      const { count, title } = destinationCount(s.id, fleet)
+      const { count, lowerBound, title } = destinationCount(s.id, fleet)
       return {
         id: s.id,
         label: s.label,
         icon: ICONS[s.id],
         count,
+        countLowerBound: lowerBound,
         countTitle: title,
         active: active?.screen === s.id,
         child: active?.screen === s.id ? active.child : undefined,
@@ -108,5 +115,5 @@ export function useCNPGSidebarWorkspace({
         scopeNote: nsKey ? `Counts for namespace ${nsKey.split(',').join(', ')}` : undefined,
       },
     }
-  }, [discovered, fleet, active?.screen, active?.child?.label, active?.child?.title, navigate, nsKey]) // eslint-disable-line react-hooks/exhaustive-deps
+  }, [available, fleet, active?.screen, active?.child?.label, active?.child?.title, navigate, nsKey]) // eslint-disable-line react-hooks/exhaustive-deps
 }
diff --git a/web/src/components/workload/WorkloadView.tsx b/web/src/components/workload/WorkloadView.tsx
index 9fed2751c6..b2f125160f 100644
--- a/web/src/components/workload/WorkloadView.tsx
+++ b/web/src/components/workload/WorkloadView.tsx
@@ -98,7 +98,7 @@ import { RightsizingPanel } from '../resource/RightsizingStrip'
 import { WorkloadCostTab } from '../cost/WorkloadCostTab'
 import { isOpenCostWorkloadKind } from '../cost/kinds'
 import { isRadarFeatureUnsupported } from '../../api/radarFeatures'
-import { useResourceAudit, useResourceIssues, useResources, useTrace, fetchTraceWithProbes, fetchInClusterCapability, runInClusterMerged } from '../../api/client'
+import { useResourceAudit, useResourceIssues, useResources, useTrace, fetchTraceWithProbes, fetchInClusterCapability, runInClusterMerged, useRadarFeature } from '../../api/client'
 import { AuditAlerts, getRadarUpgradeRequirement, ResourceIssuesSection, ReachabilityView, TraceSummary, InClusterConsentDialog, traceFingerprint, staticPollUnreliable, summarizeInClusterTests, type Trace as NetworkTrace, type InClusterCapability, inClusterConsentGiven, consentRequestRows } from '@skyhook-io/k8s-ui'
 import { WorkloadLogsViewer } from '../logs/WorkloadLogsViewer'
 import { ScheduledWorkloadLogsViewer } from '../logs/ScheduledWorkloadLogsViewer'
@@ -228,6 +228,7 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
   const location = useLocation()
   const navigate = useNavigate()
   const [searchParams] = useSearchParams()
+  const cnpgWorkspace = useRadarFeature('cnpgWorkspace').support !== 'unsupported'
 
   // Parse /workload/:kind/:ns/:name from pathname. Segments are URL-encoded by
   // buildWorkloadPath; names can also contain literal slashes (e.g. some CRD names),
@@ -284,7 +285,8 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
     )
   }
 
-  const cnpgPlural = cnpgDetailKindFor(kind, group)
+  // A Radar without the CloudNativePG workspace keeps the standard view.
+  const cnpgPlural = cnpgWorkspace ? cnpgDetailKindFor(kind, group) : null
   if (cnpgPlural) {
     const params = new URLSearchParams(searchParams)
     params.delete('apiGroup')
@@ -556,6 +558,7 @@ export function WorkloadView({
 }: WorkloadViewProps) {
   const [searchParams, setSearchParams] = useSearchParams()
   const location = useLocation()
+  const cnpgWorkspace = useRadarFeature('cnpgWorkspace').support !== 'unsupported'
   const apiKind = kindToPluralWithGroup(kindProp, rest.group ?? '')
   const queryClient = useQueryClient()
   const [imageTargetOwnership, setImageTargetOwnership] =
@@ -1202,9 +1205,16 @@ export function WorkloadView({
             onSelectRun={handleSelectedRunChange}
           />
         )}
-        renderHeaderActions={({ resource: res, context, onNavigate }) => renderCNPGHeaderActions({ resource: res, namespace, name, compact: context === 'drawer', onNavigate })}
-        renderSummary={({ apiKind: ak, namespace: ns, name: n, resource: res, context, onNavigate }) =>
-          renderCNPGSummary({ apiKind: ak, namespace: ns, name: n, group: effectiveGroup, resource: res, context, onNavigate })
+        renderHeaderActions={
+          cnpgWorkspace
+            ? ({ resource: res, context, onNavigate }) => renderCNPGHeaderActions({ resource: res, namespace, name, compact: context === 'drawer', onNavigate })
+            : undefined
+        }
+        renderSummary={
+          cnpgWorkspace
+            ? ({ apiKind: ak, namespace: ns, name: n, resource: res, context, onNavigate }) =>
+                renderCNPGSummary({ apiKind: ak, namespace: ns, name: n, group: effectiveGroup, resource: res, context, onNavigate })
+            : undefined
         }
         renderExpandedOverview={({ kind: k, apiKind, namespace: ns, name: n, resource: res }) =>
           supportsBatchExecution(k, apiKind, effectiveGroup, res?.apiVersion) &&
diff --git a/web/src/hooks/useGitOpsWriteGuard.ts b/web/src/hooks/useGitOpsWriteGuard.ts
index ee6e4e640c..0948197b5f 100644
--- a/web/src/hooks/useGitOpsWriteGuard.ts
+++ b/web/src/hooks/useGitOpsWriteGuard.ts
@@ -9,7 +9,7 @@ import {
   type GitOpsWriteTarget,
 } from '@skyhook-io/k8s-ui'
 import type { Relationships } from '../types'
-import { fetchGitOpsWriteEvidence, useResource } from '../api/client'
+import { fetchGitOpsWriteEvidence, useResource, useRadarFeature } from '../api/client'
 import { kindToPluralWithGroup } from '../utils/navigation'
 import { gitOpsOwnerKindRef, useResolvedGitOpsOwner, type ResolvedGitOpsOwner } from './useResolvedGitOpsOwner'
 
@@ -78,17 +78,20 @@ export function useGitOpsWriteGuard({
     return null
   }, [ownership.owner, ownership.helmOwner])
 
+  const evidenceFeature = useRadarFeature('gitopsWriteEvidence')
   const evidenceQuery = useQuery({
-    queryKey: ['gitops-write-evidence', target.kind, target.group, target.namespace, target.name, paths, ownerRef],
+    queryKey: ['gitops-write-evidence', target.kind, target.group, target.namespace, target.name, paths, ownerRef, ...evidenceFeature.gatedKey],
     queryFn: () =>
-      fetchGitOpsWriteEvidence({
-        kind: target.kind,
-        group: target.group,
-        namespace: target.namespace,
-        name: target.name,
-        paths,
-        owner: ownerRef ?? undefined,
-      }),
+      evidenceFeature.guard(() =>
+        fetchGitOpsWriteEvidence({
+          kind: target.kind,
+          group: target.group,
+          namespace: target.namespace,
+          name: target.name,
+          paths,
+          owner: ownerRef ?? undefined,
+        }),
+      ),
     enabled: enabled && managed && !lookupPending,
     staleTime: 0,
     retry: false,

From afbe26067ce356370d220a915320b01ce9f851e6 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:46:43 +0300
Subject: [PATCH 12/26] Share the bounded per-namespace fan-out of the CNPG
 fleet reads

The fleet metrics and fleet disk handlers each hand-rolled a semaphore,
cancellation check, indexed results and join. fanOut does that
scheduling; each handler still fans out over at most 64 namespaces,
answers the rest as notRead itself and sorts its rows.
---
 internal/server/cnpg_history.go | 36 +++++++++--------------------
 internal/server/cnpg_storage.go | 35 ++++++++--------------------
 internal/server/fanout.go       | 32 +++++++++++++++++++++++++
 internal/server/fanout_test.go  | 41 +++++++++++++++++++++++++++++++++
 4 files changed, 94 insertions(+), 50 deletions(-)
 create mode 100644 internal/server/fanout.go
 create mode 100644 internal/server/fanout_test.go

diff --git a/internal/server/cnpg_history.go b/internal/server/cnpg_history.go
index b8e7b1f4c7..e87d028d1a 100644
--- a/internal/server/cnpg_history.go
+++ b/internal/server/cnpg_history.go
@@ -349,34 +349,20 @@ func (s *Server) handleCNPGFleetMetrics(w http.ResponseWriter, r *http.Request)
 	}
 	sort.Strings(nsList)
 
-	results := make([][]CNPGClusterFleetMetrics, len(nsList))
-	sem := make(chan struct{}, cnpgFleetDiskConcurrency)
-	var wg sync.WaitGroup
-	for i, ns := range nsList {
-		if i >= cnpgFleetDiskMaxNamespaces {
-			reason := fmt.Sprintf("read for at most %d namespaces at a time; narrow the namespace filter", cnpgFleetDiskMaxNamespaces)
-			for _, c := range byNamespace[ns] {
-				results[i] = append(results[i], CNPGClusterFleetMetrics{Namespace: ns, Name: c.GetName(),
-					Lag: CNPGFleetLag{State: cnpgUsageStateNotRead, Reason: reason}, Growth: CNPGFleetGrowth{State: cnpgUsageStateNotRead, Reason: reason}})
-			}
-			continue
-		}
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			select {
-			case sem <- struct{}{}:
-			case <-r.Context().Done():
-				return
-			}
-			defer func() { <-sem }()
-			results[i] = s.cnpgNamespaceFleetMetrics(r, cache, ns, byNamespace[ns])
-		}()
-	}
-	wg.Wait()
+	read := min(len(nsList), cnpgFleetDiskMaxNamespaces)
+	results := fanOut(r.Context(), read, cnpgFleetDiskConcurrency, func(i int) []CNPGClusterFleetMetrics {
+		return s.cnpgNamespaceFleetMetrics(r, cache, nsList[i], byNamespace[nsList[i]])
+	})
 	for _, rs := range results {
 		resp.Clusters = append(resp.Clusters, rs...)
 	}
+	reason := fmt.Sprintf("read for at most %d namespaces at a time; narrow the namespace filter", cnpgFleetDiskMaxNamespaces)
+	for _, ns := range nsList[read:] {
+		for _, c := range byNamespace[ns] {
+			resp.Clusters = append(resp.Clusters, CNPGClusterFleetMetrics{Namespace: ns, Name: c.GetName(),
+				Lag: CNPGFleetLag{State: cnpgUsageStateNotRead, Reason: reason}, Growth: CNPGFleetGrowth{State: cnpgUsageStateNotRead, Reason: reason}})
+		}
+	}
 	sort.Slice(resp.Clusters, func(i, j int) bool {
 		if resp.Clusters[i].Namespace != resp.Clusters[j].Namespace {
 			return resp.Clusters[i].Namespace < resp.Clusters[j].Namespace
diff --git a/internal/server/cnpg_storage.go b/internal/server/cnpg_storage.go
index f6581252cb..460bdb2def 100644
--- a/internal/server/cnpg_storage.go
+++ b/internal/server/cnpg_storage.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"sort"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -815,33 +814,19 @@ func (s *Server) handleCNPGFleetDisk(w http.ResponseWriter, r *http.Request) {
 	}
 	sort.Strings(nsList)
 
-	results := make([][]CNPGClusterDisk, len(nsList))
-	sem := make(chan struct{}, cnpgFleetDiskConcurrency)
-	var wg sync.WaitGroup
-	for i, ns := range nsList {
-		if i >= cnpgFleetDiskMaxNamespaces {
-			for _, c := range byNamespace[ns] {
-				results[i] = append(results[i], CNPGClusterDisk{Namespace: ns, Name: c.GetName(), State: cnpgUsageStateNotRead,
-					Reason: fmt.Sprintf("disk use is read for at most %d namespaces at a time; narrow the namespace filter", cnpgFleetDiskMaxNamespaces)})
-			}
-			continue
-		}
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			select {
-			case sem <- struct{}{}:
-			case <-r.Context().Done():
-				return
-			}
-			defer func() { <-sem }()
-			results[i] = s.cnpgNamespaceDisk(r, cache, ns, byNamespace[ns])
-		}()
-	}
-	wg.Wait()
+	read := min(len(nsList), cnpgFleetDiskMaxNamespaces)
+	results := fanOut(r.Context(), read, cnpgFleetDiskConcurrency, func(i int) []CNPGClusterDisk {
+		return s.cnpgNamespaceDisk(r, cache, nsList[i], byNamespace[nsList[i]])
+	})
 	for _, rs := range results {
 		resp.Clusters = append(resp.Clusters, rs...)
 	}
+	for _, ns := range nsList[read:] {
+		for _, c := range byNamespace[ns] {
+			resp.Clusters = append(resp.Clusters, CNPGClusterDisk{Namespace: ns, Name: c.GetName(), State: cnpgUsageStateNotRead,
+				Reason: fmt.Sprintf("disk use is read for at most %d namespaces at a time; narrow the namespace filter", cnpgFleetDiskMaxNamespaces)})
+		}
+	}
 	sort.Slice(resp.Clusters, func(i, j int) bool {
 		if resp.Clusters[i].Namespace != resp.Clusters[j].Namespace {
 			return resp.Clusters[i].Namespace < resp.Clusters[j].Namespace
diff --git a/internal/server/fanout.go b/internal/server/fanout.go
new file mode 100644
index 0000000000..29ea77982c
--- /dev/null
+++ b/internal/server/fanout.go
@@ -0,0 +1,32 @@
+package server
+
+import (
+	"context"
+	"sync"
+)
+
+// fanOut calls run(i) for every i in [0, n), at most limit at a time, and
+// returns the results in index order once every call has finished. A call
+// still waiting for a slot when ctx is done does not run; its result is the
+// zero value. Caps on n, ordering and what a skipped index means stay with
+// the caller.
+func fanOut[T any](ctx context.Context, n, limit int, run func(i int) T) []T {
+	results := make([]T, n)
+	sem := make(chan struct{}, limit)
+	var wg sync.WaitGroup
+	for i := range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			select {
+			case sem <- struct{}{}:
+			case <-ctx.Done():
+				return
+			}
+			defer func() { <-sem }()
+			results[i] = run(i)
+		}()
+	}
+	wg.Wait()
+	return results
+}
diff --git a/internal/server/fanout_test.go b/internal/server/fanout_test.go
new file mode 100644
index 0000000000..911ff4c32c
--- /dev/null
+++ b/internal/server/fanout_test.go
@@ -0,0 +1,41 @@
+package server
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestFanOutKeepsIndexOrderAndBoundsConcurrency(t *testing.T) {
+	var running, peak atomic.Int32
+	got := fanOut(context.Background(), 20, 3, func(i int) int {
+		n := running.Add(1)
+		for {
+			p := peak.Load()
+			if n <= p || peak.CompareAndSwap(p, n) {
+				break
+			}
+		}
+		time.Sleep(2 * time.Millisecond)
+		running.Add(-1)
+		return i * 10
+	})
+	if len(got) != 20 {
+		t.Fatalf("len = %d", len(got))
+	}
+	for i, v := range got {
+		if v != i*10 {
+			t.Fatalf("results[%d] = %d, want %d", i, v, i*10)
+		}
+	}
+	if p := peak.Load(); p > 3 || p < 1 {
+		t.Errorf("peak concurrency = %d, want 1..3", p)
+	}
+}
+
+func TestFanOutOfNothing(t *testing.T) {
+	if got := fanOut(context.Background(), 0, 4, func(int) string { t.Fatal("ran"); return "" }); len(got) != 0 {
+		t.Errorf("got %v", got)
+	}
+}

From bf05ebdb023e3e547f78ba9ea96d91cc0945bdff Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:46:48 +0300
Subject: [PATCH 13/26] Title a CloudNativePG problem the way the Issues page
 titles its reason

The Issues page and the workspace titled WAL archiving and the latest
backup failure in two wordings. issueReasonTitle now answers for those
reasons in both places; the workspace keeps titles only for reasons the
Issues page does not title itself.
---
 .../src/components/cnpg/workspace-problems.test.ts    |  2 +-
 packages/k8s-ui/src/components/cnpg/workspace.ts      | 11 +++++------
 packages/k8s-ui/src/components/issues/index.ts        |  1 +
 packages/k8s-ui/src/components/issues/severity.ts     |  7 ++++++-
 4 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/packages/k8s-ui/src/components/cnpg/workspace-problems.test.ts b/packages/k8s-ui/src/components/cnpg/workspace-problems.test.ts
index dfdddf1b2a..e5d441536c 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace-problems.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace-problems.test.ts
@@ -45,7 +45,7 @@ describe('cnpgIssueText', () => {
       message:
         'The last WAL archival did not complete; recovery-point advancement is uncertain: unexpected failure invoking barman-cloud-wal-archive: exit status 4',
     })
-    expect(t.title).toBe('WAL archiving is failing')
+    expect(t.title).toBe('WAL archiving failing')
     expect(t.detail).toContain('exit status 4')
   })
 })
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index 92ff5464af..6a3ae17904 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -7,6 +7,7 @@ import { worseTone } from '../ui/status-tone'
 import type { Fact, ProblemOrigin, WorkspaceProblem } from '../workspace'
 import { formatBytes } from '../../utils/format'
 import { formatGrant, type Grant } from '../../utils/grant'
+import { issueReasonTitle } from '../issues/severity'
 import {
   CNPG_BARMAN_PLUGIN_NAME,
   getCNPGClusterBackupConfig,
@@ -206,13 +207,11 @@ const CNPG_POD_REASON_SENTENCES: Record<string, string> = {
 
 // Plain headlines for CNPG issues whose message carries the operator's own
 // condition text; that message becomes the detail beneath.
+// Reasons the Issues page already titles come from issueReasonTitle, so a
+// problem reads the same here and there; these are the rest.
 const CNPG_REASON_TITLES: Record<string, string> = {
-  CNPGWALArchivingFailing: 'WAL archiving is failing',
-  CNPGLastBackupFailed: 'The last backup failed',
   CNPGBackupFailed: 'Backup failed',
   CNPGScheduledBackupMissed: 'A scheduled backup did not run',
-  // The detector sees no successful backup since the run; a failed one may exist.
-  CNPGScheduledRunNoBackup: 'No successful backup since a scheduled run',
   CNPGCertificateExpiring: 'A certificate expires soon',
   CNPGCertificateExpired: 'A certificate has expired',
 }
@@ -228,7 +227,7 @@ export function cnpgIssueText(issue: Pick<CNPGWorkspaceIssue, 'kind' | 'name' |
   const cause = issue.cause?.trim() || undefined
   // The run's time is the issue's first_seen, not part of the message.
   if (issue.reason === 'CNPGScheduledRunNoBackup' && issue.first_seen && message) message = `${message} ${formatAge(issue.first_seen)} ago`
-  const known = CNPG_REASON_TITLES[issue.reason]
+  const known = issueReasonTitle(issue.reason) ?? CNPG_REASON_TITLES[issue.reason]
   if (known) return { title: known, detail: [stripTitlePrefix(message, known), cause].filter(Boolean).join(' ') || undefined }
   if (message && message !== issue.reason && /\s/.test(message)) return { title: message, detail: cause }
   const token = message || issue.reason
@@ -284,7 +283,7 @@ export function cnpgCollapseBackupFailures(problems: IssueProblem[], backupTimes
 }
 
 /**
- * "The last backup failed" restates a failed-Backup problem when that problem
+ * "Latest backup failed" restates a failed-Backup problem when that problem
  * is about the cluster's newest Backup, so the duplicate is dropped and the
  * count stays honest. With the newest Backup unknown, both stay.
  */
diff --git a/packages/k8s-ui/src/components/issues/index.ts b/packages/k8s-ui/src/components/issues/index.ts
index 898b442ba0..93fcb849b1 100644
--- a/packages/k8s-ui/src/components/issues/index.ts
+++ b/packages/k8s-ui/src/components/issues/index.ts
@@ -25,5 +25,6 @@ export {
   ISSUE_SEVERITY_RAIL_CLASS,
   categoryLabel,
   issueTitle,
+  issueReasonTitle,
   groupLabel,
 } from './severity';
diff --git a/packages/k8s-ui/src/components/issues/severity.ts b/packages/k8s-ui/src/components/issues/severity.ts
index 397bab6253..6bb64597fc 100644
--- a/packages/k8s-ui/src/components/issues/severity.ts
+++ b/packages/k8s-ui/src/components/issues/severity.ts
@@ -144,9 +144,14 @@ const REASON_TITLE: Record<string, string> = {
   CNPGScheduledRunNoBackup: "No successful backup since a scheduled run",
 };
 
+/** The title a reason has wherever it is shown, when its category's label would name the wrong operation. */
+export function issueReasonTitle(reason: string | undefined): string | undefined {
+  return reason ? REASON_TITLE[reason] : undefined;
+}
+
 /** An issue row's title: its category, unless the reason names it better. */
 export function issueTitle(issue: { category: string; reason?: string }): string {
-  return (issue.reason && REASON_TITLE[issue.reason]) || categoryLabel(issue.category);
+  return issueReasonTitle(issue.reason) || categoryLabel(issue.category);
 }
 
 export function groupLabel(group: string): string {

From a76625dcc0230831d373d036e10f2dcf1ebe2962 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:50:33 +0300
Subject: [PATCH 14/26] Name each CloudNativePG object's GitOps manager in the
 workspace

The workspace client re-parsed Argo CD and Flux labels itself and read an
apps-in-any-namespace tracking ID's ns_app prefix as the Application
name. topology.ManagedByFromMeta (the existing metadata-only detection,
now exported; nothing else in pkg changes) answers instead, and
/api/cnpg/workspace returns managedBy keyed Kind/namespace/name for every
returned CNPG object with a manager signal. A native Helm release keeps
an empty group and an Application named without a namespace keeps an
empty one.
---
 internal/server/cnpg_workspace.go      | 11 +++++++
 internal/server/cnpg_workspace_test.go | 28 ++++++++++++++++
 pkg/resourcecontext/summary.go         |  2 +-
 pkg/resourcecontext/summary_test.go    |  2 +-
 pkg/subject/overlay.go                 |  2 +-
 pkg/topology/managedby.go              | 18 +++++++----
 pkg/topology/managedby_test.go         | 45 ++++++++++++++++++++++++++
 7 files changed, 98 insertions(+), 10 deletions(-)

diff --git a/internal/server/cnpg_workspace.go b/internal/server/cnpg_workspace.go
index 8b0fb76487..02d6091a5e 100644
--- a/internal/server/cnpg_workspace.go
+++ b/internal/server/cnpg_workspace.go
@@ -17,6 +17,7 @@ import (
 	"github.com/skyhook-io/radar/internal/k8s"
 	bp "github.com/skyhook-io/radar/pkg/audit"
 	"github.com/skyhook-io/radar/pkg/issuesapi"
+	"github.com/skyhook-io/radar/pkg/topology"
 )
 
 const cnpgBarmanGroup = "barmancloud.cnpg.io"
@@ -94,6 +95,10 @@ type CNPGWorkspaceResponse struct {
 	// operator reads it, keyed "namespace/name"; a schedule the operator
 	// cannot parse has no entry.
 	ScheduleReadings map[string]string `json:"scheduleReadings,omitempty"`
+	// ManagedBy is the GitOps or Helm manager each returned CNPG object's
+	// labels and annotations name, keyed "Kind/namespace/name"; objects with
+	// no such signal have no entry. Instance Pods are not included.
+	ManagedBy map[string]topology.ResourceRef `json:"managedBy,omitempty"`
 }
 
 func newCNPGWorkspaceResponse(namespaces []string) CNPGWorkspaceResponse {
@@ -179,6 +184,12 @@ func (s *Server) handleCNPGWorkspace(w http.ResponseWriter, r *http.Request) {
 		out := make([]any, 0, len(list))
 		for _, u := range list {
 			out = append(out, u.Object)
+			if ref := topology.ManagedByFromMeta(u); ref != nil {
+				if resp.ManagedBy == nil {
+					resp.ManagedBy = map[string]topology.ResourceRef{}
+				}
+				resp.ManagedBy[k.kind+"/"+u.GetNamespace()+"/"+u.GetName()] = *ref
+			}
 		}
 		resp.Objects[k.key] = out
 	}
diff --git a/internal/server/cnpg_workspace_test.go b/internal/server/cnpg_workspace_test.go
index 4ff69256dd..5ef0a2f2c7 100644
--- a/internal/server/cnpg_workspace_test.go
+++ b/internal/server/cnpg_workspace_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -18,6 +19,7 @@ import (
 
 	"github.com/skyhook-io/radar/internal/auth"
 	"github.com/skyhook-io/radar/internal/k8s"
+	"github.com/skyhook-io/radar/pkg/topology"
 )
 
 func cnpgTestResource(group, kind, resource string, namespaced bool) k8s.APIResource {
@@ -193,6 +195,32 @@ func cnpgPod(ns, name, clusterLabel string, owners ...metav1.OwnerReference) *co
 	}
 }
 
+// Each returned object's GitOps or Helm manager comes from the server's one
+// metadata-only detection: an Argo CD tracking ID in the apps-in-any-namespace
+// form names the Application's namespace, the default form names none (and
+// none is invented), Flux needs both kustomization labels.
+func TestCNPGWorkspace_ManagedByFromObjectMetadata(t *testing.T) {
+	cluster := cnpgObj("postgresql.cnpg.io/v1", "Cluster", "db", "pg", nil, nil)
+	cluster.SetAnnotations(map[string]string{"argocd.argoproj.io/tracking-id": "team-a_orders:postgresql.cnpg.io/Cluster:db/pg"})
+	database := cnpgObj("postgresql.cnpg.io/v1", "Database", "db", "app", map[string]any{"cluster": map[string]any{"name": "pg"}}, nil)
+	database.SetAnnotations(map[string]string{"argocd.argoproj.io/tracking-id": "orders:postgresql.cnpg.io/Database:db/app"})
+	pooler := cnpgObj("postgresql.cnpg.io/v1", "Pooler", "db", "pg-rw", map[string]any{"cluster": map[string]any{"name": "pg"}}, nil)
+	pooler.SetLabels(map[string]string{"kustomize.toolkit.fluxcd.io/name": "databases", "kustomize.toolkit.fluxcd.io/namespace": "flux-system"})
+	sched := cnpgObj("postgresql.cnpg.io/v1", "ScheduledBackup", "db", "nightly", map[string]any{"cluster": map[string]any{"name": "pg"}, "schedule": "0 0 2 * * *"}, nil)
+	sched.SetLabels(map[string]string{"app.kubernetes.io/name": "pg"})
+	seedCNPGWorkspace(t, cnpgWorkspaceTestKinds, cluster, database, pooler, sched)
+
+	got := getWorkspaceNoAuth(t, "")
+	want := map[string]topology.ResourceRef{
+		"Cluster/db/pg":   {Kind: "Application", Group: "argoproj.io", Namespace: "team-a", Name: "orders"},
+		"Database/db/app": {Kind: "Application", Group: "argoproj.io", Name: "orders"},
+		"Pooler/db/pg-rw": {Kind: "Kustomization", Group: "kustomize.toolkit.fluxcd.io", Namespace: "flux-system", Name: "databases"},
+	}
+	if !reflect.DeepEqual(got.ManagedBy, want) {
+		t.Errorf("managedBy = %+v, want %+v", got.ManagedBy, want)
+	}
+}
+
 func TestCNPGWorkspace_AuthDisabledReturnsEverythingAndOnlyOwnedInstancePods(t *testing.T) {
 	seedCNPGWorkspace(t, cnpgWorkspaceTestKinds,
 		withUID(cnpgObj("postgresql.cnpg.io/v1", "Cluster", "pgws", "pg-orders", map[string]any{"instances": int64(1)}, nil), "c-uid"),
diff --git a/pkg/resourcecontext/summary.go b/pkg/resourcecontext/summary.go
index d51d1fd187..cd6708418e 100644
--- a/pkg/resourcecontext/summary.go
+++ b/pkg/resourcecontext/summary.go
@@ -68,7 +68,7 @@ func BuildSummary(obj runtime.Object, opts SummaryOptions) *ResourceSummaryConte
 //   - "argocd" for argoproj.io kinds (Application, ApplicationSet, Rollout)
 //   - "flux" for *.fluxcd.io kinds (Kustomization, HelmRelease, GitRepository, …)
 //   - "helm" for the native Helm release pseudo-owner (kind "HelmRelease"
-//     with no group — emitted by topology's detectManagedByFromMeta to
+//     with no group — emitted by topology's ManagedByFromMeta to
 //     distinguish from Flux's HelmRelease CR in helm.toolkit.fluxcd.io)
 //   - "native" for everything else (Deployment, StatefulSet, DaemonSet, ReplicaSet, Job, …)
 func ManagedByFromOwner(ownerKind, ownerGroup, ownerNamespace, ownerName string) *ManagedByRef {
diff --git a/pkg/resourcecontext/summary_test.go b/pkg/resourcecontext/summary_test.go
index c361feb99f..139606af91 100644
--- a/pkg/resourcecontext/summary_test.go
+++ b/pkg/resourcecontext/summary_test.go
@@ -371,7 +371,7 @@ func TestManagedByFromOwner(t *testing.T) {
 			want:      &ManagedByRef{Kind: "GitRepository", Source: "flux", Name: "repo", Namespace: "flux-system"},
 		},
 		{
-			// Native Helm release: topology's detectManagedByFromMeta emits
+			// Native Helm release: topology's ManagedByFromMeta emits
 			// {Kind:"HelmRelease", Group:""} when it sees Helm's release-name
 			// annotation (no Flux/GitOps signal). Must classify as "helm",
 			// not "native" — distinguishes Helm-managed resources in the
diff --git a/pkg/subject/overlay.go b/pkg/subject/overlay.go
index a109adf93b..329d58ab72 100644
--- a/pkg/subject/overlay.go
+++ b/pkg/subject/overlay.go
@@ -103,7 +103,7 @@ type AppOverlay struct {
 // ResolveOverlay is the Tier-2 entrypoint. It COLLECTS ALL matching signals from
 // obj's labels/annotations, sorts by Tier, returns the winner + retained
 // conflicts, or nil when nothing reaches TierAppName (TierBareApp alone is opt-in via
-// allowBareApp; default off => never silent). SUBSUMES detectManagedByFromMeta
+// allowBareApp; default off => never silent). SUBSUMES topology.ManagedByFromMeta
 // (tiers 1-5, first-hit-return REPLACED by collect-all). The native-Helm
 // sentinel {Kind:"HelmRelease",Group:""} the Source classifier keys on is set
 // here; enrichRef MUST NOT be applied to tier 1-5 refs (Group is hand-set) —
diff --git a/pkg/topology/managedby.go b/pkg/topology/managedby.go
index 98658007f5..327d798b4a 100644
--- a/pkg/topology/managedby.go
+++ b/pkg/topology/managedby.go
@@ -49,8 +49,8 @@ const (
 //
 // Returns nil when no meaningful manager is detectable.
 func SynthesizeManagedBy(obj metav1.Object, kind, namespace, name string, topo *Topology, dp DynamicProvider, idx *RelationshipsIndex) []ResourceRef {
-	if ref := detectManagedByFromMeta(obj); ref != nil {
-		// detectManagedByFromMeta hand-sets Group for GitOps/Flux managers; do
+	if ref := ManagedByFromMeta(obj); ref != nil {
+		// ManagedByFromMeta hand-sets Group for GitOps/Flux managers; do
 		// NOT call enrichRef here — it would overwrite the deliberate group
 		// with the result of a dp lookup keyed on the manager kind, which
 		// resolves wrong for cross-group kinds like Flux's HelmRelease vs
@@ -64,7 +64,7 @@ func SynthesizeManagedBy(obj metav1.Object, kind, namespace, name string, topo *
 }
 
 func synthesizeManagedByFromNode(obj metav1.Object, nodeID string, topo *Topology, dp DynamicProvider, idx *RelationshipsIndex) []ResourceRef {
-	if ref := detectManagedByFromMeta(obj); ref != nil {
+	if ref := ManagedByFromMeta(obj); ref != nil {
 		return []ResourceRef{*ref}
 	}
 	if top := walkTopmostOwnerFromNodeID(nodeID, topo, dp, idx); top != nil {
@@ -73,10 +73,14 @@ func synthesizeManagedByFromNode(obj metav1.Object, nodeID string, topo *Topolog
 	return nil
 }
 
-// detectManagedByFromMeta inspects labels/annotations on obj for GitOps / Helm
-// ownership signals and returns the implied manager ref. Returns nil if no
-// signal is present. Mirrors detectGitOpsOwner precedence in the web package.
-func detectManagedByFromMeta(obj metav1.Object) *ResourceRef {
+// ManagedByFromMeta inspects labels/annotations on obj for GitOps / Helm
+// ownership signals and returns the implied manager ref, or nil when there is
+// none. It reads metadata only, so it needs no topology. A native Helm release
+// has Kind "HelmRelease" and no Group (Flux's HelmRelease carries its group);
+// an Argo CD Application named only by the instance label, or by a tracking ID
+// without an app namespace, has no Namespace. Mirrors detectGitOpsOwner
+// precedence in the web package.
+func ManagedByFromMeta(obj metav1.Object) *ResourceRef {
 	if obj == nil {
 		return nil
 	}
diff --git a/pkg/topology/managedby_test.go b/pkg/topology/managedby_test.go
index 2bc9d53e99..75c83ada7a 100644
--- a/pkg/topology/managedby_test.go
+++ b/pkg/topology/managedby_test.go
@@ -423,3 +423,48 @@ func TestParseArgoTrackingID(t *testing.T) {
 		})
 	}
 }
+
+func TestManagedByFromMeta(t *testing.T) {
+	obj := func(labels, annos map[string]string) *unstructured.Unstructured {
+		u := &unstructured.Unstructured{}
+		u.SetAPIVersion("postgresql.cnpg.io/v1")
+		u.SetKind("Cluster")
+		u.SetNamespace("db")
+		u.SetName("pg")
+		u.SetLabels(labels)
+		u.SetAnnotations(annos)
+		return u
+	}
+	cases := []struct {
+		name string
+		obj  *unstructured.Unstructured
+		want *ResourceRef
+	}{
+		{"argo tracking-id, apps in any namespace", obj(nil, map[string]string{argoTrackingIDAnnotation: "team-a_orders:postgresql.cnpg.io/Cluster:db/pg"}),
+			&ResourceRef{Kind: "Application", Group: argoApplicationGroup, Namespace: "team-a", Name: "orders"}},
+		{"argo tracking-id, default form names no namespace", obj(nil, map[string]string{argoTrackingIDAnnotation: "orders:postgresql.cnpg.io/Cluster:db/pg"}),
+			&ResourceRef{Kind: "Application", Group: argoApplicationGroup, Name: "orders"}},
+		{"argo instance label", obj(map[string]string{argoInstanceLabel: "orders"}, nil),
+			&ResourceRef{Kind: "Application", Group: argoApplicationGroup, Name: "orders"}},
+		{"flux kustomization", obj(map[string]string{fluxKustomizeNameLabel: "databases", fluxKustomizeNSLabel: "flux-system"}, nil),
+			&ResourceRef{Kind: "Kustomization", Group: fluxKustomizeGroup, Namespace: "flux-system", Name: "databases"}},
+		{"flux kustomization without its namespace label is not a signal", obj(map[string]string{fluxKustomizeNameLabel: "databases"}, nil), nil},
+		{"native helm has no group", obj(nil, map[string]string{helmReleaseNameAnno: "pg", helmReleaseNSAnno: "db"}),
+			&ResourceRef{Kind: "HelmRelease", Namespace: "db", Name: "pg"}},
+		{"none", obj(map[string]string{"app": "pg"}, nil), nil},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got := ManagedByFromMeta(c.obj)
+			switch {
+			case c.want == nil && got != nil:
+				t.Errorf("got %+v, want none", *got)
+			case c.want != nil && (got == nil || *got != *c.want):
+				t.Errorf("got %+v, want %+v", got, *c.want)
+			}
+		})
+	}
+	if ManagedByFromMeta(nil) != nil {
+		t.Error("nil object has a manager")
+	}
+}

From b2242bacde866a1212ac58bc20e77c8e2e54af90 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:53:47 +0300
Subject: [PATCH 15/26] Share the reviewed-action client between workspace
 integrations

web/src/api/actions.ts holds the client half of the action contract:
ActionCapability and ActionRequest, the shared refusal codes with
actionErrorCode (an integration widens it with its own codes, as
CloudNativePG does for all_fenced, operator_webhook_unavailable and
invalid_schedule), actionOutcomeLocked, actionCompleted, and
capabilityReason, which now words every disabled CloudNativePG action the
same way and names the missing grant when the server gives no reason.
---
 ...Code.test.ts => actions.errorCode.test.ts} | 11 ++--
 web/src/api/actions.test.ts                   | 15 +++++
 web/src/api/actions.ts                        | 64 +++++++++++++++++++
 web/src/api/cnpg-recovery.ts                  |  6 +-
 web/src/api/cnpg-sessions.ts                  |  7 +-
 web/src/api/cnpg.ts                           | 54 +++-------------
 .../components/cnpg/CNPGBlockingSessions.tsx  |  5 +-
 .../cnpg/actions/CNPGClusterActions.tsx       | 23 ++-----
 .../actions/CNPGDestroyInstanceDialog.tsx     |  7 +-
 .../cnpg/actions/CNPGInstanceActions.tsx      |  7 +-
 .../cnpg/actions/CNPGMaintenanceBanner.tsx    |  3 +-
 .../cnpg/actions/CNPGPoolerActions.tsx        |  9 +--
 .../cnpg/actions/CNPGScheduleActions.tsx      | 15 ++---
 .../components/cnpg/actions/actionModel.ts    |  5 +-
 .../components/cnpg/recovery/restoreModel.ts  |  5 +-
 15 files changed, 136 insertions(+), 100 deletions(-)
 rename web/src/api/{cnpg.errorCode.test.ts => actions.errorCode.test.ts} (74%)
 create mode 100644 web/src/api/actions.test.ts
 create mode 100644 web/src/api/actions.ts

diff --git a/web/src/api/cnpg.errorCode.test.ts b/web/src/api/actions.errorCode.test.ts
similarity index 74%
rename from web/src/api/cnpg.errorCode.test.ts
rename to web/src/api/actions.errorCode.test.ts
index 31ada3528f..2080136a82 100644
--- a/web/src/api/cnpg.errorCode.test.ts
+++ b/web/src/api/actions.errorCode.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { ApiError } from './client'
-import { cnpgActionCompleted, cnpgActionErrorCode, cnpgActionOutcomeLocked } from './cnpg'
+import { cnpgActionErrorCode } from './cnpg'
+import { actionCompleted, actionOutcomeLocked } from './actions'
 
 describe('cnpgActionErrorCode', () => {
   it('keeps the server code when there is one', () => {
@@ -22,11 +23,11 @@ describe('partial outcomes', () => {
   const partial = new ApiError('stopped', 403, { code: 'partial', completed: ['deleted PVC pg-2', 'deleted PVC pg-2-wal'] })
   it('locks confirm and lists what already happened, whatever the status', () => {
     expect(cnpgActionErrorCode(partial)).toBe('partial')
-    expect(cnpgActionOutcomeLocked(partial)).toBe(true)
-    expect(cnpgActionCompleted(partial)).toEqual(['deleted PVC pg-2', 'deleted PVC pg-2-wal'])
+    expect(actionOutcomeLocked(partial)).toBe(true)
+    expect(actionCompleted(partial)).toEqual(['deleted PVC pg-2', 'deleted PVC pg-2-wal'])
   })
   it('leaves known refusals unlocked', () => {
-    expect(cnpgActionOutcomeLocked(new ApiError('changed', 409, { code: 'changed' }))).toBe(false)
-    expect(cnpgActionCompleted(new ApiError('changed', 409, { code: 'changed' }))).toEqual([])
+    expect(actionOutcomeLocked(new ApiError('changed', 409, { code: 'changed' }))).toBe(false)
+    expect(actionCompleted(new ApiError('changed', 409, { code: 'changed' }))).toEqual([])
   })
 })
diff --git a/web/src/api/actions.test.ts b/web/src/api/actions.test.ts
new file mode 100644
index 0000000000..f4d1df9466
--- /dev/null
+++ b/web/src/api/actions.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest'
+import { capabilityReason } from './actions'
+
+describe('capabilityReason', () => {
+  it('says nothing for an allowed action, and the server reason when there is one', () => {
+    expect(capabilityReason({ allowed: true, permission: 'allowed' })).toBeUndefined()
+    expect(capabilityReason({ allowed: false, permission: 'allowed', reason: 'The Cluster is hibernated' })).toBe('The Cluster is hibernated')
+  })
+  it('names the missing grant when the reason is absent', () => {
+    expect(capabilityReason({ allowed: false, permission: 'denied', grant: { verb: 'create', group: 'postgresql.cnpg.io', resource: 'backups', namespace: 'db' } })).toBe(
+      'Your account may not do this (create backups (postgresql.cnpg.io) in namespace db)',
+    )
+    expect(capabilityReason({ allowed: false, permission: 'unknown' })).toBe('Not available')
+  })
+})
diff --git a/web/src/api/actions.ts b/web/src/api/actions.ts
new file mode 100644
index 0000000000..bbec0cc33d
--- /dev/null
+++ b/web/src/api/actions.ts
@@ -0,0 +1,64 @@
+// The client half of the reviewed-action contract shared by workspace
+// integrations (server: internal/server/actions.go). A capability says
+// whether an action is offered and why not; a request carries the context,
+// object UID and facts the user confirmed, and the server refuses it with a
+// stable code when any of them no longer holds.
+
+import { formatGrant, type Grant } from '@skyhook-io/k8s-ui'
+import { ApiError } from './client'
+
+export interface ActionCapability {
+  allowed: boolean
+  reason?: string
+  /** `unknown`: the permission check itself failed; the apiserver decides on submit. */
+  permission: 'allowed' | 'denied' | 'unknown'
+  grant?: Grant
+}
+
+export interface ActionRequest {
+  reviewedContext: string
+  uid: string
+  facts: Record<string, unknown>
+  params?: Record<string, unknown>
+}
+
+/**
+ * Refusals every action family shares. An integration adds its own codes by
+ * widening the type parameter of actionErrorCode.
+ */
+export type ActionErrorCode = 'context_changed' | 'changed' | 'blocked' | 'partial' | 'outcome_unknown'
+
+// A request that timed out or lost its connection may have been applied by the
+// apiserver anyway. 503 without a code is Radar refusing before any write.
+const AMBIGUOUS_STATUSES = new Set([500, 502, 504])
+
+export function actionErrorCode<C extends string = ActionErrorCode>(err: unknown): C | ActionErrorCode | undefined {
+  if (!err) return undefined
+  if (!(err instanceof ApiError)) return 'outcome_unknown'
+  const code = err.data?.code
+  if (typeof code === 'string') return code as C
+  return AMBIGUOUS_STATUSES.has(err.status) ? 'outcome_unknown' : undefined
+}
+
+/**
+ * Confirm stays locked when the last attempt may have taken effect (unknown)
+ * or partly did (partial): repeating it would act on a target that moved.
+ */
+export function actionOutcomeLocked(err: unknown): boolean {
+  const code = actionErrorCode(err)
+  return code === 'outcome_unknown' || code === 'partial'
+}
+
+/** The mutations a `partial` refusal reports as already done. */
+export function actionCompleted(err: unknown): string[] {
+  if (!(err instanceof ApiError) || err.data?.code !== 'partial') return []
+  const done = err.data.completed
+  return Array.isArray(done) ? done.filter((d): d is string => typeof d === 'string') : []
+}
+
+/** Why an action is not offered, or undefined when it is. */
+export function capabilityReason(cap: ActionCapability): string | undefined {
+  if (cap.allowed) return undefined
+  if (cap.reason) return cap.reason
+  return cap.permission === 'denied' ? `Your account may not do this (${formatGrant(cap.grant) ?? 'permission denied'})` : 'Not available'
+}
diff --git a/web/src/api/cnpg-recovery.ts b/web/src/api/cnpg-recovery.ts
index ce84978933..89e22167e9 100644
--- a/web/src/api/cnpg-recovery.ts
+++ b/web/src/api/cnpg-recovery.ts
@@ -1,7 +1,7 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import type { Grant } from '@skyhook-io/k8s-ui'
 import { apiFetch, ApiError, fetchJSON, useRadarFeature } from './client'
-import type { CNPGActionCapability } from './cnpg'
+import type { ActionCapability } from './actions'
 import { getApiBase } from './config'
 import { shouldRetryRadarQuery } from './radarFeatures'
 
@@ -241,9 +241,9 @@ export interface CNPGOperatorDiagnosis {
 // writes), for every way into the restore dialog.
 export function useCNPGRestoreCapability(namespace: string) {
   const { guard, gatedKey } = useRadarFeature('cnpgWorkspace')
-  return useQuery<CNPGActionCapability>({
+  return useQuery<ActionCapability>({
     queryKey: ['cnpg', 'restore-capability', namespace, ...gatedKey],
-    queryFn: ({ signal }) => guard(() => fetchJSON<CNPGActionCapability>(`/cnpg/restore/capability?namespace=${encodeURIComponent(namespace)}`, signal)),
+    queryFn: ({ signal }) => guard(() => fetchJSON<ActionCapability>(`/cnpg/restore/capability?namespace=${encodeURIComponent(namespace)}`, signal)),
     enabled: !!namespace,
     staleTime: 15_000,
     retry: false,
diff --git a/web/src/api/cnpg-sessions.ts b/web/src/api/cnpg-sessions.ts
index 47a81255c4..0beab9c1de 100644
--- a/web/src/api/cnpg-sessions.ts
+++ b/web/src/api/cnpg-sessions.ts
@@ -1,7 +1,8 @@
 import { useQuery } from '@tanstack/react-query'
 import type { Grant } from '@skyhook-io/k8s-ui'
 import { fetchJSON, useRadarFeature } from './client'
-import type { CNPGActionCapability, CNPGClusterFacts, CNPGRuntimeSourceState } from './cnpg'
+import type { CNPGClusterFacts, CNPGRuntimeSourceState } from './cnpg'
+import type { ActionCapability } from './actions'
 
 const enc = encodeURIComponent
 
@@ -95,7 +96,7 @@ export interface CNPGDestroyPlan {
   pvcs: CNPGDestroyPVC[]
   jobsReadable: boolean
   jobs: string[]
-  actions: { delete: CNPGActionCapability; keep: CNPGActionCapability }
+  actions: { delete: ActionCapability; keep: ActionCapability }
 }
 
 export function useCNPGDestroyPlan(namespace: string, name: string, pod: string, enabled = true) {
@@ -135,7 +136,7 @@ export interface CNPGPoolerCapabilities {
   resourceVersion: string
   context: string
   facts: CNPGPoolerFacts
-  actions: { pause: CNPGActionCapability; resume: CNPGActionCapability; observeState: CNPGActionCapability }
+  actions: { pause: ActionCapability; resume: ActionCapability; observeState: ActionCapability }
 }
 
 export function useCNPGPoolerCapabilities(namespace: string, name: string, enabled = true) {
diff --git a/web/src/api/cnpg.ts b/web/src/api/cnpg.ts
index 5cc74f7eb3..073e582d6f 100644
--- a/web/src/api/cnpg.ts
+++ b/web/src/api/cnpg.ts
@@ -1,8 +1,9 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import type { CNPGSchedulePreview, CNPGWorkspaceResponse, Grant, TimelineEvent } from '@skyhook-io/k8s-ui'
-import { ApiError, fetchJSON, useRadarFeature } from './client'
+import { fetchJSON, useRadarFeature } from './client'
 import { shouldRetryRadarQuery } from './radarFeatures'
 import type { CNPGOperatorDiagnosis } from './cnpg-recovery'
+import { actionErrorCode, type ActionCapability, type ActionErrorCode, type ActionRequest } from './actions'
 
 // /api/cnpg/workspace
 //
@@ -134,13 +135,6 @@ export function useCNPGClusterActivity(namespace: string, name: string, sinceHou
   })
 }
 
-export interface CNPGActionCapability {
-  allowed: boolean
-  reason?: string
-  permission: 'allowed' | 'denied' | 'unknown'
-  grant?: Grant
-}
-
 export interface CNPGInstanceFact {
   pod: string
   podUID: string
@@ -197,8 +191,8 @@ export interface CNPGClusterCapabilities {
   context: string
   facts: CNPGClusterFacts
   /** `restore` is creating a new Cluster in this namespace from this one's backups (`create clusters`). */
-  actions: Record<CNPGClusterActionName, CNPGActionCapability> & { psql: CNPGActionCapability; destroyInstance: CNPGActionCapability; restore: CNPGActionCapability }
-  instanceActions: Record<string, { restart: CNPGActionCapability; switchoverTarget: CNPGActionCapability; fence: CNPGActionCapability; unfence: CNPGActionCapability; psql: CNPGActionCapability; destroy: CNPGActionCapability }>
+  actions: Record<CNPGClusterActionName, ActionCapability> & { psql: ActionCapability; destroyInstance: ActionCapability; restore: ActionCapability }
+  instanceActions: Record<string, { restart: ActionCapability; switchoverTarget: ActionCapability; fence: ActionCapability; unfence: ActionCapability; psql: ActionCapability; destroy: ActionCapability }>
   restartPlan?: {
     primaryUpdateStrategy?: string
     primaryUpdateMethod?: string
@@ -242,7 +236,7 @@ export interface CNPGScheduleCapabilities {
     schedule: string
     preview: CNPGSchedulePreview
   }
-  actions: Record<CNPGScheduleActionName, CNPGActionCapability>
+  actions: Record<CNPGScheduleActionName, ActionCapability>
   operator?: CNPGOperatorVerdict
 }
 
@@ -287,13 +281,6 @@ export function useCNPGScheduleCapabilities(namespace: string, name: string, ena
   })
 }
 
-export interface CNPGActionRequest {
-  reviewedContext: string
-  uid: string
-  facts: Record<string, unknown>
-  params?: Record<string, unknown>
-}
-
 export interface CNPGActionResult {
   action: string
   message: string
@@ -309,7 +296,7 @@ export interface CNPGActionResult {
 export function useCNPGAction(kind: 'clusters' | 'scheduledbackups' | 'poolers', namespace: string, name: string) {
   const { guard } = useRadarFeature('cnpgWorkspace')
   const queryClient = useQueryClient()
-  return useMutation<CNPGActionResult, Error, { action: string; request: CNPGActionRequest }>({
+  return useMutation<CNPGActionResult, Error, { action: string; request: ActionRequest }>({
     mutationFn: ({ action, request }) => guard(() =>
       fetchJSON<CNPGActionResult>(`${cnpgPath(kind, namespace, name)}/actions/${action}`, {
         method: 'POST',
@@ -328,34 +315,11 @@ export function useCNPGAction(kind: 'clusters' | 'scheduledbackups' | 'poolers',
   })
 }
 
-export type CNPGActionErrorCode = 'context_changed' | 'changed' | 'blocked' | 'all_fenced' | 'operator_webhook_unavailable' | 'outcome_unknown' | 'partial' | 'invalid_schedule'
-
-// A request that timed out or lost its connection may have been applied by the
-// apiserver anyway. 503 without a code is Radar refusing before any write.
-const CNPG_AMBIGUOUS_STATUSES = new Set([500, 502, 504])
+/** The action refusals the CloudNativePG handlers add to the shared ones. */
+export type CNPGActionErrorCode = ActionErrorCode | 'all_fenced' | 'operator_webhook_unavailable' | 'invalid_schedule'
 
 export function cnpgActionErrorCode(err: unknown): CNPGActionErrorCode | undefined {
-  if (!err) return undefined
-  if (!(err instanceof ApiError)) return 'outcome_unknown'
-  const code = err.data?.code
-  if (typeof code === 'string') return code as CNPGActionErrorCode
-  return CNPG_AMBIGUOUS_STATUSES.has(err.status) ? 'outcome_unknown' : undefined
-}
-
-/**
- * Confirm stays locked when the last attempt may have taken effect (unknown)
- * or partly did (partial): repeating it would act on a target that moved.
- */
-export function cnpgActionOutcomeLocked(err: unknown): boolean {
-  const code = cnpgActionErrorCode(err)
-  return code === 'outcome_unknown' || code === 'partial'
-}
-
-/** The mutations a `partial` refusal reports as already done. */
-export function cnpgActionCompleted(err: unknown): string[] {
-  if (!(err instanceof ApiError) || err.data?.code !== 'partial') return []
-  const done = err.data.completed
-  return Array.isArray(done) ? done.filter((d): d is string => typeof d === 'string') : []
+  return actionErrorCode<CNPGActionErrorCode>(err)
 }
 
 export type CNPGRuntimeSourceState = 'ok' | 'denied' | 'unreachable' | 'error' | 'partial'
diff --git a/web/src/components/cnpg/CNPGBlockingSessions.tsx b/web/src/components/cnpg/CNPGBlockingSessions.tsx
index 5d0e95e86b..22f23edb86 100644
--- a/web/src/components/cnpg/CNPGBlockingSessions.tsx
+++ b/web/src/components/cnpg/CNPGBlockingSessions.tsx
@@ -5,7 +5,8 @@ import { Lock } from 'lucide-react'
 import { ActionConfirmDialog, PaneLoader, Tooltip, formatAge, toneFillClass, toneTextClass, formatGrant } from '@skyhook-io/k8s-ui'
 import { formatCPUString, formatMemoryString, parseCPUToNanocores, parseMemoryToBytes } from '@skyhook-io/k8s-ui/utils/format'
 import { podMetricsQuery, usePodMetrics } from '../../api/client'
-import { cnpgActionOutcomeLocked, useCNPGAction, useCNPGClusterCapabilities } from '../../api/cnpg'
+import { useCNPGAction, useCNPGClusterCapabilities } from '../../api/cnpg'
+import { actionOutcomeLocked } from '../../api/actions'
 import { useCNPGSessions, type CNPGBackend, type CNPGSessionInstance, type CNPGSessionsResponse } from '../../api/cnpg-sessions'
 import { useToast } from '../ui/Toast'
 import { buildBlockingTree, cnpgConnectionFigure, cnpgNoMetricsReadings, countVictims, type BlockingNode } from './blocking'
@@ -345,7 +346,7 @@ function SignalDialog({
       incompleteReason={!caps.data ? 'Reading the cluster…' : undefined}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
     />
   )
 }
diff --git a/web/src/components/cnpg/actions/CNPGClusterActions.tsx b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
index bb35885619..507774d78a 100644
--- a/web/src/components/cnpg/actions/CNPGClusterActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGClusterActions.tsx
@@ -1,18 +1,9 @@
 import { useEffect, useMemo, useState, type ReactNode } from 'react'
 import { ChevronDown, DatabaseBackup, MoreHorizontal, Repeat } from 'lucide-react'
 import { clsx } from 'clsx'
-import { ActionConfirmDialog, Tooltip, cnpgPDBFact, cnpgQuorumFact, toneTextClass, type ActionWrite, type CNPGClusterHA, formatGrant } from '@skyhook-io/k8s-ui'
-import {
-  cnpgActionOutcomeLocked,
-  useCNPGAction,
-  useCNPGClusterCapabilities,
-  useCNPGRuntime,
-  type CNPGActionCapability,
-  type CNPGActionResult,
-  type CNPGBackupMethod,
-  type CNPGClusterActionName,
-  type CNPGClusterCapabilities,
-} from '../../../api/cnpg'
+import { ActionConfirmDialog, Tooltip, cnpgPDBFact, cnpgQuorumFact, toneTextClass, type ActionWrite, type CNPGClusterHA } from '@skyhook-io/k8s-ui'
+import { useCNPGAction, useCNPGClusterCapabilities, useCNPGRuntime, type CNPGActionResult, type CNPGBackupMethod, type CNPGClusterActionName, type CNPGClusterCapabilities } from '../../../api/cnpg'
+import { actionOutcomeLocked, type ActionCapability, capabilityReason } from '../../../api/actions'
 import { useToast } from '../../ui/Toast'
 import { useAnimatedUnmount } from '../../../hooks/useAnimatedUnmount'
 import { TRANSITION_MENU, overlayExitMs, overlayTransitionStyle } from '../../../utils/animation'
@@ -45,10 +36,8 @@ function EffectItem({ list, label }: { list: { available: boolean; reason?: stri
   return <li>{label}: {list.names.join(', ')}</li>
 }
 
-function capabilityTitle(cap: CNPGActionCapability | undefined): string | undefined {
-  if (!cap) return 'Checking permissions…'
-  if (cap.allowed) return undefined
-  return cap.reason ?? (cap.permission === 'denied' ? `Your account may not do this (${formatGrant(cap.grant) ?? 'permission denied'})` : 'Not available')
+function capabilityTitle(cap: ActionCapability | undefined): string | undefined {
+  return cap ? capabilityReason(cap) : 'Checking permissions…'
 }
 
 /**
@@ -754,7 +743,7 @@ export function ClusterActionDialog({
       incompleteReason={spec.incomplete}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
     >
       {spec.body}
     </ActionConfirmDialog>
diff --git a/web/src/components/cnpg/actions/CNPGDestroyInstanceDialog.tsx b/web/src/components/cnpg/actions/CNPGDestroyInstanceDialog.tsx
index efcbb26d30..e4c6f93dd1 100644
--- a/web/src/components/cnpg/actions/CNPGDestroyInstanceDialog.tsx
+++ b/web/src/components/cnpg/actions/CNPGDestroyInstanceDialog.tsx
@@ -1,6 +1,7 @@
 import { useState } from 'react'
 import { ActionConfirmDialog, PaneLoader } from '@skyhook-io/k8s-ui'
-import { cnpgActionCompleted, cnpgActionErrorCode, cnpgActionOutcomeLocked, useCNPGAction } from '../../../api/cnpg'
+import { cnpgActionErrorCode, useCNPGAction } from '../../../api/cnpg'
+import { actionCompleted, actionOutcomeLocked } from '../../../api/actions'
 import { useCNPGDestroyPlan } from '../../../api/cnpg-sessions'
 import { useToast } from '../../ui/Toast'
 import { trackCNPGOperation } from '../operations/store'
@@ -34,7 +35,7 @@ export function CNPGDestroyInstanceDialog({
   const pvcNames = data?.pvcs.map((p) => p.name) ?? []
   const partial = cnpgActionErrorCode(mutation.error) === 'partial'
   const fenced = !!data && (data.facts.fencedInstances.all || data.facts.fencedInstances.instances.includes(pod))
-  const completed = cnpgActionCompleted(mutation.error)
+  const completed = actionCompleted(mutation.error)
   const fenceOffered = !!data && !fenced && !!onFenceFirst
 
   return (
@@ -116,7 +117,7 @@ export function CNPGDestroyInstanceDialog({
       guardSatisfied={!!cap?.allowed}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
       outcomeTitle={partial ? 'Only part of this took effect' : undefined}
     >
       {partial && completed.length > 0 && (
diff --git a/web/src/components/cnpg/actions/CNPGInstanceActions.tsx b/web/src/components/cnpg/actions/CNPGInstanceActions.tsx
index b3b47cd401..5faa298349 100644
--- a/web/src/components/cnpg/actions/CNPGInstanceActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGInstanceActions.tsx
@@ -1,5 +1,6 @@
 import { useState } from 'react'
-import { useCNPGClusterCapabilities, type CNPGActionCapability, type CNPGClusterActionName } from '../../../api/cnpg'
+import { useCNPGClusterCapabilities, type CNPGClusterActionName } from '../../../api/cnpg'
+import { type ActionCapability, capabilityReason } from '../../../api/actions'
 import { ClusterActionDialog } from './CNPGClusterActions'
 import { CNPGDestroyInstanceDialog } from './CNPGDestroyInstanceDialog'
 import { useOpenCNPGPsql } from './useOpenCNPGPsql'
@@ -33,9 +34,9 @@ export function CNPGInstanceActions({ namespace, cluster, pod }: { namespace: st
   )
   const link = (id: CNPGClusterActionName, label: string, extraReason?: string) => {
     const cap = capFor(id) ?? data.actions[id]
-    return button(id, label, extraReason ?? (!cap.allowed ? cap.reason ?? 'Not allowed' : undefined), () => setOpen(id))
+    return button(id, label, extraReason ?? capabilityReason(cap), () => setOpen(id))
   }
-  const reasonOf = (cap: CNPGActionCapability | undefined) => (!cap ? 'Not available for this instance' : !cap.allowed ? cap.reason ?? 'Not allowed' : undefined)
+  const reasonOf = (cap: ActionCapability | undefined) => (!cap ? 'Not available for this instance' : capabilityReason(cap))
 
   return (
     <>
diff --git a/web/src/components/cnpg/actions/CNPGMaintenanceBanner.tsx b/web/src/components/cnpg/actions/CNPGMaintenanceBanner.tsx
index 33244992be..ae5aa7a7a4 100644
--- a/web/src/components/cnpg/actions/CNPGMaintenanceBanner.tsx
+++ b/web/src/components/cnpg/actions/CNPGMaintenanceBanner.tsx
@@ -2,6 +2,7 @@ import { useState } from 'react'
 import { AlertBanner, Tooltip } from '@skyhook-io/k8s-ui'
 import { useCNPGClusterCapabilities } from '../../../api/cnpg'
 import { ClusterActionDialog } from './CNPGClusterActions'
+import { capabilityReason } from '../../../api/actions'
 
 /**
  * Standing notice while spec.nodeMaintenanceWindow.inProgress is true. The
@@ -33,7 +34,7 @@ export function CNPGMaintenanceBanner({
         }
       >
         <div className="mt-2">
-          <Tooltip content={cap && !cap.allowed ? cap.reason : undefined}>
+          <Tooltip content={cap ? capabilityReason(cap) : undefined}>
             <button
               type="button"
               disabled={!cap?.allowed}
diff --git a/web/src/components/cnpg/actions/CNPGPoolerActions.tsx b/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
index 9c4a235ed4..4602df9c39 100644
--- a/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGPoolerActions.tsx
@@ -1,7 +1,8 @@
 import { useState } from 'react'
 import { Pause, Play } from 'lucide-react'
 import { ActionConfirmDialog, Tooltip } from '@skyhook-io/k8s-ui'
-import { cnpgActionOutcomeLocked, useCNPGAction } from '../../../api/cnpg'
+import { useCNPGAction } from '../../../api/cnpg'
+import { actionOutcomeLocked, capabilityReason } from '../../../api/actions'
 import { useCNPGPoolerCapabilities, type CNPGPoolerCapabilities } from '../../../api/cnpg-sessions'
 import { useToast } from '../../ui/Toast'
 import { useCNPGWriteGuard } from './useCNPGWriteGuard'
@@ -19,7 +20,7 @@ export function CNPGPoolerActions({ namespace, name }: { namespace: string; name
   const cap = data.actions[kind]
   return (
     <>
-      <Tooltip content={cap.allowed ? undefined : cap.reason ?? 'Not allowed'} position="bottom">
+      <Tooltip content={capabilityReason(cap)} position="bottom">
         <button type="button" className={BUTTON} disabled={!cap.allowed} onClick={() => setOpen(kind)}>
           {kind === 'pause' ? <Pause className="h-3.5 w-3.5" /> : <Play className="h-3.5 w-3.5" />}
           {kind === 'pause' ? 'Pause' : 'Resume'}
@@ -70,10 +71,10 @@ function PoolerDialog({ kind, caps, namespace, name, onClose }: { kind: 'pause'
       typedConfirmation={pause ? name : undefined}
       confirmLabel={pause ? 'Pause' : 'Resume'}
       disruptive={pause}
-      disabledReason={cap.allowed ? undefined : cap.reason}
+      disabledReason={capabilityReason(cap)}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
     />
   )
 }
diff --git a/web/src/components/cnpg/actions/CNPGScheduleActions.tsx b/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
index bd1a8058dc..19e41a6666 100644
--- a/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
+++ b/web/src/components/cnpg/actions/CNPGScheduleActions.tsx
@@ -1,12 +1,7 @@
 import { useState } from 'react'
 import { ActionConfirmDialog, CNPGSchedulePreviewFacts, FactGrid, Tooltip, useDebouncedValue } from '@skyhook-io/k8s-ui'
-import {
-  cnpgActionOutcomeLocked,
-  useCNPGAction,
-  useCNPGScheduleCapabilities,
-  useCNPGSchedulePreview,
-  type CNPGScheduleActionName,
-} from '../../../api/cnpg'
+import { useCNPGAction, useCNPGScheduleCapabilities, useCNPGSchedulePreview, type CNPGScheduleActionName } from '../../../api/cnpg'
+import { actionOutcomeLocked, capabilityReason } from '../../../api/actions'
 import { useToast } from '../../ui/Toast'
 import { useCNPGWriteGuard } from './useCNPGWriteGuard'
 import { cnpgOperatorActionNote } from '../operatorStatus'
@@ -24,7 +19,7 @@ export function CNPGScheduleActions({ namespace, name }: { namespace: string; na
   const btn = (id: CNPGScheduleActionName, label: string) => {
     const cap = data.actions[id]
     return (
-      <Tooltip key={id} content={cap.allowed ? undefined : cap.reason ?? 'Not allowed'} position="bottom">
+      <Tooltip key={id} content={capabilityReason(cap)} position="bottom">
         <button type="button" className={BUTTON} disabled={!cap.allowed} onClick={() => setOpen(id)}>
           {label}
         </button>
@@ -98,7 +93,7 @@ function EditScheduleDialog({ namespace, name, onClose }: { namespace: string; n
       confirmLabel="Save schedule"
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
       disabledReason={disabledReason}
       incompleteReason={incompleteReason}
     >
@@ -203,7 +198,7 @@ function ScheduleDialog({ kind, namespace, name, onClose }: { kind: CNPGSchedule
       confirmLabel={spec.confirm}
       isLoading={mutation.isPending}
       error={mutation.error?.message}
-      outcomeUnknown={cnpgActionOutcomeLocked(mutation.error)}
+      outcomeUnknown={actionOutcomeLocked(mutation.error)}
       disabledReason={data.actions[kind].allowed ? undefined : data.actions[kind].reason}
     />
   )
diff --git a/web/src/components/cnpg/actions/actionModel.ts b/web/src/components/cnpg/actions/actionModel.ts
index e28f52ef24..ff5e010e07 100644
--- a/web/src/components/cnpg/actions/actionModel.ts
+++ b/web/src/components/cnpg/actions/actionModel.ts
@@ -1,6 +1,7 @@
 import { cnpgFormatLag } from '@skyhook-io/k8s-ui'
 import { formatBytes } from '../lsn'
-import type { CNPGActionCapability, CNPGBackupMethod } from '../../../api/cnpg'
+import type { CNPGBackupMethod } from '../../../api/cnpg'
+import type { ActionCapability } from '../../../api/actions'
 
 export interface StandbyChoice {
   pod: string
@@ -60,7 +61,7 @@ export function switchoverDefault(input: { touched: boolean; current: string | u
  * after every other state guard, so its reason names the fence only when
  * nothing else blocks.
  */
-export function cnpgDestroyBlocker(cap: CNPGActionCapability | undefined, pod: string, fenceOffered: boolean): string | undefined {
+export function cnpgDestroyBlocker(cap: ActionCapability | undefined, pod: string, fenceOffered: boolean): string | undefined {
   if (!cap || cap.allowed) return undefined
   if (fenceOffered && cap.permission !== 'denied' && cap.reason?.startsWith(`Fence ${pod} first`)) return undefined
   return cap.reason ?? 'Not allowed'
diff --git a/web/src/components/cnpg/recovery/restoreModel.ts b/web/src/components/cnpg/recovery/restoreModel.ts
index 4e0b924271..86a88f1a0d 100644
--- a/web/src/components/cnpg/recovery/restoreModel.ts
+++ b/web/src/components/cnpg/recovery/restoreModel.ts
@@ -1,5 +1,6 @@
 import { CNPG_BARMAN_PLUGIN_NAME, getCNPGClusterBarmanPlugin, getCNPGObjectStoreRecoveryWindows, isApiGroup, type HealthLevel, formatGrant } from '@skyhook-io/k8s-ui'
-import type { CNPGActionCapability, CNPGRuntimeResponse } from '../../../api/cnpg'
+import type { CNPGRuntimeResponse } from '../../../api/cnpg'
+import type { ActionCapability } from '../../../api/actions'
 import type { CNPGRecoveryResponse, CNPGRecoveryPod } from '../../../api/cnpg-recovery'
 
 export const RESTORE_VALIDATION_ANNOTATION = 'radar.skyhook.io/restore-validation'
@@ -437,7 +438,7 @@ export function observeRestore(snap: CNPGRecoveryResponse): RestoreObservation {
  */
 export function restorePermission(
   namespace: string,
-  cap: CNPGActionCapability | undefined,
+  cap: ActionCapability | undefined,
   error: unknown,
 ): { blocked?: string; pending?: string; unchecked?: string } {
   if (cap) {

From 9f0aebe9cec4363850b39024d472853d0aaeb6c0 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:53:47 +0300
Subject: [PATCH 16/26] Write the rules for unknown and partial values once

DESIGN.md states how a surface that reads several sources shows what it
could not read, what it read in part and where a value came from, and
names the shared components that do it. Capacity and CloudNativePG link to
it and keep their own per-value tables.
---
 DESIGN.md        | 11 +++++++++++
 docs/capacity.md |  2 +-
 docs/cnpg.md     |  2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/DESIGN.md b/DESIGN.md
index d33301fa08..43629eeba2 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -173,6 +173,17 @@ Use CSS classes from `components.css` for status cells in table rows:
 | `.border-r-subtle` | Right border |
 | `.border-t-subtle` | Top border |
 
+### Unknown, partial and denied values
+Radar shows only what the cluster reports, and says where it came from. These rules apply to every surface that reads several sources at once (workspace integrations such as Capacity and CloudNativePG, multi-source detail pages):
+
+- **Unavailable ≠ zero.** A value Radar could not read (no access, not installed, not cached, the request failed) renders as unread, naming why — never as `0`, "none" or a healthy colour. A missing grant is named exactly (`GrantText`, `formatGrant`).
+- **Partial ≠ exact.** A count or total over data read only in part is a lower bound: `≥N` (`CertaintyGlyph`, `SidebarCategoryDestination.countLowerBound`), and a zero over partial data is unknown, not none.
+- **Unread is listed, not left out.** A summary line names what it could not read ("not read: Pods, zones"); a combined tone is never calmer than a part that was not read (`worseTone` ranks `unknown` above `healthy`).
+- **Recorded ≠ observed.** A value copied from a status field, an annotation or a declaration says so; a value matched to its subject by name rather than by identity says that too.
+- **Facts keep their rows.** `FactRow` renders the unread text in place; never hide a row because its value is missing (unlike `Property`, which hides empty values).
+
+The shared pieces live in `packages/k8s-ui/src/components/workspace/` (facts, sections, problems, certainty) and `web/src/components/workspace/` (screen layout and tables); each integration's own doc lists which source each value comes from and how it reads when unknown.
+
 ## 5. Layout Principles
 
 ### Spacing
diff --git a/docs/capacity.md b/docs/capacity.md
index c2fb9e6802..ba3610a256 100644
--- a/docs/capacity.md
+++ b/docs/capacity.md
@@ -64,7 +64,7 @@ Operators rarely start at the nav. Capacity meets them where they are:
 
 ## Reading the numbers
 
-Capacity's core contract is **per-value certainty**. Every quantity carries one of:
+Capacity applies Radar's rules for unknown and partial values ([DESIGN.md](../DESIGN.md#unknown-partial-and-denied-values)) per quantity: its core contract is **per-value certainty**. Every quantity carries one of:
 
 | Glyph | Meaning |
 |-------|---------|
diff --git a/docs/cnpg.md b/docs/cnpg.md
index 44ea1eff64..4afb7b5acc 100644
--- a/docs/cnpg.md
+++ b/docs/cnpg.md
@@ -29,7 +29,7 @@ Every CNPG kind's full detail is `/cnpg/<plural>/<namespace|_>/<name>` — reach
 
 ## The certainty contract
 
-Every value is something the cluster reports, labelled with where it came from. When the cluster does not report something the UI says so; it never shows zero, "none" or green in its place.
+Every value is something the cluster reports, labelled with where it came from. When the cluster does not report something the UI says so; it never shows zero, "none" or green in its place. These are Radar's shared rules for unknown and partial values ([DESIGN.md](../DESIGN.md#unknown-partial-and-denied-values)); the table below is where each CloudNativePG fact comes from.
 
 | Fact | Source | When it is not known |
 |---|---|---|

From dd5590f38a8fb352db173ae4c530944140d4c798 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 01:55:27 +0300
Subject: [PATCH 17/26] Say a namespace is not cached rather than not
 accessible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coverage gains the uncached state and uncachedNamespaces. One function,
cnpgCoverageGap, words why a kind was not read for both the workspace facts
and the related-object lookups: no access only when the namespace is named
as denied, "Radar does not cache …" when it is named as uncached, and
"not read" when the server names neither cause. Empty states and the
coverage notice word the uncached case the same way.
---
 .../k8s-ui/src/components/cnpg/relations.ts   | 14 ++------
 .../src/components/cnpg/workspace.test.ts     | 11 ++++++-
 .../k8s-ui/src/components/cnpg/workspace.ts   | 32 +++++++++++++------
 web/src/components/cnpg/shared.tsx            | 11 +++++--
 4 files changed, 42 insertions(+), 26 deletions(-)

diff --git a/packages/k8s-ui/src/components/cnpg/relations.ts b/packages/k8s-ui/src/components/cnpg/relations.ts
index 78f4324843..f9e682a2d5 100644
--- a/packages/k8s-ui/src/components/cnpg/relations.ts
+++ b/packages/k8s-ui/src/components/cnpg/relations.ts
@@ -10,7 +10,7 @@ import {
   isApiGroup,
   type CNPGObjectStoreRecoveryWindow,
 } from '../resources/resource-utils-cnpg'
-import { cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText, coverageReadable, type CNPGProblem, type CNPGWorkspaceIssue, type CNPGWorkspaceKey, type CNPGWorkspaceResponse } from './workspace'
+import { cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText, cnpgCoverageGap, coverageReadable, type CNPGProblem, type CNPGWorkspaceIssue, type CNPGWorkspaceKey, type CNPGWorkspaceResponse } from './workspace'
 import type { Fact } from '../workspace'
 
 export interface CNPGObjectRef {
@@ -70,17 +70,7 @@ export function relationUnavailable(
   if (!ws) return `${what} could not be read`
   const cov = ws.coverage?.[key] ?? { state: 'notInstalled' as const }
   if (coverageReadable(cov, namespace)) return null
-  switch (cov.state) {
-    case 'denied':
-    case 'partial':
-      return `No access to ${what}`
-    case 'syncing':
-      return 'Loading…'
-    case 'error':
-      return `Could not read ${what}`
-    default:
-      return `${what} are not installed`
-  }
+  return cnpgCoverageGap(cov, what, namespace, `${what} are not installed`)
 }
 
 export function clustersIn(ws: CNPGWorkspaceResponse | null | undefined): any[] {
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.test.ts b/packages/k8s-ui/src/components/cnpg/workspace.test.ts
index 0d9cc6f3c0..aceab333db 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.test.ts
@@ -298,7 +298,16 @@ describe('buildCNPGFleet', () => {
     const named = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { backups: { state: 'partial', allowedNamespaces: ['db'] } } }))
     expect(named.rows[0].protection.lastSuccessfulBackup.text).toBe('None observed')
     const unnamed = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { backups: { state: 'partial' } } }))
-    expect(unnamed.rows[0].protection.lastSuccessfulBackup.text).toBe('No access to Backups')
+    expect(unnamed.rows[0].protection.lastSuccessfulBackup.text).toBe('Backups not read in db')
+  })
+
+  it('names the cause of a partial read only when the server names the namespace', () => {
+    const denied = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { backups: { state: 'partial', allowedNamespaces: ['other'], deniedNamespaces: ['db'] } } }))
+    expect(denied.rows[0].protection.lastSuccessfulBackup.text).toBe('No access to Backups')
+    const uncached = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { pods: { state: 'partial', allowedNamespaces: ['other'], uncachedNamespaces: ['db'] } } }))
+    expect(uncached.rows[0].replication.text).toBe('Radar does not cache Pods in db')
+    const none = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { pods: { state: 'uncached' } } }))
+    expect(none.rows[0].replication.text).toBe('Radar does not cache Pods')
   })
 
   it('says no access instead of "no replica pods" when Pods are unreadable', () => {
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index 6a3ae17904..c6e0374db5 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -36,12 +36,14 @@ export const CNPG_WORKSPACE_KEYS = [
 
 export type CNPGWorkspaceKey = (typeof CNPG_WORKSPACE_KEYS)[number]
 
-export type CNPGCoverageState = 'full' | 'partial' | 'denied' | 'notInstalled' | 'syncing' | 'error'
+export type CNPGCoverageState = 'full' | 'partial' | 'denied' | 'notInstalled' | 'syncing' | 'uncached' | 'error'
 
 export interface CNPGKindCoverage {
   state: CNPGCoverageState
   /** Denied namespaces, named only when the caller supplied the candidate list. */
   deniedNamespaces?: string[]
+  /** Namespaces the caller may read but Radar's cache does not hold, named under the same rule. */
+  uncachedNamespaces?: string[]
   /** For partial coverage: the namespaces that were read. */
   allowedNamespaces?: string[]
 }
@@ -410,23 +412,33 @@ export function coverageReadable(cov: CNPGKindCoverage, namespace?: string): boo
   if (cov.state === 'partial') {
     if (!namespace) return false
     if (cov.allowedNamespaces) return cov.allowedNamespaces.includes(namespace)
-    if (cov.deniedNamespaces) return !cov.deniedNamespaces.includes(namespace)
+    if (cov.deniedNamespaces || cov.uncachedNamespaces) return !cov.deniedNamespaces?.includes(namespace) && !cov.uncachedNamespaces?.includes(namespace)
     return false
   }
   return false
 }
 
-function coverageUnavailableText(cov: CNPGKindCoverage, what: string): string {
+/**
+ * Why a kind's objects were not read (in `namespace`, when given), worded for
+ * a fact. A namespace Radar's cache does not hold is never called "no access";
+ * a partial read that names neither cause says only that it was not read.
+ */
+export function cnpgCoverageGap(cov: CNPGKindCoverage, what: string, namespace?: string, notInstalled = 'Not installed'): string {
   switch (cov.state) {
     case 'denied':
-    case 'partial':
       return `No access to ${what}`
+    case 'partial':
+      if (namespace && cov.uncachedNamespaces?.includes(namespace)) return `Radar does not cache ${what} in ${namespace}`
+      if (namespace && cov.deniedNamespaces?.includes(namespace)) return `No access to ${what}`
+      return namespace ? `${what} not read in ${namespace}` : `${what} not read`
+    case 'uncached':
+      return `Radar does not cache ${what}`
     case 'syncing':
       return 'Loading…'
     case 'error':
       return `Could not read ${what}`
     default:
-      return 'Not installed'
+      return notInstalled
   }
 }
 
@@ -484,7 +496,7 @@ function scheduleFact(
 ): CNPGProtectionFacts['schedule'] {
   const ns = cluster.metadata?.namespace
   if (!coverageReadable(cov, ns)) {
-    return { text: coverageUnavailableText(cov, 'ScheduledBackups'), tone: 'unknown', names: [] }
+    return { text: cnpgCoverageGap(cov, 'ScheduledBackups', ns), tone: 'unknown', names: [] }
   }
   const mine = schedules.filter((s) => s.metadata?.namespace === ns && specClusterName(s) === cluster.metadata?.name)
   if (mine.length === 0) return { text: 'No declarative schedule', tone: 'neutral', names: [] }
@@ -568,9 +580,9 @@ function lastBackupFact(
   if (!cfg.plugin && cfg.lastSuccessfulBackup) candidates.push({ at: cfg.lastSuccessfulBackup, source: 'Cluster status' })
   if (candidates.length === 0) {
     if (!coverageReadable(backupsCov, ns)) {
-      return { text: coverageUnavailableText(backupsCov, 'Backups'), tone: 'unknown' }
+      return { text: cnpgCoverageGap(backupsCov, 'Backups', ns), tone: 'unknown' }
     }
-    if (storesUnreadable) return { text: coverageUnavailableText(storesUnreadable, 'ObjectStores'), tone: 'unknown' }
+    if (storesUnreadable) return { text: cnpgCoverageGap(storesUnreadable, 'ObjectStores', ns), tone: 'unknown' }
     return { text: 'None observed', tone: 'unknown' }
   }
   const best = candidates.reduce((a, b) => (Date.parse(a.at) >= Date.parse(b.at) ? a : b))
@@ -736,7 +748,7 @@ function replicationFact(cluster: any, pods: CNPGInstance[], hibernated: boolean
   const desired = cluster?.spec?.instances
   if (desired === 1) return { text: 'Single instance', tone: 'neutral' }
   if (!coverageReadable(podsCov, cluster?.metadata?.namespace)) {
-    return { text: coverageUnavailableText(podsCov, 'Pods'), tone: 'unknown' }
+    return { text: cnpgCoverageGap(podsCov, 'Pods', cluster?.metadata?.namespace), tone: 'unknown' }
   }
   const replicas = pods.filter((p) => p.role === 'replica')
   const readyReplicas = replicas.filter((p) => p.ready === true).length
@@ -994,7 +1006,7 @@ export function buildCNPGFleet(resp: CNPGWorkspaceResponse): CNPGFleet {
             source: `ObjectStore ${window.store} status (earliest point)`,
           }
         : storesUnreadable
-          ? { text: coverageUnavailableText(storesCov, 'ObjectStores'), tone: 'unknown' }
+          ? { text: cnpgCoverageGap(storesCov, 'ObjectStores', ns), tone: 'unknown' }
           : { text: 'Not reported', tone: 'unknown' },
       restoreValidation: restoreValidationFact(cluster, clusters, resp.objects.backups ?? [], coverageReadable(coverageOf(resp, 'backups'), ns)),
     }
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index 2b82fdc52e..d64eaa2353 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -29,7 +29,8 @@ export interface CNPGScreenProps {
 
 const COVERAGE_LABEL: Record<string, string> = {
   denied: 'no access',
-  partial: 'no access in some namespaces',
+  partial: 'not read in some namespaces',
+  uncached: 'not cached by Radar',
   syncing: 'still loading',
   error: 'could not be read',
 }
@@ -124,7 +125,11 @@ export function coverageEmpty(cov: CNPGKindCoverage | undefined, noun: string):
     case 'full':
       return `No ${noun} in this scope.`
     case 'partial':
-      return `No ${noun} visible. Some namespaces are not readable with your access.`
+      if (cov.uncachedNamespaces?.length) return `No ${noun} visible. Radar does not cache ${noun} in ${cov.uncachedNamespaces.join(', ')}.`
+      if (cov.deniedNamespaces?.length) return `No ${noun} visible. Some namespaces are not readable with your access.`
+      return `No ${noun} visible. Some namespaces were not read.`
+    case 'uncached':
+      return `Radar does not cache ${noun} in this scope.`
     case 'denied':
       return `No access to ${noun}.`
     case 'syncing':
@@ -138,7 +143,7 @@ export function coverageEmpty(cov: CNPGKindCoverage | undefined, noun: string):
 
 /** The less complete of two coverages, for collections built from several kinds. */
 export function worstCoverage(...covs: (CNPGKindCoverage | undefined)[]): CNPGKindCoverage | undefined {
-  const rank: Record<string, number> = { error: 0, denied: 1, syncing: 2, partial: 3, full: 4, notInstalled: 5 }
+  const rank: Record<string, number> = { error: 0, denied: 1, uncached: 2, syncing: 3, partial: 4, full: 5, notInstalled: 6 }
   return covs.filter(Boolean).sort((a, b) => (rank[a!.state] ?? 9) - (rank[b!.state] ?? 9))[0]
 }
 

From 289c1a5578617f3e6341235268ec83e407ca76a9 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:01:07 +0300
Subject: [PATCH 18/26] Show the GitOps manager the server detected for
 CloudNativePG objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workspace read Argo CD and Flux labels itself, which misnamed Argo CD
applications that live outside Argo CD's namespace and ignored the Flux
namespace label. It now uses the managedBy the server derives for each
object, and the shared ManagedByText names the manager as "Argo CD
application argocd/app" or "Flux Kustomization …", linking it when its
namespace is recorded; gitOpsOwnerFromRef is exported for it.

The operator page's coverage notice words its gaps like the workspace
notice ("not cached by Radar in pg") instead of printing raw states.
---
 .../cnpg/CNPGClusterSummary.test.tsx          |  1 -
 .../components/cnpg/CNPGClusterSummary.tsx    |  6 ++--
 .../cnpg/CNPGDeclarativeSummary.tsx           | 25 ++++++-------
 .../k8s-ui/src/components/cnpg/ha.test.ts     |  1 -
 .../src/components/cnpg/relations.test.ts     | 11 ------
 .../k8s-ui/src/components/cnpg/relations.ts   |  1 -
 .../k8s-ui/src/components/cnpg/workspace.ts   | 35 +++++++-----------
 .../k8s-ui/src/components/workspace/index.ts  |  1 +
 .../components/workspace/managed-by.test.tsx  | 26 ++++++++++++++
 .../src/components/workspace/managed-by.tsx   | 36 +++++++++++++++++++
 packages/k8s-ui/src/utils/gitops-owner.ts     |  5 +--
 web/src/api/cnpg.ts                           |  8 ++---
 web/src/components/cnpg/CNPGDeclarations.tsx  | 18 +++++-----
 web/src/components/cnpg/CNPGOperator.tsx      |  4 +--
 web/src/components/cnpg/shared.tsx            | 12 ++++---
 15 files changed, 112 insertions(+), 78 deletions(-)
 create mode 100644 packages/k8s-ui/src/components/workspace/managed-by.test.tsx
 create mode 100644 packages/k8s-ui/src/components/workspace/managed-by.tsx

diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
index 525081f069..e13a583071 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
@@ -41,7 +41,6 @@ function row(over: Partial<CNPGFleetRow> = {}): CNPGFleetRow {
     problems: [],
     attention: false,
     categories: new Set(),
-    gitops: null,
     ...over,
   }
 }
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
index b05b1be21a..d9837a8ce8 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
@@ -10,7 +10,7 @@ import type { CNPGDimension } from './ha'
 import { PrimaryConflictNote } from './primitives'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { StatusDot, toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactSource, FactValue, ProblemCallout, ProblemList, SectionHeading } from '../workspace'
+import { FactGrid, FactRow, FactSource, FactValue, ProblemCallout, ProblemList, SectionHeading, ManagedByText, managedByLabel } from '../workspace'
 
 function ReadyCount({ row }: { row: CNPGFleetRow }) {
   const r = cnpgReadyInstances(row)
@@ -253,9 +253,9 @@ export function CNPGClusterSummary({
             </span>
           )}
         </FactRow>
-        {row.gitops && (
+        {row.managedBy && managedByLabel(row.managedBy) && (
           <FactRow label="Declared in">
-            {row.gitops.tool === 'argocd' ? 'Argo CD' : 'Flux'} <span className="font-mono">{row.gitops.name}</span>
+            <ManagedByText refTo={row.managedBy} onNavigate={onNavigate} />
           </FactRow>
         )}
         {stateFacts}
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
index 4d775d27d6..c56f60202a 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from 'react'
 import { getCNPGDeclarativeMessage, getCNPGReclaimPolicy } from '../resources/resource-utils-cnpg'
-import type { CNPGWorkspaceResponse } from './workspace'
+import { cnpgManagedBy, type CNPGWorkspaceResponse } from './workspace'
 import type { Fact } from '../workspace'
 import { cnpgLogicalPaths, type CNPGLogicalPath } from './logicalReplication'
 import { CNPGLogicalPathView } from './CNPGLogicalPath'
@@ -10,7 +10,6 @@ import {
   appliedFact,
   clustersIn,
   databaseForDeclaration,
-  gitopsSourceOf,
   missingManagedRole,
   observedGenerationFact,
   refOf,
@@ -21,7 +20,7 @@ import {
 } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
+import { FactGrid, FactRow, FactValue, SectionHeading, ManagedByText, managedByLabel } from '../workspace'
 
 interface SummaryProps {
   resource: any
@@ -68,14 +67,10 @@ function Reconciled({ resource, extra }: { resource: any; extra?: ReactNode }) {
   )
 }
 
-function DeclaredIn({ resource }: { resource: any }) {
-  const src = gitopsSourceOf(resource)
-  if (!src) return <NotReported text="GitOps source not recorded" />
-  return (
-    <span>
-      {src.tool === 'argocd' ? 'Argo CD application' : 'Flux'} <span className="font-mono">{src.namespace ? `${src.namespace}/${src.name}` : src.name}</span>
-    </span>
-  )
+function DeclaredIn({ resource, workspace, onNavigate }: { resource: any; workspace: CNPGWorkspaceResponse | null; onNavigate?: NavigateToRef }) {
+  const manager = cnpgManagedBy(workspace, resource)
+  if (!manager || !managedByLabel(manager)) return <NotReported text="GitOps source not recorded" />
+  return <ManagedByText refTo={manager} onNavigate={onNavigate} />
 }
 
 function DatabaseRef({ resource, workspace, onNavigate }: SummaryProps) {
@@ -146,7 +141,7 @@ export function CNPGDatabaseSummary({ resource, workspace, onNavigate }: Summary
       <SectionHeading>Source and target</SectionHeading>
       <FactGrid>
         <FactRow label="Declared in">
-          <DeclaredIn resource={resource} />
+          <DeclaredIn resource={resource} workspace={workspace} onNavigate={onNavigate} />
         </FactRow>
         <FactRow label="Cluster">
           <ClusterLink resource={resource} workspace={workspace} onNavigate={onNavigate} />
@@ -243,7 +238,7 @@ export function CNPGPublicationSummary({
         <FactRow label="Publishes">{publicationTargets(resource)}</FactRow>
         <ReclaimRow resource={resource} />
         <FactRow label="Declared in">
-          <DeclaredIn resource={resource} />
+          <DeclaredIn resource={resource} workspace={workspace} onNavigate={onNavigate} />
         </FactRow>
       </FactGrid>
 
@@ -313,7 +308,7 @@ export function CNPGDatabaseRoleSummary({ resource, workspace, onNavigate }: Sum
         </FactRow>
         <ReclaimRow resource={resource} />
         <FactRow label="Declared in">
-          <DeclaredIn resource={resource} />
+          <DeclaredIn resource={resource} workspace={workspace} onNavigate={onNavigate} />
         </FactRow>
       </FactGrid>
 
@@ -381,7 +376,7 @@ export function CNPGSubscriptionSummary({
         </FactRow>
         <ReclaimRow resource={resource} />
         <FactRow label="Declared in">
-          <DeclaredIn resource={resource} />
+          <DeclaredIn resource={resource} workspace={workspace} onNavigate={onNavigate} />
         </FactRow>
       </FactGrid>
 
diff --git a/packages/k8s-ui/src/components/cnpg/ha.test.ts b/packages/k8s-ui/src/components/cnpg/ha.test.ts
index 20d4f57773..06ae643cee 100644
--- a/packages/k8s-ui/src/components/cnpg/ha.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/ha.test.ts
@@ -70,7 +70,6 @@ function row(over: Partial<CNPGFleetRow> = {}): CNPGFleetRow {
     problems: [],
     attention: false,
     categories: new Set(),
-    gitops: null,
     ...over,
   }
 }
diff --git a/packages/k8s-ui/src/components/cnpg/relations.test.ts b/packages/k8s-ui/src/components/cnpg/relations.test.ts
index 437dafbc70..9bffa5ec25 100644
--- a/packages/k8s-ui/src/components/cnpg/relations.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/relations.test.ts
@@ -5,7 +5,6 @@ import {
   backupsForScheduledBackup,
   clustersUsingCatalog,
   databaseForDeclaration,
-  gitopsSourceOf,
   inferredObjectStoreHealth,
   isBackupFromSchedule,
   issuesForObject,
@@ -254,16 +253,6 @@ describe('declarations', () => {
     expect(missingManagedRole({ status: { message: 'connection refused' } }, cluster('main'))).toBeNull()
   })
 
-  it('reads the GitOps owner labels', () => {
-    expect(gitopsSourceOf({ metadata: { labels: { 'argocd.argoproj.io/instance': 'app' } } })).toEqual({ tool: 'argocd', name: 'app' })
-    expect(gitopsSourceOf({ metadata: { labels: { 'kustomize.toolkit.fluxcd.io/name': 'k', 'kustomize.toolkit.fluxcd.io/namespace': 'flux' } } })).toEqual({
-      tool: 'flux',
-      name: 'k',
-      namespace: 'flux',
-    })
-    expect(gitopsSourceOf({ metadata: {} })).toBeNull()
-  })
-
   const decl = (kind: string, name: string, clusterName: string, dbname: string, ns = 'pg') => ({
     apiVersion: PG,
     kind,
diff --git a/packages/k8s-ui/src/components/cnpg/relations.ts b/packages/k8s-ui/src/components/cnpg/relations.ts
index f9e682a2d5..1119129414 100644
--- a/packages/k8s-ui/src/components/cnpg/relations.ts
+++ b/packages/k8s-ui/src/components/cnpg/relations.ts
@@ -317,7 +317,6 @@ export function missingManagedRole(obj: any, cluster: any | null): string | null
   return names.includes(m[1]) ? null : m[1]
 }
 
-export { cnpgGitOpsSource as gitopsSourceOf } from './workspace'
 
 /** Publications and Subscriptions on the same Cluster and PostgreSQL database. */
 export function replicationForDatabase(
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index c6e0374db5..c70d9d628a 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -5,6 +5,7 @@
 import { formatAge, type HealthLevel } from '../resources/resource-utils'
 import { worseTone } from '../ui/status-tone'
 import type { Fact, ProblemOrigin, WorkspaceProblem } from '../workspace'
+import type { ResourceRef } from '../../types/core'
 import { formatBytes } from '../../utils/format'
 import { formatGrant, type Grant } from '../../utils/grant'
 import { issueReasonTitle } from '../issues/severity'
@@ -84,6 +85,8 @@ export interface CNPGWorkspaceResponse {
   backupsOmitted: number
   /** Each ScheduledBackup's schedule as the operator reads it, keyed "namespace/name"; absent when it cannot be parsed. */
   scheduleReadings?: Record<string, string>
+  /** The manager of each object that has one, keyed "Kind/namespace/name". */
+  managedBy?: Record<string, ResourceRef>
 }
 
 export const CNPG_KIND_BY_KEY: Record<CNPGWorkspaceKey, { kind: string; group: string; plural: string }> = {
@@ -171,7 +174,8 @@ export interface CNPGFleetRow {
   attention: boolean
   categories: Set<CNPGProblemCategory>
   /** GitOps owner recorded on the Cluster, when it carries the standard labels. */
-  gitops: CNPGGitOpsSource | null
+  /** The GitOps or Helm object that manages the Cluster, as the server detected it. */
+  managedBy?: ResourceRef
   /** Fullest measured volume, set by applyCNPGDisk; absent when no disk reading was requested. */
   disk?: Fact
   /** Growth of the fastest-growing volume, set by applyCNPGFleetMetrics when measured. */
@@ -465,27 +469,12 @@ function podReady(pod: any): boolean | null {
   return ready.status === 'True'
 }
 
-export type CNPGGitOpsSource = { tool: 'argocd' | 'flux'; name: string; namespace?: string }
-
-/** The GitOps owner recorded on an object's standard Argo CD / Flux labels. */
-export function cnpgGitOpsSource(obj: any): CNPGGitOpsSource | null {
-  const labels = obj?.metadata?.labels ?? {}
-  const annotations = obj?.metadata?.annotations ?? {}
-  const argo = labels['argocd.argoproj.io/instance']
-  if (argo) return { tool: 'argocd', name: argo }
-  const tracking = annotations['argocd.argoproj.io/tracking-id']
-  if (typeof tracking === 'string' && tracking.includes(':')) {
-    return { tool: 'argocd', name: tracking.split(':')[0] }
-  }
-  const fluxName = labels['kustomize.toolkit.fluxcd.io/name'] || labels['helm.toolkit.fluxcd.io/name']
-  if (fluxName) {
-    return {
-      tool: 'flux',
-      name: fluxName,
-      namespace: labels['kustomize.toolkit.fluxcd.io/namespace'] || labels['helm.toolkit.fluxcd.io/namespace'],
-    }
-  }
-  return null
+/** The manager the server detected for a workspace object (Argo CD, Flux or Helm), if any. */
+export function cnpgManagedBy(ws: Pick<CNPGWorkspaceResponse, 'managedBy'> | null | undefined, obj: any): ResourceRef | undefined {
+  const kind = obj?.kind
+  const name = obj?.metadata?.name
+  if (!kind || !name) return undefined
+  return ws?.managedBy?.[`${kind}/${obj?.metadata?.namespace ?? ''}/${name}`]
 }
 
 function scheduleFact(
@@ -1052,7 +1041,7 @@ export function buildCNPGFleet(resp: CNPGWorkspaceResponse): CNPGFleet {
       problems,
       attention: problems.some((p) => p.severity !== 'posture'),
       categories,
-      gitops: cnpgGitOpsSource(cluster),
+      managedBy: cnpgManagedBy(resp, cluster),
     }
   })
 
diff --git a/packages/k8s-ui/src/components/workspace/index.ts b/packages/k8s-ui/src/components/workspace/index.ts
index f0275d0cff..fb2fcd7ecb 100644
--- a/packages/k8s-ui/src/components/workspace/index.ts
+++ b/packages/k8s-ui/src/components/workspace/index.ts
@@ -4,3 +4,4 @@ export * from './facts'
 export * from './sections'
 export * from './problems'
 export * from './certainty'
+export * from './managed-by'
diff --git a/packages/k8s-ui/src/components/workspace/managed-by.test.tsx b/packages/k8s-ui/src/components/workspace/managed-by.test.tsx
new file mode 100644
index 0000000000..842c51f1ef
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/managed-by.test.tsx
@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { ManagedByText, managedByLabel } from './managed-by'
+import { cnpgManagedBy } from '../cnpg/workspace'
+
+describe('ManagedByText', () => {
+  it('names the GitOps manager and links it when its namespace is recorded', () => {
+    const app = { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'payments' }
+    const html = renderToStaticMarkup(<ManagedByText refTo={app} onNavigate={() => {}} />)
+    expect(html).toContain('Argo CD application')
+    expect(html).toMatch(/<button[^>]*>argocd\/payments<\/button>/)
+    expect(renderToStaticMarkup(<ManagedByText refTo={{ ...app, namespace: '' }} onNavigate={() => {}} />)).not.toContain('<button')
+  })
+  it('says nothing for a manager that is not a GitOps controller', () => {
+    expect(renderToStaticMarkup(<ManagedByText refTo={{ kind: 'HelmRelease', namespace: 'db', name: 'pg' }} />)).toBe('')
+    expect(managedByLabel({ kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', namespace: 'flux-system', name: 'apps' })).toBe('Flux Kustomization flux-system/apps')
+  })
+})
+
+describe('cnpgManagedBy', () => {
+  it('looks an object up by kind, namespace and name in the workspace answer', () => {
+    const ws = { managedBy: { 'Cluster/db/pg': { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'pg' } } }
+    expect(cnpgManagedBy(ws, { kind: 'Cluster', metadata: { namespace: 'db', name: 'pg' } })?.name).toBe('pg')
+    expect(cnpgManagedBy(ws, { kind: 'Pooler', metadata: { namespace: 'db', name: 'pg' } })).toBeUndefined()
+  })
+})
diff --git a/packages/k8s-ui/src/components/workspace/managed-by.tsx b/packages/k8s-ui/src/components/workspace/managed-by.tsx
new file mode 100644
index 0000000000..c5ba1c1ec4
--- /dev/null
+++ b/packages/k8s-ui/src/components/workspace/managed-by.tsx
@@ -0,0 +1,36 @@
+import type { ResourceRef } from '../../types/core'
+import { gitOpsOwnerFromRef, type GitOpsOwnerRef } from '../../utils/gitops-owner'
+import { RefLink, type NavigateToRef } from '../ui/RefLink'
+
+function managerLabel(owner: GitOpsOwnerRef): string {
+  if (owner.tool === 'argocd') return 'Argo CD application'
+  return owner.kind === 'helmreleases' ? 'Flux HelmRelease' : 'Flux Kustomization'
+}
+
+/**
+ * The GitOps object that manages a resource, from the server's manager
+ * detection. Renders nothing for a manager that is not a GitOps controller,
+ * and plain text when the manager's namespace is not recorded.
+ */
+export function ManagedByText({ refTo, onNavigate }: { refTo: ResourceRef; onNavigate?: NavigateToRef }) {
+  const owner = gitOpsOwnerFromRef(refTo)
+  if (!owner) return null
+  return (
+    <span>
+      {managerLabel(owner)}{' '}
+      {refTo.namespace ? (
+        <RefLink refTo={refTo} onNavigate={onNavigate} mono>
+          {`${refTo.namespace}/${refTo.name}`}
+        </RefLink>
+      ) : (
+        <span className="font-mono">{refTo.name}</span>
+      )}
+    </span>
+  )
+}
+
+/** The manager's label and name as text, for a table cell. */
+export function managedByLabel(refTo: ResourceRef | undefined): string | undefined {
+  const owner = refTo && gitOpsOwnerFromRef(refTo)
+  return owner ? `${managerLabel(owner)} ${refTo!.namespace ? `${refTo!.namespace}/` : ''}${refTo!.name}` : undefined
+}
diff --git a/packages/k8s-ui/src/utils/gitops-owner.ts b/packages/k8s-ui/src/utils/gitops-owner.ts
index 5d2ce20829..766ba94a43 100644
--- a/packages/k8s-ui/src/utils/gitops-owner.ts
+++ b/packages/k8s-ui/src/utils/gitops-owner.ts
@@ -38,10 +38,11 @@ export function gitOpsOwnerFromRelationships(
 ): GitOpsOwnerRef | null {
   const refs = rel?.managedBy
   if (!refs || refs.length === 0) return null
-  return refToGitOpsOwner(refs[0])
+  return gitOpsOwnerFromRef(refs[0])
 }
 
-function refToGitOpsOwner(ref: ResourceRef): GitOpsOwnerRef | null {
+/** A manager ref (relationships.managedBy, a workspace's managedBy) as a GitOps owner, or null when the manager is not a GitOps controller. */
+export function gitOpsOwnerFromRef(ref: ResourceRef): GitOpsOwnerRef | null {
   switch (true) {
     case ref.kind === 'Application' && ref.group === ARGO_APPLICATION_GROUP:
       return { tool: 'argocd', kind: 'applications', namespace: ref.namespace, name: ref.name }
diff --git a/web/src/api/cnpg.ts b/web/src/api/cnpg.ts
index 073e582d6f..b1be7d72e5 100644
--- a/web/src/api/cnpg.ts
+++ b/web/src/api/cnpg.ts
@@ -1,5 +1,5 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
-import type { CNPGSchedulePreview, CNPGWorkspaceResponse, Grant, TimelineEvent } from '@skyhook-io/k8s-ui'
+import type { CNPGKindCoverage, CNPGSchedulePreview, CNPGWorkspaceResponse, Grant, TimelineEvent } from '@skyhook-io/k8s-ui'
 import { fetchJSON, useRadarFeature } from './client'
 import { shouldRetryRadarQuery } from './radarFeatures'
 import type { CNPGOperatorDiagnosis } from './cnpg-recovery'
@@ -25,10 +25,8 @@ export function useCNPGWorkspace(namespaces: string[], options?: { enabled?: boo
   })
 }
 
-export interface CNPGOperatorCoverage {
-  state: 'full' | 'partial' | 'denied' | 'syncing' | 'error'
-  deniedNamespaces?: string[]
-}
+/** The operator's Deployments and Services are read with the same per-kind coverage as the workspace. */
+export type CNPGOperatorCoverage = CNPGKindCoverage
 
 export interface CNPGOperatorComponent {
   role: 'operator' | 'plugin'
diff --git a/web/src/components/cnpg/CNPGDeclarations.tsx b/web/src/components/cnpg/CNPGDeclarations.tsx
index 2feee03057..fd60c5be7c 100644
--- a/web/src/components/cnpg/CNPGDeclarations.tsx
+++ b/web/src/components/cnpg/CNPGDeclarations.tsx
@@ -6,7 +6,9 @@ import {
   CNPGLogicalPathView,
   cnpgDatabaseRoleFacts,
   cnpgDatabaseRoleMeta,
-  cnpgGitOpsSource,
+  cnpgManagedBy,
+  managedByLabel,
+  type CNPGWorkspaceResponse,
   cnpgLogicalPaths,
   cnpgLogicalSlotFact,
   isApiGroup,
@@ -51,10 +53,8 @@ function stateOf(obj: any): State {
   return 'pending'
 }
 
-function gitopsSource(obj: any): string | undefined {
-  const src = cnpgGitOpsSource(obj)
-  if (!src) return undefined
-  return `${src.tool === 'argocd' ? 'Argo CD' : 'Flux'} ${src.name}`
+function gitopsSource(data: CNPGWorkspaceResponse, obj: any): string | undefined {
+  return managedByLabel(cnpgManagedBy(data, obj))
 }
 
 const STATE_BADGE: Record<State, { severity: 'success' | 'warning' | 'neutral'; text: string }> = {
@@ -105,7 +105,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
         state: st,
         meta: d.spec?.owner ? `owner ${d.spec.owner}` : undefined,
         error: st === 'failed' ? d.status?.message : undefined,
-        source: gitopsSource(d),
+        source: gitopsSource(data, d),
         resource: cnpgResource('databases', ns, d.metadata?.name),
         isField: false,
       })
@@ -125,7 +125,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
                 ? p.spec?.target?.allTables ? 'all tables' : 'selected objects'
                 : `from ${p.spec?.publicationName ?? 'an unnamed publication'} on ${p.spec?.externalClusterName ?? 'an unnamed external cluster'}`,
             error: pst === 'failed' ? p.status?.message : undefined,
-            source: gitopsSource(p),
+            source: gitopsSource(data, p),
             resource: cnpgResource(kind === 'Publication' ? 'publications' : 'subscriptions', ns, p.metadata?.name),
             isField: false,
           })
@@ -146,7 +146,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
           state: pst,
           meta: p.spec?.dbname ? `database ${p.spec.dbname}` : undefined,
           error: pst === 'failed' ? p.status?.message : undefined,
-          source: gitopsSource(p),
+          source: gitopsSource(data, p),
           resource: cnpgResource(kind === 'Publication' ? 'publications' : 'subscriptions', ns, p.metadata?.name),
           isField: false,
         })
@@ -165,7 +165,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
         state: f.state,
         meta: cnpgDatabaseRoleMeta(f),
         error: f.state === 'failed' ? f.message : undefined,
-        source: gitopsSource(r),
+        source: gitopsSource(data, r),
         resource: cnpgResource('databaseroles', ns, r.metadata?.name),
         isField: false,
       })
diff --git a/web/src/components/cnpg/CNPGOperator.tsx b/web/src/components/cnpg/CNPGOperator.tsx
index e97632ec96..526ec864ee 100644
--- a/web/src/components/cnpg/CNPGOperator.tsx
+++ b/web/src/components/cnpg/CNPGOperator.tsx
@@ -2,7 +2,7 @@ import { useMemo } from 'react'
 import { Badge, getCNPGImageCatalogEntries, isApiGroup, PaneLoader, Tooltip } from '@skyhook-io/k8s-ui'
 import { useCNPGOperator, type CNPGOperatorComponent, type CNPGOperatorConfig } from '../../api/cnpg'
 import { CNPGOperatorDiagnosisSection } from './CNPGOperatorDiagnosis'
-import { CNPGWorkspaceHeader, CoverageNotice, coverageEmpty, worstCoverage, cnpgResource, type CNPGScreenProps } from './shared'
+import { CNPGWorkspaceHeader, CoverageNotice, coverageEmpty, coverageLabel, worstCoverage, cnpgResource, type CNPGScreenProps } from './shared'
 import { Mono, Notice, ScreenBody, SectionTable, Sub } from '../workspace/layout'
 
 interface CatalogRow {
@@ -69,7 +69,7 @@ export function CNPGOperator({ data, fleet, onInspect, inspected }: CNPGScreenPr
           <>
             {coverageGaps.length > 0 && (
               <Notice>
-                Some workloads are not readable ({coverageGaps.map((k) => `${k}: ${op.coverage[k].state}`).join(', ')}), so an operator or plugin running in those namespaces may be missing below.
+                Some workloads are not readable ({coverageGaps.map((k) => `${k === 'deployments' ? 'Deployments' : 'Services'}: ${coverageLabel(op.coverage[k])}`).join(', ')}), so an operator or plugin running in those namespaces may be missing below.
               </Notice>
             )}
             <SectionTable
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index d64eaa2353..3e8073ea76 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -53,13 +53,15 @@ export function CNPGWorkspaceHeader({ title, subtitle, actions }: { title: strin
   )
 }
 
+/** How much of a kind was read, in a few words ("not cached by Radar in pg"). */
+export function coverageLabel(cov: CNPGKindCoverage | undefined): string {
+  if (cov?.state === 'partial' && cov.uncachedNamespaces?.length) return `not cached by Radar in ${cov.uncachedNamespaces.join(', ')}`
+  return COVERAGE_LABEL[cov?.state ?? ''] ?? cov?.state ?? 'unknown'
+}
+
 export function CoverageNotice({ fleet, data }: { fleet: CNPGFleet; data: CNPGWorkspaceResponse }) {
   if (fleet.incompleteKinds.length === 0) return null
-  const parts = fleet.incompleteKinds.map((k) => {
-    const cov = data.coverage[k]
-    const label = COVERAGE_LABEL[cov?.state ?? ''] ?? cov?.state
-    return `${CNPG_KIND_BY_KEY[k].kind} (${label})`
-  })
+  const parts = fleet.incompleteKinds.map((k) => `${CNPG_KIND_BY_KEY[k].kind} (${coverageLabel(data.coverage[k])})`)
   return (
     <Notice>
       Some CloudNativePG data is not readable: {parts.join(', ')}. Facts built on it read “No access” or “unknown” rather than none, and counts are lower bounds.

From 3508fc51721db25d92d921adfbef4f16baac6c3a Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:11:31 +0300
Subject: [PATCH 19/26] Recompute the declarations list when the detected
 managers change

---
 web/src/components/cnpg/CNPGDeclarations.tsx | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/web/src/components/cnpg/CNPGDeclarations.tsx b/web/src/components/cnpg/CNPGDeclarations.tsx
index fd60c5be7c..c89054e54f 100644
--- a/web/src/components/cnpg/CNPGDeclarations.tsx
+++ b/web/src/components/cnpg/CNPGDeclarations.tsx
@@ -53,8 +53,8 @@ function stateOf(obj: any): State {
   return 'pending'
 }
 
-function gitopsSource(data: CNPGWorkspaceResponse, obj: any): string | undefined {
-  return managedByLabel(cnpgManagedBy(data, obj))
+function gitopsSource(managedBy: CNPGWorkspaceResponse['managedBy'], obj: any): string | undefined {
+  return managedByLabel(cnpgManagedBy({ managedBy }, obj))
 }
 
 const STATE_BADGE: Record<State, { severity: 'success' | 'warning' | 'neutral'; text: string }> = {
@@ -105,7 +105,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
         state: st,
         meta: d.spec?.owner ? `owner ${d.spec.owner}` : undefined,
         error: st === 'failed' ? d.status?.message : undefined,
-        source: gitopsSource(data, d),
+        source: gitopsSource(data.managedBy, d),
         resource: cnpgResource('databases', ns, d.metadata?.name),
         isField: false,
       })
@@ -125,7 +125,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
                 ? p.spec?.target?.allTables ? 'all tables' : 'selected objects'
                 : `from ${p.spec?.publicationName ?? 'an unnamed publication'} on ${p.spec?.externalClusterName ?? 'an unnamed external cluster'}`,
             error: pst === 'failed' ? p.status?.message : undefined,
-            source: gitopsSource(data, p),
+            source: gitopsSource(data.managedBy, p),
             resource: cnpgResource(kind === 'Publication' ? 'publications' : 'subscriptions', ns, p.metadata?.name),
             isField: false,
           })
@@ -146,7 +146,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
           state: pst,
           meta: p.spec?.dbname ? `database ${p.spec.dbname}` : undefined,
           error: pst === 'failed' ? p.status?.message : undefined,
-          source: gitopsSource(data, p),
+          source: gitopsSource(data.managedBy, p),
           resource: cnpgResource(kind === 'Publication' ? 'publications' : 'subscriptions', ns, p.metadata?.name),
           isField: false,
         })
@@ -165,7 +165,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
         state: f.state,
         meta: cnpgDatabaseRoleMeta(f),
         error: f.state === 'failed' ? f.message : undefined,
-        source: gitopsSource(data, r),
+        source: gitopsSource(data.managedBy, r),
         resource: cnpgResource('databaseroles', ns, r.metadata?.name),
         isField: false,
       })
@@ -200,7 +200,7 @@ export function CNPGDeclarations({ data, fleet, namespaces, searchParams, onSetP
         const fb = b.items.some((i) => i.state === 'failed') ? 0 : 1
         return fa - fb || a.namespace.localeCompare(b.namespace) || a.cluster.localeCompare(b.cluster)
       })
-  }, [data.objects.databases, data.objects.publications, data.objects.subscriptions, data.objects.databaseRoles, fleet.rows, clusterFilter, show])
+  }, [data.objects.databases, data.objects.publications, data.objects.subscriptions, data.objects.databaseRoles, data.managedBy, fleet.rows, clusterFilter, show])
 
   const totals = useMemo(() => {
     let failed = 0

From b00308d4607089dd8a0748d19c5bf03dd758d2fb Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:11:31 +0300
Subject: [PATCH 20/26] Document how to build a workspace integration from the
 shared pieces

The integration guide gains a Workspace integrations chapter: when a
workspace is warranted, and the server, UI, navigation, version-skew and
action pieces a new one imports instead of copying, plus the ones that are
not shared yet because a second integration should shape them. CLAUDE.md
points at it, and docs/cnpg.md describes the grant object, the uncached
coverage state, managedBy and the cnpgWorkspace capability flag.
---
 CLAUDE.md                 |   1 +
 docs/INTEGRATION_GUIDE.md | 107 +++++++++++++++++++++++++++++++++++++-
 docs/cnpg.md              |   8 +--
 3 files changed, 111 insertions(+), 5 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 2f7371dac8..932bf21d03 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -25,6 +25,7 @@ Not everything is in this file. The following files contain critical details tha
 | Adding or modifying **HTTP endpoints** | `internal/server/server.go` — all routes are defined here — **plus** the handler's doc comments (why the route is gated the way it is lives there; copy the gate of the closest sibling only after reading it) and the integration's section in [docs/integrations.md](docs/integrations.md) |
 | Adding or modifying **CLI flags** | `cmd/explorer/main.go` — flag definitions and defaults |
 | Adding a **new CRD integration** (renderer, topology, discovery) | [docs/INTEGRATION_GUIDE.md](docs/INTEGRATION_GUIDE.md) — full checklist with collision gotchas |
+| Building a **workspace integration** (several related CRDs with their own screens, like `/cnpg` or `/capacity`) | [docs/INTEGRATION_GUIDE.md](docs/INTEGRATION_GUIDE.md#3-workspace-integrations) — the shared server, UI and action pieces to import, and what is not shared yet; [DESIGN.md](DESIGN.md#unknown-partial-and-denied-values) — how unknown, partial and denied values read |
 | Working on the **CloudNativePG workspace** (`/cnpg`) | [docs/cnpg.md](docs/cnpg.md) — destinations, navigation (drawer trail, return label, `ctx` guard) and the certainty table: which source each fact comes from and what it reads when unknown. Data from `/api/cnpg/workspace` (per-kind coverage); derivations in `packages/k8s-ui/src/components/cnpg/workspace.ts` + `relations.ts`; screens in `web/src/components/cnpg/` |
 | Working on **local per-cluster integration settings** (Metrics, Argo CD, Cost in `~/.radar/clusters.json`) | [docs/configuration.md](docs/configuration.md#local-integration-connections) — store `internal/config/profiles.go`, resolve/update `internal/connections`, activation `internal/connectionruntime`, routes `GET/PUT /api/integrations/connections`. In local mode the older `PUT /api/integrations/{prometheus,argocd,cost}` return 409 |
 | Working on **GitOps** (Argo CD / Flux detail pages, operations, Terminating lifecycle, drift, per-resource health, remote destinations) | [docs/gitops.md](docs/gitops.md) — detail-page tabs, operation semantics, the Terminating severity ramp, nested navigation, single-cluster scope. Engine in `pkg/gitops/`, handlers `internal/server/gitops_handlers.go` |
diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md
index ad993ddb76..a2b6e2dd48 100644
--- a/docs/INTEGRATION_GUIDE.md
+++ b/docs/INTEGRATION_GUIDE.md
@@ -126,7 +126,112 @@ shared renderers.
   - `packages/k8s-ui/src/components/topology/`: `TopologyFilterSidebar.tsx`,
     `K8sResourceNode.tsx`, `layout.ts`, `topology.css`.
 
-## 3. Before submitting
+## 3. Workspace integrations
+
+A workspace is a set of screens for several related kinds (CloudNativePG at
+`/cnpg`, Karpenter at `/capacity`). Build one only when the operator question
+spans objects: fleet health, a chain such as Backup → ObjectStore → Cluster, or
+actions that need facts from more than one object. With fewer kinds, or no
+cross-object question, a renderer plus Issues plus the detail slots is enough.
+The batch kinds, for example, use only the detail seams.
+
+The pieces below are shared and should be imported, not copied. Read
+[DESIGN.md](../DESIGN.md#unknown-partial-and-denied-values) for the rules on
+unknown, partial and denied values first: every piece here exists to keep them.
+
+- [ ] **Placement.** Under Resources as a category workspace
+  (`ResourcesSidebar` `categoryWorkspaces`, keyed by the category name from
+  `api-resources.ts`), or a top-level page when the subject is cluster-wide.
+  Say whether the namespace filter applies, and why.
+- [ ] **Routes and navigation.** Use `/x`, `/x/<screen>` and
+  `/x/<plural>/<ns|_>/<name>?ctx=`.
+  - The in-drawer trail is `?drawer=`, encoded by `web/src/utils/drawer-trail.ts`.
+  - Back labels come from `currentPageLabel` and subject-filtered Issues links
+    from `issuesPathForSubject` (both in `web/src/utils/page-links.ts`).
+  - Pin `ctx` on a detail page. After a context switch, say the object is not in
+    this context; never open a same-named object from another cluster.
+- [ ] **One aggregate endpoint.**
+  - List each kind with `readWorkspaceKind` (dynamic kinds) or
+    `typedKindScope` (typed kinds such as Pods), both in
+    `internal/server/kind_access.go`. Their answer's `coverage()` is a
+    `KindCoverage`: `full|partial|denied|notInstalled|syncing|uncached|error`,
+    with denied and uncached namespaces named only when the caller supplied the
+    namespace list.
+  - Radar's own cache scope comes from `namespacesWithinCache`
+    (`cache_scope.go`).
+  - A per-object read with several sources reports a `ReadSource`
+    `{state, grant, reason}` per source (`read_source.go`), with the missing
+    permission as a `Grant` (`internal/auth/grant.go`), never a sentence.
+  - Fan out over namespaces with `fanOut` (`fanout.go`), behind a cap.
+  - Prometheus series matched to an object by name rather than identity carry a
+    `SeriesIsolation` (`internal/prometheus/series_scope.go`).
+  - A GitOps or Helm manager comes from `topology.ManagedByFromMeta`, never from
+    labels read on the client.
+- [ ] **Version skew.** Give the workspace's endpoints one `FeatureCapabilities`
+  flag and a `radarFeatures.ts` entry with `flagShippedWithEndpoint: true`.
+  - Gate every hook with `useRadarFeature`, including mutations, streams and
+    downloads. Never add `retry` to a mutation.
+  - When the Radar is too old, hide the sidebar destinations and fall back to
+    the standard detail views.
+- [ ] **Findings.** The Issues engine comes first. A finding that depends on
+  the caller's grants (a measurement) stays in the workspace as a
+  `WorkspaceProblem` with `source: 'measurement'`, `measuredBy` and, when
+  matched by name only, `unverifiedMatch`. Add no new severity ladder, and
+  title reasons the Issues page already titles with `issueReasonTitle`.
+- [ ] **Screens.**
+  - k8s-ui `components/workspace`:
+    - facts: `Fact`, `FactGrid`, `FactRow`, `FactValue`, `FactSource`
+    - sections: `SectionHeading`, `FoldSection`, `FoldSummary`
+    - problems: `WorkspaceProblem`, and `ProblemCallout`/`ProblemList`/`ProblemMeta`
+      with the workspace's `rootKind`
+    - also `OpenIssueContext`, `CertaintyGlyph` and `ManagedByText`
+  - Also from k8s-ui: `ui/RefLink`, `toneTextClass`/`worseTone` in
+    `ui/status-tone`, and `formatGrant`.
+  - App: `web/src/components/workspace`:
+    - layout: `ScreenBody`, `ScreenEmptyState`, `Notice`
+    - controls: `Segments`, `FilterChips`
+    - tables: `SectionTable` and its table classes
+    - text: `RefreshFailedNotice` and `GrantText`
+  - Buttons are `.btn-brand` and `.btn-secondary`.
+- [ ] **Detail page.** Through `WorkloadView`:
+  - `renderSummary`: a composed Overview; the resource's renderer moves to
+    "Spec & status".
+  - `extraTabs`
+  - `renderHeaderActions`
+- [ ] **Actions.**
+  - Server (`internal/server/actions.go`):
+    - A capabilities endpoint answers each action as an `ActionCapability`
+      `{allowed, reason, permission, grant}`, built with `grantPermission` and
+      `capabilityVerdict`.
+    - The POST body is an `ActionRequest` `{reviewedContext, uid, facts, params}`
+      read with `decodeActionRequest`.
+    - Bind the facts the user reviewed. Refuse with 409 `changed`
+      (`changedAction`) or `context_changed`, and use `partialAction` when a
+      multi-step write stops part-way.
+    - Writes are impersonated, version-bound (`mergePatchAtVersion`) and never
+      retried.
+  - Client:
+    - `web/src/api/actions.ts`: `actionErrorCode`, widened with the integration's
+      own codes; `actionOutcomeLocked`, `actionCompleted` and `capabilityReason`.
+    - `ActionConfirmDialog` and the GitOps write guard (`useGitOpsWriteGuard`).
+  - An accepted POST is not a completed action: follow the outcome in status.
+- [ ] **Docs and fixtures.** Add a `docs/<x>.md` listing which source each value
+  comes from and how it reads when unknown, a `scripts/<x>-demo.sh` with its
+  README, and a CLAUDE.md row.
+
+These pieces are not shared yet, because they have one consumer and the second
+should shape them:
+- the App/route wiring
+- the operation tracker
+- the fixed-path `pods/proxy` reader
+- the merged log stream
+- the report bundle
+- operator diagnosis
+
+Read CloudNativePG's versions (`web/src/components/cnpg/`,
+`internal/server/cnpg_*.go`), and extract one when you copy it.
+
+## 4. Before submitting
 
 - [ ] Verify status against the controller's documented API: desired versus
   observed, unknown versus false, intentional pause/stop versus failure. Consider
diff --git a/docs/cnpg.md b/docs/cnpg.md
index 4afb7b5acc..85768fd442 100644
--- a/docs/cnpg.md
+++ b/docs/cnpg.md
@@ -45,7 +45,7 @@ Every value is something the cluster reports, labelled with where it came from.
 | ObjectStore upload health | **Inferred** from its user clusters' WAL archiving and recovery windows (ObjectStore has no status of its own) | "Unknown" |
 | Declarations | `status.applied` (true / false / absent = pending); managed roles from `status.managedRolesStatus` (`reconciled`, `cannotReconcile`; anything else pending). A DatabaseRole whose name also appears in the Cluster's `spec.managed.roles` is overridden — the Cluster spec wins and the operator reports it not applied; its summary says so, or "unknown" when the Cluster is not visible | Pending, never failed |
 | Logical replication path | Per Subscription object: the subscriber's `spec.externalClusters[externalClusterName].connectionParameters.host`, resolved to a visible Cluster only through its `-rw`/`-ro`/`-r` Service or a Pooler Service (any other host stays external, never guessed); the publication by `publicationName` + `publicationDBName` (else the external cluster's `dbname`), linked to a Publication object when one declares it ("unknown: no access to Publications in <ns>" when that namespace's Publications are not readable, never "none declares it"). Slot name: `parameters.slot_name`, else the subscription's name, as PostgreSQL names it; observed on the publisher primary's `/pg/status` `replicationSlotsInfo` (type, active, WAL status) with retained WAL from the exporter. Survives failover: declared only — the publisher's `replicationSlots.highAvailability.synchronizeLogicalDecoding` together with `highAvailability.enabled` (default true; the operator enables synchronization only with both), then on PostgreSQL 17 the subscription's `failover` parameter (only failover slots are synchronized); before 17 it depends on `pg_failover_slots`, which Radar cannot see | Slot: "not read" / "no access (needs get pods/proxy on the publisher)", and "not found" only from a readable report. Failover: "unknown" for an external publisher, a missing PostgreSQL major, or PostgreSQL < 17. Apply errors and lag beyond the Subscription's `status.message`: not reported (the default exporter has no `pg_stat_subscription` query) |
-| GitOps source | Argo CD / Flux labels and the Argo tracking annotation | "GitOps source not recorded" |
+| GitOps source | The manager Radar's server detects from Argo CD / Flux labels and the Argo tracking annotation (`managedBy` in the workspace answer) | "GitOps source not recorded" |
 | Pooler pressure | Each pooler Pod's PgBouncer exporter (`:9127/metrics`): per pool clients active/waiting, servers active/idle/used, max wait, the pool mode PgBouncer reports, and how many Pods reported | "Not measured" when no Pod could be read; partial (a lower bound) when only some reported |
 | Pooler readiness | The Pooler's Deployment (controlled by the Pooler's UID): ready of desired replicas. The Pooler's own `status.instances` counts scheduled Pods only | "Unknown" when the Deployment cannot be read |
 | Pooler paused | Requested: `spec.pgbouncer.paused`. Observed: each PgBouncer's `SHOW STATE` over the caller's `pods/exec` | Observed reads "Not observable: needs create pods/exec"; the exporter does not publish it |
@@ -65,7 +65,7 @@ Problems come from Radar's Issues engine (the same detections as `/issues`) plus
 
 ## Access
 
-All data comes from `GET /api/cnpg/workspace`, authorized **per kind**: namespaced kinds use a cluster-wide `list` or fall back per namespace; `ClusterImageCatalog` needs a cluster-scope `list`. Each kind reports coverage (`full`, `partial` with the namespaces read, `denied`, `syncing`, `error`, `notInstalled`). Issues and audit findings are withheld where the underlying kind is not covered — Pod evidence only reaches callers who can list Pods. Denied namespaces are named only when the caller supplied the namespace list. A partial or denied kind makes the screen show a coverage notice, and its facts read "No access" rather than none.
+All data comes from `GET /api/cnpg/workspace`, authorized **per kind**: namespaced kinds use a cluster-wide `list` or fall back per namespace; `ClusterImageCatalog` needs a cluster-scope `list`. Each kind reports coverage (`full`, `partial` with the namespaces read, `denied`, `uncached`, `syncing`, `error`, `notInstalled`). A namespace the caller may read but Radar's cache does not hold reads "Radar does not cache …", never "no access". Issues and audit findings are withheld where the underlying kind is not covered — Pod evidence only reaches callers who can list Pods. Denied namespaces are named only when the caller supplied the namespace list. A partial or denied kind makes the screen show a coverage notice, and its facts read "No access" rather than none.
 
 `GET /api/cnpg/operator` reads operator and plugin Deployments (label `app.kubernetes.io/name=cloudnative-pg`, plugin Services labelled `cnpg.io/pluginName`) and the operator's config references. It ignores the namespace view filter (the operator lives in its own namespace), returns ConfigMap data only with `get configmaps`, and never reads Secrets.
 
@@ -206,9 +206,9 @@ The guard is shared: the CNPG actions, Set image and the investigation apply dia
 
 ## API
 
-Every route is gated on the caller's own access, and a partial answer names what it withheld rather than shrinking silently.
+Every route is gated on the caller's own access, and a partial answer names what it withheld rather than shrinking silently. A missing grant is sent as an object, `{verb, group?, resource, subresource?, namespace?}` (no namespace means cluster-wide), and the UI words it with `formatGrant`. All of these routes except the two image-catalog lookups are advertised by the `cnpgWorkspace` capability flag; the UI gates every call on it, so a Radar that predates the workspace shows the standard views and an upgrade note instead of failed requests.
 
-- Workspace: `/api/cnpg/workspace` returns every CNPG kind (plus owner-validated instance Pods) with per-kind `coverage` (`full|partial|denied|notInstalled|syncing|error`, `partial` naming only in-scope denied namespaces), CNPG issues from the Issues engine and `cnpgNoDeclarativeBackup` audit findings, each withheld where the caller lacks coverage, plus `scheduleReadings` (each readable ScheduledBackup's schedule worded as the operator parses it, keyed `ns/name`). Namespaced kinds follow the view filter and the capacity per-namespace `list` fallback; `ClusterImageCatalog` needs a cluster-scope `list`. Handler `internal/server/cnpg_workspace.go`
+- Workspace: `/api/cnpg/workspace` returns every CNPG kind (plus owner-validated instance Pods) with per-kind `coverage` (`full|partial|denied|notInstalled|syncing|uncached|error`; `partial` names in-scope namespaces left unread as `deniedNamespaces` (no access) or `uncachedNamespaces` (Radar's cache does not hold them), and only when the caller supplied the namespace list; `uncached` is a scope Radar's cache does not cover at all), CNPG issues from the Issues engine and `cnpgNoDeclarativeBackup` audit findings, each withheld where the caller lacks coverage, plus `scheduleReadings` (each readable ScheduledBackup's schedule worded as the operator parses it, keyed `ns/name`) and `managedBy` (each object's Argo CD, Flux or Helm manager, keyed `Kind/ns/name`). Namespaced kinds follow the view filter and the capacity per-namespace `list` fallback; `ClusterImageCatalog` needs a cluster-scope `list`. Handler `internal/server/cnpg_workspace.go`
 - Operator status: `/api/cnpg/operator/status?namespaces=` returns, per namespace, whether the watching operator is leading and whether a fail-closed webhook has no ready endpoint (`reconciling|notReconciling|unknown|notWatched`); capabilities embed the same verdict and refuse webhook-bound writes while it rejects them. Handler `internal/server/cnpg_operator_status.go`
 - Operator: `/api/cnpg/operator` returns the operator Deployments (`app.kubernetes.io/name=cloudnative-pg`) and plugin Deployments (served by Services labelled `cnpg.io/pluginName`) with image-tag version and readiness (`null` when unreported), plus the operator's ConfigMap/Secret/monitoring-queries references from its args and env. ConfigMap data only with `get configmaps`; the Secret is name-only, never read. Deployments and Services carry the workspace `coverage` states; deliberately ignores the namespace view filter (the operator lives in its own namespace). Handler `internal/server/cnpg_operator.go`. Additive `diagnosis[]` per operator Deployment (`cnpg_operator_diagnosis.go`), every read as the caller with its own coverage: leader Lease `db9c8771.cnpg.io` (holder Pod, renew, transitions, `stale` via `cnpgHALeaseFrom`; `disabled` without `--leader-elect`), watched namespaces from the container's `WATCH_NAMESPACE` env only (the ConfigMap value is read after the cache is built), the `cnpg-{mutating,validating}-webhook-configuration` objects (failurePolicy, caBundle set) + their Service's EndpointSlice readiness, `controller_runtime_reconcile_{errors_,}total` per controller from the operator's `metrics` port through `pods/proxy` (25s memo; counters since the container's last start), and recent events for its Deployment/ReplicaSets/Pods
 - Catalog reverse-lookup: `/api/cnpg/imagecatalogs/{ns}/{name}/clusters` and `/api/cnpg/clusterimagecatalogs/{name}/clusters` return the Clusters pinned to an image catalog, with the major each asks for and the image it actually resolved. Cluster-scoped catalogs are referenceable from any namespace, so the cluster-scoped route reads cluster-wide gated on `list clusters` — a view-filtered answer would report "nothing uses this" before an edit.

From 3230bf3fa89f8d240d0018d563adfbf7c43638b9 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:16:59 +0300
Subject: [PATCH 21/26] List the workspace and CloudNativePG directories in the
 structure map

---
 docs/STRUCTURE.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/STRUCTURE.md b/docs/STRUCTURE.md
index d13583f487..2b45558461 100644
--- a/docs/STRUCTURE.md
+++ b/docs/STRUCTURE.md
@@ -97,6 +97,8 @@ radar/
 │       │   ├── shared/        # ResourceRendererDispatch, ResourceActionsBar, EditableYamlView
 │       │   ├── gitops/        # Argo/Flux badges + actions + tree graph + insights views
 │       │   ├── workload/      # WorkloadView
+│       │   ├── workspace/     # Workspace building blocks: facts, sections, problems, certainty glyph, GitOps manager
+│       │   ├── cnpg/          # CloudNativePG workspace model + composed summaries
 │       │   ├── timeline/      # Timeline shared components
 │       │   ├── logs/          # Log viewer core
 │       │   └── ui/            # Shared primitives, package-owned Monaco/YAML runtime, Problems + review
@@ -115,6 +117,8 @@ radar/
 │   │   │   ├── portforward/   # Port forward manager
 │   │   │   ├── resource/      # Single resource detail page
 │   │   │   ├── resources/     # Resource list panels (thin wrappers over @skyhook-io/k8s-ui)
+│   │   │   ├── workspace/     # Workspace screen layout, tables and notices (Capacity, CloudNativePG)
+│   │   │   ├── cnpg/          # CloudNativePG workspace screens, actions, runtime
 │   │   │   ├── audit/         # Cluster audit detail view
 │   │   │   ├── cost/          # Cost tracking and visualization
 │   │   │   ├── settings/      # Settings dialog

From 6a99aaa8c98788a54caa836dbfe3429e43f5e6bf Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:21:45 +0300
Subject: [PATCH 22/26] Keep the standard views until a Radar confirms the
 CloudNativePG workspace

A /workload link and a drawer's Expand now open the workspace page only once
the Radar is known to serve it, since the redirect replaces the URL; while
capabilities load, or on an older Radar, they stay on the standard view,
and a Cluster's Logs tab keeps the Pod logs instead of the merged instance
stream. useRadarFeature returns a stable guard, so a callback built on it,
like the Cluster log fetch, no longer reloads a running stream on every
render. A namespace the server names as denied or uncached now decides the
wording even when the kind's overall state is uncached, and an empty list
names both causes when both apply.
---
 .../k8s-ui/src/components/cnpg/workspace.test.ts  |  2 ++
 packages/k8s-ui/src/components/cnpg/workspace.ts  |  6 ++++--
 web/src/App.tsx                                   |  6 ++++--
 web/src/api/client.ts                             | 15 ++++++++-------
 web/src/components/cnpg/shared.tsx                | 11 +++++++----
 web/src/components/workload/WorkloadView.tsx      |  9 +++++++--
 6 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/packages/k8s-ui/src/components/cnpg/workspace.test.ts b/packages/k8s-ui/src/components/cnpg/workspace.test.ts
index aceab333db..c4391088aa 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.test.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.test.ts
@@ -308,6 +308,8 @@ describe('buildCNPGFleet', () => {
     expect(uncached.rows[0].replication.text).toBe('Radar does not cache Pods in db')
     const none = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { pods: { state: 'uncached' } } }))
     expect(none.rows[0].replication.text).toBe('Radar does not cache Pods')
+    const mixed = buildCNPGFleet(resp({ clusters: [cluster('pg-a', 'db')] }, { coverage: { pods: { state: 'uncached', uncachedNamespaces: ['other'], deniedNamespaces: ['db'] } } }))
+    expect(mixed.rows[0].replication.text).toBe('No access to Pods')
   })
 
   it('says no access instead of "no replica pods" when Pods are unreadable', () => {
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index c70d9d628a..ddde0cda70 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -428,12 +428,14 @@ export function coverageReadable(cov: CNPGKindCoverage, namespace?: string): boo
  * a partial read that names neither cause says only that it was not read.
  */
 export function cnpgCoverageGap(cov: CNPGKindCoverage, what: string, namespace?: string, notInstalled = 'Not installed'): string {
+  // A namespace the server names wins over the kind's overall state: an
+  // uncached scope can still name namespaces the caller was denied.
+  if (namespace && cov.deniedNamespaces?.includes(namespace)) return `No access to ${what}`
+  if (namespace && cov.uncachedNamespaces?.includes(namespace)) return `Radar does not cache ${what} in ${namespace}`
   switch (cov.state) {
     case 'denied':
       return `No access to ${what}`
     case 'partial':
-      if (namespace && cov.uncachedNamespaces?.includes(namespace)) return `Radar does not cache ${what} in ${namespace}`
-      if (namespace && cov.deniedNamespaces?.includes(namespace)) return `No access to ${what}`
       return namespace ? `${what} not read in ${namespace}` : `${what} not read`
     case 'uncached':
       return `Radar does not cache ${what}`
diff --git a/web/src/App.tsx b/web/src/App.tsx
index 0ba540f3e8..13c21fe95b 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -59,7 +59,7 @@ import { UsageDataPrompt } from './components/usage-data/UsageDataPrompt'
 import { ShortcutHelpOverlay } from './components/ui/ShortcutHelpOverlay'
 import { DiagnosticsOverlay } from './components/ui/DiagnosticsOverlay'
 import { useEventSource } from './hooks/useEventSource'
-import { debugNamespaceLog, useNamespaces, useNamespaceScope, useSetActiveNamespace, useSwitchContext, useAuthMe, useAudit } from './api/client'
+import { debugNamespaceLog, useNamespaces, useNamespaceScope, useSetActiveNamespace, useSwitchContext, useAuthMe, useAudit, useRadarFeature } from './api/client'
 import { buildAuditSeverityMap } from './utils/auditBadges'
 import { isInNamespaceScope, scopeNodesToNamespaces } from './utils/topology-namespace'
 import { routePath, apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from './api/config'
@@ -357,6 +357,8 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   const navigationType = useNavigationType()
   const [searchParams, setSearchParams] = useSearchParams()
   const capabilities = useCapabilitiesContext()
+  // Expanding a CloudNativePG object opens its workspace page only on a Radar that serves it.
+  const cnpgWorkspaceSupported = useRadarFeature('cnpgWorkspace').support === 'supported'
   const openLocalTerminal = useOpenLocalTerminal()
   const navCustomization = useNavCustomization()
   // The AI panel is an absolute slot in the body frame (the column under the header):
@@ -2423,7 +2425,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           onNavigate={(res) => navigateToResource(res)}
           canCollapseToDrawer={!isMobile}
           onExpand={(res, opts) => {
-            const cnpgPlural = cnpgDetailKindFor(res.kind, res.group)
+            const cnpgPlural = cnpgWorkspaceSupported ? cnpgDetailKindFor(res.kind, res.group) : null
             if (cnpgPlural) {
               navigate(
                 cnpgDetailPath({ plural: cnpgPlural, namespace: res.namespace, name: res.name }, connection.context || undefined, opts?.yaml ? 'yaml' : undefined),
diff --git a/web/src/api/client.ts b/web/src/api/client.ts
index 1747d4ad74..cf5bb884f7 100644
--- a/web/src/api/client.ts
+++ b/web/src/api/client.ts
@@ -1,6 +1,6 @@
 import { canonicalResourceGroup } from '@skyhook-io/k8s-ui/utils/api-resources'
 import { knownKindForPluralWithGroup, pluralToKind } from '@skyhook-io/k8s-ui/utils/navigation'
-import { useEffect, useRef } from 'react'
+import { useEffect, useRef, useCallback, useMemo } from 'react'
 import type { KueueAdmissionResponse } from '@skyhook-io/k8s-ui/types/scheduling'
 import type { GitOpsWriteEvidence } from '@skyhook-io/k8s-ui/utils/gitops-write-guard'
 import type {
@@ -1808,13 +1808,14 @@ export function useRadarFeature(feature: RadarFeature) {
   const currentVersion = versionInfo?.currentVersion || radarVersion
   const latestVersion = versionInfo?.latestVersion
   const support = radarFeatureSupport(feature, capabilities, currentVersion)
+  // Stable across renders, so a callback built on guard keeps its identity.
+  const guard = useCallback(
+    <T,>(request: () => Promise<T>): Promise<T> => guardRadarFeature(feature, support, { currentVersion, latestVersion }, request),
+    [feature, support, currentVersion, latestVersion],
+  )
+  const gatedKey = useMemo(() => (support === 'unsupported' ? ['radar-feature-unsupported'] : []), [support])
 
-  return {
-    support,
-    gatedKey: support === 'unsupported' ? ['radar-feature-unsupported'] : [],
-    guard: <T,>(request: () => Promise<T>): Promise<T> =>
-      guardRadarFeature(feature, support, { currentVersion, latestVersion }, request),
-  }
+  return { support, gatedKey, guard }
 }
 
 // ============================================================================
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index 3e8073ea76..6b85a7f985 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -126,10 +126,13 @@ export function coverageEmpty(cov: CNPGKindCoverage | undefined, noun: string):
   switch (cov?.state) {
     case 'full':
       return `No ${noun} in this scope.`
-    case 'partial':
-      if (cov.uncachedNamespaces?.length) return `No ${noun} visible. Radar does not cache ${noun} in ${cov.uncachedNamespaces.join(', ')}.`
-      if (cov.deniedNamespaces?.length) return `No ${noun} visible. Some namespaces are not readable with your access.`
-      return `No ${noun} visible. Some namespaces were not read.`
+    case 'partial': {
+      const causes = [
+        cov.deniedNamespaces?.length ? 'some namespaces are not readable with your access' : '',
+        cov.uncachedNamespaces?.length ? `Radar does not cache ${noun} in ${cov.uncachedNamespaces.join(', ')}` : '',
+      ].filter(Boolean)
+      return causes.length ? `No ${noun} visible: ${causes.join(', and ')}.` : `No ${noun} visible. Some namespaces were not read.`
+    }
     case 'uncached':
       return `Radar does not cache ${noun} in this scope.`
     case 'denied':
diff --git a/web/src/components/workload/WorkloadView.tsx b/web/src/components/workload/WorkloadView.tsx
index b2f125160f..0cd77e910e 100644
--- a/web/src/components/workload/WorkloadView.tsx
+++ b/web/src/components/workload/WorkloadView.tsx
@@ -228,7 +228,8 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
   const location = useLocation()
   const navigate = useNavigate()
   const [searchParams] = useSearchParams()
-  const cnpgWorkspace = useRadarFeature('cnpgWorkspace').support !== 'unsupported'
+  // The redirect replaces the URL, so it waits for a confirmed workspace.
+  const cnpgWorkspace = useRadarFeature('cnpgWorkspace').support === 'supported'
 
   // Parse /workload/:kind/:ns/:name from pathname. Segments are URL-encoded by
   // buildWorkloadPath; names can also contain literal slashes (e.g. some CRD names),
@@ -1201,6 +1202,7 @@ export function WorkloadView({
           <LogsTabContent
             {...props}
             group={effectiveGroup}
+            cnpgWorkspace={cnpgWorkspace}
             selectedRunKey={selectedRunKey}
             onSelectRun={handleSelectedRunChange}
           />
@@ -1483,6 +1485,7 @@ function LogsTabContent({
   onConsumeInitialContainer,
   selectedRunKey,
   onSelectRun,
+  cnpgWorkspace,
 }: {
   kind: string
   apiKind: string
@@ -1497,6 +1500,8 @@ function LogsTabContent({
   onConsumeInitialContainer: () => void
   selectedRunKey: string
   onSelectRun: (runKey: string) => void
+  /** The Radar serves the CloudNativePG workspace's merged instance logs. */
+  cnpgWorkspace: boolean
 }) {
   if (SCHEDULED_LOG_KINDS.has(kind) && supportsBatchExecution(kind, apiKind, group, resource?.apiVersion)) {
     return (
@@ -1512,7 +1517,7 @@ function LogsTabContent({
     )
   }
 
-  if (kind === 'Cluster' && isApiGroup(resource?.apiVersion, 'postgresql.cnpg.io')) {
+  if (cnpgWorkspace && kind === 'Cluster' && isApiGroup(resource?.apiVersion, 'postgresql.cnpg.io')) {
     return <CNPGClusterLogs namespace={namespace} name={name} />
   }
 

From 2c6299abe23b31fac6a9f0ad1c7a8ca458662267 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:54:51 +0300
Subject: [PATCH 23/26] Name both causes of an unread namespace in empty lists
 and notices

An uncached read can still name namespaces the caller was denied. Empty
collection text and the coverage notice now list every cause the server
named ("no access in c; Radar does not cache Pods in b") and fall back to
the state only when it names none.
---
 web/src/components/cnpg/coverageText.test.ts | 15 +++++++++++
 web/src/components/cnpg/shared.tsx           | 27 +++++++++++++-------
 2 files changed, 33 insertions(+), 9 deletions(-)
 create mode 100644 web/src/components/cnpg/coverageText.test.ts

diff --git a/web/src/components/cnpg/coverageText.test.ts b/web/src/components/cnpg/coverageText.test.ts
new file mode 100644
index 0000000000..b639a07f8c
--- /dev/null
+++ b/web/src/components/cnpg/coverageText.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest'
+import { coverageEmpty, coverageLabel } from './shared'
+
+describe('coverage wording', () => {
+  it('names every cause the server named, whatever the overall state', () => {
+    const mixed = { state: 'uncached' as const, uncachedNamespaces: ['b'], deniedNamespaces: ['c'] }
+    expect(coverageEmpty(mixed, 'Pods')).toBe('No Pods visible: no access in c; Radar does not cache Pods in b.')
+    expect(coverageLabel(mixed)).toBe('no access in c; not cached by Radar in b')
+  })
+  it('falls back to the state when no namespace is named', () => {
+    expect(coverageEmpty({ state: 'uncached' }, 'Pods')).toBe('Radar does not cache Pods in this scope.')
+    expect(coverageEmpty({ state: 'partial' }, 'Pods')).toBe('No Pods visible. Some namespaces were not read.')
+    expect(coverageLabel({ state: 'denied' })).toBe('no access')
+  })
+})
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index 6b85a7f985..638a98c406 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -53,9 +53,20 @@ export function CNPGWorkspaceHeader({ title, subtitle, actions }: { title: strin
   )
 }
 
+// The causes the server named for the namespaces it left unread. A partial or
+// uncached read can name both kinds of namespace at once.
+function namedCauses(cov: CNPGKindCoverage | undefined, uncachedNoun: string): { denied?: string; uncached?: string } {
+  return {
+    denied: cov?.deniedNamespaces?.length ? cov.deniedNamespaces.join(', ') : undefined,
+    uncached: cov?.uncachedNamespaces?.length ? `${uncachedNoun} in ${cov.uncachedNamespaces.join(', ')}` : undefined,
+  }
+}
+
 /** How much of a kind was read, in a few words ("not cached by Radar in pg"). */
 export function coverageLabel(cov: CNPGKindCoverage | undefined): string {
-  if (cov?.state === 'partial' && cov.uncachedNamespaces?.length) return `not cached by Radar in ${cov.uncachedNamespaces.join(', ')}`
+  const { denied, uncached } = namedCauses(cov, 'not cached by Radar')
+  const named = [denied && `no access in ${denied}`, uncached].filter(Boolean)
+  if (named.length > 0) return named.join('; ')
   return COVERAGE_LABEL[cov?.state ?? ''] ?? cov?.state ?? 'unknown'
 }
 
@@ -126,15 +137,13 @@ export function coverageEmpty(cov: CNPGKindCoverage | undefined, noun: string):
   switch (cov?.state) {
     case 'full':
       return `No ${noun} in this scope.`
-    case 'partial': {
-      const causes = [
-        cov.deniedNamespaces?.length ? 'some namespaces are not readable with your access' : '',
-        cov.uncachedNamespaces?.length ? `Radar does not cache ${noun} in ${cov.uncachedNamespaces.join(', ')}` : '',
-      ].filter(Boolean)
-      return causes.length ? `No ${noun} visible: ${causes.join(', and ')}.` : `No ${noun} visible. Some namespaces were not read.`
+    case 'partial':
+    case 'uncached': {
+      const { denied, uncached } = namedCauses(cov, `Radar does not cache ${noun}`)
+      const causes = [denied && `no access in ${denied}`, uncached].filter(Boolean)
+      if (causes.length > 0) return `No ${noun} visible: ${causes.join('; ')}.`
+      return cov.state === 'uncached' ? `Radar does not cache ${noun} in this scope.` : `No ${noun} visible. Some namespaces were not read.`
     }
-    case 'uncached':
-      return `Radar does not cache ${noun} in this scope.`
     case 'denied':
       return `No access to ${noun}.`
     case 'syncing':

From 8b034f09d9f021cdb5993bc902754ef0d96a16b3 Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 02:58:13 +0300
Subject: [PATCH 24/26] Drop a comment that restates worseTone's name

---
 packages/k8s-ui/src/components/ui/status-tone.tsx | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/k8s-ui/src/components/ui/status-tone.tsx b/packages/k8s-ui/src/components/ui/status-tone.tsx
index 5c3274d892..73e5a8c39f 100644
--- a/packages/k8s-ui/src/components/ui/status-tone.tsx
+++ b/packages/k8s-ui/src/components/ui/status-tone.tsx
@@ -73,7 +73,6 @@ export function toneTextClass(tone: StatusTone): string {
 // part that could not be read.
 const TONE_RANK: Record<StatusTone, number> = { healthy: 0, neutral: 0, unknown: 1, degraded: 2, alert: 3, unhealthy: 4 }
 
-/** The more severe of two tones. */
 export function worseTone(a: StatusTone, b: StatusTone): StatusTone {
   return TONE_RANK[b] > TONE_RANK[a] ? b : a
 }

From b2ac729c9692cd49cde383c4a3b019f7b054cb2f Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 10:32:56 +0300
Subject: [PATCH 25/26] Name the shared view pieces for what they are, not for
 workspaces

Facts, the certainty glyph and the GitOps manager text are how any surface
shows observed values, single-kind renderers included, so they move from
components/workspace to components/facts. The problem list with its sources
moves to components/problems, and the section heading and folded section,
plain layout, to ui/FoldSection. No behaviour change.
---
 DESIGN.md                                         |  2 +-
 docs/INTEGRATION_GUIDE.md                         | 15 ++++++++-------
 docs/STRUCTURE.md                                 |  3 ++-
 .../src/components/cnpg/CNPGBackupSummary.tsx     |  3 ++-
 .../src/components/cnpg/CNPGClusterHASection.tsx  |  3 ++-
 .../components/cnpg/CNPGClusterSummary.test.tsx   |  2 +-
 .../src/components/cnpg/CNPGClusterSummary.tsx    |  4 +++-
 .../src/components/cnpg/CNPGConnectSection.tsx    |  3 ++-
 .../components/cnpg/CNPGDeclarativeSummary.tsx    |  5 +++--
 .../components/cnpg/CNPGImageCatalogSummary.tsx   |  3 ++-
 .../src/components/cnpg/CNPGLogicalPath.tsx       |  4 ++--
 .../components/cnpg/CNPGObjectStoreSummary.tsx    |  3 ++-
 .../src/components/cnpg/CNPGPoolerSummary.tsx     |  3 ++-
 .../src/components/cnpg/CNPGSharedSummary.tsx     |  3 ++-
 packages/k8s-ui/src/components/cnpg/ha.ts         |  3 ++-
 .../src/components/cnpg/logicalReplication.ts     |  2 +-
 packages/k8s-ui/src/components/cnpg/relations.ts  |  2 +-
 packages/k8s-ui/src/components/cnpg/workspace.ts  |  3 ++-
 .../components/{workspace => facts}/certainty.tsx |  0
 .../{workspace => facts}/facts.test.tsx           |  0
 .../src/components/{workspace => facts}/facts.tsx |  0
 packages/k8s-ui/src/components/facts/index.ts     |  6 ++++++
 .../{workspace => facts}/managed-by.test.tsx      |  0
 .../{workspace => facts}/managed-by.tsx           |  0
 packages/k8s-ui/src/components/problems/index.ts  |  1 +
 .../{workspace => problems}/problems.test.tsx     |  0
 .../{workspace => problems}/problems.tsx          |  0
 .../src/components/resources/ResourcesSidebar.tsx |  2 +-
 .../sections.tsx => ui/FoldSection.tsx}           |  4 ++--
 packages/k8s-ui/src/components/ui/index.ts        |  2 ++
 packages/k8s-ui/src/components/workspace/index.ts |  7 -------
 packages/k8s-ui/src/index.ts                      |  5 +++--
 packages/k8s-ui/src/types/capacity.ts             |  2 +-
 33 files changed, 56 insertions(+), 39 deletions(-)
 rename packages/k8s-ui/src/components/{workspace => facts}/certainty.tsx (100%)
 rename packages/k8s-ui/src/components/{workspace => facts}/facts.test.tsx (100%)
 rename packages/k8s-ui/src/components/{workspace => facts}/facts.tsx (100%)
 create mode 100644 packages/k8s-ui/src/components/facts/index.ts
 rename packages/k8s-ui/src/components/{workspace => facts}/managed-by.test.tsx (100%)
 rename packages/k8s-ui/src/components/{workspace => facts}/managed-by.tsx (100%)
 create mode 100644 packages/k8s-ui/src/components/problems/index.ts
 rename packages/k8s-ui/src/components/{workspace => problems}/problems.test.tsx (100%)
 rename packages/k8s-ui/src/components/{workspace => problems}/problems.tsx (100%)
 rename packages/k8s-ui/src/components/{workspace/sections.tsx => ui/FoldSection.tsx} (94%)
 delete mode 100644 packages/k8s-ui/src/components/workspace/index.ts

diff --git a/DESIGN.md b/DESIGN.md
index 43629eeba2..8489e617e1 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -182,7 +182,7 @@ Radar shows only what the cluster reports, and says where it came from. These ru
 - **Recorded ≠ observed.** A value copied from a status field, an annotation or a declaration says so; a value matched to its subject by name rather than by identity says that too.
 - **Facts keep their rows.** `FactRow` renders the unread text in place; never hide a row because its value is missing (unlike `Property`, which hides empty values).
 
-The shared pieces live in `packages/k8s-ui/src/components/workspace/` (facts, sections, problems, certainty) and `web/src/components/workspace/` (screen layout and tables); each integration's own doc lists which source each value comes from and how it reads when unknown.
+The shared pieces live in `packages/k8s-ui/src/components/facts/` (facts, certainty, GitOps manager), `components/problems/` (problems with their sources), `components/ui/FoldSection.tsx` (section headings and folded sections) and `web/src/components/workspace/` (workspace screen layout and tables); each integration's own doc lists which source each value comes from and how it reads when unknown.
 
 ## 5. Layout Principles
 
diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md
index a2b6e2dd48..a185fba833 100644
--- a/docs/INTEGRATION_GUIDE.md
+++ b/docs/INTEGRATION_GUIDE.md
@@ -179,13 +179,14 @@ unknown, partial and denied values first: every piece here exists to keep them.
   matched by name only, `unverifiedMatch`. Add no new severity ladder, and
   title reasons the Issues page already titles with `issueReasonTitle`.
 - [ ] **Screens.**
-  - k8s-ui `components/workspace`:
-    - facts: `Fact`, `FactGrid`, `FactRow`, `FactValue`, `FactSource`
-    - sections: `SectionHeading`, `FoldSection`, `FoldSummary`
-    - problems: `WorkspaceProblem`, and `ProblemCallout`/`ProblemList`/`ProblemMeta`
-      with the workspace's `rootKind`
-    - also `OpenIssueContext`, `CertaintyGlyph` and `ManagedByText`
-  - Also from k8s-ui: `ui/RefLink`, `toneTextClass`/`worseTone` in
+  - k8s-ui `components/facts`: `Fact`, `FactGrid`, `FactRow`, `FactValue`,
+    `FactSource`, `CertaintyGlyph` and `ManagedByText`. These are for any
+    surface that shows observed values, single-kind renderers included.
+  - k8s-ui `components/problems`: `WorkspaceProblem`, and
+    `ProblemCallout`/`ProblemList`/`ProblemMeta` with the workspace's
+    `rootKind`, plus `OpenIssueContext`.
+  - Also from k8s-ui: `SectionHeading`, `FoldSection` and `FoldSummary`
+    (`ui/FoldSection`), `ui/RefLink`, `toneTextClass`/`worseTone` in
     `ui/status-tone`, and `formatGrant`.
   - App: `web/src/components/workspace`:
     - layout: `ScreenBody`, `ScreenEmptyState`, `Notice`
diff --git a/docs/STRUCTURE.md b/docs/STRUCTURE.md
index 2b45558461..f3fc0279ba 100644
--- a/docs/STRUCTURE.md
+++ b/docs/STRUCTURE.md
@@ -97,7 +97,8 @@ radar/
 │       │   ├── shared/        # ResourceRendererDispatch, ResourceActionsBar, EditableYamlView
 │       │   ├── gitops/        # Argo/Flux badges + actions + tree graph + insights views
 │       │   ├── workload/      # WorkloadView
-│       │   ├── workspace/     # Workspace building blocks: facts, sections, problems, certainty glyph, GitOps manager
+│       │   ├── facts/         # Observed values with their sources: facts, certainty glyph, GitOps manager
+│       │   ├── problems/      # Problems with where their evidence came from (callout, list, origin)
 │       │   ├── cnpg/          # CloudNativePG workspace model + composed summaries
 │       │   ├── timeline/      # Timeline shared components
 │       │   ├── logs/          # Log viewer core
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
index b54e282b8a..29ebe7b756 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGBackupSummary.tsx
@@ -22,7 +22,8 @@ import {
 } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, SectionHeading } from '../workspace'
+import { FactGrid, FactRow } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 interface SummaryProps {
   resource: any
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
index 985abc8c1b..bc25580fd0 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterHASection.tsx
@@ -23,7 +23,8 @@ import {
 } from './ha'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { StatusDot, toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactValue, FoldSection, SectionHeading } from '../workspace'
+import { FactGrid, FactRow, FactValue } from '../facts'
+import { FoldSection, SectionHeading } from '../ui/FoldSection'
 
 function Unknown({ text }: { text: string }) {
   return <span className="text-theme-text-tertiary">{text}</span>
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
index e13a583071..c977fcebda 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.test.tsx
@@ -5,7 +5,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import { CNPGClusterSummary } from './CNPGClusterSummary'
 import type { CNPGFleetRow, CNPGProblem } from './workspace'
 import type { CNPGDimension } from './ha'
-import { OpenIssueContext } from '../workspace'
+import { OpenIssueContext } from '../problems'
 
 ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
 
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
index d9837a8ce8..9a7bd88341 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGClusterSummary.tsx
@@ -10,7 +10,9 @@ import type { CNPGDimension } from './ha'
 import { PrimaryConflictNote } from './primitives'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { StatusDot, toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactSource, FactValue, ProblemCallout, ProblemList, SectionHeading, ManagedByText, managedByLabel } from '../workspace'
+import { FactGrid, FactRow, FactSource, FactValue, ManagedByText, managedByLabel } from '../facts'
+import { ProblemCallout, ProblemList } from '../problems'
+import { SectionHeading } from '../ui/FoldSection'
 
 function ReadyCount({ row }: { row: CNPGFleetRow }) {
   const r = cnpgReadyInstances(row)
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx b/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
index 04174a58fa..20057f9e3b 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGConnectSection.tsx
@@ -4,7 +4,8 @@ import { Tooltip } from '../ui/Tooltip'
 import { CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import { cnpgConnectionURI, cnpgConnectInfo, cnpgPsqlCommand, type CNPGConnectEndpoint } from './connect'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
-import { FactGrid, FactRow, SectionHeading } from '../workspace'
+import { FactGrid, FactRow } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 function CopyButton({ text, label }: { text: string; label: string }) {
   const [copied, setCopied] = useState(false)
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
index c56f60202a..2f402c0646 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGDeclarativeSummary.tsx
@@ -1,7 +1,7 @@
 import type { ReactNode } from 'react'
 import { getCNPGDeclarativeMessage, getCNPGReclaimPolicy } from '../resources/resource-utils-cnpg'
 import { cnpgManagedBy, type CNPGWorkspaceResponse } from './workspace'
-import type { Fact } from '../workspace'
+import { type Fact } from '../facts'
 import { cnpgLogicalPaths, type CNPGLogicalPath } from './logicalReplication'
 import { CNPGLogicalPathView } from './CNPGLogicalPath'
 import { cnpgDatabaseRoleFacts } from './databaseRole'
@@ -20,7 +20,8 @@ import {
 } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactValue, SectionHeading, ManagedByText, managedByLabel } from '../workspace'
+import { FactGrid, FactRow, FactValue, ManagedByText, managedByLabel } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 interface SummaryProps {
   resource: any
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
index ccff25fde4..a17740c498 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGImageCatalogSummary.tsx
@@ -4,7 +4,8 @@ import { NotReported, Note, ObjectProblems, SummaryShell } from './CNPGSharedSum
 import { clustersIn, clustersUsingCatalog, refOf, relationUnavailable } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, SectionHeading } from '../workspace'
+import { FactGrid, FactRow } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 export function CNPGImageCatalogSummary({
   resource,
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx b/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
index b09e5ef2fd..0364ad606a 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGLogicalPath.tsx
@@ -1,11 +1,11 @@
 import type { ReactNode } from 'react'
 import { ArrowRight } from 'lucide-react'
 import { CNPG_GROUP } from '../resources/resource-utils-cnpg'
-import type { Fact } from '../workspace'
+import { type Fact } from '../facts'
 import { cnpgLogicalLocation, type CNPGLogicalPath } from './logicalReplication'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactSource, FactValue } from '../workspace'
+import { FactGrid, FactRow, FactSource, FactValue } from '../facts'
 
 // A hop after the first carries its arrow, so a wrapped line never ends on an
 // arrow pointing at nothing.
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
index 1a5f18309f..801ea1936d 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGObjectStoreSummary.tsx
@@ -12,7 +12,8 @@ import { NotReported, Note, ObjectProblems, SummaryShell, TimeAgo } from './CNPG
 import { clustersIn, inferredObjectStoreHealth, refOf, relationUnavailable, usersOfObjectStore } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
+import { FactGrid, FactRow, FactValue } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 function utc(at: string | undefined): string {
   if (!at || !Number.isFinite(Date.parse(at))) return 'unknown'
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
index 7a2f6e5d72..60338eb781 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGPoolerSummary.tsx
@@ -15,7 +15,8 @@ import {
 } from './pooler'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
 import { toneTextClass } from '../ui/status-tone'
-import { FactGrid, FactRow, FactValue, SectionHeading } from '../workspace'
+import { FactGrid, FactRow, FactValue } from '../facts'
+import { SectionHeading } from '../ui/FoldSection'
 
 const TYPE_LABEL: Record<string, string> = {
   rw: 'rw · routes to the primary',
diff --git a/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx b/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
index 625f02c2e9..6bfba39fb4 100644
--- a/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
+++ b/packages/k8s-ui/src/components/cnpg/CNPGSharedSummary.tsx
@@ -6,7 +6,8 @@ import type { CNPGWorkspaceIssue, CNPGWorkspaceResponse } from './workspace'
 import { healthToSeverity } from '../../utils/badge-colors'
 import { clustersIn, problemsForObject, relationUnavailable, targetCluster, type CNPGObjectRef } from './relations'
 import { type NavigateToRef, RefLink } from '../ui/RefLink'
-import { FactValue, ProblemCallout } from '../workspace'
+import { FactValue } from '../facts'
+import { ProblemCallout } from '../problems'
 
 const MAX_PROBLEMS = 3
 
diff --git a/packages/k8s-ui/src/components/cnpg/ha.ts b/packages/k8s-ui/src/components/cnpg/ha.ts
index 5271bf96a7..8e196fd827 100644
--- a/packages/k8s-ui/src/components/cnpg/ha.ts
+++ b/packages/k8s-ui/src/components/cnpg/ha.ts
@@ -6,7 +6,8 @@
 import type { HealthLevel } from '../resources/resource-utils'
 import { formatGrant, type Grant } from '../../utils/grant'
 import { cnpgFormatLag, cnpgLagTone, cnpgReplicationTone, cnpgSustainedLagProblemId, type CNPGFleetRow } from './workspace'
-import type { Fact, FoldSummary } from '../workspace'
+import { type Fact } from '../facts'
+import { type FoldSummary } from '../ui/FoldSection'
 import { worseTone } from '../ui/status-tone'
 
 export type CNPGHASourceState = 'ok' | 'denied' | 'notFound' | 'notInstalled' | 'unavailable' | 'error'
diff --git a/packages/k8s-ui/src/components/cnpg/logicalReplication.ts b/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
index f5755b8fc3..3e03e5ff8c 100644
--- a/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
+++ b/packages/k8s-ui/src/components/cnpg/logicalReplication.ts
@@ -1,4 +1,4 @@
-import type { Fact } from '../workspace'
+import { type Fact } from '../facts'
 
 /** Where a Subscription's publisher lives, as far as the subscriber's spec shows. */
 export type CNPGPublisher =
diff --git a/packages/k8s-ui/src/components/cnpg/relations.ts b/packages/k8s-ui/src/components/cnpg/relations.ts
index 1119129414..08c8009336 100644
--- a/packages/k8s-ui/src/components/cnpg/relations.ts
+++ b/packages/k8s-ui/src/components/cnpg/relations.ts
@@ -11,7 +11,7 @@ import {
   type CNPGObjectStoreRecoveryWindow,
 } from '../resources/resource-utils-cnpg'
 import { cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText, cnpgCoverageGap, coverageReadable, type CNPGProblem, type CNPGWorkspaceIssue, type CNPGWorkspaceKey, type CNPGWorkspaceResponse } from './workspace'
-import type { Fact } from '../workspace'
+import { type Fact } from '../facts'
 
 export interface CNPGObjectRef {
   kind: string
diff --git a/packages/k8s-ui/src/components/cnpg/workspace.ts b/packages/k8s-ui/src/components/cnpg/workspace.ts
index ddde0cda70..cfac2d6c82 100644
--- a/packages/k8s-ui/src/components/cnpg/workspace.ts
+++ b/packages/k8s-ui/src/components/cnpg/workspace.ts
@@ -4,7 +4,8 @@
 
 import { formatAge, type HealthLevel } from '../resources/resource-utils'
 import { worseTone } from '../ui/status-tone'
-import type { Fact, ProblemOrigin, WorkspaceProblem } from '../workspace'
+import { type Fact } from '../facts'
+import { type ProblemOrigin, type WorkspaceProblem } from '../problems'
 import type { ResourceRef } from '../../types/core'
 import { formatBytes } from '../../utils/format'
 import { formatGrant, type Grant } from '../../utils/grant'
diff --git a/packages/k8s-ui/src/components/workspace/certainty.tsx b/packages/k8s-ui/src/components/facts/certainty.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/certainty.tsx
rename to packages/k8s-ui/src/components/facts/certainty.tsx
diff --git a/packages/k8s-ui/src/components/workspace/facts.test.tsx b/packages/k8s-ui/src/components/facts/facts.test.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/facts.test.tsx
rename to packages/k8s-ui/src/components/facts/facts.test.tsx
diff --git a/packages/k8s-ui/src/components/workspace/facts.tsx b/packages/k8s-ui/src/components/facts/facts.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/facts.tsx
rename to packages/k8s-ui/src/components/facts/facts.tsx
diff --git a/packages/k8s-ui/src/components/facts/index.ts b/packages/k8s-ui/src/components/facts/index.ts
new file mode 100644
index 0000000000..ce2f304a7c
--- /dev/null
+++ b/packages/k8s-ui/src/components/facts/index.ts
@@ -0,0 +1,6 @@
+// How a surface shows what the cluster reported: each value with its source,
+// partial and unread values marked as such (see DESIGN.md, "Unknown, partial
+// and denied values"). For any renderer, summary or workspace screen.
+export * from './facts'
+export * from './certainty'
+export * from './managed-by'
diff --git a/packages/k8s-ui/src/components/workspace/managed-by.test.tsx b/packages/k8s-ui/src/components/facts/managed-by.test.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/managed-by.test.tsx
rename to packages/k8s-ui/src/components/facts/managed-by.test.tsx
diff --git a/packages/k8s-ui/src/components/workspace/managed-by.tsx b/packages/k8s-ui/src/components/facts/managed-by.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/managed-by.tsx
rename to packages/k8s-ui/src/components/facts/managed-by.tsx
diff --git a/packages/k8s-ui/src/components/problems/index.ts b/packages/k8s-ui/src/components/problems/index.ts
new file mode 100644
index 0000000000..94e9292d32
--- /dev/null
+++ b/packages/k8s-ui/src/components/problems/index.ts
@@ -0,0 +1 @@
+export * from './problems'
diff --git a/packages/k8s-ui/src/components/workspace/problems.test.tsx b/packages/k8s-ui/src/components/problems/problems.test.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/problems.test.tsx
rename to packages/k8s-ui/src/components/problems/problems.test.tsx
diff --git a/packages/k8s-ui/src/components/workspace/problems.tsx b/packages/k8s-ui/src/components/problems/problems.tsx
similarity index 100%
rename from packages/k8s-ui/src/components/workspace/problems.tsx
rename to packages/k8s-ui/src/components/problems/problems.tsx
diff --git a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
index 076f610ec2..52377c8df5 100644
--- a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
+++ b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
@@ -13,7 +13,7 @@ import type { APIResource } from '../../types'
 import { categorizeResources, CORE_RESOURCES } from '../../utils/api-resources'
 import { getResourceIcon } from '../../utils/resource-icons'
 import { Tooltip } from '../ui/Tooltip'
-import { certaintyGlyph } from '../workspace/certainty'
+import { certaintyGlyph } from '../facts'
 import { Input } from '../ui/Input'
 
 // Selected resource type info (need both name for API and kind for display)
diff --git a/packages/k8s-ui/src/components/workspace/sections.tsx b/packages/k8s-ui/src/components/ui/FoldSection.tsx
similarity index 94%
rename from packages/k8s-ui/src/components/workspace/sections.tsx
rename to packages/k8s-ui/src/components/ui/FoldSection.tsx
index eb2539ee3c..c6c8748481 100644
--- a/packages/k8s-ui/src/components/workspace/sections.tsx
+++ b/packages/k8s-ui/src/components/ui/FoldSection.tsx
@@ -1,7 +1,7 @@
 import { useEffect, useState, type ReactNode } from 'react'
 import { clsx } from 'clsx'
-import { toneTextClass } from '../ui/status-tone'
-import { Collapse, CollapseChevron, useDisclosure } from '../ui/Collapse'
+import { toneTextClass } from './status-tone'
+import { Collapse, CollapseChevron, useDisclosure } from './Collapse'
 
 /** A folded section's one-line summary, and whether it opens on its own. */
 export interface FoldSummary {
diff --git a/packages/k8s-ui/src/components/ui/index.ts b/packages/k8s-ui/src/components/ui/index.ts
index 2a57acd04a..95e5a37d88 100644
--- a/packages/k8s-ui/src/components/ui/index.ts
+++ b/packages/k8s-ui/src/components/ui/index.ts
@@ -21,6 +21,8 @@ export { FilterPill } from './FilterPill'
 export type { FilterPillTone } from './FilterPill'
 export { StatusDot, mapHealthToTone, toneFillClass, toneTextClass, worseTone } from './status-tone'
 export { RefLink } from './RefLink'
+export { FoldSection, SectionHeading } from './FoldSection'
+export type { FoldSummary } from './FoldSection'
 export type { NavigateToRef } from './RefLink'
 export type { StatusTone, StatusDotProps } from './status-tone'
 export { DialogPortal } from './DialogPortal'
diff --git a/packages/k8s-ui/src/components/workspace/index.ts b/packages/k8s-ui/src/components/workspace/index.ts
deleted file mode 100644
index fb2fcd7ecb..0000000000
--- a/packages/k8s-ui/src/components/workspace/index.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-// Building blocks for workspace integrations: several related CRDs with a
-// composed UI (see docs/INTEGRATION_GUIDE.md, "Workspace integrations").
-export * from './facts'
-export * from './sections'
-export * from './problems'
-export * from './certainty'
-export * from './managed-by'
diff --git a/packages/k8s-ui/src/index.ts b/packages/k8s-ui/src/index.ts
index 156b4453af..9fb0f5b477 100644
--- a/packages/k8s-ui/src/index.ts
+++ b/packages/k8s-ui/src/index.ts
@@ -55,8 +55,9 @@ export * from './components/checks'
 // queue)
 export * from './components/issues'
 
-// Workspace building blocks: facts, sections and problems shared by multi-CRD integrations
-export * from './components/workspace'
+// Observed values with their sources, and problems with where they came from
+export * from './components/facts'
+export * from './components/problems'
 
 // CloudNativePG workspace model (fleet derivation over /api/cnpg/workspace) and summaries
 export * from './components/cnpg'
diff --git a/packages/k8s-ui/src/types/capacity.ts b/packages/k8s-ui/src/types/capacity.ts
index a9104bce3d..9231bdbef3 100644
--- a/packages/k8s-ui/src/types/capacity.ts
+++ b/packages/k8s-ui/src/types/capacity.ts
@@ -1,5 +1,5 @@
 import type { Issue } from "../components/issues/types";
-import type { Certainty } from "../components/workspace/certainty";
+import type { Certainty } from "../components/facts/certainty";
 
 export const CAPACITY_SCHEMA_VERSION = "v1alpha1" as const;
 

From 5af6ed15e550966cf0a481cf96bc4ffe1d44f6af Mon Sep 17 00:00:00 2001
From: Nadav Erell <nadaverell@gmail.com>
Date: Sun, 4 Oct 2026 11:27:57 +0300
Subject: [PATCH 26/26] Call CloudNativePG's screens views, not a workspace

Radar Hub uses "workspace" for the customer's account, and the embedded
app showed the same word as a heading inside the Resources sidebar. The
block above a category's kinds now reads "Views", the upgrade note says
"CloudNativePG views" and "CloudNativePG needs a newer Radar on this
cluster", the error states name the CloudNativePG data, and the README,
GitOps, Helm Compare and CloudNativePG docs describe these areas by their
subject. "Workspace" stays an internal term for an integration with
several kinds and its own screens.
---
 README.md                                            |  4 ++--
 docs/cnpg.md                                         | 12 ++++++------
 docs/gitops.md                                       |  2 +-
 docs/helm.md                                         |  2 +-
 .../components/resources/ResourcesSidebar.test.tsx   |  2 +-
 .../src/components/resources/ResourcesSidebar.tsx    |  2 +-
 web/src/api/radarFeatures.ts                         |  2 +-
 web/src/components/cnpg/CNPGSummaryHost.tsx          |  2 +-
 .../components/cnpg/actions/CNPGConnectButton.tsx    |  2 +-
 web/src/components/cnpg/shared.tsx                   |  6 +++---
 10 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/README.md b/README.md
index e196a4cf18..09e6d0bb35 100644
--- a/README.md
+++ b/README.md
@@ -362,7 +362,7 @@ View TLS certificate details and expiry dates across all namespaces — catch ex
 
 ### GitOps
 
-Monitor, diagnose, and manage FluxCD and ArgoCD resources from a dedicated GitOps workspace.
+Monitor, diagnose, and manage FluxCD and ArgoCD resources in one place.
 
 <p align="center">
   <img src="docs/screenshots/gitops-view.png" alt="GitOps fleet view" width="800">
@@ -548,7 +548,7 @@ Upgrade impact also gets list-only access to CSIStorageCapacities, FlowSchemas,
 | **Strimzi** | [KafkaConnector failure evidence](docs/integrations.md#strimzi-kafka-connectors) (connector/task status) |
 | **Velero** | Backup, Restore, Schedule, BackupStorageLocation, VolumeSnapshotLocation |
 | **External Secrets** | ExternalSecret, ClusterExternalSecret, SecretStore, ClusterSecretStore |
-| **CloudNativePG** | Cluster, Backup, ScheduledBackup, Pooler, Database, Publication, Subscription, ImageCatalog, ClusterImageCatalog, ObjectStore — plus a [workspace](docs/cnpg.md) for fleet, protection and declaration triage |
+| **CloudNativePG** | Cluster, Backup, ScheduledBackup, Pooler, Database, Publication, Subscription, ImageCatalog, ClusterImageCatalog, ObjectStore — plus [dedicated views](docs/cnpg.md) for fleet, protection and declaration triage |
 | **Crossplane** | Managed Resources (any provider), Composite Resources, Claims, Provider, ProviderConfig, Function, Configuration, Composition, CompositionRevision, XRD |
 | **Kyverno** | Policy, ClusterPolicy, PolicyReport, ClusterPolicyReport |
 | **Sealed Secrets** | SealedSecret |
diff --git a/docs/cnpg.md b/docs/cnpg.md
index 85768fd442..8a14e1f37b 100644
--- a/docs/cnpg.md
+++ b/docs/cnpg.md
@@ -1,4 +1,4 @@
-# CloudNativePG workspace
+# CloudNativePG
 
 A task-shaped view over [CloudNativePG](https://cloudnative-pg.io/) (CNPG): which PostgreSQL cluster needs attention, why, what the instances are doing right now, and what to do about it — without assembling the story from ten separate CRD lists, `kubectl cnpg` and a Grafana dashboard. The per-kind renderers, issue detection and audit check it builds on are described in [integrations.md](integrations.md#cloudnativepg).
 
@@ -6,7 +6,7 @@ Reading never writes. Writes happen only through the [Actions](#actions) (backup
 
 ## Where it lives
 
-CNPG stays inside **Resources**; there is no new global navigation item. When the `postgresql.cnpg.io` CRDs are discovered, the Resources sidebar's CloudNativePG group gains a **Workspace** block above its exact kinds:
+CNPG stays inside **Resources**; there is no new global navigation item. When the `postgresql.cnpg.io` CRDs are discovered, the Resources sidebar's CloudNativePG group gains a **Views** block above its exact kinds:
 
 | Destination | Route | Job | Detail home for |
 |---|---|---|---|
@@ -16,9 +16,9 @@ CNPG stays inside **Resources**; there is no new global navigation item. When th
 | Pooling | `/cnpg/pooling` | Poolers and the clusters they front. | Pooler |
 | Operator | `/cnpg/operator` | Operator and plugin workloads, leader, watched namespaces, webhooks and reconcile errors, image catalogs, operator configuration. | ImageCatalog, ClusterImageCatalog |
 
-Destination badges count **affected clusters**, not findings, and follow the namespace filter (the sidebar says so). The exact kinds stay under a collapsible **Resource kinds** block, grouped by API group; on workspace screens it starts collapsed.
+Destination badges count **affected clusters**, not findings, and follow the namespace filter (the sidebar says so). The exact kinds stay under a collapsible **Resource kinds** block, grouped by API group; on the CloudNativePG views it starts collapsed.
 
-Every CNPG kind's full detail is `/cnpg/<plural>/<namespace|_>/<name>` — reached from a row's **Open**, from the drawer's expand control, and by redirect from the generic `/workload/...` URL. The page keeps the workspace sidebar (its destination highlighted, the object nested under it) and uses Radar's detail view underneath: **Overview** is a composed summary, **Spec & status** is the kind's existing renderer, then YAML and the rest. A Cluster adds **Protection** (its recovery evidence), **Activity** (in place of Timeline) and merged instance **Logs**.
+Every CNPG kind's full detail is `/cnpg/<plural>/<namespace|_>/<name>` — reached from a row's **Open**, from the drawer's expand control, and by redirect from the generic `/workload/...` URL. The page keeps the sidebar with the CloudNativePG views (its destination highlighted, the object nested under it) and uses Radar's detail view underneath: **Overview** is a composed summary, **Spec & status** is the kind's existing renderer, then YAML and the rest. A Cluster adds **Protection** (its recovery evidence), **Activity** (in place of Timeline) and merged instance **Logs**.
 
 ## Navigation
 
@@ -45,7 +45,7 @@ Every value is something the cluster reports, labelled with where it came from.
 | ObjectStore upload health | **Inferred** from its user clusters' WAL archiving and recovery windows (ObjectStore has no status of its own) | "Unknown" |
 | Declarations | `status.applied` (true / false / absent = pending); managed roles from `status.managedRolesStatus` (`reconciled`, `cannotReconcile`; anything else pending). A DatabaseRole whose name also appears in the Cluster's `spec.managed.roles` is overridden — the Cluster spec wins and the operator reports it not applied; its summary says so, or "unknown" when the Cluster is not visible | Pending, never failed |
 | Logical replication path | Per Subscription object: the subscriber's `spec.externalClusters[externalClusterName].connectionParameters.host`, resolved to a visible Cluster only through its `-rw`/`-ro`/`-r` Service or a Pooler Service (any other host stays external, never guessed); the publication by `publicationName` + `publicationDBName` (else the external cluster's `dbname`), linked to a Publication object when one declares it ("unknown: no access to Publications in <ns>" when that namespace's Publications are not readable, never "none declares it"). Slot name: `parameters.slot_name`, else the subscription's name, as PostgreSQL names it; observed on the publisher primary's `/pg/status` `replicationSlotsInfo` (type, active, WAL status) with retained WAL from the exporter. Survives failover: declared only — the publisher's `replicationSlots.highAvailability.synchronizeLogicalDecoding` together with `highAvailability.enabled` (default true; the operator enables synchronization only with both), then on PostgreSQL 17 the subscription's `failover` parameter (only failover slots are synchronized); before 17 it depends on `pg_failover_slots`, which Radar cannot see | Slot: "not read" / "no access (needs get pods/proxy on the publisher)", and "not found" only from a readable report. Failover: "unknown" for an external publisher, a missing PostgreSQL major, or PostgreSQL < 17. Apply errors and lag beyond the Subscription's `status.message`: not reported (the default exporter has no `pg_stat_subscription` query) |
-| GitOps source | The manager Radar's server detects from Argo CD / Flux labels and the Argo tracking annotation (`managedBy` in the workspace answer) | "GitOps source not recorded" |
+| GitOps source | The manager Radar's server detects from Argo CD / Flux labels and the Argo tracking annotation (`managedBy` in `/api/cnpg/workspace`) | "GitOps source not recorded" |
 | Pooler pressure | Each pooler Pod's PgBouncer exporter (`:9127/metrics`): per pool clients active/waiting, servers active/idle/used, max wait, the pool mode PgBouncer reports, and how many Pods reported | "Not measured" when no Pod could be read; partial (a lower bound) when only some reported |
 | Pooler readiness | The Pooler's Deployment (controlled by the Pooler's UID): ready of desired replicas. The Pooler's own `status.instances` counts scheduled Pods only | "Unknown" when the Deployment cannot be read |
 | Pooler paused | Requested: `spec.pgbouncer.paused`. Observed: each PgBouncer's `SHOW STATE` over the caller's `pods/exec` | Observed reads "Not observable: needs create pods/exec"; the exporter does not publish it |
@@ -190,7 +190,7 @@ The dialog (`ActionConfirmDialog` in k8s-ui) leads with the effect, keeps the li
 
 ### Operation tracker
 
-A successful POST means the write was accepted, not that it happened. The dialog hands off a tracked operation (`trackCNPGOperation` in `web/src/components/cnpg/operations/`) bound to the kube context, the Cluster UID, the target (name + UID) and a baseline; the Cluster header shows it until it finishes. States: `requested → observed → progressing → completed | failed | stalled | superseded | unobservable`. A step Radar cannot see keeps the operation **unobservable**, never completed. Each source (capabilities facts, workspace, HA, runtime) carries when it was last fetched successfully and whether its latest fetch failed; a source not fetched successfully since the operation started, or whose refresh failed, is withheld from the observer, so a cached answer from before the action never certifies it; **stalled** needs telemetry showing no movement for 10 minutes. A newer conflicting operation, or the Cluster being recreated, supersedes it. Completion per kind: switchover — the target is `currentPrimary`, the old primary streams again, the `-rw` endpoints point at the target and the phase is healthy (unreadable endpoints leave that step unverified, so the switchover ends unobservable, never completed); restart — per instance, a recreated Pod, a restarted postgres container or a later `cnpg_pg_postmaster_start_time`; reload — no completion signal, said so; fence — the fence recorded on the Cluster; the operation then ends unobservable, because CloudNativePG reports no shutdown signal (`/pg/status` never carries `isFenced`, and a masked status error also arrives without WAL positions), so "PostgreSQL stopped" is never claimed; lift — Pod readiness and streaming; hibernate / rehydrate — the hibernation condition and ready instances; backup and schedule run — the Backup's phase; maintenance — the spec. Operations persist per browser session (`sessionStorage`, in memory when unavailable). New kinds register an observer with `registerCNPGOperationObserver(kind, fn)`.
+A successful POST means the write was accepted, not that it happened. The dialog hands off a tracked operation (`trackCNPGOperation` in `web/src/components/cnpg/operations/`) bound to the kube context, the Cluster UID, the target (name + UID) and a baseline; the Cluster header shows it until it finishes. States: `requested → observed → progressing → completed | failed | stalled | superseded | unobservable`. A step Radar cannot see keeps the operation **unobservable**, never completed. Each source (capabilities facts, `/api/cnpg/workspace`, HA, runtime) carries when it was last fetched successfully and whether its latest fetch failed; a source not fetched successfully since the operation started, or whose refresh failed, is withheld from the observer, so a cached answer from before the action never certifies it; **stalled** needs telemetry showing no movement for 10 minutes. A newer conflicting operation, or the Cluster being recreated, supersedes it. Completion per kind: switchover — the target is `currentPrimary`, the old primary streams again, the `-rw` endpoints point at the target and the phase is healthy (unreadable endpoints leave that step unverified, so the switchover ends unobservable, never completed); restart — per instance, a recreated Pod, a restarted postgres container or a later `cnpg_pg_postmaster_start_time`; reload — no completion signal, said so; fence — the fence recorded on the Cluster; the operation then ends unobservable, because CloudNativePG reports no shutdown signal (`/pg/status` never carries `isFenced`, and a masked status error also arrives without WAL positions), so "PostgreSQL stopped" is never claimed; lift — Pod readiness and streaming; hibernate / rehydrate — the hibernation condition and ready instances; backup and schedule run — the Backup's phase; maintenance — the spec. Operations persist per browser session (`sessionStorage`, in memory when unavailable). New kinds register an observer with `registerCNPGOperationObserver(kind, fn)`.
 
 ## Inside PostgreSQL
 
diff --git a/docs/gitops.md b/docs/gitops.md
index acfac9ef79..26fde4fdbb 100644
--- a/docs/gitops.md
+++ b/docs/gitops.md
@@ -1,6 +1,6 @@
 # GitOps (Argo CD & Flux)
 
-Radar's GitOps workspace gives Argo CD and Flux first-class treatment. Instead of treating Applications and Kustomizations as generic CRDs, you get a typed fleet view, a per-app detail page that diagnoses *why* something is misbehaving, and the controls you'd otherwise reach for `argocd` / `flux` CLI to run.
+Radar's GitOps view gives Argo CD and Flux first-class treatment. Instead of treating Applications and Kustomizations as generic CRDs, you get a typed fleet view, a per-app detail page that diagnoses *why* something is misbehaving, and the controls you'd otherwise reach for `argocd` / `flux` CLI to run.
 
 The hard part of GitOps tooling isn't sync — it's diagnosis. Radar surfaces drift, recent events, controller-failure attribution, and lifecycle state inline so you don't have to context-switch between `kubectl get`, `argocd app diff`, controller logs, and a YAML viewer to understand a stuck reconcile.
 
diff --git a/docs/helm.md b/docs/helm.md
index d11774adab..0a5feb446b 100644
--- a/docs/helm.md
+++ b/docs/helm.md
@@ -25,7 +25,7 @@ The drawer includes:
 - Resources: live status for resources rendered by the current release.
 - Hooks: hook events, path, weight, status, run times, delete policies, output-log policies, and diagnostics for failed/running hooks.
 
-Compare opens a full-page workspace instead of rendering inside the drawer. The drawer links to Compare from history rows and operation banners when Radar can identify a useful revision pair.
+Compare opens as a full page instead of rendering inside the drawer. The drawer links to Compare from history rows and operation banners when Radar can identify a useful revision pair.
 
 ## Operation Insight
 
diff --git a/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx b/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
index 2330002b4b..0410ccc6a2 100644
--- a/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
+++ b/packages/k8s-ui/src/components/resources/ResourcesSidebar.test.tsx
@@ -144,7 +144,7 @@ describe('ResourcesSidebar category workspaces', () => {
         }}
       />
     )
-    expect(html).toContain('Workspace')
+    expect(html).toContain('Views')
     expect(html).toContain('Overview')
     expect(html).toContain('pg-orders')
     expect(html).toContain('Counts for namespace payments')
diff --git a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
index 52377c8df5..527bdd38ee 100644
--- a/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
+++ b/packages/k8s-ui/src/components/resources/ResourcesSidebar.tsx
@@ -792,7 +792,7 @@ function WorkspaceDestinations({
 }) {
   return (
     <div className="space-y-0.5">
-      <div className="pl-5 pr-2 pt-0.5 pb-0.5 text-[10.5px] font-semibold uppercase tracking-wide text-theme-text-tertiary">Workspace</div>
+      <div className="pl-5 pr-2 pt-0.5 pb-0.5 text-[10.5px] font-semibold uppercase tracking-wide text-theme-text-tertiary">Views</div>
       {workspace.destinations.map((d) => {
         const Icon = d.icon
         return (
diff --git a/web/src/api/radarFeatures.ts b/web/src/api/radarFeatures.ts
index 072daddc47..3dbbc0ec71 100644
--- a/web/src/api/radarFeatures.ts
+++ b/web/src/api/radarFeatures.ts
@@ -35,7 +35,7 @@ export const RADAR_FEATURES = {
   drainPlan: { label: 'Drain plans', minimumVersion: 'v1.14.0' },
   applications: { label: 'Applications', minimumVersion: 'v1.7.7' },
   workloadHistory: { label: 'Workload history', flag: 'workloadHistory', flagShippedWithEndpoint: true },
-  cnpgWorkspace: { label: 'The CloudNativePG workspace', flag: 'cnpgWorkspace', flagShippedWithEndpoint: true },
+  cnpgWorkspace: { label: 'CloudNativePG views', flag: 'cnpgWorkspace', flagShippedWithEndpoint: true },
   gitopsWriteEvidence: { label: 'GitOps revert warnings', flag: 'gitopsWriteEvidence', flagShippedWithEndpoint: true },
 } as const satisfies Record<string, RadarFeatureSpec>
 
diff --git a/web/src/components/cnpg/CNPGSummaryHost.tsx b/web/src/components/cnpg/CNPGSummaryHost.tsx
index 762f2cd0af..c525f95b7c 100644
--- a/web/src/components/cnpg/CNPGSummaryHost.tsx
+++ b/web/src/components/cnpg/CNPGSummaryHost.tsx
@@ -97,7 +97,7 @@ function ClusterSummaryHost({ namespace, name, context, onNavigate }: SummaryCon
       <div className="px-4 py-4 text-sm text-theme-text-secondary">
         {query.error instanceof Error
           ? `The CloudNativePG summary could not be loaded: ${query.error.message}`
-          : 'This Cluster is not in the CloudNativePG workspace for your identity.'}{' '}
+          : 'Radar cannot read this Cluster with your access.'}{' '}
         Spec & status still shows everything the object reports.
       </div>
     )
diff --git a/web/src/components/cnpg/actions/CNPGConnectButton.tsx b/web/src/components/cnpg/actions/CNPGConnectButton.tsx
index 4eb7c0346a..f241ca4e8c 100644
--- a/web/src/components/cnpg/actions/CNPGConnectButton.tsx
+++ b/web/src/components/cnpg/actions/CNPGConnectButton.tsx
@@ -105,7 +105,7 @@ export function CNPGConnectButton({
           {row?.cluster ? (
             <CNPGConnectSection cluster={row.cluster} poolers={row.poolerObjects} poolersKnown={row.poolersKnown} onNavigate={go} showHeading={false} />
           ) : (
-            <div className="text-sm text-theme-text-tertiary">{fleet ? 'This Cluster is not in the CloudNativePG workspace for your identity.' : 'Reading the Cluster…'}</div>
+            <div className="text-sm text-theme-text-tertiary">{fleet ? 'Radar cannot read this Cluster with your access.' : 'Reading the Cluster…'}</div>
           )}
         </div>
       </DialogPortal>
diff --git a/web/src/components/cnpg/shared.tsx b/web/src/components/cnpg/shared.tsx
index 638a98c406..88191256ff 100644
--- a/web/src/components/cnpg/shared.tsx
+++ b/web/src/components/cnpg/shared.tsx
@@ -102,7 +102,7 @@ export function CNPGScreenGate({
       return (
         <ScreenEmptyState
           icon={Database}
-          title={radarUpgradeHeadline('The CloudNativePG workspace')}
+          title={radarUpgradeHeadline('CloudNativePG')}
           detail={radarUpgradeDetail(upgrade)}
           action={
             <div className="mt-3 text-sm">
@@ -115,8 +115,8 @@ export function CNPGScreenGate({
     return (
       <ScreenEmptyState
         icon={Database}
-        title="CloudNativePG workspace unavailable"
-        detail={query.error instanceof Error ? query.error.message : 'The workspace could not be loaded.'}
+        title="CloudNativePG data unavailable"
+        detail={query.error instanceof Error ? query.error.message : 'Radar could not load the CloudNativePG data.'}
       />
     )
   }