[dcadolph]

A value no scanner observed used to enter findings, scores, statuses, and capacity figures as if it were zero. An errored quota run with live namespaces reported "no resource quotas defined", a cluster with no metrics read "100% headroom", a degraded run's failed reads raised critical outliers, a fleet where every scanner failed graded A, and a cluster every scanner failed on read "healthy". This closes that class with one mechanism.

One observation accessor. Every finding generator, capacity, and cluster health read scanner fields through observe, observeString, and clusterView, which return observed, partial (degraded run), or unobserved (errored, never ran, or field missing). The run state table is derived from Degraded and the section payloads, so a report decoded from storage behaves the same. Absence rules (no quotas, no policies, every namespace unlabeled, missing PDB or HPA) need a completed run. Presence rules accept a degraded run and end the description with "(partial scan)". The old getters are gone.

Capacity and metrics. Utilization and headroom are *float64 and absent when not observed, with status unknown and a recommendation naming the missing read. The metrics scanner omits its averages when no node resolved a usage percentage and adds nodes_with_usage.

Coverage gate. fleet_score gains graded and coverage. The fleet is graded only when every cluster has an observed run and at least 80 percent of expected runs were observed. Otherwise the grade is empty and the headline reads "Not enough data". Exporters skip the score series when ungraded and always emit fleetsweeper_fleet_score_graded and fleetsweeper_coverage_ratio. Forecast, Slack, seal bundles, the FleetDrift CRD, compare, whatchanged, top, and watch read graded first. The dashboard shows "Not graded" with a coverage line.

Cluster status unknown when a scanner run did not observe a cluster and nothing else made it degraded or critical, across the report, Prometheus, OTel, top, compare, and the dashboard.

Outlier populations take a degraded run's field only as a lower bound (an UpIsBad count above zero). Every other degraded field is skipped like an absent one.

security/psa-unenforced now charges only namespaces with no enforce label. Namespaces that explicitly enforce privileged are listed in the finding but not charged, since they were set on purpose and the remediation does not touch them. unenforced_count stays the true count. The demo derives its Pod Security counts from the scanner rule and fills the new workload security fields.

Trust tests pin the invariant end to end across errored, absent, degraded, and blind variants of four fleets. Fully observed reports score exactly as before (golden test unchanged) and the demo findings are unchanged. The local gate (lint, race, cmd x10, browser, kind integration) is green.