diff --git a/README.md b/README.md
index 15f6236..0f3c152 100644
--- a/README.md
+++ b/README.md
@@ -15,7 +15,7 @@
 
 ## 🚀 Overview
 
-Pulse is a modern, unified dashboard for your **Proxmox** and **Docker** estate. It consolidates metrics, logs, and alerts from Proxmox VE, Proxmox Backup Server, Proxmox Mail Gateway, and standalone Docker hosts into a single, beautiful interface.
+Pulse is a modern, unified dashboard for monitoring your **infrastructure** across Proxmox, Docker, and Kubernetes. It consolidates metrics, alerts, and AI-powered insights from all your systems into a single, beautiful interface.
 
 Designed for homelabs, sysadmins, and MSPs who need a "single pane of glass" without the complexity of enterprise monitoring stacks.
 
@@ -23,13 +23,30 @@ Designed for homelabs, sysadmins, and MSPs who need a "single pane of glass" wit
 
 ## ✨ Features
 
-- **Unified Monitoring**: View health and metrics for PVE, PBS, PMG, and Docker containers in one place.
-- **Smart Alerts**: Get notified via Discord, Slack, Telegram, Email, and more when things go wrong (e.g., "VM down", "Storage full").
-- **Auto-Discovery**: Automatically finds Proxmox nodes on your network.
-- **Secure by Design**: Credentials encrypted at rest, no external dependencies, and strict API scoping.
-- **Backup Explorer**: Visualize backup jobs and storage usage across your entire infrastructure.
-- **Privacy Focused**: No telemetry, no phone-home, all data stays on your server.
-- **Lightweight**: Built with Go and React, running as a single binary or container.
+### Core Monitoring
+- **Unified Monitoring**: View health and metrics for PVE, PBS, PMG, Docker, and Kubernetes in one place
+- **Smart Alerts**: Get notified via Discord, Slack, Telegram, Email, and more
+- **Auto-Discovery**: Automatically finds Proxmox nodes on your network
+- **Metrics History**: Persistent storage with configurable retention
+- **Backup Explorer**: Visualize backup jobs and storage usage
+
+### Pulse AI *(New in 5.0)*
+- **Chat Assistant**: Ask questions about your infrastructure in natural language
+- **Patrol Mode**: Automated health checks with proactive issue detection
+- **Auto-Fix**: Automatically resolve common issues with AI-guided remediation
+- **Predictive Intelligence**: Forecast problems before they happen
+
+### Multi-Platform
+- **Proxmox VE/PBS/PMG**: Full monitoring and management
+- **Kubernetes**: Complete K8s cluster monitoring via agents
+- **Docker/Podman**: Container and Swarm service monitoring
+- **OCI Containers**: Proxmox 9.1+ native container support
+
+### Security & Operations
+- **Secure by Design**: Credentials encrypted at rest, strict API scoping
+- **One-Click Updates**: Easy upgrades for supported deployments
+- **OIDC/SSO**: Enterprise authentication support
+- **Privacy Focused**: No telemetry, all data stays on your server
 
 ## ⚡ Quick Start
 
@@ -65,7 +82,7 @@ Access the dashboard at `http://<your-ip>:7655`.
 
 Community-maintained integrations and addons:
 
-- **[Home Assistant Addon](https://github.com/Kosztyk/pulse-docker-agent-addon)** - Run the Pulse Docker Agent as a Home Assistant addon.
+- **[Home Assistant Addons](https://github.com/Kosztyk/homeassistant-addons)** - Run Pulse Agent and Pulse Server as Home Assistant addons.
 
 ## ❤️ Support Pulse Development
 
diff --git a/cmd/pulse-agent/main.go b/cmd/pulse-agent/main.go
index e6e221f..6b30525 100644
--- a/cmd/pulse-agent/main.go
+++ b/cmd/pulse-agent/main.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"syscall"
@@ -18,6 +19,7 @@ import (
 	"github.com/rcourtman/pulse-go-rewrite/internal/agentupdate"
 	"github.com/rcourtman/pulse-go-rewrite/internal/dockeragent"
 	"github.com/rcourtman/pulse-go-rewrite/internal/hostagent"
+	"github.com/rcourtman/pulse-go-rewrite/internal/kubernetesagent"
 	"github.com/rcourtman/pulse-go-rewrite/internal/utils"
 	"github.com/rs/zerolog"
 	"golang.org/x/sync/errgroup"
@@ -30,7 +32,7 @@ var (
 	agentInfo = promauto.NewGaugeVec(prometheus.GaugeOpts{
 		Name: "pulse_agent_info",
 		Help: "Information about the Pulse agent",
-	}, []string{"version", "host_enabled", "docker_enabled"})
+	}, []string{"version", "host_enabled", "docker_enabled", "kubernetes_enabled"})
 
 	agentUp = promauto.NewGauge(prometheus.GaugeOpts{
 		Name: "pulse_agent_up",
@@ -78,6 +80,8 @@ func main() {
 		Str("pulse_url", cfg.PulseURL).
 		Bool("host_agent", cfg.EnableHost).
 		Bool("docker_agent", cfg.EnableDocker).
+		Bool("kubernetes_agent", cfg.EnableKubernetes).
+		Bool("proxmox_mode", cfg.EnableProxmox).
 		Bool("auto_update", !cfg.DisableAutoUpdate).
 		Msg("Starting Pulse Unified Agent")
 
@@ -86,6 +90,7 @@ func main() {
 		Version,
 		fmt.Sprintf("%t", cfg.EnableHost),
 		fmt.Sprintf("%t", cfg.EnableDocker),
+		fmt.Sprintf("%t", cfg.EnableKubernetes),
 	).Set(1)
 	agentUp.Set(1)
 
@@ -126,6 +131,8 @@ func main() {
 			InsecureSkipVerify: cfg.InsecureSkipVerify,
 			LogLevel:           cfg.LogLevel,
 			Logger:             &logger,
+			EnableProxmox:      cfg.EnableProxmox,
+			ProxmoxType:        cfg.ProxmoxType,
 		}
 
 		agent, err := hostagent.New(hostCfg)
@@ -163,19 +170,71 @@ func main() {
 
 		dockerAgent, err = dockeragent.New(dockerCfg)
 		if err != nil {
-			logger.Fatal().Err(err).Msg("Failed to initialize docker agent")
+			// Docker isn't available yet - start retry loop in background
+			logger.Warn().Err(err).Msg("Docker not available, will retry with exponential backoff")
+
+			g.Go(func() error {
+				agent := initDockerWithRetry(ctx, dockerCfg, &logger)
+				if agent != nil {
+					dockerAgent = agent
+					logger.Info().Msg("Docker agent module started (after retry)")
+					return agent.Run(ctx)
+				}
+				// Docker never became available, continue without it
+				return nil
+			})
+		} else {
+			g.Go(func() error {
+				logger.Info().Msg("Docker agent module started")
+				return dockerAgent.Run(ctx)
+			})
+		}
+	}
+
+	// 10. Start Kubernetes Agent (if enabled)
+	if cfg.EnableKubernetes {
+		kubeCfg := kubernetesagent.Config{
+			PulseURL:           cfg.PulseURL,
+			APIToken:           cfg.APIToken,
+			Interval:           cfg.Interval,
+			AgentID:            cfg.AgentID,
+			AgentType:          "unified",
+			AgentVersion:       Version,
+			InsecureSkipVerify: cfg.InsecureSkipVerify,
+			LogLevel:           cfg.LogLevel,
+			Logger:             &logger,
+			KubeconfigPath:     cfg.KubeconfigPath,
+			KubeContext:        cfg.KubeContext,
+			IncludeNamespaces:  cfg.KubeIncludeNamespaces,
+			ExcludeNamespaces:  cfg.KubeExcludeNamespaces,
+			IncludeAllPods:     cfg.KubeIncludeAllPods,
+			MaxPods:            cfg.KubeMaxPods,
 		}
 
-		g.Go(func() error {
-			logger.Info().Msg("Docker agent module started")
-			return dockerAgent.Run(ctx)
-		})
+		agent, err := kubernetesagent.New(kubeCfg)
+		if err != nil {
+			logger.Warn().Err(err).Msg("Kubernetes not available, will retry with exponential backoff")
+
+			g.Go(func() error {
+				retried := initKubernetesWithRetry(ctx, kubeCfg, &logger)
+				if retried != nil {
+					logger.Info().Msg("Kubernetes agent module started (after retry)")
+					return retried.Run(ctx)
+				}
+				return nil
+			})
+		} else {
+			g.Go(func() error {
+				logger.Info().Msg("Kubernetes agent module started")
+				return agent.Run(ctx)
+			})
+		}
 	}
 
 	// Mark as ready after all agents started
 	ready.Store(true)
 
-	// 10. Wait for all agents to exit
+	// 11. Wait for all agents to exit
 	if err := g.Wait(); err != nil && err != context.Canceled {
 		logger.Error().Err(err).Msg("Agent terminated with error")
 		agentUp.Set(0)
@@ -183,7 +242,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	// 11. Cleanup
+	// 12. Cleanup
 	agentUp.Set(0)
 	cleanupDockerAgent(dockerAgent, &logger)
 
@@ -259,14 +318,25 @@ type Config struct {
 	Logger             *zerolog.Logger
 
 	// Module flags
-	EnableHost   bool
-	EnableDocker bool
+	EnableHost       bool
+	EnableDocker     bool
+	EnableKubernetes bool
+	EnableProxmox    bool
+	ProxmoxType      string // "pve", "pbs", or "" for auto-detect
 
 	// Auto-update
 	DisableAutoUpdate bool
 
 	// Health/metrics server
 	HealthAddr string
+
+	// Kubernetes
+	KubeconfigPath        string
+	KubeContext           string
+	KubeIncludeNamespaces []string
+	KubeExcludeNamespaces []string
+	KubeIncludeAllPods    bool
+	KubeMaxPods           int
 }
 
 func loadConfig() Config {
@@ -281,8 +351,17 @@ func loadConfig() Config {
 	envLogLevel := utils.GetenvTrim("LOG_LEVEL")
 	envEnableHost := utils.GetenvTrim("PULSE_ENABLE_HOST")
 	envEnableDocker := utils.GetenvTrim("PULSE_ENABLE_DOCKER")
+	envEnableKubernetes := utils.GetenvTrim("PULSE_ENABLE_KUBERNETES")
+	envEnableProxmox := utils.GetenvTrim("PULSE_ENABLE_PROXMOX")
+	envProxmoxType := utils.GetenvTrim("PULSE_PROXMOX_TYPE")
 	envDisableAutoUpdate := utils.GetenvTrim("PULSE_DISABLE_AUTO_UPDATE")
 	envHealthAddr := utils.GetenvTrim("PULSE_HEALTH_ADDR")
+	envKubeconfig := utils.GetenvTrim("PULSE_KUBECONFIG")
+	envKubeContext := utils.GetenvTrim("PULSE_KUBE_CONTEXT")
+	envKubeIncludeNamespaces := utils.GetenvTrim("PULSE_KUBE_INCLUDE_NAMESPACES")
+	envKubeExcludeNamespaces := utils.GetenvTrim("PULSE_KUBE_EXCLUDE_NAMESPACES")
+	envKubeIncludeAllPods := utils.GetenvTrim("PULSE_KUBE_INCLUDE_ALL_PODS")
+	envKubeMaxPods := utils.GetenvTrim("PULSE_KUBE_MAX_PODS")
 
 	// Defaults
 	defaultInterval := 30 * time.Second
@@ -302,6 +381,16 @@ func loadConfig() Config {
 		defaultEnableDocker = utils.ParseBool(envEnableDocker)
 	}
 
+	defaultEnableKubernetes := false
+	if envEnableKubernetes != "" {
+		defaultEnableKubernetes = utils.ParseBool(envEnableKubernetes)
+	}
+
+	defaultEnableProxmox := false
+	if envEnableProxmox != "" {
+		defaultEnableProxmox = utils.ParseBool(envEnableProxmox)
+	}
+
 	defaultHealthAddr := envHealthAddr
 	if defaultHealthAddr == "" {
 		defaultHealthAddr = ":9191"
@@ -318,12 +407,23 @@ func loadConfig() Config {
 
 	enableHostFlag := flag.Bool("enable-host", defaultEnableHost, "Enable Host Agent module")
 	enableDockerFlag := flag.Bool("enable-docker", defaultEnableDocker, "Enable Docker Agent module")
+	enableKubernetesFlag := flag.Bool("enable-kubernetes", defaultEnableKubernetes, "Enable Kubernetes Agent module")
+	enableProxmoxFlag := flag.Bool("enable-proxmox", defaultEnableProxmox, "Enable Proxmox mode (creates API token, registers node)")
+	proxmoxTypeFlag := flag.String("proxmox-type", envProxmoxType, "Proxmox type: pve or pbs (auto-detected if not specified)")
 	disableAutoUpdateFlag := flag.Bool("disable-auto-update", utils.ParseBool(envDisableAutoUpdate), "Disable automatic updates")
 	healthAddrFlag := flag.String("health-addr", defaultHealthAddr, "Health/metrics server address (empty to disable)")
+	kubeconfigFlag := flag.String("kubeconfig", envKubeconfig, "Path to kubeconfig (optional; uses in-cluster config if available)")
+	kubeContextFlag := flag.String("kube-context", envKubeContext, "Kubeconfig context (optional)")
+	kubeIncludeAllPodsFlag := flag.Bool("kube-include-all-pods", utils.ParseBool(envKubeIncludeAllPods), "Include all non-succeeded pods (may be large)")
+	kubeMaxPodsFlag := flag.Int("kube-max-pods", defaultInt(envKubeMaxPods, 200), "Max pods included in report")
 	showVersion := flag.Bool("version", false, "Print the agent version and exit")
 
 	var tagFlags multiValue
 	flag.Var(&tagFlags, "tag", "Tag to apply (repeatable)")
+	var kubeIncludeNamespaceFlags multiValue
+	flag.Var(&kubeIncludeNamespaceFlags, "kube-include-namespace", "Namespace to include (repeatable; default is all)")
+	var kubeExcludeNamespaceFlags multiValue
+	flag.Var(&kubeExcludeNamespaceFlags, "kube-exclude-namespace", "Namespace to exclude (repeatable)")
 
 	flag.Parse()
 
@@ -350,20 +450,31 @@ func loadConfig() Config {
 	}
 
 	tags := gatherTags(envTags, tagFlags)
+	kubeIncludeNamespaces := gatherCSV(envKubeIncludeNamespaces, kubeIncludeNamespaceFlags)
+	kubeExcludeNamespaces := gatherCSV(envKubeExcludeNamespaces, kubeExcludeNamespaceFlags)
 
 	return Config{
-		PulseURL:           pulseURL,
-		APIToken:           token,
-		Interval:           *intervalFlag,
-		HostnameOverride:   strings.TrimSpace(*hostnameFlag),
-		AgentID:            strings.TrimSpace(*agentIDFlag),
-		Tags:               tags,
-		InsecureSkipVerify: *insecureFlag,
-		LogLevel:           logLevel,
-		EnableHost:         *enableHostFlag,
-		EnableDocker:       *enableDockerFlag,
-		DisableAutoUpdate:  *disableAutoUpdateFlag,
-		HealthAddr:         strings.TrimSpace(*healthAddrFlag),
+		PulseURL:              pulseURL,
+		APIToken:              token,
+		Interval:              *intervalFlag,
+		HostnameOverride:      strings.TrimSpace(*hostnameFlag),
+		AgentID:               strings.TrimSpace(*agentIDFlag),
+		Tags:                  tags,
+		InsecureSkipVerify:    *insecureFlag,
+		LogLevel:              logLevel,
+		EnableHost:            *enableHostFlag,
+		EnableDocker:          *enableDockerFlag,
+		EnableKubernetes:      *enableKubernetesFlag,
+		EnableProxmox:         *enableProxmoxFlag,
+		ProxmoxType:           strings.TrimSpace(*proxmoxTypeFlag),
+		DisableAutoUpdate:     *disableAutoUpdateFlag,
+		HealthAddr:            strings.TrimSpace(*healthAddrFlag),
+		KubeconfigPath:        strings.TrimSpace(*kubeconfigFlag),
+		KubeContext:           strings.TrimSpace(*kubeContextFlag),
+		KubeIncludeNamespaces: kubeIncludeNamespaces,
+		KubeExcludeNamespaces: kubeExcludeNamespaces,
+		KubeIncludeAllPods:    *kubeIncludeAllPodsFlag,
+		KubeMaxPods:           *kubeMaxPodsFlag,
 	}
 }
 
@@ -386,6 +497,37 @@ func gatherTags(env string, flags []string) []string {
 	return tags
 }
 
+func gatherCSV(env string, flags []string) []string {
+	values := make([]string, 0)
+	if env != "" {
+		for _, value := range strings.Split(env, ",") {
+			value = strings.TrimSpace(value)
+			if value != "" {
+				values = append(values, value)
+			}
+		}
+	}
+	for _, value := range flags {
+		value = strings.TrimSpace(value)
+		if value != "" {
+			values = append(values, value)
+		}
+	}
+	return values
+}
+
+func defaultInt(value string, fallback int) int {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.Atoi(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
 func parseLogLevel(value string) (zerolog.Level, error) {
 	normalized := strings.ToLower(strings.TrimSpace(value))
 	if normalized == "" {
@@ -400,3 +542,114 @@ func defaultLogLevel(envValue string) string {
 	}
 	return envValue
 }
+
+// initDockerWithRetry attempts to initialize the Docker agent with exponential backoff.
+// It returns the agent when Docker becomes available, or nil if the context is cancelled.
+// Retry intervals: 5s, 10s, 20s, 40s, 80s, 160s, then cap at 5 minutes.
+func initDockerWithRetry(ctx context.Context, cfg dockeragent.Config, logger *zerolog.Logger) *dockeragent.Agent {
+	const (
+		initialDelay = 5 * time.Second
+		maxDelay     = 5 * time.Minute
+		multiplier   = 2.0
+	)
+
+	delay := initialDelay
+	attempt := 0
+
+	for {
+		select {
+		case <-ctx.Done():
+			logger.Info().Msg("Docker retry cancelled, context done")
+			return nil
+		default:
+		}
+
+		attempt++
+		logger.Info().
+			Int("attempt", attempt).
+			Str("next_retry", delay.String()).
+			Msg("Waiting to retry Docker connection")
+
+		select {
+		case <-ctx.Done():
+			logger.Info().Msg("Docker retry cancelled during wait")
+			return nil
+		case <-time.After(delay):
+		}
+
+		agent, err := dockeragent.New(cfg)
+		if err == nil {
+			logger.Info().
+				Int("attempts", attempt).
+				Msg("Successfully connected to Docker after retry")
+			return agent
+		}
+
+		logger.Warn().
+			Err(err).
+			Int("attempt", attempt).
+			Str("next_retry", (time.Duration(float64(delay) * multiplier)).String()).
+			Msg("Docker still not available, will retry")
+
+		// Calculate next delay with exponential backoff, capped at maxDelay
+		delay = time.Duration(float64(delay) * multiplier)
+		if delay > maxDelay {
+			delay = maxDelay
+		}
+	}
+}
+
+// initKubernetesWithRetry attempts to initialize the Kubernetes agent with exponential backoff.
+// It returns the agent when Kubernetes becomes available, or nil if the context is cancelled.
+// Retry intervals: 5s, 10s, 20s, 40s, 80s, 160s, then cap at 5 minutes.
+func initKubernetesWithRetry(ctx context.Context, cfg kubernetesagent.Config, logger *zerolog.Logger) *kubernetesagent.Agent {
+	const (
+		initialDelay = 5 * time.Second
+		maxDelay     = 5 * time.Minute
+		multiplier   = 2.0
+	)
+
+	delay := initialDelay
+	attempt := 0
+
+	for {
+		select {
+		case <-ctx.Done():
+			logger.Info().Msg("Kubernetes retry cancelled, context done")
+			return nil
+		default:
+		}
+
+		attempt++
+		logger.Info().
+			Int("attempt", attempt).
+			Str("next_retry", delay.String()).
+			Msg("Waiting to retry Kubernetes connection")
+
+		select {
+		case <-ctx.Done():
+			logger.Info().Msg("Kubernetes retry cancelled during wait")
+			return nil
+		case <-time.After(delay):
+		}
+
+		agent, err := kubernetesagent.New(cfg)
+		if err == nil {
+			logger.Info().
+				Int("attempts", attempt).
+				Msg("Successfully connected to Kubernetes after retry")
+			return agent
+		}
+
+		logger.Warn().
+			Err(err).
+			Int("attempt", attempt).
+			Str("next_retry", (time.Duration(float64(delay) * multiplier)).String()).
+			Msg("Kubernetes still not available, will retry")
+
+		delay = time.Duration(float64(delay) * multiplier)
+		if delay > maxDelay {
+			delay = maxDelay
+		}
+	}
+}
diff --git a/cmd/pulse-docker-agent/main.go b/cmd/pulse-docker-agent/main.go
index 6fc7142..60b9f99 100644
--- a/cmd/pulse-docker-agent/main.go
+++ b/cmd/pulse-docker-agent/main.go
@@ -55,6 +55,12 @@ func main() {
 	logger := zerolog.New(os.Stdout).Level(cfg.LogLevel).With().Timestamp().Logger()
 	cfg.Logger = &logger
 
+	// Deprecation warning
+	logger.Warn().Msg("pulse-docker-agent is DEPRECATED and will be removed in a future release")
+	logger.Warn().Msg("Please migrate to the unified 'pulse-agent' with --enable-docker flag")
+	logger.Warn().Msg("Example: pulse-agent --url <URL> --token <TOKEN> --enable-docker")
+	logger.Warn().Msg("")
+
 	agent, err := dockeragent.New(cfg)
 	if err != nil {
 		logger.Fatal().Err(err).Msg("Failed to create docker agent")
diff --git a/cmd/pulse-host-agent/main.go b/cmd/pulse-host-agent/main.go
index e1fe2d6..e64dc46 100644
--- a/cmd/pulse-host-agent/main.go
+++ b/cmd/pulse-host-agent/main.go
@@ -61,6 +61,12 @@ func main() {
 
 	g, ctx := errgroup.WithContext(ctx)
 
+	// Deprecation warning
+	logger.Warn().Msg("pulse-host-agent is DEPRECATED and will be removed in a future release")
+	logger.Warn().Msg("Please migrate to the unified 'pulse-agent' with --enable-host flag")
+	logger.Warn().Msg("Example: pulse-agent --url <URL> --token <TOKEN> --enable-host")
+	logger.Warn().Msg("")
+
 	logger.Info().
 		Str("version", Version).
 		Str("pulse_url", hostCfg.PulseURL).
diff --git a/cmd/pulse-sensor-proxy/README.md b/cmd/pulse-sensor-proxy/README.md
index fb26e92..3753310 100644
--- a/cmd/pulse-sensor-proxy/README.md
+++ b/cmd/pulse-sensor-proxy/README.md
@@ -1,5 +1,10 @@
 # pulse-sensor-proxy
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead. The agent provides
+> temperature monitoring plus additional features (AI, automatic Proxmox API setup).
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md) for details.
+
 The sensor proxy keeps SSH identities and temperature polling logic on the
 Proxmox host while presenting a small RPC surface (Unix socket or HTTPS) to the
 Pulse server. It protects SSH keys from container breakouts, enforces per-UID
diff --git a/cmd/pulse/main.go b/cmd/pulse/main.go
index afb0c32..53a6095 100644
--- a/cmd/pulse/main.go
+++ b/cmd/pulse/main.go
@@ -141,8 +141,15 @@ func runServer() {
 	}
 
 	// Set state getter for WebSocket hub
+	// IMPORTANT: Return StateFrontend (not StateSnapshot) to match broadcast format.
+	// StateSnapshot uses time.Time fields while StateFrontend uses Unix timestamps,
+	// and includes frontend-specific field transformations. Without this conversion,
+	// nodes/hosts would be missing on initial page load but appear after broadcasts.
 	wsHub.SetStateGetter(func() interface{} {
-		return reloadableMonitor.GetState()
+		// GetMonitor().GetState() returns models.StateSnapshot
+		state := reloadableMonitor.GetMonitor().GetState()
+		// Convert to frontend format, matching what BroadcastState does
+		return state.ToFrontend()
 	})
 
 	// Wire up Prometheus metrics for alert lifecycle
@@ -172,15 +179,29 @@ func runServer() {
 		return nil
 	}
 	router = api.NewRouter(cfg, reloadableMonitor.GetMonitor(), wsHub, reloadFunc, Version)
+	
+	// Inject resource store into monitor for WebSocket broadcasts
+	// This must be done after router creation since resourceHandlers is created in NewRouter
+	router.SetMonitor(reloadableMonitor.GetMonitor())
+
+	// Start AI patrol service for background infrastructure monitoring
+	router.StartPatrol(ctx)
+
+	// Wire alert-triggered AI analysis (token-efficient real-time insights when alerts fire)
+	router.WireAlertTriggeredAI()
 
 	// Create HTTP server with unified configuration
 	// In production, serve everything (frontend + API) on the frontend port
+	// NOTE: We use ReadHeaderTimeout instead of ReadTimeout to avoid affecting
+	// WebSocket connections. ReadTimeout sets a deadline on the underlying connection
+	// that persists even after WebSocket upgrade, causing premature disconnections.
+	// ReadHeaderTimeout only applies during header reading, not the full request body.
 	srv := &http.Server{
-		Addr:         fmt.Sprintf("%s:%d", cfg.BackendHost, cfg.FrontendPort),
-		Handler:      router.Handler(),
-		ReadTimeout:  15 * time.Second,
-		WriteTimeout: 60 * time.Second, // Increased from 15s to 60s to support large JSON responses (e.g., mock data)
-		IdleTimeout:  60 * time.Second,
+		Addr:              fmt.Sprintf("%s:%d", cfg.BackendHost, cfg.FrontendPort),
+		Handler:           router.Handler(),
+		ReadHeaderTimeout: 15 * time.Second,
+		WriteTimeout:      0, // Disabled to support SSE/streaming - each handler manages its own deadline
+		IdleTimeout:       120 * time.Second,
 	}
 
 	// Start config watcher for .env file changes
diff --git a/docs/AI.md b/docs/AI.md
new file mode 100644
index 0000000..416abc3
--- /dev/null
+++ b/docs/AI.md
@@ -0,0 +1,123 @@
+# Pulse AI
+
+Pulse AI is an intelligent monitoring assistant that helps you understand and manage your infrastructure through natural language conversations, proactive monitoring, and automated issue resolution.
+
+## Features
+
+### Chat Assistant
+Ask questions about your infrastructure in plain English:
+- "What's using the most CPU right now?"
+- "Show me VMs with high memory usage"
+- "Why is my backup failing?"
+- "Summarize the health of my cluster"
+
+### Patrol Mode
+Automated monitoring that runs on a schedule to:
+- Analyze resource utilization patterns
+- Detect potential issues before they cause problems
+- Generate actionable recommendations
+- Track trends over time
+
+### Auto-Fix
+Automatically resolve common issues:
+- Restart stuck services
+- Clear disk space
+- Restart unresponsive containers
+- Apply recommended optimizations
+
+### Predictive Intelligence
+- Identify resources trending toward problems
+- Forecast disk space exhaustion
+- Detect unusual patterns
+- Alert on anomalies
+
+## Configuration
+
+### Enable Pulse AI
+
+1. Navigate to **Settings → AI**
+2. Toggle **Enable Pulse AI**
+3. Configure your AI provider
+
+### Supported Providers
+
+| Provider | Models | Notes |
+|----------|--------|-------|
+| **OpenAI** | GPT-4, GPT-4 Turbo, GPT-3.5 | Recommended for best results |
+| **Anthropic** | Claude 3 Opus, Sonnet, Haiku | Excellent for complex analysis |
+| **Ollama** | Llama 3, Mistral, etc. | Self-hosted, privacy-focused |
+| **OpenRouter** | Multiple models | Pay-per-use routing |
+| **Custom** | Any OpenAI-compatible API | For enterprise deployments |
+
+### API Key Setup
+
+```bash
+# Environment variable (recommended for production)
+export PULSE_AI_PROVIDER=openai
+export PULSE_AI_API_KEY=sk-...
+
+# Or configure via Settings UI
+```
+
+### Patrol Configuration
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| Patrol Enabled | Off | Run automated checks |
+| Patrol Interval | 30 minutes | How often to run patrol |
+| Auto-Fix Enabled | Off | Allow automatic remediation |
+| Auto-Fix Model | Same as chat | Model for auto-fix decisions |
+
+## Usage
+
+### Chat Interface
+Access the AI chat from the bottom-right corner of any page. Type your question and press Enter.
+
+**Example queries:**
+```
+"What VMs are using more than 80% memory?"
+"Show me the status of all backups"
+"Why is node pve1 showing high load?"
+"Compare resource usage between this week and last week"
+```
+
+### Context Selection
+Click on any resource (VM, container, host) to add it to the AI context. This helps the AI provide more specific answers.
+
+### Patrol Reports
+When Patrol is enabled, Pulse AI will:
+1. Run periodic health checks
+2. Generate findings (issues, warnings, info)
+3. Offer to auto-fix issues (if enabled)
+4. Track trends over time
+
+## Cost Tracking
+
+Track AI API usage in **Settings → AI → Cost Dashboard**:
+- Daily/monthly usage statistics
+- Cost breakdown by feature
+- Usage trends over time
+
+## Privacy & Security
+
+- **Data stays local**: Only resource metadata is sent to AI providers
+- **No training**: Your data is never used for model training
+- **Audit logging**: All AI interactions are logged
+- **Self-hosted option**: Use Ollama for complete data privacy
+
+## Troubleshooting
+
+### AI not responding
+1. Check API key is configured correctly
+2. Verify network connectivity to AI provider
+3. Check Settings → AI for error messages
+
+### Patrol not running
+1. Ensure Patrol is enabled in Settings
+2. Check system resource availability
+3. Review logs: `journalctl -u pulse -f`
+
+### Auto-fix not working
+1. Enable Auto-Fix in Settings → AI
+2. Verify the connected agents have execute permissions
+3. Check the Auto-Fix model is configured
diff --git a/docs/API.md b/docs/API.md
index 32f2584..3173216 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -112,23 +112,6 @@ Triggers a test alert to all configured channels.
 
 ---
 
----
-## 🖥️ Host Agent
-
-### Submit Report
-`POST /api/agents/host/report`
-Used by the Pulse Host Agent to push system metrics.
-
-### Lookup Agent
-`POST /api/agents/host/lookup`
-Check if a host agent is already registered.
-
-### Delete Host
-`DELETE /api/agents/host/<id>`
-Remove a host agent from monitoring.
-
----
-
 ## ⚙️ System Settings
 
 ### Get Settings
@@ -157,15 +140,55 @@ Initiate OIDC login flow.
 
 ---
 
-## 🐳 Docker Agent
+## 🤖 Pulse AI *(New in 5.0)*
 
-### Submit Report
-`POST /api/agents/docker/report`
-Used by the Pulse Docker Agent to push container metrics.
+### Get AI Settings
+`GET /api/settings/ai`
+Returns current AI configuration (providers, models, patrol status).
 
-### Download Agent
-`GET /download/pulse-docker-agent`
-Downloads the binary for the current platform.
+### Update AI Settings
+`PUT /api/settings/ai`
+Configure AI providers, API keys, and preferences.
+
+### Chat
+`POST /api/ai/chat`
+Send a message to the AI assistant.
+```json
+{ "message": "What VMs are using the most CPU?", "context": ["vm-100", "vm-101"] }
+```
+
+### Patrol Status
+`GET /api/ai/patrol/status`
+Get current patrol status and recent findings.
+
+### Patrol Findings
+`GET /api/ai/patrol/findings`
+List all patrol findings with severity and recommendations.
+
+### Cost Tracking
+`GET /api/ai/cost?period=30d`
+Get AI usage statistics and costs.
+
+---
+
+## 🤖 Agent Endpoints
+
+### Unified Agent (Recommended)
+`GET /download/pulse-agent`
+Downloads the unified agent binary for the current platform.
+
+The unified agent combines host, Docker, and Kubernetes monitoring. Use `--enable-docker` or `--enable-kubernetes` to enable additional metrics.
+
+See [UNIFIED_AGENT.md](UNIFIED_AGENT.md) for installation instructions.
+
+### Legacy Agents (Deprecated)
+`GET /download/pulse-host-agent` - *Deprecated, use pulse-agent*
+`GET /download/pulse-docker-agent` - *Deprecated, use pulse-agent --enable-docker*
+
+### Submit Reports
+`POST /api/agents/host/report` - Host metrics
+`POST /api/agents/docker/report` - Docker container metrics
+`POST /api/agents/kubernetes/report` - Kubernetes cluster metrics
 
 ---
 
diff --git a/docs/AUTO_UPDATE.md b/docs/AUTO_UPDATE.md
new file mode 100644
index 0000000..791619d
--- /dev/null
+++ b/docs/AUTO_UPDATE.md
@@ -0,0 +1,141 @@
+# Automatic Updates
+
+Pulse 5.0 introduces one-click updates for supported deployment types, making it easy to keep your monitoring system up to date.
+
+## Supported Deployment Types
+
+| Deployment | Auto-Update | Method |
+|------------|-------------|--------|
+| **ProxmoxVE LXC** | ✅ Yes | In-app update button |
+| **Systemd Service** | ✅ Yes | In-app update button |
+| **Docker** | ❌ Manual | Pull new image |
+| **Source Build** | ❌ Manual | Git pull + rebuild |
+
+## Using One-Click Updates
+
+### When an Update is Available
+
+1. Navigate to **Settings → System Updates**
+2. If an update is available, you'll see an **"Install Update"** button
+3. Click the button to open the confirmation dialog
+4. Review the update details:
+   - Current version → New version
+   - Estimated time
+   - Changelog highlights
+5. Click **"Install Update"** to begin
+
+### Update Process
+
+1. **Download**: New version is downloaded
+2. **Backup**: Current installation is backed up
+3. **Apply**: Files are updated
+4. **Restart**: Service restarts automatically
+5. **Verify**: Health check confirms success
+
+### Progress Tracking
+
+A real-time progress modal shows:
+- Current step
+- Download progress
+- Any warnings or errors
+- Automatic page reload on success
+
+## Configuration
+
+### Update Preferences
+
+In **Settings → System Updates**:
+
+| Setting | Description |
+|---------|-------------|
+| **Update Channel** | Stable (recommended) or Release Candidate |
+| **Auto-Check** | Automatically check for updates daily |
+
+### Environment Variables
+
+```bash
+# Disable auto-update check
+PULSE_AUTO_UPDATE_CHECK=false
+
+# Use release candidate channel
+PULSE_UPDATE_CHANNEL=rc
+```
+
+## Manual Update Methods
+
+### Docker
+
+```bash
+# Pull latest image
+docker pull ghcr.io/rcourtman/pulse:latest
+
+# Restart container
+docker-compose down && docker-compose up -d
+```
+
+### ProxmoxVE LXC (Manual)
+
+```bash
+# Inside the container
+curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/scripts/install.sh | bash
+```
+
+### Systemd Service (Manual)
+
+```bash
+# Download new release
+curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/scripts/install.sh | bash
+```
+
+### Source Build
+
+```bash
+cd /opt/pulse
+git pull
+make build
+sudo systemctl restart pulse
+```
+
+## Rollback
+
+If an update causes issues:
+
+### Automatic Rollback
+Pulse creates a backup before updating. If the update fails:
+1. The previous version is automatically restored
+2. Service restarts with the old version
+3. Error details are logged
+
+### Manual Rollback
+```bash
+# Backups are stored in /etc/pulse/backups/
+ls /etc/pulse/backups/
+
+# Restore a specific backup
+sudo /opt/pulse/scripts/restore-backup.sh /etc/pulse/backups/pulse-backup-20250101.tar.gz
+```
+
+## Update History
+
+View past updates in **Settings → System Updates → Update History**:
+- Previous versions installed
+- Update timestamps
+- Success/failure status
+
+## Troubleshooting
+
+### Update button not showing
+1. Check if your deployment supports auto-update
+2. Verify an update is actually available
+3. Ensure you have the latest frontend loaded (hard refresh)
+
+### Update failed
+1. Check the error message in the progress modal
+2. Review logs: `journalctl -u pulse -n 100`
+3. Verify disk space is available
+4. Check network connectivity to GitHub
+
+### Service won't restart after update
+1. Check systemd status: `systemctl status pulse`
+2. View recent logs: `journalctl -u pulse -f`
+3. Manually restore from backup if needed
diff --git a/docs/MAIL_GATEWAY.md b/docs/MAIL_GATEWAY.md
new file mode 100644
index 0000000..4fb623e
--- /dev/null
+++ b/docs/MAIL_GATEWAY.md
@@ -0,0 +1,99 @@
+# Proxmox Mail Gateway (PMG) Monitoring
+
+Pulse 5.0 adds support for monitoring Proxmox Mail Gateway instances alongside your PVE and PBS infrastructure.
+
+## Features
+
+- **Mail Queue Monitoring**: Track active, deferred, and held messages
+- **Spam Statistics**: View spam detection rates and virus blocks
+- **Cluster Status**: Monitor PMG cluster node health
+- **Quarantine Overview**: See quarantine size and pending reviews
+
+## Adding a PMG Instance
+
+### Via Settings UI
+
+1. Navigate to **Settings → Proxmox**
+2. Click **Add Node**
+3. Select **Proxmox Mail Gateway** as the type
+4. Enter connection details:
+   - Host: Your PMG IP or hostname
+   - Port: 8006 (default)
+   - API Token ID: e.g., `root@pam!pulse`
+   - API Token Secret: Your token secret
+
+### Via Discovery
+
+Pulse can automatically discover PMG instances on your network:
+
+1. Go to **Settings → Discovery**
+2. Enable network discovery
+3. PMG instances on port 8006 will be detected
+4. Click to add discovered instances
+
+## API Token Setup on PMG
+
+Create an API token on your PMG server:
+
+```bash
+# SSH to your PMG server
+pveum user token add root@pam pulse --privsep 0
+
+# Note the token secret - it's only shown once!
+```
+
+Required permissions:
+- `Sys.Audit` - Read system status
+- `Datastore.Audit` - Read mail statistics
+
+## Dashboard
+
+The Mail Gateway tab shows:
+
+| Metric | Description |
+|--------|-------------|
+| **Mail Processed** | Total emails processed today |
+| **Spam Rate** | Percentage of spam detected |
+| **Virus Blocked** | Malicious emails caught |
+| **Queue Depth** | Messages pending delivery |
+| **Quarantine Size** | Emails in quarantine |
+
+### Status Indicators
+
+- 🟢 **Healthy**: Normal operation
+- 🟡 **Warning**: Queue building up or high spam rate
+- 🔴 **Critical**: Delivery issues or cluster problems
+
+## Alerts
+
+Configure alerts for PMG metrics in **Settings → Alerts**:
+
+- Queue depth exceeding threshold
+- Spam rate spike
+- Delivery failures
+- Cluster node offline
+
+## Multi-Instance Support
+
+Monitor multiple PMG instances from a single Pulse dashboard:
+
+- Compare spam rates across gateways
+- Aggregate mail statistics
+- View cluster-wide health
+
+## Troubleshooting
+
+### Connection refused
+1. Verify PMG is accessible on port 8006
+2. Check firewall rules
+3. Ensure API token has correct permissions
+
+### No statistics showing
+1. Wait for initial data collection (may take 1-2 polling cycles)
+2. Verify PMG has mail activity
+3. Check Pulse logs for API errors
+
+### Cluster nodes missing
+1. PMG cluster must be properly configured
+2. API token needs cluster-wide permissions
+3. All nodes must be reachable from Pulse
diff --git a/docs/METRICS_HISTORY.md b/docs/METRICS_HISTORY.md
new file mode 100644
index 0000000..b79d2a1
--- /dev/null
+++ b/docs/METRICS_HISTORY.md
@@ -0,0 +1,87 @@
+# Metrics History
+
+Pulse 5.0 introduces persistent metrics history, allowing you to view historical resource usage data and trends over time.
+
+## Features
+
+- **Persistent Storage**: Metrics are saved to disk and survive restarts
+- **Configurable Retention**: Set how long to keep different metric types
+- **Trend Analysis**: View resource usage patterns over time
+- **Spark Lines**: See at-a-glance trends in the dashboard
+
+## Configuration
+
+### Retention Settings
+
+Configure retention periods in **Settings → General → Metrics History**:
+
+| Metric Type | Default | Description |
+|-------------|---------|-------------|
+| **Host Metrics** | 7 days | CPU, memory, disk for hypervisors |
+| **Guest Metrics** | 7 days | VM and container metrics |
+| **Container Metrics** | 3 days | Docker/Podman container stats |
+| **Aggregate Metrics** | 30 days | Cluster-wide summaries |
+
+### Environment Variables
+
+```bash
+# Override via environment
+PULSE_METRICS_HOST_RETENTION_DAYS=14
+PULSE_METRICS_GUEST_RETENTION_DAYS=14
+PULSE_METRICS_CONTAINER_RETENTION_DAYS=7
+PULSE_METRICS_AGGREGATE_RETENTION_DAYS=60
+```
+
+## Storage
+
+Metrics are stored in `/etc/pulse/data/metrics/` (or your configured data directory).
+
+### Disk Usage
+
+Approximate storage requirements:
+- ~1 KB per resource per hour
+- 10 hosts × 50 guests × 7 days ≈ 8 MB
+
+### Database Maintenance
+
+Pulse automatically:
+- Compacts old data
+- Prunes metrics beyond retention period
+- Optimizes storage during low-usage periods
+
+## API Access
+
+Query historical metrics via the API:
+
+```bash
+# Get metrics for a specific resource
+curl -H "X-API-Token: $TOKEN" \
+  "http://localhost:7655/api/metrics/history?resource=vm-100&hours=24"
+
+# Get aggregated cluster metrics
+curl -H "X-API-Token: $TOKEN" \
+  "http://localhost:7655/api/metrics/history?type=aggregate&days=7"
+```
+
+## Visualization
+
+### Dashboard Sparklines
+The dashboard shows 24-hour trend sparklines for each resource, updating in real-time.
+
+### Detailed Charts
+Click on any resource to see detailed historical charts with:
+- Selectable time ranges (1h, 6h, 24h, 7d, 30d)
+- Multiple metric overlays (CPU, memory, disk, network)
+- Zoom and pan controls
+
+## Troubleshooting
+
+### Metrics not persisting
+1. Check data directory permissions
+2. Verify disk space availability
+3. Check logs: `journalctl -u pulse | grep metrics`
+
+### High disk usage
+1. Reduce retention periods in Settings
+2. Exclude low-value resources from history
+3. Run manual cleanup: Settings → General → Clear Old Metrics
diff --git a/docs/README.md b/docs/README.md
index 24b71c1..75f13c1 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -26,6 +26,14 @@ Welcome to the Pulse documentation portal. Here you'll find everything you need
 
 - **[Security Policy](../SECURITY.md)** – The core security model (Encryption, Auth, API Scopes).
 
+## ✨ New in 5.0
+
+- **[Pulse AI](AI.md)** – Intelligent monitoring assistant with chat, patrol mode, and auto-fix.
+- **[Metrics History](METRICS_HISTORY.md)** – Persistent metrics storage with configurable retention.
+- **[Mail Gateway](MAIL_GATEWAY.md)** – Proxmox Mail Gateway (PMG) monitoring.
+- **[Auto Updates](AUTO_UPDATE.md)** – One-click updates for supported deployments.
+- **[Kubernetes](KUBERNETES.md)** – Complete K8s cluster monitoring via agents.
+
 ## 📡 Monitoring & Agents
 
 - **[Unified Agent](UNIFIED_AGENT.md)** – Single binary for Host and Docker monitoring.
diff --git a/docs/UNIFIED_AGENT.md b/docs/UNIFIED_AGENT.md
index 6b0447e..72700a8 100644
--- a/docs/UNIFIED_AGENT.md
+++ b/docs/UNIFIED_AGENT.md
@@ -1,6 +1,6 @@
 # Pulse Unified Agent
 
-The unified agent (`pulse-agent`) combines host and Docker monitoring into a single binary. It replaces the separate `pulse-host-agent` and `pulse-docker-agent` for simpler deployment and management.
+The unified agent (`pulse-agent`) combines host, Docker, and Kubernetes monitoring into a single binary. It replaces the separate `pulse-host-agent` and `pulse-docker-agent` for simpler deployment and management.
 
 ## Quick Start
 
@@ -29,6 +29,7 @@ curl -fsSL http://<pulse-ip>:7655/install.sh | \
 
 - **Host Metrics**: CPU, memory, disk, network I/O, temperatures
 - **Docker Monitoring**: Container metrics, health checks, Swarm support (when enabled)
+- **Kubernetes Monitoring**: Cluster, node, pod, and deployment health (when enabled)
 - **Auto-Update**: Automatically updates when a new version is released
 - **Multi-Platform**: Linux, macOS, Windows support
 
@@ -41,6 +42,13 @@ curl -fsSL http://<pulse-ip>:7655/install.sh | \
 | `--interval` | `PULSE_INTERVAL` | Reporting interval | `30s` |
 | `--enable-host` | `PULSE_ENABLE_HOST` | Enable host metrics | `true` |
 | `--enable-docker` | `PULSE_ENABLE_DOCKER` | Enable Docker metrics | `false` |
+| `--enable-kubernetes` | `PULSE_ENABLE_KUBERNETES` | Enable Kubernetes metrics | `false` |
+| `--kubeconfig` | `PULSE_KUBECONFIG` | Kubeconfig path (optional) | *(auto)* |
+| `--kube-context` | `PULSE_KUBE_CONTEXT` | Kubeconfig context (optional) | *(auto)* |
+| `--kube-include-namespace` | `PULSE_KUBE_INCLUDE_NAMESPACES` | Limit namespaces (repeatable or CSV) | *(all)* |
+| `--kube-exclude-namespace` | `PULSE_KUBE_EXCLUDE_NAMESPACES` | Exclude namespaces (repeatable or CSV) | *(none)* |
+| `--kube-include-all-pods` | `PULSE_KUBE_INCLUDE_ALL_PODS` | Include all non-succeeded pods | `false` |
+| `--kube-max-pods` | `PULSE_KUBE_MAX_PODS` | Max pods per report | `200` |
 | `--disable-auto-update` | `PULSE_DISABLE_AUTO_UPDATE` | Disable auto-updates | `false` |
 | `--insecure` | `PULSE_INSECURE_SKIP_VERIFY` | Skip TLS verification | `false` |
 | `--hostname` | `PULSE_HOSTNAME` | Override hostname | *(OS hostname)* |
@@ -61,6 +69,12 @@ curl -fsSL http://<pulse-ip>:7655/install.sh | \
   bash -s -- --url http://<pulse-ip>:7655 --token <token> --enable-docker
 ```
 
+### Host + Kubernetes Monitoring
+```bash
+curl -fsSL http://<pulse-ip>:7655/install.sh | \
+  bash -s -- --url http://<pulse-ip>:7655 --token <token> --enable-kubernetes
+```
+
 ### Docker Monitoring Only
 ```bash
 curl -fsSL http://<pulse-ip>:7655/install.sh | \
diff --git a/docs/development/MOCK_MODE.md b/docs/development/MOCK_MODE.md
index 5f09f6a..4d4e2ab 100644
--- a/docs/development/MOCK_MODE.md
+++ b/docs/development/MOCK_MODE.md
@@ -25,6 +25,8 @@ Edit `mock.env` (or `mock.env.local` for overrides):
 | `PULSE_MOCK_LXCS_PER_NODE` | `8` | Containers per node. |
 | `PULSE_MOCK_RANDOM_METRICS` | `true` | Jitter metrics. |
 | `PULSE_MOCK_STOPPED_PERCENT` | `20` | % of offline guests. |
+| `PULSE_MOCK_TRENDS_SEED_DURATION` | `1h` | Pre-seed backend chart history (improves demo “Trends” immediately). |
+| `PULSE_MOCK_TRENDS_SAMPLE_INTERVAL` | `30s` | Backend chart sampling interval while in mock mode. |
 
 ## ℹ️ How it Works
 *   **Data**: Swaps `PULSE_DATA_DIR` to `/opt/pulse/tmp/mock-data`.
diff --git a/docs/operations/SENSOR_PROXY_CONFIG.md b/docs/operations/SENSOR_PROXY_CONFIG.md
index eae06ae..9305690 100644
--- a/docs/operations/SENSOR_PROXY_CONFIG.md
+++ b/docs/operations/SENSOR_PROXY_CONFIG.md
@@ -1,5 +1,9 @@
 # ⚙️ Sensor Proxy Configuration
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead.
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
+
 Safe configuration management using the CLI (v4.31.1+).
 
 ## 📂 Files
diff --git a/docs/operations/SENSOR_PROXY_LOGS.md b/docs/operations/SENSOR_PROXY_LOGS.md
index 5c56b4d..06c5cf1 100644
--- a/docs/operations/SENSOR_PROXY_LOGS.md
+++ b/docs/operations/SENSOR_PROXY_LOGS.md
@@ -1,5 +1,9 @@
 # 📝 Sensor Proxy Log Forwarding
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead.
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
+
 Forward `audit.log` and `proxy.log` to a central SIEM via RELP + TLS.
 
 ## 🚀 Quick Start
diff --git a/docs/security/SENSOR_PROXY_APPARMOR.md b/docs/security/SENSOR_PROXY_APPARMOR.md
index 44fb5a5..6d25c06 100644
--- a/docs/security/SENSOR_PROXY_APPARMOR.md
+++ b/docs/security/SENSOR_PROXY_APPARMOR.md
@@ -1,5 +1,9 @@
 # 🛡️ Sensor Proxy Hardening
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead.
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
+
 Secure `pulse-sensor-proxy` with AppArmor and Seccomp.
 
 ## 🛡️ AppArmor
diff --git a/docs/security/SENSOR_PROXY_HARDENING.md b/docs/security/SENSOR_PROXY_HARDENING.md
index c03f99c..12f1c65 100644
--- a/docs/security/SENSOR_PROXY_HARDENING.md
+++ b/docs/security/SENSOR_PROXY_HARDENING.md
@@ -1,5 +1,9 @@
 # 🛡️ Sensor Proxy Hardening
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead.
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
+
 The `pulse-sensor-proxy` runs on the host to securely collect temperatures, keeping SSH keys out of containers.
 
 ## 🏗️ Architecture
diff --git a/docs/security/SENSOR_PROXY_NETWORK.md b/docs/security/SENSOR_PROXY_NETWORK.md
index 55c6139..9a5d1fa 100644
--- a/docs/security/SENSOR_PROXY_NETWORK.md
+++ b/docs/security/SENSOR_PROXY_NETWORK.md
@@ -1,5 +1,9 @@
 # 🌐 Sensor Proxy Network Segmentation
 
+> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
+> For new installations, use `install.sh --enable-proxmox` instead.
+> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
+
 Isolate the proxy to prevent lateral movement.
 
 ## 🚧 Zones
diff --git a/docs/security/TEMPERATURE_MONITORING.md b/docs/security/TEMPERATURE_MONITORING.md
index 760419c..0276393 100644
--- a/docs/security/TEMPERATURE_MONITORING.md
+++ b/docs/security/TEMPERATURE_MONITORING.md
@@ -1,29 +1,57 @@
-# 🌡️ Temperature Monitoring Security
+# 🌡️ Temperature Monitoring
 
-Secure architecture for collecting hardware temperatures.
+Pulse supports two methods for collecting hardware temperatures from Proxmox nodes.
 
-## 🛡️ Security Model
+## Recommended: Pulse Agent
+
+The simplest and most feature-rich method is installing the Pulse agent on your Proxmox nodes:
+
+```bash
+curl -fsSL http://your-pulse-server:7655/api/download/install.sh | bash -s -- \
+  --url http://your-pulse-server:7655 \
+  --token YOUR_TOKEN \
+  --enable-proxmox
+```
+
+**Benefits:**
+- ✅ One-command setup
+- ✅ Automatic API token creation
+- ✅ Temperature monitoring built-in
+- ✅ Enables AI features for VM/container management
+- ✅ No SSH keys or proxy configuration required
+
+The agent runs `sensors -j` locally and reports temperatures directly to Pulse.
+
+---
+
+## Legacy: Sensor Proxy (SSH-based)
+
+For users who prefer not to install an agent on their hypervisor, the sensor-proxy method is still available.
+
+> **Note:** This method is deprecated and will be removed in a future release. Consider migrating to the agent-based approach.
+
+### 🛡️ Security Model
 *   **Isolation**: SSH keys live on the host, not in the container.
 *   **Least Privilege**: Proxy runs as `pulse-sensor-proxy` (no shell).
 *   **Verification**: Container identity verified via `SO_PEERCRED`.
 
-## 🏗️ Components
+### 🏗️ Components
 1.  **Pulse Backend**: Connects to Unix socket `/mnt/pulse-proxy/pulse-sensor-proxy.sock`.
 2.  **Sensor Proxy**: Validates request, executes SSH to node.
 3.  **Target Node**: Accepts SSH key restricted to `sensors -j`.
 
-## 🔒 Key Restrictions
+### 🔒 Key Restrictions
 SSH keys deployed to nodes are locked down:
 ```
 command="sensors -j",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty
 ```
 
-## 🚦 Rate Limiting
+### 🚦 Rate Limiting
 *   **Per Peer**: ~12 req/min.
 *   **Concurrency**: Max 2 parallel requests per peer.
 *   **Global**: Max 8 concurrent requests.
 
-## 📝 Auditing
+### 📝 Auditing
 All requests logged to system journal:
 ```bash
 journalctl -u pulse-sensor-proxy
diff --git a/frontend-modern/index.html b/frontend-modern/index.html
index 78bd7f0..0ce2d45 100644
--- a/frontend-modern/index.html
+++ b/frontend-modern/index.html
@@ -6,6 +6,34 @@
     <meta name="theme-color" content="#000000" />
     <link rel="icon" type="image/svg+xml" href="/logo.svg" />
     <title>Pulse</title>
+    <!-- Inline critical styles to prevent flash of unstyled content -->
+    <style>
+      /* Apply theme immediately before any CSS loads */
+      html { background-color: #f3f4f6; } /* gray-100 */
+      html.dark { background-color: #111827; } /* gray-900 */
+      body { margin: 0; min-height: 100vh; }
+      #root { min-height: 100vh; }
+      /* Hide content until app is ready to prevent layout shift */
+      #root:empty { 
+        display: flex; 
+        align-items: center; 
+        justify-content: center;
+        background-color: inherit;
+      }
+    </style>
+    <!-- Apply dark mode immediately from localStorage to prevent flash -->
+    <script>
+      (function() {
+        try {
+          var darkMode = localStorage.getItem('pulse_dark_mode');
+          var prefersDark = darkMode === 'true' || 
+            (darkMode === null && window.matchMedia('(prefers-color-scheme: dark)').matches);
+          if (prefersDark) {
+            document.documentElement.classList.add('dark');
+          }
+        } catch (e) {}
+      })();
+    </script>
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>
diff --git a/frontend-modern/package-lock.json b/frontend-modern/package-lock.json
index e09c7a6..b13a360 100644
Binary files a/frontend-modern/package-lock.json and b/frontend-modern/package-lock.json differ
diff --git a/frontend-modern/package.json b/frontend-modern/package.json
index 666c8a9..9c94d57 100644
--- a/frontend-modern/package.json
+++ b/frontend-modern/package.json
@@ -27,11 +27,14 @@
   },
   "dependencies": {
     "@solidjs/router": "^0.10.10",
+    "dompurify": "^3.3.1",
     "lucide-solid": "^0.545.0",
+    "marked": "^17.0.1",
     "solid-js": "^1.8.0"
   },
   "devDependencies": {
     "@solidjs/testing-library": "^0.8.5",
+    "@tailwindcss/typography": "^0.5.19",
     "@testing-library/jest-dom": "^6.5.0",
     "@types/node": "^20.10.0",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
diff --git a/frontend-modern/src/App.tsx b/frontend-modern/src/App.tsx
index 5deca70..4d335d0 100644
--- a/frontend-modern/src/App.tsx
+++ b/frontend-modern/src/App.tsx
@@ -35,14 +35,21 @@ import { createTooltipSystem } from './components/shared/Tooltip';
 import type { State } from '@/types/api';
 import { ProxmoxIcon } from '@/components/icons/ProxmoxIcon';
 import { startMetricsSampler } from './stores/metricsSampler';
+import { seedFromBackend } from './stores/metricsHistory';
+import { getMetricsViewMode } from './stores/metricsViewMode';
 import BoxesIcon from 'lucide-solid/icons/boxes';
 import MonitorIcon from 'lucide-solid/icons/monitor';
 import BellIcon from 'lucide-solid/icons/bell';
 import SettingsIcon from 'lucide-solid/icons/settings';
+import NetworkIcon from 'lucide-solid/icons/network';
 import { TokenRevealDialog } from './components/TokenRevealDialog';
 import { useAlertsActivation } from './stores/alertsActivation';
 import { UpdateProgressModal } from './components/UpdateProgressModal';
 import type { UpdateStatus } from './api/updates';
+import { AIChat } from './components/AI/AIChat';
+import { AIStatusIndicator } from './components/AI/AIStatusIndicator';
+import { aiChatStore } from './stores/aiChat';
+import { useResourcesAsLegacy } from './hooks/useResources';
 
 const Dashboard = lazy(() =>
   import('./components/Dashboard/Dashboard').then((module) => ({ default: module.Dashboard })),
@@ -51,6 +58,7 @@ const StorageComponent = lazy(() => import('./components/Storage/Storage'));
 const Backups = lazy(() => import('./components/Backups/Backups'));
 const Replication = lazy(() => import('./components/Replication/Replication'));
 const MailGateway = lazy(() => import('./components/PMG/MailGateway'));
+const CephPage = lazy(() => import('./pages/Ceph'));
 const AlertsPage = lazy(() =>
   import('./pages/Alerts').then((module) => ({ default: module.Alerts })),
 );
@@ -58,12 +66,18 @@ const SettingsPage = lazy(() => import('./components/Settings/Settings'));
 const DockerHosts = lazy(() =>
   import('./components/Docker/DockerHosts').then((module) => ({ default: module.DockerHosts })),
 );
+const KubernetesClusters = lazy(() =>
+  import('./components/Kubernetes/KubernetesClusters').then((module) => ({
+    default: module.KubernetesClusters,
+  })),
+);
 const HostsOverview = lazy(() =>
   import('./components/Hosts/HostsOverview').then((module) => ({
     default: module.HostsOverview,
   })),
 );
 
+
 // Enhanced store type with proper typing
 type EnhancedStore = ReturnType<typeof getGlobalWebSocketStore>;
 
@@ -87,26 +101,29 @@ export const useDarkMode = () => {
   return context;
 };
 
-// Docker route component that properly uses activeAlerts from useWebSocket
+// Docker route component - uses unified resources via useResourcesAsLegacy hook
 function DockerRoute() {
   const wsContext = useContext(WebSocketContext);
   if (!wsContext) {
     return <div>Loading...</div>;
   }
-  const { state, activeAlerts } = wsContext;
-  const hosts = createMemo(() => state.dockerHosts ?? []);
-  return <DockerHosts hosts={hosts()} activeAlerts={activeAlerts} />;
+  const { activeAlerts } = wsContext;
+  const { asDockerHosts } = useResourcesAsLegacy();
+
+  return <DockerHosts hosts={asDockerHosts() as any} activeAlerts={activeAlerts} />;
 }
 
+// Hosts route component - HostsOverview uses useResourcesAsLegacy directly for proper reactivity
 function HostsRoute() {
+  return <HostsOverview />;
+}
+
+function KubernetesRoute() {
   const wsContext = useContext(WebSocketContext);
   if (!wsContext) {
     return <div>Loading...</div>;
   }
-  const { state } = wsContext;
-  return (
-    <HostsOverview hosts={state.hosts ?? []} connectionHealth={state.connectionHealth ?? {}} />
-  );
+  return <KubernetesClusters clusters={wsContext.state.kubernetesClusters ?? []} />;
 }
 
 // Helper to detect if an update is actively in progress (not just checking for updates)
@@ -211,6 +228,13 @@ function App() {
   // Start metrics sampler for sparklines
   onMount(() => {
     startMetricsSampler();
+
+    // If user already has sparklines mode enabled, seed historical data immediately
+    if (getMetricsViewMode() === 'sparklines') {
+      seedFromBackend('1h').catch(() => {
+        // Errors are already logged in seedFromBackend
+      });
+    }
   });
 
   let hasPreloadedRoutes = false;
@@ -226,6 +250,7 @@ function App() {
       () => import('./components/Replication/Replication'),
       () => import('./components/PMG/MailGateway'),
       () => import('./components/Hosts/HostsOverview'),
+
       () => import('./pages/Alerts'),
       () => import('./components/Settings/Settings'),
       () => import('./components/Docker/DockerHosts'),
@@ -251,23 +276,23 @@ function App() {
     pmg: [],
     replicationJobs: [],
     metrics: [],
-  pveBackups: {
-    backupTasks: [],
-    storageBackups: [],
-    guestSnapshots: [],
-  },
-  pbsBackups: [],
-  pmgBackups: [],
-  backups: {
-    pve: {
+    pveBackups: {
       backupTasks: [],
       storageBackups: [],
       guestSnapshots: [],
     },
-    pbs: [],
-    pmg: [],
-  },
-  performance: {
+    pbsBackups: [],
+    pmgBackups: [],
+    backups: {
+      pve: {
+        backupTasks: [],
+        storageBackups: [],
+        guestSnapshots: [],
+      },
+      pbs: [],
+      pmg: [],
+    },
+    performance: {
       apiCallDuration: {},
       lastPollDuration: 0,
       pollingStartTime: '',
@@ -498,9 +523,9 @@ function App() {
 
       // Detect legacy DISABLE_AUTH flag (now ignored) so we can surface a warning
       if (securityData.deprecatedDisableAuth === true) {
-          logger.warn(
-            '[App] Legacy DISABLE_AUTH flag detected; authentication remains enabled. Remove the flag and restart Pulse to silence this warning.',
-          );
+        logger.warn(
+          '[App] Legacy DISABLE_AUTH flag detected; authentication remains enabled. Remove the flag and restart Pulse to silence this warning.',
+        );
       }
 
       const authConfigured = securityData.hasAuthentication || false;
@@ -713,9 +738,14 @@ function App() {
   // Pass through the store directly (only when initialized)
   const enhancedStore = () => wsStore();
 
-  const DashboardView = () => (
-    <Dashboard vms={state().vms} containers={state().containers} nodes={state().nodes} />
-  );
+  // Dashboard view - uses unified resources via useResourcesAsLegacy hook
+  const DashboardView = () => {
+    const { asVMs, asContainers, asNodes } = useResourcesAsLegacy();
+
+    return (
+      <Dashboard vms={asVMs() as any} containers={asContainers() as any} nodes={asNodes() as any} />
+    );
+  };
 
   const SettingsRoute = () => (
     <SettingsPage darkMode={darkMode} toggleDarkMode={toggleDarkMode} />
@@ -723,42 +753,120 @@ function App() {
 
   // Root layout component for Router
   const RootLayout = (props: { children?: JSX.Element }) => {
+    // Check AI settings on mount and setup keyboard shortcut
+    onMount(() => {
+      // Only check AI settings if already authenticated (not on login screen)
+      // Otherwise, the 401 response triggers a redirect loop
+      if (!needsAuth()) {
+        import('./api/ai').then(({ AIAPI }) => {
+          AIAPI.getSettings()
+            .then((settings) => {
+              aiChatStore.setEnabled(settings.enabled && settings.configured);
+            })
+            .catch(() => {
+              aiChatStore.setEnabled(false);
+            });
+        });
+      }
+
+      // Keyboard shortcut: Cmd/Ctrl+K to toggle AI
+      const handleKeyDown = (e: KeyboardEvent) => {
+        if ((e.metaKey || e.ctrlKey) && e.key === 'k') {
+          e.preventDefault();
+          if (aiChatStore.enabled) {
+            aiChatStore.toggle();
+          }
+        }
+        // Escape to close
+        if (e.key === 'Escape' && aiChatStore.isOpen) {
+          aiChatStore.close();
+        }
+      };
+
+      document.addEventListener('keydown', handleKeyDown);
+      onCleanup(() => {
+        document.removeEventListener('keydown', handleKeyDown);
+      });
+    });
+
     return (
       <Show
         when={!isLoading()}
         fallback={
-          <div class="min-h-screen flex items-center justify-center bg-gray-50 dark:bg-gray-900">
+          <div class="min-h-screen flex items-center justify-center bg-gray-100 dark:bg-gray-900">
             <div class="text-gray-600 dark:text-gray-400">Loading...</div>
           </div>
         }
       >
-        <Show when={!needsAuth()} fallback={<Login onLogin={handleLogin} />}>
+        <Show when={!needsAuth()} fallback={<Login onLogin={handleLogin} hasAuth={hasAuth()} />}>
           <ErrorBoundary>
-            <Show when={enhancedStore()} fallback={<div>Initializing...</div>}>
+            <Show when={enhancedStore()} fallback={
+              <div class="min-h-screen flex items-center justify-center bg-gray-100 dark:bg-gray-900">
+                <div class="text-gray-600 dark:text-gray-400">Initializing...</div>
+              </div>
+            }>
               <WebSocketContext.Provider value={enhancedStore()!}>
                 <DarkModeContext.Provider value={darkMode}>
                   <SecurityWarning />
                   <DemoBanner />
                   <UpdateBanner />
                   <GlobalUpdateProgressWatcher />
-                  <div class="min-h-screen bg-gray-100 dark:bg-gray-900 text-gray-800 dark:text-gray-200 font-sans py-4 sm:py-6">
-                    <AppLayout
-                      connected={connected}
-                      reconnecting={reconnecting}
-                      dataUpdated={dataUpdated}
-                      lastUpdateText={lastUpdateText}
-                      versionInfo={versionInfo}
-                      hasAuth={hasAuth}
-                      needsAuth={needsAuth}
-                      proxyAuthInfo={proxyAuthInfo}
-                      handleLogout={handleLogout}
-                      state={state}
-                    >
-                      {props.children}
-                    </AppLayout>
+                  {/* Main layout container - flexbox to allow AI panel to push content */}
+                  <div class="flex h-screen overflow-hidden">
+                    {/* Main content area - shrinks when AI panel is open, scrolls independently */}
+                    <div class={`flex-1 min-w-0 overflow-y-auto bg-gray-100 dark:bg-gray-900 text-gray-800 dark:text-gray-200 font-sans py-4 sm:py-6 transition-all duration-300`}>
+                      <AppLayout
+                        connected={connected}
+                        reconnecting={reconnecting}
+                        dataUpdated={dataUpdated}
+                        lastUpdateText={lastUpdateText}
+                        versionInfo={versionInfo}
+                        hasAuth={hasAuth}
+                        needsAuth={needsAuth}
+                        proxyAuthInfo={proxyAuthInfo}
+                        handleLogout={handleLogout}
+                        state={state}
+                      >
+                        {props.children}
+                      </AppLayout>
+                    </div>
+                    {/* AI Panel - slides in from right, pushes content */}
+                    <AIChat onClose={() => aiChatStore.close()} />
                   </div>
                   <ToastContainer />
                   <TokenRevealDialog />
+                  {/* Fixed AI Assistant Button - always visible on the side when AI is enabled */}
+                  <Show when={aiChatStore.enabled !== false && !aiChatStore.isOpen}>
+                    {/* This component only shows when chat is closed */}
+                    <button
+                      type="button"
+                      onClick={() => aiChatStore.toggle()}
+                      class="fixed right-0 top-1/2 -translate-y-1/2 z-40 flex items-center gap-1.5 pl-2 pr-1.5 py-3 rounded-l-xl bg-gradient-to-r from-purple-600 to-purple-700 text-white shadow-lg hover:from-purple-700 hover:to-purple-800 transition-all duration-200 group"
+                      title={aiChatStore.context.context?.name ? `AI Assistant - ${aiChatStore.context.context.name}` : 'AI Assistant (⌘K)'}
+                      aria-label="Expand AI Assistant"
+                    >
+                      {/* Double chevron left - expand */}
+                      <svg
+                        class="h-4 w-4 flex-shrink-0"
+                        fill="none"
+                        stroke="currentColor"
+                        viewBox="0 0 24 24"
+                        stroke-width="2"
+                      >
+                        <path
+                          stroke-linecap="round"
+                          stroke-linejoin="round"
+                          d="M11 19l-7-7 7-7M18 19l-7-7 7-7"
+                        />
+                      </svg>
+                      {/* Context indicator - shows count when items are in context */}
+                      <Show when={aiChatStore.contextItems.length > 0}>
+                        <span class="min-w-[18px] h-[18px] px-1 flex items-center justify-center text-[10px] font-bold bg-green-500 text-white rounded-full">
+                          {aiChatStore.contextItems.length}
+                        </span>
+                      </Show>
+                    </button>
+                  </Show>
                   <TooltipRoot />
                 </DarkModeContext.Provider>
               </WebSocketContext.Provider>
@@ -776,13 +884,16 @@ function App() {
       <Route path="/proxmox" component={() => <Navigate href="/proxmox/overview" />} />
       <Route path="/proxmox/overview" component={DashboardView} />
       <Route path="/proxmox/storage" component={StorageComponent} />
+      <Route path="/proxmox/ceph" component={CephPage} />
       <Route path="/proxmox/replication" component={Replication} />
       <Route path="/proxmox/mail" component={MailGateway} />
       <Route path="/proxmox/backups" component={Backups} />
       <Route path="/storage" component={() => <Navigate href="/proxmox/storage" />} />
       <Route path="/backups" component={() => <Navigate href="/proxmox/backups" />} />
       <Route path="/docker" component={DockerRoute} />
+      <Route path="/kubernetes" component={KubernetesRoute} />
       <Route path="/hosts" component={HostsRoute} />
+
       <Route path="/servers" component={() => <Navigate href="/hosts" />} />
       <Route path="/alerts/*" component={AlertsPage} />
       <Route path="/settings/*" component={SettingsRoute} />
@@ -797,13 +908,12 @@ function ConnectionStatusBadge(props: {
 }) {
   return (
     <div
-      class={`group status text-xs rounded-full flex items-center justify-center transition-all duration-500 ease-in-out px-1.5 ${
-        props.connected()
-          ? 'connected bg-green-200 dark:bg-green-700 text-green-700 dark:text-green-300 min-w-6 h-6 group-hover:px-3'
-          : props.reconnecting()
-            ? 'reconnecting bg-yellow-200 dark:bg-yellow-700 text-yellow-700 dark:text-yellow-300 py-1'
-            : 'disconnected bg-gray-200 dark:bg-gray-700 text-gray-700 dark:text-gray-300 min-w-6 h-6 group-hover:px-3'
-      } ${props.class ?? ''}`}
+      class={`group status text-xs rounded-full flex items-center justify-center transition-all duration-500 ease-in-out px-1.5 ${props.connected()
+        ? 'connected bg-green-200 dark:bg-green-700 text-green-700 dark:text-green-300 min-w-6 h-6 group-hover:px-3'
+        : props.reconnecting()
+          ? 'reconnecting bg-yellow-200 dark:bg-yellow-700 text-yellow-700 dark:text-yellow-300 py-1'
+          : 'disconnected bg-gray-200 dark:bg-gray-700 text-gray-700 dark:text-gray-300 min-w-6 h-6 group-hover:px-3'
+        } ${props.class ?? ''}`}
     >
       <Show when={props.reconnecting()}>
         <svg class="animate-spin h-3 w-3 flex-shrink-0" fill="none" viewBox="0 0 24 24">
@@ -829,11 +939,10 @@ function ConnectionStatusBadge(props: {
         <span class="h-2.5 w-2.5 rounded-full bg-gray-600 dark:bg-gray-400 flex-shrink-0"></span>
       </Show>
       <span
-        class={`whitespace-nowrap overflow-hidden transition-all duration-500 ${
-          props.connected() || (!props.connected() && !props.reconnecting())
-            ? 'max-w-0 group-hover:max-w-[100px] group-hover:ml-2 group-hover:mr-1 opacity-0 group-hover:opacity-100'
-            : 'max-w-[100px] ml-1 opacity-100'
-        }`}
+        class={`whitespace-nowrap overflow-hidden transition-all duration-500 ${props.connected() || (!props.connected() && !props.reconnecting())
+          ? 'max-w-0 group-hover:max-w-[100px] group-hover:ml-2 group-hover:mr-1 opacity-0 group-hover:opacity-100'
+          : 'max-w-[100px] ml-1 opacity-100'
+          }`}
       >
         {props.connected()
           ? 'Connected'
@@ -904,6 +1013,7 @@ function AppLayout(props: {
     const path = location.pathname;
     if (path.startsWith('/proxmox')) return 'proxmox';
     if (path.startsWith('/docker')) return 'docker';
+    if (path.startsWith('/kubernetes')) return 'kubernetes';
     if (path.startsWith('/hosts')) return 'hosts';
     if (path.startsWith('/servers')) return 'hosts'; // Legacy redirect
     if (path.startsWith('/alerts')) return 'alerts';
@@ -911,6 +1021,7 @@ function AppLayout(props: {
     return 'proxmox';
   };
   const hasDockerHosts = createMemo(() => (props.state().dockerHosts?.length ?? 0) > 0);
+  const hasKubernetesClusters = createMemo(() => (props.state().kubernetesClusters?.length ?? 0) > 0);
   const hasHosts = createMemo(() => (props.state().hosts?.length ?? 0) > 0);
   const hasProxmoxHosts = createMemo(
     () =>
@@ -925,6 +1036,12 @@ function AppLayout(props: {
     }
   });
 
+  createEffect(() => {
+    if (hasKubernetesClusters()) {
+      markPlatformSeen('kubernetes');
+    }
+  });
+
   createEffect(() => {
     if (hasProxmoxHosts()) {
       markPlatformSeen('proxmox');
@@ -938,7 +1055,7 @@ function AppLayout(props: {
   });
 
   const platformTabs = createMemo(() => {
-    return [
+    const allPlatforms = [
       {
         id: 'proxmox' as const,
         label: 'Proxmox',
@@ -950,6 +1067,7 @@ function AppLayout(props: {
         icon: (
           <ProxmoxIcon class="w-4 h-4 shrink-0" />
         ),
+        alwaysShow: true, // Proxmox is the default, always show
       },
       {
         id: 'docker' as const,
@@ -962,6 +1080,20 @@ function AppLayout(props: {
         icon: (
           <BoxesIcon class="w-4 h-4 shrink-0" />
         ),
+        alwaysShow: true, // Docker is commonly used, keep visible
+      },
+      {
+        id: 'kubernetes' as const,
+        label: 'Kubernetes',
+        route: '/kubernetes',
+        settingsRoute: '/settings/agents',
+        tooltip: 'Monitor Kubernetes clusters and workloads',
+        enabled: hasKubernetesClusters(),
+        live: hasKubernetesClusters(),
+        icon: (
+          <NetworkIcon class="w-4 h-4 shrink-0" />
+        ),
+        alwaysShow: false, // Only show when clusters exist
       },
       {
         id: 'hosts' as const,
@@ -974,8 +1106,12 @@ function AppLayout(props: {
         icon: (
           <MonitorIcon class="w-4 h-4 shrink-0" />
         ),
+        alwaysShow: true, // Hosts is commonly used, keep visible
       },
     ];
+
+    // Filter out platforms that should be hidden when not configured
+    return allPlatforms.filter(p => p.alwaysShow || p.enabled);
   });
 
   const utilityTabs = createMemo(() => {
@@ -1074,6 +1210,8 @@ function AppLayout(props: {
         <div class="header-controls flex items-center gap-2 justify-end sm:col-start-3 sm:col-end-4 sm:w-auto sm:justify-end sm:justify-self-end">
           <Show when={props.hasAuth() && !props.needsAuth()}>
             <div class="flex items-center gap-2">
+              {/* AI Patrol Status Indicator */}
+              <AIStatusIndicator />
               <Show when={props.proxyAuthInfo()?.username}>
                 <span class="text-xs px-2 py-1 text-gray-600 dark:text-gray-400">
                   {props.proxyAuthInfo()?.username}
@@ -1168,12 +1306,12 @@ function AppLayout(props: {
                 const baseClasses =
                   'tab relative px-2 sm:px-3 py-1.5 text-xs sm:text-sm font-medium flex items-center gap-1 sm:gap-1.5 rounded-t border border-transparent transition-colors whitespace-nowrap cursor-pointer';
 
-              const className = () => {
-                if (isActive()) {
-                  return `${baseClasses} bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-400 border-gray-300 dark:border-gray-700 border-b border-b-white dark:border-b-gray-800 shadow-sm font-semibold`;
-                }
-                return `${baseClasses} text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60`;
-              };
+                const className = () => {
+                  if (isActive()) {
+                    return `${baseClasses} bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-400 border-gray-300 dark:border-gray-700 border-b border-b-white dark:border-b-gray-800 shadow-sm font-semibold`;
+                  }
+                  return `${baseClasses} text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60`;
+                };
 
                 return (
                   <div
diff --git a/frontend-modern/src/api/__tests__/charts.test.ts b/frontend-modern/src/api/__tests__/charts.test.ts
new file mode 100644
index 0000000..79d1411
--- /dev/null
+++ b/frontend-modern/src/api/__tests__/charts.test.ts
@@ -0,0 +1,259 @@
+/**
+ * Tests for Charts API types and interface
+ */
+import { describe, expect, it } from 'vitest';
+import type { ChartData, ChartsResponse, TimeRange, MetricPoint, ChartStats } from '@/api/charts';
+
+// Note: We test the types and interfaces here since the actual API calls
+// require a running backend. Integration tests should cover the full flow.
+
+describe('Charts API Types', () => {
+    describe('TimeRange', () => {
+        it('supports all expected time range values', () => {
+            const validRanges: TimeRange[] = ['5m', '15m', '30m', '1h', '4h', '12h', '24h', '7d'];
+
+            validRanges.forEach(range => {
+                // This is a compile-time check - if it compiles, the types are correct
+                const r: TimeRange = range;
+                expect(r).toBe(range);
+            });
+        });
+    });
+
+    describe('MetricPoint', () => {
+        it('has required timestamp and value properties', () => {
+            const point: MetricPoint = {
+                timestamp: 1733700000000,
+                value: 45.7,
+            };
+
+            expect(point.timestamp).toBe(1733700000000);
+            expect(point.value).toBe(45.7);
+        });
+    });
+
+    describe('ChartData', () => {
+        it('supports all metric types', () => {
+            const data: ChartData = {
+                cpu: [{ timestamp: 1000, value: 50 }],
+                memory: [{ timestamp: 1000, value: 60 }],
+                disk: [{ timestamp: 1000, value: 70 }],
+                diskread: [{ timestamp: 1000, value: 1000000 }],
+                diskwrite: [{ timestamp: 1000, value: 500000 }],
+                netin: [{ timestamp: 1000, value: 2000000 }],
+                netout: [{ timestamp: 1000, value: 1500000 }],
+            };
+
+            expect(data.cpu).toHaveLength(1);
+            expect(data.memory![0].value).toBe(60);
+        });
+
+        it('allows partial data (all fields optional)', () => {
+            const cpuOnly: ChartData = {
+                cpu: [{ timestamp: 1000, value: 25 }],
+            };
+
+            expect(cpuOnly.cpu).toBeDefined();
+            expect(cpuOnly.memory).toBeUndefined();
+            expect(cpuOnly.disk).toBeUndefined();
+        });
+
+        it('allows empty arrays for metrics', () => {
+            const emptyData: ChartData = {
+                cpu: [],
+                memory: [],
+            };
+
+            expect(emptyData.cpu).toHaveLength(0);
+        });
+    });
+
+    describe('ChartsResponse', () => {
+        it('includes all required fields', () => {
+            const response: ChartsResponse = {
+                data: {},
+                nodeData: {},
+                storageData: {},
+                timestamp: Date.now(),
+                stats: { oldestDataTimestamp: Date.now() - 3600000 },
+            };
+
+            expect(response.data).toBeDefined();
+            expect(response.nodeData).toBeDefined();
+            expect(response.timestamp).toBeGreaterThan(0);
+        });
+
+        it('supports optional dockerData field', () => {
+            const response: ChartsResponse = {
+                data: {},
+                nodeData: {},
+                storageData: {},
+                dockerData: {
+                    'container-abc123': {
+                        cpu: [{ timestamp: 1000, value: 10 }],
+                        memory: [{ timestamp: 1000, value: 20 }],
+                    },
+                },
+                timestamp: Date.now(),
+                stats: { oldestDataTimestamp: Date.now() },
+            };
+
+            expect(response.dockerData).toBeDefined();
+            expect(response.dockerData!['container-abc123'].cpu).toHaveLength(1);
+        });
+
+        it('supports optional dockerHostData field', () => {
+            const response: ChartsResponse = {
+                data: {},
+                nodeData: {},
+                storageData: {},
+                dockerHostData: {
+                    'host-1': {
+                        cpu: [{ timestamp: 1000, value: 30 }],
+                        memory: [{ timestamp: 1000, value: 40 }],
+                    },
+                },
+                timestamp: Date.now(),
+                stats: { oldestDataTimestamp: Date.now() },
+            };
+
+            expect(response.dockerHostData).toBeDefined();
+            expect(response.dockerHostData!['host-1'].cpu![0].value).toBe(30);
+        });
+
+        it('supports optional guestTypes field for VM/container type mapping', () => {
+            const response: ChartsResponse = {
+                data: {
+                    'vm-100': { cpu: [{ timestamp: 1000, value: 50 }] },
+                    'ct-200': { cpu: [{ timestamp: 1000, value: 30 }] },
+                },
+                nodeData: {},
+                storageData: {},
+                guestTypes: {
+                    'vm-100': 'vm',
+                    'ct-200': 'container',
+                },
+                timestamp: Date.now(),
+                stats: { oldestDataTimestamp: Date.now() },
+            };
+
+            expect(response.guestTypes!['vm-100']).toBe('vm');
+            expect(response.guestTypes!['ct-200']).toBe('container');
+        });
+
+        it('contains all data sources for comprehensive monitoring', () => {
+            const comprehensiveResponse: ChartsResponse = {
+                // VM and container metrics (legacy format)
+                data: {
+                    'pve1/qemu/100': {
+                        cpu: [{ timestamp: 1000, value: 45 }],
+                        memory: [{ timestamp: 1000, value: 55 }],
+                        disk: [{ timestamp: 1000, value: 30 }],
+                    },
+                    'pve1/lxc/200': {
+                        cpu: [{ timestamp: 1000, value: 15 }],
+                    },
+                },
+                // Node metrics
+                nodeData: {
+                    'pve1': {
+                        cpu: [{ timestamp: 1000, value: 35 }],
+                        memory: [{ timestamp: 1000, value: 65 }],
+                    },
+                },
+                // Storage metrics
+                storageData: {
+                    'local-zfs': {
+                        disk: [{ timestamp: 1000, value: 50 }],
+                    },
+                },
+                // Docker container metrics
+                dockerData: {
+                    'abc123': {
+                        cpu: [{ timestamp: 1000, value: 5 }],
+                        memory: [{ timestamp: 1000, value: 128 }],
+                    },
+                },
+                // Docker host metrics
+                dockerHostData: {
+                    'docker-host-1': {
+                        cpu: [{ timestamp: 1000, value: 25 }],
+                    },
+                },
+                // Guest type mapping
+                guestTypes: {
+                    'pve1/qemu/100': 'vm',
+                    'pve1/lxc/200': 'container',
+                },
+                timestamp: 1733700000000,
+                stats: {
+                    oldestDataTimestamp: 1733696400000, // 1 hour ago
+                },
+            };
+
+            expect(Object.keys(comprehensiveResponse.data)).toHaveLength(2);
+            expect(Object.keys(comprehensiveResponse.nodeData)).toHaveLength(1);
+            expect(Object.keys(comprehensiveResponse.dockerData!)).toHaveLength(1);
+            expect(Object.keys(comprehensiveResponse.dockerHostData!)).toHaveLength(1);
+        });
+    });
+
+    describe('ChartStats', () => {
+        it('contains oldest data timestamp for data availability', () => {
+            const stats: ChartStats = {
+                oldestDataTimestamp: 1733696400000,
+            };
+
+            expect(stats.oldestDataTimestamp).toBe(1733696400000);
+        });
+
+        it('can be used to determine available data range', () => {
+            const now = Date.now();
+            const oneHourAgo = now - 3600000;
+
+            const stats: ChartStats = {
+                oldestDataTimestamp: oneHourAgo,
+            };
+
+            const availableRangeMs = now - stats.oldestDataTimestamp;
+            expect(availableRangeMs).toBeCloseTo(3600000, -2); // Allow 100ms tolerance
+        });
+    });
+});
+
+describe('Time Range to Milliseconds Conversion', () => {
+    // This tests the concept matching metricsHistory.ts timeRangeToMs
+    function timeRangeToMs(range: TimeRange): number {
+        switch (range) {
+            case '5m': return 5 * 60 * 1000;
+            case '15m': return 15 * 60 * 1000;
+            case '30m': return 30 * 60 * 1000;
+            case '1h': return 60 * 60 * 1000;
+            case '4h': return 4 * 60 * 60 * 1000;
+            case '12h': return 12 * 60 * 60 * 1000;
+            case '24h': return 24 * 60 * 60 * 1000;
+            case '7d': return 7 * 24 * 60 * 60 * 1000;
+            default: return 60 * 60 * 1000;
+        }
+    }
+
+    const expectedValues: [TimeRange, number][] = [
+        ['5m', 300000],
+        ['15m', 900000],
+        ['30m', 1800000],
+        ['1h', 3600000],
+        ['4h', 14400000],
+        ['12h', 43200000],
+        ['24h', 86400000],
+        ['7d', 604800000],
+    ];
+
+    it.each(expectedValues)('converts %s to %d ms', (range, expectedMs) => {
+        expect(timeRangeToMs(range)).toBe(expectedMs);
+    });
+
+    it('defaults to 1 hour for unknown range', () => {
+        // @ts-expect-error - Testing invalid input
+        expect(timeRangeToMs('invalid')).toBe(3600000);
+    });
+});
diff --git a/frontend-modern/src/api/ai.ts b/frontend-modern/src/api/ai.ts
new file mode 100644
index 0000000..5c3e690
--- /dev/null
+++ b/frontend-modern/src/api/ai.ts
@@ -0,0 +1,417 @@
+import { apiFetchJSON, apiFetch } from '@/utils/apiClient';
+import { logger } from '@/utils/logger';
+import type {
+  AISettings,
+  AISettingsUpdateRequest,
+  AITestResult,
+  AIExecuteRequest,
+  AIExecuteResponse,
+  AIStreamEvent,
+  AICostSummary,
+} from '@/types/ai';
+import type {
+  PatternsResponse,
+  PredictionsResponse,
+  CorrelationsResponse,
+  ChangesResponse,
+  BaselinesResponse,
+} from '@/types/aiIntelligence';
+
+export class AIAPI {
+  private static baseUrl = '/api';
+
+  // Get AI settings
+  static async getSettings(): Promise<AISettings> {
+    return apiFetchJSON(`${this.baseUrl}/settings/ai`) as Promise<AISettings>;
+  }
+
+  // Update AI settings
+  static async updateSettings(settings: AISettingsUpdateRequest): Promise<AISettings> {
+    return apiFetchJSON(`${this.baseUrl}/settings/ai/update`, {
+      method: 'PUT',
+      body: JSON.stringify(settings),
+    }) as Promise<AISettings>;
+  }
+
+  // Test AI connection
+  static async testConnection(): Promise<AITestResult> {
+    return apiFetchJSON(`${this.baseUrl}/ai/test`, {
+      method: 'POST',
+    }) as Promise<AITestResult>;
+  }
+
+  // Test a specific provider connection
+  static async testProvider(provider: string): Promise<{ success: boolean; message: string; provider: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/test/${provider}`, {
+      method: 'POST',
+    }) as Promise<{ success: boolean; message: string; provider: string }>;
+  }
+
+  // Get available models from the AI provider
+  static async getModels(): Promise<{ models: { id: string; name: string; description?: string }[]; error?: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/models`) as Promise<{ models: { id: string; name: string; description?: string }[]; error?: string }>;
+  }
+
+  // Get AI cost/usage summary
+  static async getCostSummary(days = 30): Promise<AICostSummary> {
+    return apiFetchJSON(`${this.baseUrl}/ai/cost/summary?days=${days}`) as Promise<AICostSummary>;
+  }
+
+  // Reset AI usage history (admin-only)
+  static async resetCostHistory(): Promise<{ ok: boolean; backup_file?: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/cost/reset`, {
+      method: 'POST',
+      body: JSON.stringify({}),
+    }) as Promise<{ ok: boolean; backup_file?: string }>;
+  }
+
+  static async exportCostHistory(days = 30, format: 'json' | 'csv' = 'csv'): Promise<Response> {
+    return apiFetch(`${this.baseUrl}/ai/cost/export?days=${days}&format=${format}`, { method: 'GET' });
+  }
+
+  // ============================================
+  // AI Intelligence API - Patterns, Predictions, Correlations
+  // ============================================
+
+  // Get detected failure patterns
+  static async getPatterns(resourceId?: string): Promise<PatternsResponse> {
+    const params = resourceId ? `?resource_id=${encodeURIComponent(resourceId)}` : '';
+    return apiFetchJSON(`${this.baseUrl}/ai/intelligence/patterns${params}`) as Promise<PatternsResponse>;
+  }
+
+  // Get failure predictions
+  static async getPredictions(resourceId?: string): Promise<PredictionsResponse> {
+    const params = resourceId ? `?resource_id=${encodeURIComponent(resourceId)}` : '';
+    return apiFetchJSON(`${this.baseUrl}/ai/intelligence/predictions${params}`) as Promise<PredictionsResponse>;
+  }
+
+  // Get resource correlations
+  static async getCorrelations(resourceId?: string): Promise<CorrelationsResponse> {
+    const params = resourceId ? `?resource_id=${encodeURIComponent(resourceId)}` : '';
+    return apiFetchJSON(`${this.baseUrl}/ai/intelligence/correlations${params}`) as Promise<CorrelationsResponse>;
+  }
+
+  // Get recent infrastructure changes
+  static async getRecentChanges(hours = 24): Promise<ChangesResponse> {
+    return apiFetchJSON(`${this.baseUrl}/ai/intelligence/changes?hours=${hours}`) as Promise<ChangesResponse>;
+  }
+
+  // Get learned baselines
+  static async getBaselines(resourceId?: string): Promise<BaselinesResponse> {
+    const params = resourceId ? `?resource_id=${encodeURIComponent(resourceId)}` : '';
+    return apiFetchJSON(`${this.baseUrl}/ai/intelligence/baselines${params}`) as Promise<BaselinesResponse>;
+  }
+
+
+  // Start OAuth flow for Claude Pro/Max subscription
+  // Returns the authorization URL to redirect the user to
+  static async startOAuth(): Promise<{ auth_url: string; state: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/oauth/start`, {
+      method: 'POST',
+    }) as Promise<{ auth_url: string; state: string }>;
+  }
+
+  // Exchange manually-pasted authorization code for tokens
+  static async exchangeOAuthCode(code: string, state: string): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/oauth/exchange`, {
+      method: 'POST',
+      body: JSON.stringify({ code, state }),
+    }) as Promise<{ success: boolean; message: string }>;
+  }
+
+  // Disconnect OAuth and clear tokens
+  static async disconnectOAuth(): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON(`${this.baseUrl}/ai/oauth/disconnect`, {
+      method: 'POST',
+    }) as Promise<{ success: boolean; message: string }>;
+  }
+
+
+  // Execute an AI prompt
+  static async execute(request: AIExecuteRequest): Promise<AIExecuteResponse> {
+    return apiFetchJSON(`${this.baseUrl}/ai/execute`, {
+      method: 'POST',
+      body: JSON.stringify(request),
+    }) as Promise<AIExecuteResponse>;
+  }
+
+  // Run a single command (for approved commands)
+  static async runCommand(request: {
+    command: string;
+    target_type: string;
+    target_id: string;
+    run_on_host: boolean;
+    vmid?: string;
+    target_host?: string; // Explicit host for command routing
+  }): Promise<{ output: string; success: boolean; error?: string }> {
+    // Ensure run_on_host is explicitly a boolean (not undefined)
+    const sanitizedRequest = {
+      command: request.command,
+      target_type: request.target_type,
+      target_id: request.target_id,
+      run_on_host: Boolean(request.run_on_host),
+      ...(request.vmid ? { vmid: String(request.vmid) } : {}),
+      ...(request.target_host ? { target_host: request.target_host } : {}),
+    };
+    const body = JSON.stringify(sanitizedRequest);
+    logger.debug('[AI] runCommand', { request: sanitizedRequest, bodyLength: body.length });
+    return apiFetchJSON(`${this.baseUrl}/ai/run-command`, {
+      method: 'POST',
+      body,
+    }) as Promise<{ output: string; success: boolean; error?: string }>;
+  }
+
+
+  // Investigate an alert with AI (one-click investigation)
+  static async investigateAlert(
+    request: {
+      alert_id: string;
+      resource_id: string;
+      resource_name: string;
+      resource_type: string;
+      alert_type: string;
+      level: string;
+      value: number;
+      threshold: number;
+      message: string;
+      duration: string;
+      node?: string;
+      vmid?: number;
+    },
+    onEvent: (event: AIStreamEvent) => void,
+    signal?: AbortSignal
+  ): Promise<void> {
+    logger.debug('[AI] Starting alert investigation', request);
+
+    const response = await apiFetch(`${this.baseUrl}/ai/investigate-alert`, {
+      method: 'POST',
+      body: JSON.stringify(request),
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'text/event-stream',
+      },
+      signal,
+    });
+
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(text || `Request failed with status ${response.status}`);
+    }
+
+    const reader = response.body?.getReader();
+    if (!reader) {
+      throw new Error('No response body');
+    }
+
+    const decoder = new TextDecoder();
+    let buffer = '';
+    // 5 minutes timeout - Opus models can take a long time
+    const STREAM_TIMEOUT_MS = 300000;
+    let lastEventTime = Date.now();
+
+    try {
+      for (;;) {
+        if (Date.now() - lastEventTime > STREAM_TIMEOUT_MS) {
+          console.warn('[AI] Alert investigation stream timeout');
+          break;
+        }
+
+        const readPromise = reader.read();
+        const timeoutPromise = new Promise<never>((_, reject) => {
+          setTimeout(() => reject(new Error('Read timeout')), STREAM_TIMEOUT_MS);
+        });
+
+        let result: ReadableStreamReadResult<Uint8Array>;
+        try {
+          result = await Promise.race([readPromise, timeoutPromise]);
+        } catch (e) {
+          if ((e as Error).message === 'Read timeout') break;
+          throw e;
+        }
+
+        const { done, value } = result;
+        if (done) break;
+
+        lastEventTime = Date.now();
+        buffer += decoder.decode(value, { stream: true });
+
+        const normalizedBuffer = buffer.replace(/\r\n/g, '\n');
+        const messages = normalizedBuffer.split('\n\n');
+        buffer = messages.pop() || '';
+
+        for (const message of messages) {
+          if (!message.trim() || message.trim().startsWith(':')) continue;
+
+          const dataLines = message.split('\n').filter((line) => line.startsWith('data: '));
+          for (const line of dataLines) {
+            try {
+              const jsonStr = line.slice(6);
+              if (!jsonStr.trim()) continue;
+              const data = JSON.parse(jsonStr);
+              onEvent(data as AIStreamEvent);
+            } catch (e) {
+              console.error('[AI] Failed to parse investigation event:', e);
+            }
+          }
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
+
+  // Execute an AI prompt with streaming
+  // Returns an abort function to cancel the request
+  static async executeStream(
+    request: AIExecuteRequest,
+    onEvent: (event: AIStreamEvent) => void,
+    signal?: AbortSignal
+  ): Promise<void> {
+    logger.debug('[AI SSE] Starting streaming request', request);
+
+    const response = await apiFetch(`${this.baseUrl}/ai/execute/stream`, {
+      method: 'POST',
+      body: JSON.stringify(request),
+      headers: {
+        'Content-Type': 'application/json',
+        'Accept': 'text/event-stream',
+      },
+      signal,
+    });
+
+    logger.debug('[AI SSE] Response status', { status: response.status, contentType: response.headers.get('content-type') });
+
+    if (!response.ok) {
+      const text = await response.text();
+      logger.error('[AI SSE] Request failed', text);
+      throw new Error(text || `Request failed with status ${response.status}`);
+    }
+
+    const reader = response.body?.getReader();
+    if (!reader) {
+      logger.error('[AI SSE] No response body');
+      throw new Error('No response body');
+    }
+
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let lastEventTime = Date.now();
+    let receivedComplete = false;
+    let receivedDone = false;
+
+    // Timeout to detect stalled streams (5 minutes - Opus models can take a long time)
+    const STREAM_TIMEOUT_MS = 300000;
+
+    logger.debug('[AI SSE] Starting to read stream');
+
+    try {
+      for (;;) {
+        // Check for stream timeout
+        if (Date.now() - lastEventTime > STREAM_TIMEOUT_MS) {
+          logger.warn('[AI SSE] Stream timeout', { seconds: STREAM_TIMEOUT_MS / 1000 });
+          break;
+        }
+
+        // Create a promise with timeout for the read operation
+        const readPromise = reader.read();
+        const timeoutPromise = new Promise<never>((_, reject) => {
+          setTimeout(() => reject(new Error('Read timeout')), STREAM_TIMEOUT_MS);
+        });
+
+        let result: ReadableStreamReadResult<Uint8Array>;
+        try {
+          result = await Promise.race([readPromise, timeoutPromise]);
+        } catch (e) {
+          if ((e as Error).message === 'Read timeout') {
+            logger.warn('[AI SSE] Read timeout, ending stream');
+            break;
+          }
+          throw e;
+        }
+
+        const { done, value } = result;
+        if (done) {
+          logger.debug('[AI SSE] Stream ended normally');
+          break;
+        }
+
+        lastEventTime = Date.now();
+        const chunk = decoder.decode(value, { stream: true });
+
+        // Log chunk info only if it's not just a heartbeat
+        if (!chunk.includes(': heartbeat')) {
+          logger.debug('[AI SSE] Received chunk', { bytes: chunk.length });
+        }
+
+        buffer += chunk;
+
+        // Process complete SSE messages (separated by double newlines)
+        // Handle both \n\n and \r\n\r\n for cross-platform compatibility
+        const normalizedBuffer = buffer.replace(/\r\n/g, '\n');
+        const messages = normalizedBuffer.split('\n\n');
+        buffer = messages.pop() || ''; // Keep incomplete message in buffer
+
+        for (const message of messages) {
+          // Skip empty messages and heartbeat comments
+          if (!message.trim() || message.trim().startsWith(':')) {
+            if (message.includes('heartbeat')) {
+              logger.debug('[AI SSE] Received heartbeat');
+            }
+            continue;
+          }
+
+          // Parse SSE message (can have multiple lines, look for data: prefix)
+          const dataLines = message.split('\n').filter(line => line.startsWith('data: '));
+          for (const line of dataLines) {
+            try {
+              const jsonStr = line.slice(6); // Remove 'data: ' prefix
+              if (!jsonStr.trim()) continue;
+
+              const data = JSON.parse(jsonStr);
+              logger.debug('[AI SSE] Parsed event', { type: data.type, data });
+
+              // Track completion events
+              if (data.type === 'complete') {
+                receivedComplete = true;
+              }
+              if (data.type === 'done') {
+                receivedDone = true;
+              }
+
+              onEvent(data as AIStreamEvent);
+            } catch (e) {
+              logger.error('[AI SSE] Failed to parse event', { error: e, line });
+            }
+          }
+        }
+      }
+
+      // Process any remaining buffer content
+      if (buffer.trim() && buffer.trim().startsWith('data: ')) {
+        try {
+          const jsonStr = buffer.slice(6);
+          if (jsonStr.trim()) {
+            const data = JSON.parse(jsonStr);
+            logger.debug('[AI SSE] Parsed final buffered event', { type: data.type });
+            onEvent(data as AIStreamEvent);
+            if (data.type === 'complete') receivedComplete = true;
+            if (data.type === 'done') receivedDone = true;
+          }
+        } catch {
+          logger.warn('[AI SSE] Could not parse remaining buffer', { preview: buffer.substring(0, 100) });
+        }
+      }
+
+      // If we ended without receiving a done event, send a synthetic one
+      // This ensures the UI properly clears the streaming state
+      if (!receivedDone) {
+        logger.warn('[AI SSE] Stream ended without done event, sending synthetic done');
+        onEvent({ type: 'done', data: undefined });
+      }
+
+    } finally {
+      reader.releaseLock();
+      logger.debug('[AI SSE] Reader released', { receivedComplete, receivedDone });
+    }
+  }
+}
diff --git a/frontend-modern/src/api/charts.ts b/frontend-modern/src/api/charts.ts
new file mode 100644
index 0000000..0c0dd9e
--- /dev/null
+++ b/frontend-modern/src/api/charts.ts
@@ -0,0 +1,151 @@
+/**
+ * Charts API
+ *
+ * Fetches historical metrics data from the backend for sparkline visualizations.
+ * The backend maintains proper historical data with 30s sample intervals.
+ */
+
+import { apiFetchJSON } from '@/utils/apiClient';
+
+// Types matching backend response format
+export interface MetricPoint {
+    timestamp: number;  // Unix timestamp in milliseconds
+    value: number;
+}
+
+// Extended metric point with min/max for aggregated data
+export interface AggregatedMetricPoint {
+    timestamp: number;  // Unix timestamp in milliseconds
+    value: number;
+    min: number;
+    max: number;
+}
+
+export interface ChartData {
+    cpu?: MetricPoint[];
+    memory?: MetricPoint[];
+    disk?: MetricPoint[];
+    diskread?: MetricPoint[];
+    diskwrite?: MetricPoint[];
+    netin?: MetricPoint[];
+    netout?: MetricPoint[];
+}
+
+export interface ChartStats {
+    oldestDataTimestamp: number;
+}
+
+export interface ChartsResponse {
+    data: Record<string, ChartData>;       // VM/Container data keyed by ID
+    nodeData: Record<string, ChartData>;   // Node data keyed by ID
+    storageData: Record<string, ChartData>; // Storage data keyed by ID
+    dockerData?: Record<string, ChartData>; // Docker container data keyed by container ID
+    dockerHostData?: Record<string, ChartData>; // Docker host data keyed by host ID
+    guestTypes?: Record<string, 'vm' | 'container'>; // Maps guest ID to type
+    timestamp: number;
+    stats: ChartStats;
+}
+
+// Persistent metrics history types (SQLite-backed, longer retention)
+export type HistoryTimeRange = '1h' | '6h' | '12h' | '24h' | '7d' | '30d' | '90d';
+export type ResourceType = 'node' | 'guest' | 'storage' | 'docker' | 'dockerHost';
+
+export interface MetricsHistoryParams {
+    resourceType: ResourceType;
+    resourceId: string;
+    metric?: string;  // Optional: 'cpu', 'memory', 'disk', etc. Omit for all metrics
+    range?: HistoryTimeRange;  // Default: '24h'
+}
+
+export interface SingleMetricHistoryResponse {
+    resourceType: string;
+    resourceId: string;
+    metric: string;
+    range: string;
+    start: number;  // Unix timestamp in milliseconds
+    end: number;    // Unix timestamp in milliseconds
+    points: AggregatedMetricPoint[];
+}
+
+export interface AllMetricsHistoryResponse {
+    resourceType: string;
+    resourceId: string;
+    range: string;
+    start: number;  // Unix timestamp in milliseconds
+    end: number;    // Unix timestamp in milliseconds
+    metrics: Record<string, AggregatedMetricPoint[]>;
+}
+
+export interface MetricsStoreStats {
+    enabled: boolean;
+    dbPath?: string;
+    dbSize?: number;
+    rawCount?: number;
+    minuteCount?: number;
+    hourlyCount?: number;
+    dailyCount?: number;
+    totalWrites?: number;
+    bufferSize?: number;
+    lastFlush?: string;
+    lastRollup?: string;
+    lastRetention?: string;
+    error?: string;
+}
+
+export type TimeRange = '5m' | '15m' | '30m' | '1h' | '4h' | '12h' | '24h' | '7d';
+
+export class ChartsAPI {
+    private static baseUrl = '/api';
+
+    /**
+     * Fetch historical chart data for all resources
+     * @param range Time range to fetch (default: 1h)
+     */
+    static async getCharts(range: TimeRange = '1h'): Promise<ChartsResponse> {
+        const url = `${this.baseUrl}/charts?range=${range}`;
+        return apiFetchJSON(url);
+    }
+
+    /**
+     * Fetch storage-specific chart data
+     * @param rangeMinutes Range in minutes (default: 60)
+     */
+    static async getStorageCharts(rangeMinutes: number = 60): Promise<Record<string, {
+        usage?: MetricPoint[];
+        used?: MetricPoint[];
+        total?: MetricPoint[];
+        avail?: MetricPoint[];
+    }>> {
+        const url = `${this.baseUrl}/storage/charts?range=${rangeMinutes}`;
+        return apiFetchJSON(url);
+    }
+
+    /**
+     * Fetch persistent metrics history for a specific resource
+     * This uses the SQLite-backed store with longer retention (up to 90 days)
+     * @param params Query parameters
+     */
+    static async getMetricsHistory(params: MetricsHistoryParams): Promise<SingleMetricHistoryResponse | AllMetricsHistoryResponse> {
+        const searchParams = new URLSearchParams({
+            resourceType: params.resourceType,
+            resourceId: params.resourceId,
+        });
+        if (params.metric) {
+            searchParams.set('metric', params.metric);
+        }
+        if (params.range) {
+            searchParams.set('range', params.range);
+        }
+        const url = `${this.baseUrl}/metrics-store/history?${searchParams.toString()}`;
+        return apiFetchJSON(url);
+    }
+
+    /**
+     * Fetch statistics about the persistent metrics store
+     */
+    static async getMetricsStoreStats(): Promise<MetricsStoreStats> {
+        const url = `${this.baseUrl}/metrics-store/stats`;
+        return apiFetchJSON(url);
+    }
+}
+
diff --git a/frontend-modern/src/api/dockerMetadata.ts b/frontend-modern/src/api/dockerMetadata.ts
index ab3d4ab..2b9d929 100644
--- a/frontend-modern/src/api/dockerMetadata.ts
+++ b/frontend-modern/src/api/dockerMetadata.ts
@@ -6,6 +6,7 @@ export interface DockerMetadata {
   customUrl?: string;
   description?: string;
   tags?: string[];
+  notes?: string[]; // User annotations for AI context
 }
 
 export class DockerMetadataAPI {
diff --git a/frontend-modern/src/api/guestMetadata.ts b/frontend-modern/src/api/guestMetadata.ts
index 3a29ecb..b3d1971 100644
--- a/frontend-modern/src/api/guestMetadata.ts
+++ b/frontend-modern/src/api/guestMetadata.ts
@@ -6,6 +6,7 @@ export interface GuestMetadata {
   customUrl?: string;
   description?: string;
   tags?: string[];
+  notes?: string[]; // User annotations for AI context
 }
 
 export class GuestMetadataAPI {
diff --git a/frontend-modern/src/api/hostMetadata.ts b/frontend-modern/src/api/hostMetadata.ts
new file mode 100644
index 0000000..73026c0
--- /dev/null
+++ b/frontend-modern/src/api/hostMetadata.ts
@@ -0,0 +1,42 @@
+// Host Metadata API
+import { apiFetchJSON } from '@/utils/apiClient';
+
+export interface HostMetadata {
+    id: string;
+    customUrl?: string;
+    description?: string;
+    tags?: string[];
+    notes?: string[]; // User annotations for AI context
+}
+
+export class HostMetadataAPI {
+    private static baseUrl = '/api/hosts/metadata';
+
+    // Get metadata for a specific host
+    static async getMetadata(hostId: string): Promise<HostMetadata> {
+        return apiFetchJSON(`${this.baseUrl}/${encodeURIComponent(hostId)}`);
+    }
+
+    // Get all host metadata
+    static async getAllMetadata(): Promise<Record<string, HostMetadata>> {
+        return apiFetchJSON(this.baseUrl);
+    }
+
+    // Update metadata for a host
+    static async updateMetadata(
+        hostId: string,
+        metadata: Partial<HostMetadata>,
+    ): Promise<HostMetadata> {
+        return apiFetchJSON(`${this.baseUrl}/${encodeURIComponent(hostId)}`, {
+            method: 'PUT',
+            body: JSON.stringify(metadata),
+        });
+    }
+
+    // Delete metadata for a host
+    static async deleteMetadata(hostId: string): Promise<void> {
+        await apiFetchJSON(`${this.baseUrl}/${encodeURIComponent(hostId)}`, {
+            method: 'DELETE',
+        });
+    }
+}
diff --git a/frontend-modern/src/api/monitoring.ts b/frontend-modern/src/api/monitoring.ts
index 04a140e..6a9eaf4 100644
--- a/frontend-modern/src/api/monitoring.ts
+++ b/frontend-modern/src/api/monitoring.ts
@@ -216,6 +216,191 @@ export class MonitoringAPI {
     }
   }
 
+  static async deleteKubernetesCluster(clusterId: string): Promise<DeleteKubernetesClusterResponse> {
+    const url = `${this.baseUrl}/agents/kubernetes/clusters/${encodeURIComponent(clusterId)}`;
+
+    const response = await apiFetch(url, {
+      method: 'DELETE',
+    });
+
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {};
+      }
+
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_jsonErr) {
+            // ignore parse errors
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+
+    if (response.status === 204) {
+      return {};
+    }
+
+    const text = await response.text();
+    if (!text?.trim()) {
+      return {};
+    }
+
+    try {
+      return JSON.parse(text) as DeleteKubernetesClusterResponse;
+    } catch (err) {
+      throw new Error((err as Error).message || 'Failed to parse delete kubernetes cluster response');
+    }
+  }
+
+  static async unhideKubernetesCluster(clusterId: string): Promise<void> {
+    const url = `${this.baseUrl}/agents/kubernetes/clusters/${encodeURIComponent(clusterId)}/unhide`;
+
+    const response = await apiFetch(url, {
+      method: 'PUT',
+    });
+
+    if (!response.ok) {
+      if (response.status === 404) {
+        return;
+      }
+
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_jsonErr) {
+            // ignore parse errors
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+  }
+
+  static async markKubernetesClusterPendingUninstall(clusterId: string): Promise<void> {
+    const url = `${this.baseUrl}/agents/kubernetes/clusters/${encodeURIComponent(clusterId)}/pending-uninstall`;
+
+    const response = await apiFetch(url, {
+      method: 'PUT',
+    });
+
+    if (!response.ok) {
+      if (response.status === 404) {
+        return;
+      }
+
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_jsonErr) {
+            // ignore parse errors
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+  }
+
+  static async setKubernetesClusterDisplayName(clusterId: string, displayName: string): Promise<void> {
+    const url = `${this.baseUrl}/agents/kubernetes/clusters/${encodeURIComponent(clusterId)}/display-name`;
+
+    const response = await apiFetch(url, {
+      method: 'PUT',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ displayName }),
+    });
+
+    if (!response.ok) {
+      if (response.status === 404) {
+        throw new Error('Kubernetes cluster not found');
+      }
+
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_jsonErr) {
+            // ignore parse errors
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+  }
+
+  static async allowKubernetesClusterReenroll(clusterId: string): Promise<void> {
+    const url = `${this.baseUrl}/agents/kubernetes/clusters/${encodeURIComponent(clusterId)}/allow-reenroll`;
+
+    const response = await apiFetch(url, {
+      method: 'POST',
+    });
+
+    if (!response.ok) {
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_err) {
+            // ignore parse error
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+  }
+
   static async deleteHostAgent(hostId: string): Promise<void> {
     if (!hostId) {
       throw new Error('Host ID is required to remove a host agent.');
@@ -313,3 +498,9 @@ export interface DeleteDockerHostResponse {
   message?: string;
   command?: DockerHostCommand;
 }
+
+export interface DeleteKubernetesClusterResponse {
+  success?: boolean;
+  clusterId?: string;
+  message?: string;
+}
diff --git a/frontend-modern/src/api/patrol.ts b/frontend-modern/src/api/patrol.ts
new file mode 100644
index 0000000..b927a51
--- /dev/null
+++ b/frontend-modern/src/api/patrol.ts
@@ -0,0 +1,379 @@
+/**
+ * AI Patrol API client
+ * Provides access to background AI monitoring findings and status
+ */
+
+import { apiFetchJSON } from '@/utils/apiClient';
+
+export type FindingSeverity = 'info' | 'watch' | 'warning' | 'critical';
+export type FindingCategory = 'performance' | 'capacity' | 'reliability' | 'backup' | 'security' | 'general';
+
+export interface Finding {
+    id: string;
+    severity: FindingSeverity;
+    category: FindingCategory;
+    resource_id: string;
+    resource_name: string;
+    resource_type: string; // node, vm, container, docker_host, docker_container, storage, pbs, host_raid
+    node?: string;
+    title: string;
+    description: string;
+    recommendation?: string;
+    evidence?: string;
+    detected_at: string;
+    last_seen_at: string;
+    resolved_at?: string;
+    auto_resolved: boolean;
+    acknowledged_at?: string;
+    snoozed_until?: string; // Finding hidden until this time
+    alert_id?: string;
+    // User feedback fields (LLM memory system)
+    dismissed_reason?: 'not_an_issue' | 'expected_behavior' | 'will_fix_later';
+    user_note?: string;
+    times_raised: number;
+    suppressed: boolean;
+}
+
+export interface FindingsSummary {
+    critical: number;
+    warning: number;
+    watch: number;
+    info: number;
+}
+
+export interface PatrolStatus {
+    running: boolean;
+    enabled: boolean;
+    last_patrol_at?: string;
+    last_deep_analysis_at?: string;
+    next_patrol_at?: string;
+    last_duration_ms: number;
+    resources_checked: number;
+    findings_count: number;
+    error_count: number;
+    healthy: boolean;
+    interval_ms: number; // Patrol interval in milliseconds
+    summary: FindingsSummary;
+}
+
+export interface PatrolRunRecord {
+    id: string;
+    started_at: string;
+    completed_at: string;
+    duration_ms: number;
+    type: string; // Always 'patrol' now (kept for backwards compat with old records)
+    resources_checked: number;
+    // Breakdown by resource type
+    nodes_checked: number;
+    guests_checked: number;
+    docker_checked: number;
+    storage_checked: number;
+    hosts_checked: number;
+    pbs_checked: number;
+    // Findings from this run
+    new_findings: number;
+    existing_findings: number;
+    resolved_findings: number;
+    findings_summary: string;
+    finding_ids: string[];
+    error_count: number;
+    status: 'healthy' | 'issues_found' | 'critical' | 'error';
+    // AI Analysis details
+    ai_analysis?: string;    // The AI's raw response/analysis
+    input_tokens?: number;   // Tokens sent to AI
+    output_tokens?: number;  // Tokens received from AI
+}
+
+/**
+ * Get the current AI patrol status
+ */
+export async function getPatrolStatus(): Promise<PatrolStatus> {
+    const resp = await fetch('/api/ai/patrol/status', {
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get patrol status: ${resp.status}`);
+    }
+    return resp.json();
+}
+
+/**
+ * Get all active findings from the patrol service
+ * Optionally filter by resource ID
+ */
+export async function getFindings(resourceId?: string): Promise<Finding[]> {
+    const url = resourceId
+        ? `/api/ai/patrol/findings?resource_id=${encodeURIComponent(resourceId)}`
+        : '/api/ai/patrol/findings';
+
+    const resp = await fetch(url, {
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get findings: ${resp.status}`);
+    }
+    return resp.json();
+}
+
+/**
+ * Trigger an immediate patrol run
+ */
+export async function forcePatrol(deep: boolean = false): Promise<{ success: boolean; message: string }> {
+    const url = deep ? '/api/ai/patrol/run?deep=true' : '/api/ai/patrol/run';
+    return apiFetchJSON(url, { method: 'POST' });
+}
+
+/**
+ * Get AI findings history including resolved findings
+ * @param startTime Optional ISO timestamp to filter findings from
+ */
+export async function getFindingsHistory(startTime?: string): Promise<Finding[]> {
+    const url = startTime
+        ? `/api/ai/patrol/history?start_time=${encodeURIComponent(startTime)}`
+        : '/api/ai/patrol/history';
+    const resp = await fetch(url, {
+        method: 'GET',
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get findings history: ${resp.status}`);
+    }
+    return resp.json();
+}
+
+/**
+ * Get the history of patrol check runs
+ * @param limit Maximum number of records to return (default: 50, max: 100)
+ */
+export async function getPatrolRunHistory(limit?: number): Promise<PatrolRunRecord[]> {
+    const url = limit
+        ? `/api/ai/patrol/runs?limit=${limit}`
+        : '/api/ai/patrol/runs';
+    const resp = await fetch(url, {
+        method: 'GET',
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get patrol run history: ${resp.status}`);
+    }
+    return resp.json();
+}
+
+/**
+ * Acknowledge a finding (marks as seen but keeps visible, like alert acknowledgement)
+ * Finding will auto-resolve when the underlying condition clears.
+ */
+export async function acknowledgeFinding(findingId: string): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON('/api/ai/patrol/acknowledge', {
+        method: 'POST',
+        body: JSON.stringify({ finding_id: findingId }),
+    });
+}
+
+/**
+ * Snooze a finding for a specified duration
+ * @param findingId The ID of the finding to snooze
+ * @param durationHours Duration in hours (e.g., 1, 24, 168 for 7 days)
+ */
+export async function snoozeFinding(findingId: string, durationHours: number): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON('/api/ai/patrol/snooze', {
+        method: 'POST',
+        body: JSON.stringify({ finding_id: findingId, duration_hours: durationHours }),
+    });
+}
+
+/**
+ * Manually resolve a finding (mark as fixed)
+ * @param findingId The ID of the finding to resolve
+ */
+export async function resolveFinding(findingId: string): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON('/api/ai/patrol/resolve', {
+        method: 'POST',
+        body: JSON.stringify({ finding_id: findingId }),
+    });
+}
+
+/**
+ * Dismiss a finding with a reason (LLM memory feature)
+ * The LLM will be told not to re-raise this issue in future patrols.
+ * @param findingId The ID of the finding to dismiss
+ * @param reason One of: "not_an_issue", "expected_behavior", "will_fix_later"
+ * @param note Optional freeform explanation
+ */
+export async function dismissFinding(
+    findingId: string,
+    reason: 'not_an_issue' | 'expected_behavior' | 'will_fix_later',
+    note?: string
+): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON('/api/ai/patrol/dismiss', {
+        method: 'POST',
+        body: JSON.stringify({ finding_id: findingId, reason, note }),
+    });
+}
+
+/**
+ * Permanently suppress a finding type (LLM memory feature)
+ * The LLM will never re-raise this type of finding for this resource.
+ * @param findingId The ID of the finding to suppress
+ */
+export async function suppressFinding(findingId: string): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON('/api/ai/patrol/suppress', {
+        method: 'POST',
+        body: JSON.stringify({ finding_id: findingId }),
+    });
+}
+
+/**
+ * Severity color mapping for UI
+ */
+export const severityColors: Record<FindingSeverity, { bg: string; text: string; border: string }> = {
+    critical: { bg: 'rgba(220, 38, 38, 0.15)', text: '#ef4444', border: 'rgba(220, 38, 38, 0.3)' },
+    warning: { bg: 'rgba(234, 179, 8, 0.15)', text: '#eab308', border: 'rgba(234, 179, 8, 0.3)' },
+    watch: { bg: 'rgba(59, 130, 246, 0.15)', text: '#3b82f6', border: 'rgba(59, 130, 246, 0.3)' },
+    info: { bg: 'rgba(107, 114, 128, 0.15)', text: '#9ca3af', border: 'rgba(107, 114, 128, 0.3)' },
+};
+
+/**
+ * Category labels for UI
+ */
+export const categoryLabels: Record<FindingCategory, string> = {
+    performance: 'Performance',
+    capacity: 'Capacity',
+    reliability: 'Reliability',
+    backup: 'Backup',
+    security: 'Security',
+    general: 'General',
+};
+
+/**
+ * Format a timestamp for display
+ */
+export function formatTimestamp(ts: string): string {
+    const date = new Date(ts);
+    const now = new Date();
+    const diffMs = now.getTime() - date.getTime();
+    const diffMins = Math.floor(diffMs / 60000);
+    const diffHours = Math.floor(diffMs / 3600000);
+    const diffDays = Math.floor(diffMs / 86400000);
+
+    if (diffMins < 1) return 'just now';
+    if (diffMins < 60) return `${diffMins}m ago`;
+    if (diffHours < 24) return `${diffHours}h ago`;
+    if (diffDays < 7) return `${diffDays}d ago`;
+    return date.toLocaleDateString();
+}
+
+/**
+ * Event types from patrol stream
+ */
+export interface PatrolStreamEvent {
+    type: 'start' | 'content' | 'thinking' | 'phase' | 'complete' | 'error';
+    content?: string;
+    phase?: string;
+    tokens?: number;
+}
+
+/**
+ * Subscribe to live patrol stream via SSE
+ * Returns an unsubscribe function
+ */
+export function subscribeToPatrolStream(
+    onEvent: (event: PatrolStreamEvent) => void,
+    onError?: (error: Error) => void
+): () => void {
+    const eventSource = new EventSource('/api/ai/patrol/stream', { withCredentials: true });
+
+    eventSource.onmessage = (event) => {
+        try {
+            const data = JSON.parse(event.data) as PatrolStreamEvent;
+            onEvent(data);
+        } catch (e) {
+            console.error('Failed to parse patrol stream event:', e);
+        }
+    };
+
+    eventSource.onerror = () => {
+        if (onError) {
+            onError(new Error('Patrol stream connection error'));
+        }
+        eventSource.close();
+    };
+
+    // Return unsubscribe function
+    return () => {
+        eventSource.close();
+    };
+}
+
+// === Suppression Rules ===
+
+export interface SuppressionRule {
+    id: string;
+    resource_id?: string;   // Empty means "any resource"
+    resource_name?: string; // Human-readable name
+    category?: FindingCategory; // Empty means "any category"
+    description: string;    // User's reason
+    created_at: string;
+    created_from: 'finding' | 'manual';
+    finding_id?: string;    // Original finding ID if created from dismissal
+}
+
+/**
+ * Get all suppression rules (both manual and from dismissed findings)
+ */
+export async function getSuppressionRules(): Promise<SuppressionRule[]> {
+    const resp = await fetch('/api/ai/patrol/suppressions', {
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get suppression rules: ${resp.status}`);
+    }
+    return resp.json();
+}
+
+/**
+ * Create a new manual suppression rule
+ * @param resourceId Resource ID (empty for "any resource")
+ * @param resourceName Human-readable name for display
+ * @param category Category (empty for "any category")
+ * @param description User's reason for the rule
+ */
+export async function addSuppressionRule(
+    resourceId: string,
+    resourceName: string,
+    category: FindingCategory | '',
+    description: string
+): Promise<{ success: boolean; message: string; rule: SuppressionRule }> {
+    return apiFetchJSON('/api/ai/patrol/suppressions', {
+        method: 'POST',
+        body: JSON.stringify({
+            resource_id: resourceId,
+            resource_name: resourceName,
+            category: category,
+            description: description,
+        }),
+    });
+}
+
+/**
+ * Delete a suppression rule
+ * @param ruleId The ID of the rule to delete
+ */
+export async function deleteSuppressionRule(ruleId: string): Promise<{ success: boolean; message: string }> {
+    return apiFetchJSON(`/api/ai/patrol/suppressions/${encodeURIComponent(ruleId)}`, {
+        method: 'DELETE',
+    });
+}
+
+/**
+ * Get all dismissed/suppressed findings
+ */
+export async function getDismissedFindings(): Promise<Finding[]> {
+    const resp = await fetch('/api/ai/patrol/dismissed', {
+        credentials: 'include',
+    });
+    if (!resp.ok) {
+        throw new Error(`Failed to get dismissed findings: ${resp.status}`);
+    }
+    return resp.json();
+}
diff --git a/frontend-modern/src/components/AI/AIChat.tsx b/frontend-modern/src/components/AI/AIChat.tsx
new file mode 100644
index 0000000..8632781
--- /dev/null
+++ b/frontend-modern/src/components/AI/AIChat.tsx
@@ -0,0 +1,1549 @@
+import { Component, Show, createSignal, For, createEffect, createMemo, onMount, Switch, Match } from 'solid-js';
+import { marked } from 'marked';
+import DOMPurify from 'dompurify';
+import { AIAPI } from '@/api/ai';
+import { notificationStore } from '@/stores/notifications';
+import { logger } from '@/utils/logger';
+import { aiChatStore } from '@/stores/aiChat';
+import { useWebSocket } from '@/App';
+import { GuestNotes } from './GuestNotes';
+import type {
+  AIToolExecution,
+  AIStreamEvent,
+  AIStreamToolStartData,
+  AIStreamToolEndData,
+  AIStreamCompleteData,
+  AIStreamApprovalNeededData,
+  ModelInfo,
+} from '@/types/ai';
+
+// Provider display names for grouped model selection
+const PROVIDER_DISPLAY_NAMES: Record<string, string> = {
+  anthropic: 'Anthropic',
+  openai: 'OpenAI',
+  deepseek: 'DeepSeek',
+  ollama: 'Ollama',
+};
+
+// Parse provider from model ID (format: "provider:model-name")
+function getProviderFromModelId(modelId: string): string {
+  const colonIndex = modelId.indexOf(':');
+  if (colonIndex > 0) {
+    return modelId.substring(0, colonIndex);
+  }
+  // Default detection for models without prefix
+  if (modelId.includes('claude') || modelId.includes('opus') || modelId.includes('sonnet') || modelId.includes('haiku')) {
+    return 'anthropic';
+  }
+  if (modelId.includes('gpt') || modelId.includes('o1') || modelId.includes('o3')) {
+    return 'openai';
+  }
+  if (modelId.includes('deepseek')) {
+    return 'deepseek';
+  }
+  return 'ollama';
+}
+
+// Group models by provider for grouped rendering
+function groupModelsByProvider(models: ModelInfo[]): Map<string, ModelInfo[]> {
+  const grouped = new Map<string, ModelInfo[]>();
+
+  for (const model of models) {
+    const provider = getProviderFromModelId(model.id);
+    const existing = grouped.get(provider) || [];
+    existing.push(model);
+    grouped.set(provider, existing);
+  }
+
+  return grouped;
+}
+
+// Configure marked for safe rendering
+marked.setOptions({
+  breaks: true, // Convert \n to <br>
+  gfm: true, // GitHub Flavored Markdown
+});
+
+let domPurifyConfigured = false;
+const configureDOMPurify = () => {
+  if (domPurifyConfigured) return;
+  domPurifyConfigured = true;
+
+  DOMPurify.addHook('afterSanitizeAttributes', (node) => {
+    const element = node as Element | null;
+    if (!element || element.tagName !== 'A') return;
+    element.setAttribute('target', '_blank');
+    element.setAttribute('rel', 'noopener noreferrer');
+  });
+};
+
+// Helper to render markdown safely with XSS protection
+// LLM output should NEVER be trusted - always sanitize before rendering as HTML
+const renderMarkdown = (content: string): string => {
+  try {
+    configureDOMPurify();
+    const rawHtml = marked.parse(content) as string;
+    // Sanitize to prevent XSS from malicious LLM output or injected content
+    return DOMPurify.sanitize(rawHtml, {
+      // Allow common formatting tags but block scripts, iframes, etc.
+      ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'b', 'i', 'u', 'code', 'pre', 'blockquote',
+        'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'a', 'hr', 'table',
+        'thead', 'tbody', 'tr', 'th', 'td', 'span', 'div'],
+      ALLOWED_ATTR: ['href', 'target', 'rel', 'class'],
+      // Force all links to open in new tab and prevent opener attacks
+      ADD_ATTR: ['target', 'rel'],
+    });
+  } catch {
+    // If parsing fails, escape HTML entities as fallback
+    return content.replace(/[&<>"']/g, (char) => {
+      const entities: Record<string, string> = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
+      return entities[char] || char;
+    });
+  }
+};
+
+// Helper to sanitize thinking/reasoning content for display
+// Removes raw network errors with IP addresses that are not user-friendly
+const sanitizeThinking = (content: string): string => {
+  // Replace raw TCP connection details like "write tcp 192.168.0.123:7655->192.168.0.134:58004: i/o timeout"
+  // with friendlier messages
+  let sanitized = content.replace(
+    /write tcp [\d.:]+->[\d.:]+: i\/o timeout/g,
+    'connection timed out'
+  );
+  sanitized = sanitized.replace(
+    /read tcp [\d.:]+: i\/o timeout/g,
+    'connection timed out'
+  );
+  sanitized = sanitized.replace(
+    /dial tcp [\d.:]+: connection refused/g,
+    'connection refused'
+  );
+  // Replace "failed to send command: <raw error>" patterns
+  sanitized = sanitized.replace(
+    /failed to send command: write tcp [\d.:->\s]+/g,
+    'failed to send command: connection error'
+  );
+  return sanitized;
+};
+
+// In-progress tool execution (before completion)
+interface PendingTool {
+  name: string;
+  input: string;
+}
+
+// Command awaiting user approval
+interface PendingApproval {
+  command: string;
+  toolId: string;
+  toolName: string;
+  runOnHost: boolean;
+  targetHost?: string; // Explicit host for command routing
+  isExecuting?: boolean;
+}
+
+
+// Unified event type for chronological display
+interface StreamDisplayEvent {
+  type: 'thinking' | 'tool' | 'content';
+  thinking?: string;
+  tool?: AIToolExecution;
+  content?: string; // Text content chunk for chronological display
+}
+
+interface Message {
+  id: string;
+  role: 'user' | 'assistant';
+  content: string;
+  thinking?: string; // DeepSeek reasoning/thinking content (accumulated)
+  thinkingChunks?: string[]; // Thinking split into sequential blocks for display
+  streamEvents?: StreamDisplayEvent[]; // All events in chronological order
+  timestamp: Date;
+  model?: string;
+  tokens?: { input: number; output: number };
+  toolCalls?: AIToolExecution[];
+  // Streaming state
+  isStreaming?: boolean;
+  pendingTools?: PendingTool[];
+  pendingApprovals?: PendingApproval[];
+}
+
+interface AIChatProps {
+  onClose: () => void;
+}
+
+// Extract guest name from context if available
+const getGuestName = (context?: Record<string, unknown>): string | undefined => {
+  if (!context) return undefined;
+  if (typeof context.guestName === 'string') return context.guestName;
+  if (typeof context.name === 'string') return context.name;
+  return undefined;
+};
+
+export const AIChat: Component<AIChatProps> = (props) => {
+  // Read all context from store for proper SolidJS reactivity
+  const isOpen = () => aiChatStore.isOpen;
+  const context = () => aiChatStore.context;
+  const targetType = () => context().targetType;
+  const targetId = () => context().targetId;
+  const contextData = () => context().context;
+  const initialPrompt = () => context().initialPrompt;
+  const findingId = () => context().findingId; // For resolving patrol findings
+
+  // Access WebSocket state for listing available resources
+  const wsContext = useWebSocket();
+
+  // Context picker state
+  const [showContextPicker, setShowContextPicker] = createSignal(false);
+  const [contextSearch, setContextSearch] = createSignal('');
+
+  // Build a list of all available resources for the context picker
+  const availableResources = createMemo(() => {
+    const resources: Array<{
+      id: string;
+      type: 'vm' | 'container' | 'node' | 'host' | 'docker';
+      name: string;
+      status: string;
+      node?: string;
+      data: Record<string, unknown>;
+    }> = [];
+
+    // Add VMs
+    for (const vm of wsContext.state.vms || []) {
+      resources.push({
+        id: `${vm.node}-${vm.vmid}`,
+        type: 'vm',
+        name: vm.name || `VM ${vm.vmid}`,
+        status: vm.status,
+        node: vm.node,
+        data: {
+          guest_id: `${vm.node}-${vm.vmid}`,
+          guest_name: vm.name,
+          guest_vmid: vm.vmid,
+          guest_type: 'qemu',
+          guest_node: vm.node,
+          guest_status: vm.status,
+          cpu: vm.cpu,
+          mem: vm.memory?.used,
+          maxmem: vm.memory?.total,
+          disk: vm.disk?.used,
+          maxdisk: vm.disk?.total,
+        },
+      });
+    }
+
+    // Add containers
+    for (const ct of wsContext.state.containers || []) {
+      resources.push({
+        id: `${ct.node}-${ct.vmid}`,
+        type: 'container',
+        name: ct.name || `CT ${ct.vmid}`,
+        status: ct.status,
+        node: ct.node,
+        data: {
+          guest_id: `${ct.node}-${ct.vmid}`,
+          guest_name: ct.name,
+          guest_vmid: ct.vmid,
+          guest_type: 'lxc',
+          guest_node: ct.node,
+          guest_status: ct.status,
+          cpu: ct.cpu,
+          mem: ct.memory?.used,
+          maxmem: ct.memory?.total,
+          disk: ct.disk?.used,
+          maxdisk: ct.disk?.total,
+        },
+      });
+    }
+
+    // Add Proxmox nodes
+    for (const node of wsContext.state.nodes || []) {
+      resources.push({
+        id: `node-${node.name}`,
+        type: 'node',
+        name: node.name,
+        status: node.status,
+        data: {
+          node_name: node.name,
+          node_status: node.status,
+          cpu: node.cpu,
+          mem: node.memory?.used,
+          maxmem: node.memory?.total,
+          disk: node.disk?.used,
+          maxdisk: node.disk?.total,
+        },
+      });
+    }
+
+    // Add host agents
+    for (const host of wsContext.state.hosts || []) {
+      resources.push({
+        id: `host-${host.hostname}`,
+        type: 'host',
+        name: host.hostname,
+        status: host.status === 'online' ? 'online' : 'offline',
+        data: {
+          host_name: host.hostname,
+          host_platform: host.platform,
+          host_version: host.agentVersion,
+          connected: host.status === 'online',
+        },
+      });
+    }
+
+    return resources;
+  });
+
+  // Filtered resources based on search
+  const filteredResources = createMemo(() => {
+    const search = contextSearch().toLowerCase();
+    if (!search) return availableResources();
+    return availableResources().filter(
+      (r) =>
+        r.name.toLowerCase().includes(search) ||
+        r.type.toLowerCase().includes(search) ||
+        (r.node && r.node.toLowerCase().includes(search))
+    );
+  });
+
+  // Add a resource to context
+  const addResourceToContext = (resource: ReturnType<typeof availableResources>[number]) => {
+    aiChatStore.addContextItem(resource.type, resource.id, resource.name, resource.data);
+    setShowContextPicker(false);
+    setContextSearch('');
+  };
+
+  // Initialize messages from store (for persistence across navigation)
+  const [messages, setMessagesLocal] = createSignal<Message[]>(
+    aiChatStore.messages as Message[] || []
+  );
+  const [input, setInput] = createSignal('');
+  const [isLoading, setIsLoading] = createSignal(false);
+  const [queuedMessage, setQueuedMessage] = createSignal<string | null>(null);
+
+  // Model selection
+  const [availableModels, setAvailableModels] = createSignal<ModelInfo[]>([]);
+  const [selectedModel, setSelectedModel] = createSignal<string>(''); // Empty = use default
+  const [showModelSelector, setShowModelSelector] = createSignal(false);
+
+  let messagesEndRef: HTMLDivElement | undefined;
+  let inputRef: HTMLTextAreaElement | undefined;
+  let abortControllerRef: AbortController | null = null;
+
+  // Fetch available models on mount using the dynamic API
+  onMount(async () => {
+    try {
+      const result = await AIAPI.getModels();
+      if (result.models && result.models.length > 0) {
+        setAvailableModels(result.models.map(m => ({
+          id: m.id,
+          name: m.name || m.id,
+          description: m.description,
+        })));
+      }
+    } catch (_e) {
+      // Silently fail - models will just not be selectable
+    }
+  });
+
+  // Wrapper to sync messages to global store
+  const setMessages = (updater: Message[] | ((prev: Message[]) => Message[])) => {
+    setMessagesLocal((prev) => {
+      const newMsgs = typeof updater === 'function' ? updater(prev) : updater;
+      // Sync to global store for persistence (debounce or defer to avoid too many updates)
+      setTimeout(() => aiChatStore.setMessages(newMsgs as any), 0);
+      return newMsgs;
+    });
+  };
+
+  // Auto-scroll to bottom when new messages arrive
+  createEffect(() => {
+    if (messages().length > 0 && messagesEndRef) {
+      messagesEndRef.scrollIntoView({ behavior: 'smooth' });
+    }
+  });
+
+  // Focus input when drawer opens and register with store for keyboard shortcuts
+  createEffect(() => {
+    if (isOpen() && inputRef) {
+      setTimeout(() => inputRef?.focus(), 100);
+      aiChatStore.registerInput(inputRef);
+    } else {
+      aiChatStore.registerInput(null);
+    }
+  });
+
+  // Handle initial prompt if provided
+  createEffect(() => {
+    if (initialPrompt() && isOpen()) {
+      setInput(initialPrompt()!);
+    }
+  });
+
+  // Auto-send queued message when AI finishes processing
+  createEffect(() => {
+    const loading = isLoading();
+    const queued = queuedMessage();
+
+    // When loading finishes and we have a queued message, send it
+    if (!loading && queued) {
+      logger.info('[AIChat] AI finished, auto-sending queued message', { prompt: queued.substring(0, 50) });
+      setQueuedMessage(null);
+      // Small delay to let the UI update first
+      setTimeout(() => {
+        handleSubmit(undefined, queued);
+      }, 100);
+    }
+  });
+
+  const generateId = () => Math.random().toString(36).substring(2, 9);
+
+  // Stop/cancel the current AI request
+  const handleStop = () => {
+    if (abortControllerRef) {
+      abortControllerRef.abort();
+      abortControllerRef = null;
+    }
+    // Mark any streaming message as stopped
+    setMessages((prev) =>
+      prev.map((msg) =>
+        msg.isStreaming
+          ? { ...msg, isStreaming: false, content: msg.content || '(Stopped by user)' }
+          : msg
+      )
+    );
+    // Clear queued message when stopping - user likely doesn't want it sent
+    setQueuedMessage(null);
+    setIsLoading(false);
+  };
+
+  const handleSubmit = async (e?: Event, forcePrompt?: string) => {
+    e?.preventDefault();
+    const prompt = forcePrompt || input().trim();
+    if (!prompt) return;
+
+    // If AI is currently working, queue this message for later
+    if (isLoading() && !forcePrompt) {
+      setQueuedMessage(prompt);
+      setInput('');
+      logger.info('[AIChat] Message queued while AI is working', { prompt: prompt.substring(0, 50) });
+      return;
+    }
+
+    // IMPORTANT: Capture the current messages BEFORE adding new ones to avoid race conditions
+    // SolidJS batches updates, so messages() may not be updated synchronously
+    const previousMessages = messages();
+
+    // Build conversation history from previous messages (before we add new ones)
+    // Include tool call outputs so the AI remembers what commands were run
+    const history = previousMessages
+      .filter((m) => !m.isStreaming) // Only include completed messages
+      .filter((m) => m.content || (m.toolCalls && m.toolCalls.length > 0)) // Must have content or tool calls
+      .map((m) => {
+        let content = m.content || '';
+
+        // For assistant messages, prepend tool call outputs so AI has full context
+        if (m.role === 'assistant' && m.toolCalls && m.toolCalls.length > 0) {
+          const toolSummary = m.toolCalls
+            .map((tc) => `Command: ${tc.input}\nOutput: ${tc.output}`)
+            .join('\n\n');
+          content = toolSummary + (content ? '\n\n' + content : '');
+        }
+
+        return {
+          role: m.role,
+          content,
+        };
+      })
+      .filter((m) => m.content); // Filter out any empty messages
+
+    // Add user message
+    const userMessage: Message = {
+      id: generateId(),
+      role: 'user',
+      content: prompt,
+      timestamp: new Date(),
+    };
+    setMessages((prev) => [...prev, userMessage]);
+    setInput('');
+    setIsLoading(true);
+
+    // Create abort controller for this request
+    abortControllerRef = new AbortController();
+
+    // Create a streaming assistant message
+    const assistantId = generateId();
+    const streamingMessage: Message = {
+      id: assistantId,
+      role: 'assistant',
+      content: '',
+      timestamp: new Date(),
+      isStreaming: true,
+      pendingTools: [],
+      pendingApprovals: [],
+      toolCalls: [],
+      thinkingChunks: [],
+      streamEvents: [],
+    };
+    setMessages((prev) => [...prev, streamingMessage]);
+
+    // Safety timeout - clear streaming state if we don't get any completion event
+    // This prevents the UI from getting stuck in a streaming state
+    let lastEventTime = Date.now();
+    const SAFETY_TIMEOUT_MS = 120000; // 2 minutes
+
+    const safetyCheckInterval = setInterval(() => {
+      const timeSinceLastEvent = Date.now() - lastEventTime;
+      if (timeSinceLastEvent > SAFETY_TIMEOUT_MS) {
+        logger.warn('[AIChat] Safety timeout - forcing stream completion', { seconds: SAFETY_TIMEOUT_MS / 1000 });
+        clearInterval(safetyCheckInterval);
+        setMessages((prev) =>
+          prev.map((msg) =>
+            msg.id === assistantId && msg.isStreaming
+              ? { ...msg, isStreaming: false, content: msg.content || '(Request timed out - no response received)' }
+              : msg
+          )
+        );
+        setIsLoading(false);
+        if (abortControllerRef) {
+          abortControllerRef.abort();
+          abortControllerRef = null;
+        }
+      }
+    }, 10000); // Check every 10 seconds
+
+    try {
+      await AIAPI.executeStream(
+        {
+          prompt,
+          target_type: targetType(),
+          target_id: targetId(),
+          context: contextData(),
+          history: history.length > 0 ? history : undefined,
+          finding_id: findingId(), // Pass finding ID so AI can resolve it when fixed
+          model: selectedModel() || undefined, // Use selected model or default
+        },
+        (event: AIStreamEvent) => {
+          lastEventTime = Date.now(); // Update last event time
+          logger.debug('[AIChat] Received event', { type: event.type, event });
+          // Update the streaming message based on event type
+          setMessages((prev) =>
+            prev.map((msg) => {
+              if (msg.id !== assistantId) return msg;
+
+              switch (event.type) {
+                case 'tool_start': {
+                  const data = event.data as AIStreamToolStartData;
+                  return {
+                    ...msg,
+                    pendingTools: [...(msg.pendingTools || []), { name: data.name, input: data.input }],
+                  };
+                }
+                case 'tool_end': {
+                  const data = event.data as AIStreamToolEndData;
+                  // Remove one pending tool with matching name
+                  const pendingTools = msg.pendingTools || [];
+                  const matchingIndex = pendingTools.findIndex((t) => t.name === data.name);
+                  const updatedPending = matchingIndex >= 0
+                    ? [...pendingTools.slice(0, matchingIndex), ...pendingTools.slice(matchingIndex + 1)]
+                    : pendingTools;
+                  // Use input directly from tool_end event (authoritative)
+                  const newToolCall: AIToolExecution = {
+                    name: data.name,
+                    input: data.input,
+                    output: data.output,
+                    success: data.success,
+                  };
+                  // Add to both toolCalls and streamEvents for chronological display
+                  const events = msg.streamEvents || [];
+                  return {
+                    ...msg,
+                    pendingTools: updatedPending,
+                    toolCalls: [...(msg.toolCalls || []), newToolCall],
+                    streamEvents: [...events, { type: 'tool' as const, tool: newToolCall }],
+                  };
+                }
+                case 'thinking': {
+                  const chunk = event.data as string;
+                  if (!chunk.trim()) return msg; // Skip empty chunks
+                  // Each thinking event is a new chunk - add to both arrays
+                  const chunks = msg.thinkingChunks || [];
+                  const events = msg.streamEvents || [];
+                  return {
+                    ...msg,
+                    thinking: (msg.thinking || '') + chunk,
+                    thinkingChunks: [...chunks, chunk.trim()],
+                    streamEvents: [...events, { type: 'thinking' as const, thinking: chunk.trim() }],
+                  };
+                }
+                case 'content': {
+                  const content = event.data as string;
+                  if (!content.trim()) return msg; // Skip empty content
+                  // Track content in streamEvents for chronological display
+                  const events = msg.streamEvents || [];
+                  // Also accumulate in content for backwards compatibility / summary
+                  const existingContent = msg.content || '';
+                  const separator = existingContent && !existingContent.endsWith('\n') ? '\n\n' : '';
+                  return {
+                    ...msg,
+                    content: existingContent + separator + content,
+                    streamEvents: [...events, { type: 'content' as const, content: content.trim() }],
+                  };
+                }
+                case 'complete': {
+                  // Complete event has flat structure (model, input_tokens at top level, not under data)
+                  const completeEvent = event as unknown as AIStreamCompleteData & { type: string };
+                  return {
+                    ...msg,
+                    isStreaming: false,
+                    pendingTools: [],
+                    model: completeEvent.model,
+                    tokens: {
+                      input: completeEvent.input_tokens,
+                      output: completeEvent.output_tokens,
+                    },
+                    // Use tool_calls from complete if we missed any
+                    toolCalls: msg.toolCalls?.length ? msg.toolCalls : completeEvent.tool_calls,
+                  };
+                }
+                case 'done': {
+                  return {
+                    ...msg,
+                    isStreaming: false,
+                    pendingTools: [],
+                  };
+                }
+                case 'error': {
+                  const errorMsg = event.data as string;
+                  return {
+                    ...msg,
+                    isStreaming: false,
+                    pendingTools: [],
+                    content: `Error: ${errorMsg}`,
+                  };
+                }
+                case 'processing': {
+                  // Show processing status for multi-iteration calls
+                  const status = event.data as string;
+                  logger.debug('[AIChat] Processing', status);
+                  // Add as a pending tool for visual feedback
+                  return {
+                    ...msg,
+                    pendingTools: [{ name: 'processing', input: status }],
+                  };
+                }
+                case 'approval_needed': {
+                  const data = event.data as AIStreamApprovalNeededData;
+                  return {
+                    ...msg,
+                    pendingApprovals: [...(msg.pendingApprovals || []), {
+                      command: data.command,
+                      toolId: data.tool_id,
+                      toolName: data.tool_name,
+                      runOnHost: data.run_on_host ?? false, // Default to false if undefined
+                      targetHost: data.target_host, // Pass through the explicit routing target
+                    }],
+                  };
+                }
+
+                default:
+                  return msg;
+              }
+            })
+          );
+        },
+        abortControllerRef?.signal
+      );
+    } catch (error) {
+      // Don't show error for user-initiated abort
+      if (error instanceof Error && error.name === 'AbortError') {
+        logger.debug('[AIChat] Request aborted by user');
+        return;
+      }
+      logger.error('[AIChat] Execute failed:', error);
+      const errorMessage = error instanceof Error ? error.message : 'Failed to get AI response';
+      notificationStore.error(errorMessage);
+
+      // Update the streaming message to show error
+      setMessages((prev) =>
+        prev.map((msg) =>
+          msg.id === assistantId
+            ? { ...msg, isStreaming: false, content: `Error: ${errorMessage}` }
+            : msg
+        )
+      );
+    } finally {
+      clearInterval(safetyCheckInterval);
+      abortControllerRef = null;
+      setIsLoading(false);
+    }
+  };
+
+  const handleKeyDown = (e: KeyboardEvent) => {
+    if (e.key === 'Enter' && !e.shiftKey) {
+      e.preventDefault();
+      handleSubmit();
+    }
+  };
+
+  const clearChat = () => {
+    setMessages([]);
+    aiChatStore.clearConversation();
+  };
+
+  // Execute an approved command
+  const executeApprovedCommand = async (messageId: string, approval: PendingApproval) => {
+    // Mark as executing
+    setMessages((prev) =>
+      prev.map((m) =>
+        m.id === messageId
+          ? {
+            ...m,
+            pendingApprovals: m.pendingApprovals?.map((a) =>
+              a.toolId === approval.toolId ? { ...a, isExecuting: true } : a
+            ),
+          }
+          : m
+      )
+    );
+
+    try {
+      // Extract VMID from context if available
+      const vmid = contextData()?.vmid as string | undefined;
+
+      const result = await AIAPI.runCommand({
+        command: approval.command,
+        target_type: targetType() || '',
+        target_id: targetId() || '',
+        run_on_host: approval.runOnHost,
+        vmid,
+        target_host: approval.targetHost, // Pass through the explicit routing target
+      });
+
+
+      // Move from pending approvals to completed tool calls
+      const currentMessages = messages();
+      const targetMessage = currentMessages.find((m) => m.id === messageId);
+      const pendingCount = targetMessage?.pendingApprovals?.length || 0;
+      const remainingAfterThis = (targetMessage?.pendingApprovals?.filter((a) => a.toolId !== approval.toolId) || []).length;
+
+      logger.info('[AIChat] Approval processed', {
+        messageId,
+        toolId: approval.toolId,
+        pendingCount,
+        remainingAfterThis,
+        pendingApprovals: targetMessage?.pendingApprovals?.map(a => a.toolId)
+      });
+
+      setMessages((prev) =>
+        prev.map((m) => {
+          if (m.id !== messageId) return m;
+
+          const newToolCall: AIToolExecution = {
+            name: approval.toolName,
+            input: approval.command,
+            output: result.output || result.error || '',
+            success: result.success,
+          };
+
+          const remainingApprovals = m.pendingApprovals?.filter((a) => a.toolId !== approval.toolId) || [];
+
+          return {
+            ...m,
+            pendingApprovals: remainingApprovals,
+            toolCalls: [...(m.toolCalls || []), newToolCall],
+            // Clear the stale "I need approval" content after the last approval is processed
+            // The tool output will show the result instead
+            content: remainingApprovals.length === 0 ? '' : m.content,
+          };
+        })
+      );
+
+      // No toast for success - the tool output shows the result inline
+      // Only show error toast for failures since they might need attention
+      if (!result.success && result.error) {
+        notificationStore.error(result.error);
+      }
+
+      // After the last approval is processed, automatically continue the conversation
+      // This lets the AI analyze the command output and provide a summary
+      if (remainingAfterThis === 0) {
+        logger.info('[AIChat] Last approval processed, triggering auto-continuation');
+        // Small delay to let the UI update first
+        setTimeout(async () => {
+          logger.info('[AIChat] Starting auto-continuation');
+          setIsLoading(true);
+
+          // Build history including the just-executed command
+          const currentMsgs = messages();
+          logger.debug('[AIChat] Building history for continuation', { messageCount: currentMsgs.length });
+
+          const historyForContinuation = currentMsgs
+            .filter((m) => !m.isStreaming)
+            .filter((m) => m.content || (m.toolCalls && m.toolCalls.length > 0))
+            .map((m) => {
+              let content = m.content || '';
+              if (m.role === 'assistant' && m.toolCalls && m.toolCalls.length > 0) {
+                const toolSummary = m.toolCalls
+                  .map((tc) => `Command: ${tc.input}\nOutput: ${tc.output}`)
+                  .join('\n\n');
+                content = toolSummary + (content ? '\n\n' + content : '');
+              }
+              return { role: m.role, content };
+            })
+            .filter((m) => m.content);
+
+          logger.debug('[AIChat] History for continuation built', { historyLength: historyForContinuation.length });
+
+          // Add a hidden continuation prompt - the AI will see it but user won't
+          const continuationPrompt = 'Continue analyzing the command output above and provide a summary.';
+
+          // Create the streaming assistant response message (no visible user message)
+          // Show "Analyzing..." as initial content so user sees inline feedback
+          const assistantId = generateId();
+          const streamingMessage: Message = {
+            id: assistantId,
+            role: 'assistant',
+            content: '*Analyzing results...*',
+            timestamp: new Date(),
+            isStreaming: true,
+            pendingTools: [],
+            pendingApprovals: [],
+            toolCalls: [],
+          };
+          setMessages((prev) => [...prev, streamingMessage]);
+
+          try {
+            logger.info('[AIChat] Calling executeStream for continuation');
+            await AIAPI.executeStream(
+              {
+                prompt: continuationPrompt,
+                target_type: targetType(),
+                target_id: targetId(),
+                context: contextData(),
+                history: historyForContinuation,
+              },
+              (event: AIStreamEvent) => {
+                logger.debug('[AIChat] Continuation event received', { type: event.type });
+                setMessages((prev) =>
+                  prev.map((msg) => {
+                    if (msg.id !== assistantId) return msg;
+                    switch (event.type) {
+                      case 'content': {
+                        // Append content, but filter out the initial placeholder
+                        const content = event.data as string;
+                        const existingContent = msg.content === '*Analyzing results...*' ? '' : (msg.content || '');
+                        const separator = existingContent && !existingContent.endsWith('\n') ? '\n\n' : '';
+                        return { ...msg, content: existingContent + separator + content, isStreaming: false };
+                      }
+                      case 'done':
+                        return { ...msg, isStreaming: false };
+                      case 'error':
+                        return { ...msg, content: `Error: ${event.data}`, isStreaming: false };
+                      case 'thinking':
+                        // Ignore thinking events for now
+                        return msg;
+                      case 'processing':
+                        // Ignore processing events
+                        return msg;
+                      case 'tool_start': {
+                        const data = event.data as { name: string; input: string };
+                        return {
+                          ...msg,
+                          pendingTools: [...(msg.pendingTools || []), { name: data.name, input: data.input }],
+                        };
+                      }
+                      case 'tool_end': {
+                        const data = event.data as { name: string; input: string; output: string; success: boolean };
+                        const pendingTools = msg.pendingTools || [];
+                        const matchingIndex = pendingTools.findIndex((t) => t.name === data.name);
+                        const updatedPending = matchingIndex >= 0
+                          ? [...pendingTools.slice(0, matchingIndex), ...pendingTools.slice(matchingIndex + 1)]
+                          : pendingTools;
+                        return {
+                          ...msg,
+                          pendingTools: updatedPending,
+                          toolCalls: [...(msg.toolCalls || []), {
+                            name: data.name,
+                            input: data.input,
+                            output: data.output,
+                            success: data.success,
+                          }],
+                        };
+                      }
+                      case 'approval_needed': {
+                        const data = event.data as AIStreamApprovalNeededData;
+                        logger.info('[AIChat] Approval needed in continuation', { command: data.command });
+                        return {
+                          ...msg,
+                          pendingApprovals: [...(msg.pendingApprovals || []), {
+                            command: data.command,
+                            toolId: data.tool_id,
+                            toolName: data.tool_name,
+                            runOnHost: data.run_on_host,
+                            targetHost: data.target_host,
+                          }],
+                          isStreaming: false, // Stop streaming when approval is needed
+                        };
+                      }
+                      default:
+                        logger.debug('[AIChat] Unhandled continuation event', { type: event.type, event });
+                        return msg;
+                    }
+                  })
+                );
+              }
+            );
+            logger.info('[AIChat] Continuation executeStream completed');
+          } catch (err) {
+            logger.error('[AIChat] Failed to continue after approval:', err);
+            setMessages((prev) =>
+              prev.map((msg) =>
+                msg.id === assistantId
+                  ? { ...msg, content: 'Failed to analyze results.', isStreaming: false }
+                  : msg
+              )
+            );
+          } finally {
+            setIsLoading(false);
+          }
+        }, 200);
+      } else {
+        logger.debug('[AIChat] Approvals remaining, not triggering continuation', { remainingAfterThis });
+      }
+    } catch (error) {
+      logger.error('[AIChat] Failed to execute approved command:', error);
+      const errorMsg = error instanceof Error ? error.message : 'Failed to execute command';
+      notificationStore.error(errorMsg);
+
+      // Mark as no longer executing
+      setMessages((prev) =>
+        prev.map((m) =>
+          m.id === messageId
+            ? {
+              ...m,
+              pendingApprovals: m.pendingApprovals?.map((a) =>
+                a.toolId === approval.toolId ? { ...a, isExecuting: false } : a
+              ),
+            }
+            : m
+        )
+      );
+    }
+  };
+
+  // Panel renders as flex child, width controlled by isOpen state
+  return (
+    <div
+      class={`flex-shrink-0 h-full bg-white dark:bg-gray-900 border-l border-gray-200 dark:border-gray-700 flex flex-col transition-all duration-300 overflow-hidden ${isOpen() ? 'w-[420px]' : 'w-0 border-l-0'
+        }`}
+    >
+      <Show when={isOpen()}>
+        {/* Header */}
+        <div class="flex items-center justify-between px-4 py-3 border-b border-gray-200 dark:border-gray-700 bg-gradient-to-r from-purple-50 to-pink-50 dark:from-purple-900/20 dark:to-pink-900/20">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-purple-100 dark:bg-purple-900/40 rounded-lg">
+              <svg
+                class="w-5 h-5 text-purple-600 dark:text-purple-300"
+                fill="none"
+                stroke="currentColor"
+                viewBox="0 0 24 24"
+              >
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="1.8"
+                  d="M9.75 3.104v5.714a2.25 2.25 0 01-.659 1.591L5 14.5M9.75 3.104c-.251.023-.501.05-.75.082m.75-.082a24.301 24.301 0 014.5 0m0 0v5.714c0 .597.237 1.17.659 1.591L19.8 15.3M14.25 3.104c.251.023.501.05.75.082M19.8 15.3l-1.57.393A9.065 9.065 0 0112 15a9.065 9.065 0 00-6.23.693L5 14.5m14.8.8l1.402 1.402c1.232 1.232.65 3.318-1.067 3.611l-2.576.43a18.003 18.003 0 01-5.118 0l-2.576-.43c-1.717-.293-2.299-2.379-1.067-3.611L5 14.5"
+                />
+              </svg>
+            </div>
+            <div>
+              <h2 class="text-sm font-semibold text-gray-900 dark:text-gray-100">
+                <Show when={getGuestName(contextData())} fallback="AI Assistant">
+                  Ask AI about {getGuestName(contextData())}
+                </Show>
+              </h2>
+              <Show when={targetType()}>
+                <p class="text-xs text-gray-500 dark:text-gray-400">
+                  {targetType() === 'vm' ? 'Virtual Machine' : targetType() === 'container' ? 'LXC Container' : targetType()}
+                </p>
+              </Show>
+            </div>
+          </div>
+          <div class="flex items-center gap-2">
+            {/* Model selector dropdown */}
+            <Show when={availableModels().length > 0}>
+              <div class="relative">
+                <button
+                  onClick={() => setShowModelSelector(!showModelSelector())}
+                  class="flex items-center gap-1 px-2 py-1 text-xs text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200 rounded border border-gray-200 dark:border-gray-700 hover:border-gray-300 dark:hover:border-gray-600 bg-white dark:bg-gray-800"
+                  title="Select AI model"
+                >
+                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
+                  </svg>
+                  <span class="max-w-[80px] truncate">
+                    {selectedModel() || 'Default'}
+                  </span>
+                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                  </svg>
+                </button>
+                <Show when={showModelSelector()}>
+                  <div class="absolute right-0 top-full mt-1 w-64 bg-white dark:bg-gray-800 rounded-lg shadow-lg border border-gray-200 dark:border-gray-700 z-50 py-1">
+                    <button
+                      onClick={() => { setSelectedModel(''); setShowModelSelector(false); }}
+                      class={`w-full px-3 py-2 text-left text-sm hover:bg-gray-100 dark:hover:bg-gray-700 ${!selectedModel() ? 'bg-blue-50 dark:bg-blue-900/30' : ''}`}
+                    >
+                      <div class="font-medium text-gray-900 dark:text-gray-100">Default</div>
+                      <div class="text-xs text-gray-500 dark:text-gray-400">Use configured default model</div>
+                    </button>
+                    <For each={Array.from(groupModelsByProvider(availableModels()).entries())}>
+                      {([provider, models]) => (
+                        <>
+                          <div class="px-3 py-1.5 text-xs font-semibold text-gray-500 dark:text-gray-400 bg-gray-50 dark:bg-gray-700/50 sticky top-0">
+                            {PROVIDER_DISPLAY_NAMES[provider] || provider}
+                          </div>
+                          <For each={models}>
+                            {(model) => (
+                              <button
+                                onClick={() => { setSelectedModel(model.id); setShowModelSelector(false); }}
+                                class={`w-full px-3 py-2 text-left text-sm hover:bg-gray-100 dark:hover:bg-gray-700 ${selectedModel() === model.id ? 'bg-blue-50 dark:bg-blue-900/30' : ''}`}
+                              >
+                                <div class="font-medium text-gray-900 dark:text-gray-100">
+                                  {model.name || model.id.split(':').pop()}
+                                </div>
+                              </button>
+                            )}
+                          </For>
+                        </>
+                      )}
+                    </For>
+                  </div>
+                </Show>
+              </div>
+            </Show>
+            <button
+              onClick={clearChat}
+              class="p-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300 rounded-lg hover:bg-gray-100 dark:hover:bg-gray-800"
+              title="Clear chat"
+            >
+              <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16"
+                />
+              </svg>
+            </button>
+            <button
+              onClick={props.onClose}
+              class="p-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300 rounded-lg hover:bg-gray-100 dark:hover:bg-gray-800"
+              title="Collapse panel"
+            >
+              {/* Double chevron right - collapse */}
+              <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M13 5l7 7-7 7M6 5l7 7-7 7"
+                />
+              </svg>
+            </button>
+          </div>
+        </div>
+
+        {/* Messages Area */}
+        <div class="flex-1 overflow-y-auto p-4 space-y-4">
+          <Show when={messages().length === 0}>
+            <div class="text-center py-12 text-gray-500 dark:text-gray-400">
+              <svg
+                class="w-12 h-12 mx-auto mb-4 text-purple-200 dark:text-purple-800"
+                fill="none"
+                stroke="currentColor"
+                viewBox="0 0 24 24"
+              >
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="1.5"
+                  d="M8 10h.01M12 10h.01M16 10h.01M9 16H5a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v8a2 2 0 01-2 2h-5l-5 5v-5z"
+                />
+              </svg>
+              <Show when={getGuestName(contextData())} fallback={
+                <>
+                  <p class="text-sm font-medium mb-2">Start a conversation</p>
+                  <p class="text-xs max-w-xs mx-auto">
+                    Ask about your infrastructure, diagnose issues, or get remediation suggestions.
+                  </p>
+                </>
+              }>
+                <p class="text-sm font-medium mb-2">Ask about {getGuestName(contextData())}</p>
+                <p class="text-xs max-w-xs mx-auto mb-4">
+                  AI has access to this guest's current metrics and state. Try asking:
+                </p>
+                <div class="text-xs space-y-2 text-left max-w-xs mx-auto">
+                  <button
+                    type="button"
+                    class="w-full text-left px-3 py-2 rounded-lg bg-purple-50 dark:bg-purple-900/30 text-purple-700 dark:text-purple-300 hover:bg-purple-100 dark:hover:bg-purple-900/50 transition-colors"
+                    onClick={() => setInput('What is the current status of this guest?')}
+                  >
+                    "What is the current status of this guest?"
+                  </button>
+                  <button
+                    type="button"
+                    class="w-full text-left px-3 py-2 rounded-lg bg-purple-50 dark:bg-purple-900/30 text-purple-700 dark:text-purple-300 hover:bg-purple-100 dark:hover:bg-purple-900/50 transition-colors"
+                    onClick={() => setInput('Are there any performance concerns?')}
+                  >
+                    "Are there any performance concerns?"
+                  </button>
+                  <button
+                    type="button"
+                    class="w-full text-left px-3 py-2 rounded-lg bg-purple-50 dark:bg-purple-900/30 text-purple-700 dark:text-purple-300 hover:bg-purple-100 dark:hover:bg-purple-900/50 transition-colors"
+                    onClick={() => setInput('How can I optimize resource usage?')}
+                  >
+                    "How can I optimize resource usage?"
+                  </button>
+                </div>
+              </Show>
+            </div>
+          </Show>
+
+          <For each={messages()}>
+            {(message) => (
+              <div
+                class={`flex ${message.role === 'user' ? 'justify-end' : 'justify-start'}`}
+              >
+                <div
+                  class={`max-w-[85%] rounded-lg px-4 py-2 ${message.role === 'user'
+                    ? 'bg-purple-600 text-white'
+                    : 'bg-gray-100 dark:bg-gray-800 text-gray-900 dark:text-gray-100'
+                    }`}
+                >
+                  {/* Render all events in chronological order - thinking, tools, and content interleaved */}
+                  <Show when={message.role === 'assistant' && message.streamEvents && message.streamEvents.length > 0}>
+                    <div class="space-y-2">
+                      <For each={message.streamEvents}>
+                        {(evt) => (
+                          <Switch>
+                            <Match when={evt.type === 'tool' && evt.tool}>
+                              {/* Tool call */}
+                              <div class="rounded border border-gray-300 dark:border-gray-600 overflow-hidden">
+                                <div class={`px-2 py-1 text-xs font-medium flex items-center gap-2 ${evt.tool!.success
+                                  ? 'bg-green-100 dark:bg-green-900/30 text-green-800 dark:text-green-200'
+                                  : 'bg-red-100 dark:bg-red-900/30 text-red-800 dark:text-red-200'
+                                  }`}>
+                                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 9l3 3-3 3m5 0h3M5 20h14a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z" />
+                                  </svg>
+                                  <code class="font-mono">{evt.tool!.input}</code>
+                                </div>
+                                <Show when={evt.tool!.output}>
+                                  <pre class="px-2 py-1 text-xs font-mono bg-gray-50 dark:bg-gray-900 text-gray-700 dark:text-gray-300 overflow-x-auto max-h-32 overflow-y-auto whitespace-pre-wrap break-words">
+                                    {evt.tool!.output.length > 500 ? evt.tool!.output.substring(0, 500) + '...' : evt.tool!.output}
+                                  </pre>
+                                </Show>
+                              </div>
+                            </Match>
+                            <Match when={evt.type === 'thinking' && evt.thinking}>
+                              {/* Thinking chunk */}
+                              <div class="px-2 py-1.5 text-xs bg-blue-50 dark:bg-blue-900/20 text-gray-700 dark:text-gray-300 rounded border-l-2 border-blue-400 whitespace-pre-wrap">
+                                {sanitizeThinking(evt.thinking!.length > 500 ? evt.thinking!.substring(0, 500) + '...' : evt.thinking!)}
+                              </div>
+                            </Match>
+                            <Match when={evt.type === 'content' && evt.content}>
+                              {/* Content chunk - rendered as markdown */}
+                              {/* DOMPurify sanitizes LLM output in renderMarkdown before HTML rendering. */}
+                              <div
+                                class="text-sm prose prose-sm dark:prose-invert max-w-none prose-pre:bg-gray-800 prose-pre:text-gray-100 prose-code:text-purple-600 dark:prose-code:text-purple-400 prose-code:before:content-none prose-code:after:content-none"
+                                // eslint-disable-next-line solid/no-innerhtml -- HTML is sanitized via DOMPurify in renderMarkdown
+                                innerHTML={renderMarkdown(evt.content!)}
+                              />
+                            </Match>
+                          </Switch>
+                        )}
+                      </For>
+                    </div>
+                  </Show>
+
+                  {/* Show in-progress tool executions - at the bottom */}
+                  <Show when={message.role === 'assistant' && message.pendingTools && message.pendingTools.length > 0}>
+                    <div class="mb-3 space-y-2">
+                      <For each={message.pendingTools}>
+                        {(tool) => (
+                          <div class="rounded border border-purple-400 dark:border-purple-600 overflow-hidden">
+                            <div class="px-2 py-1 text-xs font-medium flex items-center gap-2 bg-purple-100 dark:bg-purple-900/30 text-purple-800 dark:text-purple-200">
+                              <svg class="w-3 h-3 animate-spin" fill="none" viewBox="0 0 24 24">
+                                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                              </svg>
+                              <code class="font-mono">{tool.input}</code>
+                              <span class="text-[10px] text-purple-600 dark:text-purple-400">Running...</span>
+                            </div>
+                          </div>
+                        )}
+                      </For>
+                    </div>
+                  </Show>
+
+                  {/* Show AI's response text - only if no streamEvents (fallback for old messages or messages without streaming) */}
+                  <Show when={message.content && (!message.streamEvents || message.streamEvents.length === 0)}>
+                    <div
+                      class="text-sm prose prose-sm dark:prose-invert max-w-none prose-pre:bg-gray-800 prose-pre:text-gray-100 prose-code:text-purple-600 dark:prose-code:text-purple-400 prose-code:before:content-none prose-code:after:content-none"
+                      // eslint-disable-next-line solid/no-innerhtml -- HTML is sanitized via DOMPurify in renderMarkdown
+                      innerHTML={renderMarkdown(message.content)}
+                    />
+                  </Show>
+
+                  {/* Show commands awaiting approval */}
+                  <Show when={message.role === 'assistant' && message.pendingApprovals && message.pendingApprovals.length > 0}>
+                    <div class="mt-3 space-y-2">
+                      <For each={message.pendingApprovals}>
+                        {(approval) => (
+                          <div class="rounded border border-amber-400 dark:border-amber-600 overflow-hidden">
+                            <div class="px-2 py-1.5 text-xs font-medium flex items-center gap-2 bg-amber-100 dark:bg-amber-900/30 text-amber-800 dark:text-amber-200">
+                              <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                              </svg>
+                              <span>Approval Required</span>
+                              <Show when={approval.runOnHost}>
+                                <span class="px-1 py-0.5 bg-amber-200 dark:bg-amber-800 rounded text-[10px]">HOST</span>
+                              </Show>
+                            </div>
+                            <div class="px-2 py-2 bg-amber-50 dark:bg-amber-900/20">
+                              <code class="text-xs font-mono text-gray-800 dark:text-gray-200 block mb-2">{approval.command}</code>
+                              <div class="flex gap-2">
+                                <button
+                                  type="button"
+                                  class={`flex-1 px-2 py-1 text-xs font-medium rounded transition-colors ${approval.isExecuting
+                                    ? 'bg-green-400 text-white cursor-wait'
+                                    : 'bg-green-600 hover:bg-green-700 text-white'
+                                    }`}
+                                  onClick={() => executeApprovedCommand(message.id, approval)}
+                                  disabled={approval.isExecuting}
+                                >
+                                  {approval.isExecuting ? (
+                                    <span class="flex items-center justify-center gap-1">
+                                      <svg class="w-3 h-3 animate-spin" fill="none" viewBox="0 0 24 24">
+                                        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                        <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                                      </svg>
+                                      Running...
+                                    </span>
+                                  ) : 'Run'}
+                                </button>
+                                <button
+                                  type="button"
+                                  class="flex-1 px-2 py-1 text-xs font-medium bg-gray-200 hover:bg-gray-300 dark:bg-gray-700 dark:hover:bg-gray-600 text-gray-700 dark:text-gray-200 rounded transition-colors disabled:opacity-50"
+                                  onClick={() => {
+                                    // Remove from pending approvals
+                                    setMessages((prev) =>
+                                      prev.map((m) =>
+                                        m.id === message.id
+                                          ? { ...m, pendingApprovals: m.pendingApprovals?.filter((a) => a.toolId !== approval.toolId) }
+                                          : m
+                                      )
+                                    );
+                                  }}
+                                  disabled={approval.isExecuting}
+                                >
+                                  Skip
+                                </button>
+                              </div>
+                            </div>
+                          </div>
+                        )}
+                      </For>
+                    </div>
+                  </Show>
+                  {/* Minimal footer - no model/token info shown */}
+                </div>
+              </div>
+            )}
+          </For>
+
+          <div ref={messagesEndRef} />
+        </div>
+
+        {/* Processing indicator - sticky above input */}
+        <Show when={isLoading()}>
+          <div class="px-4 py-2 bg-purple-50 dark:bg-purple-900/20 border-t border-purple-200 dark:border-purple-800 flex items-center gap-2 text-sm text-purple-700 dark:text-purple-300">
+            <svg class="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+              <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+              <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+            </svg>
+            <span>Analyzing...</span>
+          </div>
+        </Show>
+
+        {/* Input Area */}
+        <div class="border-t border-gray-200 dark:border-gray-700 p-4">
+          {/* Context section - always show with Add button */}
+          <div class="mb-3 px-3 py-2 bg-gray-50 dark:bg-gray-800/50 rounded-lg border border-gray-200 dark:border-gray-700">
+            <div class="flex items-center justify-between mb-2">
+              <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
+                <svg class="w-3.5 h-3.5 text-purple-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                </svg>
+                <span class="font-medium">
+                  Context {aiChatStore.contextItems.length > 0 ? `(${aiChatStore.contextItems.length})` : ''}
+                </span>
+              </div>
+              <div class="flex items-center gap-2">
+                <Show when={aiChatStore.contextItems.length > 0}>
+                  <button
+                    type="button"
+                    onClick={() => aiChatStore.clearAllContext()}
+                    class="text-[10px] text-gray-400 hover:text-red-500 transition-colors"
+                    title="Clear all context"
+                  >
+                    Clear all
+                  </button>
+                </Show>
+              </div>
+            </div>
+
+            {/* Context items */}
+            <div class="flex flex-wrap gap-1.5">
+              <For each={aiChatStore.contextItems}>
+                {(item) => (
+                  <span class="inline-flex items-center gap-1 px-2 py-1 text-[11px] rounded-md bg-purple-100 text-purple-800 dark:bg-purple-900/40 dark:text-purple-200">
+                    <span class="text-[9px] uppercase text-purple-500 dark:text-purple-400">{item.type}</span>
+                    <span class="font-medium">{item.name}</span>
+                    <button
+                      type="button"
+                      onClick={() => aiChatStore.removeContextItem(item.id)}
+                      class="ml-0.5 p-0.5 rounded hover:bg-purple-200 dark:hover:bg-purple-800 transition-colors"
+                      title="Remove from context"
+                    >
+                      <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                      </svg>
+                    </button>
+                  </span>
+                )}
+              </For>
+
+              {/* Add context button */}
+              <div class="relative">
+                <button
+                  type="button"
+                  onClick={() => setShowContextPicker(!showContextPicker())}
+                  class="inline-flex items-center gap-1 px-2 py-1 text-[11px] rounded-md border border-dashed border-gray-300 dark:border-gray-600 text-gray-500 dark:text-gray-400 hover:border-purple-400 hover:text-purple-600 dark:hover:border-purple-500 dark:hover:text-purple-400 transition-colors"
+                >
+                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 4v16m8-8H4" />
+                  </svg>
+                  <span>Add</span>
+                </button>
+
+                {/* Context picker dropdown */}
+                <Show when={showContextPicker()}>
+                  <div class="absolute bottom-full left-0 mb-1 w-72 max-h-80 bg-white dark:bg-gray-800 rounded-lg shadow-xl border border-gray-200 dark:border-gray-700 overflow-hidden z-50">
+                    {/* Search input */}
+                    <div class="p-2 border-b border-gray-200 dark:border-gray-700">
+                      <input
+                        type="text"
+                        value={contextSearch()}
+                        onInput={(e) => setContextSearch(e.currentTarget.value)}
+                        placeholder="Search VMs, containers, hosts..."
+                        class="w-full px-2 py-1.5 text-xs rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-900 text-gray-900 dark:text-gray-100 placeholder-gray-400 focus:outline-none focus:ring-1 focus:ring-purple-500"
+                        autofocus
+                      />
+                    </div>
+
+                    {/* Resource list */}
+                    <div class="max-h-56 overflow-y-auto">
+                      <Show when={filteredResources().length > 0} fallback={
+                        <div class="p-4 text-center text-xs text-gray-500 dark:text-gray-400">
+                          No resources found
+                        </div>
+                      }>
+                        <For each={filteredResources()}>
+                          {(resource) => {
+                            const isAlreadyAdded = () => aiChatStore.hasContextItem(resource.id);
+                            return (
+                              <button
+                                type="button"
+                                onClick={() => !isAlreadyAdded() && addResourceToContext(resource)}
+                                disabled={isAlreadyAdded()}
+                                class={`w-full px-3 py-2 text-left flex items-center gap-2 text-xs transition-colors ${isAlreadyAdded()
+                                  ? 'bg-purple-50 dark:bg-purple-900/20 text-gray-400 dark:text-gray-500 cursor-default'
+                                  : 'hover:bg-gray-50 dark:hover:bg-gray-700/50 text-gray-700 dark:text-gray-300'
+                                  }`}
+                              >
+                                {/* Type icon */}
+                                <span class={`flex-shrink-0 w-5 h-5 rounded flex items-center justify-center text-[9px] font-bold uppercase ${resource.type === 'vm' ? 'bg-blue-100 text-blue-600 dark:bg-blue-900/40 dark:text-blue-400' :
+                                  resource.type === 'container' ? 'bg-green-100 text-green-600 dark:bg-green-900/40 dark:text-green-400' :
+                                    resource.type === 'node' ? 'bg-orange-100 text-orange-600 dark:bg-orange-900/40 dark:text-orange-400' :
+                                      resource.type === 'host' ? 'bg-purple-100 text-purple-600 dark:bg-purple-900/40 dark:text-purple-400' :
+                                        'bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-400'
+                                  }`}>
+                                  {resource.type === 'vm' ? 'VM' :
+                                    resource.type === 'container' ? 'CT' :
+                                      resource.type === 'node' ? 'N' :
+                                        resource.type === 'host' ? 'H' : '?'}
+                                </span>
+
+                                {/* Name and details */}
+                                <div class="flex-1 min-w-0">
+                                  <div class="font-medium truncate">{resource.name}</div>
+                                  <Show when={resource.node}>
+                                    <div class="text-[10px] text-gray-400">{resource.node}</div>
+                                  </Show>
+                                </div>
+
+                                {/* Status indicator */}
+                                <span class={`flex-shrink-0 w-2 h-2 rounded-full ${resource.status === 'running' || resource.status === 'online' ? 'bg-green-500' :
+                                  resource.status === 'stopped' || resource.status === 'offline' ? 'bg-gray-400' :
+                                    'bg-yellow-500'
+                                  }`} />
+
+                                {/* Check if already added */}
+                                <Show when={isAlreadyAdded()}>
+                                  <svg class="w-3.5 h-3.5 text-purple-500" fill="currentColor" viewBox="0 0 20 20">
+                                    <path fill-rule="evenodd" d="M16.707 5.293a1 1 0 010 1.414l-8 8a1 1 0 01-1.414 0l-4-4a1 1 0 011.414-1.414L8 12.586l7.293-7.293a1 1 0 011.414 0z" clip-rule="evenodd" />
+                                  </svg>
+                                </Show>
+                              </button>
+                            );
+                          }}
+                        </For>
+                      </Show>
+                    </div>
+
+                    {/* Close button */}
+                    <div class="p-2 border-t border-gray-200 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/50">
+                      <button
+                        type="button"
+                        onClick={() => { setShowContextPicker(false); setContextSearch(''); }}
+                        class="w-full px-2 py-1 text-xs text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-200"
+                      >
+                        Close
+                      </button>
+                    </div>
+                  </div>
+                </Show>
+              </div>
+            </div>
+
+            {/* Empty state hint */}
+            <Show when={aiChatStore.contextItems.length === 0}>
+              <p class="mt-2 text-[10px] text-gray-400 dark:text-gray-500">
+                Add VMs, containers, or hosts to provide context for your questions
+              </p>
+            </Show>
+
+            {/* Guest Notes - show for first context item */}
+            <Show when={aiChatStore.contextItems.length > 0}>
+              <GuestNotes
+                guestId={`${aiChatStore.contextItems[0].type}-${aiChatStore.contextItems[0].id}`}
+                guestName={aiChatStore.contextItems[0].name}
+                guestType={aiChatStore.contextItems[0].type}
+              />
+            </Show>
+          </div>
+          {/* Queued message indicator */}
+          <Show when={queuedMessage()}>
+            <div class="flex items-center gap-2 px-3 py-2 mb-2 text-xs rounded-lg bg-amber-50 dark:bg-amber-900/30 border border-amber-200 dark:border-amber-700 text-amber-700 dark:text-amber-300">
+              <svg class="w-4 h-4 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+              </svg>
+              <span class="flex-1 truncate">
+                <span class="font-medium">Queued:</span> "{queuedMessage()!.substring(0, 50)}{queuedMessage()!.length > 50 ? '...' : ''}"
+              </span>
+              <button
+                type="button"
+                onClick={() => setQueuedMessage(null)}
+                class="p-0.5 rounded hover:bg-amber-200 dark:hover:bg-amber-800 transition-colors"
+                title="Cancel queued message"
+              >
+                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                </svg>
+              </button>
+            </div>
+          </Show>
+          <form onSubmit={handleSubmit} class="flex gap-2">
+            <textarea
+              ref={inputRef}
+              value={input()}
+              onInput={(e) => setInput(e.currentTarget.value)}
+              onKeyDown={handleKeyDown}
+              placeholder={
+                isLoading()
+                  ? queuedMessage()
+                    ? "Type another message to replace queued..."
+                    : "Type to queue your next message..."
+                  : aiChatStore.contextItems.length > 0
+                    ? `Ask about ${aiChatStore.contextItems.length} item${aiChatStore.contextItems.length > 1 ? 's' : ''} in context...`
+                    : "Ask about your infrastructure..."
+              }
+              rows={2}
+              class={`flex-1 px-3 py-2 text-sm rounded-lg border bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 placeholder-gray-400 dark:placeholder-gray-500 focus:outline-none focus:ring-2 focus:border-transparent resize-none transition-colors ${isLoading()
+                ? 'border-amber-300 dark:border-amber-600 focus:ring-amber-500'
+                : 'border-gray-300 dark:border-gray-600 focus:ring-purple-500'
+                }`}
+            />
+            <Show
+              when={isLoading()}
+              fallback={
+                <button
+                  type="submit"
+                  disabled={!input().trim()}
+                  class="px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 disabled:opacity-50 disabled:cursor-not-allowed transition-colors self-end"
+                  title="Send message"
+                >
+                  <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M12 19l9 2-9-18-9 18 9-2zm0 0v-8"
+                    />
+                  </svg>
+                </button>
+              }
+            >
+              <div class="flex flex-col gap-1 self-end">
+                {/* Queue button when AI is working */}
+                <button
+                  type="submit"
+                  disabled={!input().trim()}
+                  class="px-4 py-2 bg-amber-500 text-white rounded-lg hover:bg-amber-600 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+                  title={queuedMessage() ? "Replace queued message" : "Queue message for when AI finishes"}
+                >
+                  <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                </button>
+                {/* Stop button */}
+                <button
+                  type="button"
+                  onClick={handleStop}
+                  class="px-4 py-2 bg-red-500 text-white rounded-lg hover:bg-red-600 transition-colors"
+                  title="Stop generating"
+                >
+                  <svg class="w-5 h-5" fill="currentColor" viewBox="0 0 24 24">
+                    <rect x="6" y="6" width="12" height="12" rx="1" />
+                  </svg>
+                </button>
+              </div>
+            </Show>
+          </form>
+          <p class="text-xs text-gray-400 dark:text-gray-500 mt-2">
+            {isLoading()
+              ? "Type and press Enter to queue your next message"
+              : "Press Enter to send, Shift+Enter for new line"
+            }
+          </p>
+        </div>
+      </Show>
+    </div>
+  );
+};
+
+export default AIChat;
diff --git a/frontend-modern/src/components/AI/AICostDashboard.tsx b/frontend-modern/src/components/AI/AICostDashboard.tsx
new file mode 100644
index 0000000..26738eb
--- /dev/null
+++ b/frontend-modern/src/components/AI/AICostDashboard.tsx
@@ -0,0 +1,605 @@
+import { Component, Show, createMemo, createSignal, onMount, For } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { AIAPI } from '@/api/ai';
+import { formatNumber } from '@/utils/format';
+import { logger } from '@/utils/logger';
+import { notificationStore } from '@/stores/notifications';
+import type { AICostSummary, AISettings } from '@/types/ai';
+import { PROVIDER_NAMES } from '@/types/ai';
+
+const usdFormatter = new Intl.NumberFormat(undefined, {
+  style: 'currency',
+  currency: 'USD',
+  minimumFractionDigits: 2,
+  maximumFractionDigits: 2,
+});
+
+const TinySparkline: Component<{
+  values: number[];
+  width?: number;
+  height?: number;
+  stroke?: string;
+}> = (props) => {
+  const width = () => props.width ?? 160;
+  const height = () => props.height ?? 28;
+  const stroke = () => props.stroke ?? '#22c55e';
+
+  const pathD = createMemo(() => {
+    const values = props.values;
+    const w = width();
+    const h = height();
+    if (!values || values.length === 0) return '';
+
+    const max = Math.max(...values, 0);
+    const safeMax = max <= 0 ? 1 : max;
+
+    // For single point, draw a horizontal line across the middle
+    if (values.length === 1) {
+      const y = h - (Math.max(0, values[0]) / safeMax) * h;
+      // Draw a short horizontal line to make the single point visible
+      return `M0,${y.toFixed(2)} L${w.toFixed(2)},${y.toFixed(2)}`;
+    }
+
+    const xStep = w / (values.length - 1);
+    let d = '';
+    values.forEach((v, idx) => {
+      const x = idx * xStep;
+      const y = h - (Math.max(0, v) / safeMax) * h;
+      d += `${idx === 0 ? 'M' : 'L'}${x.toFixed(2)},${y.toFixed(2)} `;
+    });
+    return d.trim();
+  });
+
+  return (
+    <svg width={width()} height={height()} viewBox={`0 0 ${width()} ${height()}`} class="block">
+      <path d={pathD()} fill="none" stroke={stroke()} stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
+    </svg>
+  );
+};
+
+export const AICostDashboard: Component = () => {
+  const [days, setDays] = createSignal(30);
+  const [loading, setLoading] = createSignal(false);
+  const [loadError, setLoadError] = createSignal<string | null>(null);
+  const [summary, setSummary] = createSignal<AICostSummary | null>(null);
+  const [aiSettings, setAISettings] = createSignal<AISettings | null>(null);
+  let requestSeq = 0;
+
+  const anyPricingKnown = createMemo(() => {
+    const data = summary();
+    if (!data) return false;
+    return data.provider_models.some((pm) => pm.pricing_known);
+  });
+
+  const unpricedProviderModels = createMemo(() => {
+    const data = summary();
+    if (!data) return [];
+    return (data.provider_models ?? []).filter((pm) => !pm.pricing_known && (pm.total_tokens ?? 0) > 0);
+  });
+
+  const estimatedTotalUSD = createMemo(() => {
+    const data = summary();
+    if (!data || !anyPricingKnown()) return null;
+    return data.totals.estimated_usd ?? 0;
+  });
+
+  const useCaseMap = createMemo(() => {
+    const data = summary();
+    const map = new Map<string, { tokens: number; usd: number; pricingKnown: boolean }>();
+    if (!data) return map;
+    for (const uc of data.use_cases ?? []) {
+      map.set(uc.use_case, {
+        tokens: uc.total_tokens,
+        usd: uc.estimated_usd ?? 0,
+        pricingKnown: uc.pricing_known,
+      });
+    }
+    return map;
+  });
+
+  const dailyTotals = createMemo(() => summary()?.daily_totals ?? []);
+  const dailyTokenValues = createMemo(() => dailyTotals().map((d) => d.total_tokens));
+  const dailyUSDValues = createMemo(() => dailyTotals().map((d) => d.estimated_usd ?? 0));
+
+  const lastDailyTokens = createMemo(() => {
+    const values = dailyTokenValues();
+    if (values.length === 0) return null;
+    return values[values.length - 1];
+  });
+
+  const lastDailyUSD = createMemo(() => {
+    const values = dailyUSDValues();
+    if (values.length === 0) return null;
+    return values[values.length - 1];
+  });
+
+  const formatUSD = (usd: number) => usdFormatter.format(usd);
+
+  const loadSummary = async (rangeDays: number) => {
+    const seq = ++requestSeq;
+    const isInitialLoad = summary() === null;
+    setLoading(true);
+    setLoadError(null);
+    try {
+      const data = await AIAPI.getCostSummary(rangeDays);
+      if (seq !== requestSeq) return;
+      setSummary(data);
+    } catch (err) {
+      if (seq !== requestSeq) return;
+      logger.error('[AICostDashboard] Failed to load cost summary:', err);
+      // Only show notification on refresh failures, not initial load
+      if (!isInitialLoad) {
+        notificationStore.error('Failed to refresh AI cost summary');
+      }
+      const message =
+        err instanceof Error && err.message ? err.message : 'Failed to load usage data';
+      setLoadError(message);
+    } finally {
+      if (seq === requestSeq) setLoading(false);
+    }
+  };
+
+  onMount(() => {
+    loadSummary(days());
+  });
+
+  const loadBudgetSettings = async () => {
+    try {
+      const s = await AIAPI.getSettings();
+      setAISettings(s);
+    } catch (err) {
+      logger.debug('[AICostDashboard] Failed to load AI settings for budget:', err);
+      setAISettings(null);
+    }
+  };
+
+  onMount(() => {
+    loadBudgetSettings();
+  });
+
+  const parsedBudgetUSD30d = createMemo(() => {
+    const s = aiSettings();
+    const n = s?.cost_budget_usd_30d;
+    if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0) return null;
+    return n;
+  });
+
+  const budgetForRange = createMemo(() => {
+    const budget30d = parsedBudgetUSD30d();
+    if (budget30d == null) return null;
+    const rangeDays = days();
+    return (budget30d * rangeDays) / 30;
+  });
+
+  const isOverBudget = createMemo(() => {
+    const budget = budgetForRange();
+    const usd = estimatedTotalUSD();
+    if (budget == null || usd == null) return false;
+    return usd > budget;
+  });
+
+  const resetHistory = async () => {
+    if (!confirm('Reset AI usage history? A backup will be created in the Pulse config directory.')) return;
+    try {
+      const result = await AIAPI.resetCostHistory();
+      if (result.backup_file) {
+        notificationStore.success(`AI usage history reset (backup: ${result.backup_file})`);
+      } else {
+        notificationStore.success('AI usage history reset');
+      }
+      await loadSummary(days());
+    } catch (err) {
+      logger.error('[AICostDashboard] Failed to reset AI cost history:', err);
+      notificationStore.error('Failed to reset AI usage history');
+    }
+  };
+
+  const downloadExport = async (format: 'csv' | 'json') => {
+    try {
+      const resp = await AIAPI.exportCostHistory(days(), format);
+      if (!resp.ok) {
+        throw new Error(`Export failed (${resp.status})`);
+      }
+      const blob = await resp.blob();
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement('a');
+      a.href = url;
+      a.download = `pulse-ai-usage-${new Date().toISOString().split('T')[0]}-${days()}d.${format}`;
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      URL.revokeObjectURL(url);
+    } catch (err) {
+      logger.error('[AICostDashboard] Failed to export cost history:', err);
+      notificationStore.error('Failed to export AI usage history');
+    }
+  };
+
+  const handleRangeClick = (rangeDays: number) => {
+    if (loading() || rangeDays === days()) return;
+    setDays(rangeDays);
+    loadSummary(rangeDays);
+  };
+
+  return (
+    <Card padding="none" class="overflow-hidden border border-gray-200 dark:border-gray-700" border={false}>
+      <div class="bg-gradient-to-r from-emerald-50 to-teal-50 dark:from-emerald-900/20 dark:to-teal-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+        <div class="flex items-center gap-3">
+          <div class="p-2 bg-emerald-100 dark:bg-emerald-900/40 rounded-lg">
+            <svg class="w-5 h-5 text-emerald-600 dark:text-emerald-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8c-1.657 0-3 1.343-3 3v1a3 3 0 006 0v-1c0-1.657-1.343-3-3-3zM5 12a7 7 0 0114 0v3a2 2 0 01-2 2H7a2 2 0 01-2-2v-3z" />
+            </svg>
+          </div>
+          <SectionHeader
+            title="AI Cost & Usage"
+            description="Token usage and estimated spend across providers"
+            size="sm"
+            class="flex-1"
+          />
+          <Show when={loading()}>
+            <div class="text-xs text-gray-500 dark:text-gray-400">Loading…</div>
+          </Show>
+          <div class="flex items-center gap-1">
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => handleRangeClick(1)}
+              class={`p-0.5 px-1.5 text-xs border rounded transition-colors ${days() === 1
+                ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+                : 'border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700'
+                } ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              1d
+            </button>
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => handleRangeClick(7)}
+              class={`p-0.5 px-1.5 text-xs border rounded transition-colors ${days() === 7
+                ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+                : 'border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700'
+                } ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              7d
+            </button>
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => handleRangeClick(30)}
+              class={`p-0.5 px-1.5 text-xs border rounded transition-colors ${days() === 30
+                ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+                : 'border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700'
+                } ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              30d
+            </button>
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => handleRangeClick(90)}
+              class={`p-0.5 px-1.5 text-xs border rounded transition-colors ${days() === 90
+                ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+                : 'border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700'
+                } ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              90d
+            </button>
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => handleRangeClick(365)}
+              class={`p-0.5 px-1.5 text-xs border rounded transition-colors ${days() === 365
+                ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border-blue-300 dark:border-blue-700'
+                : 'border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700'
+                } ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              1y
+            </button>
+          </div>
+        </div>
+      </div>
+
+      <div class="p-6 space-y-4">
+        <Show when={!summary() && loading()}>
+          <div class="text-sm text-gray-500 dark:text-gray-400">Loading usage…</div>
+        </Show>
+
+        <Show when={summary()?.truncated}>
+          <div class="text-xs px-3 py-2 rounded border border-blue-200 dark:border-blue-800/60 bg-blue-50 dark:bg-blue-900/20 text-blue-900 dark:text-blue-100">
+            Showing the last {summary()?.effective_days} days due to a {summary()?.retention_days}-day retention window.
+          </div>
+        </Show>
+
+        <Show when={isOverBudget()}>
+          <div class="text-xs px-3 py-2 rounded border border-red-200 dark:border-red-800/60 bg-red-50 dark:bg-red-900/20 text-red-900 dark:text-red-100">
+            Estimated spend ({formatUSD(estimatedTotalUSD() ?? 0)}) is above your budget ({formatUSD(budgetForRange() ?? 0)}).
+          </div>
+        </Show>
+
+        <Show when={loadError() && summary()}>
+          <div class="flex items-center justify-between gap-3 text-xs px-3 py-2 rounded border border-amber-200 dark:border-amber-800/60 bg-amber-50 dark:bg-amber-900/20 text-amber-900 dark:text-amber-100">
+            <div class="truncate">
+              Couldn’t refresh. Showing last loaded data. {loadError()}
+            </div>
+            <button
+              type="button"
+              disabled={loading()}
+              onClick={() => loadSummary(days())}
+              class={`shrink-0 px-2 py-1 rounded border border-amber-300 dark:border-amber-700 hover:bg-amber-100 dark:hover:bg-amber-900/40 ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+            >
+              Retry
+            </button>
+          </div>
+        </Show>
+
+        <Show when={!summary() && !loading() && loadError()}>
+          <div class="text-sm text-gray-500 dark:text-gray-400">{loadError()}</div>
+        </Show>
+
+        <Show when={!summary() && !loading() && !loadError()}>
+          <div class="text-sm text-gray-500 dark:text-gray-400">No usage data yet.</div>
+        </Show>
+
+        <Show when={summary()}>
+          {(data) => (
+            <>
+              <div class="grid grid-cols-1 sm:grid-cols-3 gap-3">
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Estimated spend</div>
+                  <div class="text-lg font-semibold text-gray-900 dark:text-white">
+                    <Show
+                      when={estimatedTotalUSD() != null}
+                      fallback={<span class="text-gray-500 dark:text-gray-400">—</span>}
+                    >
+                      {formatUSD(estimatedTotalUSD() ?? 0)}
+                    </Show>
+                  </div>
+                </div>
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Total tokens</div>
+                  <div class="text-lg font-semibold text-gray-900 dark:text-white">
+                    {formatNumber(data().totals.total_tokens)}
+                  </div>
+                </div>
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Model/provider pairs</div>
+                  <div class="text-lg font-semibold text-gray-900 dark:text-white">
+                    {formatNumber(data().provider_models.length)}
+                  </div>
+                </div>
+              </div>
+
+              <div class="grid grid-cols-1 sm:grid-cols-3 gap-3">
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Chat</div>
+                  <div class="text-sm font-semibold text-gray-900 dark:text-white">
+                    {formatNumber(useCaseMap().get('chat')?.tokens ?? 0)} tokens
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    <Show
+                      when={useCaseMap().get('chat')?.pricingKnown}
+                      fallback={<span>—</span>}
+                    >
+                      {formatUSD(useCaseMap().get('chat')?.usd ?? 0)}
+                    </Show>
+                  </div>
+                </div>
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Patrol</div>
+                  <div class="text-sm font-semibold text-gray-900 dark:text-white">
+                    {formatNumber(useCaseMap().get('patrol')?.tokens ?? 0)} tokens
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    <Show
+                      when={useCaseMap().get('patrol')?.pricingKnown}
+                      fallback={<span>—</span>}
+                    >
+                      {formatUSD(useCaseMap().get('patrol')?.usd ?? 0)}
+                    </Show>
+                  </div>
+                </div>
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="text-xs text-gray-500 dark:text-gray-400">Budget alert (USD per 30d)</div>
+                  <div class="text-sm font-semibold text-gray-900 dark:text-white mt-1">
+                    <Show when={parsedBudgetUSD30d() != null} fallback={<span class="text-gray-500 dark:text-gray-400">—</span>}>
+                      {formatUSD(parsedBudgetUSD30d() ?? 0)}
+                    </Show>
+                  </div>
+                  <div class="text-[11px] text-gray-500 dark:text-gray-400 mt-1">
+                    Set in AI settings. Pro-rated for {days()}d:{' '}
+                    <Show when={budgetForRange() != null} fallback={<span>—</span>}>
+                      {formatUSD(budgetForRange() ?? 0)}
+                    </Show>
+                  </div>
+                </div>
+              </div>
+
+              <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="flex items-center justify-between">
+                    <div class="text-xs text-gray-500 dark:text-gray-400">Daily estimated USD</div>
+                    <div class="text-xs text-gray-500 dark:text-gray-400">
+                      <Show when={anyPricingKnown() && lastDailyUSD() != null} fallback={<span>—</span>}>
+                        {formatUSD(lastDailyUSD() ?? 0)}
+                      </Show>
+                    </div>
+                  </div>
+                  <div class="mt-2">
+                    <Show
+                      when={anyPricingKnown() && dailyUSDValues().length >= 2}
+                      fallback={<div class="text-xs text-gray-500 dark:text-gray-400">No daily USD trend yet.</div>}
+                    >
+                      <TinySparkline values={dailyUSDValues()} stroke="#10b981" />
+                    </Show>
+                  </div>
+                </div>
+                <div class="p-3 rounded-lg bg-gray-50 dark:bg-gray-800/40 border border-gray-200 dark:border-gray-700">
+                  <div class="flex items-center justify-between">
+                    <div class="text-xs text-gray-500 dark:text-gray-400">Daily total tokens</div>
+                    <div class="text-xs text-gray-500 dark:text-gray-400">
+                      <Show when={lastDailyTokens() != null} fallback={<span>—</span>}>
+                        {formatNumber(lastDailyTokens() ?? 0)}
+                      </Show>
+                    </div>
+                  </div>
+                  <div class="mt-2">
+                    <Show
+                      when={dailyTokenValues().length >= 2}
+                      fallback={<div class="text-xs text-gray-500 dark:text-gray-400">No daily token trend yet.</div>}
+                    >
+                      <TinySparkline values={dailyTokenValues()} stroke="#3b82f6" />
+                    </Show>
+                  </div>
+                </div>
+              </div>
+
+              <div class="text-xs text-gray-500 dark:text-gray-400">
+                USD is an estimate based on public list prices. It may differ from billing.
+                <Show when={unpricedProviderModels().length > 0}>
+                  <span class="ml-2">
+                    Estimated spend is partial. Pricing is unknown for{' '}
+                    {unpricedProviderModels()
+                      .slice(0, 6)
+                      .map(
+                        (pm) =>
+                          `${PROVIDER_NAMES[pm.provider as keyof typeof PROVIDER_NAMES] || pm.provider}/${pm.model}`,
+                      )
+                      .join(', ')}
+                    <Show when={unpricedProviderModels().length > 6}>
+                      <span> (+{unpricedProviderModels().length - 6} more)</span>
+                    </Show>
+                    .
+                  </span>
+                </Show>
+                <Show when={summary()?.pricing_as_of}>
+                  <span class="ml-2">Prices as of {summary()?.pricing_as_of}.</span>
+                </Show>
+              </div>
+
+              <div class="flex items-center justify-between gap-3">
+                <div class="text-xs text-gray-500 dark:text-gray-400">
+                  History retention: {data().retention_days} days
+                </div>
+                <div class="flex items-center gap-2">
+                  <button
+                    type="button"
+                    disabled={loading()}
+                    onClick={() => downloadExport('csv')}
+                    class={`text-xs px-2 py-1 rounded border border-gray-200 dark:border-gray-700 hover:bg-gray-100 dark:hover:bg-gray-800 ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+                  >
+                    Export CSV
+                  </button>
+                  <button
+                    type="button"
+                    disabled={loading()}
+                    onClick={() => downloadExport('json')}
+                    class={`text-xs px-2 py-1 rounded border border-gray-200 dark:border-gray-700 hover:bg-gray-100 dark:hover:bg-gray-800 ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+                  >
+                    Export JSON
+                  </button>
+                  <button
+                    type="button"
+                    disabled={loading()}
+                    onClick={resetHistory}
+                    class={`text-xs px-2 py-1 rounded border border-gray-200 dark:border-gray-700 hover:bg-gray-100 dark:hover:bg-gray-800 ${loading() ? 'opacity-60 cursor-not-allowed' : ''}`}
+                  >
+                    Reset history
+                  </button>
+                </div>
+              </div>
+
+              <Show when={(data().targets?.length ?? 0) > 0}>
+                <div class="overflow-x-auto">
+                  <table class="min-w-full text-sm">
+                    <thead class="text-xs text-gray-500 dark:text-gray-400 uppercase tracking-wide">
+                      <tr class="border-b border-gray-200 dark:border-gray-700">
+                        <th class="text-left py-2 pr-4">Top targets</th>
+                        <th class="text-right py-2 px-2">Est. USD</th>
+                        <th class="text-right py-2 px-2">Calls</th>
+                        <th class="text-right py-2 px-2">Tokens</th>
+                      </tr>
+                    </thead>
+                    <tbody>
+                      <For each={data().targets}>
+                        {(t) => (
+                          <tr class="border-b border-gray-100 dark:border-gray-800">
+                            <td class="py-2 pr-4 text-gray-700 dark:text-gray-300 font-mono text-xs">
+                              {t.target_type}:{t.target_id}
+                            </td>
+                            <td class="py-2 px-2 text-right text-gray-900 dark:text-gray-100">
+                              <Show
+                                when={t.pricing_known}
+                                fallback={<span class="text-gray-500 dark:text-gray-500">—</span>}
+                              >
+                                {formatUSD(t.estimated_usd ?? 0)}
+                              </Show>
+                            </td>
+                            <td class="py-2 px-2 text-right text-gray-700 dark:text-gray-300">
+                              {formatNumber(t.calls)}
+                            </td>
+                            <td class="py-2 px-2 text-right text-gray-900 dark:text-gray-100">
+                              {formatNumber(t.total_tokens)}
+                            </td>
+                          </tr>
+                        )}
+                      </For>
+                    </tbody>
+                  </table>
+                </div>
+              </Show>
+
+              <div class="overflow-x-auto">
+                <table class="min-w-full text-sm">
+                  <thead class="text-xs text-gray-500 dark:text-gray-400 uppercase tracking-wide">
+                    <tr class="border-b border-gray-200 dark:border-gray-700">
+                      <th class="text-left py-2 pr-4">Provider</th>
+                      <th class="text-left py-2 pr-4">Model</th>
+                      <th class="text-right py-2 px-2">Est. USD</th>
+                      <th class="text-right py-2 px-2">Input</th>
+                      <th class="text-right py-2 px-2">Output</th>
+                      <th class="text-right py-2 px-2">Total</th>
+                    </tr>
+                  </thead>
+                  <tbody>
+                    <For each={data().provider_models}>
+                      {(pm) => (
+                        <tr class="border-b border-gray-100 dark:border-gray-800">
+                          <td class="py-2 pr-4 font-medium text-gray-900 dark:text-gray-100">
+                            {PROVIDER_NAMES[pm.provider as keyof typeof PROVIDER_NAMES] || pm.provider}
+                          </td>
+                          <td class="py-2 pr-4 text-gray-700 dark:text-gray-300 font-mono text-xs">
+                            {pm.model}
+                          </td>
+                          <td class="py-2 px-2 text-right text-gray-900 dark:text-gray-100">
+                            <Show
+                              when={pm.pricing_known}
+                              fallback={<span class="text-gray-500 dark:text-gray-500">—</span>}
+                            >
+                              {formatUSD(pm.estimated_usd ?? 0)}
+                            </Show>
+                          </td>
+                          <td class="py-2 px-2 text-right text-gray-700 dark:text-gray-300">
+                            {formatNumber(pm.input_tokens)}
+                          </td>
+                          <td class="py-2 px-2 text-right text-gray-700 dark:text-gray-300">
+                            {formatNumber(pm.output_tokens)}
+                          </td>
+                          <td class="py-2 px-2 text-right text-gray-900 dark:text-gray-100">
+                            {formatNumber(pm.total_tokens)}
+                          </td>
+                        </tr>
+                      )}
+                    </For>
+                  </tbody>
+                </table>
+              </div>
+            </>
+          )}
+        </Show>
+      </div>
+    </Card>
+  );
+};
+
+export default AICostDashboard;
diff --git a/frontend-modern/src/components/AI/AIStatusIndicator.css b/frontend-modern/src/components/AI/AIStatusIndicator.css
new file mode 100644
index 0000000..fa27869
--- /dev/null
+++ b/frontend-modern/src/components/AI/AIStatusIndicator.css
@@ -0,0 +1,74 @@
+/**
+ * AIStatusIndicator styles
+ * Designed to be minimal and blend with Pulse's header
+ */
+
+.ai-status-indicator {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 4px 8px;
+  border-radius: 4px;
+  border: 1px solid transparent;
+  background: transparent;
+  cursor: pointer;
+  font-size: 12px;
+  font-weight: 500;
+  transition: all 0.15s ease;
+  color: var(--text-secondary, #9ca3af);
+}
+
+.ai-status-indicator:hover {
+  background: rgba(255, 255, 255, 0.05);
+}
+
+/* Healthy state - very subtle */
+.ai-status--healthy {
+  color: var(--success-color, #22c55e);
+  opacity: 0.7;
+}
+
+.ai-status--healthy:hover {
+  opacity: 1;
+}
+
+/* Watch state - noticeable but not alarming */
+.ai-status--watch {
+  color: var(--info-color, #3b82f6);
+  background: rgba(59, 130, 246, 0.1);
+  border-color: rgba(59, 130, 246, 0.2);
+}
+
+.ai-status--watch:hover {
+  background: rgba(59, 130, 246, 0.15);
+}
+
+/* Issues state - draws attention */
+.ai-status--issues {
+  color: var(--warning-color, #eab308);
+  background: rgba(234, 179, 8, 0.1);
+  border-color: rgba(234, 179, 8, 0.25);
+}
+
+.ai-status--issues:hover {
+  background: rgba(234, 179, 8, 0.15);
+}
+
+/* Icon */
+.ai-status-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.ai-status-icon svg {
+  display: block;
+}
+
+/* Count badge */
+.ai-status-count {
+  font-size: 11px;
+  font-weight: 600;
+  min-width: 16px;
+  text-align: center;
+}
diff --git a/frontend-modern/src/components/AI/AIStatusIndicator.tsx b/frontend-modern/src/components/AI/AIStatusIndicator.tsx
new file mode 100644
index 0000000..61484d4
--- /dev/null
+++ b/frontend-modern/src/components/AI/AIStatusIndicator.tsx
@@ -0,0 +1,113 @@
+/**
+ * AIStatusIndicator - Subtle header component showing AI patrol health
+ * 
+ * Design: Minimal presence when healthy, highlighted when issues detected.
+ * Clicking navigates to the Alerts page where AI Insights are displayed.
+ */
+
+import { createResource, Show, createMemo, onCleanup } from 'solid-js';
+import { useNavigate } from '@solidjs/router';
+import { getPatrolStatus, type PatrolStatus } from '../../api/patrol';
+import './AIStatusIndicator.css';
+
+export function AIStatusIndicator() {
+    const navigate = useNavigate();
+
+    // Poll patrol status every 30 seconds
+    const [status, { refetch }] = createResource<PatrolStatus>(
+        async () => {
+            try {
+                return await getPatrolStatus();
+            } catch {
+                return null as unknown as PatrolStatus;
+            }
+        },
+        { initialValue: undefined }
+    );
+
+    // Refetch every 30 seconds with proper cleanup
+    const intervalId = setInterval(() => refetch(), 30000);
+    onCleanup(() => clearInterval(intervalId));
+
+    const hasIssues = createMemo(() => {
+        const s = status();
+        if (!s) return false;
+        return s.summary.critical > 0 || s.summary.warning > 0;
+    });
+
+    const hasWatch = createMemo(() => {
+        const s = status();
+        if (!s) return false;
+        return s.summary.watch > 0 && !hasIssues();
+    });
+
+    const totalFindings = createMemo(() => {
+        const s = status();
+        if (!s) return 0;
+        return s.summary.critical + s.summary.warning + s.summary.watch;
+    });
+
+    const tooltipText = createMemo(() => {
+        const s = status();
+        if (!s || !s.enabled) return 'AI Patrol disabled';
+        if (!s.running) return 'AI Patrol not running';
+
+        const parts: string[] = [];
+        if (s.summary.critical > 0) parts.push(`${s.summary.critical} critical`);
+        if (s.summary.warning > 0) parts.push(`${s.summary.warning} warning`);
+        if (s.summary.watch > 0) parts.push(`${s.summary.watch} watch`);
+
+        if (parts.length === 0) return 'AI: All systems healthy';
+        return `AI: ${parts.join(', ')}`;
+    });
+
+    const statusClass = createMemo(() => {
+        if (hasIssues()) return 'ai-status--issues';
+        if (hasWatch()) return 'ai-status--watch';
+        return 'ai-status--healthy';
+    });
+
+    const handleClick = () => {
+        // Navigate to Alerts page with AI Insights subtab selected
+        navigate('/alerts?subtab=ai-insights');
+    };
+
+    return (
+        <Show when={status()?.enabled}>
+            <button
+                class={`ai-status-indicator ${statusClass()}`}
+                onClick={handleClick}
+                title={tooltipText()}
+            >
+                <span class="ai-status-icon">
+                    <Show when={hasIssues()} fallback={
+                        <Show when={hasWatch()} fallback={
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M12 22c5.523 0 10-4.477 10-10S17.523 2 12 2 2 6.477 2 12s4.477 10 10 10z" />
+                                <path d="M9 12l2 2 4-4" />
+                            </svg>
+                        }>
+                            {/* Watch icon - eye */}
+                            <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" />
+                                <circle cx="12" cy="12" r="3" />
+                            </svg>
+                        </Show>
+                    }>
+                        {/* Issues icon - alert */}
+                        <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                            <path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" />
+                            <line x1="12" y1="9" x2="12" y2="13" />
+                            <line x1="12" y1="17" x2="12.01" y2="17" />
+                        </svg>
+                    </Show>
+                </span>
+                <Show when={totalFindings() > 0}>
+                    <span class="ai-status-count">{totalFindings()}</span>
+                </Show>
+            </button>
+        </Show>
+    );
+}
+
+export default AIStatusIndicator;
diff --git a/frontend-modern/src/components/AI/GuestNotes.tsx b/frontend-modern/src/components/AI/GuestNotes.tsx
new file mode 100644
index 0000000..fac1e8f
--- /dev/null
+++ b/frontend-modern/src/components/AI/GuestNotes.tsx
@@ -0,0 +1,818 @@
+import { Component, createSignal, createEffect, For, Show, createMemo } from 'solid-js';
+import { notificationStore } from '@/stores/notifications';
+import { apiFetch } from '@/utils/apiClient';
+
+interface Note {
+    id: string;
+    category: string;
+    title: string;
+    content: string;
+    created_at: string;
+    updated_at: string;
+}
+
+interface GuestKnowledge {
+    guest_id: string;
+    guest_name: string;
+    guest_type: string;
+    notes: Note[];
+    updated_at: string;
+}
+
+interface GuestNotesProps {
+    guestId: string;
+    guestName?: string;
+    guestType?: string;
+    customUrl?: string;
+    onCustomUrlUpdate?: (guestId: string, url: string) => void;
+}
+
+const CATEGORY_LABELS: Record<string, string> = {
+    service: 'Service',
+    path: 'Path',
+    config: 'Config',
+    credential: 'Credential',
+    learning: 'Learning',
+};
+
+const CATEGORY_ICONS: Record<string, string> = {
+    service: '⚙️',
+    path: '📁',
+    config: '📋',
+    credential: '🔐',
+    learning: '💡',
+};
+
+const CATEGORY_COLORS: Record<string, string> = {
+    service: 'bg-blue-500/20 border-blue-500/30 text-blue-300',
+    path: 'bg-amber-500/20 border-amber-500/30 text-amber-300',
+    config: 'bg-purple-500/20 border-purple-500/30 text-purple-300',
+    credential: 'bg-red-500/20 border-red-500/30 text-red-300',
+    learning: 'bg-green-500/20 border-green-500/30 text-green-300',
+};
+
+const CATEGORY_OPTIONS = ['service', 'path', 'config', 'credential', 'learning'];
+
+// Quick templates for common note types
+const TEMPLATES = [
+    { category: 'credential', title: 'Admin Password', placeholder: 'Enter admin password...' },
+    { category: 'credential', title: 'SSH Key', placeholder: 'Paste SSH private key or fingerprint...' },
+    { category: 'credential', title: 'API Key', placeholder: 'Enter API key...' },
+    { category: 'path', title: 'Config Directory', placeholder: '/path/to/config' },
+    { category: 'path', title: 'Data Directory', placeholder: '/path/to/data' },
+    { category: 'path', title: 'Log Location', placeholder: '/var/log/service.log' },
+    { category: 'service', title: 'Web Interface', placeholder: 'http://localhost:8080' },
+    { category: 'service', title: 'Database', placeholder: 'PostgreSQL on port 5432' },
+    { category: 'config', title: 'Port Number', placeholder: '8080' },
+    { category: 'config', title: 'Environment', placeholder: 'production' },
+];
+
+// Format relative time
+const formatRelativeTime = (dateStr: string): string => {
+    const date = new Date(dateStr);
+    const now = new Date();
+    const diffMs = now.getTime() - date.getTime();
+    const diffMinutes = Math.floor(diffMs / 60000);
+    const diffHours = Math.floor(diffMs / 3600000);
+    const diffDays = Math.floor(diffMs / 86400000);
+
+    if (diffMinutes < 1) return 'just now';
+    if (diffMinutes < 60) return `${diffMinutes}m ago`;
+    if (diffHours < 24) return `${diffHours}h ago`;
+    if (diffDays < 7) return `${diffDays}d ago`;
+    return date.toLocaleDateString();
+};
+
+export const GuestNotes: Component<GuestNotesProps> = (props) => {
+    const [knowledge, setKnowledge] = createSignal<GuestKnowledge | null>(null);
+    const [isLoading, setIsLoading] = createSignal(false);
+    const [isExpanded, setIsExpanded] = createSignal(false);
+    const [showAddForm, setShowAddForm] = createSignal(false);
+    const [showTemplates, setShowTemplates] = createSignal(false);
+    const [showActions, setShowActions] = createSignal(false);
+    const [editingNote, setEditingNote] = createSignal<Note | null>(null);
+    const [searchQuery, setSearchQuery] = createSignal('');
+    const [filterCategory, setFilterCategory] = createSignal<string>('');
+    const [showCredentials, setShowCredentials] = createSignal<Set<string>>(new Set());
+    const [deleteConfirmId, setDeleteConfirmId] = createSignal<string | null>(null);
+    const [clearConfirm, setClearConfirm] = createSignal(false);
+    const [isImporting, setIsImporting] = createSignal(false);
+
+    // Form state
+    const [category, setCategory] = createSignal('learning');
+    const [title, setTitle] = createSignal('');
+    const [content, setContent] = createSignal('');
+
+    // Guest URL state
+    const [guestUrl, setGuestUrl] = createSignal(props.customUrl || '');
+    const [isEditingUrl, setIsEditingUrl] = createSignal(false);
+    const [isSavingUrl, setIsSavingUrl] = createSignal(false);
+
+    // Sync URL from props
+    createEffect(() => {
+        setGuestUrl(props.customUrl || '');
+    });
+
+    // File input ref for import
+    let fileInputRef: HTMLInputElement | undefined;
+
+    // Fetch knowledge when guestId changes
+    createEffect(() => {
+        const guestId = props.guestId;
+        if (guestId) {
+            loadKnowledge(guestId);
+        }
+    });
+
+    const loadKnowledge = async (guestId: string) => {
+        setIsLoading(true);
+        try {
+            // Fetch knowledge and metadata in parallel
+            const [knowledgeResponse, metadataResponse] = await Promise.all([
+                apiFetch(`/api/ai/knowledge?guest_id=${encodeURIComponent(guestId)}`),
+                apiFetch(`/api/guests/metadata/${encodeURIComponent(guestId)}`),
+            ]);
+
+            if (knowledgeResponse.ok) {
+                const data = await knowledgeResponse.json();
+                setKnowledge(data);
+            }
+
+            // Load customUrl from metadata if not provided via props
+            if (metadataResponse.ok) {
+                const metadata = await metadataResponse.json();
+                if (metadata.customUrl && !props.customUrl) {
+                    setGuestUrl(metadata.customUrl);
+                }
+            }
+        } catch (error) {
+            console.error('Failed to load guest knowledge:', error);
+        } finally {
+            setIsLoading(false);
+        }
+    };
+
+    const saveGuestUrl = async () => {
+        const url = guestUrl().trim();
+        setIsSavingUrl(true);
+        try {
+            const response = await apiFetch(`/api/guests/metadata/${encodeURIComponent(props.guestId)}`, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ customUrl: url }),
+            });
+            if (response.ok) {
+                notificationStore.success(url ? 'Guest URL saved' : 'Guest URL cleared');
+                setIsEditingUrl(false);
+                props.onCustomUrlUpdate?.(props.guestId, url);
+            } else {
+                notificationStore.error('Failed to save guest URL');
+            }
+        } catch (error) {
+            console.error('Failed to save guest URL:', error);
+            notificationStore.error('Failed to save guest URL');
+        } finally {
+            setIsSavingUrl(false);
+        }
+    };
+
+    const saveNote = async () => {
+        if (!title().trim() || !content().trim()) return;
+
+        try {
+            const response = await apiFetch('/api/ai/knowledge/save', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    guest_id: props.guestId,
+                    guest_name: props.guestName || props.guestId,
+                    guest_type: props.guestType || 'unknown',
+                    category: category(),
+                    title: title().trim(),
+                    content: content().trim(),
+                }),
+            });
+
+            if (response.ok) {
+                notificationStore.success('Note saved');
+                // Reset form
+                setTitle('');
+                setContent('');
+                setShowAddForm(false);
+                setShowTemplates(false);
+                setEditingNote(null);
+                // Reload knowledge
+                loadKnowledge(props.guestId);
+            } else {
+                notificationStore.error('Failed to save note');
+            }
+        } catch (error) {
+            console.error('Failed to save note:', error);
+            notificationStore.error('Failed to save note');
+        }
+    };
+
+    const deleteNote = async (noteId: string) => {
+        try {
+            const response = await apiFetch('/api/ai/knowledge/delete', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    guest_id: props.guestId,
+                    note_id: noteId,
+                }),
+            });
+
+            if (response.ok) {
+                notificationStore.success('Note deleted');
+                setDeleteConfirmId(null);
+                loadKnowledge(props.guestId);
+            } else {
+                notificationStore.error('Failed to delete note');
+            }
+        } catch (error) {
+            console.error('Failed to delete note:', error);
+            notificationStore.error('Failed to delete note');
+        }
+    };
+
+    const exportNotes = async () => {
+        try {
+            const response = await apiFetch(`/api/ai/knowledge/export?guest_id=${encodeURIComponent(props.guestId)}`);
+            if (response.ok) {
+                const data = await response.json();
+                const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+                const url = URL.createObjectURL(blob);
+                const a = document.createElement('a');
+                a.href = url;
+                a.download = `pulse-notes-${props.guestName || props.guestId}.json`;
+                document.body.appendChild(a);
+                a.click();
+                document.body.removeChild(a);
+                URL.revokeObjectURL(url);
+                notificationStore.success('Notes exported');
+                setShowActions(false);
+            } else {
+                notificationStore.error('Failed to export notes');
+            }
+        } catch (error) {
+            console.error('Failed to export notes:', error);
+            notificationStore.error('Failed to export notes');
+        }
+    };
+
+    const handleImportFile = async (event: Event) => {
+        const target = event.target as HTMLInputElement;
+        const file = target.files?.[0];
+        if (!file) return;
+
+        setIsImporting(true);
+        try {
+            const text = await file.text();
+            const data = JSON.parse(text);
+
+            // Add merge flag and ensure guest_id matches current
+            const importData = {
+                ...data,
+                guest_id: props.guestId,
+                guest_name: props.guestName || data.guest_name,
+                guest_type: props.guestType || data.guest_type,
+                merge: true, // Merge with existing notes
+            };
+
+            const response = await apiFetch('/api/ai/knowledge/import', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(importData),
+            });
+
+            if (response.ok) {
+                const result = await response.json();
+                notificationStore.success(`Imported ${result.imported} of ${result.total} notes`);
+                loadKnowledge(props.guestId);
+                setShowActions(false);
+            } else {
+                const errorText = await response.text();
+                notificationStore.error('Import failed: ' + errorText);
+            }
+        } catch (error) {
+            console.error('Failed to import notes:', error);
+            notificationStore.error('Failed to parse import file');
+        } finally {
+            setIsImporting(false);
+            // Reset file input
+            if (fileInputRef) {
+                fileInputRef.value = '';
+            }
+        }
+    };
+
+    const clearAllNotes = async () => {
+        try {
+            const response = await apiFetch('/api/ai/knowledge/clear', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    guest_id: props.guestId,
+                    confirm: true,
+                }),
+            });
+
+            if (response.ok) {
+                const result = await response.json();
+                notificationStore.success(`Cleared ${result.deleted} notes`);
+                setClearConfirm(false);
+                setShowActions(false);
+                loadKnowledge(props.guestId);
+            } else {
+                notificationStore.error('Failed to clear notes');
+            }
+        } catch (error) {
+            console.error('Failed to clear notes:', error);
+            notificationStore.error('Failed to clear notes');
+        }
+    };
+
+    const startEdit = (note: Note) => {
+        setEditingNote(note);
+        setCategory(note.category);
+        setTitle(note.title);
+        setContent(note.content);
+        setShowAddForm(true);
+        setShowTemplates(false);
+    };
+
+    const useTemplate = (template: { category: string; title: string; placeholder: string }) => {
+        setCategory(template.category);
+        setTitle(template.title);
+        setContent('');
+        setShowTemplates(false);
+        setShowAddForm(true);
+    };
+
+    const cancelEdit = () => {
+        setEditingNote(null);
+        setTitle('');
+        setContent('');
+        setShowAddForm(false);
+        setShowTemplates(false);
+    };
+
+    const copyToClipboard = async (text: string, label: string) => {
+        try {
+            await navigator.clipboard.writeText(text);
+            notificationStore.success(`${label} copied to clipboard`);
+        } catch {
+            notificationStore.error('Failed to copy to clipboard');
+        }
+    };
+
+    const toggleCredentialVisibility = (noteId: string) => {
+        const current = showCredentials();
+        const updated = new Set(current);
+        if (updated.has(noteId)) {
+            updated.delete(noteId);
+        } else {
+            updated.add(noteId);
+        }
+        setShowCredentials(updated);
+    };
+
+    const maskCredential = (content: string): string => {
+        // Mask most of the content, showing only first 2 and last 2 chars
+        if (content.length <= 6) {
+            return '••••••';
+        }
+        return content.slice(0, 2) + '•'.repeat(Math.min(content.length - 4, 12)) + content.slice(-2);
+    };
+
+    const notes = () => knowledge()?.notes || [];
+    const hasNotes = () => notes().length > 0;
+
+    // Filtered notes based on search and category
+    const filteredNotes = createMemo(() => {
+        let result = notes();
+
+        // Filter by category
+        const catFilter = filterCategory();
+        if (catFilter) {
+            result = result.filter(n => n.category === catFilter);
+        }
+
+        // Filter by search query
+        const query = searchQuery().toLowerCase();
+        if (query) {
+            result = result.filter(n =>
+                n.title.toLowerCase().includes(query) ||
+                n.content.toLowerCase().includes(query) ||
+                CATEGORY_LABELS[n.category]?.toLowerCase().includes(query)
+            );
+        }
+
+        // Sort by updated_at descending
+        return result.sort((a, b) =>
+            new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime()
+        );
+    });
+
+    // Group notes by category for summary
+    const notesByCategory = createMemo(() => {
+        const grouped: Record<string, number> = {};
+        for (const note of notes()) {
+            grouped[note.category] = (grouped[note.category] || 0) + 1;
+        }
+        return grouped;
+    });
+
+    return (
+        <div class="border-t border-gray-700 pt-2 mt-2">
+            {/* Hidden file input for import */}
+            <input
+                ref={fileInputRef}
+                type="file"
+                accept=".json"
+                class="hidden"
+                onChange={handleImportFile}
+            />
+
+            {/* Header with expand/collapse */}
+            <button
+                onClick={() => setIsExpanded(!isExpanded())}
+                class="flex items-center justify-between w-full text-left px-2 py-1 text-sm hover:bg-gray-700/50 rounded transition-colors"
+            >
+                <span class="flex items-center gap-2">
+                    <svg class={`w-3 h-3 transition-transform ${isExpanded() ? 'rotate-90' : ''}`} fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M7.293 14.707a1 1 0 010-1.414L10.586 10 7.293 6.707a1 1 0 011.414-1.414l4 4a1 1 0 010 1.414l-4 4a1 1 0 01-1.414 0z" clip-rule="evenodd" />
+                    </svg>
+                    <span class="text-gray-300 font-medium">Saved Notes</span>
+                    <Show when={hasNotes()}>
+                        <span class="text-xs text-gray-500">({notes().length})</span>
+                    </Show>
+                </span>
+                <Show when={isLoading()}>
+                    <span class="text-xs text-gray-500">Loading...</span>
+                </Show>
+            </button>
+
+            {/* Expandable content */}
+            <Show when={isExpanded()}>
+                <div class="mt-2 space-y-2 px-2">
+                    {/* Guest URL field */}
+                    <div class="bg-gray-800/50 rounded p-2 border border-gray-700">
+                        <div class="flex items-center justify-between mb-1">
+                            <span class="text-xs font-medium text-gray-400 flex items-center gap-1">
+                                <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
+                                </svg>
+                                Guest URL
+                            </span>
+                            <Show when={guestUrl() && !isEditingUrl()}>
+                                <a
+                                    href={guestUrl()}
+                                    target="_blank"
+                                    rel="noopener noreferrer"
+                                    class="text-xs text-blue-400 hover:text-blue-300 flex items-center gap-1"
+                                >
+                                    Open
+                                    <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
+                                    </svg>
+                                </a>
+                            </Show>
+                        </div>
+                        <Show when={isEditingUrl()} fallback={
+                            <div class="flex items-center gap-2">
+                                <Show when={guestUrl()} fallback={
+                                    <span class="text-xs text-gray-500 italic">No URL set</span>
+                                }>
+                                    <span class="text-xs text-gray-300 break-all font-mono">{guestUrl()}</span>
+                                </Show>
+                                <button
+                                    onClick={() => setIsEditingUrl(true)}
+                                    class="text-xs text-blue-400 hover:text-blue-300 ml-auto"
+                                >
+                                    {guestUrl() ? 'Edit' : 'Add'}
+                                </button>
+                            </div>
+                        }>
+                            <div class="space-y-2">
+                                <input
+                                    type="text"
+                                    value={guestUrl()}
+                                    onInput={(e) => setGuestUrl(e.target.value)}
+                                    onKeyDown={(e) => {
+                                        if (e.key === 'Enter') {
+                                            e.preventDefault();
+                                            saveGuestUrl();
+                                        } else if (e.key === 'Escape') {
+                                            e.preventDefault();
+                                            setGuestUrl(props.customUrl || '');
+                                            setIsEditingUrl(false);
+                                        }
+                                    }}
+                                    placeholder="https://192.168.1.100:8080"
+                                    class="w-full bg-gray-700 text-xs text-gray-200 rounded px-2 py-1.5 border border-gray-600 placeholder-gray-500 font-mono"
+                                    autofocus
+                                />
+                                <div class="flex gap-2 justify-end">
+                                    <button
+                                        onClick={() => {
+                                            setGuestUrl(props.customUrl || '');
+                                            setIsEditingUrl(false);
+                                        }}
+                                        class="text-xs px-2 py-1 text-gray-400 hover:text-gray-200"
+                                    >
+                                        Cancel
+                                    </button>
+                                    <button
+                                        onClick={saveGuestUrl}
+                                        disabled={isSavingUrl()}
+                                        class="text-xs px-3 py-1 bg-blue-600 text-white rounded hover:bg-blue-500 disabled:opacity-50"
+                                    >
+                                        {isSavingUrl() ? 'Saving...' : 'Save'}
+                                    </button>
+                                </div>
+                            </div>
+                        </Show>
+                    </div>
+
+                    {/* Search and filter bar - only show if there are notes */}
+                    <Show when={hasNotes()}>
+                        <div class="flex gap-2 mb-2">
+                            <input
+                                type="text"
+                                placeholder="Search notes..."
+                                value={searchQuery()}
+                                onInput={(e) => setSearchQuery(e.target.value)}
+                                class="flex-1 bg-gray-700 text-xs text-gray-200 rounded px-2 py-1 border border-gray-600 placeholder-gray-500"
+                            />
+                            <select
+                                value={filterCategory()}
+                                onChange={(e) => setFilterCategory(e.target.value)}
+                                class="bg-gray-700 text-xs text-gray-200 rounded px-2 py-1 border border-gray-600"
+                            >
+                                <option value="">All</option>
+                                <For each={CATEGORY_OPTIONS}>
+                                    {(cat) => (
+                                        <Show when={notesByCategory()[cat]}>
+                                            <option value={cat}>{CATEGORY_ICONS[cat]} {CATEGORY_LABELS[cat]} ({notesByCategory()[cat]})</option>
+                                        </Show>
+                                    )}
+                                </For>
+                            </select>
+                        </div>
+                    </Show>
+
+                    {/* Notes list */}
+                    <Show when={hasNotes()} fallback={
+                        <p class="text-xs text-gray-500 italic">No saved notes yet. Add notes to remember passwords, paths, and configs.</p>
+                    }>
+                        <Show when={filteredNotes().length > 0} fallback={
+                            <p class="text-xs text-gray-500 italic">No notes match your search.</p>
+                        }>
+                            <div class="space-y-1.5 max-h-48 overflow-y-auto">
+                                <For each={filteredNotes()}>
+                                    {(note) => (
+                                        <div class={`group rounded border px-2 py-1.5 text-xs ${CATEGORY_COLORS[note.category] || 'bg-gray-800/50 border-gray-700'}`}>
+                                            <div class="flex items-start justify-between gap-2">
+                                                <div class="flex-1 min-w-0">
+                                                    <div class="flex items-center gap-1.5">
+                                                        <span class="text-sm" title={CATEGORY_LABELS[note.category]}>{CATEGORY_ICONS[note.category]}</span>
+                                                        <span class="text-gray-200 font-medium">{note.title}</span>
+                                                        <span class="text-gray-500 text-[10px]" title={new Date(note.updated_at).toLocaleString()}>
+                                                            {formatRelativeTime(note.updated_at)}
+                                                        </span>
+                                                    </div>
+                                                    <div class="flex items-center gap-1 mt-0.5">
+                                                        {/* Content - mask if credential and not revealed */}
+                                                        <Show when={note.category === 'credential' && !showCredentials().has(note.id)}
+                                                            fallback={
+                                                                <p class="text-gray-300 break-words font-mono text-[11px]">{note.content}</p>
+                                                            }>
+                                                            <p class="text-gray-400 break-words font-mono text-[11px]">{maskCredential(note.content)}</p>
+                                                        </Show>
+                                                    </div>
+                                                </div>
+                                                <div class="flex gap-0.5 opacity-0 group-hover:opacity-100 transition-opacity shrink-0">
+                                                    {/* Show/hide for credentials */}
+                                                    <Show when={note.category === 'credential'}>
+                                                        <button
+                                                            onClick={() => toggleCredentialVisibility(note.id)}
+                                                            class="text-gray-400 hover:text-yellow-400 p-0.5"
+                                                            title={showCredentials().has(note.id) ? 'Hide' : 'Show'}
+                                                        >
+                                                            <Show when={showCredentials().has(note.id)} fallback={
+                                                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" /><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z" /></svg>
+                                                            }>
+                                                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21" /></svg>
+                                                            </Show>
+                                                        </button>
+                                                    </Show>
+                                                    {/* Copy button */}
+                                                    <button
+                                                        onClick={() => copyToClipboard(note.content, note.title)}
+                                                        class="text-gray-400 hover:text-green-400 p-0.5"
+                                                        title="Copy content"
+                                                    >
+                                                        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" /></svg>
+                                                    </button>
+                                                    {/* Edit button */}
+                                                    <button
+                                                        onClick={() => startEdit(note)}
+                                                        class="text-gray-400 hover:text-blue-400 p-0.5"
+                                                        title="Edit"
+                                                    >
+                                                        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" /></svg>
+                                                    </button>
+                                                    {/* Delete button with confirmation */}
+                                                    <Show when={deleteConfirmId() === note.id} fallback={
+                                                        <button
+                                                            onClick={() => setDeleteConfirmId(note.id)}
+                                                            class="text-gray-400 hover:text-red-400 p-0.5"
+                                                            title="Delete"
+                                                        >
+                                                            <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" /></svg>
+                                                        </button>
+                                                    }>
+                                                        <div class="flex items-center gap-1 bg-red-900/50 rounded px-1">
+                                                            <span class="text-red-300 text-[10px]">Delete?</span>
+                                                            <button
+                                                                onClick={() => deleteNote(note.id)}
+                                                                class="text-red-400 hover:text-red-300 p-0.5 font-bold"
+                                                                title="Confirm delete"
+                                                            >
+                                                                ✓
+                                                            </button>
+                                                            <button
+                                                                onClick={() => setDeleteConfirmId(null)}
+                                                                class="text-gray-400 hover:text-gray-300 p-0.5"
+                                                                title="Cancel"
+                                                            >
+                                                                ✗
+                                                            </button>
+                                                        </div>
+                                                    </Show>
+                                                </div>
+                                            </div>
+                                        </div>
+                                    )}
+                                </For>
+                            </div>
+                        </Show>
+                    </Show>
+
+                    {/* Template picker */}
+                    <Show when={showTemplates()}>
+                        <div class="bg-gray-800/80 rounded p-2 border border-gray-700">
+                            <div class="flex items-center justify-between mb-2">
+                                <span class="text-xs font-medium text-gray-300">Quick Templates</span>
+                                <button onClick={() => setShowTemplates(false)} class="text-gray-400 hover:text-gray-200 text-xs">✕</button>
+                            </div>
+                            <div class="grid grid-cols-2 gap-1">
+                                <For each={TEMPLATES}>
+                                    {(template) => (
+                                        <button
+                                            onClick={() => useTemplate(template)}
+                                            class={`text-left px-2 py-1 rounded text-[10px] border ${CATEGORY_COLORS[template.category]} hover:opacity-80 transition-opacity`}
+                                        >
+                                            {CATEGORY_ICONS[template.category]} {template.title}
+                                        </button>
+                                    )}
+                                </For>
+                            </div>
+                        </div>
+                    </Show>
+
+                    {/* Actions menu (Export/Import/Clear) */}
+                    <Show when={showActions()}>
+                        <div class="bg-gray-800/80 rounded p-2 border border-gray-700 space-y-1">
+                            <div class="flex items-center justify-between mb-1">
+                                <span class="text-xs font-medium text-gray-300">Actions</span>
+                                <button onClick={() => { setShowActions(false); setClearConfirm(false); }} class="text-gray-400 hover:text-gray-200 text-xs">✕</button>
+                            </div>
+                            <button
+                                onClick={exportNotes}
+                                disabled={!hasNotes()}
+                                class="w-full text-left px-2 py-1.5 rounded text-xs bg-blue-600/20 hover:bg-blue-600/30 text-blue-300 disabled:opacity-50 disabled:cursor-not-allowed flex items-center gap-2"
+                            >
+                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" /></svg>
+                                Export Notes (JSON)
+                            </button>
+                            <button
+                                onClick={() => fileInputRef?.click()}
+                                disabled={isImporting()}
+                                class="w-full text-left px-2 py-1.5 rounded text-xs bg-green-600/20 hover:bg-green-600/30 text-green-300 disabled:opacity-50 flex items-center gap-2"
+                            >
+                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12" /></svg>
+                                {isImporting() ? 'Importing...' : 'Import Notes (Merge)'}
+                            </button>
+                            <Show when={clearConfirm()} fallback={
+                                <button
+                                    onClick={() => setClearConfirm(true)}
+                                    disabled={!hasNotes()}
+                                    class="w-full text-left px-2 py-1.5 rounded text-xs bg-red-600/20 hover:bg-red-600/30 text-red-300 disabled:opacity-50 disabled:cursor-not-allowed flex items-center gap-2"
+                                >
+                                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" /></svg>
+                                    Clear All Notes
+                                </button>
+                            }>
+                                <div class="bg-red-900/50 rounded p-2 flex items-center justify-between">
+                                    <span class="text-red-300 text-[10px]">Delete all {notes().length} notes?</span>
+                                    <div class="flex gap-1">
+                                        <button onClick={clearAllNotes} class="px-2 py-0.5 bg-red-600 hover:bg-red-500 text-white rounded text-[10px]">Yes, clear all</button>
+                                        <button onClick={() => setClearConfirm(false)} class="px-2 py-0.5 bg-gray-600 hover:bg-gray-500 text-white rounded text-[10px]">Cancel</button>
+                                    </div>
+                                </div>
+                            </Show>
+                        </div>
+                    </Show>
+
+                    {/* Add/Edit form */}
+                    <Show when={showAddForm()}>
+                        <div class="bg-gray-800/80 rounded p-2 space-y-2 border border-gray-700">
+                            <div class="flex items-center justify-between mb-1">
+                                <span class="text-xs font-medium text-gray-300">
+                                    {editingNote() ? 'Edit Note' : 'Add Note'}
+                                </span>
+                                <Show when={editingNote()}>
+                                    <span class="text-[10px] text-gray-500">ID: {editingNote()?.id}</span>
+                                </Show>
+                            </div>
+                            <div class="flex gap-2">
+                                <select
+                                    value={category()}
+                                    onChange={(e) => setCategory(e.target.value)}
+                                    class="bg-gray-700 text-xs text-gray-200 rounded px-2 py-1.5 border border-gray-600"
+                                >
+                                    <For each={CATEGORY_OPTIONS}>
+                                        {(cat) => <option value={cat}>{CATEGORY_ICONS[cat]} {CATEGORY_LABELS[cat]}</option>}
+                                    </For>
+                                </select>
+                                <input
+                                    type="text"
+                                    placeholder="Title (e.g., 'Admin Password')"
+                                    value={title()}
+                                    onInput={(e) => setTitle(e.target.value)}
+                                    class="flex-1 bg-gray-700 text-xs text-gray-200 rounded px-2 py-1.5 border border-gray-600 placeholder-gray-500"
+                                />
+                            </div>
+                            <textarea
+                                placeholder={category() === 'credential'
+                                    ? "Enter credential value (stored encrypted)..."
+                                    : "Content..."}
+                                value={content()}
+                                onInput={(e) => setContent(e.target.value)}
+                                class="w-full bg-gray-700 text-xs text-gray-200 rounded px-2 py-1.5 border border-gray-600 resize-none placeholder-gray-500 font-mono"
+                                rows={2}
+                            />
+                            <Show when={category() === 'credential'}>
+                                <p class="text-[10px] text-amber-400 flex items-center gap-1">
+                                    <span>🔐</span> Credentials are encrypted at rest and masked in the UI
+                                </p>
+                            </Show>
+                            <div class="flex gap-2 justify-end">
+                                <button
+                                    onClick={cancelEdit}
+                                    class="text-xs px-2 py-1 text-gray-400 hover:text-gray-200"
+                                >
+                                    Cancel
+                                </button>
+                                <button
+                                    onClick={saveNote}
+                                    disabled={!title().trim() || !content().trim()}
+                                    class="text-xs px-3 py-1 bg-blue-600 text-white rounded hover:bg-blue-500 disabled:opacity-50 disabled:cursor-not-allowed"
+                                >
+                                    {editingNote() ? 'Update' : 'Save'}
+                                </button>
+                            </div>
+                        </div>
+                    </Show>
+
+                    {/* Action buttons row */}
+                    <Show when={!showAddForm() && !showTemplates() && !showActions()}>
+                        <div class="flex items-center gap-2 pt-1">
+                            <button
+                                onClick={() => setShowAddForm(true)}
+                                class="text-xs text-blue-400 hover:text-blue-300 flex items-center gap-1"
+                            >
+                                <span>+</span> Add note
+                            </button>
+                            <button
+                                onClick={() => setShowTemplates(true)}
+                                class="text-xs text-purple-400 hover:text-purple-300 flex items-center gap-1"
+                            >
+                                <span>📝</span> Templates
+                            </button>
+                            <button
+                                onClick={() => setShowActions(true)}
+                                class="text-xs text-gray-400 hover:text-gray-300 flex items-center gap-1"
+                            >
+                                <span>⚙️</span> Actions
+                            </button>
+                        </div>
+                    </Show>
+                </div>
+            </Show>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/Alerts/ActivationModal.tsx b/frontend-modern/src/components/Alerts/ActivationModal.tsx
index 03e0652..6a04a3c 100644
--- a/frontend-modern/src/components/Alerts/ActivationModal.tsx
+++ b/frontend-modern/src/components/Alerts/ActivationModal.tsx
@@ -5,6 +5,7 @@ import type { JSX } from 'solid-js';
 import type { Alert } from '@/types/api';
 import type { AlertConfig, AlertThresholds, HysteresisThreshold } from '@/types/alerts';
 import { showError, showSuccess } from '@/utils/toast';
+import { formatAlertValue, formatAlertThreshold } from '@/utils/alertFormatters';
 
 interface ActivationModalProps {
   isOpen: boolean;
@@ -85,7 +86,7 @@ const summarizeThresholds = (config: AlertConfig | null): ThresholdSummary[] =>
       ...nodeItems,
       {
         label: 'Temperature',
-        value: formatThreshold(extractTrigger(config.nodeDefaults?.temperature)),
+        value: formatAlertThreshold(extractTrigger(config.nodeDefaults?.temperature), 'temperature'),
       },
     ];
     summaries.push({ heading: 'Node thresholds', items: nodeWithTemperature });
@@ -263,20 +264,18 @@ export function ActivationModal(props: ActivationModalProps): JSX.Element {
                     <For each={violations()}>
                       {(alert) => (
                         <div
-                          class={`border rounded-md p-3 text-sm transition-colors ${
-                            alert.level === 'critical'
-                              ? 'border-red-300 dark:border-red-700 bg-red-50 dark:bg-red-900/20'
-                              : 'border-yellow-300 dark:border-yellow-700 bg-yellow-50 dark:bg-yellow-900/20'
-                          }`}
+                          class={`border rounded-md p-3 text-sm transition-colors ${alert.level === 'critical'
+                            ? 'border-red-300 dark:border-red-700 bg-red-50 dark:bg-red-900/20'
+                            : 'border-yellow-300 dark:border-yellow-700 bg-yellow-50 dark:bg-yellow-900/20'
+                            }`}
                         >
                           <div class="flex items-center justify-between">
                             <div class="flex items-center gap-2">
                               <span
-                                class={`px-2 py-0.5 rounded-full text-xs font-semibold uppercase ${
-                                  alert.level === 'critical'
-                                    ? 'bg-red-600 text-white'
-                                    : 'bg-yellow-500 text-gray-900'
-                                }`}
+                                class={`px-2 py-0.5 rounded-full text-xs font-semibold uppercase ${alert.level === 'critical'
+                                  ? 'bg-red-600 text-white'
+                                  : 'bg-yellow-500 text-gray-900'
+                                  }`}
                               >
                                 {alert.level}
                               </span>
@@ -288,7 +287,7 @@ export function ActivationModal(props: ActivationModalProps): JSX.Element {
                           </div>
                           <p class="mt-2 text-xs text-gray-600 dark:text-gray-300">{alert.message}</p>
                           <p class="mt-1 text-xs text-gray-500 dark:text-gray-400">
-                            Threshold {alert.threshold}% • Current {alert.value}% • Since{' '}
+                            Threshold {formatAlertValue(alert.threshold, alert.type)} • Current {formatAlertValue(alert.value, alert.type)} • Since{' '}
                             {new Date(alert.startTime).toLocaleString()}
                           </p>
                         </div>
@@ -303,11 +302,10 @@ export function ActivationModal(props: ActivationModalProps): JSX.Element {
                   Notification channels
                 </h3>
                 <div
-                  class={`mt-3 rounded-md border p-4 ${
-                    channelSummary().status === 'configured'
-                      ? 'border-green-200 dark:border-green-700 bg-green-50 dark:bg-green-900/20'
-                      : 'border-blue-200 dark:border-blue-700 bg-blue-50 dark:bg-blue-900/20'
-                  }`}
+                  class={`mt-3 rounded-md border p-4 ${channelSummary().status === 'configured'
+                    ? 'border-green-200 dark:border-green-700 bg-green-50 dark:bg-green-900/20'
+                    : 'border-blue-200 dark:border-blue-700 bg-blue-50 dark:bg-blue-900/20'
+                    }`}
                 >
                   <p class="text-sm text-gray-800 dark:text-gray-100">{channelSummary().message}</p>
                   <button
diff --git a/frontend-modern/src/components/Alerts/InvestigateAlertButton.tsx b/frontend-modern/src/components/Alerts/InvestigateAlertButton.tsx
new file mode 100644
index 0000000..96a73b8
--- /dev/null
+++ b/frontend-modern/src/components/Alerts/InvestigateAlertButton.tsx
@@ -0,0 +1,189 @@
+import { Show, createSignal } from 'solid-js';
+import { aiChatStore } from '@/stores/aiChat';
+import type { Alert } from '@/types/api';
+import { formatAlertValue } from '@/utils/alertFormatters';
+
+interface InvestigateAlertButtonProps {
+    alert: Alert;
+    resourceType?: string;
+    vmid?: number;
+    size?: 'sm' | 'md';
+    variant?: 'icon' | 'text' | 'full';
+    class?: string;
+}
+
+/**
+ * "Ask AI" button for one-click alert investigation.
+ * When clicked, opens the AI chat panel with the alert context pre-populated.
+ */
+export function InvestigateAlertButton(props: InvestigateAlertButtonProps) {
+    const [isHovered, setIsHovered] = createSignal(false);
+
+    const handleClick = (e: MouseEvent) => {
+        e.stopPropagation();
+        e.preventDefault();
+
+        // Calculate how long the alert has been active
+        const startTime = new Date(props.alert.startTime);
+        const now = new Date();
+        const durationMs = now.getTime() - startTime.getTime();
+        const durationMins = Math.floor(durationMs / 60000);
+        const durationStr =
+            durationMins < 60
+                ? `${durationMins} min${durationMins !== 1 ? 's' : ''}`
+                : `${Math.floor(durationMins / 60)}h ${durationMins % 60}m`;
+
+        // Format a focused prompt for investigation
+        const prompt = `Investigate this ${props.alert.level.toUpperCase()} alert:
+
+**Resource:** ${props.alert.resourceName}
+**Alert Type:** ${props.alert.type}
+**Current Value:** ${formatAlertValue(props.alert.value, props.alert.type)}
+**Threshold:** ${formatAlertValue(props.alert.threshold, props.alert.type)}
+**Duration:** ${durationStr}
+${props.alert.node ? `**Node:** ${props.alert.node}` : ''}
+
+Please:
+1. Identify the root cause
+2. Check related metrics
+3. Suggest specific remediation steps
+4. Execute diagnostic commands if safe`;
+
+        // Determine target type from alert or infer from resource
+        let targetType = props.resourceType || 'guest';
+        if (props.alert.type.startsWith('node_')) {
+            targetType = 'node';
+        } else if (props.alert.type.startsWith('docker_')) {
+            targetType = 'docker_container';
+        } else if (props.alert.type.startsWith('storage_')) {
+            targetType = 'storage';
+        }
+
+        // Open AI chat with this context and prompt
+        aiChatStore.openWithPrompt(prompt, {
+            targetType,
+            targetId: props.alert.resourceId,
+            context: {
+                alertId: props.alert.id,
+                alertType: props.alert.type,
+                alertLevel: props.alert.level,
+                alertMessage: props.alert.message,
+                guestName: props.alert.resourceName,
+                node: props.alert.node,
+                vmid: props.vmid,
+            },
+        });
+    };
+
+    const sizeClasses = {
+        sm: 'w-6 h-6 text-xs',
+        md: 'w-8 h-8 text-sm',
+    };
+
+    const baseButtonClass = `
+    inline-flex items-center justify-center
+    rounded-md transition-all duration-200
+    focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500
+    disabled:opacity-50 disabled:cursor-not-allowed
+  `;
+
+    // Icon-only variant (smallest footprint)
+    if (props.variant === 'icon') {
+        return (
+            <button
+                type="button"
+                onClick={handleClick}
+                onMouseEnter={() => setIsHovered(true)}
+                onMouseLeave={() => setIsHovered(false)}
+                class={`${baseButtonClass} ${sizeClasses[props.size || 'sm']} 
+          bg-gradient-to-r from-purple-500/10 to-blue-500/10
+          hover:from-purple-500/20 hover:to-blue-500/20
+          text-purple-600 dark:text-purple-400
+          hover:text-purple-700 dark:hover:text-purple-300
+          border border-purple-200/50 dark:border-purple-700/50
+          hover:border-purple-300 dark:hover:border-purple-600
+          ${props.class || ''}`}
+                title="Ask AI to investigate this alert"
+            >
+                <svg
+                    class={`${props.size === 'sm' ? 'w-3.5 h-3.5' : 'w-4 h-4'}`}
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                >
+                    <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z"
+                    />
+                </svg>
+            </button>
+        );
+    }
+
+    // Text variant (shows "Ask AI" on hover)
+    if (props.variant === 'text') {
+        return (
+            <button
+                type="button"
+                onClick={handleClick}
+                onMouseEnter={() => setIsHovered(true)}
+                onMouseLeave={() => setIsHovered(false)}
+                class={`${baseButtonClass} px-2 py-1
+          bg-gradient-to-r from-purple-500/10 to-blue-500/10
+          hover:from-purple-500/20 hover:to-blue-500/20
+          text-purple-600 dark:text-purple-400
+          hover:text-purple-700 dark:hover:text-purple-300
+          border border-purple-200/50 dark:border-purple-700/50
+          hover:border-purple-300 dark:hover:border-purple-600
+          gap-1.5
+          ${props.class || ''}`}
+                title="Ask AI to investigate this alert"
+            >
+                <svg class="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z"
+                    />
+                </svg>
+                <span class="text-xs font-medium">Ask AI</span>
+            </button>
+        );
+    }
+
+    // Full variant (with expanded label)
+    return (
+        <button
+            type="button"
+            onClick={handleClick}
+            onMouseEnter={() => setIsHovered(true)}
+            onMouseLeave={() => setIsHovered(false)}
+            class={`${baseButtonClass} px-3 py-1.5
+        bg-gradient-to-r from-purple-500 to-blue-500
+        hover:from-purple-600 hover:to-blue-600
+        text-white font-medium
+        shadow-sm hover:shadow-md
+        gap-2
+        ${props.class || ''}`}
+            title="Ask AI to investigate this alert"
+        >
+            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    stroke-width="2"
+                    d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z"
+                />
+            </svg>
+            <span>Investigate with AI</span>
+            <Show when={isHovered()}>
+                <span class="text-xs opacity-80">→</span>
+            </Show>
+        </button>
+    );
+}
+
+export default InvestigateAlertButton;
diff --git a/frontend-modern/src/components/Backups/BackupsFilter.tsx b/frontend-modern/src/components/Backups/BackupsFilter.tsx
index 0146cb6..69f1c43 100644
--- a/frontend-modern/src/components/Backups/BackupsFilter.tsx
+++ b/frontend-modern/src/components/Backups/BackupsFilter.tsx
@@ -23,6 +23,9 @@ interface BackupsFilterProps {
   onReset?: () => void;
   statusFilter?: () => 'all' | 'verified' | 'unverified';
   setStatusFilter?: (value: 'all' | 'verified' | 'unverified') => void;
+  // Time format toggle
+  useRelativeTime?: () => boolean;
+  setUseRelativeTime?: (value: boolean) => void;
 }
 
 export const BackupsFilter: Component<BackupsFilterProps> = (props) => {
@@ -504,6 +507,25 @@ export const BackupsFilter: Component<BackupsFilterProps> = (props) => {
 
           <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
 
+          {/* Time Format Toggle */}
+          <Show when={props.useRelativeTime && props.setUseRelativeTime}>
+            <button
+              type="button"
+              onClick={() => props.setUseRelativeTime!(!props.useRelativeTime!())}
+              title={props.useRelativeTime!() ? 'Switch to absolute time' : 'Switch to relative time'}
+              class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-lg transition-all ${props.useRelativeTime!()
+                  ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 border border-blue-200 dark:border-blue-800'
+                  : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 border border-gray-200 dark:border-gray-600 hover:bg-gray-200 dark:hover:bg-gray-600'
+                }`}
+            >
+              <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+              </svg>
+              <span class="hidden sm:inline">{props.useRelativeTime!() ? 'Relative' : 'Absolute'}</span>
+            </button>
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
+          </Show>
+
           {/* Reset Button */}
           <button
             onClick={() => {
@@ -518,14 +540,14 @@ export const BackupsFilter: Component<BackupsFilterProps> = (props) => {
             }}
             title="Reset all filters"
             class={`flex items-center justify-center px-2.5 py-1 text-xs font-medium rounded-lg transition-colors ${props.search().trim() !== '' ||
-                props.viewMode() !== 'all' ||
-                props.groupBy() !== 'date' ||
-                props.sortKey() !== 'backupTime' ||
-                props.sortDirection() !== 'desc' ||
-                (props.typeFilter && props.typeFilter() !== 'all') ||
-                (props.statusFilter && props.statusFilter() !== 'all')
-                ? 'text-blue-700 dark:text-blue-300 bg-blue-100 dark:bg-blue-900/50 hover:bg-blue-200 dark:hover:bg-blue-900/70'
-                : 'text-gray-600 dark:text-gray-400 bg-gray-100 dark:bg-gray-700 hover:bg-gray-200 dark:hover:bg-gray-600'
+              props.viewMode() !== 'all' ||
+              props.groupBy() !== 'date' ||
+              props.sortKey() !== 'backupTime' ||
+              props.sortDirection() !== 'desc' ||
+              (props.typeFilter && props.typeFilter() !== 'all') ||
+              (props.statusFilter && props.statusFilter() !== 'all')
+              ? 'text-blue-700 dark:text-blue-300 bg-blue-100 dark:bg-blue-900/50 hover:bg-blue-200 dark:hover:bg-blue-900/70'
+              : 'text-gray-600 dark:text-gray-400 bg-gray-100 dark:bg-gray-700 hover:bg-gray-200 dark:hover:bg-gray-600'
               }`}
           >
             <svg
diff --git a/frontend-modern/src/components/Backups/UnifiedBackups.tsx b/frontend-modern/src/components/Backups/UnifiedBackups.tsx
index e8f4bf2..6671e3f 100644
--- a/frontend-modern/src/components/Backups/UnifiedBackups.tsx
+++ b/frontend-modern/src/components/Backups/UnifiedBackups.tsx
@@ -134,12 +134,10 @@ const UnifiedBackups: Component = () => {
     }
   });
 
-  const [useRelativeTime] = createLocalStorageBooleanSignal(
+  const [useRelativeTime, setUseRelativeTime] = createLocalStorageBooleanSignal(
     STORAGE_KEYS.BACKUPS_USE_RELATIVE_TIME,
     false, // Default to absolute time
   );
-  // TODO: Add time format toggle to BackupsFilter component
-  // const setUseRelativeTime = ...;
 
   // Helper functions
   const getDaySuffix = (day: number) => {
@@ -1932,6 +1930,8 @@ const UnifiedBackups: Component = () => {
           sortDirection={sortDirection}
           setSortDirection={setSortDirection}
           onReset={resetFilters}
+          useRelativeTime={useRelativeTime}
+          setUseRelativeTime={setUseRelativeTime}
         />
 
         {/* Table */}
@@ -2364,7 +2364,7 @@ const UnifiedBackups: Component = () => {
                                   </td>
                                 </Show>
                                 <td
-                                  class="hidden md:table-cell p-0.5 px-1.5 cursor-help align-middle"
+                                  class="hidden md:table-cell p-0.5 px-1.5 align-middle"
                                   onMouseEnter={(e) => {
                                     const details = [];
 
diff --git a/frontend-modern/src/components/Dashboard/Dashboard.tsx b/frontend-modern/src/components/Dashboard/Dashboard.tsx
index 2df7232..130f372 100644
--- a/frontend-modern/src/components/Dashboard/Dashboard.tsx
+++ b/frontend-modern/src/components/Dashboard/Dashboard.tsx
@@ -1,7 +1,7 @@
 import { createSignal, createMemo, createEffect, For, Show, onMount } from 'solid-js';
 import { useNavigate } from '@solidjs/router';
 import type { VM, Container, Node } from '@/types/api';
-import { GuestRow, GUEST_COLUMNS } from './GuestRow';
+import { GuestRow, GUEST_COLUMNS, type GuestColumnDef } from './GuestRow';
 import { useWebSocket } from '@/App';
 import { getAlertStyles } from '@/utils/alerts';
 import { useAlertsActivation } from '@/stores/alertsActivation';
@@ -19,8 +19,10 @@ import { isNodeOnline, OFFLINE_HEALTH_STATUSES, DEGRADED_HEALTH_STATUSES } from
 import { getNodeDisplayName } from '@/utils/nodes';
 import { logger } from '@/utils/logger';
 import { usePersistentSignal } from '@/hooks/usePersistentSignal';
+import { useColumnVisibility } from '@/hooks/useColumnVisibility';
 import { STORAGE_KEYS } from '@/utils/localStorage';
 import { getBackupInfo } from '@/utils/format';
+import { aiChatStore } from '@/stores/aiChat';
 
 type GuestMetadataRecord = Record<string, GuestMetadata>;
 type IdleCallbackHandle = number;
@@ -199,6 +201,7 @@ type ViewMode = 'all' | 'vm' | 'lxc';
 type StatusMode = 'all' | 'running' | 'degraded' | 'stopped';
 type BackupMode = 'all' | 'needs-backup';
 type GroupingMode = 'grouped' | 'flat';
+type ProblemsMode = 'all' | 'problems';
 
 export function Dashboard(props: DashboardProps) {
   const navigate = useNavigate();
@@ -252,6 +255,15 @@ export function Dashboard(props: DashboardProps) {
     },
   );
 
+  // Problems mode - show only guests with issues
+  const [problemsMode, setProblemsMode] = usePersistentSignal<ProblemsMode>(
+    'dashboardProblemsMode',
+    'all',
+    {
+      deserialize: (raw) => (raw === 'all' || raw === 'problems' ? raw : 'all'),
+    },
+  );
+
   const [showFilters, setShowFilters] = usePersistentSignal<boolean>(
     'dashboardShowFilters',
     false,
@@ -265,8 +277,18 @@ export function Dashboard(props: DashboardProps) {
   const [sortKey, setSortKey] = createSignal<keyof (VM | Container) | null>('vmid');
   const [sortDirection, setSortDirection] = createSignal<'asc' | 'desc'>('asc');
 
+  // Column visibility management
+  // OS and IP columns are hidden by default since they require guest agent and may show dashes
+  const columnVisibility = useColumnVisibility(
+    STORAGE_KEYS.DASHBOARD_HIDDEN_COLUMNS,
+    GUEST_COLUMNS as GuestColumnDef[],
+    ['os', 'ip']  // Default hidden columns for cleaner first-run experience
+  );
+  const visibleColumns = columnVisibility.visibleColumns;
+  const visibleColumnIds = createMemo(() => visibleColumns().map(c => c.id));
+
   // Total columns for colspan calculations
-  const totalColumns = GUEST_COLUMNS.length;
+  const totalColumns = createMemo(() => visibleColumns().length);
 
   // Load all guest metadata on mount (single API call for all guests)
   onMount(async () => {
@@ -434,7 +456,8 @@ export function Dashboard(props: DashboardProps) {
           selectedNode() !== null ||
           viewMode() !== 'all' ||
           statusMode() !== 'all' ||
-          backupMode() !== 'all';
+          backupMode() !== 'all' ||
+          problemsMode() !== 'all';
 
         if (hasActiveFilters) {
           // Clear ALL filters including search text, tag filters, node selection, and view modes
@@ -446,6 +469,7 @@ export function Dashboard(props: DashboardProps) {
           setViewMode('all');
           setStatusMode('all');
           setBackupMode('all');
+          setProblemsMode('all');
 
           // Blur the search input if it's focused
           if (searchInputRef && document.activeElement === searchInputRef) {
@@ -457,6 +481,12 @@ export function Dashboard(props: DashboardProps) {
         }
       } else if (!isInputField && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
         // If it's a printable character and user is not in an input field
+        // Check if AI chat is open - if so, focus that instead
+        if (aiChatStore.focusInput()) {
+          // AI chat input was focused, let the character be typed there
+          return;
+        }
+        // Otherwise, focus the search input
         // Expand filters section if collapsed
         if (!showFilters()) {
           setShowFilters(true);
@@ -473,6 +503,32 @@ export function Dashboard(props: DashboardProps) {
     return () => document.removeEventListener('keydown', handleKeyDown);
   });
 
+  // Compute guests with problems - used for AI investigation regardless of filter state
+  const problemGuests = createMemo(() => {
+    return allGuests().filter((g) => {
+      // Skip templates
+      if (g.template) return false;
+
+      // Check for degraded status
+      const status = (g.status || '').toLowerCase();
+      const isDegraded = DEGRADED_HEALTH_STATUSES.has(status) ||
+        (status !== 'running' && !OFFLINE_HEALTH_STATUSES.has(status) && status !== 'stopped');
+      if (isDegraded) return true;
+
+      // Check for backup issues
+      const backupInfo = getBackupInfo(g.lastBackup);
+      if (backupInfo.status === 'stale' || backupInfo.status === 'critical' || backupInfo.status === 'never') {
+        return true;
+      }
+
+      // Check for high resource usage (>90%)
+      if (g.cpu > 0.9) return true;
+      if (g.memory && g.memory.usage && g.memory.usage > 90) return true;
+
+      return false;
+    });
+  });
+
   // Filter guests based on current settings
   const filteredGuests = createMemo(() => {
     let guests = allGuests();
@@ -493,7 +549,8 @@ export function Dashboard(props: DashboardProps) {
     if (viewMode() === 'vm') {
       guests = guests.filter((g) => g.type === 'qemu');
     } else if (viewMode() === 'lxc') {
-      guests = guests.filter((g) => g.type === 'lxc');
+      // Include both traditional LXC and OCI containers (Proxmox 9.1+)
+      guests = guests.filter((g) => g.type === 'lxc' || g.type === 'oci');
     }
 
     // Filter by status
@@ -522,6 +579,32 @@ export function Dashboard(props: DashboardProps) {
       });
     }
 
+    // Filter by problems mode - show guests that need attention
+    if (problemsMode() === 'problems') {
+      guests = guests.filter((g) => {
+        // Skip templates
+        if (g.template) return false;
+
+        // Check for degraded status
+        const status = (g.status || '').toLowerCase();
+        const isDegraded = DEGRADED_HEALTH_STATUSES.has(status) ||
+          (status !== 'running' && !OFFLINE_HEALTH_STATUSES.has(status) && status !== 'stopped');
+        if (isDegraded) return true;
+
+        // Check for backup issues
+        const backupInfo = getBackupInfo(g.lastBackup);
+        if (backupInfo.status === 'stale' || backupInfo.status === 'critical' || backupInfo.status === 'never') {
+          return true;
+        }
+
+        // Check for high resource usage (>90%)
+        if (g.cpu > 0.9) return true;
+        if (g.memory && g.memory.usage && g.memory.usage > 90) return true;
+
+        return false;
+      });
+    }
+
     // Apply search/filter
     const searchTerm = search().trim();
     if (searchTerm) {
@@ -643,6 +726,7 @@ export function Dashboard(props: DashboardProps) {
     guests.forEach((guest) => {
       // Node.ID is formatted as "instance-nodename", so we need to match that
       const nodeId = `${guest.instance}-${guest.node}`;
+
       if (!groups[nodeId]) {
         groups[nodeId] = [];
       }
@@ -724,7 +808,7 @@ export function Dashboard(props: DashboardProps) {
     }).length;
     const stopped = guests.length - running - degraded;
     const vms = guests.filter((g) => g.type === 'qemu').length;
-    const containers = guests.filter((g) => g.type === 'lxc').length;
+    const containers = guests.filter((g) => g.type === 'lxc' || g.type === 'oci').length;
     return {
       total: guests.length,
       running,
@@ -737,6 +821,27 @@ export function Dashboard(props: DashboardProps) {
 
   const handleNodeSelect = (nodeId: string | null, nodeType: 'pve' | 'pbs' | 'pmg' | null) => {
     logger.debug('handleNodeSelect called', { nodeId, nodeType });
+
+    // If AI sidebar is open, add node to AI context instead of filtering
+    if (aiChatStore.isOpen && nodeId && nodeType === 'pve') {
+      const node = props.nodes.find((n) => n.id === nodeId);
+      if (node) {
+        // Toggle: remove if already in context, add if not
+        if (aiChatStore.hasContextItem(nodeId)) {
+          aiChatStore.removeContextItem(nodeId);
+        } else {
+          aiChatStore.addContextItem('node', nodeId, node.name, {
+            nodeName: node.name,
+            name: node.name,
+            type: 'Proxmox Node',
+            status: node.status,
+            instance: node.instance,
+          });
+        }
+      }
+      return;
+    }
+
     // Track selected node for filtering (independent of search)
     if (nodeType === 'pve' || nodeType === null) {
       setSelectedNode(nodeId);
@@ -796,6 +901,43 @@ export function Dashboard(props: DashboardProps) {
     }
   };
 
+  // Handle row click - add guest to AI context (works even when sidebar is closed)
+  const handleGuestRowClick = (guest: VM | Container) => {
+    // Only enable if AI is configured
+    if (!aiChatStore.enabled) return;
+
+    const guestId = guest.id || `${guest.instance}-${guest.vmid}`;
+    const guestType = guest.type === 'qemu' ? 'vm' : 'container';
+    const isOCI = guest.type === 'oci' || ('isOci' in guest && guest.isOci === true);
+
+    // Toggle: remove if already in context, add if not
+    if (aiChatStore.hasContextItem(guestId)) {
+      aiChatStore.removeContextItem(guestId);
+      // If no items left in context and sidebar is open, keep it open for now
+    } else {
+      // Build context with OCI-specific info when applicable
+      const contextData: Record<string, unknown> = {
+        guestName: guest.name,
+        name: guest.name,
+        type: guest.type === 'qemu' ? 'Virtual Machine' : (isOCI ? 'OCI Container' : 'LXC Container'),
+        vmid: guest.vmid,
+        node: guest.node,
+        status: guest.status,
+      };
+
+      // Add OCI image info if available
+      if (isOCI && 'osTemplate' in guest && guest.osTemplate) {
+        contextData.ociImage = guest.osTemplate;
+      }
+
+      aiChatStore.addContextItem(guestType, guestId, guest.name, contextData);
+      // Auto-open the sidebar when first item is selected
+      if (!aiChatStore.isOpen) {
+        aiChatStore.open();
+      }
+    }
+  };
+
   return (
     <div class="space-y-3">
       <ProxmoxSectionNav current="overview" />
@@ -807,7 +949,7 @@ export function Dashboard(props: DashboardProps) {
         onNodeSelect={handleNodeSelect}
         nodes={props.nodes}
         filteredVms={filteredGuests().filter((g) => g.type === 'qemu')}
-        filteredContainers={filteredGuests().filter((g) => g.type === 'lxc')}
+        filteredContainers={filteredGuests().filter((g) => g.type === 'lxc' || g.type === 'oci')}
         searchTerm={search()}
       />
 
@@ -822,11 +964,18 @@ export function Dashboard(props: DashboardProps) {
         setStatusMode={setStatusMode}
         backupMode={backupMode}
         setBackupMode={setBackupMode}
+        problemsMode={problemsMode}
+        setProblemsMode={setProblemsMode}
+        filteredProblemGuests={problemGuests}
         groupingMode={groupingMode}
         setGroupingMode={setGroupingMode}
         setSortKey={setSortKey}
         setSortDirection={setSortDirection}
         searchInputRef={(el) => (searchInputRef = el)}
+        availableColumns={columnVisibility.availableToggles()}
+        isColumnHidden={columnVisibility.isHiddenByUser}
+        onColumnToggle={columnVisibility.toggle}
+        onColumnReset={columnVisibility.resetToDefaults}
       />
 
       {/* Loading State */}
@@ -951,96 +1100,40 @@ export function Dashboard(props: DashboardProps) {
         <ComponentErrorBoundary name="Guest Table">
           <Card padding="none" tone="glass" class="mb-4 overflow-hidden">
             <div class="overflow-x-auto">
-              <table class="w-full border-collapse whitespace-nowrap">
+              <table class="w-full border-collapse whitespace-nowrap" style={{ "min-width": "900px" }}>
                 <thead>
                   <tr class="bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-300 border-b border-gray-200 dark:border-gray-700">
-                    {/* Name Header */}
-                    <th
-                      class="pl-4 pr-2 py-1 text-left text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('name')}
-                    >
-                      Name {sortKey() === 'name' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
+                    <For each={visibleColumns()}>
+                      {(col) => {
+                        const isFirst = () => col.id === visibleColumns()[0]?.id;
+                        const sortKeyForCol = col.sortKey as keyof (VM | Container) | undefined;
+                        const isSortable = !!sortKeyForCol;
+                        const isSorted = () => sortKeyForCol && sortKey() === sortKeyForCol;
 
-                    {/* Type */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('type')}
-                    >
-                      Type {sortKey() === 'type' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* VMID */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('vmid')}
-                    >
-                      VMID {sortKey() === 'vmid' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Uptime */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('uptime')}
-                    >
-                      Uptime {sortKey() === 'uptime' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* CPU */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('cpu')}
-                    >
-                      CPU {sortKey() === 'cpu' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Memory */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('memory')}
-                    >
-                      Memory {sortKey() === 'memory' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Disk */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('disk')}
-                    >
-                      Disk {sortKey() === 'disk' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Disk Read */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('diskRead')}
-                    >
-                      Disk Read {sortKey() === 'diskRead' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Disk Write */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('diskWrite')}
-                    >
-                      Disk Write {sortKey() === 'diskWrite' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Net In */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('networkIn')}
-                    >
-                      Net In {sortKey() === 'networkIn' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
-
-                    {/* Net Out */}
-                    <th
-                      class="px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap"
-                      onClick={() => handleSort('networkOut')}
-                    >
-                      Net Out {sortKey() === 'networkOut' && (sortDirection() === 'asc' ? '▲' : '▼')}
-                    </th>
+                        return (
+                          <th
+                            class={`py-1 text-[11px] sm:text-xs font-medium uppercase tracking-wider whitespace-nowrap
+                              ${isFirst() ? 'pl-4 pr-2 text-left' : 'px-2 text-center'}
+                              ${isSortable ? 'cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600' : ''}`}
+                            style={{
+                              ...(col.width ? { "min-width": col.width } : {}),
+                              "vertical-align": 'middle'
+                            }}
+                            onClick={() => isSortable && handleSort(sortKeyForCol!)}
+                            title={col.icon ? col.label : undefined}
+                          >
+                              <div class={`flex items-center gap-0.5 ${isFirst() ? 'justify-start' : 'justify-center'}`} style={{ "min-height": "14px" }}>
+                              {col.icon ? (
+                                <span class="flex items-center">{col.icon}</span>
+                              ) : (
+                                col.label
+                              )}
+                              {isSorted() && (sortDirection() === 'asc' ? ' ▲' : ' ▼')}
+                            </div>
+                          </th>
+                        );
+                      }}
+                    </For>
                   </tr>
                 </thead>
                 <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
@@ -1059,16 +1152,23 @@ export function Dashboard(props: DashboardProps) {
                       return (
                         <>
                           <Show when={node && groupingMode() === 'grouped'}>
-                            <NodeGroupHeader node={node!} renderAs="tr" colspan={totalColumns} />
+                            <NodeGroupHeader node={node!} renderAs="tr" colspan={totalColumns()} />
                           </Show>
                           <For each={guests} fallback={<></>}>
-                            {(guest) => {
+                            {(guest, index) => {
                               const guestId = guest.id || `${guest.instance}-${guest.vmid}`;
                               const metadata =
                                 guestMetadata()[guestId] ||
                                 guestMetadata()[`${guest.node}-${guest.vmid}`];
                               const parentNode = node ?? resolveParentNode(guest);
                               const parentNodeOnline = parentNode ? isNodeOnline(parentNode) : true;
+
+                              // Get adjacent guest IDs for merged AI context borders
+                              const prevGuest = guests[index() - 1];
+                              const nextGuest = guests[index() + 1];
+                              const prevGuestId = prevGuest ? (prevGuest.id || `${prevGuest.instance}-${prevGuest.vmid}`) : null;
+                              const nextGuestId = nextGuest ? (nextGuest.id || `${nextGuest.instance}-${nextGuest.vmid}`) : null;
+
                               return (
                                 <ComponentErrorBoundary name="GuestRow">
                                   <GuestRow
@@ -1080,6 +1180,10 @@ export function Dashboard(props: DashboardProps) {
                                     parentNodeOnline={parentNodeOnline}
                                     onCustomUrlUpdate={handleCustomUrlUpdate}
                                     isGroupedView={groupingMode() === 'grouped'}
+                                    visibleColumnIds={visibleColumnIds()}
+                                    aboveGuestId={prevGuestId}
+                                    belowGuestId={nextGuestId}
+                                    onRowClick={aiChatStore.enabled ? handleGuestRowClick : undefined}
                                   />
                                 </ComponentErrorBoundary>
                               );
diff --git a/frontend-modern/src/components/Dashboard/DashboardFilter.tsx b/frontend-modern/src/components/Dashboard/DashboardFilter.tsx
index d110057..50ba737 100644
--- a/frontend-modern/src/components/Dashboard/DashboardFilter.tsx
+++ b/frontend-modern/src/components/Dashboard/DashboardFilter.tsx
@@ -2,6 +2,10 @@ import { Component, Show, For, createSignal, onMount, createEffect, onCleanup }
 import { Card } from '@/components/shared/Card';
 import { SearchTipsPopover } from '@/components/shared/SearchTipsPopover';
 import { MetricsViewToggle } from '@/components/shared/MetricsViewToggle';
+import { ColumnPicker } from '@/components/shared/ColumnPicker';
+import { InvestigateProblemsButton } from './InvestigateProblemsButton';
+import type { ColumnDef } from '@/hooks/useColumnVisibility';
+import type { VM, Container } from '@/types/api';
 import { STORAGE_KEYS } from '@/utils/localStorage';
 import { createSearchHistoryManager } from '@/utils/searchHistory';
 
@@ -15,11 +19,20 @@ interface DashboardFilterProps {
   setStatusMode: (value: 'all' | 'running' | 'degraded' | 'stopped') => void;
   backupMode: () => 'all' | 'needs-backup';
   setBackupMode: (value: 'all' | 'needs-backup') => void;
+  problemsMode: () => 'all' | 'problems';
+  setProblemsMode: (value: 'all' | 'problems') => void;
+  /** Guests that match the problems filter - used for AI investigation */
+  filteredProblemGuests?: () => (VM | Container)[];
   groupingMode: () => 'grouped' | 'flat';
   setGroupingMode: (value: 'grouped' | 'flat') => void;
   setSortKey: (value: string) => void;
   setSortDirection: (value: string) => void;
   searchInputRef?: (el: HTMLInputElement) => void;
+  // Column visibility
+  availableColumns?: ColumnDef[];
+  isColumnHidden?: (id: string) => boolean;
+  onColumnToggle?: (id: string) => void;
+  onColumnReset?: () => void;
 }
 
 export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
@@ -91,10 +104,10 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
 
   return (
     <Card class="dashboard-filter mb-3" padding="sm">
-      <div class="flex flex-col lg:flex-row gap-3">
-        {/* Search Bar */}
-        <div class="flex gap-2 flex-1 items-center">
-          <div class="relative flex-1">
+      <div class="flex flex-col gap-3">
+        {/* Row 1: Search Bar */}
+        <div class="flex gap-2 items-center">
+          <div class="relative flex-1 min-w-0">
             <input
               ref={(el) => {
                 searchInputEl = el;
@@ -147,27 +160,33 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
             <Show when={props.search()}>
               <button
                 type="button"
-                class="absolute right-9 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
+                class="absolute right-[4.5rem] top-1/2 -translate-y-1/2 transform p-1 rounded-full 
+                       bg-gray-200 dark:bg-gray-600 text-gray-500 dark:text-gray-300 
+                       hover:bg-red-100 hover:text-red-600 dark:hover:bg-red-900/50 dark:hover:text-red-400 
+                       transition-all duration-150 active:scale-90"
                 onClick={() => props.setSearch('')}
                 onMouseDown={markSuppressCommit}
                 aria-label="Clear search"
                 title="Clear search"
               >
-                <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <svg class="h-3 w-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="3">
                   <path
                     stroke-linecap="round"
                     stroke-linejoin="round"
-                    stroke-width="2"
                     d="M6 18L18 6M6 6l12 12"
                   />
                 </svg>
               </button>
             </Show>
-            <div class="absolute inset-y-0 right-2 flex items-center gap-1">
+            <div class="absolute inset-y-0 right-2 flex items-center gap-0.5">
               <button
                 ref={(el) => (historyToggleRef = el)}
                 type="button"
-                class="flex h-6 w-6 items-center justify-center rounded-lg border border-transparent text-gray-400 transition-colors hover:border-gray-200 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:border-gray-700 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
+                class={`flex h-6 w-6 items-center justify-center rounded-md transition-colors 
+                       ${isHistoryOpen()
+                    ? 'bg-blue-100 dark:bg-blue-900/40 text-blue-600 dark:text-blue-400'
+                    : 'text-gray-400 dark:text-gray-500 hover:bg-gray-100 dark:hover:bg-gray-700 hover:text-gray-600 dark:hover:text-gray-300'
+                  }`}
                 onClick={() =>
                   setIsHistoryOpen((prev) => {
                     const next = !prev;
@@ -186,13 +205,9 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
                     : 'No recent searches yet'
                 }
               >
-                <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M12 8v4l2.5 1.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                  />
+                {/* Dropdown chevron icon - clearer than clock */}
+                <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M19 9l-7 7-7-7" />
                 </svg>
                 <span class="sr-only">Show search history</span>
               </button>
@@ -287,97 +302,141 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
           </div>
         </div>
 
-        {/* Filters */}
+        {/* Row 2: Filters - grouped for logical wrapping */}
+        <div class="flex flex-wrap items-center gap-x-2 gap-y-2">
+          {/* Problems Toggle - Prominent "Show me issues" button */}
+          <button
+            type="button"
+            onClick={() => props.setProblemsMode(props.problemsMode() === 'problems' ? 'all' : 'problems')}
+            class={`inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-semibold rounded-lg transition-all duration-150 active:scale-95 ${props.problemsMode() === 'problems'
+              ? 'bg-gradient-to-r from-red-500 to-orange-500 text-white shadow-md shadow-red-500/25 ring-1 ring-red-400'
+              : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-200 dark:hover:bg-gray-600'
+              }`}
+            title="Show guests that need attention: degraded status, backup issues, or high resource usage (>90%)"
+          >
+            <svg class={`w-3.5 h-3.5 ${props.problemsMode() === 'problems' ? 'animate-pulse' : ''}`} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+              <path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" />
+              <line x1="12" y1="9" x2="12" y2="13" />
+              <line x1="12" y1="17" x2="12.01" y2="17" />
+            </svg>
+            Problems
+          </button>
+
+          {/* AI Investigation button - appears when problems mode is active */}
+          <Show when={props.filteredProblemGuests}>
+            <InvestigateProblemsButton
+              problemGuests={props.filteredProblemGuests!()}
+              isProblemsMode={props.problemsMode() === 'problems'}
+            />
+          </Show>
+
+          <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
+
+          {/* Primary Filters Group: Type + Status */}
+          <div class="flex flex-wrap items-center gap-2">
+            {/* Type Filter */}
+            <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+              <button
+                type="button"
+                onClick={() => props.setViewMode('all')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.viewMode() === 'all'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                All
+              </button>
+              <button
+                type="button"
+                onClick={() => props.setViewMode(props.viewMode() === 'vm' ? 'all' : 'vm')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.viewMode() === 'vm'
+                  ? 'bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-400 shadow-sm ring-1 ring-blue-200 dark:ring-blue-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                  <rect x="2" y="3" width="20" height="14" rx="2" />
+                  <path d="M8 21h8M12 17v4" />
+                </svg>
+                VMs
+              </button>
+              <button
+                type="button"
+                onClick={() => props.setViewMode(props.viewMode() === 'lxc' ? 'all' : 'lxc')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.viewMode() === 'lxc'
+                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm ring-1 ring-green-200 dark:ring-green-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                  <path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z" />
+                </svg>
+                LXCs
+              </button>
+            </div>
+
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
+
+            {/* Status Filter */}
+            <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+              <button
+                type="button"
+                onClick={() => props.setStatusMode('all')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.statusMode() === 'all'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                All
+              </button>
+              <button
+                type="button"
+                onClick={() => props.setStatusMode(props.statusMode() === 'running' ? 'all' : 'running')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.statusMode() === 'running'
+                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm ring-1 ring-green-200 dark:ring-green-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                <span class={`w-2 h-2 rounded-full ${props.statusMode() === 'running' ? 'bg-green-500 shadow-sm shadow-green-500/50' : 'bg-green-400/60'}`} />
+                Running
+              </button>
+              <button
+                type="button"
+                onClick={() => props.setStatusMode(props.statusMode() === 'degraded' ? 'all' : 'degraded')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.statusMode() === 'degraded'
+                  ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm ring-1 ring-amber-200 dark:ring-amber-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                <span class={`w-2 h-2 rounded-full ${props.statusMode() === 'degraded' ? 'bg-amber-500 shadow-sm shadow-amber-500/50' : 'bg-amber-400/60'}`} />
+                Degraded
+              </button>
+              <button
+                type="button"
+                onClick={() => props.setStatusMode(props.statusMode() === 'stopped' ? 'all' : 'stopped')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.statusMode() === 'stopped'
+                  ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm ring-1 ring-red-200 dark:ring-red-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                  }`}
+              >
+                <span class={`w-2 h-2 rounded-full ${props.statusMode() === 'stopped' ? 'bg-red-500 shadow-sm shadow-red-500/50' : 'bg-red-400/60'}`} />
+                Stopped
+              </button>
+            </div>
+          </div>
+
+        </div>
+        {/* End Primary Filters Group */}
+
+        {/* Secondary Controls Group: Backup, Grouping, View, Columns, Reset */}
         <div class="flex flex-wrap items-center gap-2">
-          {/* Type Filter */}
-          <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
-            <button
-              type="button"
-              onClick={() => props.setViewMode('all')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.viewMode() === 'all'
-                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              All
-            </button>
-            <button
-              type="button"
-              onClick={() => props.setViewMode(props.viewMode() === 'vm' ? 'all' : 'vm')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.viewMode() === 'vm'
-                ? 'bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-400 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              VMs
-            </button>
-            <button
-              type="button"
-              onClick={() => props.setViewMode(props.viewMode() === 'lxc' ? 'all' : 'lxc')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.viewMode() === 'lxc'
-                ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              LXCs
-            </button>
-          </div>
-
-          <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
-
-          {/* Status Filter */}
-          <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
-            <button
-              type="button"
-              onClick={() => props.setStatusMode('all')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusMode() === 'all'
-                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              All
-            </button>
-            <button
-              type="button"
-              onClick={() => props.setStatusMode(props.statusMode() === 'running' ? 'all' : 'running')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusMode() === 'running'
-                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              Running
-            </button>
-            <button
-              type="button"
-              onClick={() => props.setStatusMode(props.statusMode() === 'degraded' ? 'all' : 'degraded')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusMode() === 'degraded'
-                  ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              Degraded
-            </button>
-            <button
-              type="button"
-              onClick={() => props.setStatusMode(props.statusMode() === 'stopped' ? 'all' : 'stopped')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusMode() === 'stopped'
-                  ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
-            >
-              Stopped
-            </button>
-          </div>
-
-          <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
-
           {/* Backup Filter */}
           <button
             type="button"
             onClick={() => props.setBackupMode(props.backupMode() === 'needs-backup' ? 'all' : 'needs-backup')}
-            class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-lg transition-all ${props.backupMode() === 'needs-backup'
-              ? 'bg-orange-100 dark:bg-orange-900/50 text-orange-700 dark:text-orange-300 shadow-sm'
-              : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+            class={`inline-flex items-center gap-1.5 px-2.5 py-1.5 text-xs font-medium rounded-lg transition-all duration-150 active:scale-95 ${props.backupMode() === 'needs-backup'
+              ? 'bg-orange-100 dark:bg-orange-900/50 text-orange-700 dark:text-orange-300 shadow-sm ring-1 ring-orange-200 dark:ring-orange-800'
+              : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-200 dark:hover:bg-gray-600'
               }`}
             title="Show guests with stale or missing backups"
           >
@@ -395,23 +454,34 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
             <button
               type="button"
               onClick={() => props.setGroupingMode('grouped')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.groupingMode() === 'grouped'
-                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+              class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.groupingMode() === 'grouped'
+                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
                 }`}
               title="Group by node"
             >
+              <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                <path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2v11z" />
+              </svg>
               Grouped
             </button>
             <button
               type="button"
               onClick={() => props.setGroupingMode(props.groupingMode() === 'flat' ? 'grouped' : 'flat')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.groupingMode() === 'flat'
-                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+              class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${props.groupingMode() === 'flat'
+                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
                 }`}
               title="Flat list view"
             >
+              <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                <line x1="8" y1="6" x2="21" y2="6" />
+                <line x1="8" y1="12" x2="21" y2="12" />
+                <line x1="8" y1="18" x2="21" y2="18" />
+                <line x1="3" y1="6" x2="3.01" y2="6" />
+                <line x1="3" y1="12" x2="3.01" y2="12" />
+                <line x1="3" y1="18" x2="3.01" y2="18" />
+              </svg>
               List
             </button>
           </div>
@@ -423,6 +493,20 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
 
           <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
 
+          {/* Column Picker */}
+          <Show when={props.availableColumns && props.isColumnHidden && props.onColumnToggle}>
+            <ColumnPicker
+              columns={props.availableColumns!}
+              isHidden={props.isColumnHidden!}
+              onToggle={props.onColumnToggle!}
+              onReset={props.onColumnReset}
+            />
+          </Show>
+
+          <Show when={props.availableColumns}>
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block"></div>
+          </Show>
+
           {/* Reset Button */}
           <button
             onClick={() => {
@@ -432,15 +516,17 @@ export const DashboardFilter: Component<DashboardFilterProps> = (props) => {
               props.setViewMode('all');
               props.setStatusMode('all');
               props.setBackupMode('all');
+              props.setProblemsMode('all');
               props.setGroupingMode('grouped');
             }}
             title="Reset all filters"
-            class={`flex items-center justify-center px-2.5 py-1 text-xs font-medium rounded-lg transition-colors ${props.search() ||
+            class={`flex items-center justify-center px-2.5 py-1.5 text-xs font-medium rounded-lg transition-all duration-150 active:scale-95 ${props.search() ||
               props.viewMode() !== 'all' ||
               props.statusMode() !== 'all' ||
               props.backupMode() !== 'all' ||
+              props.problemsMode() !== 'all' ||
               props.groupingMode() !== 'grouped'
-              ? 'text-blue-700 dark:text-blue-300 bg-blue-100 dark:bg-blue-900/50 hover:bg-blue-200 dark:hover:bg-blue-900/70'
+              ? 'text-blue-700 dark:text-blue-300 bg-blue-100 dark:bg-blue-900/50 hover:bg-blue-200 dark:hover:bg-blue-900/70 ring-1 ring-blue-200 dark:ring-blue-800'
               : 'text-gray-600 dark:text-gray-400 bg-gray-100 dark:bg-gray-700 hover:bg-gray-200 dark:hover:bg-gray-600'
               }`}
           >
diff --git a/frontend-modern/src/components/Dashboard/DiskList.tsx b/frontend-modern/src/components/Dashboard/DiskList.tsx
index 042d8d1..1ae5cc3 100644
--- a/frontend-modern/src/components/Dashboard/DiskList.tsx
+++ b/frontend-modern/src/components/Dashboard/DiskList.tsx
@@ -48,7 +48,7 @@ export function DiskList(props: DiskListProps) {
     <Show
       when={props.disks && props.disks.length > 0}
       fallback={
-        <span class="text-gray-400 text-sm cursor-help" title={getDiskStatusTooltip()}>
+        <span class="text-gray-400 text-sm" title={getDiskStatusTooltip()}>
           -
         </span>
       }
diff --git a/frontend-modern/src/components/Dashboard/EnhancedCPUBar.tsx b/frontend-modern/src/components/Dashboard/EnhancedCPUBar.tsx
index d945f7c..4b9fe2c 100644
--- a/frontend-modern/src/components/Dashboard/EnhancedCPUBar.tsx
+++ b/frontend-modern/src/components/Dashboard/EnhancedCPUBar.tsx
@@ -2,7 +2,7 @@ import { Show, createMemo, createSignal } from 'solid-js';
 import { Portal } from 'solid-js/web';
 import { formatPercent } from '@/utils/format';
 import { useMetricsViewMode } from '@/stores/metricsViewMode';
-import { getMetricHistory } from '@/stores/metricsHistory';
+import { getMetricHistoryForRange, getMetricsVersion } from '@/stores/metricsHistory';
 import { Sparkline } from '@/components/shared/Sparkline';
 
 interface EnhancedCPUBarProps {
@@ -35,21 +35,25 @@ export function EnhancedCPUBar(props: EnhancedCPUBarProps) {
         setShowTooltip(false);
     };
 
-    const { viewMode } = useMetricsViewMode();
+    const { viewMode, timeRange } = useMetricsViewMode();
 
     // Get metric history for sparkline
+    // Depends on metricsVersion to re-fetch when data is seeded (e.g., on time range change)
     const metricHistory = createMemo(() => {
+        // Subscribe to version changes so we re-read when new data is seeded
+        getMetricsVersion();
         if (viewMode() !== 'sparklines' || !props.resourceId) return [];
-        return getMetricHistory(props.resourceId);
+        return getMetricHistoryForRange(props.resourceId, timeRange());
     });
 
     return (
         <Show
             when={viewMode() === 'sparklines' && props.resourceId}
             fallback={
+                // Progress bar mode - full width, flex centered like stacked bars
                 <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
                     <div
-                        class="relative w-full max-w-[140px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded cursor-help"
+                        class="relative w-full h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
                         onMouseEnter={handleMouseEnter}
                         onMouseLeave={handleMouseLeave}
                     >
@@ -112,19 +116,14 @@ export function EnhancedCPUBar(props: EnhancedCPUBarProps) {
                 </div>
             }
         >
-            {/* Sparkline mode */}
-            <div class="metric-text w-full h-6 flex items-center gap-1.5">
-                <div class="flex-1 min-w-0">
-                    <Sparkline
-                        data={metricHistory()}
-                        metric="cpu"
-                        width={0}
-                        height={24}
-                    />
-                </div>
-                <span class="text-[10px] font-medium text-gray-800 dark:text-gray-100 whitespace-nowrap flex-shrink-0 min-w-[35px]">
-                    {formatPercent(props.usage)}
-                </span>
+            {/* Sparkline mode - full width, flex centered like stacked bars */}
+            <div class="metric-text w-full h-4 flex items-center justify-center min-w-0 overflow-hidden">
+                <Sparkline
+                    data={metricHistory()}
+                    metric="cpu"
+                    width={0}
+                    height={16}
+                />
             </div>
         </Show>
     );
diff --git a/frontend-modern/src/components/Dashboard/GuestDrawer.tsx b/frontend-modern/src/components/Dashboard/GuestDrawer.tsx
index 89fe0d6..8dda2db 100644
--- a/frontend-modern/src/components/Dashboard/GuestDrawer.tsx
+++ b/frontend-modern/src/components/Dashboard/GuestDrawer.tsx
@@ -1,7 +1,11 @@
-import { Component, Show, For } from 'solid-js';
+import { Component, Show, For, createSignal, createEffect } from 'solid-js';
 import { VM, Container } from '@/types/api';
-import { formatBytes } from '@/utils/format';
+import { formatBytes, formatPercent, formatSpeed, formatUptime } from '@/utils/format';
 import { DiskList } from './DiskList';
+import { aiChatStore } from '@/stores/aiChat';
+import { AIAPI } from '@/api/ai';
+import { GuestMetadataAPI } from '@/api/guestMetadata';
+import { logger } from '@/utils/logger';
 
 type Guest = VM | Container;
 
@@ -12,37 +16,205 @@ interface GuestDrawerProps {
 }
 
 export const GuestDrawer: Component<GuestDrawerProps> = (props) => {
+    const [aiEnabled, setAiEnabled] = createSignal(false);
+    const [annotations, setAnnotations] = createSignal<string[]>([]);
+    const [newAnnotation, setNewAnnotation] = createSignal('');
+    const [saving, setSaving] = createSignal(false);
+
+    // Build guest ID for metadata
+    const guestId = () => props.guest.id || `${props.guest.instance}-${props.guest.vmid}`;
+
+    // Check if AI is enabled and load annotations on mount
+    createEffect(() => {
+        AIAPI.getSettings()
+            .then((settings) => setAiEnabled(settings.enabled && settings.configured))
+            .catch((err) => logger.debug('[GuestDrawer] AI settings check failed:', err));
+
+        // Load existing annotations
+        GuestMetadataAPI.getMetadata(guestId())
+            .then((meta) => {
+                if (meta.notes && Array.isArray(meta.notes)) setAnnotations(meta.notes);
+            })
+            .catch((err) => logger.debug('[GuestDrawer] Failed to load annotations:', err));
+    });
+
+    // Update AI context whenever guest changes or annotations are loaded
+    createEffect(() => {
+        const guestType = props.guest.type === 'qemu' ? 'vm' : 'container';
+        // Track annotations to re-run when they change
+        void annotations();
+        aiChatStore.setTargetContext(guestType, guestId(), {
+            guestName: props.guest.name,
+            ...buildGuestContext(),
+        });
+    });
+
+    // Note: We no longer clear context on unmount - context accumulates across navigation
+    // Users can clear individual items or all context from the AI panel
+
+    const saveAnnotations = async (updated: string[]) => {
+        setSaving(true);
+        try {
+            await GuestMetadataAPI.updateMetadata(guestId(), { notes: updated });
+            logger.debug('[GuestDrawer] Annotations saved');
+        } catch (err) {
+            logger.error('[GuestDrawer] Failed to save annotations:', err);
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    const addAnnotation = () => {
+        const text = newAnnotation().trim();
+        if (!text) return;
+        const updated = [...annotations(), text];
+        setAnnotations(updated);
+        setNewAnnotation('');
+        saveAnnotations(updated);
+    };
+
+    const removeAnnotation = (index: number) => {
+        const updated = annotations().filter((_, i) => i !== index);
+        setAnnotations(updated);
+        saveAnnotations(updated);
+    };
+
+    const handleKeyDown = (e: KeyboardEvent) => {
+        if (e.key === 'Enter') {
+            e.preventDefault();
+            addAnnotation();
+        }
+    };
+
     const isVM = (guest: Guest): guest is VM => {
         return guest.type === 'qemu';
     };
 
+    // Build comprehensive context for AI
+    const buildGuestContext = () => {
+        const guest = props.guest;
+        const context: Record<string, unknown> = {
+            name: guest.name,
+            type: guest.type === 'qemu' ? 'Virtual Machine' : 'LXC Container',
+            vmid: guest.vmid,
+            node: guest.node,  // PVE node this guest lives on
+            guest_node: guest.node,  // For backend agent routing
+            status: guest.status,
+            uptime: guest.uptime ? formatUptime(guest.uptime) : 'Not running',
+        };
+
+        // CPU info
+        if (guest.cpu !== undefined) {
+            context.cpu_usage = formatPercent(guest.cpu * 100);
+        }
+        if (guest.cpus) {
+            context.cpu_cores = guest.cpus;
+        }
+
+        // Memory info
+        if (guest.memory) {
+            context.memory_used = formatBytes(guest.memory.used || 0);
+            context.memory_total = formatBytes(guest.memory.total || 0);
+            context.memory_usage = formatPercent(guest.memory.usage || 0);
+            if (guest.memory.balloon && guest.memory.balloon !== guest.memory.total) {
+                context.memory_balloon = formatBytes(guest.memory.balloon);
+            }
+            if (guest.memory.swapTotal && guest.memory.swapTotal > 0) {
+                context.swap_used = formatBytes(guest.memory.swapUsed || 0);
+                context.swap_total = formatBytes(guest.memory.swapTotal);
+            }
+        }
+
+        // Disk info
+        if (guest.disk && guest.disk.total > 0) {
+            context.disk_used = formatBytes(guest.disk.used || 0);
+            context.disk_total = formatBytes(guest.disk.total || 0);
+            context.disk_usage = formatPercent((guest.disk.used / guest.disk.total) * 100);
+        }
+
+        // I/O rates
+        if (guest.diskRead !== undefined) {
+            context.disk_read_rate = formatSpeed(guest.diskRead);
+        }
+        if (guest.diskWrite !== undefined) {
+            context.disk_write_rate = formatSpeed(guest.diskWrite);
+        }
+        if (guest.networkIn !== undefined) {
+            context.network_in_rate = formatSpeed(guest.networkIn);
+        }
+        if (guest.networkOut !== undefined) {
+            context.network_out_rate = formatSpeed(guest.networkOut);
+        }
+
+        // OS info (both VMs and containers can have this)
+        if (guest.osName) context.os_name = guest.osName;
+        if (guest.osVersion) context.os_version = guest.osVersion;
+        if (guest.agentVersion) context.guest_agent = guest.agentVersion;
+        if (guest.ipAddresses?.length) context.ip_addresses = guest.ipAddresses;
+
+        // Tags
+        if (guest.tags?.length) {
+            context.tags = guest.tags;
+        }
+
+        // Backup info - Pulse already has this from PBS
+        if (guest.lastBackup) {
+            const backupDate = new Date(guest.lastBackup);
+            const now = new Date();
+            const daysSinceBackup = Math.floor((now.getTime() - backupDate.getTime()) / (1000 * 60 * 60 * 24));
+            context.last_backup = backupDate.toISOString();
+            context.days_since_backup = daysSinceBackup;
+            if (daysSinceBackup > 30) {
+                context.backup_status = 'CRITICAL - No backup in over 30 days';
+            } else if (daysSinceBackup > 7) {
+                context.backup_status = 'Warning - Backup is over a week old';
+            } else {
+                context.backup_status = 'OK';
+            }
+        } else {
+            context.backup_status = 'NEVER - No backup recorded';
+        }
+
+        // User annotations (for AI context)
+        if (annotations().length > 0) {
+            context.user_annotations = annotations();
+        }
+
+        return context;
+    };
+
+    const handleAskAI = () => {
+        const guestType = props.guest.type === 'qemu' ? 'vm' : 'container';
+        const guestId = props.guest.id || `${props.guest.instance}-${props.guest.vmid}`;
+
+        aiChatStore.openForTarget(guestType, guestId, {
+            guestName: props.guest.name,
+            ...buildGuestContext(),
+        });
+    };
+
     const hasOsInfo = () => {
-        if (!isVM(props.guest)) return false;
+        // Both VMs and containers can have OS info
         return (props.guest.osName?.length ?? 0) > 0 || (props.guest.osVersion?.length ?? 0) > 0;
     };
 
     const osName = () => {
-        if (!isVM(props.guest)) return '';
         return props.guest.osName || '';
     };
 
     const osVersion = () => {
-        if (!isVM(props.guest)) return '';
         return props.guest.osVersion || '';
     };
 
     const hasAgentInfo = () => {
-        if (!isVM(props.guest)) return false;
         return !!props.guest.agentVersion;
     };
 
     const agentVersion = () => {
-        if (!isVM(props.guest)) return '';
         return props.guest.agentVersion || '';
     };
 
     const ipAddresses = () => {
-        if (!isVM(props.guest)) return [];
         return props.guest.ipAddresses || [];
     };
 
@@ -70,7 +242,7 @@ export const GuestDrawer: Component<GuestDrawerProps> = (props) => {
     };
 
     const networkInterfaces = () => {
-        if (!isVM(props.guest)) return [];
+        // Both VMs and containers can have network interfaces
         return props.guest.networkInterfaces || [];
     };
 
@@ -79,118 +251,248 @@ export const GuestDrawer: Component<GuestDrawerProps> = (props) => {
     };
 
     return (
-        <div class="flex items-start gap-4">
-            {/* Left Column: Guest Overview */}
-            <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium text-gray-700 dark:text-gray-200">Guest Overview</div>
-                <div class="mt-1 space-y-1">
-                    <Show when={hasOsInfo()}>
-                        <div class="flex flex-wrap items-center gap-1 text-gray-600 dark:text-gray-300">
-                            <Show when={osName().length > 0}>
-                                <span class="font-medium" title={osName()}>{osName()}</span>
+        <div class="space-y-3">
+            {/* Flex layout - items grow to fill space, max ~4 per row */}
+            <div class="flex flex-wrap gap-3 [&>*]:flex-1 [&>*]:basis-[calc(25%-0.75rem)] [&>*]:min-w-[200px] [&>*]:max-w-full">
+                {/* System Info - always show */}
+                <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">System</div>
+                    <div class="space-y-1.5 text-[11px]">
+                        <Show when={props.guest.cpus}>
+                            <div class="flex items-center justify-between">
+                                <span class="text-gray-500 dark:text-gray-400">CPUs</span>
+                                <span class="font-medium text-gray-700 dark:text-gray-200">{props.guest.cpus}</span>
+                            </div>
+                        </Show>
+                        <Show when={props.guest.uptime > 0}>
+                            <div class="flex items-center justify-between">
+                                <span class="text-gray-500 dark:text-gray-400">Uptime</span>
+                                <span class="font-medium text-gray-700 dark:text-gray-200">{formatUptime(props.guest.uptime)}</span>
+                            </div>
+                        </Show>
+                        <Show when={props.guest.node}>
+                            <div class="flex items-center justify-between">
+                                <span class="text-gray-500 dark:text-gray-400">Node</span>
+                                <span class="font-medium text-gray-700 dark:text-gray-200">{props.guest.node}</span>
+                            </div>
+                        </Show>
+                        <Show when={hasAgentInfo()}>
+                            <div class="flex items-center justify-between">
+                                <span class="text-gray-500 dark:text-gray-400">Agent</span>
+                                <span class="font-medium text-gray-700 dark:text-gray-200 truncate ml-2" title={isVM(props.guest) ? `QEMU guest agent ${agentVersion()}` : agentVersion()}>
+                                    {isVM(props.guest) ? `QEMU ${agentVersion()}` : agentVersion()}
+                                </span>
+                            </div>
+                        </Show>
+                    </div>
+                </div>
+
+                {/* Guest Info - OS and IPs */}
+                <Show when={hasOsInfo() || ipAddresses().length > 0}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Guest Info</div>
+                        <div class="space-y-2">
+                            <Show when={hasOsInfo()}>
+                                <div class="text-[11px] text-gray-600 dark:text-gray-300">
+                                    <Show when={osName().length > 0}>
+                                        <span class="font-medium">{osName()}</span>
+                                    </Show>
+                                    <Show when={osName().length > 0 && osVersion().length > 0}>
+                                        <span class="text-gray-400 dark:text-gray-500 mx-1">•</span>
+                                    </Show>
+                                    <Show when={osVersion().length > 0}>
+                                        <span>{osVersion()}</span>
+                                    </Show>
+                                </div>
                             </Show>
-                            <Show when={osName().length > 0 && osVersion().length > 0}>
-                                <span class="text-gray-400 dark:text-gray-500">•</span>
-                            </Show>
-                            <Show when={osVersion().length > 0}>
-                                <span title={osVersion()}>{osVersion()}</span>
+                            <Show when={ipAddresses().length > 0}>
+                                <div class="flex flex-wrap gap-1">
+                                    <For each={ipAddresses()}>
+                                        {(ip) => (
+                                            <span class="inline-block rounded bg-blue-100 px-1.5 py-0.5 text-[10px] text-blue-700 dark:bg-blue-900/40 dark:text-blue-200" title={ip}>
+                                                {ip}
+                                            </span>
+                                        )}
+                                    </For>
+                                </div>
                             </Show>
                         </div>
-                    </Show>
-                    <Show when={hasAgentInfo()}>
-                        <div class="flex flex-wrap items-center gap-1 text-[11px] text-gray-500 dark:text-gray-400">
-                            <span class="uppercase tracking-wide text-[10px] text-gray-400 dark:text-gray-500">
-                                Agent
-                            </span>
-                            <span title={`QEMU guest agent ${agentVersion()}`}>
-                                QEMU guest agent {agentVersion()}
-                            </span>
+                    </div>
+                </Show>
+
+                {/* Memory Details */}
+                <Show when={memoryExtraLines() && memoryExtraLines()!.length > 0}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Memory</div>
+                        <div class="space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
+                            <For each={memoryExtraLines()!}>{(line) => <div>{line}</div>}</For>
                         </div>
-                    </Show>
-                    <Show when={ipAddresses().length > 0}>
+                    </div>
+                </Show>
+
+                {/* Backup Info */}
+                <Show when={props.guest.lastBackup}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Backup</div>
+                        <div class="space-y-1 text-[11px]">
+                            {(() => {
+                                const backupDate = new Date(props.guest.lastBackup);
+                                const now = new Date();
+                                const daysSince = Math.floor((now.getTime() - backupDate.getTime()) / (1000 * 60 * 60 * 24));
+                                const isOld = daysSince > 7;
+                                const isCritical = daysSince > 30;
+                                return (
+                                    <>
+                                        <div class="flex items-center justify-between">
+                                            <span class="text-gray-500 dark:text-gray-400">Last Backup</span>
+                                            <span class={`font-medium ${isCritical ? 'text-red-600 dark:text-red-400' : isOld ? 'text-amber-600 dark:text-amber-400' : 'text-green-600 dark:text-green-400'}`}>
+                                                {daysSince === 0 ? 'Today' : daysSince === 1 ? 'Yesterday' : `${daysSince}d ago`}
+                                            </span>
+                                        </div>
+                                        <div class="text-[10px] text-gray-400 dark:text-gray-500">
+                                            {backupDate.toLocaleDateString()}
+                                        </div>
+                                    </>
+                                );
+                            })()}
+                        </div>
+                    </div>
+                </Show>
+
+                {/* Tags */}
+                <Show when={props.guest.tags && (Array.isArray(props.guest.tags) ? props.guest.tags.length > 0 : props.guest.tags.length > 0)}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Tags</div>
                         <div class="flex flex-wrap gap-1">
-                            <For each={ipAddresses()}>
-                                {(ip) => (
-                                    <span
-                                        class="max-w-full truncate rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200"
-                                        title={ip}
-                                    >
-                                        {ip}
+                            <For each={Array.isArray(props.guest.tags) ? props.guest.tags : (props.guest.tags?.split(',') || [])}>
+                                {(tag) => (
+                                    <span class="inline-block rounded bg-gray-100 px-1.5 py-0.5 text-[10px] text-gray-700 dark:bg-gray-700 dark:text-gray-200">
+                                        {tag.trim()}
+                                    </span>
+                                )}
+                            </For>
+                        </div>
+                    </div>
+                </Show>
+
+                {/* Filesystems */}
+                <Show when={hasFilesystemDetails() && props.guest.disks && props.guest.disks.length > 0}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Filesystems</div>
+                        <div class="text-[11px] text-gray-600 dark:text-gray-300">
+                            <DiskList
+                                disks={props.guest.disks || []}
+                                diskStatusReason={isVM(props.guest) ? props.guest.diskStatusReason : undefined}
+                            />
+                        </div>
+                    </div>
+                </Show>
+
+                {/* Network Interfaces */}
+                <Show when={hasNetworkInterfaces()}>
+                    <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                        <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200 mb-2">Network</div>
+                        <div class="space-y-2">
+                            <For each={networkInterfaces().slice(0, 4)}>
+                                {(iface) => {
+                                    const addresses = iface.addresses ?? [];
+                                    const hasTraffic = (iface.rxBytes ?? 0) > 0 || (iface.txBytes ?? 0) > 0;
+                                    return (
+                                        <div class="rounded border border-dashed border-gray-200 p-2 dark:border-gray-700">
+                                            <div class="flex items-center gap-2 text-[11px] font-medium text-gray-700 dark:text-gray-200">
+                                                <span class="truncate">{iface.name || 'interface'}</span>
+                                                <Show when={iface.mac}>
+                                                    <span class="text-[9px] text-gray-400 dark:text-gray-500 font-normal">{iface.mac}</span>
+                                                </Show>
+                                            </div>
+                                            <Show when={addresses.length > 0}>
+                                                <div class="flex flex-wrap gap-1 mt-1">
+                                                    <For each={addresses}>
+                                                        {(ip) => (
+                                                            <span class="inline-block rounded bg-blue-100 px-1.5 py-0.5 text-[10px] text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
+                                                                {ip}
+                                                            </span>
+                                                        )}
+                                                    </For>
+                                                </div>
+                                            </Show>
+                                            <Show when={hasTraffic}>
+                                                <div class="flex gap-3 mt-1 text-[10px] text-gray-500 dark:text-gray-400">
+                                                    <span>RX {formatBytes(iface.rxBytes ?? 0)}</span>
+                                                    <span>TX {formatBytes(iface.txBytes ?? 0)}</span>
+                                                </div>
+                                            </Show>
+                                        </div>
+                                    );
+                                }}
+                            </For>
+                        </div>
+                    </div>
+                </Show>
+            </div>
+
+            {/* Bottom row: AI Context & Ask AI - only show when AI is enabled */}
+            <Show when={aiEnabled()}>
+                <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700 space-y-2">
+                    <div class="flex items-center gap-1.5">
+                        <span class="text-[10px] font-medium text-gray-500 dark:text-gray-400">AI Context</span>
+                        <Show when={saving()}>
+                            <span class="text-[9px] text-gray-400">saving...</span>
+                        </Show>
+                    </div>
+
+                    {/* Existing annotations */}
+                    <Show when={annotations().length > 0}>
+                        <div class="flex flex-wrap gap-1.5">
+                            <For each={annotations()}>
+                                {(annotation, index) => (
+                                    <span class="inline-flex items-center gap-1 px-2 py-1 text-[11px] rounded-md bg-purple-100 text-purple-800 dark:bg-purple-900/40 dark:text-purple-200">
+                                        <span class="max-w-[300px] truncate">{annotation}</span>
+                                        <button
+                                            type="button"
+                                            onClick={() => removeAnnotation(index())}
+                                            class="ml-0.5 p-0.5 rounded hover:bg-purple-200 dark:hover:bg-purple-800 transition-colors"
+                                            title="Remove"
+                                        >
+                                            <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                                            </svg>
+                                        </button>
                                     </span>
                                 )}
                             </For>
                         </div>
                     </Show>
-                </div>
-            </div>
 
-            {/* Middle Column: Memory Details */}
-            <Show when={memoryExtraLines() && memoryExtraLines()!.length > 0}>
-                <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                    <div class="text-[11px] font-medium text-gray-700 dark:text-gray-200">Memory</div>
-                    <div class="mt-1 space-y-1 text-gray-600 dark:text-gray-300">
-                        <For each={memoryExtraLines()!}>{(line) => <div>{line}</div>}</For>
-                    </div>
-                </div>
-            </Show>
-
-            {/* Right Column: Filesystems */}
-            <Show when={hasFilesystemDetails() && props.guest.disks && props.guest.disks.length > 0}>
-                <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                    <div class="text-[11px] font-medium text-gray-700 dark:text-gray-200">Filesystems</div>
-                    <div class="mt-1 text-gray-600 dark:text-gray-300">
-                        <DiskList
-                            disks={props.guest.disks || []}
-                            diskStatusReason={isVM(props.guest) ? props.guest.diskStatusReason : undefined}
+                    {/* Add new annotation + Ask AI */}
+                    <div class="flex items-center gap-2">
+                        <input
+                            type="text"
+                            value={newAnnotation()}
+                            onInput={(e) => setNewAnnotation(e.currentTarget.value)}
+                            onKeyDown={handleKeyDown}
+                            placeholder="Add context for AI (press Enter)..."
+                            class="flex-1 px-2 py-1.5 text-[11px] rounded border border-gray-200 dark:border-gray-600 bg-white dark:bg-gray-800 text-gray-700 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:outline-none focus:ring-1 focus:ring-purple-500 focus:border-purple-500"
                         />
-                    </div>
-                </div>
-            </Show>
-
-            {/* Far Right Column: Network Interfaces */}
-            <Show when={hasNetworkInterfaces()}>
-                <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                    <div class="text-[11px] font-medium text-gray-700 dark:text-gray-200">Network Interfaces</div>
-                    <div class="mt-1 text-[10px] text-gray-400 dark:text-gray-500">Row charts show current rate; totals below are cumulative since boot.</div>
-                    <div class="mt-1 space-y-1 text-gray-600 dark:text-gray-300">
-                        <For each={networkInterfaces()}>
-                            {(iface) => {
-                                const addresses = iface.addresses ?? [];
-                                const hasTraffic = (iface.rxBytes ?? 0) > 0 || (iface.txBytes ?? 0) > 0;
-                                return (
-                                    <div class="space-y-1 rounded border border-dashed border-gray-200 p-2 last:mb-0 dark:border-gray-700">
-                                        <div class="flex items-center gap-2 font-medium text-gray-700 dark:text-gray-200">
-                                            <span class="truncate" title={iface.name}>{iface.name || 'interface'}</span>
-                                            <Show when={iface.mac}>
-                                                <span class="text-[10px] text-gray-400 dark:text-gray-500" title={iface.mac}>
-                                                    {iface.mac}
-                                                </span>
-                                            </Show>
-                                        </div>
-                                        <Show when={addresses.length > 0}>
-                                            <div class="flex flex-wrap gap-1">
-                                                <For each={addresses}>
-                                                    {(ip) => (
-                                                        <span
-                                                            class="max-w-full truncate rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200"
-                                                            title={ip}
-                                                        >
-                                                            {ip}
-                                                        </span>
-                                                    )}
-                                                </For>
-                                            </div>
-                                        </Show>
-                                        <Show when={hasTraffic}>
-                                            <div class="flex items-center gap-3 text-[10px] text-gray-500 dark:text-gray-400">
-                                                <span>Total RX {formatBytes(iface.rxBytes ?? 0)}</span>
-                                                <span>Total TX {formatBytes(iface.txBytes ?? 0)}</span>
-                                            </div>
-                                        </Show>
-                                    </div>
-                                );
-                            }}
-                        </For>
+                        <button
+                            type="button"
+                            onClick={addAnnotation}
+                            disabled={!newAnnotation().trim()}
+                            class="px-2 py-1.5 text-[11px] rounded border border-gray-200 dark:border-gray-600 bg-white dark:bg-gray-800 text-gray-700 dark:text-gray-200 hover:bg-gray-50 dark:hover:bg-gray-700 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+                        >
+                            Add
+                        </button>
+                        <button
+                            type="button"
+                            onClick={handleAskAI}
+                            class="flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-gradient-to-r from-purple-500 to-pink-500 text-white text-[11px] font-medium shadow-sm hover:from-purple-600 hover:to-pink-600 transition-all"
+                            title={`Ask AI about ${props.guest.name}`}
+                        >
+                            <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.75 3.104v5.714a2.25 2.25 0 01-.659 1.591L5 14.5M9.75 3.104c-.251.023-.501.05-.75.082m.75-.082a24.301 24.301 0 014.5 0m0 0v5.714c0 .597.237 1.17.659 1.591L19.8 15.3M14.25 3.104c.251.023.501.05.75.082M19.8 15.3l-1.57.393A9.065 9.065 0 0112 15a9.065 9.065 0 00-6.23.693L5 14.5m14.8.8l1.402 1.402c1.232 1.232.65 3.318-1.067 3.611l-2.576.43a18.003 18.003 0 01-5.118 0l-2.576-.43c-1.717-.293-2.299-2.379-1.067-3.611L5 14.5" />
+                            </svg>
+                            Ask AI
+                        </button>
                     </div>
                 </div>
             </Show>
diff --git a/frontend-modern/src/components/Dashboard/GuestRow.tsx b/frontend-modern/src/components/Dashboard/GuestRow.tsx
index 208b07e..e59648e 100644
--- a/frontend-modern/src/components/Dashboard/GuestRow.tsx
+++ b/frontend-modern/src/components/Dashboard/GuestRow.tsx
@@ -1,6 +1,7 @@
-import { GuestDrawer } from './GuestDrawer';
-import { createMemo, createSignal, createEffect, Show } from 'solid-js';
-import type { VM, Container } from '@/types/api';
+import { createMemo, createSignal, createEffect, Show, For } from 'solid-js';
+import type { JSX } from 'solid-js';
+import { Portal } from 'solid-js/web';
+import type { VM, Container, GuestNetworkInterface } from '@/types/api';
 import { formatBytes, formatUptime, formatSpeed, getBackupInfo, type BackupStatus, formatPercent } from '@/utils/format';
 import { TagBadges } from './TagBadges';
 import { StackedDiskBar } from './StackedDiskBar';
@@ -15,6 +16,8 @@ import { buildMetricKey } from '@/utils/metricsKeys';
 import { type ColumnPriority } from '@/hooks/useBreakpoint';
 import { ResponsiveMetricCell } from '@/components/shared/responsive';
 import { useBreakpoint } from '@/hooks/useBreakpoint';
+import { useMetricsViewMode } from '@/stores/metricsViewMode';
+import { aiChatStore } from '@/stores/aiChat';
 
 type Guest = VM | Container;
 
@@ -30,14 +33,7 @@ function getIOColorClass(bytesPerSec: number): string {
   return 'text-red-600 dark:text-red-400';
 }
 
-// Global state for currently expanded drawer (only one drawer open at a time)
-const [currentlyExpandedGuestId, setCurrentlyExpandedGuestId] = createSignal<string | null>(null);
-// Global editing state - use a signal so all components react
-const [currentlyEditingGuestId, setCurrentlyEditingGuestId] = createSignal<string | null>(null);
-// Store the editing value globally so it survives re-renders
-const editingValues = new Map<string, string>();
-// Signal to trigger reactivity when editing values change
-const [editingValuesVersion, setEditingValuesVersion] = createSignal(0);
+
 
 const GROUPED_FIRST_CELL_INDENT = 'pl-5 sm:pl-6 lg:pl-8';
 const DEFAULT_FIRST_CELL_INDENT = 'pl-4';
@@ -103,30 +99,355 @@ function BackupIndicator(props: { lastBackup: string | number | null | undefined
   );
 }
 
+// Network info cell with rich tooltip showing interfaces, IPs, and MACs
+function NetworkInfoCell(props: { ipAddresses: string[]; networkInterfaces: GuestNetworkInterface[] }) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const hasInterfaces = () => props.networkInterfaces.length > 0;
+  const primaryIp = () => props.ipAddresses[0] || props.networkInterfaces[0]?.addresses?.[0] || null;
+  const totalIps = () => {
+    if (props.ipAddresses.length > 0) return props.ipAddresses.length;
+    return props.networkInterfaces.reduce((sum, iface) => sum + (iface.addresses?.length || 0), 0);
+  };
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  return (
+    <>
+      <span
+        class="inline-flex items-center gap-1 text-xs text-gray-600 dark:text-gray-400"
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        <Show when={primaryIp()} fallback="-">
+          {/* Network icon */}
+          <svg class="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M12 21a9.004 9.004 0 008.716-6.747M12 21a9.004 9.004 0 01-8.716-6.747M12 21c2.485 0 4.5-4.03 4.5-9S14.485 3 12 3m0 18c-2.485 0-4.5-4.03-4.5-9S9.515 3 12 3m0 0a8.997 8.997 0 017.843 4.582M12 3a8.997 8.997 0 00-7.843 4.582m15.686 0A11.953 11.953 0 0112 10.5c-2.998 0-5.74-1.1-7.843-2.918m15.686 0A8.959 8.959 0 0121 12c0 .778-.099 1.533-.284 2.253m0 0A17.919 17.919 0 0112 16.5c-3.162 0-6.133-.815-8.716-2.247m0 0A9.015 9.015 0 013 12c0-1.605.42-3.113 1.157-4.418" />
+          </svg>
+          <span class="text-[10px] font-medium">{totalIps()}</span>
+        </Show>
+      </span>
+
+      <Show when={showTooltip() && (hasInterfaces() || props.ipAddresses.length > 0)}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[180px] max-w-[280px] border border-gray-700">
+              <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                Network Interfaces
+              </div>
+
+              {/* Show detailed interface info if available */}
+              <Show when={hasInterfaces()}>
+                <For each={props.networkInterfaces}>
+                  {(iface, idx) => (
+                    <div class="py-1" classList={{ 'border-t border-gray-700/50': idx() > 0 }}>
+                      <div class="flex items-center gap-2 text-blue-400 font-medium">
+                        <span>{iface.name || 'eth' + idx()}</span>
+                        <Show when={iface.mac}>
+                          <span class="text-[9px] text-gray-500 font-normal">{iface.mac}</span>
+                        </Show>
+                      </div>
+                      <Show when={iface.addresses && iface.addresses.length > 0}>
+                        <div class="mt-0.5 flex flex-wrap gap-1">
+                          <For each={iface.addresses}>
+                            {(ip) => (
+                              <span class="text-gray-300 font-mono">{ip}</span>
+                            )}
+                          </For>
+                        </div>
+                      </Show>
+                      <Show when={!iface.addresses || iface.addresses.length === 0}>
+                        <span class="text-gray-500 text-[9px]">No IP assigned</span>
+                      </Show>
+                      <Show when={(iface.rxBytes || 0) > 0 || (iface.txBytes || 0) > 0}>
+                        <div class="mt-0.5 text-[9px] text-gray-500">
+                          RX: {formatBytes(iface.rxBytes || 0)} / TX: {formatBytes(iface.txBytes || 0)}
+                        </div>
+                      </Show>
+                    </div>
+                  )}
+                </For>
+              </Show>
+
+              {/* Fallback: just show IP list if no interface details */}
+              <Show when={!hasInterfaces() && props.ipAddresses.length > 0}>
+                <div class="py-1">
+                  <div class="flex items-center gap-2 text-blue-400 font-medium">
+                    <span>IP Addresses</span>
+                    <span class="text-[9px] text-gray-500 font-normal">No agent data</span>
+                  </div>
+                  <div class="mt-0.5 flex flex-wrap gap-1">
+                    <For each={props.ipAddresses}>
+                      {(ip) => (
+                        <span class="text-gray-300 font-mono">{ip}</span>
+                      )}
+                    </For>
+                  </div>
+                </div>
+              </Show>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
+// OS detection helper - simplified to just Linux vs Windows
+type OSType = 'windows' | 'linux' | 'unknown';
+
+function detectOSType(osName: string): OSType {
+  const lower = osName.toLowerCase();
+  if (lower.includes('windows')) return 'windows';
+  // All Linux distros, BSDs, and Unix-likes -> linux
+  if (lower.includes('linux') || lower.includes('debian') || lower.includes('ubuntu') ||
+    lower.includes('alpine') || lower.includes('centos') || lower.includes('fedora') ||
+    lower.includes('arch') || lower.includes('nixos') || lower.includes('suse') ||
+    lower.includes('gentoo') || lower.includes('rhel') || lower.includes('rocky') ||
+    lower.includes('alma') || lower.includes('devuan') || lower.includes('gnu') ||
+    lower.includes('freebsd') || lower.includes('openbsd') || lower.includes('netbsd')) {
+    return 'linux';
+  }
+  return 'unknown';
+}
+
+
+// OS info cell with icon and Portal tooltip
+function OSInfoCell(props: { osName: string; osVersion: string; agentVersion: string }) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const osType = createMemo(() => detectOSType(props.osName));
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  // OS icons - Windows logo and terminal prompt for Linux
+  const OSIcon = () => {
+    const type = osType();
+    const iconClass = 'w-3.5 h-3.5 text-gray-500 dark:text-gray-400';
+
+    switch (type) {
+      case 'windows':
+        // Windows logo - four tilted panes
+        return (
+          <svg class={iconClass} viewBox="0 0 24 24" fill="currentColor">
+            <path d="M3 5.5l7.038-1v6.5H3v-5.5zm0 13l7.038 1V13H3v5.5zm8.038 1.118L21 21V13h-9.962v6.618zM11.038 4.382L21 3v8h-9.962V4.382z" />
+          </svg>
+        );
+      case 'linux':
+        // Terminal prompt icon
+        return (
+          <svg class={iconClass} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <polyline points="4 17 10 11 4 5" />
+            <line x1="12" y1="19" x2="20" y2="19" />
+          </svg>
+        );
+      default:
+        return <span class="text-gray-400">-</span>;
+    }
+  };
+
+  return (
+    <>
+      <span
+        class="inline-flex items-center gap-1"
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        <OSIcon />
+      </span>
+
+      <Show when={showTooltip()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[120px] max-w-[220px] border border-gray-700">
+              <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                Operating System
+              </div>
+              <div class="py-0.5">
+                <div class="text-gray-200 font-medium">{props.osName}</div>
+                <Show when={props.osVersion}>
+                  <div class="text-gray-400">Version: {props.osVersion}</div>
+                </Show>
+                <Show when={props.agentVersion}>
+                  <div class="text-gray-500 text-[9px] mt-1 pt-1 border-t border-gray-700/50">
+                    Agent: {props.agentVersion}
+                  </div>
+                </Show>
+              </div>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
+// Backup status cell with Portal tooltip
+function BackupStatusCell(props: { lastBackup: string | number | null | undefined }) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const info = createMemo(() => getBackupInfo(props.lastBackup));
+  const config = createMemo(() => BACKUP_STATUS_CONFIG[info().status]);
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  return (
+    <>
+      <span
+        class={`inline-flex items-center gap-1 px-1.5 py-0.5 text-[10px] font-medium rounded ${config().bgColor} ${config().color}`}
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        {/* Status icon */}
+        <Show when={info().status === 'fresh'}>
+          <svg class="w-3 h-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2.5">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+          </svg>
+        </Show>
+        <Show when={info().status === 'stale'}>
+          <svg class="w-3 h-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+          </svg>
+        </Show>
+        <Show when={info().status === 'critical' || info().status === 'never'}>
+          <svg class="w-3 h-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2.5">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+          </svg>
+        </Show>
+        {/* Status text */}
+        {info().status === 'fresh' && 'OK'}
+        {info().status === 'stale' && info().ageFormatted}
+        {info().status === 'critical' && info().ageFormatted}
+        {info().status === 'never' && 'Never'}
+      </span>
+
+      <Show when={showTooltip()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[140px] border border-gray-700">
+              <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                Backup Status
+              </div>
+              <Show when={info().status !== 'never'}>
+                <div class="py-0.5">
+                  <div class="text-gray-400">Last backup</div>
+                  <div class="text-gray-200 font-medium">
+                    {new Date(props.lastBackup!).toLocaleDateString(undefined, {
+                      weekday: 'short',
+                      year: 'numeric',
+                      month: 'short',
+                      day: 'numeric',
+                    })}
+                  </div>
+                  <div class="text-gray-300">
+                    {new Date(props.lastBackup!).toLocaleTimeString()}
+                  </div>
+                </div>
+                <div class="pt-1 mt-1 border-t border-gray-700/50">
+                  <span class={config().color}>{info().ageFormatted} ago</span>
+                </div>
+              </Show>
+              <Show when={info().status === 'never'}>
+                <div class="py-0.5 text-red-400">
+                  No backup has ever been recorded for this guest.
+                </div>
+              </Show>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
 // Column configuration using the priority system
-interface ColumnDef {
+export interface GuestColumnDef {
   id: string;
   label: string;
+  icon?: JSX.Element;  // SVG icon for compact column headers
   priority: ColumnPriority;
+  toggleable?: boolean;
+  width?: string;  // Fixed width for consistent column sizing
   minWidth?: string;
   maxWidth?: string;
   flex?: number;
+  sortKey?: string;
 }
 
-export const GUEST_COLUMNS: ColumnDef[] = [
-  { id: 'name', label: 'Name', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'type', label: 'Type', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'vmid', label: 'VMID', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'uptime', label: 'Uptime', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  // Metric columns - fixed min/max width to match progress bar
-  { id: 'cpu', label: 'CPU', priority: 'essential', minWidth: '55px', maxWidth: '156px' },
-  { id: 'memory', label: 'Memory', priority: 'essential', minWidth: '75px', maxWidth: '156px' },
-  { id: 'disk', label: 'Disk', priority: 'essential', minWidth: '75px', maxWidth: '156px' },
-  // I/O columns - auto sizing
-  { id: 'diskRead', label: 'Disk Read', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'diskWrite', label: 'Disk Write', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'netIn', label: 'Net In', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
-  { id: 'netOut', label: 'Net Out', priority: 'essential', minWidth: 'auto', maxWidth: 'auto' },
+export const GUEST_COLUMNS: GuestColumnDef[] = [
+  // Essential - always visible (fixed widths ensure no overlap)
+  { id: 'name', label: 'Name', priority: 'essential', width: '120px', sortKey: 'name' },
+  { id: 'type', label: 'Type', priority: 'essential', width: '40px', sortKey: 'type' },
+  { id: 'vmid', label: 'ID', priority: 'essential', width: '45px', sortKey: 'vmid' },
+
+  // Core metrics - fixed minimum widths to prevent content overlap
+  { id: 'cpu', label: 'CPU', priority: 'essential', width: '140px', sortKey: 'cpu' },
+  { id: 'memory', label: 'Mem', priority: 'essential', width: '140px', sortKey: 'memory' },
+  { id: 'disk', label: 'Disk', priority: 'essential', width: '140px', sortKey: 'disk' },
+
+  // Secondary - visible on md+ (768px), user toggleable - use icons
+  { id: 'ip', label: 'IP', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/></svg>, priority: 'secondary', width: '45px', toggleable: true },
+  { id: 'uptime', label: 'Uptime', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>, priority: 'secondary', width: '60px', toggleable: true, sortKey: 'uptime' },
+  { id: 'node', label: 'Node', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 12h14M5 12a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v4a2 2 0 01-2 2M5 12a2 2 0 00-2 2v4a2 2 0 002 2h14a2 2 0 002-2v-4a2 2 0 00-2-2m-2-4h.01M17 16h.01"/></svg>, priority: 'secondary', width: '55px', toggleable: true, sortKey: 'node' },
+
+  // Supplementary - visible on lg+ (1024px), user toggleable
+  { id: 'backup', label: 'Backup', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/></svg>, priority: 'supplementary', width: '50px', toggleable: true },
+  { id: 'tags', label: 'Tags', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 7h.01M7 3h5c.512 0 1.024.195 1.414.586l7 7a2 2 0 010 2.828l-7 7a2 2 0 01-2.828 0l-7-7A1.994 1.994 0 013 12V7a4 4 0 014-4z"/></svg>, priority: 'supplementary', width: '60px', toggleable: true },
+
+  // Detailed - visible on xl+ (1280px), user toggleable
+  { id: 'os', label: 'OS', priority: 'detailed', width: '45px', toggleable: true },
+  { id: 'diskRead', label: 'D Read', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"/></svg>, priority: 'detailed', width: '55px', toggleable: true, sortKey: 'diskRead' },
+  { id: 'diskWrite', label: 'D Write', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"/></svg>, priority: 'detailed', width: '55px', toggleable: true, sortKey: 'diskWrite' },
+  { id: 'netIn', label: 'Net In', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M7 16l-4-4m0 0l4-4m-4 4h18"/></svg>, priority: 'detailed', width: '55px', toggleable: true, sortKey: 'networkIn' },
+  { id: 'netOut', label: 'Net Out', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 8l4 4m0 0l-4 4m4-4H3"/></svg>, priority: 'detailed', width: '55px', toggleable: true, sortKey: 'networkOut' },
 ];
 
 interface GuestRowProps {
@@ -151,16 +472,33 @@ interface GuestRowProps {
   parentNodeOnline?: boolean;
   onCustomUrlUpdate?: (guestId: string, url: string) => void;
   isGroupedView?: boolean;
+  /** IDs of columns that should be visible */
+  visibleColumnIds?: string[];
+  /** Guest ID of the row above (for checking AI context adjacency) */
+  aboveGuestId?: string | null;
+  /** Guest ID of the row below (for checking AI context adjacency) */
+  belowGuestId?: string | null;
+  /** Called when user clicks the row (for AI context selection) */
+  onRowClick?: (guest: Guest) => void;
 }
 
 export function GuestRow(props: GuestRowProps) {
   const guestId = createMemo(() => buildGuestId(props.guest));
-  const isEditingUrl = createMemo(() => currentlyEditingGuestId() === guestId());
 
   // Use breakpoint hook directly for responsive behavior
   const { isMobile } = useBreakpoint();
 
-  // Create namespaced metrics key
+  // Get current metrics view mode (bars vs sparklines)
+  const { viewMode } = useMetricsViewMode();
+
+  // Helper to check if a column is visible
+  // If visibleColumnIds is not provided, show all columns for backwards compatibility
+  const isColVisible = (colId: string) => {
+    if (!props.visibleColumnIds) return true;
+    return props.visibleColumnIds.includes(colId);
+  };
+
+  // Create namespaced metrics key for sparklines
   const metricsKey = createMemo(() => {
     const kind = props.guest.type === 'qemu' ? 'vm' : 'container';
     return buildMetricKey(kind, guestId());
@@ -168,14 +506,64 @@ export function GuestRow(props: GuestRowProps) {
 
   const [customUrl, setCustomUrl] = createSignal<string | undefined>(props.customUrl);
   const [shouldAnimateIcon, setShouldAnimateIcon] = createSignal(false);
-  const drawerOpen = createMemo(() => currentlyExpandedGuestId() === guestId());
-  const editingUrlValue = createMemo(() => {
-    editingValuesVersion(); // Subscribe to changes
-    return editingValues.get(guestId()) || '';
-  });
+  const [isEditingUrl, setIsEditingUrl] = createSignal(false);
+  const [editingUrlValue, setEditingUrlValue] = createSignal('');
+  const [isSavingUrl, setIsSavingUrl] = createSignal(false);
   let urlInputRef: HTMLInputElement | undefined;
 
-  const hasFilesystemDetails = createMemo(() => (props.guest.disks?.length ?? 0) > 0);
+  // Focus input when editing starts
+  createEffect(() => {
+    if (isEditingUrl() && urlInputRef) {
+      urlInputRef.focus();
+      urlInputRef.select();
+    }
+  });
+
+  const startEditingUrl = (event: MouseEvent) => {
+    event.stopPropagation();
+    setEditingUrlValue(customUrl() || '');
+    setIsEditingUrl(true);
+  };
+
+  const saveUrl = async () => {
+    const newUrl = editingUrlValue().trim();
+    setIsSavingUrl(true);
+
+    try {
+      await GuestMetadataAPI.updateMetadata(guestId(), { customUrl: newUrl });
+
+      const hadUrl = !!customUrl();
+      if (!hadUrl && newUrl) {
+        setShouldAnimateIcon(true);
+        setTimeout(() => setShouldAnimateIcon(false), 200);
+      }
+
+      setCustomUrl(newUrl || undefined);
+      setIsEditingUrl(false);
+
+      if (props.onCustomUrlUpdate) {
+        props.onCustomUrlUpdate(guestId(), newUrl);
+      }
+
+      if (newUrl) {
+        showSuccess('Guest URL saved');
+      } else {
+        showSuccess('Guest URL cleared');
+      }
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'Failed to save guest URL';
+      logger.error('Failed to save guest URL:', err);
+      showError(message);
+    } finally {
+      setIsSavingUrl(false);
+    }
+  };
+
+  const cancelEditingUrl = () => {
+    setIsEditingUrl(false);
+    setEditingUrlValue('');
+  };
+
   const ipAddresses = createMemo(() => props.guest.ipAddresses ?? []);
   const networkInterfaces = createMemo(() => props.guest.networkInterfaces ?? []);
   const hasNetworkInterfaces = createMemo(() => networkInterfaces().length > 0);
@@ -183,24 +571,38 @@ export function GuestRow(props: GuestRowProps) {
   const osVersion = createMemo(() => props.guest.osVersion?.trim() ?? '');
   const agentVersion = createMemo(() => props.guest.agentVersion?.trim() ?? '');
   const hasOsInfo = createMemo(() => osName().length > 0 || osVersion().length > 0);
-  const hasAgentInfo = createMemo(() => agentVersion().length > 0);
 
-  // Update custom URL when prop changes, but only if we're not currently editing
+  const isOCIContainer = createMemo(() => {
+    if (isVM(props.guest)) return false;
+    const container = props.guest as Container;
+    return props.guest.type === 'oci' || container.isOci === true;
+  });
+
+  // OCI image info - extract clean image name from osTemplate (similar to Docker container image display)
+  const ociImage = createMemo(() => {
+    if (!isOCIContainer()) return null;
+    const template = (props.guest as Container).osTemplate;
+    if (!template) return null;
+    // Strip common prefixes to get clean image reference
+    let image = template;
+    if (image.startsWith('oci:')) image = image.slice(4);
+    if (image.startsWith('docker:')) image = image.slice(7);
+    return image;
+  });
+
+  // Update custom URL when prop changes
   createEffect(() => {
-    // Don't update customUrl from props if this guest is currently being edited
-    if (currentlyEditingGuestId() !== guestId()) {
-      const prevUrl = customUrl();
-      const newUrl = props.customUrl;
+    const prevUrl = customUrl();
+    const newUrl = props.customUrl;
 
-      // Only animate when URL transitions from empty to having a value
-      if (!prevUrl && newUrl) {
-        setShouldAnimateIcon(true);
-        // Remove animation class after it completes
-        setTimeout(() => setShouldAnimateIcon(false), 200);
-      }
-
-      setCustomUrl(newUrl);
+    // Only animate when URL transitions from empty to having a value
+    if (!prevUrl && newUrl) {
+      setShouldAnimateIcon(true);
+      // Remove animation class after it completes
+      setTimeout(() => setShouldAnimateIcon(false), 200);
     }
+
+    setCustomUrl(newUrl);
   });
 
   const cpuPercent = createMemo(() => (props.guest.cpu || 0) * 100);
@@ -239,166 +641,8 @@ export function GuestRow(props: GuestRowProps) {
     return lines.length > 0 ? lines : undefined;
   });
   const memoryTooltip = createMemo(() => memoryExtraLines()?.join('\n') ?? undefined);
-  const hasDrawerContent = createMemo(
-    () =>
-      hasOsInfo() ||
-      hasAgentInfo() ||
-      ipAddresses().length > 0 ||
-      (memoryExtraLines()?.length ?? 0) > 0 ||
-      hasFilesystemDetails() ||
-      hasNetworkInterfaces(),
-  );
-  const hasFallbackContent = createMemo(
-    () => !hasDrawerContent() && (props.guest.type === 'qemu' || props.guest.type === 'lxc'),
-  );
-  const canShowDrawer = createMemo(() => hasDrawerContent() || hasFallbackContent());
 
-  createEffect(() => {
-    if (!canShowDrawer() && drawerOpen()) {
-      setCurrentlyExpandedGuestId(null);
-    }
-  });
 
-  const toggleDrawer = (event: MouseEvent) => {
-    if (!canShowDrawer()) return;
-    const target = event.target as HTMLElement;
-    if (target.closest('a, button, input, [data-prevent-toggle]')) {
-      return;
-    }
-    setCurrentlyExpandedGuestId(prev => prev === guestId() ? null : guestId());
-  };
-
-  const startEditingUrl = (event: MouseEvent) => {
-    event.stopPropagation();
-
-    const currentEditing = currentlyEditingGuestId();
-    if (currentEditing !== null && currentEditing !== guestId()) {
-      const currentInput = document.querySelector(`input[data-guest-id="${currentEditing}"]`) as HTMLInputElement;
-      if (currentInput) {
-        currentInput.blur();
-      }
-    }
-
-    editingValues.set(guestId(), customUrl() || '');
-    setEditingValuesVersion(v => v + 1);
-    setCurrentlyEditingGuestId(guestId());
-  };
-
-  createEffect(() => {
-    if (isEditingUrl() && urlInputRef) {
-      urlInputRef.focus();
-      urlInputRef.select();
-    }
-  });
-
-  let isCurrentlyMounted = true;
-
-  createEffect(() => {
-    if (isEditingUrl() && isCurrentlyMounted) {
-      const handleGlobalClick = (e: MouseEvent) => {
-        if (currentlyEditingGuestId() !== guestId()) return;
-
-        const target = e.target as HTMLElement;
-        const isClickingGuestName = target.closest('[data-guest-name-editable]');
-
-        if (!target.closest('[data-url-editor]') && !isClickingGuestName) {
-          e.preventDefault();
-          e.stopPropagation();
-          e.stopImmediatePropagation();
-          cancelEditingUrl();
-        }
-      };
-
-      const handleGlobalMouseDown = (e: MouseEvent) => {
-        if (currentlyEditingGuestId() !== guestId()) return;
-
-        const target = e.target as HTMLElement;
-        const isClickingGuestName = target.closest('[data-guest-name-editable]');
-
-        if (!target.closest('[data-url-editor]') && !isClickingGuestName) {
-          e.preventDefault();
-          e.stopPropagation();
-          e.stopImmediatePropagation();
-        }
-      };
-
-      document.addEventListener('mousedown', handleGlobalMouseDown, true);
-      document.addEventListener('click', handleGlobalClick, true);
-      return () => {
-        document.removeEventListener('mousedown', handleGlobalMouseDown, true);
-        document.removeEventListener('click', handleGlobalClick, true);
-      };
-    }
-  });
-
-  const saveUrl = async () => {
-    if (currentlyEditingGuestId() !== guestId()) return;
-
-    const newUrl = (editingValues.get(guestId()) || '').trim();
-
-    editingValues.delete(guestId());
-    setEditingValuesVersion(v => v + 1);
-    setCurrentlyEditingGuestId(null);
-
-    if (newUrl === (customUrl() || '')) return;
-
-    try {
-      await GuestMetadataAPI.updateMetadata(guestId(), { customUrl: newUrl });
-
-      const hadUrl = !!customUrl();
-      if (!hadUrl && newUrl) {
-        setShouldAnimateIcon(true);
-        setTimeout(() => setShouldAnimateIcon(false), 200);
-      }
-
-      setCustomUrl(newUrl || undefined);
-
-      if (props.onCustomUrlUpdate) {
-        props.onCustomUrlUpdate(guestId(), newUrl);
-      }
-
-      if (newUrl) {
-        showSuccess('Guest URL saved');
-      } else {
-        showSuccess('Guest URL cleared');
-      }
-    } catch (err: any) {
-      logger.error('Failed to save guest URL:', err);
-      showError(err.message || 'Failed to save guest URL');
-    }
-  };
-
-  const deleteUrl = async () => {
-    if (currentlyEditingGuestId() !== guestId()) return;
-
-    editingValues.delete(guestId());
-    setEditingValuesVersion(v => v + 1);
-    setCurrentlyEditingGuestId(null);
-
-    if (customUrl()) {
-      try {
-        await GuestMetadataAPI.updateMetadata(guestId(), { customUrl: '' });
-        setCustomUrl(undefined);
-
-        if (props.onCustomUrlUpdate) {
-          props.onCustomUrlUpdate(guestId(), '');
-        }
-
-        showSuccess('Guest URL removed');
-      } catch (err: any) {
-        logger.error('Failed to remove guest URL:', err);
-        showError(err.message || 'Failed to remove guest URL');
-      }
-    }
-  };
-
-  const cancelEditingUrl = () => {
-    if (currentlyEditingGuestId() !== guestId()) return;
-
-    editingValues.delete(guestId());
-    setEditingValuesVersion(v => v + 1);
-    setCurrentlyEditingGuestId(null);
-  };
 
   const diskPercent = createMemo(() => {
     if (!props.guest.disk || props.guest.disk.total === 0) return 0;
@@ -458,6 +702,18 @@ export function GuestRow(props: GuestRowProps) {
     return '#9ca3af';
   });
 
+  // Check AI context state reactively from the store
+  // Show selection even when sidebar is closed - makes selection persistent
+  const isInAIContext = createMemo(() => aiChatStore.enabled && aiChatStore.hasContextItem(guestId()));
+  const isAboveInAIContext = createMemo(() => {
+    if (!props.aboveGuestId) return false;
+    return aiChatStore.hasContextItem(props.aboveGuestId);
+  });
+  const isBelowInAIContext = createMemo(() => {
+    if (!props.belowGuestId) return false;
+    return aiChatStore.hasContextItem(props.belowGuestId);
+  });
+
   const rowClass = createMemo(() => {
     const base = 'transition-all duration-200 relative';
     const hover = 'hover:shadow-sm';
@@ -470,194 +726,220 @@ export function GuestRow(props: GuestRowProps) {
       ? ''
       : 'hover:bg-gray-50 dark:hover:bg-gray-700/30';
     const stoppedDimming = !isRunning() ? 'opacity-60' : '';
-    const clickable = canShowDrawer() ? 'cursor-pointer' : '';
-    const expanded = drawerOpen() && !hasUnacknowledgedAlert()
-      ? 'bg-gray-50 dark:bg-gray-800/40'
-      : '';
-    return `${base} ${hover} ${defaultHover} ${alertBg} ${stoppedDimming} ${clickable} ${expanded}`;
+    // Make row clickable if AI is enabled (for context selection)
+    const clickable = aiChatStore.enabled ? 'cursor-pointer' : '';
+    // AI context highlight with merged borders for adjacent rows
+    let aiContext = '';
+    if (isInAIContext()) {
+      aiContext = 'ai-context-row';
+      if (isAboveInAIContext()) aiContext += ' ai-context-no-top';
+      if (isBelowInAIContext()) aiContext += ' ai-context-no-bottom';
+    }
+    return `${base} ${hover} ${defaultHover} ${alertBg} ${stoppedDimming} ${clickable} ${aiContext}`;
   });
 
   const rowStyle = createMemo(() => {
-    if (!showAlertHighlight()) return {};
-    const color = alertAccentColor();
-    if (!color) return {};
-    return {
-      'box-shadow': `inset 4px 0 0 0 ${color}`,
-    };
+    const styles: Record<string, string> = {};
+
+    // Alert styling (only if not in AI context - AI context uses CSS class)
+    if (!isInAIContext() && showAlertHighlight()) {
+      const color = alertAccentColor();
+      if (color) {
+        styles['box-shadow'] = `inset 4px 0 0 0 ${color}`;
+      }
+    }
+
+    return styles;
   });
 
-  // Total columns for colspan calculation
-  const totalColumns = GUEST_COLUMNS.length;
+  const handleRowClick = (e: MouseEvent) => {
+    // Don't trigger if clicking on interactive elements
+    const target = e.target as HTMLElement;
+    if (target.closest('[data-prevent-toggle]') ||
+      target.closest('a') ||
+      target.closest('button') ||
+      target.closest('input')) {
+      return;
+    }
+    props.onRowClick?.(props.guest);
+  };
 
   return (
-    <>
-      <tr
-        class={rowClass()}
-        style={rowStyle()}
-        onClick={toggleDrawer}
-        aria-expanded={drawerOpen()}
-      >
-        {/* Name */}
-        <td class={`pr-2 py-1 align-middle whitespace-nowrap ${props.isGroupedView ? GROUPED_FIRST_CELL_INDENT : DEFAULT_FIRST_CELL_INDENT}`}>
-          <div class="flex items-center gap-2 min-w-0">
-            <div class="flex items-center gap-1.5 min-w-0">
-              <StatusDot
-                variant={guestStatus().variant}
-                title={guestStatus().label}
-                ariaLabel={guestStatus().label}
-                size="xs"
-              />
-              <Show
-                when={isEditingUrl()}
-                fallback={
-                  <div class="flex items-center gap-1.5 min-w-0">
-                    <span
-                      class="text-xs font-medium text-gray-900 dark:text-gray-100 cursor-text select-none whitespace-nowrap"
-                      style="cursor: text;"
-                      title={`${props.guest.name}${customUrl() ? ' - Click to edit URL' : ' - Click to add URL'}`}
-                      onClick={startEditingUrl}
-                      data-guest-name-editable
+    <tr
+      class={rowClass()}
+      style={rowStyle()}
+      onClick={handleRowClick}
+      data-guest-id={guestId()}
+    >
+      {/* Name - always visible */}
+      <td class={`pr-2 py-1 align-middle whitespace-nowrap ${props.isGroupedView ? GROUPED_FIRST_CELL_INDENT : DEFAULT_FIRST_CELL_INDENT}`}>
+        <div class="flex items-center gap-2 min-w-0">
+          <div class="flex items-center gap-1.5 min-w-0">
+            <StatusDot
+              variant={guestStatus().variant}
+              title={guestStatus().label}
+              ariaLabel={guestStatus().label}
+              size="xs"
+            />
+            <Show
+              when={isEditingUrl()}
+              fallback={
+                <div class="flex items-center gap-1.5 min-w-0 group/name">
+                  <span
+                    class="text-xs font-medium text-gray-900 dark:text-gray-100 select-none whitespace-nowrap"
+                    title={props.guest.name}
+                  >
+                    {props.guest.name}
+                  </span>
+                  <Show when={customUrl()}>
+                    <a
+                      href={customUrl()}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      class={`flex-shrink-0 text-blue-600 dark:text-blue-400 hover:text-blue-700 dark:hover:text-blue-300 transition-colors ${shouldAnimateIcon() ? 'animate-fadeIn' : ''}`}
+                      title={`Open ${customUrl()}`}
+                      onClick={(event) => event.stopPropagation()}
                     >
-                      {props.guest.name}
-                    </span>
-                    <Show when={customUrl()}>
-                      <a
-                        href={customUrl()}
-                        target="_blank"
-                        rel="noopener noreferrer"
-                        class={`flex-shrink-0 text-blue-600 dark:text-blue-400 hover:text-blue-700 dark:hover:text-blue-300 transition-colors ${shouldAnimateIcon() ? 'animate-fadeIn' : ''}`}
-                        title="Open in new tab"
-                        onClick={(event) => event.stopPropagation()}
+                      <svg
+                        class="w-3.5 h-3.5"
+                        fill="none"
+                        stroke="currentColor"
+                        viewBox="0 0 24 24"
                       >
-                        <svg
-                          class="w-3.5 h-3.5"
-                          fill="none"
-                          stroke="currentColor"
-                          viewBox="0 0 24 24"
-                        >
-                          <path
-                            stroke-linecap="round"
-                            stroke-linejoin="round"
-                            stroke-width="2"
-                            d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
-                          />
-                        </svg>
-                      </a>
-                    </Show>
+                        <path
+                          stroke-linecap="round"
+                          stroke-linejoin="round"
+                          stroke-width="2"
+                          d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
+                        />
+                      </svg>
+                    </a>
+                  </Show>
+                  {/* Edit URL button - shows on hover */}
+                  <button
+                    type="button"
+                    onClick={startEditingUrl}
+                    class="flex-shrink-0 opacity-0 group-hover/name:opacity-100 text-gray-400 hover:text-blue-500 dark:hover:text-blue-400 transition-all"
+                    title={customUrl() ? 'Edit URL' : 'Add URL'}
+                  >
+                    <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" />
+                    </svg>
+                  </button>
+                  {/* Show backup indicator in name cell only if backup column is hidden */}
+                  <Show when={!isColVisible('backup')}>
                     <BackupIndicator lastBackup={props.guest.lastBackup} isTemplate={props.guest.template} />
-                  </div>
-                }
-              >
-                <div class="flex items-center gap-1 min-w-0" data-url-editor>
-                  <input
-                    ref={urlInputRef}
-                    type="text"
-                    value={editingUrlValue()}
-                    data-guest-id={guestId()}
-                    onInput={(e) => {
-                      editingValues.set(guestId(), e.currentTarget.value);
-                      setEditingValuesVersion(v => v + 1);
-                    }}
-                    onKeyDown={(e) => {
-                      if (e.key === 'Enter') {
-                        e.preventDefault();
-                        saveUrl();
-                      } else if (e.key === 'Escape') {
-                        e.preventDefault();
-                        cancelEditingUrl();
-                      }
-                    }}
-                    onClick={(e) => e.stopPropagation()}
-                    placeholder="https://192.168.1.100:8006"
-                    class="min-w-0 px-2 py-0.5 text-sm border border-blue-500 rounded bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:outline-none focus:ring-2 focus:ring-blue-500"
-                  />
-                  <button
-                    type="button"
-                    data-url-editor-button
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      saveUrl();
-                    }}
-                    class="flex-shrink-0 w-6 h-6 flex items-center justify-center text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors"
-                    title="Save (or press Enter)"
-                  >
-                    ✓
-                  </button>
-                  <button
-                    type="button"
-                    data-url-editor-button
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      deleteUrl();
-                    }}
-                    class="flex-shrink-0 w-6 h-6 flex items-center justify-center text-xs bg-red-600 text-white rounded hover:bg-red-700 transition-colors"
-                    title="Delete URL"
-                  >
-                    ✕
-                  </button>
+                  </Show>
+                  {/* AI context indicator - shows when row is selected for AI */}
+                  <Show when={isInAIContext()}>
+                    <span class="flex-shrink-0 text-purple-500 dark:text-purple-400" title="Selected for AI context">
+                      <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.455-2.456L14.25 6l1.036-.259a3.375 3.375 0 002.455-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456z" />
+                      </svg>
+                    </span>
+                  </Show>
                 </div>
-              </Show>
-            </div>
-
-            <Show when={!isEditingUrl()}>
-              <div class="hidden md:flex" data-prevent-toggle onClick={(event) => event.stopPropagation()}>
-                <TagBadges
-                  tags={Array.isArray(props.guest.tags) ? props.guest.tags : []}
-                  maxVisible={3}
-                  onTagClick={props.onTagClick}
-                  activeSearch={props.activeSearch}
+              }
+            >
+              {/* URL editing mode */}
+              <div class="flex items-center gap-1 min-w-0" data-url-editor>
+                <input
+                  ref={urlInputRef}
+                  type="text"
+                  value={editingUrlValue()}
+                  onInput={(e) => setEditingUrlValue(e.currentTarget.value)}
+                  onKeyDown={(e) => {
+                    if (e.key === 'Enter') {
+                      e.preventDefault();
+                      saveUrl();
+                    } else if (e.key === 'Escape') {
+                      e.preventDefault();
+                      cancelEditingUrl();
+                    }
+                  }}
+                  onClick={(e) => e.stopPropagation()}
+                  placeholder="https://192.168.1.100:8080"
+                  class="w-40 px-2 py-0.5 text-xs border border-blue-500 rounded bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:outline-none focus:ring-1 focus:ring-blue-500"
+                  disabled={isSavingUrl()}
                 />
+                <button
+                  type="button"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    saveUrl();
+                  }}
+                  disabled={isSavingUrl()}
+                  class="flex-shrink-0 w-5 h-5 flex items-center justify-center text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50"
+                  title="Save (Enter)"
+                >
+                  ✓
+                </button>
+                <button
+                  type="button"
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    cancelEditingUrl();
+                  }}
+                  disabled={isSavingUrl()}
+                  class="flex-shrink-0 w-5 h-5 flex items-center justify-center text-xs bg-gray-500 text-white rounded hover:bg-gray-600 transition-colors disabled:opacity-50"
+                  title="Cancel (Esc)"
+                >
+                  ✕
+                </button>
               </div>
             </Show>
-
-            <Show when={lockLabel()}>
-              <span
-                class="text-[10px] font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide whitespace-nowrap"
-                title={`Guest is locked (${lockLabel()})`}
-              >
-                Lock: {lockLabel()}
-              </span>
-            </Show>
           </div>
-        </td>
 
-        {/* Type */}
+
+
+          <Show when={lockLabel()}>
+            <span
+              class="text-[10px] font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide whitespace-nowrap"
+              title={`Guest is locked (${lockLabel()})`}
+            >
+              Lock: {lockLabel()}
+            </span>
+          </Show>
+        </div>
+      </td>
+
+      {/* Type */}
+      <Show when={isColVisible('type')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center">
             <span
               class={`inline-block px-1 py-0.5 text-[10px] font-medium rounded whitespace-nowrap ${props.guest.type === 'qemu'
                 ? 'bg-blue-100 text-blue-700 dark:bg-blue-900/50 dark:text-blue-300'
-                : 'bg-green-100 text-green-700 dark:bg-green-900/50 dark:text-green-300'
+                : isOCIContainer()
+                  ? 'bg-purple-100 text-purple-700 dark:bg-purple-900/50 dark:text-purple-300'
+                  : 'bg-green-100 text-green-700 dark:bg-green-900/50 dark:text-green-300'
                 }`}
-              title={isVM(props.guest) ? 'Virtual Machine' : 'LXC Container'}
+              title={
+                isVM(props.guest)
+                  ? 'Virtual Machine'
+                  : isOCIContainer()
+                    ? `OCI Container${ociImage() ? ` • ${ociImage()}` : ''}`
+                    : 'LXC Container'
+              }
             >
-              {isVM(props.guest) ? 'VM' : 'LXC'}
+              {isVM(props.guest) ? 'VM' : isOCIContainer() ? 'OCI' : 'LXC'}
             </span>
           </div>
         </td>
+      </Show>
 
-        {/* VMID */}
+      {/* VMID */}
+      <Show when={isColVisible('vmid')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center text-xs text-gray-600 dark:text-gray-400 whitespace-nowrap">
             {props.guest.vmid}
           </div>
         </td>
+      </Show>
 
-        {/* Uptime */}
-        <td class="px-2 py-1 align-middle">
-          <div class="flex justify-center">
-            <span class={`text-xs whitespace-nowrap ${props.guest.uptime < 3600 ? 'text-orange-500' : 'text-gray-600 dark:text-gray-400'}`}>
-              <Show when={isRunning()} fallback="-">
-                <Show when={isMobile()} fallback={formatUptime(props.guest.uptime)}>
-                  {formatUptime(props.guest.uptime, true)}
-                </Show>
-              </Show>
-            </span>
-          </div>
-        </td>
-
-        {/* CPU */}
-        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+      {/* CPU */}
+      <Show when={isColVisible('cpu')}>
+        <td class="px-2 py-1 align-middle" style={{ width: "140px", "min-width": "140px", "max-width": "140px" }}>
           <Show when={isMobile()}>
             <div class="md:hidden flex justify-center">
               <ResponsiveMetricCell
@@ -689,9 +971,11 @@ export function GuestRow(props: GuestRowProps) {
             />
           </div>
         </td>
+      </Show>
 
-        {/* Memory */}
-        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+      {/* Memory */}
+      <Show when={isColVisible('memory')}>
+        <td class="px-2 py-1 align-middle" style={{ width: "140px", "min-width": "140px", "max-width": "140px" }}>
           <div title={memoryTooltip() ?? undefined}>
             <Show when={isMobile()}>
               <div class="md:hidden flex justify-center">
@@ -706,24 +990,41 @@ export function GuestRow(props: GuestRowProps) {
               </div>
             </Show>
             <div class="hidden md:block">
-              <StackedMemoryBar
-                used={props.guest.memory?.used || 0}
-                total={props.guest.memory?.total || 0}
-                balloon={props.guest.memory?.balloon || 0}
-                swapUsed={props.guest.memory?.swapUsed || 0}
-                swapTotal={props.guest.memory?.swapTotal || 0}
-              />
+              <Show
+                when={viewMode() === 'sparklines'}
+                fallback={
+                  <StackedMemoryBar
+                    used={props.guest.memory?.used || 0}
+                    total={props.guest.memory?.total || 0}
+                    balloon={props.guest.memory?.balloon || 0}
+                    swapUsed={props.guest.memory?.swapUsed || 0}
+                    swapTotal={props.guest.memory?.swapTotal || 0}
+                    resourceId={metricsKey()}
+                  />
+                }
+              >
+                <ResponsiveMetricCell
+                  value={memPercent()}
+                  type="memory"
+                  resourceId={metricsKey()}
+                  sublabel={memoryUsageLabel()}
+                  isRunning={isRunning()}
+                  showMobile={false}
+                />
+              </Show>
             </div>
           </div>
         </td>
+      </Show>
 
-        {/* Disk */}
-        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+      {/* Disk */}
+      <Show when={isColVisible('disk')}>
+        <td class="px-2 py-1 align-middle" style={{ width: "140px", "min-width": "140px", "max-width": "140px" }}>
           <Show
             when={hasDiskUsage()}
             fallback={
               <div class="flex justify-center">
-                <span class="text-xs text-gray-400 cursor-help" title={getDiskStatusTooltip()}>
+                <span class="text-xs text-gray-400" title={getDiskStatusTooltip()}>
                   -
                 </span>
               </div>
@@ -735,15 +1036,129 @@ export function GuestRow(props: GuestRowProps) {
               </div>
             </Show>
             <div class={isMobile() ? 'hidden md:block' : ''}>
-              <StackedDiskBar
-                disks={props.guest.disks}
-                aggregateDisk={props.guest.disk}
-              />
+              <Show
+                when={viewMode() === 'sparklines'}
+                fallback={
+                  <StackedDiskBar
+                    disks={props.guest.disks}
+                    aggregateDisk={props.guest.disk}
+                  />
+                }
+              >
+                <ResponsiveMetricCell
+                  value={diskPercent()}
+                  type="disk"
+                  resourceId={metricsKey()}
+                  isRunning={isRunning()}
+                  showMobile={false}
+                />
+              </Show>
             </div>
           </Show>
         </td>
+      </Show>
 
-        {/* Disk Read */}
+      {/* IP Address with Network Tooltip */}
+      <Show when={isColVisible('ip')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={ipAddresses().length > 0 || hasNetworkInterfaces()} fallback={<span class="text-xs text-gray-400">-</span>}>
+              <NetworkInfoCell
+                ipAddresses={ipAddresses()}
+                networkInterfaces={networkInterfaces()}
+              />
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* Uptime */}
+      <Show when={isColVisible('uptime')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <span class={`text-xs whitespace-nowrap ${props.guest.uptime < 3600 ? 'text-orange-500' : 'text-gray-600 dark:text-gray-400'}`}>
+              <Show when={isRunning()} fallback="-">
+                <Show when={isMobile()} fallback={formatUptime(props.guest.uptime)}>
+                  {formatUptime(props.guest.uptime, true)}
+                </Show>
+              </Show>
+            </span>
+          </div>
+        </td>
+      </Show>
+
+      {/* Node - NEW */}
+      <Show when={isColVisible('node')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <span class="text-xs text-gray-600 dark:text-gray-400 truncate max-w-[80px]" title={props.guest.node}>
+              {props.guest.node}
+            </span>
+          </div>
+        </td>
+      </Show>
+
+      {/* Backup Status */}
+      <Show when={isColVisible('backup')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={!props.guest.template}>
+              <BackupStatusCell lastBackup={props.guest.lastBackup} />
+            </Show>
+            <Show when={props.guest.template}>
+              <span class="text-xs text-gray-400">-</span>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* Tags */}
+      <Show when={isColVisible('tags')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center" onClick={(event) => event.stopPropagation()}>
+            <TagBadges
+              tags={Array.isArray(props.guest.tags) ? props.guest.tags : []}
+              maxVisible={0}
+              onTagClick={props.onTagClick}
+              activeSearch={props.activeSearch}
+            />
+          </div>
+        </td>
+      </Show>
+
+      {/* OS */}
+      <Show when={isColVisible('os')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show
+              when={hasOsInfo()}
+              fallback={
+                <Show
+                  when={ociImage()}
+                  fallback={<span class="text-xs text-gray-400">-</span>}
+                >
+                  {/* For OCI containers without guest agent, show image name in OS column */}
+                  <span
+                    class="text-xs text-purple-600 dark:text-purple-400 truncate max-w-[100px]"
+                    title={`OCI Image: ${ociImage()}`}
+                  >
+                    {ociImage()}
+                  </span>
+                </Show>
+              }
+            >
+              <OSInfoCell
+                osName={osName()}
+                osVersion={osVersion()}
+                agentVersion={agentVersion()}
+              />
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* Disk Read */}
+      <Show when={isColVisible('diskRead')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center whitespace-nowrap">
             <Show when={isRunning()} fallback={<span class="text-xs text-gray-400">-</span>}>
@@ -751,8 +1166,10 @@ export function GuestRow(props: GuestRowProps) {
             </Show>
           </div>
         </td>
+      </Show>
 
-        {/* Disk Write */}
+      {/* Disk Write */}
+      <Show when={isColVisible('diskWrite')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center whitespace-nowrap">
             <Show when={isRunning()} fallback={<span class="text-xs text-gray-400">-</span>}>
@@ -760,8 +1177,10 @@ export function GuestRow(props: GuestRowProps) {
             </Show>
           </div>
         </td>
+      </Show>
 
-        {/* Net In */}
+      {/* Net In */}
+      <Show when={isColVisible('netIn')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center whitespace-nowrap">
             <Show when={isRunning()} fallback={<span class="text-xs text-gray-400">-</span>}>
@@ -769,8 +1188,10 @@ export function GuestRow(props: GuestRowProps) {
             </Show>
           </div>
         </td>
+      </Show>
 
-        {/* Net Out */}
+      {/* Net Out */}
+      <Show when={isColVisible('netOut')}>
         <td class="px-2 py-1 align-middle">
           <div class="flex justify-center whitespace-nowrap">
             <Show when={isRunning()} fallback={<span class="text-xs text-gray-400">-</span>}>
@@ -778,19 +1199,7 @@ export function GuestRow(props: GuestRowProps) {
             </Show>
           </div>
         </td>
-      </tr>
-
-      <Show when={drawerOpen() && canShowDrawer()}>
-        <tr class="bg-gray-50 dark:bg-gray-900/50">
-          <td colspan={totalColumns} class="p-4 border-b border-gray-200 dark:border-gray-700">
-            <GuestDrawer
-              guest={props.guest}
-              metricsKey={metricsKey()}
-              onClose={() => setCurrentlyExpandedGuestId(null)}
-            />
-          </td>
-        </tr>
       </Show>
-    </>
+    </tr>
   );
 }
diff --git a/frontend-modern/src/components/Dashboard/InvestigateProblemsButton.tsx b/frontend-modern/src/components/Dashboard/InvestigateProblemsButton.tsx
new file mode 100644
index 0000000..84a5fc4
--- /dev/null
+++ b/frontend-modern/src/components/Dashboard/InvestigateProblemsButton.tsx
@@ -0,0 +1,154 @@
+import { Component, Show, createMemo } from 'solid-js';
+import { aiChatStore } from '@/stores/aiChat';
+import type { VM, Container } from '@/types/api';
+import { getBackupInfo } from '@/utils/format';
+import { DEGRADED_HEALTH_STATUSES, OFFLINE_HEALTH_STATUSES } from '@/utils/status';
+
+interface ProblemGuest {
+    guest: VM | Container;
+    issues: string[];
+}
+
+interface InvestigateProblemsButtonProps {
+    /** The filtered guests currently showing as "problems" */
+    problemGuests: (VM | Container)[];
+    /** Whether the problems filter is active */
+    isProblemsMode: boolean;
+}
+
+/**
+ * "Investigate Problems with AI" button.
+ * Appears when the Problems filter is active and finds results.
+ * Opens AI chat with rich context about all problem guests.
+ */
+export const InvestigateProblemsButton: Component<InvestigateProblemsButtonProps> = (props) => {
+    // Analyze each guest to determine what issues they have
+    const analyzedProblems = createMemo((): ProblemGuest[] => {
+        return props.problemGuests.map(guest => {
+            const issues: string[] = [];
+
+            // Check for degraded status
+            const status = (guest.status || '').toLowerCase();
+            const isDegraded = DEGRADED_HEALTH_STATUSES.has(status) ||
+                (status !== 'running' && !OFFLINE_HEALTH_STATUSES.has(status) && status !== 'stopped');
+            if (isDegraded) {
+                issues.push(`Status: ${status || 'unknown'}`);
+            }
+
+            // Check for backup issues
+            if (!guest.template) {
+                const backupInfo = getBackupInfo(guest.lastBackup);
+                if (backupInfo.status === 'critical') {
+                    issues.push('Backup: Critical (very overdue)');
+                } else if (backupInfo.status === 'stale') {
+                    issues.push('Backup: Stale');
+                } else if (backupInfo.status === 'never') {
+                    issues.push('Backup: Never backed up');
+                }
+            }
+
+            // Check for high CPU
+            if (guest.cpu > 0.9) {
+                issues.push(`CPU: ${(guest.cpu * 100).toFixed(0)}%`);
+            }
+
+            // Check for high memory
+            if (guest.memory && guest.memory.usage && guest.memory.usage > 90) {
+                issues.push(`Memory: ${guest.memory.usage.toFixed(0)}%`);
+            }
+
+            return { guest, issues };
+        }).filter(p => p.issues.length > 0);
+    });
+
+    const handleClick = (e: MouseEvent) => {
+        e.stopPropagation();
+        e.preventDefault();
+
+        const problems = analyzedProblems();
+        if (problems.length === 0) return;
+
+        // Build a rich prompt with all problem details
+        const problemSummary = problems.map(({ guest, issues }) => {
+            const type = guest.type === 'qemu' ? 'VM' : 'LXC';
+            return `- **${guest.name}** (${type} ${guest.vmid} on ${guest.node}): ${issues.join(', ')}`;
+        }).join('\n');
+
+        // Categorize issues for better AI understanding
+        const issueCategories = {
+            backup: problems.filter(p => p.issues.some(i => i.startsWith('Backup:'))).length,
+            cpu: problems.filter(p => p.issues.some(i => i.startsWith('CPU:'))).length,
+            memory: problems.filter(p => p.issues.some(i => i.startsWith('Memory:'))).length,
+            status: problems.filter(p => p.issues.some(i => i.startsWith('Status:'))).length,
+        };
+
+        const categoryBreakdown = Object.entries(issueCategories)
+            .filter(([, count]) => count > 0)
+            .map(([type, count]) => `${count} ${type}`)
+            .join(', ');
+
+        const prompt = `I have ${problems.length} guest${problems.length !== 1 ? 's' : ''} that need attention (${categoryBreakdown}):
+
+${problemSummary}
+
+Please help me:
+1. **Prioritize** - Which issues should I address first?
+2. **Investigate** - For the most critical issues, check their current status
+3. **Remediate** - Suggest specific steps to resolve each issue
+4. **Prevent** - Recommend any configuration changes to prevent these issues
+
+Start with the most critical problems first.`;
+
+        // Open AI chat with this rich context
+        aiChatStore.openWithPrompt(prompt, {
+            context: {
+                problemCount: problems.length,
+                issueCategories,
+                guests: problems.map(p => ({
+                    id: p.guest.id,
+                    name: p.guest.name,
+                    vmid: p.guest.vmid,
+                    type: p.guest.type,
+                    node: p.guest.node,
+                    issues: p.issues,
+                })),
+            },
+        });
+    };
+
+    // Only show if problems mode is active AND there are results
+    const shouldShow = createMemo(() =>
+        props.isProblemsMode && props.problemGuests.length > 0
+    );
+
+    return (
+        <Show when={shouldShow()}>
+            <button
+                type="button"
+                onClick={handleClick}
+                class="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-semibold rounded-lg
+               bg-gradient-to-r from-purple-500 to-blue-500 
+               hover:from-purple-600 hover:to-blue-600
+               text-white shadow-md shadow-purple-500/25 
+               hover:shadow-lg hover:shadow-purple-500/30
+               transition-all duration-150 active:scale-95
+               ring-1 ring-purple-400/50"
+                title={`Ask AI to help investigate and resolve ${props.problemGuests.length} problem${props.problemGuests.length !== 1 ? 's' : ''}`}
+            >
+                <svg class="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                    <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z"
+                    />
+                </svg>
+                <span>Investigate {props.problemGuests.length} with AI</span>
+                <svg class="w-3 h-3 opacity-70" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M13 7l5 5m0 0l-5 5m5-5H6" />
+                </svg>
+            </button>
+        </Show>
+    );
+};
+
+export default InvestigateProblemsButton;
diff --git a/frontend-modern/src/components/Dashboard/MetricBar.tsx b/frontend-modern/src/components/Dashboard/MetricBar.tsx
index 455cb6e..d6d0a0d 100644
--- a/frontend-modern/src/components/Dashboard/MetricBar.tsx
+++ b/frontend-modern/src/components/Dashboard/MetricBar.tsx
@@ -1,7 +1,7 @@
 import { Show, createMemo, createSignal, onMount, onCleanup } from 'solid-js';
 import { Sparkline } from '@/components/shared/Sparkline';
 import { useMetricsViewMode } from '@/stores/metricsViewMode';
-import { getMetricHistory } from '@/stores/metricsHistory';
+import { getMetricHistoryForRange, getMetricsVersion } from '@/stores/metricsHistory';
 
 interface MetricBarProps {
   value: number;
@@ -19,7 +19,7 @@ const estimateTextWidth = (text: string): number => {
 };
 
 export function MetricBar(props: MetricBarProps) {
-  const { viewMode } = useMetricsViewMode();
+  const { viewMode, timeRange } = useMetricsViewMode();
   const width = createMemo(() => Math.min(props.value, 100));
 
   // Track container width
@@ -86,9 +86,12 @@ export function MetricBar(props: MetricBarProps) {
   });
 
   // Get metric history for sparkline
+  // Depends on metricsVersion to re-fetch when data is seeded (e.g., on time range change)
   const metricHistory = createMemo(() => {
+    // Subscribe to version changes so we re-read when new data is seeded
+    getMetricsVersion();
     if (viewMode() !== 'sparklines' || !props.resourceId) return [];
-    return getMetricHistory(props.resourceId);
+    return getMetricHistoryForRange(props.resourceId, timeRange());
   });
 
   // Determine which metric type to use for sparkline
@@ -102,9 +105,9 @@ export function MetricBar(props: MetricBarProps) {
     <Show
       when={viewMode() === 'sparklines' && props.resourceId}
       fallback={
-        // Original progress bar mode - capped width for better appearance on wide screens
+        // Progress bar mode - full width, flex centered like stacked bars
         <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
-          <div class={`relative w-full max-w-[140px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded ${props.class || ''}`}>
+          <div class={`relative w-full h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded ${props.class || ''}`}>
             <div class={`absolute top-0 left-0 h-full ${progressColorClass()}`} style={{ width: `${width()}%` }} />
             <span class="absolute inset-0 flex items-center justify-center text-[10px] font-semibold text-gray-700 dark:text-gray-100 leading-none">
               <span class="flex items-center gap-1 whitespace-nowrap px-0.5">
@@ -120,19 +123,14 @@ export function MetricBar(props: MetricBarProps) {
         </div>
       }
     >
-      {/* Sparkline mode */}
-      <div class="metric-text w-full h-6 flex items-center gap-1.5">
-        <div class="flex-1 min-w-0">
-          <Sparkline
-            data={metricHistory()}
-            metric={sparklineMetric()}
-            width={0}
-            height={24}
-          />
-        </div>
-        <span class="text-[10px] font-medium text-gray-800 dark:text-gray-100 whitespace-nowrap flex-shrink-0 min-w-[35px]">
-          {props.label}
-        </span>
+      {/* Sparkline mode - full width, flex centered like stacked bars */}
+      <div class="metric-text w-full h-4 flex items-center justify-center min-w-0 overflow-hidden">
+        <Sparkline
+          data={metricHistory()}
+          metric={sparklineMetric()}
+          width={0}
+          height={16}
+        />
       </div>
     </Show>
   );
diff --git a/frontend-modern/src/components/Dashboard/StackedDiskBar.tsx b/frontend-modern/src/components/Dashboard/StackedDiskBar.tsx
index 98aa642..5b15d06 100644
--- a/frontend-modern/src/components/Dashboard/StackedDiskBar.tsx
+++ b/frontend-modern/src/components/Dashboard/StackedDiskBar.tsx
@@ -122,9 +122,14 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
     });
   });
 
+  // Check if we have any disk details to show
+  const hasDisks = createMemo(() => {
+    return props.disks && props.disks.length > 0;
+  });
+
   // Generate tooltip content
   const tooltipContent = createMemo(() => {
-    if (hasMultipleDisks() && props.disks) {
+    if (hasDisks() && props.disks) {
       return props.disks.map((disk, idx) => {
         const percent = disk.total > 0 ? (disk.used / disk.total) * 100 : 0;
         const label = disk.mountpoint || disk.device || `Disk ${idx + 1}`;
@@ -139,6 +144,17 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
         };
       });
     }
+    // Fallback for aggregate disk
+    if (props.aggregateDisk && props.aggregateDisk.total > 0) {
+      const percent = (props.aggregateDisk.used / props.aggregateDisk.total) * 100;
+      return [{
+        label: 'Total',
+        used: formatBytes(props.aggregateDisk.used, 0),
+        total: formatBytes(props.aggregateDisk.total, 0),
+        percent: formatPercent(percent),
+        color: getUsageColor(percent),
+      }];
+    }
     return [];
   });
 
@@ -162,7 +178,7 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
   });
 
   const handleMouseEnter = (e: MouseEvent) => {
-    if (hasMultipleDisks()) {
+    if (tooltipContent().length > 0) {
       const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
       setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
       setShowTooltip(true);
@@ -176,7 +192,7 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
   return (
     <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
       <div
-        class="relative w-full max-w-[140px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
+        class="relative w-full h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
         onMouseEnter={handleMouseEnter}
         onMouseLeave={handleMouseLeave}
       >
@@ -227,8 +243,8 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
         </span>
       </div>
 
-      {/* Tooltip for multi-disk breakdown */}
-      <Show when={showTooltip() && hasMultipleDisks()}>
+      {/* Tooltip for disk breakdown */}
+      <Show when={showTooltip() && tooltipContent().length > 0}>
         <Portal mount={document.body}>
           <div
             class="fixed z-[9999] pointer-events-none"
@@ -240,13 +256,13 @@ export function StackedDiskBar(props: StackedDiskBarProps) {
           >
             <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[140px] border border-gray-700">
               <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
-                Disk Breakdown
+                {hasMultipleDisks() ? 'Disk Breakdown' : 'Disk Usage'}
               </div>
               <For each={tooltipContent()}>
                 {(item, idx) => (
                   <div class="flex justify-between gap-3 py-0.5" classList={{ 'border-t border-gray-700/50': idx() > 0 }}>
                     <span
-                      class="truncate max-w-[80px]"
+                      class="truncate max-w-[100px]"
                       style={{ color: item.color }}
                     >
                       {item.label}
diff --git a/frontend-modern/src/components/Dashboard/StackedMemoryBar.tsx b/frontend-modern/src/components/Dashboard/StackedMemoryBar.tsx
index 11550ce..36e2d81 100644
--- a/frontend-modern/src/components/Dashboard/StackedMemoryBar.tsx
+++ b/frontend-modern/src/components/Dashboard/StackedMemoryBar.tsx
@@ -1,6 +1,9 @@
 import { Show, For, createMemo, createSignal, onMount, onCleanup } from 'solid-js';
 import { Portal } from 'solid-js/web';
 import { formatBytes, formatPercent } from '@/utils/format';
+import { Sparkline } from '@/components/shared/Sparkline';
+import { useMetricsViewMode } from '@/stores/metricsViewMode';
+import { getMetricHistoryForRange, getMetricsVersion } from '@/stores/metricsHistory';
 
 interface StackedMemoryBarProps {
     used: number;
@@ -8,6 +11,7 @@ interface StackedMemoryBarProps {
     swapUsed?: number;
     swapTotal?: number;
     balloon?: number;
+    resourceId?: string; // Required for sparkline mode to fetch history
 }
 
 // Colors for memory segments
@@ -18,6 +22,17 @@ const MEMORY_COLORS = {
 };
 
 export function StackedMemoryBar(props: StackedMemoryBarProps) {
+    const { viewMode, timeRange } = useMetricsViewMode();
+
+    // Get metric history for sparkline
+    // Depends on metricsVersion to re-fetch when data is seeded (e.g., on time range change)
+    const metricHistory = createMemo(() => {
+        // Subscribe to version changes so we re-read when new data is seeded
+        getMetricsVersion();
+        if (viewMode() !== 'sparklines' || !props.resourceId) return [];
+        return getMetricHistoryForRange(props.resourceId, timeRange());
+    });
+
     const [containerWidth, setContainerWidth] = createSignal(100);
     const [showTooltip, setShowTooltip] = createSignal(false);
     const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
@@ -121,115 +136,129 @@ export function StackedMemoryBar(props: StackedMemoryBarProps) {
     };
 
     return (
-        <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
-            <div
-                class="relative w-full max-w-[140px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded cursor-help"
-                onMouseEnter={handleMouseEnter}
-                onMouseLeave={handleMouseLeave}
-            >
-                {/* Stacked segments - use absolute positioning like MetricBar for correct width scaling */}
-                <For each={segments()}>
-                    {(segment, idx) => {
-                        // Calculate left offset as sum of previous segments
-                        const leftOffset = () => {
-                            let offset = 0;
-                            const segs = segments();
-                            for (let i = 0; i < idx(); i++) {
-                                offset += segs[i].percent;
-                            }
-                            return offset;
-                        };
-                        return (
-                            <div
-                                class="absolute top-0 h-full transition-all duration-300"
-                                style={{
-                                    left: `${leftOffset()}%`,
-                                    width: `${segment.percent}%`,
-                                    'background-color': segment.color,
-                                    'border-right': idx() < segments().length - 1 ? '1px solid rgba(255,255,255,0.3)' : 'none',
-                                }}
-                            />
-                        );
-                    }}
-                </For>
-
-                {/* Swap Indicator (Thin line at bottom if swap is used) */}
-                {/* Swap Indicator (Thin line at bottom if swap is used) */}
-                <Show when={hasSwap() && (props.swapUsed || 0) > 0}>
+        <Show
+            when={viewMode() === 'sparklines' && props.resourceId}
+            fallback={
+                <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
                     <div
-                        class="absolute bottom-0 left-0 h-[3px] w-full bg-purple-500"
-                        style={{ width: `${Math.min(swapPercent(), 100)}%` }}
-                    />
-                </Show>
-
-                {/* Label overlay */}
-                <span class="absolute inset-0 flex items-center justify-center text-[10px] font-semibold text-gray-700 dark:text-gray-100 leading-none pointer-events-none">
-                    <span class="flex items-center gap-1 whitespace-nowrap px-0.5">
-                        <span>{displayLabel()}</span>
-                        <Show when={showSublabel()}>
-                            <span class="metric-sublabel font-normal text-gray-500 dark:text-gray-300">
-                                ({displaySublabel()})
-                            </span>
-                        </Show>
-                    </span>
-                </span>
-            </div>
-
-            {/* Tooltip */}
-            <Show when={showTooltip()}>
-                <Portal mount={document.body}>
-                    <div
-                        class="fixed z-[9999] pointer-events-none"
-                        style={{
-                            left: `${tooltipPos().x}px`,
-                            top: `${tooltipPos().y - 8}px`,
-                            transform: 'translate(-50%, -100%)',
-                        }}
+                        class="relative w-full h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
+                        onMouseEnter={handleMouseEnter}
+                        onMouseLeave={handleMouseLeave}
                     >
-                        <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[140px] border border-gray-700">
-                            <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
-                                Memory Composition
-                            </div>
+                        {/* Stacked segments - use absolute positioning like MetricBar for correct width scaling */}
+                        <For each={segments()}>
+                            {(segment, idx) => {
+                                // Calculate left offset as sum of previous segments
+                                const leftOffset = () => {
+                                    let offset = 0;
+                                    const segs = segments();
+                                    for (let i = 0; i < idx(); i++) {
+                                        offset += segs[i].percent;
+                                    }
+                                    return offset;
+                                };
+                                return (
+                                    <div
+                                        class="absolute top-0 h-full transition-all duration-300"
+                                        style={{
+                                            left: `${leftOffset()}%`,
+                                            width: `${segment.percent}%`,
+                                            'background-color': segment.color,
+                                            'border-right': idx() < segments().length - 1 ? '1px solid rgba(255,255,255,0.3)' : 'none',
+                                        }}
+                                    />
+                                );
+                            }}
+                        </For>
 
-                            {/* RAM Breakdown */}
-                            <div class="flex justify-between gap-3 py-0.5">
-                                <span class="text-green-400">Used</span>
-                                <span class="whitespace-nowrap text-gray-300">
-                                    {formatBytes(props.used, 0)}
-                                </span>
-                            </div>
+                        {/* Swap Indicator (Thin line at bottom if swap is used) */}
+                        <Show when={hasSwap() && (props.swapUsed || 0) > 0}>
+                            <div
+                                class="absolute bottom-0 left-0 h-[3px] w-full bg-purple-500"
+                                style={{ width: `${Math.min(swapPercent(), 100)}%` }}
+                            />
+                        </Show>
 
-                            <Show when={(props.balloon || 0) > 0 && (props.balloon || 0) < props.total}>
-                                <div class="flex justify-between gap-3 py-0.5 border-t border-gray-700/50">
-                                    <span class="text-yellow-400">Balloon Limit</span>
-                                    <span class="whitespace-nowrap text-gray-300">
-                                        {formatBytes(props.balloon || 0, 0)}
+                        {/* Label overlay */}
+                        <span class="absolute inset-0 flex items-center justify-center text-[10px] font-semibold text-gray-700 dark:text-gray-100 leading-none pointer-events-none">
+                            <span class="flex items-center gap-1 whitespace-nowrap px-0.5">
+                                <span>{displayLabel()}</span>
+                                <Show when={showSublabel()}>
+                                    <span class="metric-sublabel font-normal text-gray-500 dark:text-gray-300">
+                                        ({displaySublabel()})
                                     </span>
-                                </div>
-                            </Show>
+                                </Show>
+                            </span>
+                        </span>
+                    </div>
 
-                            <div class="flex justify-between gap-3 py-0.5 border-t border-gray-700/50">
-                                <span class="text-gray-400">Free</span>
-                                <span class="whitespace-nowrap text-gray-300">
-                                    {formatBytes(props.total - props.used, 0)}
-                                </span>
-                            </div>
+                    {/* Tooltip */}
+                    <Show when={showTooltip()}>
+                        <Portal mount={document.body}>
+                            <div
+                                class="fixed z-[9999] pointer-events-none"
+                                style={{
+                                    left: `${tooltipPos().x}px`,
+                                    top: `${tooltipPos().y - 8}px`,
+                                    transform: 'translate(-50%, -100%)',
+                                }}
+                            >
+                                <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[140px] border border-gray-700">
+                                    <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                                        Memory Composition
+                                    </div>
 
-                            {/* Swap Section */}
-                            <Show when={hasSwap()}>
-                                <div class="mt-1 pt-1 border-t border-gray-600">
+                                    {/* RAM Breakdown */}
                                     <div class="flex justify-between gap-3 py-0.5">
-                                        <span class="text-purple-400">Swap</span>
+                                        <span class="text-green-400">Used</span>
                                         <span class="whitespace-nowrap text-gray-300">
-                                            {formatBytes(props.swapUsed || 0, 0)} / {formatBytes(props.swapTotal || 0, 0)}
+                                            {formatBytes(props.used, 0)}
                                         </span>
                                     </div>
+
+                                    <Show when={(props.balloon || 0) > 0 && (props.balloon || 0) < props.total}>
+                                        <div class="flex justify-between gap-3 py-0.5 border-t border-gray-700/50">
+                                            <span class="text-yellow-400">Balloon Limit</span>
+                                            <span class="whitespace-nowrap text-gray-300">
+                                                {formatBytes(props.balloon || 0, 0)}
+                                            </span>
+                                        </div>
+                                    </Show>
+
+                                    <div class="flex justify-between gap-3 py-0.5 border-t border-gray-700/50">
+                                        <span class="text-gray-400">Free</span>
+                                        <span class="whitespace-nowrap text-gray-300">
+                                            {formatBytes(props.total - props.used, 0)}
+                                        </span>
+                                    </div>
+
+                                    {/* Swap Section */}
+                                    <Show when={hasSwap()}>
+                                        <div class="mt-1 pt-1 border-t border-gray-600">
+                                            <div class="flex justify-between gap-3 py-0.5">
+                                                <span class="text-purple-400">Swap</span>
+                                                <span class="whitespace-nowrap text-gray-300">
+                                                    {formatBytes(props.swapUsed || 0, 0)} / {formatBytes(props.swapTotal || 0, 0)}
+                                                </span>
+                                            </div>
+                                        </div>
+                                    </Show>
                                 </div>
-                            </Show>
-                        </div>
-                    </div>
-                </Portal>
-            </Show>
-        </div>
+                            </div>
+                        </Portal>
+                    </Show>
+                </div>
+            }
+        >
+            {/* Sparkline mode - full width, flex centered like stacked bars */}
+            <div class="metric-text w-full h-4 flex items-center justify-center min-w-0 overflow-hidden">
+                <Sparkline
+                    data={metricHistory()}
+                    metric="memory"
+                    width={0}
+                    height={16}
+                />
+            </div>
+        </Show>
     );
 }
diff --git a/frontend-modern/src/components/Dashboard/TagBadges.tsx b/frontend-modern/src/components/Dashboard/TagBadges.tsx
index ecb544b..bf6dc2f 100644
--- a/frontend-modern/src/components/Dashboard/TagBadges.tsx
+++ b/frontend-modern/src/components/Dashboard/TagBadges.tsx
@@ -12,7 +12,8 @@ interface TagBadgesProps {
 }
 
 export const TagBadges: Component<TagBadgesProps> = (props) => {
-  const maxVisible = () => props.maxVisible ?? 3;
+  // maxVisible: 0 means show all, undefined defaults to 3
+  const maxVisible = () => props.maxVisible === 0 ? Infinity : (props.maxVisible ?? 3);
   const darkModeSignal = useDarkMode();
   const isDark = () => props.isDarkMode ?? darkModeSignal();
 
diff --git a/frontend-modern/src/components/Docker/DockerFilter.tsx b/frontend-modern/src/components/Docker/DockerFilter.tsx
index ddc2155..88d5260 100644
--- a/frontend-modern/src/components/Docker/DockerFilter.tsx
+++ b/frontend-modern/src/components/Docker/DockerFilter.tsx
@@ -107,199 +107,199 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
 
   return (
     <Card class="docker-filter mb-3" padding="sm">
-      <div class="flex flex-col lg:flex-row gap-3">
-        <div class="flex gap-2 flex-1 items-center">
-          <div class="relative flex-1">
-            <input
-              ref={(el) => {
-                searchInputEl = el;
-                props.searchInputRef?.(el);
-              }}
-              type="text"
-              placeholder="Search containers or host:hostname"
-              value={props.search()}
-              onInput={(e) => props.setSearch(e.currentTarget.value)}
-              onKeyDown={(e) => {
-                if (e.key === 'Enter') {
-                  commitSearchToHistory(e.currentTarget.value);
-                  closeHistory();
-                } else if (e.key === 'Escape') {
-                  props.setSearch('');
-                  closeHistory();
-                  e.currentTarget.blur();
-                } else if (e.key === 'ArrowDown' && searchHistory().length > 0) {
-                  e.preventDefault();
-                  setIsHistoryOpen(true);
-                }
-              }}
-              onBlur={(e) => {
-                if (suppressBlurCommit) return;
-                const next = e.relatedTarget as HTMLElement | null;
-                const interactingWithHistory = next
-                  ? historyMenuRef?.contains(next) || historyToggleRef?.contains(next)
-                  : false;
-                const interactingWithTips =
-                  next?.getAttribute('aria-controls') === 'container-search-help';
-                if (!interactingWithHistory && !interactingWithTips) {
-                  commitSearchToHistory(e.currentTarget.value);
-                }
-              }}
-              class="w-full pl-9 pr-16 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
-              title="Search containers by name, image, ID, or host"
+      <div class="flex flex-col gap-3">
+        {/* Search - full width on its own row */}
+        <div class="relative">
+          <input
+            ref={(el) => {
+              searchInputEl = el;
+              props.searchInputRef?.(el);
+            }}
+            type="text"
+            placeholder="Search containers or host:hostname"
+            value={props.search()}
+            onInput={(e) => props.setSearch(e.currentTarget.value)}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') {
+                commitSearchToHistory(e.currentTarget.value);
+                closeHistory();
+              } else if (e.key === 'Escape') {
+                props.setSearch('');
+                closeHistory();
+                e.currentTarget.blur();
+              } else if (e.key === 'ArrowDown' && searchHistory().length > 0) {
+                e.preventDefault();
+                setIsHistoryOpen(true);
+              }
+            }}
+            onBlur={(e) => {
+              if (suppressBlurCommit) return;
+              const next = e.relatedTarget as HTMLElement | null;
+              const interactingWithHistory = next
+                ? historyMenuRef?.contains(next) || historyToggleRef?.contains(next)
+                : false;
+              const interactingWithTips =
+                next?.getAttribute('aria-controls') === 'container-search-help';
+              if (!interactingWithHistory && !interactingWithTips) {
+                commitSearchToHistory(e.currentTarget.value);
+              }
+            }}
+            class="w-full pl-9 pr-16 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+            title="Search containers by name, image, ID, or host"
+          />
+          <svg
+            class="absolute left-3 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
+            fill="none"
+            viewBox="0 0 24 24"
+            stroke="currentColor"
+          >
+            <path
+              stroke-linecap="round"
+              stroke-linejoin="round"
+              stroke-width="2"
+              d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"
             />
-            <svg
-              class="absolute left-3 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
-              fill="none"
-              viewBox="0 0 24 24"
-              stroke="currentColor"
+          </svg>
+          <Show when={props.search()}>
+            <button
+              type="button"
+              class="absolute right-9 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
+              onClick={() => props.setSearch('')}
+              onMouseDown={markSuppressCommit}
+              aria-label="Clear search"
+              title="Clear search"
             >
-              <path
-                stroke-linecap="round"
-                stroke-linejoin="round"
-                stroke-width="2"
-                d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"
-              />
-            </svg>
-            <Show when={props.search()}>
-              <button
-                type="button"
-                class="absolute right-9 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
-                onClick={() => props.setSearch('')}
-                onMouseDown={markSuppressCommit}
-                aria-label="Clear search"
-                title="Clear search"
-              >
-                <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M6 18L18 6M6 6l12 12"
-                  />
-                </svg>
-              </button>
-            </Show>
-            <div class="absolute inset-y-0 right-2 flex items-center gap-1">
-              <button
-                ref={(el) => (historyToggleRef = el)}
-                type="button"
-                class="flex h-6 w-6 items-center justify-center rounded-lg border border-transparent text-gray-400 transition-colors hover:border-gray-200 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:border-gray-700 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
-                onClick={() =>
-                  setIsHistoryOpen((prev) => {
-                    const next = !prev;
-                    if (!next) {
-                      queueMicrotask(() => historyToggleRef?.blur());
-                    }
-                    return next;
-                  })
-                }
-                onMouseDown={markSuppressCommit}
-                aria-haspopup="listbox"
-                aria-expanded={isHistoryOpen()}
-                title={
-                  searchHistory().length > 0
-                    ? 'Show recent searches'
-                    : 'No recent searches yet'
-                }
-              >
-                <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M12 8v4l2.5 1.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                  />
-                </svg>
-                <span class="sr-only">Show search history</span>
-              </button>
-              <SearchTipsPopover
-                popoverId="container-search-help"
-                intro="Filter containers quickly"
-                tips={[
-                  { code: 'name:api', description: 'Match containers with "api" in the name' },
-                  { code: 'image:postgres', description: 'Find containers running a specific image' },
-                  { code: 'host:prod', description: 'Show containers on a host' },
-                  { code: 'state:running', description: 'Running containers only' },
-                ]}
-                triggerVariant="icon"
-                buttonLabel="Search tips"
-                openOnHover
-              />
-            </div>
-            <Show when={isHistoryOpen()}>
-              <div
-                ref={(el) => (historyMenuRef = el)}
-                class="absolute left-0 right-0 top-full z-50 mt-2 w-full overflow-hidden rounded-lg border border-gray-200 bg-white text-sm shadow-xl dark:border-gray-700 dark:bg-gray-800"
-                role="listbox"
-              >
-                <Show
-                  when={searchHistory().length > 0}
-                  fallback={
-                    <div class="px-3 py-2 text-xs text-gray-500 dark:text-gray-400">
-                      Searches you run will appear here.
-                    </div>
+              <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M6 18L18 6M6 6l12 12"
+                />
+              </svg>
+            </button>
+          </Show>
+          <div class="absolute inset-y-0 right-2 flex items-center gap-1">
+            <button
+              ref={(el) => (historyToggleRef = el)}
+              type="button"
+              class="flex h-6 w-6 items-center justify-center rounded-lg border border-transparent text-gray-400 transition-colors hover:border-gray-200 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:border-gray-700 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
+              onClick={() =>
+                setIsHistoryOpen((prev) => {
+                  const next = !prev;
+                  if (!next) {
+                    queueMicrotask(() => historyToggleRef?.blur());
                   }
-                >
-                  <div class="max-h-52 overflow-y-auto py-1">
-                    <For each={searchHistory()}>
-                      {(entry) => (
-                        <div class="flex items-center justify-between px-2 py-1.5 hover:bg-blue-50 dark:hover:bg-blue-900/20">
-                          <button
-                            type="button"
-                            class="flex-1 truncate pr-2 text-left text-sm text-gray-700 transition-colors hover:text-blue-600 focus:outline-none dark:text-gray-200 dark:hover:text-blue-300"
-                            onClick={() => {
-                              props.setSearch(entry);
-                              commitSearchToHistory(entry);
-                              setIsHistoryOpen(false);
-                              focusSearchInput();
-                            }}
-                            onMouseDown={markSuppressCommit}
-                          >
-                            {entry}
-                          </button>
-                          <button
-                            type="button"
-                            class="ml-1 flex h-6 w-6 items-center justify-center rounded text-gray-400 transition-colors hover:bg-gray-100 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:bg-gray-700/70 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
-                            title="Remove from history"
-                            onClick={() => deleteHistoryEntry(entry)}
-                            onMouseDown={markSuppressCommit}
-                          >
-                            <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                              <path
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                                stroke-width="2"
-                                d="M6 18L18 6M6 6l12 12"
-                              />
-                            </svg>
-                            <span class="sr-only">Remove from history</span>
-                          </button>
-                        </div>
-                      )}
-                    </For>
-                  </div>
-                  <button
-                    type="button"
-                    class="flex w-full items-center justify-center gap-2 border-t border-gray-200 px-3 py-2 text-xs font-medium text-gray-500 transition-colors hover:bg-gray-100 hover:text-gray-700 focus:outline-none dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-700/80 dark:hover:text-gray-200"
-                    onClick={clearHistory}
-                    onMouseDown={markSuppressCommit}
-                  >
-                    <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                      <path
-                        stroke-linecap="round"
-                        stroke-linejoin="round"
-                        stroke-width="2"
-                        d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6M9 7V4a1 1 0 011-1h4a1 1 0 011 1v3m-9 0h12"
-                      />
-                    </svg>
-                    Clear history
-                  </button>
-                </Show>
-              </div>
-            </Show>
+                  return next;
+                })
+              }
+              onMouseDown={markSuppressCommit}
+              aria-haspopup="listbox"
+              aria-expanded={isHistoryOpen()}
+              title={
+                searchHistory().length > 0
+                  ? 'Show recent searches'
+                  : 'No recent searches yet'
+              }
+            >
+              <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M12 8v4l2.5 1.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                />
+              </svg>
+              <span class="sr-only">Show search history</span>
+            </button>
+            <SearchTipsPopover
+              popoverId="container-search-help"
+              intro="Filter containers quickly"
+              tips={[
+                { code: 'name:api', description: 'Match containers with "api" in the name' },
+                { code: 'image:postgres', description: 'Find containers running a specific image' },
+                { code: 'host:prod', description: 'Show containers on a host' },
+                { code: 'state:running', description: 'Running containers only' },
+              ]}
+              triggerVariant="icon"
+              buttonLabel="Search tips"
+              openOnHover
+            />
           </div>
+          <Show when={isHistoryOpen()}>
+            <div
+              ref={(el) => (historyMenuRef = el)}
+              class="absolute left-0 right-0 top-full z-50 mt-2 w-full overflow-hidden rounded-lg border border-gray-200 bg-white text-sm shadow-xl dark:border-gray-700 dark:bg-gray-800"
+              role="listbox"
+            >
+              <Show
+                when={searchHistory().length > 0}
+                fallback={
+                  <div class="px-3 py-2 text-xs text-gray-500 dark:text-gray-400">
+                    Searches you run will appear here.
+                  </div>
+                }
+              >
+                <div class="max-h-52 overflow-y-auto py-1">
+                  <For each={searchHistory()}>
+                    {(entry) => (
+                      <div class="flex items-center justify-between px-2 py-1.5 hover:bg-blue-50 dark:hover:bg-blue-900/20">
+                        <button
+                          type="button"
+                          class="flex-1 truncate pr-2 text-left text-sm text-gray-700 transition-colors hover:text-blue-600 focus:outline-none dark:text-gray-200 dark:hover:text-blue-300"
+                          onClick={() => {
+                            props.setSearch(entry);
+                            commitSearchToHistory(entry);
+                            setIsHistoryOpen(false);
+                            focusSearchInput();
+                          }}
+                          onMouseDown={markSuppressCommit}
+                        >
+                          {entry}
+                        </button>
+                        <button
+                          type="button"
+                          class="ml-1 flex h-6 w-6 items-center justify-center rounded text-gray-400 transition-colors hover:bg-gray-100 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:bg-gray-700/70 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
+                          title="Remove from history"
+                          onClick={() => deleteHistoryEntry(entry)}
+                          onMouseDown={markSuppressCommit}
+                        >
+                          <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                            <path
+                              stroke-linecap="round"
+                              stroke-linejoin="round"
+                              stroke-width="2"
+                              d="M6 18L18 6M6 6l12 12"
+                            />
+                          </svg>
+                          <span class="sr-only">Remove from history</span>
+                        </button>
+                      </div>
+                    )}
+                  </For>
+                </div>
+                <button
+                  type="button"
+                  class="flex w-full items-center justify-center gap-2 border-t border-gray-200 px-3 py-2 text-xs font-medium text-gray-500 transition-colors hover:bg-gray-100 hover:text-gray-700 focus:outline-none dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-700/80 dark:hover:text-gray-200"
+                  onClick={clearHistory}
+                  onMouseDown={markSuppressCommit}
+                >
+                  <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6M9 7V4a1 1 0 011-1h4a1 1 0 011 1v3m-9 0h12"
+                    />
+                  </svg>
+                  Clear history
+                </button>
+              </Show>
+            </div>
+          </Show>
         </div>
 
+        {/* Filters - second row */}
         <div class="flex flex-wrap items-center gap-2">
           <Show when={props.statusFilter && props.setStatusFilter}>
             <div class="inline-flex rounded-lg bg-gray-100 p-0.5 dark:bg-gray-700">
@@ -307,11 +307,10 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
                 type="button"
                 aria-pressed={props.statusFilter?.() === 'all'}
                 onClick={() => props.setStatusFilter?.('all')}
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.statusFilter?.() === 'all'
-                    ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter?.() === 'all'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
                 title="Show all hosts"
               >
                 All
@@ -322,11 +321,10 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
                 onClick={() =>
                   props.setStatusFilter?.(props.statusFilter?.() === 'online' ? 'all' : 'online')
                 }
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.statusFilter?.() === 'online'
-                    ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter?.() === 'online'
+                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
                 title="Show online hosts only"
               >
                 Online
@@ -339,11 +337,10 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
                     props.statusFilter?.() === 'degraded' ? 'all' : 'degraded',
                   )
                 }
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.statusFilter?.() === 'degraded'
-                    ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter?.() === 'degraded'
+                  ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
                 title="Show degraded hosts only"
               >
                 Degraded
@@ -356,11 +353,10 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
                     props.statusFilter?.() === 'offline' ? 'all' : 'offline',
                   )
                 }
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.statusFilter?.() === 'offline'
-                    ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter?.() === 'offline'
+                  ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
                 title="Show offline hosts only"
               >
                 Offline
@@ -373,22 +369,20 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
               <button
                 type="button"
                 onClick={() => props.setGroupingMode?.('grouped')}
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.groupingMode?.() === 'grouped'
-                    ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.groupingMode?.() === 'grouped'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
               >
                 Grouped
               </button>
               <button
                 type="button"
                 onClick={() => props.setGroupingMode?.('flat')}
-                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                  props.groupingMode?.() === 'flat'
-                    ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                    : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                }`}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.groupingMode?.() === 'flat'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
               >
                 List
               </button>
@@ -438,6 +432,6 @@ export const DockerFilter: Component<DockerFilterProps> = (props) => {
           </Show>
         </div>
       </div>
-    </Card>
+    </Card >
   );
 };
diff --git a/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx b/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
index dbc89ac..a1de9e7 100644
--- a/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
+++ b/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
@@ -9,6 +9,8 @@ import { DockerMetadataAPI } from '@/api/dockerMetadata';
 import { resolveHostRuntime } from './runtimeDisplay';
 import { showSuccess, showError } from '@/utils/toast';
 import { logger } from '@/utils/logger';
+import { aiChatStore } from '@/stores/aiChat';
+import { AIAPI } from '@/api/ai';
 import { buildMetricKey } from '@/utils/metricsKeys';
 import { StatusDot } from '@/components/shared/StatusDot';
 import {
@@ -126,7 +128,7 @@ interface DockerColumnDef extends ColumnConfig {
 export const DOCKER_COLUMNS: DockerColumnDef[] = [
   { id: 'resource', label: 'Resource', priority: 'essential', minWidth: 'auto', flex: 1, sortKey: 'resource' },
   { id: 'type', label: 'Type', priority: 'essential', minWidth: 'auto', maxWidth: 'auto', sortKey: 'type' },
-  { id: 'image', label: 'Image / Stack', priority: 'essential', minWidth: 'auto', maxWidth: 'auto', sortKey: 'image' },
+  { id: 'image', label: 'Image / Stack', priority: 'essential', minWidth: '80px', maxWidth: '200px', sortKey: 'image' },
   { id: 'status', label: 'Status', priority: 'essential', minWidth: 'auto', maxWidth: 'auto', sortKey: 'status' },
   // Metric columns - need fixed width to match progress bar max-width (140px + padding)
   // Note: Disk column removed - Docker API rarely provides this data
@@ -790,6 +792,87 @@ const DockerContainerRow: Component<{
   });
   let urlInputRef: HTMLInputElement | undefined;
 
+  // Annotations and AI state
+  const [aiEnabled, setAiEnabled] = createSignal(false);
+  // Check if this container is in AI context
+  const isInAIContext = createMemo(() => aiChatStore.enabled && aiChatStore.hasContextItem(resourceId()));
+  const [annotations, setAnnotations] = createSignal<string[]>([]);
+  const [newAnnotation, setNewAnnotation] = createSignal('');
+  const [saving, setSaving] = createSignal(false);
+
+  // Check if AI is enabled and load annotations on mount
+  createEffect(() => {
+    AIAPI.getSettings()
+      .then((settings) => setAiEnabled(settings.enabled && settings.configured))
+      .catch((err) => logger.debug('[DockerContainer] AI settings check failed:', err));
+
+    // Load existing annotations
+    DockerMetadataAPI.getMetadata(resourceId())
+      .then((meta) => {
+        if (meta.notes && Array.isArray(meta.notes)) setAnnotations(meta.notes);
+      })
+      .catch((err) => logger.debug('[DockerContainer] Failed to load annotations:', err));
+  });
+
+  const saveAnnotations = async (newAnnotations: string[]) => {
+    setSaving(true);
+    try {
+      await DockerMetadataAPI.updateMetadata(resourceId(), { notes: newAnnotations });
+      logger.debug('[DockerContainer] Annotations saved');
+    } catch (err) {
+      logger.error('[DockerContainer] Failed to save annotations:', err);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const addAnnotation = () => {
+    const text = newAnnotation().trim();
+    if (!text) return;
+    const updated = [...annotations(), text];
+    setAnnotations(updated);
+    setNewAnnotation('');
+    saveAnnotations(updated);
+  };
+
+  const removeAnnotation = (index: number) => {
+    const updated = annotations().filter((_, i) => i !== index);
+    setAnnotations(updated);
+    saveAnnotations(updated);
+  };
+
+  const handleKeyDown = (e: KeyboardEvent) => {
+    if (e.key === 'Enter' && !e.shiftKey) {
+      e.preventDefault();
+      addAnnotation();
+    }
+  };
+
+  const buildContainerContext = () => {
+    const ctx: Record<string, unknown> = {
+      name: container.name,
+      type: 'Docker Container',
+      host: host.hostname,
+      status: container.status || container.state,
+      image: container.image,
+    };
+    if (container.cpuPercent !== undefined) ctx.cpu_usage = formatPercent(container.cpuPercent);
+    if (container.memoryUsageBytes !== undefined) ctx.memory_used = formatBytes(container.memoryUsageBytes);
+    if (container.memoryLimitBytes !== undefined) ctx.memory_limit = formatBytes(container.memoryLimitBytes);
+    if (container.memoryPercent !== undefined) ctx.memory_usage = formatPercent(container.memoryPercent);
+    if (container.uptimeSeconds) ctx.uptime = formatUptime(container.uptimeSeconds);
+    if (container.ports?.length) ctx.ports = container.ports.map(p => p.publicPort ? `${p.publicPort}:${p.privatePort}/${p.protocol}` : `${p.privatePort}/${p.protocol}`);
+    if (annotations().length > 0) ctx.user_notes = annotations().join('; ');
+    return ctx;
+  };
+
+  const handleAskAI = () => {
+    aiChatStore.openForTarget('container', resourceId(), {
+      containerName: container.name,
+      ...buildContainerContext(),
+    });
+  };
+
   const writableLayerBytes = createMemo(() => container.writableLayerBytes ?? 0);
   const rootFilesystemBytes = createMemo(() => container.rootFilesystemBytes ?? 0);
   const hasDiskStats = createMemo(() => writableLayerBytes() > 0 || rootFilesystemBytes() > 0);
@@ -887,10 +970,28 @@ const DockerContainerRow: Component<{
   });
 
   const toggle = (event: MouseEvent) => {
-    if (!hasDrawerContent()) return;
     const target = event.target as HTMLElement;
     if (target.closest('a, button, input, [data-prevent-toggle]')) return;
-    // Toggle: if this row is currently expanded, close it; otherwise open it (closing any other)
+
+    // If AI is enabled, toggle AI context instead of expanding drawer
+    if (aiChatStore.enabled) {
+      if (aiChatStore.hasContextItem(resourceId())) {
+        aiChatStore.removeContextItem(resourceId());
+      } else {
+        aiChatStore.addContextItem('docker', resourceId(), container.name, {
+          containerName: container.name,
+          ...buildContainerContext(),
+        });
+        // Auto-open the sidebar when first item is selected
+        if (!aiChatStore.isOpen) {
+          aiChatStore.open();
+        }
+      }
+      return;
+    }
+
+    // Standard drawer toggle when AI is not enabled
+    if (!hasDrawerContent()) return;
     setCurrentlyExpandedRowId(prev => prev === rowId ? null : rowId);
   };
 
@@ -1094,13 +1195,10 @@ const DockerContainerRow: Component<{
                 <Show
                   when={isEditingUrl()}
                   fallback={
-                    <div class="flex items-center gap-1.5 flex-1 min-w-0">
+                    <div class="flex items-center gap-1.5 flex-1 min-w-0 group/name">
                       <span
-                        class="text-sm font-semibold text-gray-900 dark:text-gray-100 cursor-text select-none truncate"
-                        style="cursor: text;"
-                        title={`${containerTitle()}${customUrl() ? ' - Click to edit URL' : ' - Click to add URL'}`}
-                        onClick={startEditingUrl}
-                        data-resource-name-editable
+                        class="text-sm font-semibold text-gray-900 dark:text-gray-100 select-none truncate"
+                        title={containerTitle()}
                       >
                         {container.name || container.id}
                       </span>
@@ -1130,6 +1228,17 @@ const DockerContainerRow: Component<{
                           </svg>
                         </a>
                       </Show>
+                      {/* Edit URL button - shows on hover */}
+                      <button
+                        type="button"
+                        onClick={startEditingUrl}
+                        class="flex-shrink-0 opacity-0 group-hover/name:opacity-100 text-gray-400 hover:text-blue-500 dark:hover:text-blue-400 transition-all"
+                        title={customUrl() ? 'Edit URL' : 'Add URL'}
+                      >
+                        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" />
+                        </svg>
+                      </button>
                       <Show when={props.showHostContext}>
                         <span
                           class="inline-flex items-center gap-1 rounded bg-gray-100 px-1.5 py-0.5 text-[10px] font-medium text-gray-600 dark:bg-gray-800 dark:text-gray-300 flex-shrink-0 max-w-[120px]"
@@ -1139,6 +1248,14 @@ const DockerContainerRow: Component<{
                           <span class="truncate">{hostDisplayName()}</span>
                         </span>
                       </Show>
+                      {/* AI context indicator - shows when container is selected for AI */}
+                      <Show when={isInAIContext()}>
+                        <span class="flex-shrink-0 text-purple-500 dark:text-purple-400" title="Selected for AI context">
+                          <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.455-2.456L14.25 6l1.036-.259a3.375 3.375 0 002.455-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456z" />
+                          </svg>
+                        </span>
+                      </Show>
                     </div>
                   }
                 >
@@ -1172,7 +1289,10 @@ const DockerContainerRow: Component<{
         );
       case 'image':
         return (
-          <div class="px-2 py-0.5 text-xs text-gray-700 dark:text-gray-300 whitespace-nowrap">
+          <div
+            class="px-2 py-0.5 text-xs text-gray-700 dark:text-gray-300 truncate max-w-[200px]"
+            title={container.image || undefined}
+          >
             {container.image || '—'}
           </div>
         );
@@ -1222,6 +1342,7 @@ const DockerContainerRow: Component<{
                 balloon={0}
                 swapUsed={0}
                 swapTotal={0}
+                resourceId={metricsKey}
               />
             </div>
           </div>
@@ -1273,7 +1394,7 @@ const DockerContainerRow: Component<{
   return (
     <>
       <tr
-        class={`transition-all duration-200 ${hasDrawerContent() ? 'cursor-pointer' : ''} ${expanded() ? 'bg-gray-50 dark:bg-gray-800/40' : 'hover:bg-gray-50 dark:hover:bg-gray-800/50'} ${!isRunning() ? 'opacity-60' : ''}`}
+        class={`transition-all duration-200 ${aiChatStore.enabled || hasDrawerContent() ? 'cursor-pointer' : ''} ${expanded() ? 'bg-gray-50 dark:bg-gray-800/40' : 'hover:bg-gray-50 dark:hover:bg-gray-800/50'} ${!isRunning() ? 'opacity-60' : ''} ${isInAIContext() ? 'ai-context-row' : ''}`}
         onClick={toggle}
         aria-expanded={expanded()}
       >
@@ -1295,337 +1416,403 @@ const DockerContainerRow: Component<{
         <tr>
           <td colspan={DOCKER_COLUMNS.length} class="p-0">
             <div class="w-0 min-w-full bg-gray-50 dark:bg-gray-900/50 px-4 py-3 overflow-hidden">
-              <div class="flex flex-wrap justify-start gap-3">
-                <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+              <div class="flex flex-wrap gap-3 [&>*]:flex-1 [&>*]:basis-[calc(25%-0.75rem)] [&>*]:min-w-[200px] [&>*]:max-w-full">
+                <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
                   <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
                     Summary
                   </div>
-              <div class="mt-2 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                <div class="flex items-center justify-between gap-2">
-                  <span class="font-medium text-gray-700 dark:text-gray-200">Runtime</span>
-                  <span
-                    class={`inline-flex items-center gap-2 rounded-full px-2 py-0.5 text-[10px] font-semibold ${runtimeInfo.badgeClass}`}
-                    title={runtimeInfo.raw || runtimeInfo.label}
-                  >
-                    {runtimeInfo.label}
-                    <Show when={runtimeVersion()}>
-                      {(version) => (
-                        <span class="text-[10px] text-gray-500 dark:text-gray-400">{version()}</span>
+                  <div class="mt-2 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
+                    <div class="flex items-center justify-between gap-2">
+                      <span class="font-medium text-gray-700 dark:text-gray-200">Runtime</span>
+                      <span
+                        class={`inline-flex items-center gap-2 rounded-full px-2 py-0.5 text-[10px] font-semibold ${runtimeInfo.badgeClass}`}
+                        title={runtimeInfo.raw || runtimeInfo.label}
+                      >
+                        {runtimeInfo.label}
+                        <Show when={runtimeVersion()}>
+                          {(version) => (
+                            <span class="text-[10px] text-gray-500 dark:text-gray-400">{version()}</span>
+                          )}
+                        </Show>
+                      </span>
+                    </div>
+                    <div class="flex items-start justify-between gap-2">
+                      <span class="font-medium text-gray-700 dark:text-gray-200">Image</span>
+                      <span class="flex-1 truncate text-right text-gray-600 dark:text-gray-300" title={container.image}>
+                        {container.image || '—'}
+                      </span>
+                    </div>
+                    <Show when={podName()}>
+                      {(name) => (
+                        <div class="flex items-center justify-between gap-2">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Pod</span>
+                          <span class="text-right text-gray-600 dark:text-gray-300">
+                            {name()}
+                            <Show when={isPodInfra()}>
+                              <span class="ml-2 rounded bg-purple-100 px-1.5 py-0.5 text-[10px] font-semibold text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
+                                infra
+                              </span>
+                            </Show>
+                          </span>
+                        </div>
                       )}
                     </Show>
-                  </span>
-                </div>
-                <div class="flex items-start justify-between gap-2">
-                  <span class="font-medium text-gray-700 dark:text-gray-200">Image</span>
-                  <span class="flex-1 truncate text-right text-gray-600 dark:text-gray-300" title={container.image}>
-                    {container.image || '—'}
-                  </span>
-                </div>
-                <Show when={podName()}>
-                  {(name) => (
-                    <div class="flex items-center justify-between gap-2">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Pod</span>
-                      <span class="text-right text-gray-600 dark:text-gray-300">
-                        {name()}
-                        <Show when={isPodInfra()}>
-                          <span class="ml-2 rounded bg-purple-100 px-1.5 py-0.5 text-[10px] font-semibold text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
-                            infra
+                    <Show when={podmanMetadata()?.composeProject}>
+                      {(project) => (
+                        <div class="flex items-center justify-between gap-2">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Compose Project</span>
+                          <span class="text-right text-gray-600 dark:text-gray-300">{project()}</span>
+                        </div>
+                      )}
+                    </Show>
+                    <Show when={podmanMetadata()?.composeService}>
+                      {(service) => (
+                        <div class="flex items-center justify-between gap-2">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Compose Service</span>
+                          <span class="text-right text-gray-600 dark:text-gray-300">{service()}</span>
+                        </div>
+                      )}
+                    </Show>
+                    <Show when={podmanMetadata()?.autoUpdatePolicy}>
+                      {(policy) => (
+                        <div class="flex items-center justify-between gap-2">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Auto Update</span>
+                          <span class="text-right text-gray-600 dark:text-gray-300">
+                            {policy()}
+                            <Show when={podmanMetadata()?.autoUpdateRestart}>
+                              {(restart) => (
+                                <span class="ml-2 text-[10px] text-gray-500 dark:text-gray-400">restart: {restart()}</span>
+                              )}
+                            </Show>
                           </span>
-                        </Show>
-                      </span>
-                    </div>
-                  )}
-                </Show>
-                <Show when={podmanMetadata()?.composeProject}>
-                  {(project) => (
+                        </div>
+                      )}
+                    </Show>
+                    <Show when={podmanMetadata()?.userNamespace}>
+                      {(userns) => (
+                        <div class="flex items-center justify-between gap-2">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">User Namespace</span>
+                          <span class="text-right text-gray-600 dark:text-gray-300">{userns()}</span>
+                        </div>
+                      )}
+                    </Show>
                     <div class="flex items-center justify-between gap-2">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Compose Project</span>
-                      <span class="text-right text-gray-600 dark:text-gray-300">{project()}</span>
+                      <span class="font-medium text-gray-700 dark:text-gray-200">State</span>
+                      <span class="text-right text-gray-600 dark:text-gray-300">{statusLabel()}</span>
                     </div>
-                  )}
-                </Show>
-                <Show when={podmanMetadata()?.composeService}>
-                  {(service) => (
                     <div class="flex items-center justify-between gap-2">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Compose Service</span>
-                      <span class="text-right text-gray-600 dark:text-gray-300">{service()}</span>
+                      <span class="font-medium text-gray-700 dark:text-gray-200">Restarts</span>
+                      <span class="text-right text-gray-600 dark:text-gray-300">{restarts()}</span>
                     </div>
-                  )}
-                </Show>
-                <Show when={podmanMetadata()?.autoUpdatePolicy}>
-                  {(policy) => (
+                    <Show when={createdRelative()}>
+                      {(created) => (
+                        <div class="flex flex-col gap-0.5">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Created</span>
+                          <div class="text-right text-gray-600 dark:text-gray-300">
+                            {created()}
+                            <Show when={createdAbsolute()}>
+                              {(abs) => (
+                                <div class="text-[10px] text-gray-500 dark:text-gray-400">{abs()}</div>
+                              )}
+                            </Show>
+                          </div>
+                        </div>
+                      )}
+                    </Show>
+                    <Show when={startedRelative()}>
+                      {(started) => (
+                        <div class="flex flex-col gap-0.5">
+                          <span class="font-medium text-gray-700 dark:text-gray-200">Started</span>
+                          <div class="text-right text-gray-600 dark:text-gray-300">
+                            {started()}
+                            <Show when={startedAbsolute()}>
+                              {(abs) => (
+                                <div class="text-[10px] text-gray-500 dark:text-gray-400">{abs()}</div>
+                              )}
+                            </Show>
+                          </div>
+                        </div>
+                      )}
+                    </Show>
                     <div class="flex items-center justify-between gap-2">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Auto Update</span>
-                      <span class="text-right text-gray-600 dark:text-gray-300">
-                        {policy()}
-                        <Show when={podmanMetadata()?.autoUpdateRestart}>
-                          {(restart) => (
-                            <span class="ml-2 text-[10px] text-gray-500 dark:text-gray-400">restart: {restart()}</span>
-                          )}
-                        </Show>
-                      </span>
+                      <span class="font-medium text-gray-700 dark:text-gray-200">Uptime</span>
+                      <span class="text-right text-gray-600 dark:text-gray-300">{uptime()}</span>
                     </div>
-                  )}
-                </Show>
-                <Show when={podmanMetadata()?.userNamespace}>
-                  {(userns) => (
-                    <div class="flex items-center justify-between gap-2">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">User Namespace</span>
-                      <span class="text-right text-gray-600 dark:text-gray-300">{userns()}</span>
+                  </div>
+                  <Show when={runtimeInfo.id === 'podman'}>
+                    <div class="mt-3 rounded border border-dashed border-purple-200 px-2 py-1 text-[10px] text-purple-700 dark:border-purple-700/60 dark:text-purple-200">
+                      Podman hosts report container metrics, but Swarm services and tasks are unavailable. Runtime annotations and compose metadata appear below when present.
                     </div>
-                  )}
-                </Show>
-                <div class="flex items-center justify-between gap-2">
-                  <span class="font-medium text-gray-700 dark:text-gray-200">State</span>
-                  <span class="text-right text-gray-600 dark:text-gray-300">{statusLabel()}</span>
+                  </Show>
                 </div>
-                <div class="flex items-center justify-between gap-2">
-                  <span class="font-medium text-gray-700 dark:text-gray-200">Restarts</span>
-                  <span class="text-right text-gray-600 dark:text-gray-300">{restarts()}</span>
-                </div>
-                <Show when={createdRelative()}>
-                  {(created) => (
-                    <div class="flex flex-col gap-0.5">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Created</span>
-                      <div class="text-right text-gray-600 dark:text-gray-300">
-                        {created()}
-                        <Show when={createdAbsolute()}>
-                          {(abs) => (
-                            <div class="text-[10px] text-gray-500 dark:text-gray-400">{abs()}</div>
-                          )}
-                        </Show>
-                      </div>
+                <Show when={container.ports && container.ports.length > 0}>
+                  <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
+                      Ports
                     </div>
-                  )}
-                </Show>
-                <Show when={startedRelative()}>
-                  {(started) => (
-                    <div class="flex flex-col gap-0.5">
-                      <span class="font-medium text-gray-700 dark:text-gray-200">Started</span>
-                      <div class="text-right text-gray-600 dark:text-gray-300">
-                        {started()}
-                        <Show when={startedAbsolute()}>
-                          {(abs) => (
-                            <div class="text-[10px] text-gray-500 dark:text-gray-400">{abs()}</div>
-                          )}
-                        </Show>
-                      </div>
-                    </div>
-                  )}
-                </Show>
-                <div class="flex items-center justify-between gap-2">
-                  <span class="font-medium text-gray-700 dark:text-gray-200">Uptime</span>
-                  <span class="text-right text-gray-600 dark:text-gray-300">{uptime()}</span>
-                </div>
-              </div>
-              <Show when={runtimeInfo.id === 'podman'}>
-                <div class="mt-3 rounded border border-dashed border-purple-200 px-2 py-1 text-[10px] text-purple-700 dark:border-purple-700/60 dark:text-purple-200">
-                  Podman hosts report container metrics, but Swarm services and tasks are unavailable. Runtime annotations and compose metadata appear below when present.
-                </div>
-              </Show>
-            </div>
-            <Show when={container.ports && container.ports.length > 0}>
-              <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                  Ports
-                </div>
-                <div class="mt-1 flex flex-wrap gap-1 text-[11px] text-gray-600 dark:text-gray-300">
-                  {container.ports!.map((port) => {
-                    const label = port.publicPort
-                      ? `${port.publicPort}:${port.privatePort}/${port.protocol}`
-                      : `${port.privatePort}/${port.protocol}`;
-                    return (
-                      <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
-                        {label}
-                      </span>
-                    );
-                  })}
-                </div>
-              </div>
-            </Show>
-
-            <Show when={container.networks && container.networks.length > 0}>
-              <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                  Networks
-                </div>
-                <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                  {container.networks!.map((network) => (
-                    <div class="rounded border border-dashed border-gray-200 p-2 last:mb-0 dark:border-gray-700/70">
-                      <div class="font-medium text-gray-700 dark:text-gray-200">{network.name}</div>
-                      <div class="mt-0.5 flex flex-wrap gap-1 text-[10px] text-gray-500 dark:text-gray-400">
-                        <Show when={network.ipv4}>
+                    <div class="mt-1 flex flex-wrap gap-1 text-[11px] text-gray-600 dark:text-gray-300">
+                      {container.ports!.map((port) => {
+                        const label = port.publicPort
+                          ? `${port.publicPort}:${port.privatePort}/${port.protocol}`
+                          : `${port.privatePort}/${port.protocol}`;
+                        return (
                           <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
-                            {network.ipv4}
+                            {label}
                           </span>
-                        </Show>
-                        <Show when={network.ipv6}>
-                          <span class="rounded bg-purple-100 px-1.5 py-0.5 text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
-                            {network.ipv6}
-                          </span>
-                        </Show>
-                      </div>
-                    </div>
-                  ))}
-                </div>
-              </div>
-            </Show>
-
-            <Show when={hasPodmanMetadata()}>
-              <div class="min-w-[220px] flex-1 rounded border border-purple-200 bg-white/70 p-2 shadow-sm dark:border-purple-700/60 dark:bg-purple-950/20">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-purple-700 dark:text-purple-200">
-                  Podman Metadata
-                </div>
-                <div class="mt-1 space-y-2 text-[11px] text-gray-600 dark:text-gray-300">
-                  <For each={podmanMetadataSections()}>
-                    {(section) => (
-                      <div class="space-y-1 border-b border-purple-100 pb-1 last:border-b-0 last:pb-0 dark:border-purple-800/30">
-                        <div class="text-[10px] font-semibold uppercase tracking-wide text-purple-600 dark:text-purple-300">
-                          {section.title}
-                        </div>
-                        <div class="space-y-1">
-                          <For each={section.items}>
-                            {(item) => (
-                              <div class="flex items-start justify-between gap-2">
-                                <span class="font-medium text-gray-700 dark:text-gray-200">{item.label}</span>
-                                <span
-                                  class="max-w-[220px] break-all text-right text-gray-600 dark:text-gray-300"
-                                  title={item.value || '—'}
-                                >
-                                  {item.value || '—'}
-                                </span>
-                              </div>
-                            )}
-                          </For>
-                        </div>
-                      </div>
-                    )}
-                  </For>
-                </div>
-              </div>
-            </Show>
-
-            <Show when={hasBlockIo()}>
-              <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                  Block I/O
-                </div>
-                <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                  <div class="flex items-center justify-between">
-                    <span>Read</span>
-                    <div class="text-right">
-                      <div class="font-semibold text-gray-900 dark:text-gray-100">
-                        {formatBytes(blockIoReadBytes())}
-                      </div>
-                      <Show when={blockIoReadRateLabel()}>
-                        <div class="text-[10px] text-gray-500 dark:text-gray-400">
-                          {blockIoReadRateLabel()}
-                        </div>
-                      </Show>
+                        );
+                      })}
                     </div>
                   </div>
-                  <div class="flex items-center justify-between">
-                    <span>Write</span>
-                    <div class="text-right">
-                      <div class="font-semibold text-gray-900 dark:text-gray-100">
-                        {formatBytes(blockIoWriteBytes())}
-                      </div>
-                      <Show when={blockIoWriteRateLabel()}>
-                        <div class="text-[10px] text-gray-500 dark:text-gray-400">
-                          {blockIoWriteRateLabel()}
-                        </div>
-                      </Show>
-                    </div>
-                  </div>
-                </div>
-              </div>
-            </Show>
+                </Show>
 
-            <Show when={hasMounts()}>
-              <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                  Mounts
-                </div>
-                <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                  <For each={mounts()}>
-                    {(mount) => {
-                      const destination = mount.destination || mount.source || mount.name || 'mount';
-                      const rw = mount.rw === false ? 'read-only' : 'read-write';
-                      return (
+                <Show when={container.networks && container.networks.length > 0}>
+                  <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
+                      Networks
+                    </div>
+                    <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
+                      {container.networks!.map((network) => (
                         <div class="rounded border border-dashed border-gray-200 p-2 last:mb-0 dark:border-gray-700/70">
-                          <div class="flex items-center justify-between gap-2">
-                            <span class="truncate font-medium text-gray-700 dark:text-gray-200" title={destination}>
-                              {destination}
-                            </span>
-                            <Show when={mount.type}>
-                              <span class="text-[10px] uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                {mount.type}
+                          <div class="font-medium text-gray-700 dark:text-gray-200">{network.name}</div>
+                          <div class="mt-0.5 flex flex-wrap gap-1 text-[10px] text-gray-500 dark:text-gray-400">
+                            <Show when={network.ipv4}>
+                              <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
+                                {network.ipv4}
+                              </span>
+                            </Show>
+                            <Show when={network.ipv6}>
+                              <span class="rounded bg-purple-100 px-1.5 py-0.5 text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
+                                {network.ipv6}
                               </span>
                             </Show>
                           </div>
-                          <Show when={mount.source}>
-                            <div class="mt-1 truncate text-[11px] text-gray-600 dark:text-gray-300" title={mount.source}>
-                              {mount.source}
+                        </div>
+                      ))}
+                    </div>
+                  </div>
+                </Show>
+
+                <Show when={hasPodmanMetadata()}>
+                  <div class="rounded border border-purple-200 bg-white/70 p-3 shadow-sm dark:border-purple-700/60 dark:bg-purple-950/20">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-purple-700 dark:text-purple-200">
+                      Podman Metadata
+                    </div>
+                    <div class="mt-1 space-y-2 text-[11px] text-gray-600 dark:text-gray-300">
+                      <For each={podmanMetadataSections()}>
+                        {(section) => (
+                          <div class="space-y-1 border-b border-purple-100 pb-1 last:border-b-0 last:pb-0 dark:border-purple-800/30">
+                            <div class="text-[10px] font-semibold uppercase tracking-wide text-purple-600 dark:text-purple-300">
+                              {section.title}
+                            </div>
+                            <div class="space-y-1">
+                              <For each={section.items}>
+                                {(item) => (
+                                  <div class="flex items-start justify-between gap-2">
+                                    <span class="font-medium text-gray-700 dark:text-gray-200">{item.label}</span>
+                                    <span
+                                      class="max-w-[220px] break-all text-right text-gray-600 dark:text-gray-300"
+                                      title={item.value || '—'}
+                                    >
+                                      {item.value || '—'}
+                                    </span>
+                                  </div>
+                                )}
+                              </For>
+                            </div>
+                          </div>
+                        )}
+                      </For>
+                    </div>
+                  </div>
+                </Show>
+
+                <Show when={hasBlockIo()}>
+                  <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
+                      Block I/O
+                    </div>
+                    <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
+                      <div class="flex items-center justify-between">
+                        <span>Read</span>
+                        <div class="text-right">
+                          <div class="font-semibold text-gray-900 dark:text-gray-100">
+                            {formatBytes(blockIoReadBytes())}
+                          </div>
+                          <Show when={blockIoReadRateLabel()}>
+                            <div class="text-[10px] text-gray-500 dark:text-gray-400">
+                              {blockIoReadRateLabel()}
                             </div>
                           </Show>
-                          <div class="mt-1 flex flex-wrap gap-1 text-[10px] text-gray-500 dark:text-gray-400">
-                            <span
-                              class={`rounded px-1.5 py-0.5 ${mount.rw === false
-                                ? 'bg-gray-200 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200'
-                                : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
-                                }`}
-                            >
-                              {rw}
-                            </span>
-                            <Show when={mount.mode}>
-                              <span class="rounded bg-gray-200 px-1.5 py-0.5 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200">
-                                mode: {mount.mode}
-                              </span>
-                            </Show>
-                            <Show when={mount.driver}>
-                              <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
-                                {mount.driver}
-                              </span>
-                            </Show>
-                            <Show when={mount.name}>
-                              <span class="rounded bg-purple-100 px-1.5 py-0.5 text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
-                                {mount.name}
-                              </span>
-                            </Show>
-                            <Show when={mount.propagation}>
-                              <span class="rounded bg-gray-100 px-1.5 py-0.5 text-gray-600 dark:bg-gray-800/40 dark:text-gray-300">
-                                {mount.propagation}
-                              </span>
-                            </Show>
-                          </div>
                         </div>
-                      );
-                    }}
-                  </For>
-                </div>
-              </div>
-            </Show>
+                      </div>
+                      <div class="flex items-center justify-between">
+                        <span>Write</span>
+                        <div class="text-right">
+                          <div class="font-semibold text-gray-900 dark:text-gray-100">
+                            {formatBytes(blockIoWriteBytes())}
+                          </div>
+                          <Show when={blockIoWriteRateLabel()}>
+                            <div class="text-[10px] text-gray-500 dark:text-gray-400">
+                              {blockIoWriteRateLabel()}
+                            </div>
+                          </Show>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </Show>
 
-            <Show when={container.labels && Object.keys(container.labels).length > 0}>
-              <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                  Labels
-                </div>
-                <div class="mt-1 flex flex-wrap gap-1 text-[11px] text-gray-600 dark:text-gray-300">
-                  {Object.entries(container.labels!).map(([key, value]) => {
-                    const fullLabel = value ? `${key}: ${value}` : key;
-                    return (
-                      <span
-                        class="max-w-full truncate rounded bg-gray-200 px-1.5 py-0.5 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200"
-                        title={fullLabel}
+                <Show when={hasMounts()}>
+                  <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
+                      Mounts
+                    </div>
+                    <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
+                      <For each={mounts()}>
+                        {(mount) => {
+                          const destination = mount.destination || mount.source || mount.name || 'mount';
+                          const rw = mount.rw === false ? 'read-only' : 'read-write';
+                          return (
+                            <div class="rounded border border-dashed border-gray-200 p-2 last:mb-0 dark:border-gray-700/70">
+                              <div class="flex items-center justify-between gap-2">
+                                <span class="truncate font-medium text-gray-700 dark:text-gray-200" title={destination}>
+                                  {destination}
+                                </span>
+                                <Show when={mount.type}>
+                                  <span class="text-[10px] uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                    {mount.type}
+                                  </span>
+                                </Show>
+                              </div>
+                              <Show when={mount.source}>
+                                <div class="mt-1 truncate text-[11px] text-gray-600 dark:text-gray-300" title={mount.source}>
+                                  {mount.source}
+                                </div>
+                              </Show>
+                              <div class="mt-1 flex flex-wrap gap-1 text-[10px] text-gray-500 dark:text-gray-400">
+                                <span
+                                  class={`rounded px-1.5 py-0.5 ${mount.rw === false
+                                    ? 'bg-gray-200 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200'
+                                    : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
+                                    }`}
+                                >
+                                  {rw}
+                                </span>
+                                <Show when={mount.mode}>
+                                  <span class="rounded bg-gray-200 px-1.5 py-0.5 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200">
+                                    mode: {mount.mode}
+                                  </span>
+                                </Show>
+                                <Show when={mount.driver}>
+                                  <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
+                                    {mount.driver}
+                                  </span>
+                                </Show>
+                                <Show when={mount.name}>
+                                  <span class="rounded bg-purple-100 px-1.5 py-0.5 text-purple-700 dark:bg-purple-900/40 dark:text-purple-200">
+                                    {mount.name}
+                                  </span>
+                                </Show>
+                                <Show when={mount.propagation}>
+                                  <span class="rounded bg-gray-100 px-1.5 py-0.5 text-gray-600 dark:bg-gray-800/40 dark:text-gray-300">
+                                    {mount.propagation}
+                                  </span>
+                                </Show>
+                              </div>
+                            </div>
+                          );
+                        }}
+                      </For>
+                    </div>
+                  </div>
+                </Show>
+
+                <Show when={container.labels && Object.keys(container.labels).length > 0}>
+                  <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
+                      Labels
+                    </div>
+                    <div class="mt-1 flex flex-wrap gap-1 text-[11px] text-gray-600 dark:text-gray-300">
+                      {Object.entries(container.labels!).map(([key, value]) => {
+                        const fullLabel = value ? `${key}: ${value}` : key;
+                        return (
+                          <span
+                            class="max-w-full truncate rounded bg-gray-200 px-1.5 py-0.5 text-gray-700 dark:bg-gray-700/60 dark:text-gray-200"
+                            title={fullLabel}
+                          >
+                            {key}
+                            <Show when={value}>: {value}</Show>
+                          </span>
+                        );
+                      })}
+                    </div>
+                  </div>
+                </Show>
+
+                {/* Annotations & Ask AI row */}
+                <Show when={aiEnabled()}>
+                  <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700 w-full space-y-2">
+                    <div class="flex items-center gap-1.5">
+                      <span class="text-[10px] font-medium text-gray-500 dark:text-gray-400">AI Context</span>
+                      <Show when={saving()}>
+                        <span class="text-[9px] text-gray-400">saving...</span>
+                      </Show>
+                    </div>
+
+                    {/* Existing annotations */}
+                    <Show when={annotations().length > 0}>
+                      <div class="flex flex-wrap gap-1.5">
+                        <For each={annotations()}>
+                          {(annotation, index) => (
+                            <span class="inline-flex items-center gap-1 px-2 py-1 text-[11px] rounded-md bg-purple-100 text-purple-800 dark:bg-purple-900/40 dark:text-purple-200">
+                              <span class="max-w-[300px] truncate">{annotation}</span>
+                              <button
+                                type="button"
+                                onClick={() => removeAnnotation(index())}
+                                class="ml-0.5 p-0.5 rounded hover:bg-purple-200 dark:hover:bg-purple-800 transition-colors"
+                                title="Remove"
+                              >
+                                <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                                </svg>
+                              </button>
+                            </span>
+                          )}
+                        </For>
+                      </div>
+                    </Show>
+
+                    {/* Add new annotation */}
+                    <div class="flex items-center gap-2">
+                      <input
+                        type="text"
+                        value={newAnnotation()}
+                        onInput={(e) => setNewAnnotation(e.currentTarget.value)}
+                        onKeyDown={handleKeyDown}
+                        placeholder="Add context for AI (press Enter)..."
+                        class="flex-1 px-2 py-1.5 text-[11px] rounded border border-gray-200 dark:border-gray-600 bg-white dark:bg-gray-800 text-gray-700 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:outline-none focus:ring-1 focus:ring-purple-500 focus:border-purple-500"
+                      />
+                      <button
+                        type="button"
+                        onClick={addAnnotation}
+                        disabled={!newAnnotation().trim()}
+                        class="px-2 py-1.5 text-[11px] rounded border border-purple-300 dark:border-purple-600 text-purple-700 dark:text-purple-300 hover:bg-purple-50 dark:hover:bg-purple-900/30 disabled:opacity-40 disabled:cursor-not-allowed transition-colors"
                       >
-                        {key}
-                        <Show when={value}>: {value}</Show>
-                      </span>
-                    );
-                  })}
-                </div>
-              </div>
+                        Add
+                      </button>
+                      <button
+                        type="button"
+                        onClick={handleAskAI}
+                        class="flex items-center gap-1.5 px-3 py-1.5 rounded-lg bg-gradient-to-r from-purple-500 to-pink-500 text-white text-[11px] font-medium shadow-sm hover:from-purple-600 hover:to-pink-600 transition-all"
+                        title={`Ask AI about ${container.name}`}
+                      >
+                        <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.75 3.104v5.714a2.25 2.25 0 01-.659 1.591L5 14.5M9.75 3.104c-.251.023-.501.05-.75.082m.75-.082a24.301 24.301 0 014.5 0m0 0v5.714c0 .597.237 1.17.659 1.591L19.8 15.3M14.25 3.104c.251.023.501.05.75.082M19.8 15.3l-1.57.393A9.065 9.065 0 0112 15a9.065 9.065 0 00-6.23.693L5 14.5m14.8.8l1.402 1.402c1.232 1.232.65 3.318-1.067 3.611l-2.576.43a18.003 18.003 0 01-5.118 0l-2.576-.43c-1.717-.293-2.299-2.379-1.067-3.611L5 14.5" />
+                        </svg>
+                        Ask AI
+                      </button>
+                    </div>
+                  </div>
                 </Show>
               </div>
             </div>
@@ -1663,6 +1850,23 @@ const DockerServiceRow: Component<{
 
   const hasTasks = () => tasks.length > 0;
 
+  // Check if this service is in AI context
+  const isInAIContext = createMemo(() => aiChatStore.enabled && aiChatStore.hasContextItem(resourceId()));
+
+  // Build context for AI
+  const buildServiceContext = () => {
+    const ctx: Record<string, unknown> = {
+      name: service.name,
+      type: 'Docker Swarm Service',
+      host: host.hostname,
+      image: service.image,
+      mode: service.mode,
+      replicas: `${service.runningTasks ?? 0}/${service.desiredTasks ?? 0}`,
+    };
+    if (service.stack) ctx.stack = service.stack;
+    return ctx;
+  };
+
   // Update custom URL when prop changes, but only if we're not currently editing
   createEffect(() => {
     if (currentlyEditingDockerResourceId() !== resourceId()) {
@@ -1688,10 +1892,28 @@ const DockerServiceRow: Component<{
   });
 
   const toggle = (event: MouseEvent) => {
-    if (!hasTasks()) return;
     const target = event.target as HTMLElement;
     if (target.closest('a, button, input, [data-prevent-toggle]')) return;
-    // Toggle: if this row is currently expanded, close it; otherwise open it (closing any other)
+
+    // If AI is enabled, toggle AI context instead of expanding drawer
+    if (aiChatStore.enabled) {
+      if (aiChatStore.hasContextItem(resourceId())) {
+        aiChatStore.removeContextItem(resourceId());
+      } else {
+        aiChatStore.addContextItem('docker', resourceId(), service.name, {
+          serviceName: service.name,
+          ...buildServiceContext(),
+        });
+        // Auto-open the sidebar when first item is selected
+        if (!aiChatStore.isOpen) {
+          aiChatStore.open();
+        }
+      }
+      return;
+    }
+
+    // Standard drawer toggle when AI is not enabled
+    if (!hasTasks()) return;
     setCurrentlyExpandedRowId(prev => prev === rowId ? null : rowId);
   };
 
@@ -1864,13 +2086,10 @@ const DockerServiceRow: Component<{
                 <Show
                   when={isEditingUrl()}
                   fallback={
-                    <div class="flex items-center gap-1.5 flex-1 min-w-0">
+                    <div class="flex items-center gap-1.5 flex-1 min-w-0 group/name">
                       <span
-                        class="text-sm font-semibold text-gray-900 dark:text-gray-100 cursor-text select-none"
-                        style="cursor: text;"
-                        title={`${serviceTitle()}${customUrl() ? ' - Click to edit URL' : ' - Click to add URL'}`}
-                        onClick={startEditingUrl}
-                        data-resource-name-editable
+                        class="text-sm font-semibold text-gray-900 dark:text-gray-100 select-none"
+                        title={serviceTitle()}
                       >
                         {service.name || service.id || 'Service'}
                       </span>
@@ -1888,6 +2107,17 @@ const DockerServiceRow: Component<{
                           </svg>
                         </a>
                       </Show>
+                      {/* Edit URL button - shows on hover */}
+                      <button
+                        type="button"
+                        onClick={startEditingUrl}
+                        class="flex-shrink-0 opacity-0 group-hover/name:opacity-100 text-gray-400 hover:text-blue-500 dark:hover:text-blue-400 transition-all"
+                        title={customUrl() ? 'Edit URL' : 'Add URL'}
+                      >
+                        <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" />
+                        </svg>
+                      </button>
                       <Show when={service.stack && !isEditingUrl()}>
                         <span class="text-[10px] text-gray-500 dark:text-gray-400 truncate" title={`Stack: ${service.stack}`}>
                           Stack: {service.stack}
@@ -1902,6 +2132,14 @@ const DockerServiceRow: Component<{
                           <span class="max-w-[160px] truncate">{hostDisplayName()}</span>
                         </span>
                       </Show>
+                      {/* AI context indicator - shows when service is selected for AI */}
+                      <Show when={isInAIContext()}>
+                        <span class="flex-shrink-0 text-purple-500 dark:text-purple-400" title="Selected for AI context">
+                          <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.455-2.456L14.25 6l1.036-.259a3.375 3.375 0 002.455-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456z" />
+                          </svg>
+                        </span>
+                      </Show>
                     </div>
                   }
                 >
@@ -1935,7 +2173,10 @@ const DockerServiceRow: Component<{
         );
       case 'image':
         return (
-          <div class="px-2 py-0.5 text-xs text-gray-700 dark:text-gray-300 whitespace-nowrap">
+          <div
+            class="px-2 py-0.5 text-xs text-gray-700 dark:text-gray-300 truncate max-w-[200px]"
+            title={service.image || undefined}
+          >
             {service.image || '—'}
           </div>
         );
@@ -1980,7 +2221,7 @@ const DockerServiceRow: Component<{
   return (
     <>
       <tr
-        class={`transition-all duration-200 ${hasTasks() ? 'cursor-pointer' : ''} ${expanded() ? 'bg-gray-50 dark:bg-gray-800/40' : 'hover:bg-gray-50 dark:hover:bg-gray-800/50'} ${!isHealthy() ? 'opacity-60' : ''}`}
+        class={`transition-all duration-200 ${aiChatStore.enabled || hasTasks() ? 'cursor-pointer' : ''} ${expanded() ? 'bg-gray-50 dark:bg-gray-800/40' : 'hover:bg-gray-50 dark:hover:bg-gray-800/50'} ${!isHealthy() ? 'opacity-60' : ''} ${isInAIContext() ? 'ai-context-row' : ''}`}
         onClick={toggle}
         aria-expanded={expanded()}
       >
@@ -2002,8 +2243,8 @@ const DockerServiceRow: Component<{
         <tr>
           <td colspan={DOCKER_COLUMNS.length} class="p-0">
             <div class="w-0 min-w-full bg-gray-50 dark:bg-gray-900/60 px-4 py-3 overflow-hidden">
-              <div class="flex flex-wrap justify-start gap-3">
-                <div class="min-w-[320px] flex-1 rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
+              <div class="space-y-3">
+                <div class="rounded border border-gray-200 bg-white/70 p-3 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
                   <div class="flex items-center justify-between text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
                     <span>Tasks</span>
                     <span class="text-[10px] font-normal text-gray-500 dark:text-gray-400">
@@ -2012,111 +2253,111 @@ const DockerServiceRow: Component<{
                   </div>
                   <div class="mt-2 overflow-x-auto">
                     <table class="min-w-full divide-y divide-gray-100 dark:divide-gray-800/60 text-xs">
-                  <thead class="bg-gray-100 dark:bg-gray-900/40 text-[10px] uppercase tracking-wide text-gray-600 dark:text-gray-200">
-                    <tr>
-                      <th class="py-1 pr-2 text-left font-medium">Task</th>
-                      <th class="py-1 px-2 text-left font-medium w-[80px]">Type</th>
-                      <th class="py-1 px-2 text-left font-medium">Node</th>
-                      <th class="py-1 px-2 text-left font-medium">State</th>
-                      <th class="py-1 px-2 text-left font-medium w-[120px]">CPU</th>
-                      <th class="py-1 px-2 text-left font-medium w-[140px]">Memory</th>
-                      <th class="py-1 px-2 text-left font-medium">Updated</th>
-                    </tr>
-                  </thead>
-                  <tbody class="divide-y divide-gray-100 dark:divide-gray-800/50">
-                    <For each={tasks}>
-                      {(task) => {
-                        const container = findContainerForTask(host.containers || [], task);
-                        const cpu = container?.cpuPercent ?? 0;
-                        const mem = container?.memoryPercent ?? 0;
-                        const updated = ensureMs(task.updatedAt ?? task.createdAt ?? task.startedAt);
-                        const taskLabel = () => {
-                          if (task.containerName) return task.containerName;
-                          if (task.containerId) return task.containerId.slice(0, 12);
-                          if (task.slot !== undefined) return `slot-${task.slot}`;
-                          return task.id ?? 'Task';
-                        };
-                        const taskTitle = () => {
-                          const label = taskLabel();
-                          if (task.containerId && task.containerId !== label) {
-                            return `${label} \u2014 ${task.containerId}`;
-                          }
-                          if (task.id && task.id !== label) {
-                            return `${label} \u2014 ${task.id}`;
-                          }
-                          return label;
-                        };
-                        const state = toLower(task.currentState ?? task.desiredState ?? 'unknown');
-                        const taskMetricsKey = container?.id ? buildMetricKey('dockerContainer', container.id) : undefined;
-                        const stateClass = () => {
-                          if (state === 'running') {
-                            return 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300';
-                          }
-                          if (state === 'failed' || state === 'error') {
-                            return 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300';
-                          }
-                          return 'bg-gray-200 text-gray-600 dark:bg-gray-700 dark:text-gray-300';
-                        };
-                        return (
-                          <tr class="hover:bg-gray-100 dark:hover:bg-gray-800/40">
-                            <td class="py-1 pr-2">
-                              <div class="flex items-center gap-1 text-sm text-gray-900 dark:text-gray-100">
-                                <span class="truncate font-medium" title={taskTitle()}>
-                                  {taskLabel()}
-                                </span>
-                              </div>
-                            </td>
-                            <td class="py-1 px-2">
-                              <span
-                                class={`inline-flex items-center rounded px-2 py-0.5 text-[10px] font-medium whitespace-nowrap ${typeBadgeClass(
-                                  'task',
-                                )}`}
-                              >
-                                Task
-                              </span>
-                            </td>
-                            <td class="py-1 px-2 text-gray-600 dark:text-gray-400">
-                              {task.nodeName || task.nodeId || '—'}
-                            </td>
-                            <td class="py-1 px-2">
-                              <span class={`rounded px-2 py-0.5 text-[10px] font-medium whitespace-nowrap ${stateClass()}`}>
-                                {task.currentState || task.desiredState || 'Unknown'}
-                              </span>
-                            </td>
-                            <td class="py-1 px-2 w-[120px]">
-                              <Show when={cpu > 0} fallback={<span class="text-gray-400">—</span>}>
-                                <MetricBar
-                                  value={Math.min(100, cpu)}
-                                  label={formatPercent(cpu)}
-                                  type="cpu"
-                                  resourceId={taskMetricsKey}
-                                />
-                              </Show>
-                            </td>
-                            <td class="py-1 px-2 w-[140px]">
-                              <Show when={mem > 0} fallback={<span class="text-gray-400">—</span>}>
-                                <MetricBar
-                                  value={Math.min(100, mem)}
-                                  label={formatPercent(mem)}
-                                  type="memory"
-                                  resourceId={taskMetricsKey}
-                                />
-                              </Show>
-                            </td>
-                            <td class="py-1 px-2 text-gray-600 dark:text-gray-400 whitespace-nowrap">
-                              <Show when={updated} fallback="—">
-                                {(timestamp) => (
-                                  <span title={new Date(timestamp()).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' })}>
-                                    {formatRelativeTime(timestamp())}
+                      <thead class="bg-gray-100 dark:bg-gray-900/40 text-[10px] uppercase tracking-wide text-gray-600 dark:text-gray-200">
+                        <tr>
+                          <th class="py-1 pr-2 text-left font-medium">Task</th>
+                          <th class="py-1 px-2 text-left font-medium w-[80px]">Type</th>
+                          <th class="py-1 px-2 text-left font-medium">Node</th>
+                          <th class="py-1 px-2 text-left font-medium">State</th>
+                          <th class="py-1 px-2 text-left font-medium w-[120px]">CPU</th>
+                          <th class="py-1 px-2 text-left font-medium w-[140px]">Memory</th>
+                          <th class="py-1 px-2 text-left font-medium">Updated</th>
+                        </tr>
+                      </thead>
+                      <tbody class="divide-y divide-gray-100 dark:divide-gray-800/50">
+                        <For each={tasks}>
+                          {(task) => {
+                            const container = findContainerForTask(host.containers || [], task);
+                            const cpu = container?.cpuPercent ?? 0;
+                            const mem = container?.memoryPercent ?? 0;
+                            const updated = ensureMs(task.updatedAt ?? task.createdAt ?? task.startedAt);
+                            const taskLabel = () => {
+                              if (task.containerName) return task.containerName;
+                              if (task.containerId) return task.containerId.slice(0, 12);
+                              if (task.slot !== undefined) return `slot-${task.slot}`;
+                              return task.id ?? 'Task';
+                            };
+                            const taskTitle = () => {
+                              const label = taskLabel();
+                              if (task.containerId && task.containerId !== label) {
+                                return `${label} \u2014 ${task.containerId}`;
+                              }
+                              if (task.id && task.id !== label) {
+                                return `${label} \u2014 ${task.id}`;
+                              }
+                              return label;
+                            };
+                            const state = toLower(task.currentState ?? task.desiredState ?? 'unknown');
+                            const taskMetricsKey = container?.id ? buildMetricKey('dockerContainer', container.id) : undefined;
+                            const stateClass = () => {
+                              if (state === 'running') {
+                                return 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300';
+                              }
+                              if (state === 'failed' || state === 'error') {
+                                return 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300';
+                              }
+                              return 'bg-gray-200 text-gray-600 dark:bg-gray-700 dark:text-gray-300';
+                            };
+                            return (
+                              <tr class="hover:bg-gray-100 dark:hover:bg-gray-800/40">
+                                <td class="py-1 pr-2">
+                                  <div class="flex items-center gap-1 text-sm text-gray-900 dark:text-gray-100">
+                                    <span class="truncate font-medium" title={taskTitle()}>
+                                      {taskLabel()}
+                                    </span>
+                                  </div>
+                                </td>
+                                <td class="py-1 px-2">
+                                  <span
+                                    class={`inline-flex items-center rounded px-2 py-0.5 text-[10px] font-medium whitespace-nowrap ${typeBadgeClass(
+                                      'task',
+                                    )}`}
+                                  >
+                                    Task
                                   </span>
-                                )}
-                              </Show>
-                            </td>
-                          </tr>
-                        );
-                      }}
-                    </For>
-                  </tbody>
+                                </td>
+                                <td class="py-1 px-2 text-gray-600 dark:text-gray-400">
+                                  {task.nodeName || task.nodeId || '—'}
+                                </td>
+                                <td class="py-1 px-2">
+                                  <span class={`rounded px-2 py-0.5 text-[10px] font-medium whitespace-nowrap ${stateClass()}`}>
+                                    {task.currentState || task.desiredState || 'Unknown'}
+                                  </span>
+                                </td>
+                                <td class="py-1 px-2 w-[120px]">
+                                  <Show when={cpu > 0} fallback={<span class="text-gray-400">—</span>}>
+                                    <MetricBar
+                                      value={Math.min(100, cpu)}
+                                      label={formatPercent(cpu)}
+                                      type="cpu"
+                                      resourceId={taskMetricsKey}
+                                    />
+                                  </Show>
+                                </td>
+                                <td class="py-1 px-2 w-[140px]">
+                                  <Show when={mem > 0} fallback={<span class="text-gray-400">—</span>}>
+                                    <MetricBar
+                                      value={Math.min(100, mem)}
+                                      label={formatPercent(mem)}
+                                      type="memory"
+                                      resourceId={taskMetricsKey}
+                                    />
+                                  </Show>
+                                </td>
+                                <td class="py-1 px-2 text-gray-600 dark:text-gray-400 whitespace-nowrap">
+                                  <Show when={updated} fallback="—">
+                                    {(timestamp) => (
+                                      <span title={new Date(timestamp()).toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' })}>
+                                        {formatRelativeTime(timestamp())}
+                                      </span>
+                                    )}
+                                  </Show>
+                                </td>
+                              </tr>
+                            );
+                          }}
+                        </For>
+                      </tbody>
                     </table>
                   </div>
                 </div>
diff --git a/frontend-modern/src/components/Docker/StackedContainerBar.tsx b/frontend-modern/src/components/Docker/StackedContainerBar.tsx
index 59f4e16..fbedf3a 100644
--- a/frontend-modern/src/components/Docker/StackedContainerBar.tsx
+++ b/frontend-modern/src/components/Docker/StackedContainerBar.tsx
@@ -48,7 +48,7 @@ export function StackedContainerBar(props: StackedContainerBarProps) {
     return (
         <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
             <div
-                class="relative w-full max-w-[140px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded cursor-help"
+                class="relative w-full h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
                 onMouseEnter={handleMouseEnter}
                 onMouseLeave={handleMouseLeave}
             >
diff --git a/frontend-modern/src/components/Hosts/HostsFilter.tsx b/frontend-modern/src/components/Hosts/HostsFilter.tsx
index 244bccb..1e38608 100644
--- a/frontend-modern/src/components/Hosts/HostsFilter.tsx
+++ b/frontend-modern/src/components/Hosts/HostsFilter.tsx
@@ -1,6 +1,8 @@
 import { Component, Show, For, createSignal, createMemo, onMount, createEffect, onCleanup } from 'solid-js';
 import { Card } from '@/components/shared/Card';
 import { SearchTipsPopover } from '@/components/shared/SearchTipsPopover';
+import { ColumnPicker } from '@/components/shared/ColumnPicker';
+import type { ColumnDef } from '@/hooks/useColumnVisibility';
 import { STORAGE_KEYS } from '@/utils/localStorage';
 import { createSearchHistoryManager } from '@/utils/searchHistory';
 
@@ -13,6 +15,11 @@ interface HostsFilterProps {
   onReset?: () => void;
   activeHostName?: string;
   onClearHost?: () => void;
+  // Column visibility
+  availableColumns?: ColumnDef[];
+  isColumnHidden?: (id: string) => boolean;
+  onColumnToggle?: (id: string) => void;
+  onColumnReset?: () => void;
 }
 
 export const HostsFilter: Component<HostsFilterProps> = (props) => {
@@ -102,210 +109,209 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
 
   return (
     <Card class="hosts-filter mb-3" padding="sm">
-      <div class="flex flex-col lg:flex-row gap-3">
-        <div class="flex gap-2 flex-1 items-center">
-          <div class="relative flex-1">
-            <input
-              ref={(el) => {
-                searchInputEl = el;
-                props.searchInputRef?.(el);
-              }}
-              type="text"
-              placeholder="Search hosts by hostname, platform, or OS..."
-              value={props.search()}
-              onInput={(e) => props.setSearch(e.currentTarget.value)}
-              onKeyDown={(e) => {
-                if (e.key === 'Enter') {
-                  commitSearchToHistory(e.currentTarget.value);
-                  closeHistory();
-                } else if (e.key === 'Escape') {
-                  props.setSearch('');
-                  closeHistory();
-                  e.currentTarget.blur();
-                } else if (e.key === 'ArrowDown' && searchHistory().length > 0) {
-                  e.preventDefault();
-                  setIsHistoryOpen(true);
-                }
-              }}
-              onBlur={(e) => {
-                if (suppressBlurCommit) return;
-                const next = e.relatedTarget as HTMLElement | null;
-                const interactingWithHistory = next
-                  ? historyMenuRef?.contains(next) || historyToggleRef?.contains(next)
-                  : false;
-                const interactingWithTips =
-                  next?.getAttribute('aria-controls') === 'hosts-search-help';
-                if (!interactingWithHistory && !interactingWithTips) {
-                  commitSearchToHistory(e.currentTarget.value);
-                }
-              }}
-              class="w-full pl-9 pr-16 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
-              title="Search hosts by hostname, platform, or OS"
+      <div class="flex flex-col gap-3">
+        {/* Search - full width on its own row */}
+        <div class="relative">
+          <input
+            ref={(el) => {
+              searchInputEl = el;
+              props.searchInputRef?.(el);
+            }}
+            type="text"
+            placeholder="Search hosts by hostname, platform, or OS..."
+            value={props.search()}
+            onInput={(e) => props.setSearch(e.currentTarget.value)}
+            onKeyDown={(e) => {
+              if (e.key === 'Enter') {
+                commitSearchToHistory(e.currentTarget.value);
+                closeHistory();
+              } else if (e.key === 'Escape') {
+                props.setSearch('');
+                closeHistory();
+                e.currentTarget.blur();
+              } else if (e.key === 'ArrowDown' && searchHistory().length > 0) {
+                e.preventDefault();
+                setIsHistoryOpen(true);
+              }
+            }}
+            onBlur={(e) => {
+              if (suppressBlurCommit) return;
+              const next = e.relatedTarget as HTMLElement | null;
+              const interactingWithHistory = next
+                ? historyMenuRef?.contains(next) || historyToggleRef?.contains(next)
+                : false;
+              const interactingWithTips =
+                next?.getAttribute('aria-controls') === 'hosts-search-help';
+              if (!interactingWithHistory && !interactingWithTips) {
+                commitSearchToHistory(e.currentTarget.value);
+              }
+            }}
+            class="w-full pl-9 pr-16 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+            title="Search hosts by hostname, platform, or OS"
+          />
+          <svg
+            class="absolute left-3 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
+            fill="none"
+            viewBox="0 0 24 24"
+            stroke="currentColor"
+          >
+            <path
+              stroke-linecap="round"
+              stroke-linejoin="round"
+              stroke-width="2"
+              d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"
             />
-            <svg
-              class="absolute left-3 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
-              fill="none"
-              viewBox="0 0 24 24"
-              stroke="currentColor"
+          </svg>
+          <Show when={props.search()}>
+            <button
+              type="button"
+              class="absolute right-9 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
+              onClick={() => props.setSearch('')}
+              onMouseDown={markSuppressCommit}
+              aria-label="Clear search"
+              title="Clear search"
             >
-              <path
-                stroke-linecap="round"
-                stroke-linejoin="round"
-                stroke-width="2"
-                d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"
-              />
-            </svg>
-            <Show when={props.search()}>
-              <button
-                type="button"
-                class="absolute right-9 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
-                onClick={() => props.setSearch('')}
-                onMouseDown={markSuppressCommit}
-                aria-label="Clear search"
-                title="Clear search"
-              >
-                <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M6 18L18 6M6 6l12 12"
-                  />
-                </svg>
-              </button>
-            </Show>
-            <div class="absolute inset-y-0 right-2 flex items-center gap-1">
-              <button
-                ref={(el) => (historyToggleRef = el)}
-                type="button"
-                class="flex h-6 w-6 items-center justify-center rounded-lg border border-transparent text-gray-400 transition-colors hover:border-gray-200 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:border-gray-700 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
-                onClick={() =>
-                  setIsHistoryOpen((prev) => {
-                    const next = !prev;
-                    if (!next) {
-                      queueMicrotask(() => historyToggleRef?.blur());
-                    }
-                    return next;
-                  })
-                }
-                onMouseDown={markSuppressCommit}
-                aria-haspopup="listbox"
-                aria-expanded={isHistoryOpen()}
-                title={
-                  searchHistory().length > 0
-                    ? 'Show recent searches'
-                    : 'No recent searches yet'
-                }
-              >
-                <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path
-                    stroke-linecap="round"
-                    stroke-linejoin="round"
-                    stroke-width="2"
-                    d="M12 8v4l2.5 1.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                  />
-                </svg>
-                <span class="sr-only">Show search history</span>
-              </button>
-              <SearchTipsPopover
-                popoverId="hosts-search-help"
-                intro="Filter hosts quickly"
-                tips={[
-                  { code: 'hostname', description: 'Match hosts by hostname' },
-                  { code: 'linux', description: 'Find Linux hosts' },
-                  { code: 'darwin', description: 'Find macOS hosts' },
-                  { code: 'windows', description: 'Find Windows hosts' },
-                ]}
-                triggerVariant="icon"
-                buttonLabel="Search tips"
-                openOnHover
-              />
-            </div>
-            <Show when={isHistoryOpen()}>
-              <div
-                ref={(el) => (historyMenuRef = el)}
-                class="absolute left-0 right-0 top-full z-50 mt-2 w-full overflow-hidden rounded-lg border border-gray-200 bg-white text-sm shadow-xl dark:border-gray-700 dark:bg-gray-800"
-                role="listbox"
-              >
-                <Show
-                  when={searchHistory().length > 0}
-                  fallback={
-                    <div class="px-3 py-2 text-xs text-gray-500 dark:text-gray-400">
-                      Searches you run will appear here.
-                    </div>
+              <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M6 18L18 6M6 6l12 12"
+                />
+              </svg>
+            </button>
+          </Show>
+          <div class="absolute inset-y-0 right-2 flex items-center gap-1">
+            <button
+              ref={(el) => (historyToggleRef = el)}
+              type="button"
+              class="flex h-6 w-6 items-center justify-center rounded-lg border border-transparent text-gray-400 transition-colors hover:border-gray-200 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:border-gray-700 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
+              onClick={() =>
+                setIsHistoryOpen((prev) => {
+                  const next = !prev;
+                  if (!next) {
+                    queueMicrotask(() => historyToggleRef?.blur());
                   }
-                >
-                  <div class="max-h-52 overflow-y-auto py-1">
-                    <For each={searchHistory()}>
-                      {(entry) => (
-                        <div class="flex items-center justify-between px-2 py-1.5 hover:bg-blue-50 dark:hover:bg-blue-900/20">
-                          <button
-                            type="button"
-                            class="flex-1 truncate pr-2 text-left text-sm text-gray-700 transition-colors hover:text-blue-600 focus:outline-none dark:text-gray-200 dark:hover:text-blue-300"
-                            onClick={() => {
-                              props.setSearch(entry);
-                              commitSearchToHistory(entry);
-                              setIsHistoryOpen(false);
-                              focusSearchInput();
-                            }}
-                            onMouseDown={markSuppressCommit}
-                          >
-                            {entry}
-                          </button>
-                          <button
-                            type="button"
-                            class="ml-1 flex h-6 w-6 items-center justify-center rounded text-gray-400 transition-colors hover:bg-gray-100 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:bg-gray-700/70 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
-                            title="Remove from history"
-                            onClick={() => deleteHistoryEntry(entry)}
-                            onMouseDown={markSuppressCommit}
-                          >
-                            <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                              <path
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                                stroke-width="2"
-                                d="M6 18L18 6M6 6l12 12"
-                              />
-                            </svg>
-                            <span class="sr-only">Remove from history</span>
-                          </button>
-                        </div>
-                      )}
-                    </For>
-                  </div>
-                  <button
-                    type="button"
-                    class="flex w-full items-center justify-center gap-2 border-t border-gray-200 px-3 py-2 text-xs font-medium text-gray-500 transition-colors hover:bg-gray-100 hover:text-gray-700 focus:outline-none dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-700/80 dark:hover:text-gray-200"
-                    onClick={clearHistory}
-                    onMouseDown={markSuppressCommit}
-                  >
-                    <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                      <path
-                        stroke-linecap="round"
-                        stroke-linejoin="round"
-                        stroke-width="2"
-                        d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6M9 7V4a1 1 0 011-1h4a1 1 0 011 1v3m-9 0h12"
-                      />
-                    </svg>
-                    Clear history
-                  </button>
-                </Show>
-              </div>
-            </Show>
+                  return next;
+                })
+              }
+              onMouseDown={markSuppressCommit}
+              aria-haspopup="listbox"
+              aria-expanded={isHistoryOpen()}
+              title={
+                searchHistory().length > 0
+                  ? 'Show recent searches'
+                  : 'No recent searches yet'
+              }
+            >
+              <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M12 8v4l2.5 1.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                />
+              </svg>
+              <span class="sr-only">Show search history</span>
+            </button>
+            <SearchTipsPopover
+              popoverId="hosts-search-help"
+              intro="Filter hosts quickly"
+              tips={[
+                { code: 'hostname', description: 'Match hosts by hostname' },
+                { code: 'linux', description: 'Find Linux hosts' },
+                { code: 'darwin', description: 'Find macOS hosts' },
+                { code: 'windows', description: 'Find Windows hosts' },
+              ]}
+              triggerVariant="icon"
+              buttonLabel="Search tips"
+              openOnHover
+            />
           </div>
+          <Show when={isHistoryOpen()}>
+            <div
+              ref={(el) => (historyMenuRef = el)}
+              class="absolute left-0 right-0 top-full z-50 mt-2 w-full overflow-hidden rounded-lg border border-gray-200 bg-white text-sm shadow-xl dark:border-gray-700 dark:bg-gray-800"
+              role="listbox"
+            >
+              <Show
+                when={searchHistory().length > 0}
+                fallback={
+                  <div class="px-3 py-2 text-xs text-gray-500 dark:text-gray-400">
+                    Searches you run will appear here.
+                  </div>
+                }
+              >
+                <div class="max-h-52 overflow-y-auto py-1">
+                  <For each={searchHistory()}>
+                    {(entry) => (
+                      <div class="flex items-center justify-between px-2 py-1.5 hover:bg-blue-50 dark:hover:bg-blue-900/20">
+                        <button
+                          type="button"
+                          class="flex-1 truncate pr-2 text-left text-sm text-gray-700 transition-colors hover:text-blue-600 focus:outline-none dark:text-gray-200 dark:hover:text-blue-300"
+                          onClick={() => {
+                            props.setSearch(entry);
+                            commitSearchToHistory(entry);
+                            setIsHistoryOpen(false);
+                            focusSearchInput();
+                          }}
+                          onMouseDown={markSuppressCommit}
+                        >
+                          {entry}
+                        </button>
+                        <button
+                          type="button"
+                          class="ml-1 flex h-6 w-6 items-center justify-center rounded text-gray-400 transition-colors hover:bg-gray-100 hover:text-gray-600 focus:outline-none focus:ring-2 focus:ring-blue-500/40 focus:ring-offset-1 focus:ring-offset-white dark:text-gray-500 dark:hover:bg-gray-700/70 dark:hover:text-gray-200 dark:focus:ring-blue-400/40 dark:focus:ring-offset-gray-900"
+                          title="Remove from history"
+                          onClick={() => deleteHistoryEntry(entry)}
+                          onMouseDown={markSuppressCommit}
+                        >
+                          <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                            <path
+                              stroke-linecap="round"
+                              stroke-linejoin="round"
+                              stroke-width="2"
+                              d="M6 18L18 6M6 6l12 12"
+                            />
+                          </svg>
+                          <span class="sr-only">Remove from history</span>
+                        </button>
+                      </div>
+                    )}
+                  </For>
+                </div>
+                <button
+                  type="button"
+                  class="flex w-full items-center justify-center gap-2 border-t border-gray-200 px-3 py-2 text-xs font-medium text-gray-500 transition-colors hover:bg-gray-100 hover:text-gray-700 focus:outline-none dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-700/80 dark:hover:text-gray-200"
+                  onClick={clearHistory}
+                  onMouseDown={markSuppressCommit}
+                >
+                  <svg class="h-3.5 w-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6M9 7V4a1 1 0 011-1h4a1 1 0 011 1v3m-9 0h12"
+                    />
+                  </svg>
+                  Clear history
+                </button>
+              </Show>
+            </div>
+          </Show>
         </div>
 
+        {/* Filters - second row */}
         <div class="flex flex-wrap items-center gap-2">
           <div class="inline-flex rounded-lg bg-gray-100 p-0.5 dark:bg-gray-700">
             <button
               type="button"
               aria-pressed={props.statusFilter() === 'all'}
               onClick={() => props.setStatusFilter('all')}
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                props.statusFilter() === 'all'
-                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-              }`}
+              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter() === 'all'
+                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                }`}
               title="Show all hosts"
             >
               All
@@ -316,11 +322,10 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
               onClick={() =>
                 props.setStatusFilter(props.statusFilter() === 'online' ? 'all' : 'online')
               }
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                props.statusFilter() === 'online'
-                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-              }`}
+              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter() === 'online'
+                ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                }`}
               title="Show online hosts only"
             >
               Online
@@ -331,11 +336,10 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
               onClick={() =>
                 props.setStatusFilter(props.statusFilter() === 'degraded' ? 'all' : 'degraded')
               }
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                props.statusFilter() === 'degraded'
-                  ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-              }`}
+              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter() === 'degraded'
+                ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                }`}
               title="Show degraded hosts only"
             >
               Degraded
@@ -346,19 +350,16 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
               onClick={() =>
                 props.setStatusFilter(props.statusFilter() === 'offline' ? 'all' : 'offline')
               }
-              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-                props.statusFilter() === 'offline'
-                  ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm'
-                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-              }`}
+              class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${props.statusFilter() === 'offline'
+                ? 'bg-white dark:bg-gray-800 text-red-600 dark:text-red-400 shadow-sm'
+                : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                }`}
               title="Show offline hosts only"
             >
               Offline
             </button>
           </div>
-        </div>
 
-        <div class="flex flex-wrap items-center gap-2">
           <Show when={props.activeHostName}>
             <div class="flex items-center gap-1 rounded-full bg-blue-50 px-2 py-1 text-xs font-medium text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
               <span>Host: {props.activeHostName}</span>
@@ -373,6 +374,17 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
             </div>
           </Show>
 
+          {/* Column Picker */}
+          <Show when={props.availableColumns && props.isColumnHidden && props.onColumnToggle}>
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" aria-hidden="true"></div>
+            <ColumnPicker
+              columns={props.availableColumns!}
+              isHidden={props.isColumnHidden!}
+              onToggle={props.onColumnToggle!}
+              onReset={props.onColumnReset}
+            />
+          </Show>
+
           <Show when={hasActiveFilters()}>
             <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" aria-hidden="true"></div>
             <button
@@ -399,6 +411,6 @@ export const HostsFilter: Component<HostsFilterProps> = (props) => {
           </Show>
         </div>
       </div>
-    </Card>
+    </Card >
   );
 };
diff --git a/frontend-modern/src/components/Hosts/HostsOverview.tsx b/frontend-modern/src/components/Hosts/HostsOverview.tsx
index 501cf7d..74884dd 100644
--- a/frontend-modern/src/components/Hosts/HostsOverview.tsx
+++ b/frontend-modern/src/components/Hosts/HostsOverview.tsx
@@ -1,11 +1,11 @@
-import type { Component } from 'solid-js';
-import { For, Show, createMemo, createSignal, createEffect, on, onMount, onCleanup } from 'solid-js';
+import type { Component, JSX } from 'solid-js';
+import { For, Show, createMemo, createSignal, createEffect, onMount, onCleanup } from 'solid-js';
+import { Portal } from 'solid-js/web';
 import { useNavigate } from '@solidjs/router';
-import type { Host } from '@/types/api';
-import { formatBytes, formatPercent, formatRelativeTime, formatUptime } from '@/utils/format';
+import type { Host, HostRAIDArray } from '@/types/api';
+import { formatBytes, formatRelativeTime, formatUptime } from '@/utils/format';
 import { Card } from '@/components/shared/Card';
 import { EmptyState } from '@/components/shared/EmptyState';
-import { MetricBar } from '@/components/Dashboard/MetricBar';
 import { StackedDiskBar } from '@/components/Dashboard/StackedDiskBar';
 import { HostsFilter } from './HostsFilter';
 import { useWebSocket } from '@/App';
@@ -14,20 +14,461 @@ import { getHostStatusIndicator } from '@/utils/status';
 import { MetricText } from '@/components/shared/responsive';
 import { StackedMemoryBar } from '@/components/Dashboard/StackedMemoryBar';
 import { EnhancedCPUBar } from '@/components/Dashboard/EnhancedCPUBar';
-import { TemperatureGauge } from '@/components/shared/TemperatureGauge';
-import { useBreakpoint } from '@/hooks/useBreakpoint';
+import { useBreakpoint, type ColumnPriority } from '@/hooks/useBreakpoint';
+import { useColumnVisibility } from '@/hooks/useColumnVisibility';
+import { aiChatStore } from '@/stores/aiChat';
+import { STORAGE_KEYS } from '@/utils/localStorage';
+import { useResourcesAsLegacy } from '@/hooks/useResources';
+import { HostMetadataAPI, type HostMetadata } from '@/api/hostMetadata';
+import { logger } from '@/utils/logger';
 
-// Global drawer state to persist across re-renders
-const drawerState = new Map<string, boolean>();
-
-type SortKey = 'name' | 'platform' | 'cpu' | 'memory' | 'disk' | 'uptime';
-
-interface HostsOverviewProps {
-  hosts: Host[];
-  connectionHealth: Record<string, boolean>;
+// Column definition for hosts table
+export interface HostColumnDef {
+  id: string;
+  label: string;
+  icon?: JSX.Element;
+  priority: ColumnPriority;
+  toggleable?: boolean;
+  width?: string;
+  sortKey?: string;
 }
 
-export const HostsOverview: Component<HostsOverviewProps> = (props) => {
+// Host table column definitions
+export const HOST_COLUMNS: HostColumnDef[] = [
+  // Essential - always visible
+  { id: 'name', label: 'Host', priority: 'essential', width: '140px', sortKey: 'name' },
+  { id: 'platform', label: 'Platform', priority: 'essential', width: '90px', sortKey: 'platform' },
+  { id: 'cpu', label: 'CPU', priority: 'essential', width: '140px', sortKey: 'cpu' },
+  { id: 'memory', label: 'Memory', priority: 'essential', width: '140px', sortKey: 'memory' },
+  { id: 'disk', label: 'Disk', priority: 'essential', width: '140px', sortKey: 'disk' },
+
+  // Secondary - visible on md+, toggleable
+  { id: 'temp', label: 'Temp', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z"/></svg>, priority: 'secondary', width: '50px', toggleable: true },
+  { id: 'uptime', label: 'Uptime', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>, priority: 'secondary', width: '65px', toggleable: true, sortKey: 'uptime' },
+  { id: 'agent', label: 'Agent', priority: 'secondary', width: '60px', toggleable: true },
+
+  // Supplementary - visible on lg+, toggleable
+  // Note: CPU count and load average removed - they're shown in the EnhancedCPUBar tooltip
+  { id: 'ip', label: 'IP', icon: <svg class="w-3.5 h-3.5 block" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9"/></svg>, priority: 'supplementary', width: '50px', toggleable: true },
+
+  // Detailed - visible on xl+, toggleable
+  { id: 'arch', label: 'Arch', priority: 'detailed', width: '55px', toggleable: true },
+  { id: 'kernel', label: 'Kernel', priority: 'detailed', width: '120px', toggleable: true },
+  { id: 'raid', label: 'RAID', priority: 'detailed', width: '60px', toggleable: true },
+];
+
+// Network info cell with rich tooltip showing interfaces, IPs, and traffic (matches GuestRow pattern)
+interface NetworkInterface {
+  name: string;
+  addresses?: string[];
+  mac?: string;
+  rxBytes?: number;
+  txBytes?: number;
+}
+
+function HostNetworkInfoCell(props: { networkInterfaces: NetworkInterface[] }) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const hasInterfaces = () => props.networkInterfaces.length > 0;
+
+  const totalIps = () => {
+    return props.networkInterfaces.reduce((sum, iface) => sum + (iface.addresses?.length || 0), 0);
+  };
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  return (
+    <>
+      <span
+        class="inline-flex items-center gap-1 text-xs text-gray-600 dark:text-gray-400"
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        <Show when={hasInterfaces()} fallback={<span class="text-gray-400">—</span>}>
+          {/* Network globe icon */}
+          <svg class="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+            <path stroke-linecap="round" stroke-linejoin="round" d="M12 21a9.004 9.004 0 008.716-6.747M12 21a9.004 9.004 0 01-8.716-6.747M12 21c2.485 0 4.5-4.03 4.5-9S14.485 3 12 3m0 18c-2.485 0-4.5-4.03-4.5-9S9.515 3 12 3m0 0a8.997 8.997 0 017.843 4.582M12 3a8.997 8.997 0 00-7.843 4.582m15.686 0A11.953 11.953 0 0112 10.5c-2.998 0-5.74-1.1-7.843-2.918m15.686 0A8.959 8.959 0 0121 12c0 .778-.099 1.533-.284 2.253m0 0A17.919 17.919 0 0112 16.5c-3.162 0-6.133-.815-8.716-2.247m0 0A9.015 9.015 0 013 12c0-1.605.42-3.113 1.157-4.418" />
+          </svg>
+          <span class="text-[10px] font-medium">{totalIps()}</span>
+        </Show>
+      </span>
+
+      <Show when={showTooltip() && hasInterfaces()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[180px] max-w-[280px] border border-gray-700">
+              <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                Network Interfaces
+              </div>
+
+              <For each={props.networkInterfaces}>
+                {(iface, idx) => (
+                  <div class="py-1" classList={{ 'border-t border-gray-700/50': idx() > 0 }}>
+                    <div class="flex items-center gap-2 text-blue-400 font-medium">
+                      <span>{iface.name || 'eth' + idx()}</span>
+                      <Show when={iface.mac}>
+                        <span class="text-[9px] text-gray-500 font-normal">{iface.mac}</span>
+                      </Show>
+                    </div>
+                    <Show when={iface.addresses && iface.addresses.length > 0}>
+                      <div class="mt-0.5 flex flex-wrap gap-1">
+                        <For each={iface.addresses}>
+                          {(ip) => (
+                            <span class="text-gray-300 font-mono">{ip}</span>
+                          )}
+                        </For>
+                      </div>
+                    </Show>
+                    <Show when={!iface.addresses || iface.addresses.length === 0}>
+                      <span class="text-gray-500 text-[9px]">No IP assigned</span>
+                    </Show>
+                    <Show when={(iface.rxBytes || 0) > 0 || (iface.txBytes || 0) > 0}>
+                      <div class="mt-0.5 text-[9px] text-gray-500">
+                        RX: {formatBytes(iface.rxBytes || 0)} / TX: {formatBytes(iface.txBytes || 0)}
+                      </div>
+                    </Show>
+                  </div>
+                )}
+              </For>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
+// Temperature cell with rich tooltip showing all sensor readings
+function HostTemperatureCell(props: { sensors: Record<string, number> | null | undefined }) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  // Get the primary (highest) temperature for display
+  const primaryTemp = createMemo(() => {
+    if (!props.sensors) return null;
+    const temps = Object.values(props.sensors);
+    if (temps.length === 0) return null;
+    // Find package/composite temp first, otherwise show max
+    const keys = Object.keys(props.sensors);
+    const packageKey = keys.find(k =>
+      k.toLowerCase().includes('package') ||
+      k.toLowerCase().includes('composite') ||
+      k.toLowerCase().includes('tctl')
+    );
+    if (packageKey) return props.sensors[packageKey];
+    return Math.max(...temps);
+  });
+
+  const hasSensors = () => props.sensors && Object.keys(props.sensors).length > 0;
+
+  // Color based on temperature
+  const textColorClass = createMemo(() => {
+    const temp = primaryTemp();
+    if (temp === null) return 'text-gray-400';
+    if (temp >= 80) return 'text-red-600 dark:text-red-400';
+    if (temp >= 70) return 'text-yellow-600 dark:text-yellow-400';
+    return 'text-gray-600 dark:text-gray-400';
+  });
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  // Sort sensors: package/composite first, then cores, then others
+  const sortedSensors = createMemo(() => {
+    if (!props.sensors) return [];
+    return Object.entries(props.sensors).sort(([a], [b]) => {
+      const aLower = a.toLowerCase();
+      const bLower = b.toLowerCase();
+      // Package/composite/tctl first
+      const aIsPrimary = aLower.includes('package') || aLower.includes('composite') || aLower.includes('tctl');
+      const bIsPrimary = bLower.includes('package') || bLower.includes('composite') || bLower.includes('tctl');
+      if (aIsPrimary && !bIsPrimary) return -1;
+      if (bIsPrimary && !aIsPrimary) return 1;
+      // Then cores by number
+      const aCoreMatch = aLower.match(/core\s*(\d+)/);
+      const bCoreMatch = bLower.match(/core\s*(\d+)/);
+      if (aCoreMatch && bCoreMatch) {
+        return parseInt(aCoreMatch[1]) - parseInt(bCoreMatch[1]);
+      }
+      return a.localeCompare(b);
+    });
+  });
+
+  return (
+    <>
+      <span
+        class={`inline-flex items-center text-xs whitespace-nowrap ${textColorClass()}`}
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        <Show when={primaryTemp() !== null} fallback={<span class="text-gray-400">—</span>}>
+          {Math.round(primaryTemp()!)}°C
+        </Show>
+      </span>
+
+      <Show when={showTooltip() && hasSensors()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2 py-1.5 min-w-[160px] max-w-[240px] border border-gray-700">
+              <div class="font-medium mb-1 text-gray-300 border-b border-gray-700 pb-1">
+                Temperature Sensors
+              </div>
+
+              <div class="space-y-0.5">
+                <For each={sortedSensors()}>
+                  {([name, temp]) => {
+                    const colorClass = temp >= 80 ? 'text-red-400' : temp >= 70 ? 'text-yellow-400' : 'text-gray-200';
+                    return (
+                      <div class="flex justify-between gap-3 py-0.5">
+                        <span class="text-gray-400 truncate max-w-[120px]">{name}</span>
+                        <span class={`font-medium font-mono ${colorClass}`}>{Math.round(temp)}°C</span>
+                      </div>
+                    );
+                  }}
+                </For>
+              </div>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
+// RAID status cell with rich tooltip showing array details
+interface HostRAIDStatusCellProps {
+  raid: HostRAIDArray[] | undefined;
+}
+
+function HostRAIDStatusCell(props: HostRAIDStatusCellProps) {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const hasArrays = () => props.raid && props.raid.length > 0;
+
+  // Analyze overall status
+  const status = createMemo(() => {
+    if (!props.raid || props.raid.length === 0) {
+      return { type: 'none' as const, label: '-', color: 'text-gray-400' };
+    }
+
+    let hasDegraded = false;
+    let hasRebuilding = false;
+    let maxRebuildPercent = 0;
+
+    for (const array of props.raid) {
+      const state = array.state.toLowerCase();
+      if (state.includes('degraded') || array.failedDevices > 0) {
+        hasDegraded = true;
+      }
+      if (state.includes('recover') || state.includes('resync') || array.rebuildPercent > 0) {
+        hasRebuilding = true;
+        maxRebuildPercent = Math.max(maxRebuildPercent, array.rebuildPercent);
+      }
+    }
+
+    if (hasDegraded) {
+      return { type: 'degraded' as const, label: 'Degraded', color: 'text-red-600 dark:text-red-400' };
+    }
+    if (hasRebuilding) {
+      return {
+        type: 'rebuilding' as const,
+        label: `${Math.round(maxRebuildPercent)}%`,
+        color: 'text-amber-600 dark:text-amber-400'
+      };
+    }
+    return { type: 'ok' as const, label: 'OK', color: 'text-green-600 dark:text-green-400' };
+  });
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  const handleMouseLeave = () => {
+    setShowTooltip(false);
+  };
+
+  // Get state color for individual devices
+  const getDeviceStateColor = (state: string) => {
+    const s = state.toLowerCase();
+    if (s.includes('active') || s.includes('sync')) return 'text-green-400';
+    if (s.includes('spare')) return 'text-blue-400';
+    if (s.includes('faulty') || s.includes('removed')) return 'text-red-400';
+    if (s.includes('rebuilding')) return 'text-amber-400';
+    return 'text-gray-400';
+  };
+
+  // Get array state color
+  const getArrayStateColor = (array: HostRAIDArray) => {
+    const state = array.state.toLowerCase();
+    if (state.includes('degraded') || array.failedDevices > 0) return 'text-red-400';
+    if (state.includes('recover') || state.includes('resync') || array.rebuildPercent > 0) return 'text-amber-400';
+    if (state.includes('clean') || state.includes('active')) return 'text-green-400';
+    return 'text-gray-400';
+  };
+
+  return (
+    <>
+      <span
+        class={`inline-flex items-center gap-1 text-xs whitespace-nowrap ${status().color}`}
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={handleMouseLeave}
+      >
+        <Show when={hasArrays()} fallback={<span class="text-gray-400">—</span>}>
+          {/* Status icon */}
+          <Show when={status().type === 'ok'}>
+            <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+              <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+            </svg>
+          </Show>
+          <Show when={status().type === 'degraded'}>
+            <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+              <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
+            </svg>
+          </Show>
+          <Show when={status().type === 'rebuilding'}>
+            <svg class="w-3 h-3 animate-spin" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+              <path stroke-linecap="round" stroke-linejoin="round" d="M16.023 9.348h4.992v-.001M2.985 19.644v-4.992m0 0h4.992m-4.993 0l3.181 3.183a8.25 8.25 0 0013.803-3.7M4.031 9.865a8.25 8.25 0 0113.803-3.7l3.181 3.182m0-4.991v4.99" />
+            </svg>
+          </Show>
+          <span class="text-[10px] font-medium">
+            {props.raid!.length > 1 ? `${props.raid!.length} ` : ''}{status().label}
+          </span>
+        </Show>
+      </span>
+
+      <Show when={showTooltip() && hasArrays()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2.5 py-2 min-w-[200px] max-w-[320px] border border-gray-700">
+              <div class="font-medium mb-1.5 text-gray-300 border-b border-gray-700 pb-1 flex items-center gap-1.5">
+                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="1.5">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M5.25 14.25h13.5m-13.5 0a3 3 0 01-3-3m3 3a3 3 0 100 6h13.5a3 3 0 100-6m-16.5-3a3 3 0 013-3h13.5a3 3 0 013 3m-19.5 0a4.5 4.5 0 01.9-2.7L5.737 5.1a3.375 3.375 0 012.7-1.35h7.126c1.062 0 2.062.5 2.7 1.35l2.587 3.45a4.5 4.5 0 01.9 2.7m0 0a3 3 0 01-3 3m0 3h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008zm-3 6h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008z" />
+                </svg>
+                RAID Arrays ({props.raid!.length})
+              </div>
+
+              <div class="space-y-2">
+                <For each={props.raid}>
+                  {(array) => (
+                    <div class="border-b border-gray-700/50 pb-1.5 last:border-0 last:pb-0">
+                      {/* Array header */}
+                      <div class="flex items-center justify-between gap-2 mb-1">
+                        <div class="flex items-center gap-1.5">
+                          <span class="font-mono text-blue-400">{array.device}</span>
+                          <span class="text-gray-500 uppercase text-[9px]">{array.level}</span>
+                        </div>
+                        <span class={`font-medium capitalize ${getArrayStateColor(array)}`}>
+                          {array.state}
+                        </span>
+                      </div>
+
+                      {/* Array name if present */}
+                      <Show when={array.name}>
+                        <div class="text-[9px] text-gray-500 mb-1">{array.name}</div>
+                      </Show>
+
+                      {/* Device counts */}
+                      <div class="flex flex-wrap gap-x-2 gap-y-0.5 text-[9px] text-gray-400 mb-1">
+                        <span>Active: <span class="text-green-400">{array.activeDevices}</span></span>
+                        <span>Working: <span class="text-gray-200">{array.workingDevices}</span></span>
+                        <Show when={array.spareDevices > 0}>
+                          <span>Spare: <span class="text-blue-400">{array.spareDevices}</span></span>
+                        </Show>
+                        <Show when={array.failedDevices > 0}>
+                          <span>Failed: <span class="text-red-400">{array.failedDevices}</span></span>
+                        </Show>
+                      </div>
+
+                      {/* Rebuild progress */}
+                      <Show when={array.rebuildPercent > 0}>
+                        <div class="mb-1">
+                          <div class="flex items-center justify-between text-[9px] mb-0.5">
+                            <span class="text-amber-400">Rebuilding</span>
+                            <span class="text-gray-300">{array.rebuildPercent.toFixed(1)}%</span>
+                          </div>
+                          <div class="h-1 bg-gray-700 rounded-full overflow-hidden">
+                            <div
+                              class="h-full bg-amber-500 transition-all duration-300"
+                              style={{ width: `${array.rebuildPercent}%` }}
+                            />
+                          </div>
+                          <Show when={array.rebuildSpeed}>
+                            <div class="text-[9px] text-gray-500 mt-0.5">
+                              Speed: {array.rebuildSpeed}
+                            </div>
+                          </Show>
+                        </div>
+                      </Show>
+
+                      {/* Individual devices */}
+                      <Show when={array.devices && array.devices.length > 0}>
+                        <div class="flex flex-wrap gap-1 mt-1">
+                          <For each={array.devices}>
+                            {(dev) => (
+                              <span
+                                class={`font-mono text-[9px] px-1 py-0.5 rounded bg-gray-800 ${getDeviceStateColor(dev.state)}`}
+                                title={`${dev.device} - ${dev.state}`}
+                              >
+                                {dev.device.replace('/dev/', '')}
+                              </span>
+                            )}
+                          </For>
+                        </div>
+                      </Show>
+                    </div>
+                  )}
+                </For>
+              </div>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+}
+
+type SortKey = 'name' | 'platform' | 'cpu' | 'memory' | 'disk' | 'uptime';
+export const HostsOverview: Component = () => {
   const navigate = useNavigate();
   const wsContext = useWebSocket();
   const [search, setSearch] = createSignal('');
@@ -36,6 +477,77 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
   const [sortDirection, setSortDirection] = createSignal<'asc' | 'desc'>('asc');
   const { isMobile } = useBreakpoint();
 
+  // Use the hook directly to ensure reactivity is maintained
+  // This fixes the issue where props.hosts would not update when the underlying data changes
+  const { asHosts } = useResourcesAsLegacy();
+
+  // Column visibility management
+  const columnVisibility = useColumnVisibility(
+    STORAGE_KEYS.HOSTS_HIDDEN_COLUMNS,
+    HOST_COLUMNS as HostColumnDef[]
+  );
+  const visibleColumns = columnVisibility.visibleColumns;
+  const visibleColumnIds = createMemo(() => visibleColumns().map(c => c.id));
+  const isColVisible = (colId: string) => visibleColumnIds().includes(colId);
+
+  // Host metadata management (for custom URLs)
+  const [hostMetadata, setHostMetadata] = createSignal<Record<string, HostMetadata>>({});
+  const [hostMetadataVersion, setHostMetadataVersion] = createSignal(0);
+
+  // Load host metadata on mount
+  createEffect(() => {
+    HostMetadataAPI.getAllMetadata()
+      .then(data => {
+        setHostMetadata(data || {});
+        logger.debug('Loaded host metadata', { count: Object.keys(data || {}).length });
+      })
+      .catch(err => {
+        logger.warn('Failed to load host metadata', { error: err });
+      });
+  });
+
+  // Get custom URL for a host
+  const getHostCustomUrl = (hostId: string): string | undefined => {
+    // Access version to trigger reactivity when metadata changes
+    hostMetadataVersion();
+    return hostMetadata()[hostId]?.customUrl;
+  };
+
+  // Update custom URL for a host
+  const updateHostCustomUrl = async (hostId: string, url: string): Promise<boolean> => {
+    try {
+      await HostMetadataAPI.updateMetadata(hostId, { customUrl: url });
+      setHostMetadata(prev => ({
+        ...prev,
+        [hostId]: { ...prev[hostId], id: hostId, customUrl: url }
+      }));
+      setHostMetadataVersion(v => v + 1);
+      logger.info('Updated host custom URL', { hostId, url });
+      return true;
+    } catch (err) {
+      logger.error('Failed to update host custom URL', { hostId, url, error: err });
+      return false;
+    }
+  };
+
+  // Delete custom URL for a host
+  const deleteHostCustomUrl = async (hostId: string): Promise<boolean> => {
+    try {
+      await HostMetadataAPI.deleteMetadata(hostId);
+      setHostMetadata(prev => {
+        const next = { ...prev };
+        delete next[hostId];
+        return next;
+      });
+      setHostMetadataVersion(v => v + 1);
+      logger.info('Deleted host custom URL', { hostId });
+      return true;
+    } catch (err) {
+      logger.error('Failed to delete host custom URL', { hostId, error: err });
+      return false;
+    }
+  };
+
   const handleSort = (key: SortKey) => {
     if (sortKey() === key) {
       setSortDirection(sortDirection() === 'asc' ? 'desc' : 'asc');
@@ -54,18 +566,13 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
   let searchInputRef: HTMLInputElement | undefined;
 
   const handleKeyDown = (e: KeyboardEvent) => {
-    // Don't interfere if user is already typing in an input
     const target = e.target as HTMLElement;
     if (target.tagName === 'INPUT' || target.tagName === 'TEXTAREA' || target.isContentEditable) {
       return;
     }
-
-    // Don't interfere with modifier key shortcuts (except Shift for capitals)
     if (e.ctrlKey || e.metaKey || e.altKey) {
       return;
     }
-
-    // Focus search on printable characters and start typing
     if (e.key.length === 1 && searchInputRef) {
       e.preventDefault();
       searchInputRef.focus();
@@ -85,17 +592,19 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
   const reconnecting = () => wsContext.reconnecting();
   const reconnect = () => wsContext.reconnect();
 
+  // Access asHosts() directly inside the memo to maintain reactivity
+  const hosts = () => asHosts() as Host[];
+
   const isInitialLoading = createMemo(() => {
-    // Only show loading spinner when we've never been connected and have no hosts
-    return !connected() && !reconnecting() && props.hosts.length === 0;
+    return !connected() && !reconnecting() && hosts().length === 0;
   });
 
   const sortedHosts = createMemo(() => {
-    const hosts = [...props.hosts];
+    const hostList = [...hosts()];
     const key = sortKey();
     const direction = sortDirection();
 
-    return hosts.sort((a, b) => {
+    return hostList.sort((a: Host, b: Host) => {
       let comparison = 0;
       switch (key) {
         case 'name':
@@ -111,8 +620,8 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
           comparison = (a.memory?.usage ?? 0) - (b.memory?.usage ?? 0);
           break;
         case 'disk': {
-          const aDisk = a.disks?.reduce((sum, d) => sum + (d.usage ?? 0), 0) ?? 0;
-          const bDisk = b.disks?.reduce((sum, d) => sum + (d.usage ?? 0), 0) ?? 0;
+          const aDisk = a.disks?.reduce((sum: number, d: { usage?: number }) => sum + (d.usage ?? 0), 0) ?? 0;
+          const bDisk = b.disks?.reduce((sum: number, d: { usage?: number }) => sum + (d.usage ?? 0), 0) ?? 0;
           comparison = aDisk - bDisk;
           break;
         }
@@ -129,12 +638,10 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
   const matchesSearch = (host: Host) => {
     const term = search().toLowerCase();
     if (!term) return true;
-
     const hostname = (host.hostname || '').toLowerCase();
     const displayName = (host.displayName || '').toLowerCase();
     const platform = (host.platform || '').toLowerCase();
     const osName = (host.osName || '').toLowerCase();
-
     return (
       hostname.includes(term) ||
       displayName.includes(term) ||
@@ -154,33 +661,6 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
     return sortedHosts().filter((host) => matchesSearch(host) && matchesStatus(host));
   });
 
-  const getTemperatureValue = (host: Host) => {
-    if (!host.sensors?.temperatureCelsius) return null;
-    const temps = host.sensors.temperatureCelsius;
-
-    // Try to find a "package" or "composite" temperature first
-    const packageKey = Object.keys(temps).find(k =>
-      k.toLowerCase().includes('package') ||
-      k.toLowerCase().includes('composite') ||
-      k.toLowerCase().includes('tctl')
-    );
-
-    if (packageKey) return temps[packageKey];
-
-    // Fallback: average of all core temps
-    const coreKeys = Object.keys(temps).filter(k => k.toLowerCase().includes('core'));
-    if (coreKeys.length > 0) {
-      const sum = coreKeys.reduce((acc, k) => acc + temps[k], 0);
-      return sum / coreKeys.length;
-    }
-
-    // Fallback: just take the first available value if any
-    const values = Object.values(temps);
-    if (values.length > 0) return values[0];
-
-    return null;
-  };
-
   const getDiskStats = (host: Host) => {
     if (!host.disks || host.disks.length === 0) return { percent: 0, used: 0, total: 0 };
     const totalUsed = host.disks.reduce((sum, d) => sum + (d.used ?? 0), 0);
@@ -192,6 +672,8 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
     };
   };
 
+
+
   const thClass = "px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap";
 
   return (
@@ -272,7 +754,7 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
           when={sortedHosts().length === 0}
           fallback={
             <>
-              {/* Filters */}
+              {/* Filters with column visibility */}
               <HostsFilter
                 search={search}
                 setSearch={setSearch}
@@ -280,6 +762,10 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
                 setStatusFilter={setStatusFilter}
                 onReset={() => setSearch('')}
                 searchInputRef={(el) => (searchInputRef = el)}
+                availableColumns={columnVisibility.availableToggles()}
+                isColumnHidden={columnVisibility.isHiddenByUser}
+                onColumnToggle={columnVisibility.toggle}
+                onColumnReset={columnVisibility.resetToDefaults}
               />
 
               {/* Host Table */}
@@ -303,397 +789,71 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
                     <table class="w-full border-collapse whitespace-nowrap">
                       <thead>
                         <tr class="bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-300 border-b border-gray-200 dark:border-gray-700">
-                          <th
-                            class={`${thClass} text-left pl-4`}
-                            onClick={() => handleSort('name')}
-                          >
+                          {/* Essential columns */}
+                          <th class={`${thClass} text-left pl-4`} onClick={() => handleSort('name')}>
                             Host {renderSortIndicator('name')}
                           </th>
-                          <th class={thClass} onClick={() => handleSort('platform')}>
-                            Platform {renderSortIndicator('platform')}
-                          </th>
-                          <th class={thClass} onClick={() => handleSort('cpu')}>
-                            CPU {renderSortIndicator('cpu')}
-                          </th>
-                          <th class={thClass} onClick={() => handleSort('memory')}>
-                            Memory {renderSortIndicator('memory')}
-                          </th>
-                          <th class={thClass}>
-                            Temp
-                          </th>
-                          <th class={thClass} onClick={() => handleSort('disk')}>
-                            Disk {renderSortIndicator('disk')}
-                          </th>
-                          <th class={`${thClass} text-right pr-4`} onClick={() => handleSort('uptime')}>
-                            Uptime {renderSortIndicator('uptime')}
-                          </th>
+                          <Show when={isColVisible('platform')}>
+                            <th class={thClass} onClick={() => handleSort('platform')}>
+                              Platform {renderSortIndicator('platform')}
+                            </th>
+                          </Show>
+                          <Show when={isColVisible('cpu')}>
+                            <th class={thClass} onClick={() => handleSort('cpu')}>
+                              CPU {renderSortIndicator('cpu')}
+                            </th>
+                          </Show>
+                          <Show when={isColVisible('memory')}>
+                            <th class={thClass} onClick={() => handleSort('memory')}>
+                              Memory {renderSortIndicator('memory')}
+                            </th>
+                          </Show>
+                          <Show when={isColVisible('disk')}>
+                            <th class={thClass} onClick={() => handleSort('disk')}>
+                              Disk {renderSortIndicator('disk')}
+                            </th>
+                          </Show>
+
+                          {/* Secondary columns */}
+                          <Show when={isColVisible('temp')}>
+                            <th class={thClass} title="Temperature">
+                              <span class="inline-flex items-center justify-center">{HOST_COLUMNS.find(c => c.id === 'temp')?.icon}</span>
+                            </th>
+                          </Show>
+                          <Show when={isColVisible('uptime')}>
+                            <th class={thClass} onClick={() => handleSort('uptime')} title="Uptime">
+                              <span class="inline-flex items-center justify-center gap-1">
+                                <span>{HOST_COLUMNS.find(c => c.id === 'uptime')?.icon}</span>
+                                {renderSortIndicator('uptime')}
+                              </span>
+                            </th>
+                          </Show>
+                          <Show when={isColVisible('agent')}>
+                            <th class={thClass}>Agent</th>
+                          </Show>
+
+                          {/* Supplementary columns */}
+                          <Show when={isColVisible('ip')}>
+                            <th class={thClass} title="IP Address">
+                              <span class="inline-flex items-center justify-center">{HOST_COLUMNS.find(c => c.id === 'ip')?.icon}</span>
+                            </th>
+                          </Show>
+
+                          {/* Detailed columns */}
+                          <Show when={isColVisible('arch')}>
+                            <th class={thClass}>Arch</th>
+                          </Show>
+                          <Show when={isColVisible('kernel')}>
+                            <th class={thClass}>Kernel</th>
+                          </Show>
+                          <Show when={isColVisible('raid')}>
+                            <th class={thClass} title="Linux Software RAID (mdadm) Status">RAID</th>
+                          </Show>
                         </tr>
                       </thead>
                       <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
                         <For each={filteredHosts()}>
-                          {(host) => {
-                            // Drawer state
-                            const [drawerOpen, setDrawerOpen] = createSignal(drawerState.get(host.id) ?? false);
-
-                            // Check if we have additional info to show in drawer
-                            const hasDrawerContent = createMemo(() => {
-                              return (
-                                (host.disks && host.disks.length > 0) ||
-                                (host.networkInterfaces && host.networkInterfaces.length > 0) ||
-                                (host.raid && host.raid.length > 0) ||
-                                host.loadAverage ||
-                                host.cpuCount ||
-                                host.kernelVersion ||
-                                host.architecture ||
-                                host.agentVersion ||
-                                (host.sensors?.temperatureCelsius && Object.keys(host.sensors.temperatureCelsius).length > 0)
-                              );
-                            });
-
-                            const toggleDrawer = (event: MouseEvent) => {
-                              if (!hasDrawerContent()) return;
-                              const target = event.target as HTMLElement;
-                              if (target.closest('a, button, [data-prevent-toggle]')) {
-                                return;
-                              }
-                              setDrawerOpen((prev) => !prev);
-                            };
-
-                            // Sync drawer state
-                            createEffect(on(() => host.id, (id) => {
-                              const stored = drawerState.get(id);
-                              if (stored !== undefined) {
-                                setDrawerOpen(stored);
-                              } else {
-                                setDrawerOpen(false);
-                              }
-                            }));
-
-                            createEffect(() => {
-                              drawerState.set(host.id, drawerOpen());
-                            });
-
-                            const rowClass = () => {
-                              const base = 'transition-all duration-200';
-                              const hover = 'hover:bg-gray-50 dark:hover:bg-gray-800/50';
-                              const clickable = hasDrawerContent() ? 'cursor-pointer' : '';
-                              const expanded = drawerOpen() ? 'bg-gray-50 dark:bg-gray-800/40' : '';
-                              return `${base} ${hover} ${clickable} ${expanded}`;
-                            };
-
-                            const hostStatus = createMemo(() => getHostStatusIndicator(host));
-                            const cpuPercent = host.cpuUsage ?? 0;
-                            const memPercent = host.memory?.usage ?? 0;
-                            const tempValue = getTemperatureValue(host);
-                            const diskStats = getDiskStats(host);
-
-                            return (
-                              <>
-                                <tr
-                                  class={rowClass()}
-                                  onClick={toggleDrawer}
-                                  aria-expanded={drawerOpen()}
-                                >
-                                  {/* Host Name */}
-                                  <td class="pl-4 pr-2 py-1 align-middle">
-                                    <div class="flex items-center gap-2 min-w-0">
-                                      <StatusDot
-                                        variant={hostStatus().variant}
-                                        title={hostStatus().label}
-                                        ariaLabel={hostStatus().label}
-                                        size="xs"
-                                      />
-                                      <div class="min-w-0">
-                                        <p class="text-sm font-semibold text-gray-900 dark:text-gray-100 whitespace-nowrap">
-                                          {host.displayName || host.hostname || host.id}
-                                        </p>
-                                        <Show when={host.displayName && host.displayName !== host.hostname}>
-                                          <p class="text-xs text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
-                                            {host.hostname}
-                                          </p>
-                                        </Show>
-                                        <Show when={host.lastSeen}>
-                                          <p class="text-[10px] text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
-                                            Updated {formatRelativeTime(host.lastSeen!)}
-                                          </p>
-                                        </Show>
-                                      </div>
-                                    </div>
-                                  </td>
-
-                                  {/* Platform */}
-                                  <td class="px-2 py-1 align-middle">
-                                    <div class="text-xs text-gray-700 dark:text-gray-300">
-                                      <p class="font-medium capitalize whitespace-nowrap">{host.platform || '—'}</p>
-                                      <Show when={host.osName}>
-                                        <p class="text-[10px] text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
-                                          {host.osName} {host.osVersion}
-                                        </p>
-                                      </Show>
-                                    </div>
-                                  </td>
-
-                                  {/* CPU */}
-                                  <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
-                                    <Show when={isMobile()}>
-                                      <div class="md:hidden flex justify-center">
-                                        <MetricText value={cpuPercent} type="cpu" />
-                                      </div>
-                                    </Show>
-                                    <div class="hidden md:block">
-                                      <EnhancedCPUBar
-                                        usage={cpuPercent}
-                                        loadAverage={host.loadAverage?.[0]}
-                                        cores={host.cpuCount}
-                                      />
-                                    </div>
-                                  </td>
-
-                                  {/* Memory */}
-                                  <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
-                                    <Show when={isMobile()}>
-                                      <div class="md:hidden flex justify-center">
-                                        <MetricText value={memPercent} type="memory" />
-                                      </div>
-                                    </Show>
-                                    <div class="hidden md:block">
-                                      <StackedMemoryBar
-                                        used={host.memory?.used || 0}
-                                        total={host.memory?.total || 0}
-                                        balloon={host.memory?.balloon || 0}
-                                        swapUsed={host.memory?.swapUsed || 0}
-                                        swapTotal={host.memory?.swapTotal || 0}
-                                      />
-                                    </div>
-                                  </td>
-
-                                  {/* Temperature */}
-                                  <td class="px-2 py-1 align-middle">
-                                    <div class="flex justify-center">
-                                      <Show when={tempValue !== null} fallback={<span class="text-xs text-gray-400">—</span>}>
-                                        <TemperatureGauge value={tempValue!} />
-                                      </Show>
-                                    </div>
-                                  </td>
-
-                                  {/* Disk */}
-                                  <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
-                                    <Show when={isMobile()}>
-                                      <div class="md:hidden flex justify-center">
-                                        <MetricText value={diskStats.percent} type="disk" />
-                                      </div>
-                                    </Show>
-                                    <div class="hidden md:block">
-                                      <StackedDiskBar
-                                        disks={host.disks}
-                                        aggregateDisk={{
-                                          total: diskStats.total,
-                                          used: diskStats.used,
-                                          free: diskStats.total - diskStats.used,
-                                          usage: diskStats.percent / 100
-                                        }}
-                                      />
-                                    </div>
-                                  </td>
-
-                                  {/* Uptime */}
-                                  <td class="px-2 py-1 pr-4 align-middle">
-                                    <div class="flex justify-end">
-                                      <Show
-                                        when={host.uptimeSeconds}
-                                        fallback={<span class="text-xs text-gray-400">—</span>}
-                                      >
-                                        <span class="text-xs text-gray-700 dark:text-gray-300 whitespace-nowrap">
-                                          {formatUptime(host.uptimeSeconds!)}
-                                        </span>
-                                      </Show>
-                                    </div>
-                                  </td>
-                                </tr>
-
-                                {/* Drawer - Additional Info */}
-                                <Show when={drawerOpen() && hasDrawerContent()}>
-                                  <tr>
-                                    <td colspan={7} class="p-0">
-                                      <div class="bg-gray-50 dark:bg-gray-900/50 px-4 py-3 border-t border-gray-100 dark:border-gray-800/50">
-                                        <div class="flex flex-wrap justify-start gap-3">
-                                          {/* System Info */}
-                                          <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                                            <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">System</div>
-                                            <div class="mt-2 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                                              <Show when={host.cpuCount}>
-                                                <div class="flex items-center justify-between gap-2">
-                                                  <span class="font-medium text-gray-700 dark:text-gray-200">CPUs</span>
-                                                  <span class="text-right text-gray-600 dark:text-gray-300">{host.cpuCount}</span>
-                                                </div>
-                                              </Show>
-                                              <Show when={host.loadAverage && host.loadAverage.length > 0}>
-                                                <div class="flex items-center justify-between gap-2">
-                                                  <span class="font-medium text-gray-700 dark:text-gray-200">Load Avg</span>
-                                                  <span class="text-right text-gray-600 dark:text-gray-300">{host.loadAverage!.map(l => l.toFixed(2)).join(', ')}</span>
-                                                </div>
-                                              </Show>
-                                              <Show when={host.architecture}>
-                                                <div class="flex items-center justify-between gap-2">
-                                                  <span class="font-medium text-gray-700 dark:text-gray-200">Arch</span>
-                                                  <span class="text-right text-gray-600 dark:text-gray-300">{host.architecture}</span>
-                                                </div>
-                                              </Show>
-                                              <Show when={host.kernelVersion}>
-                                                <div class="flex items-center justify-between gap-2">
-                                                  <span class="font-medium text-gray-700 dark:text-gray-200">Kernel</span>
-                                                  <span class="text-right text-gray-600 dark:text-gray-300 truncate">{host.kernelVersion}</span>
-                                                </div>
-                                              </Show>
-                                              <Show when={host.agentVersion}>
-                                                <div class="flex items-center justify-between gap-2">
-                                                  <span class="font-medium text-gray-700 dark:text-gray-200">Agent</span>
-                                                  <span class="text-right text-gray-600 dark:text-gray-300">{host.agentVersion}</span>
-                                                </div>
-                                              </Show>
-                                            </div>
-                                          </div>
-
-                                          {/* Network Interfaces */}
-                                          <Show when={host.networkInterfaces && host.networkInterfaces.length > 0}>
-                                            <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                                              <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">Network</div>
-                                              <div class="mt-2 space-y-2 text-[11px]">
-                                                <For each={host.networkInterfaces?.slice(0, 4)}>
-                                                  {(iface) => (
-                                                    <div class="rounded border border-dashed border-gray-200 p-2 dark:border-gray-700/70">
-                                                      <div class="font-medium text-gray-700 dark:text-gray-200">{iface.name}</div>
-                                                      <Show when={iface.addresses && iface.addresses.length > 0}>
-                                                        <div class="flex flex-wrap gap-1 mt-1 text-[10px]">
-                                                          <For each={iface.addresses}>
-                                                            {(addr) => (
-                                                              <span class="rounded bg-blue-100 px-1.5 py-0.5 text-blue-700 dark:bg-blue-900/40 dark:text-blue-200">
-                                                                {addr}
-                                                              </span>
-                                                            )}
-                                                          </For>
-                                                        </div>
-                                                      </Show>
-                                                    </div>
-                                                  )}
-                                                </For>
-                                              </div>
-                                            </div>
-                                          </Show>
-
-                                          {/* Disk Info */}
-                                          <Show when={host.disks && host.disks.length > 0}>
-                                            <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                                              <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">Disks</div>
-                                              <div class="mt-2 space-y-2 text-[11px]">
-                                                <For each={host.disks?.slice(0, 3)}>
-                                                  {(disk) => {
-                                                    const diskPercent = () => disk.usage ?? 0;
-                                                    return (
-                                                      <div class="rounded border border-dashed border-gray-200 p-2 dark:border-gray-700/70">
-                                                        <div class="flex items-center justify-between">
-                                                          <span class="font-medium text-gray-700 dark:text-gray-200 truncate">{disk.mountpoint || disk.device}</span>
-                                                          <span class="text-[10px] text-gray-500 dark:text-gray-400">
-                                                            {formatBytes(disk.used ?? 0, 0)} / {formatBytes(disk.total ?? 0, 0)}
-                                                          </span>
-                                                        </div>
-                                                        <Show when={diskPercent() > 0}>
-                                                          <div class="mt-1">
-                                                            <MetricBar
-                                                              value={diskPercent()}
-                                                              label={formatPercent(diskPercent())}
-                                                              type="disk"
-                                                              class="max-w-none"
-                                                            />
-                                                          </div>
-                                                        </Show>
-                                                      </div>
-                                                    );
-                                                  }}
-                                                </For>
-                                              </div>
-                                            </div>
-                                          </Show>
-
-                                          {/* Temperature Sensors */}
-                                          <Show when={host.sensors?.temperatureCelsius && Object.keys(host.sensors.temperatureCelsius).length > 0}>
-                                            <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                                              <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">Temperatures</div>
-                                              <div class="mt-2 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
-                                                <For each={Object.entries(host.sensors!.temperatureCelsius!).slice(0, 5)}>
-                                                  {([name, temp]) => (
-                                                    <div class="flex items-center justify-between gap-2">
-                                                      <span class="font-medium text-gray-700 dark:text-gray-200 truncate">{name}</span>
-                                                      <span class={`text-right ${temp > 80 ? 'text-red-600 dark:text-red-400 font-semibold' : 'text-gray-600 dark:text-gray-300'}`}>
-                                                        {temp.toFixed(1)}°C
-                                                      </span>
-                                                    </div>
-                                                  )}
-                                                </For>
-                                              </div>
-                                            </div>
-                                          </Show>
-
-                                          {/* RAID Arrays */}
-                                          <Show when={host.raid && host.raid.length > 0}>
-                                            <For each={host.raid!}>
-                                              {(array) => {
-                                                const isDegraded = () => array.state.toLowerCase().includes('degraded') || array.failedDevices > 0;
-                                                const isRebuilding = () => array.state.toLowerCase().includes('recover') || array.state.toLowerCase().includes('resync') || array.rebuildPercent > 0;
-                                                const isHealthy = () => !isDegraded() && !isRebuilding() && array.state.toLowerCase().includes('clean');
-
-                                                const stateColor = () => {
-                                                  if (isDegraded()) return 'text-red-600 dark:text-red-400 font-semibold';
-                                                  if (isRebuilding()) return 'text-amber-600 dark:text-amber-400 font-semibold';
-                                                  if (isHealthy()) return 'text-green-600 dark:text-green-400';
-                                                  return 'text-gray-600 dark:text-gray-300';
-                                                };
-
-                                                return (
-                                                  <div class="min-w-[220px] flex-1 rounded border border-gray-200 bg-white/70 p-2 shadow-sm dark:border-gray-600/70 dark:bg-gray-900/30">
-                                                    <div class="text-[11px] font-medium uppercase tracking-wide text-gray-700 dark:text-gray-200">
-                                                      RAID {array.level.replace('raid', '')} - {array.device}
-                                                    </div>
-                                                    <div class="mt-2 space-y-1 text-[11px]">
-                                                      <div class="flex items-center justify-between gap-2">
-                                                        <span class="font-medium text-gray-700 dark:text-gray-200">State</span>
-                                                        <span class={stateColor()}>{array.state}</span>
-                                                      </div>
-                                                      <div class="flex items-center justify-between gap-2">
-                                                        <span class="font-medium text-gray-700 dark:text-gray-200">Devices</span>
-                                                        <span class="text-gray-600 dark:text-gray-300">
-                                                          {array.activeDevices}/{array.totalDevices}
-                                                          {array.failedDevices > 0 && <span class="text-red-600 dark:text-red-400"> ({array.failedDevices} failed)</span>}
-                                                        </span>
-                                                      </div>
-                                                      <Show when={isRebuilding() && array.rebuildPercent > 0}>
-                                                        <div class="flex items-center justify-between gap-2">
-                                                          <span class="font-medium text-gray-700 dark:text-gray-200">Rebuild</span>
-                                                          <span class="text-amber-600 dark:text-amber-400 font-medium">
-                                                            {array.rebuildPercent.toFixed(1)}%
-                                                          </span>
-                                                        </div>
-                                                        <Show when={array.rebuildSpeed}>
-                                                          <div class="flex items-center justify-between gap-2">
-                                                            <span class="font-medium text-gray-700 dark:text-gray-200">Speed</span>
-                                                            <span class="text-gray-600 dark:text-gray-300">{array.rebuildSpeed}</span>
-                                                          </div>
-                                                        </Show>
-                                                      </Show>
-                                                    </div>
-                                                  </div>
-                                                );
-                                              }}
-                                            </For>
-                                          </Show>
-                                        </div>
-                                      </div>
-                                    </td>
-                                  </tr>
-                                </Show>
-                              </>
-                            );
-                          }}
+                          {(host) => <HostRow host={host} isColVisible={isColVisible} isMobile={isMobile} getDiskStats={getDiskStats} customUrl={getHostCustomUrl(host.id)} onUpdateCustomUrl={updateHostCustomUrl} onDeleteCustomUrl={deleteHostCustomUrl} />}
                         </For>
                       </tbody>
                     </table>
@@ -736,3 +896,390 @@ export const HostsOverview: Component<HostsOverviewProps> = (props) => {
     </div>
   );
 };
+
+// Individual host row component
+interface HostRowProps {
+  host: Host;
+  isColVisible: (colId: string) => boolean;
+  isMobile: () => boolean;
+  getDiskStats: (host: Host) => { percent: number; used: number; total: number };
+  customUrl?: string;
+  onUpdateCustomUrl: (hostId: string, url: string) => Promise<boolean>;
+  onDeleteCustomUrl: (hostId: string) => Promise<boolean>;
+}
+
+const HostRow: Component<HostRowProps> = (props) => {
+  const { host } = props;
+
+  // Check if this host is in AI context
+  const isInAIContext = createMemo(() => aiChatStore.enabled && aiChatStore.hasContextItem(host.id));
+
+  // URL editing state
+  const [isEditingUrl, setIsEditingUrl] = createSignal(false);
+  const [editingUrlValue, setEditingUrlValue] = createSignal('');
+  const [isSavingUrl, setIsSavingUrl] = createSignal(false);
+  let urlInputRef: HTMLInputElement | undefined;
+
+  // Start editing URL
+  const startEditingUrl = (e: MouseEvent) => {
+    e.stopPropagation();
+    setEditingUrlValue(props.customUrl || '');
+    setIsEditingUrl(true);
+    // Focus input after render
+    setTimeout(() => urlInputRef?.focus(), 0);
+  };
+
+  // Save URL
+  const saveUrl = async () => {
+    const url = editingUrlValue().trim();
+    setIsSavingUrl(true);
+    try {
+      if (url) {
+        await props.onUpdateCustomUrl(host.id, url);
+      } else {
+        await props.onDeleteCustomUrl(host.id);
+      }
+      setIsEditingUrl(false);
+    } finally {
+      setIsSavingUrl(false);
+    }
+  };
+
+  // Cancel editing
+  const cancelEditingUrl = () => {
+    setIsEditingUrl(false);
+    setEditingUrlValue('');
+  };
+
+  // Build context for AI - includes routing fields
+  const buildHostContext = (): Record<string, unknown> => ({
+    hostName: host.displayName || host.hostname,
+    hostname: host.hostname,
+    node: host.hostname,           // Used by AI for command routing
+    target_host: host.hostname,    // Explicit routing hint
+    platform: host.platform,
+    osName: host.osName,
+    osVersion: host.osVersion,
+    cpuUsage: host.cpuUsage ? `${host.cpuUsage.toFixed(1)}%` : undefined,
+    memoryUsage: host.memory?.usage ? `${host.memory.usage.toFixed(1)}%` : undefined,
+    uptime: host.uptimeSeconds ? formatUptime(host.uptimeSeconds) : undefined,
+  });
+
+  // Handle row click - toggle AI context selection
+  const handleRowClick = (event: MouseEvent) => {
+    const target = event.target as HTMLElement;
+    if (target.closest('a, button, [data-prevent-toggle], [data-url-editor]')) {
+      return;
+    }
+
+    // If AI is enabled, toggle AI context
+    if (aiChatStore.enabled) {
+      if (aiChatStore.hasContextItem(host.id)) {
+        aiChatStore.removeContextItem(host.id);
+      } else {
+        aiChatStore.addContextItem('host', host.id, host.displayName || host.hostname, buildHostContext());
+        if (!aiChatStore.isOpen) {
+          aiChatStore.open();
+        }
+      }
+    }
+  };
+
+  const hostStatus = createMemo(() => getHostStatusIndicator(host));
+  const cpuPercent = host.cpuUsage ?? 0;
+  const memPercent = host.memory?.usage ?? 0;
+  const diskStats = props.getDiskStats(host);
+
+  const rowClass = () => {
+    const base = 'transition-all duration-200';
+    const hover = 'hover:bg-gray-50 dark:hover:bg-gray-800/50';
+    const clickable = aiChatStore.enabled ? 'cursor-pointer' : '';
+    const aiContext = isInAIContext() ? 'ai-context-row' : '';
+    return `${base} ${hover} ${clickable} ${aiContext}`;
+  };
+
+  return (
+    <tr class={rowClass()} onClick={handleRowClick}>
+      {/* Host Name - always visible */}
+      <td class="pl-4 pr-2 py-1 align-middle">
+        <div class="flex items-center gap-2 min-w-0">
+          <StatusDot
+            variant={hostStatus().variant}
+            title={hostStatus().label}
+            ariaLabel={hostStatus().label}
+            size="xs"
+          />
+          <Show
+            when={isEditingUrl()}
+            fallback={
+              <div class="min-w-0 flex items-center gap-1.5 group/name">
+                <div>
+                  <p class="text-sm font-semibold text-gray-900 dark:text-gray-100 whitespace-nowrap">
+                    {host.displayName || host.hostname || host.id}
+                  </p>
+                  <Show when={host.displayName && host.displayName !== host.hostname}>
+                    <p class="text-xs text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
+                      {host.hostname}
+                    </p>
+                  </Show>
+                  <Show when={host.lastSeen}>
+                    <p class="text-[10px] text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
+                      Updated {formatRelativeTime(host.lastSeen!)}
+                    </p>
+                  </Show>
+                </div>
+                {/* Custom URL link */}
+                <Show when={props.customUrl}>
+                  <a
+                    href={props.customUrl}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    class="flex-shrink-0 text-blue-600 dark:text-blue-400 hover:text-blue-700 dark:hover:text-blue-300 transition-colors"
+                    title={`Open ${props.customUrl}`}
+                    onClick={(event) => event.stopPropagation()}
+                  >
+                    <svg
+                      class="w-3.5 h-3.5"
+                      fill="none"
+                      stroke="currentColor"
+                      viewBox="0 0 24 24"
+                    >
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14"
+                      />
+                    </svg>
+                  </a>
+                </Show>
+                {/* Edit URL button - shows on hover */}
+                <button
+                  type="button"
+                  onClick={startEditingUrl}
+                  class="flex-shrink-0 opacity-0 group-hover/name:opacity-100 text-gray-400 hover:text-blue-500 dark:hover:text-blue-400 transition-all"
+                  title={props.customUrl ? 'Edit URL' : 'Add URL'}
+                >
+                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" />
+                  </svg>
+                </button>
+                {/* AI context indicator */}
+                <Show when={isInAIContext()}>
+                  <span class="flex-shrink-0 text-purple-500 dark:text-purple-400" title="Selected for AI context">
+                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.455-2.456L14.25 6l1.036-.259a3.375 3.375 0 002.455-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456z" />
+                    </svg>
+                  </span>
+                </Show>
+              </div>
+            }
+          >
+            {/* URL editing mode */}
+            <div class="flex items-center gap-1 min-w-0" data-url-editor>
+              <input
+                ref={urlInputRef}
+                type="text"
+                value={editingUrlValue()}
+                onInput={(e) => setEditingUrlValue(e.currentTarget.value)}
+                onKeyDown={(e) => {
+                  if (e.key === 'Enter') {
+                    e.preventDefault();
+                    saveUrl();
+                  } else if (e.key === 'Escape') {
+                    e.preventDefault();
+                    cancelEditingUrl();
+                  }
+                }}
+                onClick={(e) => e.stopPropagation()}
+                placeholder="https://192.168.1.100:8080"
+                class="w-40 px-2 py-0.5 text-xs border border-blue-500 rounded bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 focus:outline-none focus:ring-1 focus:ring-blue-500"
+                disabled={isSavingUrl()}
+              />
+              <button
+                type="button"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  saveUrl();
+                }}
+                disabled={isSavingUrl()}
+                class="flex-shrink-0 w-5 h-5 flex items-center justify-center text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50"
+                title="Save (Enter)"
+              >
+                ✓
+              </button>
+              <button
+                type="button"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  cancelEditingUrl();
+                }}
+                disabled={isSavingUrl()}
+                class="flex-shrink-0 w-5 h-5 flex items-center justify-center text-xs bg-gray-500 text-white rounded hover:bg-gray-600 transition-colors disabled:opacity-50"
+                title="Cancel (Esc)"
+              >
+                ✕
+              </button>
+            </div>
+          </Show>
+        </div>
+      </td>
+
+      {/* Platform */}
+      <Show when={props.isColVisible('platform')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="text-xs text-gray-700 dark:text-gray-300">
+            <p class="font-medium capitalize whitespace-nowrap">{host.platform || '—'}</p>
+            <Show when={host.osName}>
+              <p class="text-[10px] text-gray-500 dark:text-gray-400 mt-0.5 whitespace-nowrap">
+                {host.osName} {host.osVersion}
+              </p>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* CPU */}
+      <Show when={props.isColVisible('cpu')}>
+        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+          <Show when={props.isMobile()}>
+            <div class="md:hidden flex justify-center">
+              <MetricText value={cpuPercent} type="cpu" />
+            </div>
+          </Show>
+          <div class="hidden md:block">
+            <EnhancedCPUBar
+              usage={cpuPercent}
+              loadAverage={host.loadAverage?.[0]}
+              cores={host.cpuCount}
+            />
+          </div>
+        </td>
+      </Show>
+
+      {/* Memory */}
+      <Show when={props.isColVisible('memory')}>
+        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+          <Show when={props.isMobile()}>
+            <div class="md:hidden flex justify-center">
+              <MetricText value={memPercent} type="memory" />
+            </div>
+          </Show>
+          <div class="hidden md:block">
+            <StackedMemoryBar
+              used={host.memory?.used || 0}
+              total={host.memory?.total || 0}
+              balloon={host.memory?.balloon || 0}
+              swapUsed={host.memory?.swapUsed || 0}
+              swapTotal={host.memory?.swapTotal || 0}
+            />
+          </div>
+        </td>
+      </Show>
+
+      {/* Disk */}
+      <Show when={props.isColVisible('disk')}>
+        <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+          <Show when={props.isMobile()}>
+            <div class="md:hidden flex justify-center">
+              <MetricText value={diskStats.percent} type="disk" />
+            </div>
+          </Show>
+          <div class="hidden md:block">
+            <StackedDiskBar
+              disks={host.disks}
+              aggregateDisk={{
+                total: diskStats.total,
+                used: diskStats.used,
+                free: diskStats.total - diskStats.used,
+                usage: diskStats.percent / 100
+              }}
+            />
+          </div>
+        </td>
+      </Show>
+
+      {/* Temperature - shows primary temp with all sensors in tooltip */}
+      <Show when={props.isColVisible('temp')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <HostTemperatureCell sensors={host.sensors?.temperatureCelsius} />
+          </div>
+        </td>
+      </Show>
+
+      {/* Uptime */}
+      <Show when={props.isColVisible('uptime')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={host.uptimeSeconds} fallback={<span class="text-xs text-gray-400">—</span>}>
+              <span class="text-xs text-gray-700 dark:text-gray-300 whitespace-nowrap">
+                {formatUptime(host.uptimeSeconds!)}
+              </span>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* Agent Version */}
+      <Show when={props.isColVisible('agent')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={host.agentVersion} fallback={<span class="text-xs text-gray-400">—</span>}>
+              <span class="text-xs text-gray-700 dark:text-gray-300 whitespace-nowrap">
+                {host.agentVersion}
+              </span>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* IP Address - uses icon + count with tooltip */}
+      <Show when={props.isColVisible('ip')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <HostNetworkInfoCell networkInterfaces={host.networkInterfaces || []} />
+          </div>
+        </td>
+      </Show>
+
+      {/* Architecture */}
+      <Show when={props.isColVisible('arch')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={host.architecture} fallback={<span class="text-xs text-gray-400">—</span>}>
+              <span class="text-[10px] text-gray-700 dark:text-gray-300 whitespace-nowrap">
+                {host.architecture}
+              </span>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* Kernel */}
+      <Show when={props.isColVisible('kernel')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <Show when={host.kernelVersion} fallback={<span class="text-xs text-gray-400">—</span>}>
+              <span
+                class="text-[10px] text-gray-700 dark:text-gray-300 max-w-[100px] truncate"
+                title={host.kernelVersion}
+              >
+                {host.kernelVersion}
+              </span>
+            </Show>
+          </div>
+        </td>
+      </Show>
+
+      {/* RAID Status */}
+      <Show when={props.isColVisible('raid')}>
+        <td class="px-2 py-1 align-middle">
+          <div class="flex justify-center">
+            <HostRAIDStatusCell raid={host.raid} />
+          </div>
+        </td>
+      </Show>
+    </tr>
+  );
+};
diff --git a/frontend-modern/src/components/Hosts/__tests__/RAIDStatus.test.ts b/frontend-modern/src/components/Hosts/__tests__/RAIDStatus.test.ts
new file mode 100644
index 0000000..b7a9f6d
--- /dev/null
+++ b/frontend-modern/src/components/Hosts/__tests__/RAIDStatus.test.ts
@@ -0,0 +1,478 @@
+/**
+ * Tests for RAID status display logic
+ * 
+ * These tests cover the RAID status analysis and display logic used in HostsOverview.
+ */
+import { describe, expect, it } from 'vitest';
+
+// Mock types matching HostRAIDArray from api.ts
+interface HostRAIDDevice {
+  device: string;
+  state: string;
+  slot: number;
+}
+
+interface HostRAIDArray {
+  device: string;
+  name?: string;
+  level: string;
+  state: string;
+  totalDevices: number;
+  activeDevices: number;
+  workingDevices: number;
+  failedDevices: number;
+  spareDevices: number;
+  uuid?: string;
+  devices: HostRAIDDevice[];
+  rebuildPercent: number;
+  rebuildSpeed?: string;
+}
+
+// Status analysis logic matching HostRAIDStatusCell
+type RAIDStatusType = 'none' | 'ok' | 'degraded' | 'rebuilding';
+
+interface RAIDStatus {
+  type: RAIDStatusType;
+  label: string;
+  color: string;
+}
+
+function analyzeRAIDStatus(raid: HostRAIDArray[] | undefined): RAIDStatus {
+  if (!raid || raid.length === 0) {
+    return { type: 'none', label: '-', color: 'text-gray-400' };
+  }
+
+  let hasDegraded = false;
+  let hasRebuilding = false;
+  let maxRebuildPercent = 0;
+
+  for (const array of raid) {
+    const state = array.state.toLowerCase();
+    if (state.includes('degraded') || array.failedDevices > 0) {
+      hasDegraded = true;
+    }
+    if (state.includes('recover') || state.includes('resync') || array.rebuildPercent > 0) {
+      hasRebuilding = true;
+      maxRebuildPercent = Math.max(maxRebuildPercent, array.rebuildPercent);
+    }
+  }
+
+  if (hasDegraded) {
+    return { type: 'degraded', label: 'Degraded', color: 'text-red-600 dark:text-red-400' };
+  }
+  if (hasRebuilding) {
+    return {
+      type: 'rebuilding',
+      label: `${Math.round(maxRebuildPercent)}%`,
+      color: 'text-amber-600 dark:text-amber-400'
+    };
+  }
+  return { type: 'ok', label: 'OK', color: 'text-green-600 dark:text-green-400' };
+}
+
+function getDeviceStateColor(state: string): string {
+  const s = state.toLowerCase();
+  if (s.includes('active') || s.includes('sync')) return 'text-green-400';
+  if (s.includes('spare')) return 'text-blue-400';
+  if (s.includes('faulty') || s.includes('removed')) return 'text-red-400';
+  if (s.includes('rebuilding')) return 'text-amber-400';
+  return 'text-gray-400';
+}
+
+function getArrayStateColor(array: HostRAIDArray): string {
+  const state = array.state.toLowerCase();
+  if (state.includes('degraded') || array.failedDevices > 0) return 'text-red-400';
+  if (state.includes('recover') || state.includes('resync') || array.rebuildPercent > 0) return 'text-amber-400';
+  if (state.includes('clean') || state.includes('active')) return 'text-green-400';
+  return 'text-gray-400';
+}
+
+describe('RAID Status Analysis', () => {
+  describe('analyzeRAIDStatus', () => {
+    it('returns none status for undefined raid', () => {
+      const status = analyzeRAIDStatus(undefined);
+      expect(status.type).toBe('none');
+      expect(status.label).toBe('-');
+    });
+
+    it('returns none status for empty raid array', () => {
+      const status = analyzeRAIDStatus([]);
+      expect(status.type).toBe('none');
+    });
+
+    it('returns ok status for healthy RAID1', () => {
+      const raid: HostRAIDArray[] = [{
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean, active',
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [
+          { device: 'sda1', state: 'active sync', slot: 0 },
+          { device: 'sdb1', state: 'active sync', slot: 1 },
+        ],
+        rebuildPercent: 0,
+      }];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('ok');
+      expect(status.label).toBe('OK');
+      expect(status.color).toContain('green');
+    });
+
+    it('returns degraded status when array has failed devices', () => {
+      const raid: HostRAIDArray[] = [{
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean, degraded',
+        totalDevices: 2,
+        activeDevices: 1,
+        workingDevices: 1,
+        failedDevices: 1,
+        spareDevices: 0,
+        devices: [
+          { device: 'sda1', state: 'active sync', slot: 0 },
+          { device: 'sdb1', state: 'faulty', slot: 1 },
+        ],
+        rebuildPercent: 0,
+      }];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('degraded');
+      expect(status.label).toBe('Degraded');
+      expect(status.color).toContain('red');
+    });
+
+    it('returns degraded status when state includes degraded', () => {
+      const raid: HostRAIDArray[] = [{
+        device: '/dev/md0',
+        level: 'raid5',
+        state: 'degraded, recovering',
+        totalDevices: 3,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0, // No failed but degraded state
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 50,
+      }];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('degraded');
+    });
+
+    it('returns rebuilding status with percentage', () => {
+      const raid: HostRAIDArray[] = [{
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean, recovering',
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 45.5,
+        rebuildSpeed: '100MB/s',
+      }];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('rebuilding');
+      expect(status.label).toBe('46%'); // Rounded
+      expect(status.color).toContain('amber');
+    });
+
+    it('returns max rebuild percentage when multiple arrays rebuilding', () => {
+      const raid: HostRAIDArray[] = [
+        {
+          device: '/dev/md0',
+          level: 'raid1',
+          state: 'recovering',
+          totalDevices: 2,
+          activeDevices: 2,
+          workingDevices: 2,
+          failedDevices: 0,
+          spareDevices: 0,
+          devices: [],
+          rebuildPercent: 30,
+        },
+        {
+          device: '/dev/md1',
+          level: 'raid1',
+          state: 'recovering',
+          totalDevices: 2,
+          activeDevices: 2,
+          workingDevices: 2,
+          failedDevices: 0,
+          spareDevices: 0,
+          devices: [],
+          rebuildPercent: 75,
+        },
+      ];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('rebuilding');
+      expect(status.label).toBe('75%');
+    });
+
+    it('prioritizes degraded over rebuilding', () => {
+      const raid: HostRAIDArray[] = [
+        {
+          device: '/dev/md0',
+          level: 'raid1',
+          state: 'clean, degraded, recovering',
+          totalDevices: 2,
+          activeDevices: 1,
+          workingDevices: 1,
+          failedDevices: 1, // Failed device
+          spareDevices: 0,
+          devices: [],
+          rebuildPercent: 50, // Also rebuilding
+        },
+      ];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('degraded'); // Degraded takes priority
+    });
+
+    it('handles resync state as rebuilding', () => {
+      const raid: HostRAIDArray[] = [{
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean, resyncing',
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 0, // resync state triggers rebuilding even without percent
+      }];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('rebuilding');
+    });
+
+    it('handles multiple healthy arrays', () => {
+      const raid: HostRAIDArray[] = [
+        {
+          device: '/dev/md0',
+          level: 'raid1',
+          state: 'clean',
+          totalDevices: 2,
+          activeDevices: 2,
+          workingDevices: 2,
+          failedDevices: 0,
+          spareDevices: 0,
+          devices: [],
+          rebuildPercent: 0,
+        },
+        {
+          device: '/dev/md1',
+          level: 'raid5',
+          state: 'active',
+          totalDevices: 3,
+          activeDevices: 3,
+          workingDevices: 3,
+          failedDevices: 0,
+          spareDevices: 1,
+          devices: [],
+          rebuildPercent: 0,
+        },
+      ];
+
+      const status = analyzeRAIDStatus(raid);
+      expect(status.type).toBe('ok');
+    });
+  });
+
+  describe('getDeviceStateColor', () => {
+    it('returns green for active devices', () => {
+      expect(getDeviceStateColor('active sync')).toContain('green');
+      expect(getDeviceStateColor('Active Sync')).toContain('green');
+    });
+
+    it('returns blue for spare devices', () => {
+      expect(getDeviceStateColor('spare')).toContain('blue');
+      expect(getDeviceStateColor('hot spare')).toContain('blue');
+    });
+
+    it('returns red for faulty devices', () => {
+      expect(getDeviceStateColor('faulty')).toContain('red');
+      expect(getDeviceStateColor('removed')).toContain('red');
+    });
+
+    it('returns amber for rebuilding devices', () => {
+      expect(getDeviceStateColor('rebuilding')).toContain('amber');
+    });
+
+    it('returns gray for unknown states', () => {
+      expect(getDeviceStateColor('')).toContain('gray');
+      expect(getDeviceStateColor('unknown')).toContain('gray');
+    });
+  });
+
+  describe('getArrayStateColor', () => {
+    it('returns green for clean/active arrays', () => {
+      const cleanArray: HostRAIDArray = {
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean',
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 0,
+      };
+      expect(getArrayStateColor(cleanArray)).toContain('green');
+
+      const activeArray: HostRAIDArray = { ...cleanArray, state: 'active' };
+      expect(getArrayStateColor(activeArray)).toContain('green');
+    });
+
+    it('returns red for degraded arrays', () => {
+      const degradedArray: HostRAIDArray = {
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'degraded',
+        totalDevices: 2,
+        activeDevices: 1,
+        workingDevices: 1,
+        failedDevices: 1,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 0,
+      };
+      expect(getArrayStateColor(degradedArray)).toContain('red');
+    });
+
+    it('returns red for arrays with failed devices even if state is clean', () => {
+      const failedDeviceArray: HostRAIDArray = {
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean', // State says clean but...
+        totalDevices: 2,
+        activeDevices: 1,
+        workingDevices: 1,
+        failedDevices: 1, // Has a failed device
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 0,
+      };
+      expect(getArrayStateColor(failedDeviceArray)).toContain('red');
+    });
+
+    it('returns amber for recovering/resyncing arrays', () => {
+      const recoveringArray: HostRAIDArray = {
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'recovering',
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 50,
+      };
+      expect(getArrayStateColor(recoveringArray)).toContain('amber');
+
+      const resyncArray: HostRAIDArray = { ...recoveringArray, state: 'resyncing' };
+      expect(getArrayStateColor(resyncArray)).toContain('amber');
+    });
+
+    it('returns amber for arrays with rebuild percent > 0', () => {
+      const rebuildingArray: HostRAIDArray = {
+        device: '/dev/md0',
+        level: 'raid1',
+        state: 'clean', // State is clean but...
+        totalDevices: 2,
+        activeDevices: 2,
+        workingDevices: 2,
+        failedDevices: 0,
+        spareDevices: 0,
+        devices: [],
+        rebuildPercent: 25, // Rebuilding
+      };
+      expect(getArrayStateColor(rebuildingArray)).toContain('amber');
+    });
+  });
+});
+
+describe('RAID Level Support', () => {
+  const raidLevels = ['raid0', 'raid1', 'raid5', 'raid6', 'raid10'];
+
+  it.each(raidLevels)('supports %s level', (level) => {
+    const array: HostRAIDArray = {
+      device: '/dev/md0',
+      level: level,
+      state: 'clean',
+      totalDevices: level === 'raid0' ? 2 : level === 'raid10' ? 4 : 3,
+      activeDevices: level === 'raid0' ? 2 : level === 'raid10' ? 4 : 3,
+      workingDevices: level === 'raid0' ? 2 : level === 'raid10' ? 4 : 3,
+      failedDevices: 0,
+      spareDevices: 0,
+      devices: [],
+      rebuildPercent: 0,
+    };
+
+    const status = analyzeRAIDStatus([array]);
+    expect(status.type).toBe('ok');
+  });
+});
+
+describe('RAID Device Counts', () => {
+  it('displays correct device counts for RAID1 with spares', () => {
+    const array: HostRAIDArray = {
+      device: '/dev/md0',
+      level: 'raid1',
+      state: 'clean',
+      totalDevices: 3,
+      activeDevices: 2,
+      workingDevices: 2,
+      failedDevices: 0,
+      spareDevices: 1,
+      devices: [
+        { device: 'sda1', state: 'active sync', slot: 0 },
+        { device: 'sdb1', state: 'active sync', slot: 1 },
+        { device: 'sdc1', state: 'spare', slot: -1 },
+      ],
+      rebuildPercent: 0,
+    };
+
+    expect(array.activeDevices).toBe(2);
+    expect(array.workingDevices).toBe(2);
+    expect(array.spareDevices).toBe(1);
+    expect(array.failedDevices).toBe(0);
+    expect(array.devices).toHaveLength(3);
+  });
+
+  it('displays degraded state for RAID5 missing one device', () => {
+    const array: HostRAIDArray = {
+      device: '/dev/md0',
+      level: 'raid5',
+      state: 'clean, degraded',
+      totalDevices: 4,
+      activeDevices: 3,
+      workingDevices: 3,
+      failedDevices: 1,
+      spareDevices: 0,
+      devices: [
+        { device: 'sda1', state: 'active sync', slot: 0 },
+        { device: 'sdb1', state: 'active sync', slot: 1 },
+        { device: 'sdc1', state: 'active sync', slot: 2 },
+        { device: 'sdd1', state: 'removed', slot: 3 },
+      ],
+      rebuildPercent: 0,
+    };
+
+    const status = analyzeRAIDStatus([array]);
+    expect(status.type).toBe('degraded');
+    expect(array.failedDevices).toBe(1);
+  });
+});
diff --git a/frontend-modern/src/components/Kubernetes/KubernetesClusters.tsx b/frontend-modern/src/components/Kubernetes/KubernetesClusters.tsx
new file mode 100644
index 0000000..f768530
--- /dev/null
+++ b/frontend-modern/src/components/Kubernetes/KubernetesClusters.tsx
@@ -0,0 +1,982 @@
+import type { Component } from 'solid-js';
+import { For, Show, createMemo, createSignal, createEffect } from 'solid-js';
+import { usePersistentSignal } from '@/hooks/usePersistentSignal';
+import { useColumnVisibility, type ColumnDef } from '@/hooks/useColumnVisibility';
+import type {
+  KubernetesCluster,
+  KubernetesDeployment,
+  KubernetesNode,
+  KubernetesPod,
+} from '@/types/api';
+import { Card } from '@/components/shared/Card';
+import { EmptyState } from '@/components/shared/EmptyState';
+import { ScrollableTable } from '@/components/shared/ScrollableTable';
+import { StatusDot } from '@/components/shared/StatusDot';
+import { ColumnPicker } from '@/components/shared/ColumnPicker';
+import { formatRelativeTime, formatBytes } from '@/utils/format';
+import { DEGRADED_HEALTH_STATUSES, OFFLINE_HEALTH_STATUSES, type StatusIndicator } from '@/utils/status';
+
+interface KubernetesClustersProps {
+  clusters: KubernetesCluster[];
+}
+
+type ViewMode = 'clusters' | 'nodes' | 'pods' | 'deployments';
+type StatusFilter = 'all' | 'healthy' | 'unhealthy';
+
+const normalize = (value?: string | null): string => (value || '').trim().toLowerCase();
+
+const getStatusIndicator = (status: string | undefined | null): StatusIndicator => {
+  const normalized = normalize(status);
+  if (!normalized) return { variant: 'muted', label: 'Unknown' };
+  if (OFFLINE_HEALTH_STATUSES.has(normalized)) return { variant: 'danger', label: 'Offline' };
+  if (DEGRADED_HEALTH_STATUSES.has(normalized)) return { variant: 'warning', label: 'Degraded' };
+  if (normalized === 'online') return { variant: 'success', label: 'Online' };
+  return { variant: 'muted', label: status ?? 'Unknown' };
+};
+
+const isPodHealthy = (pod: KubernetesPod): boolean => {
+  const phase = normalize(pod.phase);
+  if (!phase) return false;
+  if (phase !== 'running') return false;
+
+  const containers = pod.containers ?? [];
+  if (containers.length === 0) return true;
+
+  return containers.every((container) => {
+    if (!container.ready) return false;
+    const state = normalize(container.state);
+    if (!state) return true;
+    return state === 'running';
+  });
+};
+
+const isDeploymentHealthy = (d: KubernetesDeployment): boolean => {
+  const desired = d.desiredReplicas ?? 0;
+  if (desired <= 0) return true;
+  const available = d.availableReplicas ?? 0;
+  const ready = d.readyReplicas ?? 0;
+  const updated = d.updatedReplicas ?? 0;
+  return available >= desired && ready >= desired && updated >= desired;
+};
+
+const getClusterDisplayName = (cluster: KubernetesCluster): string => {
+  return cluster.customDisplayName || cluster.displayName || cluster.name || cluster.id;
+};
+
+const summarizeNodes = (nodes: KubernetesNode[] | undefined) => {
+  const list = nodes ?? [];
+  const notReady = list.filter((n) => !n.ready).length;
+  const unschedulable = list.filter((n) => !!n.unschedulable).length;
+  return { total: list.length, notReady, unschedulable };
+};
+
+const summarizePods = (pods: KubernetesPod[] | undefined) => {
+  const list = pods ?? [];
+  const unhealthy = list.filter((p) => !isPodHealthy(p)).length;
+  return { total: list.length, unhealthy };
+};
+
+const summarizeDeployments = (deployments: KubernetesDeployment[] | undefined) => {
+  const list = deployments ?? [];
+  const unhealthy = list.filter((d) => !isDeploymentHealthy(d)).length;
+  return { total: list.length, unhealthy };
+};
+
+const getPodStatusBadge = (pod: KubernetesPod) => {
+  if (isPodHealthy(pod)) {
+    return { class: 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300', label: 'Running' };
+  }
+  const phase = normalize(pod.phase);
+  if (phase === 'pending') {
+    return { class: 'bg-yellow-100 text-yellow-700 dark:bg-yellow-900/40 dark:text-yellow-300', label: 'Pending' };
+  }
+  if (phase === 'failed') {
+    return { class: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300', label: 'Failed' };
+  }
+  if (phase === 'succeeded') {
+    return { class: 'bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300', label: 'Completed' };
+  }
+  // Check for CrashLoopBackOff or other container issues
+  const containers = pod.containers ?? [];
+  const crashingContainer = containers.find((c) => c.reason?.toLowerCase().includes('crash'));
+  if (crashingContainer) {
+    return { class: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300', label: 'CrashLoop' };
+  }
+  const waitingContainer = containers.find((c) => normalize(c.state) === 'waiting');
+  if (waitingContainer) {
+    return { class: 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300', label: waitingContainer.reason || 'Waiting' };
+  }
+  return { class: 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300', label: pod.phase || 'Unknown' };
+};
+
+// Get primary container image (first container)
+const getPrimaryImage = (pod: KubernetesPod): string => {
+  const containers = pod.containers ?? [];
+  if (containers.length === 0) return '—';
+  const image = containers[0].image ?? '';
+  // Truncate long image names, show just the image:tag part
+  const parts = image.split('/');
+  return parts[parts.length - 1] || image || '—';
+};
+
+// Format age from timestamp
+const formatAge = (timestamp?: number | string | null): string => {
+  if (!timestamp) return '—';
+  const ts = typeof timestamp === 'string' ? Date.parse(timestamp) : timestamp;
+  if (isNaN(ts)) return '—';
+  return formatRelativeTime(ts);
+};
+
+// Column definitions for the pods table
+const POD_COLUMNS: ColumnDef[] = [
+  { id: 'name', label: 'Pod', priority: 'essential', toggleable: false },
+  { id: 'namespace', label: 'Namespace', priority: 'essential', toggleable: true },
+  { id: 'cluster', label: 'Cluster', priority: 'primary', toggleable: true },
+  { id: 'status', label: 'Status', priority: 'essential', toggleable: false },
+  { id: 'ready', label: 'Ready', priority: 'primary', toggleable: true },
+  { id: 'restarts', label: 'Restarts', priority: 'primary', toggleable: true },
+  { id: 'image', label: 'Image', priority: 'secondary', toggleable: true },
+  { id: 'age', label: 'Age', priority: 'primary', toggleable: true },
+];
+
+export const KubernetesClusters: Component<KubernetesClustersProps> = (props) => {
+  const [search, setSearch] = createSignal('');
+  const [viewMode, setViewMode] = createSignal<ViewMode>('clusters');
+  const [statusFilter, setStatusFilter] = createSignal<StatusFilter>('all');
+  const [showHidden, setShowHidden] = createSignal(false);
+  const [namespaceFilter, setNamespaceFilter] = createSignal<string>('all');
+
+  // Column visibility for pods table
+  const podColumns = useColumnVisibility('k8s-pod-columns', POD_COLUMNS);
+
+  // Sorting state with persistence
+  type SortKey = 'name' | 'status' | 'namespace' | 'cluster' | 'age' | 'restarts' | 'ready' | 'replicas';
+  type SortDir = 'asc' | 'desc';
+  const [sortKey, setSortKey] = usePersistentSignal<SortKey>('k8s-sort-key', 'name');
+  const [sortDirection, setSortDirection] = usePersistentSignal<SortDir>('k8s-sort-dir', 'asc');
+
+  const toggleSort = (key: SortKey) => {
+    if (sortKey() === key) {
+      setSortDirection(sortDirection() === 'asc' ? 'desc' : 'asc');
+    } else {
+      setSortKey(key);
+      setSortDirection('asc');
+    }
+  };
+
+  const sortIndicator = (key: SortKey) => sortKey() === key ? (sortDirection() === 'asc' ? ' ▲' : ' ▼') : '';
+
+  // Search input ref for keyboard focus
+  let searchInputRef: HTMLInputElement | undefined;
+
+  // Global keyboard handler - focus search on typing
+  createEffect(() => {
+    const handleKeyDown = (e: KeyboardEvent) => {
+      const target = e.target as HTMLElement;
+      const isInputField =
+        target.tagName === 'INPUT' ||
+        target.tagName === 'TEXTAREA' ||
+        target.tagName === 'SELECT' ||
+        target.contentEditable === 'true';
+
+      // Escape clears search
+      if (e.key === 'Escape' && searchInputRef) {
+        setSearch('');
+        searchInputRef.blur();
+        return;
+      }
+
+      // Focus search on printable character (when not in input field)
+      if (!isInputField && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
+        searchInputRef?.focus();
+      }
+    };
+
+    document.addEventListener('keydown', handleKeyDown);
+    return () => document.removeEventListener('keydown', handleKeyDown);
+  });
+
+  // Get all unique namespaces for the filter dropdown
+  const allNamespaces = createMemo(() => {
+    const namespaces = new Set<string>();
+    for (const cluster of props.clusters ?? []) {
+      if (!showHidden() && cluster.hidden) continue;
+      for (const pod of cluster.pods ?? []) {
+        if (pod.namespace) namespaces.add(pod.namespace);
+      }
+      for (const dep of cluster.deployments ?? []) {
+        if (dep.namespace) namespaces.add(dep.namespace);
+      }
+    }
+    return Array.from(namespaces).sort();
+  });
+
+  // Get all nodes flattened across clusters
+  const allNodes = createMemo(() => {
+    const clusters = props.clusters ?? [];
+    const nodes: Array<{ cluster: KubernetesCluster; node: KubernetesNode }> = [];
+    for (const cluster of clusters) {
+      if (!showHidden() && cluster.hidden) continue;
+      for (const node of cluster.nodes ?? []) {
+        nodes.push({ cluster, node });
+      }
+    }
+    return nodes;
+  });
+
+  // Get all pods flattened across clusters
+  const allPods = createMemo(() => {
+    const clusters = props.clusters ?? [];
+    const pods: Array<{ cluster: KubernetesCluster; pod: KubernetesPod }> = [];
+    for (const cluster of clusters) {
+      if (!showHidden() && cluster.hidden) continue;
+      for (const pod of cluster.pods ?? []) {
+        pods.push({ cluster, pod });
+      }
+    }
+    return pods;
+  });
+
+  // Get all deployments flattened across clusters
+  const allDeployments = createMemo(() => {
+    const clusters = props.clusters ?? [];
+    const deps: Array<{ cluster: KubernetesCluster; deployment: KubernetesDeployment }> = [];
+    for (const cluster of clusters) {
+      if (!showHidden() && cluster.hidden) continue;
+      for (const dep of cluster.deployments ?? []) {
+        deps.push({ cluster, deployment: dep });
+      }
+    }
+    return deps;
+  });
+
+  const visibleClusters = createMemo(() => {
+    const term = search().trim().toLowerCase();
+    const clusters = props.clusters ?? [];
+    const status = statusFilter();
+    const key = sortKey();
+    const dir = sortDirection();
+
+    const filtered = clusters
+      .filter((cluster) => showHidden() || !cluster.hidden)
+      .filter((cluster) => {
+        if (status === 'all') return true;
+        const clusterStatus = normalize(cluster.status);
+        const isHealthy = clusterStatus === 'online';
+        if (status === 'healthy') return isHealthy;
+        if (status === 'unhealthy') return !isHealthy;
+        return true;
+      })
+      .filter((cluster) => {
+        if (!term) return true;
+        const haystack = [
+          getClusterDisplayName(cluster),
+          cluster.id,
+          cluster.server ?? '',
+          cluster.context ?? '',
+          cluster.version ?? '',
+        ]
+          .join(' ')
+          .toLowerCase();
+        return haystack.includes(term);
+      });
+
+    // Sort clusters
+    return filtered.sort((a, b) => {
+      let cmp = 0;
+      switch (key) {
+        case 'name': cmp = getClusterDisplayName(a).localeCompare(getClusterDisplayName(b)); break;
+        case 'status': cmp = (normalize(a.status) === 'online' ? 0 : 1) - (normalize(b.status) === 'online' ? 0 : 1); break;
+        default: cmp = getClusterDisplayName(a).localeCompare(getClusterDisplayName(b));
+      }
+      return dir === 'desc' ? -cmp : cmp;
+    });
+  });
+
+  const filteredNodes = createMemo(() => {
+    const term = search().trim().toLowerCase();
+    const status = statusFilter();
+    const key = sortKey();
+    const dir = sortDirection();
+
+    const filtered = allNodes()
+      .filter(({ node }) => {
+        if (status === 'all') return true;
+        const isHealthy = node.ready && !node.unschedulable;
+        if (status === 'healthy') return isHealthy;
+        if (status === 'unhealthy') return !isHealthy;
+        return true;
+      })
+      .filter(({ cluster, node }) => {
+        if (!term) return true;
+        const haystack = [
+          node.name,
+          getClusterDisplayName(cluster),
+          node.kubeletVersion ?? '',
+          node.osImage ?? '',
+          ...(node.roles ?? []),
+        ]
+          .join(' ')
+          .toLowerCase();
+        return haystack.includes(term);
+      });
+
+    // Sort nodes
+    return filtered.sort((a, b) => {
+      let cmp = 0;
+      switch (key) {
+        case 'name': cmp = (a.node.name ?? '').localeCompare(b.node.name ?? ''); break;
+        case 'cluster': cmp = getClusterDisplayName(a.cluster).localeCompare(getClusterDisplayName(b.cluster)); break;
+        case 'status': cmp = (a.node.ready ? 0 : 1) - (b.node.ready ? 0 : 1); break;
+        default: cmp = (a.node.name ?? '').localeCompare(b.node.name ?? '');
+      }
+      return dir === 'desc' ? -cmp : cmp;
+    });
+  });
+
+  const filteredPods = createMemo(() => {
+    const term = search().trim().toLowerCase();
+    const status = statusFilter();
+    const ns = namespaceFilter();
+    const key = sortKey();
+    const dir = sortDirection();
+
+    const filtered = allPods()
+      .filter(({ pod }) => {
+        if (ns !== 'all' && pod.namespace !== ns) return false;
+        if (status === 'all') return true;
+        const healthy = isPodHealthy(pod);
+        if (status === 'healthy') return healthy;
+        if (status === 'unhealthy') return !healthy;
+        return true;
+      })
+      .filter(({ cluster, pod }) => {
+        if (!term) return true;
+        const haystack = [
+          pod.name,
+          pod.namespace,
+          pod.nodeName ?? '',
+          pod.phase ?? '',
+          getClusterDisplayName(cluster),
+          ...(pod.containers ?? []).map(c => c.image ?? ''),
+        ]
+          .join(' ')
+          .toLowerCase();
+        return haystack.includes(term);
+      });
+
+    // Sort
+    return filtered.sort((a, b) => {
+      let cmp = 0;
+      switch (key) {
+        case 'name': cmp = (a.pod.name ?? '').localeCompare(b.pod.name ?? ''); break;
+        case 'namespace': cmp = (a.pod.namespace ?? '').localeCompare(b.pod.namespace ?? ''); break;
+        case 'cluster': cmp = getClusterDisplayName(a.cluster).localeCompare(getClusterDisplayName(b.cluster)); break;
+        case 'restarts': cmp = (a.pod.restarts ?? 0) - (b.pod.restarts ?? 0); break;
+        case 'age': cmp = (a.pod.createdAt ?? 0) - (b.pod.createdAt ?? 0); break;
+        case 'status': cmp = (isPodHealthy(a.pod) ? 0 : 1) - (isPodHealthy(b.pod) ? 0 : 1); break;
+        default: cmp = (a.pod.name ?? '').localeCompare(b.pod.name ?? '');
+      }
+      return dir === 'desc' ? -cmp : cmp;
+    });
+  });
+
+  const filteredDeployments = createMemo(() => {
+    const term = search().trim().toLowerCase();
+    const status = statusFilter();
+    const ns = namespaceFilter();
+    const key = sortKey();
+    const dir = sortDirection();
+
+    const filtered = allDeployments()
+      .filter(({ deployment }) => {
+        if (ns !== 'all' && deployment.namespace !== ns) return false;
+        if (status === 'all') return true;
+        const healthy = isDeploymentHealthy(deployment);
+        if (status === 'healthy') return healthy;
+        if (status === 'unhealthy') return !healthy;
+        return true;
+      })
+      .filter(({ cluster, deployment }) => {
+        if (!term) return true;
+        const haystack = [
+          deployment.name,
+          deployment.namespace,
+          getClusterDisplayName(cluster),
+        ]
+          .join(' ')
+          .toLowerCase();
+        return haystack.includes(term);
+      });
+
+    // Sort
+    return filtered.sort((a, b) => {
+      let cmp = 0;
+      switch (key) {
+        case 'name': cmp = (a.deployment.name ?? '').localeCompare(b.deployment.name ?? ''); break;
+        case 'namespace': cmp = (a.deployment.namespace ?? '').localeCompare(b.deployment.namespace ?? ''); break;
+        case 'cluster': cmp = getClusterDisplayName(a.cluster).localeCompare(getClusterDisplayName(b.cluster)); break;
+        case 'replicas': cmp = (a.deployment.desiredReplicas ?? 0) - (b.deployment.desiredReplicas ?? 0); break;
+        case 'ready': cmp = (a.deployment.readyReplicas ?? 0) - (b.deployment.readyReplicas ?? 0); break;
+        case 'status': cmp = (isDeploymentHealthy(a.deployment) ? 0 : 1) - (isDeploymentHealthy(b.deployment) ? 0 : 1); break;
+        default: cmp = (a.deployment.name ?? '').localeCompare(b.deployment.name ?? '');
+      }
+      return dir === 'desc' ? -cmp : cmp;
+    });
+  });
+
+  const isEmpty = createMemo(() => (props.clusters?.length ?? 0) === 0);
+
+  const hasActiveFilters = createMemo(
+    () => search().trim() !== '' || statusFilter() !== 'all' || showHidden() || namespaceFilter() !== 'all',
+  );
+
+  const handleReset = () => {
+    setSearch('');
+    setStatusFilter('all');
+    setShowHidden(false);
+    setNamespaceFilter('all');
+    setViewMode('clusters');
+  };
+
+  return (
+    <div class="space-y-4">
+      {/* Filter Bar */}
+      <Card padding="sm">
+        <div class="flex flex-col gap-3">
+          {/* Search - full width on its own row */}
+          <div class="relative">
+            <input
+              ref={searchInputRef}
+              type="text"
+              placeholder="Search clusters, nodes, pods..."
+              value={search()}
+              onInput={(e) => setSearch(e.currentTarget.value)}
+              onKeyDown={(e) => {
+                if (e.key === 'Escape') {
+                  setSearch('');
+                  e.currentTarget.blur();
+                }
+              }}
+              class="w-full pl-9 pr-8 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+            />
+            <svg
+              class="absolute left-3 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
+              fill="none"
+              viewBox="0 0 24 24"
+              stroke="currentColor"
+            >
+              <path
+                stroke-linecap="round"
+                stroke-linejoin="round"
+                stroke-width="2"
+                d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"
+              />
+            </svg>
+            <Show when={search()}>
+              <button
+                type="button"
+                class="absolute right-2 top-1/2 -translate-y-1/2 transform text-gray-400 dark:text-gray-500 hover:text-gray-600 dark:hover:text-gray-300 transition-colors"
+                onClick={() => setSearch('')}
+                aria-label="Clear search"
+              >
+                <svg class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
+                </svg>
+              </button>
+            </Show>
+          </div>
+
+          {/* Filters - second row */}
+          <div class="flex flex-wrap items-center gap-2">
+            {/* View Mode Toggle */}
+            <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+              <button
+                type="button"
+                onClick={() => setViewMode('clusters')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'clusters'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                Clusters
+              </button>
+              <button
+                type="button"
+                onClick={() => setViewMode('nodes')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'nodes'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                Nodes
+              </button>
+              <button
+                type="button"
+                onClick={() => setViewMode('pods')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'pods'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                Pods
+              </button>
+              <button
+                type="button"
+                onClick={() => setViewMode('deployments')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'deployments'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                Deployments
+              </button>
+            </div>
+
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" />
+
+            {/* Status Filter */}
+            <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+              <button
+                type="button"
+                onClick={() => setStatusFilter('all')}
+                class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${statusFilter() === 'all'
+                  ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                All
+              </button>
+              <button
+                type="button"
+                onClick={() => setStatusFilter(statusFilter() === 'healthy' ? 'all' : 'healthy')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${statusFilter() === 'healthy'
+                  ? 'bg-white dark:bg-gray-800 text-green-600 dark:text-green-400 shadow-sm ring-1 ring-green-200 dark:ring-green-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                <span class={`w-2 h-2 rounded-full ${statusFilter() === 'healthy' ? 'bg-green-500' : 'bg-green-400/60'}`} />
+                Healthy
+              </button>
+              <button
+                type="button"
+                onClick={() => setStatusFilter(statusFilter() === 'unhealthy' ? 'all' : 'unhealthy')}
+                class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${statusFilter() === 'unhealthy'
+                  ? 'bg-white dark:bg-gray-800 text-amber-600 dark:text-amber-400 shadow-sm ring-1 ring-amber-200 dark:ring-amber-800'
+                  : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                  }`}
+              >
+                <span class={`w-2 h-2 rounded-full ${statusFilter() === 'unhealthy' ? 'bg-amber-500' : 'bg-amber-400/60'}`} />
+                Unhealthy
+              </button>
+            </div>
+
+            {/* Namespace Filter - only show for pods/deployments */}
+            <Show when={(viewMode() === 'pods' || viewMode() === 'deployments') && allNamespaces().length > 1}>
+              <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" />
+              <select
+                value={namespaceFilter()}
+                onChange={(e) => setNamespaceFilter(e.currentTarget.value)}
+                class="px-2.5 py-1 text-xs font-medium rounded-lg border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800 text-gray-700 dark:text-gray-300 focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500"
+              >
+                <option value="all">All namespaces</option>
+                <For each={allNamespaces()}>
+                  {(ns) => <option value={ns}>{ns}</option>}
+                </For>
+              </select>
+            </Show>
+
+            <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" />
+
+            {/* Show Hidden Toggle */}
+            <label class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400 cursor-pointer select-none">
+              <input
+                type="checkbox"
+                checked={showHidden()}
+                onChange={(e) => setShowHidden(e.currentTarget.checked)}
+                class="rounded border-gray-300 dark:border-gray-600 text-blue-600 focus:ring-blue-500/20"
+              />
+              Show hidden
+            </label>
+
+            {/* Column Picker - only show for pods view */}
+            <Show when={viewMode() === 'pods'}>
+              <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" />
+              <ColumnPicker
+                columns={podColumns.availableToggles()}
+                isHidden={podColumns.isHiddenByUser}
+                onToggle={podColumns.toggle}
+                onReset={podColumns.resetToDefaults}
+              />
+            </Show>
+
+            {/* Reset Button */}
+            <Show when={hasActiveFilters()}>
+              <div class="h-5 w-px bg-gray-200 dark:bg-gray-600 hidden sm:block" />
+              <button
+                type="button"
+                onClick={handleReset}
+                class="flex items-center justify-center gap-1 px-2.5 py-1 text-xs font-medium rounded-lg text-blue-700 dark:text-blue-300 bg-blue-100 dark:bg-blue-900/50 hover:bg-blue-200 dark:hover:bg-blue-900/70 transition-colors"
+                title="Reset filters"
+              >
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                  <path d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8" />
+                  <path d="M21 3v5h-5" />
+                  <path d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16" />
+                  <path d="M8 16H3v5" />
+                </svg>
+                <span class="hidden sm:inline">Reset</span>
+              </button>
+            </Show>
+          </div>
+        </div>
+      </Card>
+
+      {/* Main Table */}
+      <Card padding="none" class="overflow-hidden">
+        <Show
+          when={!isEmpty()}
+          fallback={
+            <div class="p-10">
+              <EmptyState
+                title="No Kubernetes clusters reporting yet"
+                description="Enable Kubernetes monitoring on a unified agent to start reporting cluster health."
+              />
+            </div>
+          }
+        >
+          {/* Clusters View */}
+          <Show when={viewMode() === 'clusters'}>
+            <ScrollableTable minWidth="900px" persistKey="kubernetes-clusters-table">
+              <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                <thead class="bg-gray-50 dark:bg-gray-900/40">
+                  <tr>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('name')}>Cluster{sortIndicator('name')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('status')}>Status{sortIndicator('status')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Nodes</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Pods</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Deployments</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Version</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Last Seen</th>
+                  </tr>
+                </thead>
+                <tbody class="bg-white dark:bg-gray-800 divide-y divide-gray-200 dark:divide-gray-700">
+                  <For each={visibleClusters()} fallback={
+                    <tr><td colSpan={7} class="px-4 py-8 text-center text-sm text-gray-500 dark:text-gray-400">No clusters match the current filters.</td></tr>
+                  }>
+                    {(cluster) => {
+                      const indicator = () => getStatusIndicator(cluster.status);
+                      const nodes = () => summarizeNodes(cluster.nodes);
+                      const pods = () => summarizePods(cluster.pods);
+                      const deployments = () => summarizeDeployments(cluster.deployments);
+
+                      return (
+                        <tr class="hover:bg-gray-50 dark:hover:bg-gray-900/20">
+                          <td class="px-4 py-3 text-sm text-gray-900 dark:text-gray-100">
+                            <div class="flex items-center gap-2">
+                              <span class="font-medium">{getClusterDisplayName(cluster)}</span>
+                              <Show when={cluster.pendingUninstall}>
+                                <span class="text-[10px] px-2 py-0.5 rounded-full bg-amber-100 text-amber-800 dark:bg-amber-900/40 dark:text-amber-200">
+                                  Pending uninstall
+                                </span>
+                              </Show>
+                              <Show when={cluster.hidden}>
+                                <span class="text-[10px] px-2 py-0.5 rounded-full bg-gray-100 text-gray-700 dark:bg-gray-700 dark:text-gray-200">
+                                  Hidden
+                                </span>
+                              </Show>
+                            </div>
+                            <div class="text-xs text-gray-500 dark:text-gray-400 mt-0.5 truncate max-w-xs font-mono">
+                              {cluster.server || '—'}
+                            </div>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <div class="flex items-center gap-2">
+                              <StatusDot variant={indicator().variant} size="sm" />
+                              <span>{indicator().label}</span>
+                            </div>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <span class={nodes().notReady > 0 ? 'text-amber-600 dark:text-amber-400' : ''}>{nodes().total - nodes().notReady}</span>
+                            <span class="text-gray-400">/{nodes().total}</span>
+                            <Show when={nodes().notReady > 0}>
+                              <span class="ml-1 text-xs text-gray-400">ready</span>
+                            </Show>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <span class={pods().unhealthy > 0 ? 'text-amber-600 dark:text-amber-400' : ''}>{pods().total - pods().unhealthy}</span>
+                            <span class="text-gray-400">/{pods().total}</span>
+                            <Show when={pods().unhealthy > 0}>
+                              <span class="ml-1 text-xs text-gray-400">healthy</span>
+                            </Show>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <span class={deployments().unhealthy > 0 ? 'text-amber-600 dark:text-amber-400' : ''}>{deployments().total - deployments().unhealthy}</span>
+                            <span class="text-gray-400">/{deployments().total}</span>
+                            <Show when={deployments().unhealthy > 0}>
+                              <span class="ml-1 text-xs text-gray-400">ok</span>
+                            </Show>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-mono">
+                            {cluster.version || '—'}
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            {cluster.lastSeen ? formatRelativeTime(cluster.lastSeen) : '—'}
+                          </td>
+                        </tr>
+                      );
+                    }}
+                  </For>
+                </tbody>
+              </table>
+            </ScrollableTable>
+          </Show>
+
+          {/* Nodes View */}
+          <Show when={viewMode() === 'nodes'}>
+            <ScrollableTable minWidth="1000px" persistKey="kubernetes-nodes-table">
+              <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                <thead class="bg-gray-50 dark:bg-gray-900/40">
+                  <tr>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('name')}>Node{sortIndicator('name')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('cluster')}>Cluster{sortIndicator('cluster')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('status')}>Status{sortIndicator('status')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Roles</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">CPU</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Memory</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Pods</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Version</th>
+                  </tr>
+                </thead>
+                <tbody class="bg-white dark:bg-gray-800 divide-y divide-gray-200 dark:divide-gray-700">
+                  <For each={filteredNodes()} fallback={
+                    <tr><td colSpan={8} class="px-4 py-8 text-center text-sm text-gray-500 dark:text-gray-400">No nodes match the current filters.</td></tr>
+                  }>
+                    {({ cluster, node }) => {
+                      const isHealthy = () => node.ready && !node.unschedulable;
+                      const roles = () => (node.roles ?? []).join(', ') || 'worker';
+
+                      return (
+                        <tr class="hover:bg-gray-50 dark:hover:bg-gray-900/20">
+                          <td class="px-4 py-3 text-sm text-gray-900 dark:text-gray-100">
+                            <div class="font-medium">{node.name}</div>
+                            <div class="text-xs text-gray-500 dark:text-gray-400 truncate max-w-xs">
+                              {node.osImage || '—'}
+                            </div>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            {getClusterDisplayName(cluster)}
+                          </td>
+                          <td class="px-4 py-3 text-sm">
+                            <Show when={isHealthy()} fallback={
+                              <span class="inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-xs font-medium bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300">
+                                <span class="w-1.5 h-1.5 rounded-full bg-amber-500" />
+                                {!node.ready ? 'NotReady' : 'Unschedulable'}
+                              </span>
+                            }>
+                              <span class="inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300">
+                                <span class="w-1.5 h-1.5 rounded-full bg-green-500" />
+                                Ready
+                              </span>
+                            </Show>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <span class="px-2 py-0.5 rounded bg-gray-100 dark:bg-gray-700 text-xs">
+                              {roles()}
+                            </span>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-mono">
+                            {node.allocatableCpuCores ?? node.capacityCpuCores ?? '—'} cores
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-mono">
+                            {node.allocatableMemoryBytes ? formatBytes(node.allocatableMemoryBytes) : node.capacityMemoryBytes ? formatBytes(node.capacityMemoryBytes) : '—'}
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-mono">
+                            {node.allocatablePods ?? node.capacityPods ?? '—'}
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-mono">
+                            {node.kubeletVersion || '—'}
+                          </td>
+                        </tr>
+                      );
+                    }}
+                  </For>
+                </tbody>
+              </table>
+            </ScrollableTable>
+          </Show>
+
+          {/* Pods View */}
+          <Show when={viewMode() === 'pods'}>
+            <ScrollableTable minWidth="800px" persistKey="kubernetes-pods-table">
+              <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                <thead class="bg-gray-50 dark:bg-gray-900/40">
+                  <tr>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('name')}>Pod{sortIndicator('name')}</th>
+                    <Show when={podColumns.isColumnVisible('namespace')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('namespace')}>Namespace{sortIndicator('namespace')}</th>
+                    </Show>
+                    <Show when={podColumns.isColumnVisible('cluster')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('cluster')}>Cluster{sortIndicator('cluster')}</th>
+                    </Show>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('status')}>Status{sortIndicator('status')}</th>
+                    <Show when={podColumns.isColumnVisible('ready')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('ready')}>Ready{sortIndicator('ready')}</th>
+                    </Show>
+                    <Show when={podColumns.isColumnVisible('restarts')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('restarts')}>Restarts{sortIndicator('restarts')}</th>
+                    </Show>
+                    <Show when={podColumns.isColumnVisible('image')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Image</th>
+                    </Show>
+                    <Show when={podColumns.isColumnVisible('age')}>
+                      <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('age')}>Age{sortIndicator('age')}</th>
+                    </Show>
+                  </tr>
+                </thead>
+                <tbody class="bg-white dark:bg-gray-800 divide-y divide-gray-200 dark:divide-gray-700">
+                  <For each={filteredPods()} fallback={
+                    <tr><td colSpan={8} class="px-4 py-8 text-center text-sm text-gray-500 dark:text-gray-400">No pods match the current filters.</td></tr>
+                  }>
+                    {({ cluster, pod }) => {
+                      const statusBadge = () => getPodStatusBadge(pod);
+                      const containers = () => pod.containers ?? [];
+                      const readyContainers = () => containers().filter(c => c.ready).length;
+
+                      return (
+                        <tr class="hover:bg-gray-50 dark:hover:bg-gray-900/20">
+                          <td class="px-4 py-3 text-sm text-gray-900 dark:text-gray-100">
+                            <div class="font-medium truncate max-w-[200px]" title={pod.name}>{pod.name}</div>
+                            <div class="text-xs text-gray-500 dark:text-gray-400 truncate">
+                              {pod.nodeName || 'unscheduled'}
+                            </div>
+                          </td>
+                          <Show when={podColumns.isColumnVisible('namespace')}>
+                            <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                              <span class="px-2 py-0.5 rounded bg-gray-100 dark:bg-gray-700 text-xs font-mono">
+                                {pod.namespace}
+                              </span>
+                            </td>
+                          </Show>
+                          <Show when={podColumns.isColumnVisible('cluster')}>
+                            <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                              {getClusterDisplayName(cluster)}
+                            </td>
+                          </Show>
+                          <td class="px-4 py-3 text-sm">
+                            <span class={`inline-flex px-2 py-0.5 rounded-full text-xs font-medium ${statusBadge().class}`}>
+                              {statusBadge().label}
+                            </span>
+                          </td>
+                          <Show when={podColumns.isColumnVisible('ready')}>
+                            <td class="px-4 py-3 text-sm">
+                              <span class={readyContainers() === containers().length ? 'text-green-600 dark:text-green-400' : 'text-amber-600 dark:text-amber-400'}>
+                                {readyContainers()}/{containers().length}
+                              </span>
+                            </td>
+                          </Show>
+                          <Show when={podColumns.isColumnVisible('restarts')}>
+                            <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                              <Show when={(pod.restarts ?? 0) > 0} fallback={<span class="text-gray-400">0</span>}>
+                                <span class="text-amber-600 dark:text-amber-400 font-medium">{pod.restarts}</span>
+                              </Show>
+                            </td>
+                          </Show>
+                          <Show when={podColumns.isColumnVisible('image')}>
+                            <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                              <span class="font-mono text-xs truncate max-w-[150px] block" title={(pod.containers ?? [])[0]?.image}>
+                                {getPrimaryImage(pod)}
+                              </span>
+                            </td>
+                          </Show>
+                          <Show when={podColumns.isColumnVisible('age')}>
+                            <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 whitespace-nowrap">
+                              {formatAge(pod.createdAt)}
+                            </td>
+                          </Show>
+                        </tr>
+                      );
+                    }}
+                  </For>
+                </tbody>
+              </table>
+            </ScrollableTable>
+          </Show>
+
+          {/* Deployments View */}
+          <Show when={viewMode() === 'deployments'}>
+            <ScrollableTable minWidth="800px" persistKey="kubernetes-deployments-table">
+              <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                <thead class="bg-gray-50 dark:bg-gray-900/40">
+                  <tr>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('name')}>Deployment{sortIndicator('name')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('namespace')}>Namespace{sortIndicator('namespace')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('cluster')}>Cluster{sortIndicator('cluster')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('status')}>Status{sortIndicator('status')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('replicas')}>Replicas{sortIndicator('replicas')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider cursor-pointer hover:text-gray-700 dark:hover:text-gray-200" onClick={() => toggleSort('ready')}>Ready{sortIndicator('ready')}</th>
+                    <th class="px-4 py-3 text-left text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wider">Up-to-date</th>
+                  </tr>
+                </thead>
+                <tbody class="bg-white dark:bg-gray-800 divide-y divide-gray-200 dark:divide-gray-700">
+                  <For each={filteredDeployments()} fallback={
+                    <tr><td colSpan={7} class="px-4 py-8 text-center text-sm text-gray-500 dark:text-gray-400">No deployments match the current filters.</td></tr>
+                  }>
+                    {({ cluster, deployment }) => {
+                      const healthy = () => isDeploymentHealthy(deployment);
+                      const desired = () => deployment.desiredReplicas ?? 0;
+                      const ready = () => deployment.readyReplicas ?? 0;
+                      const updated = () => deployment.updatedReplicas ?? 0;
+
+                      return (
+                        <tr class="hover:bg-gray-50 dark:hover:bg-gray-900/20">
+                          <td class="px-4 py-3 text-sm text-gray-900 dark:text-gray-100">
+                            <div class="font-medium">{deployment.name}</div>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            <span class="px-2 py-0.5 rounded bg-gray-100 dark:bg-gray-700 text-xs font-mono">
+                              {deployment.namespace}
+                            </span>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300">
+                            {getClusterDisplayName(cluster)}
+                          </td>
+                          <td class="px-4 py-3 text-sm">
+                            <Show when={healthy()} fallback={
+                              <span class="inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-xs font-medium bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300">
+                                <span class="w-1.5 h-1.5 rounded-full bg-amber-500" />
+                                Progressing
+                              </span>
+                            }>
+                              <span class="inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-xs font-medium bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300">
+                                <span class="w-1.5 h-1.5 rounded-full bg-green-500" />
+                                Available
+                              </span>
+                            </Show>
+                          </td>
+                          <td class="px-4 py-3 text-sm text-gray-700 dark:text-gray-300 font-medium">
+                            {desired()}
+                          </td>
+                          <td class="px-4 py-3 text-sm">
+                            <span class={ready() >= desired() ? 'text-green-600 dark:text-green-400' : 'text-amber-600 dark:text-amber-400'}>
+                              {ready()}/{desired()}
+                            </span>
+                          </td>
+                          <td class="px-4 py-3 text-sm">
+                            <span class={updated() >= desired() ? 'text-green-600 dark:text-green-400' : 'text-amber-600 dark:text-amber-400'}>
+                              {updated()}/{desired()}
+                            </span>
+                          </td>
+                        </tr>
+                      );
+                    }}
+                  </For>
+                </tbody>
+              </table>
+            </ScrollableTable>
+          </Show>
+        </Show>
+      </Card>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Login.tsx b/frontend-modern/src/components/Login.tsx
index 4c0133c..e59efe5 100644
--- a/frontend-modern/src/components/Login.tsx
+++ b/frontend-modern/src/components/Login.tsx
@@ -2,12 +2,13 @@ import { Component, createSignal, Show, onMount, lazy, Suspense } from 'solid-js
 import { logger } from '@/utils/logger';
 import { STORAGE_KEYS } from '@/utils/localStorage';
 
-const FirstRunSetup = lazy(() =>
-  import('./FirstRunSetup').then((m) => ({ default: m.FirstRunSetup })),
+const SetupWizard = lazy(() =>
+  import('./SetupWizard').then((m) => ({ default: m.SetupWizard })),
 );
 
 interface LoginProps {
   onLogin: () => void;
+  hasAuth?: boolean; // If true, auth is configured (passed from App.tsx to skip redundant check)
 }
 
 interface SecurityStatus {
@@ -30,7 +31,8 @@ export const Login: Component<LoginProps> = (props) => {
   const [error, setError] = createSignal('');
   const [loading, setLoading] = createSignal(false);
   const [authStatus, setAuthStatus] = createSignal<SecurityStatus | null>(null);
-  const [loadingAuth, setLoadingAuth] = createSignal(true);
+  // If hasAuth is passed from App.tsx, we already know auth status - skip the loading state
+  const [loadingAuth, setLoadingAuth] = createSignal(props.hasAuth === undefined);
   const [oidcLoading, setOidcLoading] = createSignal(false);
   const [oidcError, setOidcError] = createSignal('');
   const [oidcMessage, setOidcMessage] = createSignal('');
@@ -96,6 +98,15 @@ export const Login: Component<LoginProps> = (props) => {
       window.history.replaceState({}, document.title, newUrl);
     }
 
+    // If hasAuth was passed from App.tsx, use it directly without making another API call
+    // This eliminates the flicker between "Checking authentication..." and the login form
+    if (props.hasAuth !== undefined) {
+      logger.debug('[Login] Using hasAuth from App.tsx, skipping redundant auth check');
+      setAuthStatus({ hasAuthentication: props.hasAuth });
+      setLoadingAuth(false);
+      return;
+    }
+
     logger.debug('[Login] Starting auth check...');
     try {
       const response = await fetch('/api/security/status');
@@ -328,9 +339,8 @@ export const Login: Component<LoginProps> = (props) => {
             </div>
           }
         >
-          <FirstRunSetup
-            force={legacyDisableAuth()}
-            showLegacyBanner={legacyDisableAuth()}
+          <SetupWizard
+            onComplete={() => window.location.reload()}
           />
         </Suspense>
       </Show>
diff --git a/frontend-modern/src/components/PMG/MailGateway.tsx b/frontend-modern/src/components/PMG/MailGateway.tsx
index ea24f38..131de10 100644
--- a/frontend-modern/src/components/PMG/MailGateway.tsx
+++ b/frontend-modern/src/components/PMG/MailGateway.tsx
@@ -1,9 +1,18 @@
-import { Component, Show, For, createMemo } from 'solid-js';
+import { Component, Show, For, createMemo, createSignal, createEffect, onCleanup } from 'solid-js';
+import { Portal } from 'solid-js/web';
 import { useWebSocket } from '@/App';
 import { ProxmoxSectionNav } from '@/components/Proxmox/ProxmoxSectionNav';
 import { Card } from '@/components/shared/Card';
 import { EmptyState } from '@/components/shared/EmptyState';
-import { formatRelativeTime } from '@/utils/format';
+import { formatRelativeTime, formatBytes } from '@/utils/format';
+
+// Format large numbers with K/M suffixes
+const formatCompact = (value?: number | null): string => {
+  if (value === undefined || value === null || Number.isNaN(value)) return '—';
+  if (value >= 1000000) return `${(value / 1000000).toFixed(1)}M`;
+  if (value >= 1000) return `${(value / 1000).toFixed(1)}K`;
+  return Math.round(value).toLocaleString();
+};
 
 const formatNum = (value?: number | null) => {
   if (value === undefined || value === null || Number.isNaN(value)) return '—';
@@ -15,21 +24,280 @@ const formatDec = (value?: number | null, digits = 1) => {
   return value.toFixed(digits);
 };
 
+const formatPct = (value?: number | null) => {
+  if (value === undefined || value === null || Number.isNaN(value)) return '0%';
+  return `${value.toFixed(1)}%`;
+};
+
 const parseTimestamp = (value?: string) => {
   if (!value) return undefined;
   const time = Date.parse(value);
   return Number.isNaN(time) ? undefined : time;
 };
 
-const MailGateway: Component = () => {
-  const { state, connected, reconnecting, reconnect } = useWebSocket();
-  const instances = createMemo(() => state.pmg ?? []);
+// Threat rate bar component
+const ThreatBar: Component<{
+  percent: number;
+  color: 'spam' | 'virus' | 'quarantine';
+  label: string;
+  count: number;
+}> = (props) => {
+  const barColor = () => {
+    switch (props.color) {
+      case 'spam': return 'bg-orange-500';
+      case 'virus': return 'bg-red-500';
+      case 'quarantine': return 'bg-yellow-500';
+    }
+  };
+
+  const textColor = () => {
+    switch (props.color) {
+      case 'spam': return 'text-orange-600 dark:text-orange-400';
+      case 'virus': return 'text-red-600 dark:text-red-400';
+      case 'quarantine': return 'text-yellow-600 dark:text-yellow-400';
+    }
+  };
 
   return (
-    <div class="space-y-3">
+    <div class="space-y-1">
+      <div class="flex items-center justify-between text-xs">
+        <span class="text-gray-600 dark:text-gray-400">{props.label}</span>
+        <span class={`font-medium ${textColor()}`}>
+          {formatCompact(props.count)} ({formatPct(props.percent)})
+        </span>
+      </div>
+      <div class="h-1.5 bg-gray-200 dark:bg-gray-700 rounded-full overflow-hidden">
+        <div
+          class={`h-full ${barColor()} transition-all duration-500 rounded-full`}
+          style={{ width: `${Math.min(props.percent * 10, 100)}%` }} // Scale up for visibility (10% threat = full bar)
+        />
+      </div>
+    </div>
+  );
+};
+
+// Instance status badge
+const StatusBadge: Component<{ status: string; health?: string }> = (props) => {
+  const statusInfo = createMemo(() => {
+    const status = (props.health || props.status || '').toLowerCase();
+    if (status.includes('healthy') || status === 'online') {
+      return { bg: 'bg-green-100 dark:bg-green-900/30', text: 'text-green-700 dark:text-green-400', dot: 'bg-green-500', label: 'Healthy' };
+    }
+    if (status.includes('degraded') || status.includes('warning')) {
+      return { bg: 'bg-yellow-100 dark:bg-yellow-900/30', text: 'text-yellow-700 dark:text-yellow-400', dot: 'bg-yellow-500', label: 'Degraded' };
+    }
+    if (status.includes('error') || status === 'offline') {
+      return { bg: 'bg-red-100 dark:bg-red-900/30', text: 'text-red-700 dark:text-red-400', dot: 'bg-red-500', label: 'Offline' };
+    }
+    return { bg: 'bg-gray-100 dark:bg-gray-800', text: 'text-gray-600 dark:text-gray-400', dot: 'bg-gray-400', label: status || 'Unknown' };
+  });
+
+  return (
+    <span class={`inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-[10px] font-semibold uppercase ${statusInfo().bg} ${statusInfo().text}`}>
+      <span class={`w-1.5 h-1.5 rounded-full ${statusInfo().dot}`} />
+      {statusInfo().label}
+    </span>
+  );
+};
+
+// Queue depth indicator with tooltip
+const QueueIndicator: Component<{ queue?: { total: number; active?: number; deferred?: number; hold?: number; incoming?: number; oldestAge?: number } }> = (props) => {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const queueTotal = () => props.queue?.total || 0;
+  const hasQueue = () => queueTotal() > 0;
+
+  const queueSeverity = () => {
+    const total = queueTotal();
+    if (total > 100) return 'high';
+    if (total > 20) return 'medium';
+    return 'low';
+  };
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    if (!props.queue) return;
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  return (
+    <>
+      <div
+        class="cursor-help"
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={() => setShowTooltip(false)}
+      >
+        <Show when={hasQueue()} fallback={
+          <span class="text-xs text-gray-400">Empty</span>
+        }>
+          <span class={`text-xs font-medium ${queueSeverity() === 'high' ? 'text-red-600 dark:text-red-400' :
+            queueSeverity() === 'medium' ? 'text-yellow-600 dark:text-yellow-400' :
+              'text-green-600 dark:text-green-400'
+            }`}>
+            {formatNum(queueTotal())} msgs
+          </span>
+        </Show>
+      </div>
+
+      <Show when={showTooltip() && props.queue}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-xs rounded-md shadow-lg px-3 py-2 min-w-[140px] border border-gray-700">
+              <div class="font-medium mb-1.5 text-gray-300 border-b border-gray-700 pb-1">Queue Breakdown</div>
+              <div class="space-y-0.5 text-[11px]">
+                <div class="flex justify-between"><span class="text-gray-400">Active</span><span>{props.queue?.active || 0}</span></div>
+                <div class="flex justify-between"><span class="text-gray-400">Deferred</span><span>{props.queue?.deferred || 0}</span></div>
+                <div class="flex justify-between"><span class="text-gray-400">Hold</span><span>{props.queue?.hold || 0}</span></div>
+                <div class="flex justify-between"><span class="text-gray-400">Incoming</span><span>{props.queue?.incoming || 0}</span></div>
+                <Show when={(props.queue?.oldestAge || 0) > 0}>
+                  <div class="flex justify-between pt-1 mt-1 border-t border-gray-700">
+                    <span class="text-gray-400">Oldest</span>
+                    <span class={(props.queue?.oldestAge || 0) > 1800 ? 'text-yellow-400' : ''}>
+                      {Math.floor((props.queue?.oldestAge || 0) / 60)}m
+                    </span>
+                  </div>
+                </Show>
+              </div>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+};
+
+const MailGateway: Component = () => {
+  const { state, connected, reconnecting, reconnect, initialDataReceived } = useWebSocket();
+
+  const [searchTerm, setSearchTerm] = createSignal('');
+  let searchInputRef: HTMLInputElement | undefined;
+
+  // Keyboard handler for type-to-search
+  createEffect(() => {
+    const handleKeyDown = (e: KeyboardEvent) => {
+      const target = e.target as HTMLElement;
+      const isInputField =
+        target.tagName === 'INPUT' ||
+        target.tagName === 'TEXTAREA' ||
+        target.tagName === 'SELECT' ||
+        target.contentEditable === 'true';
+
+      if (e.key === 'Escape') {
+        if (searchTerm().trim()) {
+          setSearchTerm('');
+          searchInputRef?.blur();
+        }
+      } else if (!isInputField && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
+        if (searchInputRef) {
+          searchInputRef.focus();
+        }
+      }
+    };
+
+    document.addEventListener('keydown', handleKeyDown);
+    onCleanup(() => document.removeEventListener('keydown', handleKeyDown));
+  });
+
+  const instances = createMemo(() => state.pmg ?? []);
+  const hasInstances = createMemo(() => instances().length > 0);
+
+  // Filter instances by search
+  const filteredInstances = createMemo(() => {
+    const term = searchTerm().toLowerCase().trim();
+    if (!term) return instances();
+    return instances().filter(pmg =>
+      pmg.name.toLowerCase().includes(term) ||
+      (pmg.host || '').toLowerCase().includes(term) ||
+      (pmg.version || '').toLowerCase().includes(term)
+    );
+  });
+
+  // Aggregate stats across all instances
+  const aggregateStats = createMemo(() => {
+    const pmgs = instances();
+    let totalMail = 0;
+    let totalSpam = 0;
+    let totalVirus = 0;
+    let totalQuarantine = 0;
+    let totalQueue = 0;
+    let healthyCount = 0;
+    let issueCount = 0;
+
+    for (const pmg of pmgs) {
+      totalMail += pmg.mailStats?.countTotal || 0;
+      totalSpam += pmg.mailStats?.spamIn || 0;
+      totalVirus += pmg.mailStats?.virusIn || 0;
+
+      const q = pmg.quarantine;
+      if (q) {
+        totalQuarantine += (q.spam || 0) + (q.virus || 0) + (q.attachment || 0) + (q.blacklisted || 0);
+      }
+
+      // Sum queue across all nodes
+      if (pmg.nodes) {
+        for (const node of pmg.nodes) {
+          totalQueue += node.queueStatus?.total || 0;
+        }
+      }
+
+      const status = (pmg.connectionHealth || pmg.status || '').toLowerCase();
+      if (status.includes('healthy') || status === 'online') {
+        healthyCount++;
+      } else {
+        issueCount++;
+      }
+    }
+
+    const spamRate = totalMail > 0 ? (totalSpam / totalMail) * 100 : 0;
+    const virusRate = totalMail > 0 ? (totalVirus / totalMail) * 100 : 0;
+
+    return {
+      totalMail,
+      totalSpam,
+      totalVirus,
+      totalQuarantine,
+      totalQueue,
+      spamRate,
+      virusRate,
+      healthyCount,
+      issueCount,
+      instanceCount: pmgs.length,
+    };
+  });
+
+  const isLoading = createMemo(() => connected() && !initialDataReceived());
+
+  return (
+    <div class="space-y-4">
       <ProxmoxSectionNav current="mail" />
 
-      <Show when={!connected()}>
+      {/* Loading State */}
+      <Show when={isLoading()}>
+        <Card padding="lg">
+          <EmptyState
+            icon={
+              <svg class="h-12 w-12 animate-spin text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+              </svg>
+            }
+            title="Loading mail gateway data..."
+            description="Connecting to the monitoring service."
+          />
+        </Card>
+      </Show>
+
+      {/* Disconnected State */}
+      <Show when={!connected() && !isLoading()}>
         <Card padding="lg" tone="danger">
           <EmptyState
             icon={
@@ -38,11 +306,7 @@ const MailGateway: Component = () => {
               </svg>
             }
             title="Connection lost"
-            description={
-              reconnecting()
-                ? 'Attempting to reconnect…'
-                : 'Unable to connect to the backend server'
-            }
+            description={reconnecting() ? 'Attempting to reconnect…' : 'Unable to connect to the backend server'}
             tone="danger"
             actions={
               !reconnecting() ? (
@@ -58,430 +322,438 @@ const MailGateway: Component = () => {
         </Card>
       </Show>
 
-      <Show when={connected()}>
-        <Show when={instances().length === 0}>
+      <Show when={connected() && initialDataReceived()}>
+        {/* No Instances Empty State */}
+        <Show when={!hasInstances()}>
           <Card padding="lg">
             <EmptyState
               icon={
-                <svg class="h-12 w-12 text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A9 9 0 105.64 5.64a9 9 0 0014.978 0z" />
+                <svg class="h-12 w-12 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M21.75 6.75v10.5a2.25 2.25 0 01-2.25 2.25h-15a2.25 2.25 0 01-2.25-2.25V6.75m19.5 0A2.25 2.25 0 0019.5 4.5h-15a2.25 2.25 0 00-2.25 2.25m19.5 0v.243a2.25 2.25 0 01-1.07 1.916l-7.5 4.615a2.25 2.25 0 01-2.36 0L3.32 8.91a2.25 2.25 0 01-1.07-1.916V6.75" />
                 </svg>
               }
               title="No Mail Gateways configured"
-              description="Add a Proxmox Mail Gateway via Settings → Nodes to start collecting mail analytics."
+              description="Add a Proxmox Mail Gateway via Settings → Nodes to start collecting mail analytics and security metrics."
             />
           </Card>
         </Show>
 
-        <For each={instances()}>
-          {(pmg) => {
-            const statusTone = (pmg.connectionHealth || pmg.status || '').toLowerCase();
-            const isHealthy = statusTone.includes('healthy') || (pmg.status || '').toLowerCase() === 'online';
-            const isWarning = statusTone.includes('degraded') || statusTone.includes('warning');
-            const dotClass = isHealthy ? 'bg-green-500' : isWarning ? 'bg-amber-500' : 'bg-red-500';
-
-            const lastUpdated = () => {
-              const ts = parseTimestamp(pmg.mailStats?.updatedAt) ?? parseTimestamp(pmg.lastUpdated) ?? parseTimestamp(pmg.lastSeen);
-              return ts ? formatRelativeTime(ts) : '—';
-            };
-
-            const total = pmg.mailStats?.countTotal || 0;
-            const inbound = pmg.mailStats?.countIn || 0;
-            const outbound = pmg.mailStats?.countOut || 0;
-            const spam = pmg.mailStats?.spamIn || 0;
-            const virus = pmg.mailStats?.virusIn || 0;
-            const bouncesIn = pmg.mailStats?.bouncesIn || 0;
-            const bouncesOut = pmg.mailStats?.bouncesOut || 0;
-            const bytesIn = pmg.mailStats?.bytesIn || 0;
-            const bytesOut = pmg.mailStats?.bytesOut || 0;
-            const rbl = pmg.mailStats?.rblRejects || 0;
-            const pregreet = pmg.mailStats?.pregreetRejects || 0;
-            const greylist = pmg.mailStats?.greylistCount || 0;
-            const junk = pmg.mailStats?.junkIn || 0;
-
-            const qSpam = pmg.quarantine?.spam || 0;
-            const qVirus = pmg.quarantine?.virus || 0;
-            const qAttachment = pmg.quarantine?.attachment || 0;
-            const qBlacklist = pmg.quarantine?.blacklisted || 0;
-            const qTotal = qSpam + qVirus + qAttachment + qBlacklist;
-
-            const spamPct = (spam / Math.max(total, 1)) * 100;
-            const virusPct = (virus / Math.max(total, 1)) * 100;
-            const inboundPct = (inbound / Math.max(total, 1)) * 100;
-            const outboundPct = (outbound / Math.max(total, 1)) * 100;
-            const rblPct = (rbl / Math.max(inbound, 1)) * 100;
-
-            return (
-              <Card padding="none" tone="glass" class="overflow-hidden">
-                {/* Instance Header Strip */}
-                <div class="sticky top-0 z-10 flex items-center justify-between px-3 py-2 bg-gray-50 dark:bg-gray-800/40 border-b border-gray-200 dark:border-gray-700">
-                  <div class="flex items-center gap-3">
-                    <span class={`h-2.5 w-2.5 rounded-full ${dotClass}`} />
-                    <a
-                      href={pmg.host || `https://${pmg.name}:8006`}
-                      target="_blank"
-                      rel="noopener noreferrer"
-                      class="text-sm font-semibold text-gray-900 dark:text-gray-100 hover:text-blue-600 dark:hover:text-blue-400"
-                    >
-                      {pmg.name}
-                    </a>
-                    <span class="text-xs text-gray-500 dark:text-gray-400">v{pmg.version || '?'}</span>
-                    <span class="text-xs text-gray-500 dark:text-gray-400">•</span>
-                    <span class="text-xs text-gray-500 dark:text-gray-400 capitalize">{pmg.status || 'unknown'}</span>
+        {/* Has Instances - Show Content */}
+        <Show when={hasInstances()}>
+          {/* Summary Cards */}
+          <div class="grid gap-3 grid-cols-2 lg:grid-cols-5">
+            {/* Total Mail */}
+            <Card padding="sm" tone="glass">
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Mail (24h)</div>
+                  <div class="text-2xl font-bold text-gray-900 dark:text-gray-100 mt-1">
+                    {formatCompact(aggregateStats().totalMail)}
                   </div>
                   <div class="text-xs text-gray-500 dark:text-gray-400">
-                    Updated {lastUpdated()}
+                    ~{formatNum(Math.round(aggregateStats().totalMail / 24))}/hr
                   </div>
                 </div>
+                <div class="p-2 bg-blue-100 dark:bg-blue-900/30 rounded-lg">
+                  <svg class="w-5 h-5 text-blue-600 dark:text-blue-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M21.75 6.75v10.5a2.25 2.25 0 01-2.25 2.25h-15a2.25 2.25 0 01-2.25-2.25V6.75m19.5 0A2.25 2.25 0 0019.5 4.5h-15a2.25 2.25 0 00-2.25 2.25m19.5 0v.243a2.25 2.25 0 01-1.07 1.916l-7.5 4.615a2.25 2.25 0 01-2.36 0L3.32 8.91a2.25 2.25 0 01-1.07-1.916V6.75" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
 
-                {/* 3-Column Detail Grid */}
-                <div class="p-3 space-y-3">
-                  <div class="grid grid-cols-1 lg:grid-cols-3 gap-3">
-                    {/* LEFT COLUMN: Mail Flow + Traffic Volume */}
-                    <div class="space-y-3">
-                      {/* Mail Flow Table */}
-                      <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                        <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                          <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                            Mail Flow (24h)
-                          </h4>
+            {/* Spam Rate */}
+            <Card padding="sm" tone={aggregateStats().spamRate > 50 ? 'warning' : 'glass'}>
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Spam</div>
+                  <div class={`text-2xl font-bold mt-1 ${aggregateStats().spamRate > 50 ? 'text-orange-600 dark:text-orange-400' : 'text-gray-900 dark:text-gray-100'}`}>
+                    {formatPct(aggregateStats().spamRate)}
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    {formatCompact(aggregateStats().totalSpam)} caught
+                  </div>
+                </div>
+                <div class={`p-2 rounded-lg ${aggregateStats().spamRate > 50 ? 'bg-orange-100 dark:bg-orange-900/30' : 'bg-orange-100 dark:bg-orange-900/30'}`}>
+                  <svg class="w-5 h-5 text-orange-600 dark:text-orange-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+
+            {/* Virus Blocked */}
+            <Card padding="sm" tone={aggregateStats().totalVirus > 0 ? 'danger' : 'glass'}>
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Viruses</div>
+                  <div class={`text-2xl font-bold mt-1 ${aggregateStats().totalVirus > 0 ? 'text-red-600 dark:text-red-400' : 'text-gray-900 dark:text-gray-100'}`}>
+                    {formatCompact(aggregateStats().totalVirus)}
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    blocked today
+                  </div>
+                </div>
+                <div class={`p-2 rounded-lg ${aggregateStats().totalVirus > 0 ? 'bg-red-100 dark:bg-red-900/30' : 'bg-gray-100 dark:bg-gray-800'}`}>
+                  <svg class={`w-5 h-5 ${aggregateStats().totalVirus > 0 ? 'text-red-600 dark:text-red-400' : 'text-gray-400'}`} fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m0-10.036A11.959 11.959 0 013.598 6 11.99 11.99 0 003 9.75c0 5.592 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.31-.21-2.57-.598-3.75h-.152c-3.196 0-6.1-1.249-8.25-3.286zm0 13.036h.008v.008H12v-.008z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+
+            {/* Quarantine */}
+            <Card padding="sm" tone="glass">
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Quarantine</div>
+                  <div class="text-2xl font-bold text-gray-900 dark:text-gray-100 mt-1">
+                    {formatCompact(aggregateStats().totalQuarantine)}
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    items held
+                  </div>
+                </div>
+                <div class="p-2 bg-yellow-100 dark:bg-yellow-900/30 rounded-lg">
+                  <svg class="w-5 h-5 text-yellow-600 dark:text-yellow-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M20.25 7.5l-.625 10.632a2.25 2.25 0 01-2.247 2.118H6.622a2.25 2.25 0 01-2.247-2.118L3.75 7.5m6 4.125l2.25 2.25m0 0l2.25 2.25M12 13.875l2.25-2.25M12 13.875l-2.25 2.25M3.375 7.5h17.25c.621 0 1.125-.504 1.125-1.125v-1.5c0-.621-.504-1.125-1.125-1.125H3.375c-.621 0-1.125.504-1.125 1.125v1.5c0 .621.504 1.125 1.125 1.125z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+
+            {/* Queue Status */}
+            <Card padding="sm" tone={aggregateStats().totalQueue > 50 ? 'warning' : 'glass'}>
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Queue</div>
+                  <div class={`text-2xl font-bold mt-1 ${aggregateStats().totalQueue > 100 ? 'text-red-600 dark:text-red-400' :
+                    aggregateStats().totalQueue > 20 ? 'text-yellow-600 dark:text-yellow-400' :
+                      'text-green-600 dark:text-green-400'
+                    }`}>
+                    {formatNum(aggregateStats().totalQueue)}
+                  </div>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    {aggregateStats().totalQueue === 0 ? 'all clear' : 'pending'}
+                  </div>
+                </div>
+                <div class={`p-2 rounded-lg ${aggregateStats().totalQueue > 50 ? 'bg-yellow-100 dark:bg-yellow-900/30' : 'bg-green-100 dark:bg-green-900/30'
+                  }`}>
+                  <svg class={`w-5 h-5 ${aggregateStats().totalQueue > 50 ? 'text-yellow-600 dark:text-yellow-400' : 'text-green-600 dark:text-green-400'
+                    }`} fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M3.75 12h16.5m-16.5 3.75h16.5M3.75 19.5h16.5M5.625 4.5h12.75a1.875 1.875 0 010 3.75H5.625a1.875 1.875 0 010-3.75z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+          </div>
+
+          {/* Search Bar (only show if multiple instances) */}
+          <Show when={instances().length > 1}>
+            <Card padding="sm" tone="glass">
+              <div class="relative max-w-md">
+                <input
+                  ref={(el) => (searchInputRef = el)}
+                  type="text"
+                  placeholder="Search gateways..."
+                  value={searchTerm()}
+                  onInput={(e) => setSearchTerm(e.currentTarget.value)}
+                  class="w-full pl-9 pr-8 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg 
+                         bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500
+                         focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+                />
+                <svg class="absolute left-3 top-2 h-4 w-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
+                </svg>
+                <Show when={searchTerm()}>
+                  <button
+                    onClick={() => setSearchTerm('')}
+                    class="absolute right-2.5 top-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300"
+                  >
+                    <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+                    </svg>
+                  </button>
+                </Show>
+              </div>
+            </Card>
+          </Show>
+
+          {/* Instance Cards */}
+          <Show
+            when={filteredInstances().length > 0}
+            fallback={
+              <Card padding="lg">
+                <div class="text-center py-4">
+                  <svg class="w-10 h-10 text-gray-300 dark:text-gray-600 mx-auto mb-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M21 21l-5.197-5.197m0 0A7.5 7.5 0 105.196 5.196a7.5 7.5 0 0010.607 10.607z" />
+                  </svg>
+                  <div class="text-gray-500 dark:text-gray-400 text-sm">No gateways match "{searchTerm()}"</div>
+                  <button
+                    onClick={() => setSearchTerm('')}
+                    class="mt-2 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+                  >
+                    Clear search
+                  </button>
+                </div>
+              </Card>
+            }
+          >
+            <div class="space-y-4">
+              <For each={filteredInstances()}>
+                {(pmg) => {
+                  const lastUpdated = () => {
+                    const ts = parseTimestamp(pmg.mailStats?.updatedAt) ?? parseTimestamp(pmg.lastUpdated) ?? parseTimestamp(pmg.lastSeen);
+                    return ts ? formatRelativeTime(ts) : '—';
+                  };
+
+                  const stats = createMemo(() => {
+                    const m = pmg.mailStats;
+                    const total = m?.countTotal || 0;
+                    const inbound = m?.countIn || 0;
+                    const outbound = m?.countOut || 0;
+                    const spam = m?.spamIn || 0;
+                    const virus = m?.virusIn || 0;
+                    const bytesIn = m?.bytesIn || 0;
+                    const bytesOut = m?.bytesOut || 0;
+                    const rbl = m?.rblRejects || 0;
+                    const pregreet = m?.pregreetRejects || 0;
+                    const greylist = m?.greylistCount || 0;
+                    const bouncesIn = m?.bouncesIn || 0;
+                    const bouncesOut = m?.bouncesOut || 0;
+
+                    const q = pmg.quarantine;
+                    const qSpam = q?.spam || 0;
+                    const qVirus = q?.virus || 0;
+                    const qAttachment = q?.attachment || 0;
+                    const qBlacklist = q?.blacklisted || 0;
+                    const qTotal = qSpam + qVirus + qAttachment + qBlacklist;
+
+                    const spamPct = total > 0 ? (spam / total) * 100 : 0;
+                    const virusPct = total > 0 ? (virus / total) * 100 : 0;
+                    const quarantinePct = inbound > 0 ? (qTotal / inbound) * 100 : 0;
+
+                    return {
+                      total, inbound, outbound, spam, virus, bytesIn, bytesOut,
+                      rbl, pregreet, greylist, bouncesIn, bouncesOut,
+                      qSpam, qVirus, qAttachment, qBlacklist, qTotal,
+                      spamPct, virusPct, quarantinePct,
+                    };
+                  });
+
+                  // Get aggregate queue for this instance
+                  const instanceQueue = createMemo(() => {
+                    if (!pmg.nodes) return { total: 0 };
+                    let total = 0, active = 0, deferred = 0, hold = 0, incoming = 0, oldestAge = 0;
+                    for (const node of pmg.nodes) {
+                      const q = node.queueStatus;
+                      if (q) {
+                        total += q.total || 0;
+                        active += q.active || 0;
+                        deferred += q.deferred || 0;
+                        hold += q.hold || 0;
+                        incoming += q.incoming || 0;
+                        if ((q.oldestAge || 0) > oldestAge) oldestAge = q.oldestAge || 0;
+                      }
+                    }
+                    return { total, active, deferred, hold, incoming, oldestAge };
+                  });
+
+                  return (
+                    <Card padding="none" tone="glass" class="overflow-hidden">
+                      {/* Instance Header */}
+                      <div class="flex flex-col sm:flex-row sm:items-center justify-between gap-2 px-4 py-3 bg-gray-50/50 dark:bg-gray-800/40 border-b border-gray-200 dark:border-gray-700">
+                        <div class="flex items-center gap-3">
+                          <a
+                            href={pmg.host || `https://${pmg.name}:8006`}
+                            target="_blank"
+                            rel="noopener noreferrer"
+                            class="text-base font-semibold text-gray-900 dark:text-gray-100 hover:text-blue-600 dark:hover:text-blue-400 transition-colors"
+                          >
+                            {pmg.name}
+                          </a>
+                          <StatusBadge status={pmg.status || ''} health={pmg.connectionHealth} />
+                          <Show when={pmg.version}>
+                            <span class="text-xs text-gray-500 dark:text-gray-400 bg-gray-100 dark:bg-gray-700 px-1.5 py-0.5 rounded">
+                              v{pmg.version}
+                            </span>
+                          </Show>
+                        </div>
+                        <div class="flex items-center gap-4 text-xs text-gray-500 dark:text-gray-400">
+                          <QueueIndicator queue={instanceQueue()} />
+                          <span>Updated {lastUpdated()}</span>
                         </div>
-                        <table class="w-full text-xs">
-                          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-semibold text-gray-900 dark:text-gray-100">{formatNum(total)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">{formatDec(total / 24)}/hr</div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Total processed</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(inbound)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(inbound / 24)}/hr · {formatDec(inboundPct)}% of total
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Inbound</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(outbound)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(outbound / 24)}/hr · {formatDec(outboundPct)}% of total
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Outbound</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-medium text-orange-600 dark:text-orange-400">{formatNum(spam)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(spam / 24)}/hr · {formatDec(spamPct)}% rate
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Spam caught</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-medium text-red-600 dark:text-red-400">{formatNum(virus)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(virus / 24)}/hr · {formatDec(virusPct)}% rate
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Viruses blocked</td>
-                            </tr>
-                          </tbody>
-                        </table>
                       </div>
 
-                      {/* Traffic Volume Table */}
-                      <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                        <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                          <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                            Traffic Volume
-                          </h4>
+                      {/* Main Content */}
+                      <div class="p-4">
+                        {/* Threat Rate Bars */}
+                        <div class="grid grid-cols-1 sm:grid-cols-3 gap-4 mb-4">
+                          <ThreatBar
+                            percent={stats().spamPct}
+                            color="spam"
+                            label="Spam Rate"
+                            count={stats().spam}
+                          />
+                          <ThreatBar
+                            percent={stats().virusPct}
+                            color="virus"
+                            label="Virus Rate"
+                            count={stats().virus}
+                          />
+                          <ThreatBar
+                            percent={stats().quarantinePct}
+                            color="quarantine"
+                            label="Quarantine Rate"
+                            count={stats().qTotal}
+                          />
                         </div>
-                        <table class="w-full text-xs">
-                          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatDec(bytesIn / 1024 / 1024)} MB</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(bytesIn / 1024 / 1024 / 24)} MB/hr avg
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Inbound bytes</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatDec(bytesOut / 1024 / 1024)} MB</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(bytesOut / 1024 / 1024 / 24)} MB/hr avg
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Outbound bytes</td>
-                            </tr>
-                          </tbody>
-                        </table>
-                      </div>
-                    </div>
 
-                    {/* CENTER COLUMN: Threat/Quarantine + Spam Distribution */}
-                    <div class="space-y-3">
-                      {/* Threat/Quarantine Table */}
-                      <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                        <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                          <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                            Threat & Quarantine
-                          </h4>
+                        {/* Stats Grid */}
+                        <div class="grid grid-cols-2 sm:grid-cols-4 lg:grid-cols-6 gap-3">
+                          {/* Mail Flow */}
+                          <div class="bg-gray-50 dark:bg-gray-800/50 rounded-lg p-3">
+                            <div class="text-xs text-gray-500 dark:text-gray-400 mb-1">Total (24h)</div>
+                            <div class="text-lg font-bold text-gray-900 dark:text-gray-100">{formatCompact(stats().total)}</div>
+                            <div class="text-[10px] text-gray-400">{formatNum(Math.round(stats().total / 24))}/hr</div>
+                          </div>
+                          <div class="bg-gray-50 dark:bg-gray-800/50 rounded-lg p-3">
+                            <div class="text-xs text-gray-500 dark:text-gray-400 mb-1">Inbound</div>
+                            <div class="text-lg font-bold text-gray-900 dark:text-gray-100">{formatCompact(stats().inbound)}</div>
+                            <div class="text-[10px] text-gray-400">{formatBytes(stats().bytesIn)}</div>
+                          </div>
+                          <div class="bg-gray-50 dark:bg-gray-800/50 rounded-lg p-3">
+                            <div class="text-xs text-gray-500 dark:text-gray-400 mb-1">Outbound</div>
+                            <div class="text-lg font-bold text-gray-900 dark:text-gray-100">{formatCompact(stats().outbound)}</div>
+                            <div class="text-[10px] text-gray-400">{formatBytes(stats().bytesOut)}</div>
+                          </div>
+
+                          {/* Threats */}
+                          <div class="bg-orange-50 dark:bg-orange-900/20 rounded-lg p-3">
+                            <div class="text-xs text-orange-600 dark:text-orange-400 mb-1">Spam</div>
+                            <div class="text-lg font-bold text-orange-600 dark:text-orange-400">{formatCompact(stats().spam)}</div>
+                            <div class="text-[10px] text-orange-500/70">{formatPct(stats().spamPct)} rate</div>
+                          </div>
+                          <div class="bg-red-50 dark:bg-red-900/20 rounded-lg p-3">
+                            <div class="text-xs text-red-600 dark:text-red-400 mb-1">Viruses</div>
+                            <div class="text-lg font-bold text-red-600 dark:text-red-400">{formatCompact(stats().virus)}</div>
+                            <div class="text-[10px] text-red-500/70">{formatPct(stats().virusPct)} rate</div>
+                          </div>
+                          <div class="bg-yellow-50 dark:bg-yellow-900/20 rounded-lg p-3">
+                            <div class="text-xs text-yellow-600 dark:text-yellow-400 mb-1">Quarantine</div>
+                            <div class="text-lg font-bold text-yellow-600 dark:text-yellow-400">{formatCompact(stats().qTotal)}</div>
+                            <div class="text-[10px] text-yellow-500/70">{formatPct(stats().quarantinePct)} of inbound</div>
+                          </div>
                         </div>
-                        <table class="w-full text-xs">
-                          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-medium text-orange-600 dark:text-orange-400">{formatNum(qSpam)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec((qSpam / Math.max(qTotal, 1)) * 100)}% of quarantine
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Spam quarantined</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-medium text-red-600 dark:text-red-400">{formatNum(qVirus)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec((qVirus / Math.max(qTotal, 1)) * 100)}% of quarantine
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Virus quarantined</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-medium text-yellow-600 dark:text-yellow-400">{formatNum(qAttachment)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec((qAttachment / Math.max(qTotal, 1)) * 100)}% of quarantine
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Attachments blocked</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(qBlacklist)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec((qBlacklist / Math.max(qTotal, 1)) * 100)}% of quarantine
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Blacklisted</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs font-semibold text-gray-900 dark:text-gray-100">{formatNum(qTotal)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(qTotal / 24)}/hr · {formatDec((qTotal / Math.max(inbound, 1)) * 100)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Total quarantined</td>
-                            </tr>
-                          </tbody>
-                        </table>
-                      </div>
 
-                      {/* Spam Score Distribution */}
-                      <Show when={(pmg.spamDistribution?.length ?? 0) > 0}>
-                        {(() => {
-                          const totalSpamScored = pmg.spamDistribution?.reduce((sum, b) => sum + b.count, 0) || 1;
-                          return (
-                            <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                              <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                                <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                                  Spam Score Distribution
-                                </h4>
+                        {/* Delivery Health Row */}
+                        <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700">
+                          <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide mb-2">Delivery Health</div>
+                          <div class="flex flex-wrap gap-x-6 gap-y-1 text-xs">
+                            <div class="flex items-center gap-2">
+                              <span class="text-gray-500 dark:text-gray-400">RBL Rejects:</span>
+                              <span class="font-medium text-gray-700 dark:text-gray-300">{formatNum(stats().rbl)}</span>
+                            </div>
+                            <div class="flex items-center gap-2">
+                              <span class="text-gray-500 dark:text-gray-400">Pregreet:</span>
+                              <span class="font-medium text-gray-700 dark:text-gray-300">{formatNum(stats().pregreet)}</span>
+                            </div>
+                            <div class="flex items-center gap-2">
+                              <span class="text-gray-500 dark:text-gray-400">Greylisted:</span>
+                              <span class="font-medium text-gray-700 dark:text-gray-300">{formatNum(stats().greylist)}</span>
+                            </div>
+                            <div class="flex items-center gap-2">
+                              <span class="text-gray-500 dark:text-gray-400">Bounces In/Out:</span>
+                              <span class="font-medium text-gray-700 dark:text-gray-300">{formatNum(stats().bouncesIn)}/{formatNum(stats().bouncesOut)}</span>
+                            </div>
+                            <Show when={pmg.mailStats?.averageProcessTimeMs}>
+                              <div class="flex items-center gap-2">
+                                <span class="text-gray-500 dark:text-gray-400">Avg Process:</span>
+                                <span class="font-medium text-gray-700 dark:text-gray-300">{formatDec((pmg.mailStats?.averageProcessTimeMs || 0) / 1000, 2)}s</span>
                               </div>
-                              <div class="p-2">
-                                <div class="grid grid-cols-3 gap-1.5">
-                                  <For each={pmg.spamDistribution}>
-                                    {(bucket) => {
-                                      const pct = (bucket.count / totalSpamScored) * 100;
+                            </Show>
+                          </div>
+                        </div>
+
+                        {/* Cluster Nodes */}
+                        <Show when={(pmg.nodes?.length ?? 0) > 0}>
+                          <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700">
+                            <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide mb-2">
+                              Cluster Nodes ({pmg.nodes?.length})
+                            </div>
+                            <div class="overflow-x-auto -mx-4 px-4">
+                              <table class="w-full min-w-[600px] text-xs">
+                                <thead>
+                                  <tr class="text-left text-[10px] uppercase tracking-wide text-gray-500 dark:text-gray-400 border-b border-gray-200 dark:border-gray-700">
+                                    <th class="pb-1.5 font-medium">Node</th>
+                                    <th class="pb-1.5 font-medium">Status</th>
+                                    <th class="pb-1.5 font-medium">Uptime</th>
+                                    <th class="pb-1.5 font-medium">Load</th>
+                                    <th class="pb-1.5 font-medium">Queue</th>
+                                  </tr>
+                                </thead>
+                                <tbody class="divide-y divide-gray-100 dark:divide-gray-700/50">
+                                  <For each={pmg.nodes}>
+                                    {(node) => {
+                                      const isOnline = (node.status || '').toLowerCase() === 'online';
+
                                       return (
-                                        <div class="text-center border border-gray-200 dark:border-gray-700 rounded px-1 py-1">
-                                          <div class="text-[10px] text-gray-500 dark:text-gray-400">{bucket.score}</div>
-                                          <div class="text-xs font-semibold text-gray-900 dark:text-gray-100">{formatNum(bucket.count)}</div>
-                                          <div class="text-[10px] text-gray-500 dark:text-gray-400">{formatDec(pct)}%</div>
-                                        </div>
+                                        <tr class="hover:bg-gray-50/50 dark:hover:bg-gray-800/30">
+                                          <td class="py-1.5 font-medium text-gray-900 dark:text-gray-100">{node.name}</td>
+                                          <td class="py-1.5">
+                                            <span class={`inline-flex items-center gap-1 ${isOnline ? 'text-green-600 dark:text-green-400' : 'text-red-600 dark:text-red-400'}`}>
+                                              <span class={`w-1.5 h-1.5 rounded-full ${isOnline ? 'bg-green-500' : 'bg-red-500'}`} />
+                                              {node.status || 'unknown'}
+                                            </span>
+                                          </td>
+                                          <td class="py-1.5 text-gray-600 dark:text-gray-400">
+                                            <Show when={node.uptime} fallback="—">
+                                              {Math.floor((node.uptime ?? 0) / 86400)}d {Math.floor(((node.uptime ?? 0) % 86400) / 3600)}h
+                                            </Show>
+                                          </td>
+                                          <td class="py-1.5 text-gray-600 dark:text-gray-400">{node.loadAvg || '—'}</td>
+                                          <td class="py-1.5">
+                                            <QueueIndicator queue={node.queueStatus} />
+                                          </td>
+                                        </tr>
                                       );
                                     }}
                                   </For>
-                                </div>
-                              </div>
+                                </tbody>
+                              </table>
                             </div>
-                          );
-                        })()}
-                      </Show>
-                    </div>
+                          </div>
+                        </Show>
 
-                    {/* RIGHT COLUMN: Delivery Health */}
-                    <div>
-                      <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                        <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                          <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                            Delivery Health
-                          </h4>
-                        </div>
-                        <table class="w-full text-xs">
-                          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(bouncesIn)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(bouncesIn / 24)}/hr · {formatDec((bouncesIn / Math.max(inbound, 1)) * 100)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Bounces inbound</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(bouncesOut)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(bouncesOut / 24)}/hr · {formatDec((bouncesOut / Math.max(outbound, 1)) * 100)}% of outbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Bounces outbound</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(rbl)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(rbl / 24)}/hr · {formatDec(rblPct)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">RBL rejects</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(pregreet)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(pregreet / 24)}/hr · {formatDec((pregreet / Math.max(inbound, 1)) * 100)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Pregreet rejects</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(greylist)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(greylist / 24)}/hr · {formatDec((greylist / Math.max(inbound, 1)) * 100)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Greylisted</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">{formatNum(junk)}</div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  {formatDec(junk / 24)}/hr · {formatDec((junk / Math.max(inbound, 1)) * 100)}% of inbound
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Junk mail</td>
-                            </tr>
-                            <tr>
-                              <td class="px-2 py-1.5">
-                                <div class="text-xs text-gray-900 dark:text-gray-100">
-                                  {pmg.mailStats?.averageProcessTimeMs ? formatDec(pmg.mailStats.averageProcessTimeMs / 1000, 2) : '—'} s
-                                </div>
-                                <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                  ~{pmg.mailStats?.averageProcessTimeMs ? formatNum(60000 / pmg.mailStats.averageProcessTimeMs) : '—'} msg/min
-                                </div>
-                              </td>
-                              <td class="px-2 py-1.5 text-[11px] text-gray-500 dark:text-gray-400">Avg process time</td>
-                            </tr>
-                          </tbody>
-                        </table>
+                        {/* Spam Distribution */}
+                        <Show when={(pmg.spamDistribution?.length ?? 0) > 0}>
+                          <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700">
+                            <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide mb-2">Spam Score Distribution</div>
+                            <div class="flex gap-1 overflow-x-auto pb-1">
+                              <For each={pmg.spamDistribution}>
+                                {(bucket) => {
+                                  const totalScored = pmg.spamDistribution?.reduce((sum, b) => sum + b.count, 0) || 1;
+                                  const pct = (bucket.count / totalScored) * 100;
+                                  return (
+                                    <div class="flex-shrink-0 text-center bg-gray-50 dark:bg-gray-800/50 rounded px-2 py-1.5 min-w-[50px]">
+                                      <div class="text-[10px] text-gray-500 dark:text-gray-400">{bucket.score}</div>
+                                      <div class="text-xs font-semibold text-gray-900 dark:text-gray-100">{formatCompact(bucket.count)}</div>
+                                      <div class="text-[10px] text-gray-400">{formatDec(pct)}%</div>
+                                    </div>
+                                  );
+                                }}
+                              </For>
+                            </div>
+                          </div>
+                        </Show>
                       </div>
-                    </div>
-                  </div>
-
-                  {/* FULL-WIDTH: Cluster Nodes */}
-                  <Show when={(pmg.nodes?.length ?? 0) > 0}>
-                    <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-                      <div class="px-2 py-1.5 bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
-                        <h4 class="text-[10px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                          Cluster Nodes
-                        </h4>
-                      </div>
-                      <div class="overflow-x-auto">
-                        <table class="w-full text-xs">
-                          <thead class="bg-gray-50 dark:bg-gray-800/70 border-b border-gray-200 dark:border-gray-700">
-                            <tr class="text-[11px] uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                              <th class="px-2 py-1 text-left">Name</th>
-                              <th class="px-2 py-1 text-left">Role</th>
-                              <th class="px-2 py-1 text-left">Status</th>
-                              <th class="px-2 py-1 text-left">Uptime</th>
-                              <th class="px-2 py-1 text-left">Load Avg</th>
-                              <th class="px-2 py-1 text-left">Queue Depth</th>
-                              <th class="px-2 py-1 text-left">Oldest Msg</th>
-                            </tr>
-                          </thead>
-                          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
-                            <For each={pmg.nodes}>
-                              {(node) => {
-                                const nodeStatusClass = (node.status || '').toLowerCase() === 'online' ? 'bg-green-500' : 'bg-red-500';
-                                const queue = node.queueStatus;
-                                const queueTotal = queue?.total || 0;
-                                const hasQueue = queueTotal > 0;
-                                const queueClass = hasQueue && queueTotal > 50 ? 'text-amber-600 dark:text-amber-400' : 'text-gray-700 dark:text-gray-300';
-                                const oldestAge = queue?.oldestAge || 0;
-                                const oldestMin = Math.floor(oldestAge / 60);
-                                const oldestHr = Math.floor(oldestMin / 60);
-                                const oldestClass = oldestAge > 1800 ? 'text-amber-600 dark:text-amber-400' : 'text-gray-700 dark:text-gray-300';
-
-                                return (
-                                  <tr class="">
-                                    <td class="px-2 py-1.5 text-xs font-medium text-gray-900 dark:text-gray-100 truncate max-w-[150px]">{node.name}</td>
-                                    <td class="px-2 py-1.5 text-xs text-gray-700 dark:text-gray-300 capitalize">{node.role || '—'}</td>
-                                    <td class="px-2 py-1.5">
-                                      <div class="flex items-center gap-1.5">
-                                        <span class={`h-1.5 w-1.5 rounded-full ${nodeStatusClass}`} />
-                                        <span class="text-xs text-gray-700 dark:text-gray-300 capitalize">{node.status || 'unknown'}</span>
-                                      </div>
-                                    </td>
-                                    <td class="px-2 py-1.5 text-xs text-gray-700 dark:text-gray-300">
-                                      <Show when={node.uptime} fallback="—">
-                                        {Math.floor((node.uptime ?? 0) / 86400)}d {Math.floor(((node.uptime ?? 0) % 86400) / 3600)}h
-                                      </Show>
-                                    </td>
-                                    <td class="px-2 py-1.5 text-xs text-gray-700 dark:text-gray-300">{node.loadAvg || '—'}</td>
-                                    <td class="px-2 py-1.5">
-                                      <Show when={queue} fallback={<span class="text-xs text-gray-500 dark:text-gray-400">—</span>}>
-                                        <div class={`text-xs font-medium ${queueClass}`}>
-                                          {formatNum(queueTotal)}
-                                        </div>
-                                        <div class="text-[11px] text-gray-500 dark:text-gray-400">
-                                          A:{queue!.active} D:{queue!.deferred} H:{queue!.hold} I:{queue!.incoming}
-                                        </div>
-                                      </Show>
-                                    </td>
-                                    <td class="px-2 py-1.5">
-                                      <Show when={queue && oldestAge > 0} fallback={<span class="text-xs text-gray-500 dark:text-gray-400">—</span>}>
-                                        <span class={`text-xs ${oldestClass}`}>
-                                          {oldestHr > 0 ? `${oldestHr}h ${oldestMin % 60}m` : `${oldestMin}m`}
-                                        </span>
-                                      </Show>
-                                    </td>
-                                  </tr>
-                                );
-                              }}
-                            </For>
-                          </tbody>
-                        </table>
-                      </div>
-                    </div>
-                  </Show>
-                </div>
-              </Card>
-            );
-          }}
-        </For>
+                    </Card>
+                  );
+                }}
+              </For>
+            </div>
+          </Show>
+        </Show>
       </Show>
     </div>
   );
diff --git a/frontend-modern/src/components/Proxmox/ProxmoxSectionNav.tsx b/frontend-modern/src/components/Proxmox/ProxmoxSectionNav.tsx
index 1e7dc43..bdcbf05 100644
--- a/frontend-modern/src/components/Proxmox/ProxmoxSectionNav.tsx
+++ b/frontend-modern/src/components/Proxmox/ProxmoxSectionNav.tsx
@@ -3,7 +3,7 @@ import { createMemo, For } from 'solid-js';
 import { useNavigate } from '@solidjs/router';
 import { useWebSocket } from '@/App';
 
-type ProxmoxSection = 'overview' | 'storage' | 'replication' | 'backups' | 'mail';
+type ProxmoxSection = 'overview' | 'storage' | 'ceph' | 'replication' | 'backups' | 'mail';
 
 interface ProxmoxSectionNavProps {
   current: ProxmoxSection;
@@ -15,41 +15,55 @@ const allSections: Array<{
   label: string;
   path: string;
 }> = [
-  {
-    id: 'overview',
-    label: 'Overview',
-    path: '/proxmox/overview',
-  },
-  {
-    id: 'storage',
-    label: 'Storage',
-    path: '/proxmox/storage',
-  },
-  {
-    id: 'replication',
-    label: 'Replication',
-    path: '/proxmox/replication',
-  },
-  {
-    id: 'mail',
-    label: 'Mail Gateway',
-    path: '/proxmox/mail',
-  },
-  {
-    id: 'backups',
-    label: 'Backups',
-    path: '/proxmox/backups',
-  },
-];
+    {
+      id: 'overview',
+      label: 'Overview',
+      path: '/proxmox/overview',
+    },
+    {
+      id: 'storage',
+      label: 'Storage',
+      path: '/proxmox/storage',
+    },
+    {
+      id: 'ceph',
+      label: 'Ceph',
+      path: '/proxmox/ceph',
+    },
+    {
+      id: 'replication',
+      label: 'Replication',
+      path: '/proxmox/replication',
+    },
+    {
+      id: 'mail',
+      label: 'Mail Gateway',
+      path: '/proxmox/mail',
+    },
+    {
+      id: 'backups',
+      label: 'Backups',
+      path: '/proxmox/backups',
+    },
+  ];
 
 export const ProxmoxSectionNav: Component<ProxmoxSectionNavProps> = (props) => {
   const navigate = useNavigate();
   const { state } = useWebSocket();
 
-  // Only show Mail Gateway tab if PMG instances are configured
+  // Only show tabs if the corresponding feature has data:
+  // - Mail Gateway: requires PMG instances
+  // - Ceph: requires Ceph clusters (from agent or Proxmox API)
+  // - Replication: requires replication jobs
   const sections = createMemo(() => {
     const hasPMG = state.pmg && state.pmg.length > 0;
-    return allSections.filter((section) => section.id !== 'mail' || hasPMG);
+    const hasCeph = state.cephClusters && state.cephClusters.length > 0;
+    const hasReplication = state.replicationJobs && state.replicationJobs.length > 0;
+    return allSections.filter((section) =>
+      (section.id !== 'mail' || hasPMG) &&
+      (section.id !== 'ceph' || hasCeph) &&
+      (section.id !== 'replication' || hasReplication)
+    );
   });
 
   const baseClasses =
diff --git a/frontend-modern/src/components/Replication/Replication.tsx b/frontend-modern/src/components/Replication/Replication.tsx
index f5b69ad..4b29b9c 100644
--- a/frontend-modern/src/components/Replication/Replication.tsx
+++ b/frontend-modern/src/components/Replication/Replication.tsx
@@ -1,5 +1,6 @@
 import type { Component } from 'solid-js';
-import { Show, For, createMemo } from 'solid-js';
+import { Show, For, createMemo, createSignal, createEffect, onCleanup } from 'solid-js';
+import { Portal } from 'solid-js/web';
 import { ProxmoxSectionNav } from '@/components/Proxmox/ProxmoxSectionNav';
 import { useWebSocket } from '@/App';
 import { Card } from '@/components/shared/Card';
@@ -7,33 +8,139 @@ import { EmptyState } from '@/components/shared/EmptyState';
 import { formatAbsoluteTime, formatRelativeTime } from '@/utils/format';
 import { StatusDot } from '@/components/shared/StatusDot';
 import { getReplicationJobStatusIndicator } from '@/utils/status';
+import type { ReplicationJob } from '@/types/api';
+
+type StatusFilter = 'all' | 'healthy' | 'warning' | 'error';
 
 function formatDuration(durationSeconds?: number, durationHuman?: string): string {
   if (durationHuman && durationHuman.trim()) return durationHuman;
   if (!durationSeconds || durationSeconds <= 0) return '';
 
-  const hours = Math.floor(durationSeconds / 3600)
-    .toString()
-    .padStart(2, '0');
-  const minutes = Math.floor((durationSeconds % 3600) / 60)
-    .toString()
-    .padStart(2, '0');
-  const seconds = Math.floor(durationSeconds % 60)
-    .toString()
-    .padStart(2, '0');
+  const hours = Math.floor(durationSeconds / 3600).toString().padStart(2, '0');
+  const minutes = Math.floor((durationSeconds % 3600) / 60).toString().padStart(2, '0');
+  const seconds = Math.floor(durationSeconds % 60).toString().padStart(2, '0');
 
   return `${hours}:${minutes}:${seconds}`;
 }
 
-
-
-function formatRate(limit?: number): string {
-  if (!limit || limit <= 0) return '—';
-  return `${limit.toFixed(0)} MB/s`;
+function coerceTimestamp(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string') {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return undefined;
 }
 
+function normalizeTimestampMs(value: number): number {
+  return value > 1e12 ? value : value * 1000;
+}
+
+
+
+// Countdown timer for next sync
+function getTimeUntil(timestamp?: number): { text: string; isOverdue: boolean; isImminent: boolean } {
+  if (!timestamp) return { text: '—', isOverdue: false, isImminent: false };
+
+  const now = Date.now();
+  // Handle both Unix timestamp (seconds) and JS timestamp (milliseconds)
+  const target = timestamp > 1e12 ? timestamp : timestamp * 1000;
+  const diff = target - now;
+
+  if (diff < 0) {
+    // Overdue
+    const overdueMinutes = Math.abs(Math.floor(diff / 60000));
+    if (overdueMinutes < 60) {
+      return { text: `${overdueMinutes}m overdue`, isOverdue: true, isImminent: false };
+    }
+    const overdueHours = Math.floor(overdueMinutes / 60);
+    return { text: `${overdueHours}h overdue`, isOverdue: true, isImminent: false };
+  }
+
+  const minutes = Math.floor(diff / 60000);
+  if (minutes < 60) {
+    return { text: `in ${minutes}m`, isOverdue: false, isImminent: minutes < 5 };
+  }
+  const hours = Math.floor(minutes / 60);
+  const remainingMinutes = minutes % 60;
+  return { text: `in ${hours}h ${remainingMinutes}m`, isOverdue: false, isImminent: false };
+}
+
+// Error tooltip component
+const ErrorTooltip: Component<{ error: string }> = (props) => {
+  const [showTooltip, setShowTooltip] = createSignal(false);
+  const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+  const handleMouseEnter = (e: MouseEvent) => {
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+    setShowTooltip(true);
+  };
+
+  return (
+    <>
+      <div
+        class="mt-1 text-xs text-red-500 dark:text-red-400 line-clamp-1 cursor-help"
+        onMouseEnter={handleMouseEnter}
+        onMouseLeave={() => setShowTooltip(false)}
+      >
+        {props.error}
+      </div>
+
+      <Show when={showTooltip()}>
+        <Portal mount={document.body}>
+          <div
+            class="fixed z-[9999] pointer-events-none"
+            style={{
+              left: `${tooltipPos().x}px`,
+              top: `${tooltipPos().y - 8}px`,
+              transform: 'translate(-50%, -100%)',
+            }}
+          >
+            <div class="bg-gray-900 dark:bg-gray-800 text-white text-xs rounded-md shadow-lg px-3 py-2 max-w-[400px] border border-gray-700">
+              <div class="font-medium text-red-400 mb-1">Error Details</div>
+              <div class="text-gray-300 whitespace-pre-wrap">{props.error}</div>
+            </div>
+          </div>
+        </Portal>
+      </Show>
+    </>
+  );
+};
+
 const Replication: Component = () => {
-  const { state, connected, reconnecting, reconnect } = useWebSocket();
+  const { state, connected, reconnecting, reconnect, initialDataReceived } = useWebSocket();
+
+  const [searchTerm, setSearchTerm] = createSignal('');
+  const [statusFilter, setStatusFilter] = createSignal<StatusFilter>('all');
+  let searchInputRef: HTMLInputElement | undefined;
+
+  // Keyboard handler for type-to-search
+  createEffect(() => {
+    const handleKeyDown = (e: KeyboardEvent) => {
+      const target = e.target as HTMLElement;
+      const isInputField =
+        target.tagName === 'INPUT' ||
+        target.tagName === 'TEXTAREA' ||
+        target.tagName === 'SELECT' ||
+        target.contentEditable === 'true';
+
+      if (e.key === 'Escape') {
+        if (searchTerm().trim() || statusFilter() !== 'all') {
+          setSearchTerm('');
+          setStatusFilter('all');
+          searchInputRef?.blur();
+        }
+      } else if (!isInputField && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
+        if (searchInputRef) {
+          searchInputRef.focus();
+        }
+      }
+    };
+
+    document.addEventListener('keydown', handleKeyDown);
+    onCleanup(() => document.removeEventListener('keydown', handleKeyDown));
+  });
 
   const replicationJobs = createMemo(() => {
     const jobs = state.replicationJobs ?? [];
@@ -46,11 +153,93 @@ const Replication: Component = () => {
     });
   });
 
+  // Get job status category for filtering
+  const getJobStatusCategory = (job: ReplicationJob): StatusFilter => {
+    const indicator = getReplicationJobStatusIndicator(job);
+    if (indicator.variant === 'success') return 'healthy';
+    if (indicator.variant === 'warning') return 'warning';
+    if (indicator.variant === 'danger') return 'error';
+    return 'healthy';
+  };
+
+  // Filtered jobs based on search and status
+  const filteredJobs = createMemo(() => {
+    let jobs = replicationJobs();
+
+    // Apply status filter
+    if (statusFilter() !== 'all') {
+      jobs = jobs.filter(job => getJobStatusCategory(job) === statusFilter());
+    }
+
+    // Apply search
+    const term = searchTerm().toLowerCase().trim();
+    if (term) {
+      jobs = jobs.filter(job =>
+        (job.guestName || '').toLowerCase().includes(term) ||
+        (job.jobId || '').toLowerCase().includes(term) ||
+        (job.sourceNode || '').toLowerCase().includes(term) ||
+        (job.targetNode || '').toLowerCase().includes(term) ||
+        (job.instance || '').toLowerCase().includes(term) ||
+        String(job.guestId || '').includes(term)
+      );
+    }
+
+    return jobs;
+  });
+
+  // Summary stats
+  const stats = createMemo(() => {
+    const jobs = replicationJobs();
+    let healthy = 0;
+    let warning = 0;
+    let error = 0;
+    let nextSync: { job: ReplicationJob | null; time: number | undefined } = { job: null, time: undefined };
+
+    for (const job of jobs) {
+      const category = getJobStatusCategory(job);
+      if (category === 'healthy') healthy++;
+      else if (category === 'warning') warning++;
+      else error++;
+
+      // Track the soonest next sync
+      const nextSyncRaw = coerceTimestamp(job.nextSyncTime ?? job.nextSyncUnix);
+      if (typeof nextSyncRaw === 'number') {
+        const jobSyncMs = normalizeTimestampMs(nextSyncRaw);
+        const currentSyncMs =
+          typeof nextSync.time === 'number' ? normalizeTimestampMs(nextSync.time) : Infinity;
+        if (jobSyncMs < currentSyncMs) nextSync = { job, time: nextSyncRaw };
+      }
+    }
+
+    return { total: jobs.length, healthy, warning, error, nextSync };
+  });
+
+  const isLoading = createMemo(() => connected() && !initialDataReceived());
+
+  const thClass = "px-3 py-2 text-left text-[11px] font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-400";
+
   return (
-    <div class="space-y-3">
+    <div class="space-y-4">
       <ProxmoxSectionNav current="replication" />
 
-      <Show when={connected()} fallback={
+      {/* Loading State */}
+      <Show when={isLoading()}>
+        <Card padding="lg">
+          <EmptyState
+            icon={
+              <svg class="h-12 w-12 animate-spin text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+              </svg>
+            }
+            title="Loading replication data..."
+            description="Connecting to the monitoring service."
+          />
+        </Card>
+      </Show>
+
+      {/* Disconnected State */}
+      <Show when={!connected() && !isLoading()}>
         <Card padding="lg" tone="danger">
           <EmptyState
             icon={
@@ -59,11 +248,7 @@ const Replication: Component = () => {
               </svg>
             }
             title="Connection lost"
-            description={
-              reconnecting()
-                ? 'Attempting to reconnect…'
-                : 'Unable to connect to the backend server'
-            }
+            description={reconnecting() ? 'Attempting to reconnect…' : 'Unable to connect to the backend server'}
             tone="danger"
             actions={
               !reconnecting() ? (
@@ -77,126 +262,343 @@ const Replication: Component = () => {
             }
           />
         </Card>
-      }>
-        <Show
-          when={replicationJobs().length > 0}
-          fallback={
-            <Card padding="lg">
-              <EmptyState
-                icon={
-                  <svg class="h-12 w-12 text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M4 4h16M4 10h16M4 16h16" />
+      </Show>
+
+      <Show when={connected() && initialDataReceived()}>
+        {/* No Jobs Empty State */}
+        <Show when={replicationJobs().length === 0}>
+          <Card padding="lg">
+            <EmptyState
+              icon={
+                <svg class="h-12 w-12 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M7.5 21L3 16.5m0 0L7.5 12M3 16.5h13.5m0-13.5L21 7.5m0 0L16.5 12M21 7.5H7.5" />
+                </svg>
+              }
+              title="No replication jobs detected"
+              description="Replication jobs will appear here once configured in Proxmox. Replication keeps your VMs synchronized across nodes for high availability."
+            />
+          </Card>
+        </Show>
+
+        {/* Has Jobs - Show Content */}
+        <Show when={replicationJobs().length > 0}>
+          {/* Summary Cards */}
+          <div class="grid gap-3 grid-cols-2 lg:grid-cols-4">
+            {/* Total Jobs */}
+            <Card padding="sm" tone="glass">
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Total Jobs</div>
+                  <div class="text-2xl font-bold text-gray-900 dark:text-gray-100 mt-1">
+                    {stats().total}
+                  </div>
+                </div>
+                <div class="p-2 bg-blue-100 dark:bg-blue-900/30 rounded-lg">
+                  <svg class="w-5 h-5 text-blue-600 dark:text-blue-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M7.5 21L3 16.5m0 0L7.5 12M3 16.5h13.5m0-13.5L21 7.5m0 0L16.5 12M21 7.5H7.5" />
                   </svg>
-                }
-                title="No replication jobs detected"
-                description="Replication jobs will appear here once configured in Proxmox."
-              />
+                </div>
+              </div>
             </Card>
-          }
-        >
-          <Card padding="none" tone="glass">
-            <div class="overflow-x-auto">
-              <table class="min-w-[1000px] w-full divide-y divide-gray-200 dark:divide-gray-700">
-                <thead class="bg-gray-50 dark:bg-gray-900/40">
-                  <tr class="text-left text-xs font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                    <th class="px-4 py-3">Guest</th>
-                    <th class="px-4 py-3">Job</th>
-                    <th class="px-4 py-3">Source → Target</th>
-                    <th class="px-4 py-3">Last Sync</th>
-                    <th class="px-4 py-3">Next Sync</th>
-                    <th class="px-4 py-3">Status</th>
-                    <th class="px-4 py-3">Failures</th>
-                    <th class="px-4 py-3">Rate</th>
-                  </tr>
-                </thead>
-                <tbody class="divide-y divide-gray-200 dark:divide-gray-800 text-sm text-gray-700 dark:text-gray-200">
-                  <For each={replicationJobs()}>
-                    {(job) => {
-                      const indicator = getReplicationJobStatusIndicator(job);
+
+            {/* Healthy */}
+            <Card padding="sm" tone="glass">
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Healthy</div>
+                  <div class="text-2xl font-bold text-green-600 dark:text-green-400 mt-1">
+                    {stats().healthy}
+                  </div>
+                </div>
+                <div class="p-2 bg-green-100 dark:bg-green-900/30 rounded-lg">
+                  <svg class="w-5 h-5 text-green-600 dark:text-green-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+
+            {/* Warning/Error Combined */}
+            <Card padding="sm" tone={stats().error > 0 ? 'danger' : stats().warning > 0 ? 'warning' : 'glass'}>
+              <div class="flex items-center justify-between">
+                <div>
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Issues</div>
+                  <div class={`text-2xl font-bold mt-1 ${stats().error > 0
+                    ? 'text-red-600 dark:text-red-400'
+                    : stats().warning > 0
+                      ? 'text-yellow-600 dark:text-yellow-400'
+                      : 'text-gray-400'
+                    }`}>
+                    {stats().error + stats().warning}
+                  </div>
+                </div>
+                <div class={`p-2 rounded-lg ${stats().error > 0
+                  ? 'bg-red-100 dark:bg-red-900/30'
+                  : stats().warning > 0
+                    ? 'bg-yellow-100 dark:bg-yellow-900/30'
+                    : 'bg-gray-100 dark:bg-gray-800'
+                  }`}>
+                  <Show when={stats().error > 0 || stats().warning > 0} fallback={
+                    <svg class="w-5 h-5 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                    </svg>
+                  }>
+                    <svg class={`w-5 h-5 ${stats().error > 0 ? 'text-red-600 dark:text-red-400' : 'text-yellow-600 dark:text-yellow-400'}`} fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z" />
+                    </svg>
+                  </Show>
+                </div>
+              </div>
+            </Card>
+
+            {/* Next Sync */}
+            <Card padding="sm" tone="glass">
+              <div class="flex items-center justify-between">
+                <div class="min-w-0 flex-1">
+                  <div class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Next Sync</div>
+                  <Show when={stats().nextSync.job} fallback={
+                    <div class="text-sm text-gray-400 mt-1">—</div>
+                  }>
+                    {(() => {
+                      const timeInfo = getTimeUntil(stats().nextSync.time);
                       return (
-                        <tr class="hover:bg-gray-50/80 dark:hover:bg-gray-900/40 transition-colors">
-                          <td class="px-4 py-3">
-                            <div class="font-medium text-gray-900 dark:text-gray-100 truncate max-w-[200px]">
-                              {job.guestName || `VM ${job.guestId ?? ''}`}
-                            </div>
-                            <div class="text-xs text-gray-500 dark:text-gray-400">
-                              {job.instance} · ID {job.guestId ?? '—'} · {job.guestNode || job.sourceNode || 'Unknown node'}
-                            </div>
-                          </td>
-                          <td class="px-4 py-3">
-                            <div class="font-medium">{job.jobId || '—'}</div>
-                            <div class="text-xs text-gray-500 dark:text-gray-400">
-                              {job.type ? `${job.type.toUpperCase()} · ` : ''}{job.schedule || '*/15'}
-                            </div>
-                          </td>
-                          <td class="px-4 py-3">
-                            <div class="text-sm">
-                              {job.sourceNode || '—'}
-                              <span class="mx-1 text-gray-400">→</span>
-                              {job.targetNode || '—'}
-                            </div>
-                            <div class="text-xs text-gray-500 dark:text-gray-400">
-                              {job.sourceStorage || 'local'} → {job.targetStorage || 'remote'}
-                            </div>
-                          </td>
-                          <td class="px-4 py-3">
-                            <Show when={job.lastSyncTime}>
-                              <div class="font-medium">{formatAbsoluteTime(job.lastSyncTime!)}</div>
-                              <div class="text-xs text-gray-500 dark:text-gray-400">
-                                {formatRelativeTime(job.lastSyncTime!)}
-                                <Show when={job.lastSyncDurationSeconds || job.lastSyncDurationHuman}>
-                                  <span class="mx-1">·</span>
-                                  {formatDuration(job.lastSyncDurationSeconds, job.lastSyncDurationHuman)}
-                                </Show>
-                              </div>
-                            </Show>
-                            <Show when={!job.lastSyncTime}>
-                              <span class="text-gray-400">Never</span>
-                            </Show>
-                          </td>
-                          <td class="px-4 py-3">
-                            <Show when={job.nextSyncTime}>
-                              <div class="font-medium">{formatAbsoluteTime(job.nextSyncTime!)}</div>
-                              <div class="text-xs text-gray-500 dark:text-gray-400">
-                                {formatRelativeTime(job.nextSyncTime!)}
-                              </div>
-                            </Show>
-                            <Show when={!job.nextSyncTime}>
-                              <span class="text-gray-400">—</span>
-                            </Show>
-                          </td>
-                          <td class="px-4 py-3">
-                            <div class="flex items-center gap-2">
-                              <StatusDot
-                                variant={indicator.variant}
-                                title={indicator.label}
-                                ariaLabel={indicator.label}
-                                size="sm"
-                              />
-                              <span class="text-sm font-medium text-gray-700 dark:text-gray-300">
-                                {indicator.label}
-                              </span>
-                            </div>
-                            <Show when={job.error}>
-                              <div class="mt-1 text-xs text-red-500 dark:text-red-400 line-clamp-2">
-                                {job.error}
-                              </div>
-                            </Show>
-                          </td>
-                          <td class="px-4 py-3">
-                            <span class="text-sm font-medium">{job.failCount ?? 0}</span>
-                          </td>
-                          <td class="px-4 py-3">
-                            <span class="text-sm">{formatRate(job.rateLimitMbps)}</span>
-                          </td>
-                        </tr>
+                        <>
+                          <div class={`text-lg font-bold mt-1 ${timeInfo.isOverdue
+                            ? 'text-red-600 dark:text-red-400'
+                            : timeInfo.isImminent
+                              ? 'text-blue-600 dark:text-blue-400'
+                              : 'text-gray-900 dark:text-gray-100'
+                            }`}>
+                            {timeInfo.text}
+                          </div>
+                          <div class="text-xs text-gray-500 dark:text-gray-400 truncate">
+                            {stats().nextSync.job?.guestName || `VM ${stats().nextSync.job?.guestId}`}
+                          </div>
+                        </>
                       );
-                    }}
-                  </For>
-                </tbody>
-              </table>
+                    })()}
+                  </Show>
+                </div>
+                <div class="p-2 bg-purple-100 dark:bg-purple-900/30 rounded-lg">
+                  <svg class="w-5 h-5 text-purple-600 dark:text-purple-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M12 6v6h4.5m4.5 0a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                </div>
+              </div>
+            </Card>
+          </div>
+
+          {/* Filter Bar */}
+          <Card padding="sm" tone="glass">
+            <div class="flex flex-col sm:flex-row gap-3 sm:items-center sm:justify-between">
+              {/* Search */}
+              <div class="relative flex-1 max-w-md">
+                <input
+                  ref={(el) => (searchInputRef = el)}
+                  type="text"
+                  placeholder="Search by guest, job, or node..."
+                  value={searchTerm()}
+                  onInput={(e) => setSearchTerm(e.currentTarget.value)}
+                  class="w-full pl-9 pr-8 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg 
+                         bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500
+                         focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+                />
+                <svg class="absolute left-3 top-2 h-4 w-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
+                </svg>
+                <Show when={searchTerm()}>
+                  <button
+                    onClick={() => setSearchTerm('')}
+                    class="absolute right-2.5 top-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300"
+                  >
+                    <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                      <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+                    </svg>
+                  </button>
+                </Show>
+              </div>
+
+              {/* Status Filter Buttons */}
+              <div class="flex items-center gap-1.5">
+                <span class="text-xs text-gray-500 dark:text-gray-400 mr-1">Status:</span>
+                <button
+                  onClick={() => setStatusFilter('all')}
+                  class={`px-2.5 py-1 text-xs font-medium rounded-md transition-colors ${statusFilter() === 'all'
+                    ? 'bg-gray-800 dark:bg-gray-200 text-white dark:text-gray-900'
+                    : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-700'
+                    }`}
+                >
+                  All
+                </button>
+                <button
+                  onClick={() => setStatusFilter('healthy')}
+                  class={`px-2.5 py-1 text-xs font-medium rounded-md transition-colors ${statusFilter() === 'healthy'
+                    ? 'bg-green-600 text-white'
+                    : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-700'
+                    }`}
+                >
+                  Healthy
+                </button>
+                <button
+                  onClick={() => setStatusFilter('warning')}
+                  class={`px-2.5 py-1 text-xs font-medium rounded-md transition-colors ${statusFilter() === 'warning'
+                    ? 'bg-yellow-500 text-white'
+                    : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-700'
+                    }`}
+                >
+                  Warning
+                </button>
+                <button
+                  onClick={() => setStatusFilter('error')}
+                  class={`px-2.5 py-1 text-xs font-medium rounded-md transition-colors ${statusFilter() === 'error'
+                    ? 'bg-red-600 text-white'
+                    : 'bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-700'
+                    }`}
+                >
+                  Error
+                </button>
+              </div>
             </div>
           </Card>
+
+          {/* Jobs Table */}
+          <Card padding="none" tone="glass" class="overflow-hidden">
+            <Show
+              when={filteredJobs().length > 0}
+              fallback={
+                <div class="p-8 text-center">
+                  <svg class="w-10 h-10 text-gray-300 dark:text-gray-600 mx-auto mb-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M21 21l-5.197-5.197m0 0A7.5 7.5 0 105.196 5.196a7.5 7.5 0 0010.607 10.607z" />
+                  </svg>
+                  <div class="text-gray-500 dark:text-gray-400 text-sm">
+                    No jobs match your search
+                  </div>
+                  <button
+                    onClick={() => { setSearchTerm(''); setStatusFilter('all'); }}
+                    class="mt-2 text-xs text-blue-600 dark:text-blue-400 hover:underline"
+                  >
+                    Clear filters
+                  </button>
+                </div>
+              }
+            >
+              <div class="overflow-x-auto">
+                <table class="w-full min-w-[900px]">
+                  <thead class="bg-gray-50 dark:bg-gray-800/60 border-b border-gray-200 dark:border-gray-700">
+                    <tr>
+                      <th class={`${thClass} pl-4`}>Guest</th>
+                      <th class={thClass}>Job</th>
+                      <th class={thClass}>Source → Target</th>
+                      <th class={thClass}>Last Sync</th>
+                      <th class={thClass}>Next Sync</th>
+                      <th class={thClass}>Status</th>
+                    </tr>
+                  </thead>
+                  <tbody class="divide-y divide-gray-100 dark:divide-gray-700/50">
+                    <For each={filteredJobs()}>
+                      {(job) => {
+                        const indicator = getReplicationJobStatusIndicator(job);
+                        const nextSyncInfo = getTimeUntil(job.nextSyncTime);
+                        const statusCategory = getJobStatusCategory(job);
+
+                        return (
+                          <tr class={`transition-colors ${statusCategory === 'error'
+                            ? 'bg-red-50/50 dark:bg-red-900/10 hover:bg-red-50 dark:hover:bg-red-900/20'
+                            : statusCategory === 'warning'
+                              ? 'bg-yellow-50/30 dark:bg-yellow-900/10 hover:bg-yellow-50/50 dark:hover:bg-yellow-900/20'
+                              : 'hover:bg-gray-50/80 dark:hover:bg-gray-800/50'
+                            }`}>
+                            <td class="px-3 py-3 pl-4">
+                              <div class="font-medium text-sm text-gray-900 dark:text-gray-100">
+                                {job.guestName || `VM ${job.guestId ?? ''}`}
+                              </div>
+                              <div class="text-xs text-gray-500 dark:text-gray-400 flex items-center gap-1">
+                                <span class="inline-flex items-center px-1.5 py-0.5 rounded bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 font-mono">
+                                  {job.instance}
+                                </span>
+                                <span>· ID {job.guestId ?? '—'}</span>
+                              </div>
+                            </td>
+                            <td class="px-3 py-3">
+                              <div class="font-mono text-sm text-gray-700 dark:text-gray-300">{job.jobId || '—'}</div>
+                              <div class="text-xs text-gray-500 dark:text-gray-400">
+                                {job.schedule || '*/15'}
+                              </div>
+                            </td>
+                            <td class="px-3 py-3">
+                              <div class="flex items-center gap-2 text-sm">
+                                <span class="text-gray-700 dark:text-gray-300">{job.sourceNode || '—'}</span>
+                                <svg class="w-4 h-4 text-gray-400 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                                  <path stroke-linecap="round" stroke-linejoin="round" d="M13.5 4.5L21 12m0 0l-7.5 7.5M21 12H3" />
+                                </svg>
+                                <span class="text-gray-700 dark:text-gray-300">{job.targetNode || '—'}</span>
+                              </div>
+                            </td>
+                            <td class="px-3 py-3">
+                              <Show when={job.lastSyncTime} fallback={
+                                <span class="text-gray-400 text-sm">Never</span>
+                              }>
+                                <div class="text-sm text-gray-900 dark:text-gray-100">
+                                  {formatRelativeTime(job.lastSyncTime!)}
+                                </div>
+                                <div class="text-xs text-gray-500 dark:text-gray-400">
+                                  {formatAbsoluteTime(job.lastSyncTime!)}
+                                  <Show when={job.lastSyncDurationSeconds || job.lastSyncDurationHuman}>
+                                    <span class="ml-1">({formatDuration(job.lastSyncDurationSeconds, job.lastSyncDurationHuman)})</span>
+                                  </Show>
+                                </div>
+                              </Show>
+                            </td>
+                            <td class="px-3 py-3">
+                              <div class={`text-sm font-medium ${nextSyncInfo.isOverdue
+                                ? 'text-red-600 dark:text-red-400'
+                                : nextSyncInfo.isImminent
+                                  ? 'text-blue-600 dark:text-blue-400'
+                                  : 'text-gray-700 dark:text-gray-300'
+                                }`}>
+                                {nextSyncInfo.text}
+                              </div>
+                              <Show when={job.nextSyncTime}>
+                                <div class="text-xs text-gray-500 dark:text-gray-400">
+                                  {formatAbsoluteTime(job.nextSyncTime!)}
+                                </div>
+                              </Show>
+                            </td>
+                            <td class="px-3 py-3">
+                              <div class="flex items-center gap-2">
+                                <StatusDot
+                                  variant={indicator.variant}
+                                  title={indicator.label}
+                                  ariaLabel={indicator.label}
+                                  size="sm"
+                                />
+                                <span class={`text-sm font-medium ${statusCategory === 'error'
+                                  ? 'text-red-700 dark:text-red-400'
+                                  : statusCategory === 'warning'
+                                    ? 'text-yellow-700 dark:text-yellow-400'
+                                    : 'text-gray-700 dark:text-gray-300'
+                                  }`}>
+                                  {indicator.label}
+                                </span>
+                              </div>
+                              <Show when={job.error}>
+                                <ErrorTooltip error={job.error!} />
+                              </Show>
+                              <Show when={(job.failCount ?? 0) > 0}>
+                                <div class="text-xs text-gray-500 dark:text-gray-400 mt-0.5">
+                                  {job.failCount} failure{(job.failCount ?? 0) > 1 ? 's' : ''}
+                                </div>
+                              </Show>
+                            </td>
+                          </tr>
+                        );
+                      }}
+                    </For>
+                  </tbody>
+                </table>
+              </div>
+            </Show>
+          </Card>
         </Show>
       </Show>
     </div>
diff --git a/frontend-modern/src/components/Settings/AISettings.tsx b/frontend-modern/src/components/Settings/AISettings.tsx
new file mode 100644
index 0000000..8f36e39
--- /dev/null
+++ b/frontend-modern/src/components/Settings/AISettings.tsx
@@ -0,0 +1,1270 @@
+import { Component, Show, createSignal, onMount, For } from 'solid-js';
+import { createStore } from 'solid-js/store';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { Toggle } from '@/components/shared/Toggle';
+import { formField, labelClass, controlClass, formHelpText } from '@/components/shared/Form';
+import { notificationStore } from '@/stores/notifications';
+import { logger } from '@/utils/logger';
+import { AIAPI } from '@/api/ai';
+import type { AISettings as AISettingsType, AIProvider, AuthMethod } from '@/types/ai';
+
+// Providers are now configured via accordion sections, not a single-provider selector
+
+// Provider display names for optgroup labels
+const PROVIDER_DISPLAY_NAMES: Record<string, string> = {
+  anthropic: 'Anthropic',
+  openai: 'OpenAI',
+  deepseek: 'DeepSeek',
+  ollama: 'Ollama',
+};
+
+// Parse provider from model ID (format: "provider:model-name")
+function getProviderFromModelId(modelId: string): string {
+  const colonIndex = modelId.indexOf(':');
+  if (colonIndex > 0) {
+    return modelId.substring(0, colonIndex);
+  }
+  // Default detection for models without prefix
+  if (modelId.includes('claude') || modelId.includes('opus') || modelId.includes('sonnet') || modelId.includes('haiku')) {
+    return 'anthropic';
+  }
+  if (modelId.includes('gpt') || modelId.includes('o1') || modelId.includes('o3')) {
+    return 'openai';
+  }
+  if (modelId.includes('deepseek')) {
+    return 'deepseek';
+  }
+  return 'ollama';
+}
+
+// Group models by provider for optgroup rendering
+function groupModelsByProvider(models: { id: string; name: string; description?: string }[]): Map<string, { id: string; name: string; description?: string }[]> {
+  const grouped = new Map<string, { id: string; name: string; description?: string }[]>();
+
+  for (const model of models) {
+    const provider = getProviderFromModelId(model.id);
+    const existing = grouped.get(provider) || [];
+    existing.push(model);
+    grouped.set(provider, existing);
+  }
+
+  return grouped;
+}
+
+export const AISettings: Component = () => {
+  const [settings, setSettings] = createSignal<AISettingsType | null>(null);
+  const [loading, setLoading] = createSignal(false);
+  const [saving, setSaving] = createSignal(false);
+  const [testing, setTesting] = createSignal(false);
+
+  // Dynamic model list from provider API
+  const [availableModels, setAvailableModels] = createSignal<{ id: string; name: string; description?: string }[]>([]);
+  const [modelsLoading, setModelsLoading] = createSignal(false);
+
+  // Accordion state for provider configuration sections
+  const [expandedProviders, setExpandedProviders] = createSignal<Set<AIProvider>>(new Set(['anthropic']));
+
+  // Per-provider test state
+  const [testingProvider, setTestingProvider] = createSignal<string | null>(null);
+  const [providerTestResult, setProviderTestResult] = createSignal<{ provider: string; success: boolean; message: string } | null>(null);
+
+  // Auto-fix acknowledgement state (not persisted - must acknowledge each session)
+  const [autoFixAcknowledged, setAutoFixAcknowledged] = createSignal(false);
+
+  const [form, setForm] = createStore({
+    enabled: false,
+    provider: 'anthropic' as AIProvider, // Legacy - kept for compatibility
+    apiKey: '', // Legacy - kept for compatibility
+    model: '',
+    chatModel: '', // Empty means use default model
+    patrolModel: '', // Empty means use default model
+    autoFixModel: '', // Empty means use patrol model
+    baseUrl: '', // Legacy - kept for compatibility
+    clearApiKey: false,
+    autonomousMode: false,
+    authMethod: 'api_key' as AuthMethod,
+    patrolIntervalMinutes: 360, // 6 hours default
+    alertTriggeredAnalysis: true,
+    patrolAutoFix: false,
+    // Multi-provider credentials
+    anthropicApiKey: '',
+    openaiApiKey: '',
+    deepseekApiKey: '',
+    ollamaBaseUrl: 'http://localhost:11434',
+    openaiBaseUrl: '',
+    // Cost controls
+    costBudgetUSD30d: '',
+  });
+
+  const resetForm = (data: AISettingsType | null) => {
+    if (!data) {
+      setForm({
+        enabled: false,
+        provider: 'anthropic',
+        apiKey: '',
+        model: '', // Will be set when provider is configured
+        chatModel: '',
+        patrolModel: '',
+        autoFixModel: '',
+        baseUrl: '',
+        clearApiKey: false,
+        autonomousMode: false,
+        authMethod: 'api_key',
+        patrolIntervalMinutes: 360, // 6 hours default
+        alertTriggeredAnalysis: true,
+        patrolAutoFix: false,
+        // Multi-provider - empty by default
+        anthropicApiKey: '',
+        openaiApiKey: '',
+        deepseekApiKey: '',
+        ollamaBaseUrl: 'http://localhost:11434',
+        openaiBaseUrl: '',
+        costBudgetUSD30d: '',
+      });
+      return;
+    }
+
+    setForm({
+      enabled: data.enabled,
+      provider: data.provider,
+      apiKey: '',
+      model: data.model || '', // User must select a model
+      chatModel: data.chat_model || '',
+      patrolModel: data.patrol_model || '',
+      autoFixModel: data.auto_fix_model || '',
+      baseUrl: data.base_url || '',
+      clearApiKey: false,
+      autonomousMode: data.autonomous_mode || false,
+      authMethod: data.auth_method || 'api_key',
+      patrolIntervalMinutes: data.patrol_interval_minutes ?? 360, // Use minutes, default to 6hr
+      alertTriggeredAnalysis: data.alert_triggered_analysis !== false, // default to true
+      patrolAutoFix: data.patrol_auto_fix || false, // default to false (observe only)
+      // Multi-provider - never load actual keys from server (security), just track if configured
+      anthropicApiKey: '', // Always empty - we only show if configured
+      openaiApiKey: '',
+      deepseekApiKey: '',
+      ollamaBaseUrl: data.ollama_base_url || 'http://localhost:11434',
+      openaiBaseUrl: data.openai_base_url || '',
+      costBudgetUSD30d:
+        typeof data.cost_budget_usd_30d === 'number' && data.cost_budget_usd_30d > 0
+          ? String(data.cost_budget_usd_30d)
+          : '',
+    });
+
+    // Auto-expand providers that are configured
+    const configured = new Set<AIProvider>();
+    if (data.anthropic_configured) configured.add('anthropic');
+    if (data.openai_configured) configured.add('openai');
+    if (data.deepseek_configured) configured.add('deepseek');
+    if (data.ollama_configured) configured.add('ollama');
+    // Default to anthropic if nothing is configured
+    if (configured.size === 0) configured.add('anthropic');
+    setExpandedProviders(configured);
+  };
+
+  // Load available models from the provider's API
+  const loadModels = async () => {
+    setModelsLoading(true);
+    try {
+      const result = await AIAPI.getModels();
+      if (result.models && result.models.length > 0) {
+        setAvailableModels(result.models);
+      }
+    } catch (e) {
+      // Silently fail - user can still type model names manually
+      logger.debug('[AISettings] Failed to load models from API:', e);
+    } finally {
+      setModelsLoading(false);
+    }
+  };
+
+  const loadSettings = async () => {
+    setLoading(true);
+    try {
+      const data = await AIAPI.getSettings();
+      setSettings(data);
+      resetForm(data);
+      // Load available models after settings (needs API key to be configured)
+      if (data.configured) {
+        loadModels();
+      }
+    } catch (error) {
+      logger.error('[AISettings] Failed to load settings:', error);
+      notificationStore.error('Failed to load AI settings');
+      setSettings(null);
+      resetForm(null);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  onMount(() => {
+    loadSettings();
+
+    // Check for OAuth callback parameters in URL
+    const params = new URLSearchParams(window.location.search);
+    const oauthSuccess = params.get('ai_oauth_success');
+    const oauthError = params.get('ai_oauth_error');
+
+    if (oauthSuccess === 'true') {
+      notificationStore.success('Successfully connected to Claude with your subscription!');
+      // Clean up URL
+      window.history.replaceState({}, '', window.location.pathname);
+      // Reload settings to get updated OAuth status
+      loadSettings();
+    } else if (oauthError) {
+      const errorMessages: Record<string, string> = {
+        'missing_params': 'OAuth callback missing required parameters',
+        'invalid_state': 'Invalid OAuth state - please try again',
+        'token_exchange_failed': 'Failed to complete authentication with Claude',
+        'save_failed': 'Failed to save OAuth credentials',
+      };
+      notificationStore.error(errorMessages[oauthError] || `OAuth error: ${oauthError}`);
+      // Clean up URL
+      window.history.replaceState({}, '', window.location.pathname);
+    }
+  });
+
+  // Note: handleProviderChange is no longer used as we now use multi-provider accordions
+  // The provider is implicitly determined by the selected model (e.g., "anthropic:claude-opus")
+
+  const handleSave = async (event?: Event) => {
+    event?.preventDefault();
+
+    setSaving(true);
+    try {
+      const payload: Record<string, unknown> = {
+        provider: form.provider,
+        model: form.model.trim(),
+      };
+
+      // Only include base_url if it's set or if provider is ollama
+      if (form.baseUrl.trim() || form.provider === 'ollama') {
+        payload.base_url = form.baseUrl.trim();
+      }
+
+      // Handle API key
+      if (form.apiKey.trim() !== '') {
+        payload.api_key = form.apiKey.trim();
+      } else if (form.clearApiKey) {
+        payload.api_key = '';
+      }
+
+      // Only include enabled if we're toggling it
+      if (form.enabled !== settings()?.enabled) {
+        payload.enabled = form.enabled;
+      }
+
+      // Include autonomous mode if changed
+      if (form.autonomousMode !== settings()?.autonomous_mode) {
+        payload.autonomous_mode = form.autonomousMode;
+      }
+
+      // Include patrol settings if changed
+      if (form.patrolIntervalMinutes !== (settings()?.patrol_interval_minutes ?? 360)) {
+        payload.patrol_interval_minutes = form.patrolIntervalMinutes;
+      }
+
+      if (form.alertTriggeredAnalysis !== settings()?.alert_triggered_analysis) {
+        payload.alert_triggered_analysis = form.alertTriggeredAnalysis;
+      }
+
+      if (form.patrolAutoFix !== settings()?.patrol_auto_fix) {
+        payload.patrol_auto_fix = form.patrolAutoFix;
+      }
+
+      // Include model overrides if changed
+      if (form.chatModel !== (settings()?.chat_model || '')) {
+        payload.chat_model = form.chatModel;
+      }
+
+      if (form.patrolModel !== (settings()?.patrol_model || '')) {
+        payload.patrol_model = form.patrolModel;
+      }
+
+      if (form.autoFixModel !== (settings()?.auto_fix_model || '')) {
+        payload.auto_fix_model = form.autoFixModel;
+      }
+
+      // Include multi-provider credentials if set (non-empty)
+      if (form.anthropicApiKey.trim()) {
+        payload.anthropic_api_key = form.anthropicApiKey.trim();
+      }
+      if (form.openaiApiKey.trim()) {
+        payload.openai_api_key = form.openaiApiKey.trim();
+      }
+      if (form.deepseekApiKey.trim()) {
+        payload.deepseek_api_key = form.deepseekApiKey.trim();
+      }
+      // Always include Ollama URL changes
+      if (form.ollamaBaseUrl !== (settings()?.ollama_base_url || 'http://localhost:11434')) {
+        payload.ollama_base_url = form.ollamaBaseUrl.trim();
+      }
+      if (form.openaiBaseUrl !== (settings()?.openai_base_url || '')) {
+        payload.openai_base_url = form.openaiBaseUrl.trim();
+      }
+
+      // Cost controls (server-side budget, cross-provider estimate)
+      {
+        const raw = form.costBudgetUSD30d.trim();
+        const parsed = raw === '' ? 0 : Number(raw);
+        if (!Number.isFinite(parsed) || parsed < 0) {
+          notificationStore.error('Cost budget must be a non-negative number');
+          return;
+        }
+        const current = settings()?.cost_budget_usd_30d ?? 0;
+        if (Math.abs(parsed - current) > 0.0001) {
+          payload.cost_budget_usd_30d = parsed;
+        }
+      }
+
+      const updated = await AIAPI.updateSettings(payload);
+      setSettings(updated);
+      resetForm(updated);
+      notificationStore.success('AI settings saved');
+    } catch (error) {
+      logger.error('[AISettings] Failed to save settings:', error);
+      const message = error instanceof Error ? error.message : 'Failed to save AI settings';
+      notificationStore.error(message);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleTest = async () => {
+    setTesting(true);
+    try {
+      const result = await AIAPI.testConnection();
+      if (result.success) {
+        notificationStore.success(result.message);
+      } else {
+        notificationStore.error(result.message);
+      }
+    } catch (error) {
+      logger.error('[AISettings] Test failed:', error);
+      const message = error instanceof Error ? error.message : 'Connection test failed';
+      notificationStore.error(message);
+    } finally {
+      setTesting(false);
+    }
+  };
+
+  const handleTestProvider = async (provider: string) => {
+    setTestingProvider(provider);
+    setProviderTestResult(null);
+    try {
+      const result = await AIAPI.testProvider(provider);
+      setProviderTestResult(result);
+      if (result.success) {
+        notificationStore.success(`${provider}: ${result.message}`);
+      } else {
+        notificationStore.error(`${provider}: ${result.message}`);
+      }
+    } catch (error) {
+      logger.error(`[AISettings] Test ${provider} failed:`, error);
+      const message = error instanceof Error ? error.message : 'Connection test failed';
+      setProviderTestResult({ provider, success: false, message });
+      notificationStore.error(`${provider}: ${message}`);
+    } finally {
+      setTestingProvider(null);
+    }
+  };
+
+  const handleClearProvider = async (provider: string) => {
+    if (!confirm(`Clear ${provider} credentials? You'll need to re-enter them to use this provider.`)) {
+      return;
+    }
+
+    setSaving(true);
+    try {
+      const clearPayload: Record<string, boolean> = {};
+      if (provider === 'anthropic') clearPayload.clear_anthropic_key = true;
+      if (provider === 'openai') clearPayload.clear_openai_key = true;
+      if (provider === 'deepseek') clearPayload.clear_deepseek_key = true;
+      if (provider === 'ollama') clearPayload.clear_ollama_url = true;
+
+      await AIAPI.updateSettings(clearPayload);
+
+      // Reload settings to reflect the change
+      const newSettings = await AIAPI.getSettings();
+      setSettings(newSettings);
+
+      // Clear the local form field
+      if (provider === 'anthropic') setForm('anthropicApiKey', '');
+      if (provider === 'openai') setForm('openaiApiKey', '');
+      if (provider === 'deepseek') setForm('deepseekApiKey', '');
+      if (provider === 'ollama') setForm('ollamaBaseUrl', '');
+
+      notificationStore.success(`${provider} credentials cleared`);
+    } catch (error) {
+      logger.error(`[AISettings] Clear ${provider} failed:`, error);
+      const message = error instanceof Error ? error.message : 'Failed to clear credentials';
+      notificationStore.error(message);
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  // OAuth handlers removed - OAuth is currently unavailable from Anthropic for third-party apps
+  // When OAuth becomes available, handlers can be added back to the Anthropic accordion section
+
+  // Legacy helper functions removed - multi-provider accordions handle all provider-specific UI
+
+  return (
+    <Card
+      padding="none"
+      class="overflow-hidden border border-gray-200 dark:border-gray-700"
+      border={false}
+    >
+      <div class="bg-gradient-to-r from-purple-50 to-pink-50 dark:from-purple-900/20 dark:to-pink-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+        <div class="flex items-center gap-3">
+          <div class="p-2 bg-purple-100 dark:bg-purple-900/40 rounded-lg">
+            <svg
+              class="w-5 h-5 text-purple-600 dark:text-purple-300"
+              fill="none"
+              stroke="currentColor"
+              viewBox="0 0 24 24"
+            >
+              <path
+                stroke-linecap="round"
+                stroke-linejoin="round"
+                stroke-width="1.8"
+                d="M9.75 3.104v5.714a2.25 2.25 0 01-.659 1.591L5 14.5M9.75 3.104c-.251.023-.501.05-.75.082m.75-.082a24.301 24.301 0 014.5 0m0 0v5.714c0 .597.237 1.17.659 1.591L19.8 15.3M14.25 3.104c.251.023.501.05.75.082M19.8 15.3l-1.57.393A9.065 9.065 0 0112 15a9.065 9.065 0 00-6.23.693L5 14.5m14.8.8l1.402 1.402c1.232 1.232.65 3.318-1.067 3.611l-2.576.43a18.003 18.003 0 01-5.118 0l-2.576-.43c-1.717-.293-2.299-2.379-1.067-3.611L5 14.5"
+              />
+            </svg>
+          </div>
+          <SectionHeader
+            title="AI Assistant"
+            description="Configure AI-powered infrastructure analysis"
+            size="sm"
+            class="flex-1"
+          />
+          <Toggle
+            checked={form.enabled}
+            onChange={(event) => {
+              setForm('enabled', event.currentTarget.checked);
+            }}
+            disabled={loading() || saving()}
+            containerClass="items-center gap-2"
+            label={
+              <span class="text-xs font-medium text-gray-600 dark:text-gray-300">
+                {form.enabled ? 'Enabled' : 'Disabled'}
+              </span>
+            }
+          />
+        </div>
+      </div>
+
+      <form class="p-6 space-y-5" onSubmit={handleSave}>
+        <div class="bg-purple-50 dark:bg-purple-900/30 border border-purple-200 dark:border-purple-800 rounded-lg p-3 text-xs text-purple-800 dark:text-purple-200">
+          <p class="font-medium mb-1">AI Assistant helps you:</p>
+          <ul class="space-y-0.5 list-disc pl-4">
+            <li>Diagnose infrastructure issues with context-aware analysis</li>
+            <li>Get remediation suggestions based on your specific environment</li>
+            <li>Understand alerts and metrics with plain-language explanations</li>
+          </ul>
+        </div>
+
+        <Show when={loading()}>
+          <div class="flex items-center gap-3 text-sm text-gray-600 dark:text-gray-300">
+            <span class="h-4 w-4 border-2 border-current border-t-transparent rounded-full animate-spin" />
+            Loading AI settings...
+          </div>
+        </Show>
+
+        <Show when={!loading()}>
+          <div class="space-y-4">
+            {/* Model Selection */}
+            <div class={formField}>
+              <div class="flex items-center justify-between mb-1">
+                <label class={labelClass()}>
+                  Default Model
+                  {modelsLoading() && <span class="ml-2 text-xs text-gray-500">(loading...)</span>}
+                </label>
+                <button
+                  type="button"
+                  onClick={loadModels}
+                  disabled={modelsLoading()}
+                  class="text-xs text-purple-600 dark:text-purple-400 hover:text-purple-800 dark:hover:text-purple-300 disabled:opacity-50 flex items-center gap-1"
+                  title="Refresh model list from all configured providers"
+                >
+                  <svg class={`w-3 h-3 ${modelsLoading() ? 'animate-spin' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15" />
+                  </svg>
+                  Refresh Models
+                </button>
+              </div>
+              <Show when={availableModels().length > 0} fallback={
+                <input
+                  type="text"
+                  value={form.model}
+                  onInput={(e) => setForm('model', e.currentTarget.value)}
+                  placeholder="Configure a provider below to see available models"
+                  class={controlClass()}
+                  disabled={saving()}
+                />
+              }>
+                <select
+                  value={form.model}
+                  onChange={(e) => setForm('model', e.currentTarget.value)}
+                  class={controlClass()}
+                  disabled={saving()}
+                >
+                  <Show when={!form.model || !availableModels().some(m => m.id === form.model)}>
+                    <option value={form.model}>{form.model || 'Select a model...'}</option>
+                  </Show>
+                  <For each={Array.from(groupModelsByProvider(availableModels()).entries())}>
+                    {([provider, models]) => (
+                      <optgroup label={PROVIDER_DISPLAY_NAMES[provider] || provider}>
+                        <For each={models}>
+                          {(model) => (
+                            <option value={model.id}>
+                              {model.name || model.id.split(':').pop()}
+                            </option>
+                          )}
+                        </For>
+                      </optgroup>
+                    )}
+                  </For>
+                </select>
+              </Show>
+              <p class={formHelpText}>
+                Main model used when no specific override is set. {availableModels().length === 0 && 'Save API key and refresh to see available models.'}
+              </p>
+            </div>
+
+            {/* Chat Model Override */}
+            <div class={formField}>
+              <label class={labelClass()}>Chat Model (Interactive)</label>
+              <Show when={availableModels().length > 0} fallback={
+                <input
+                  type="text"
+                  value={form.chatModel}
+                  onInput={(e) => setForm('chatModel', e.currentTarget.value)}
+                  placeholder="Leave empty to use default model"
+                  class={controlClass()}
+                  disabled={saving()}
+                />
+              }>
+                <select
+                  value={form.chatModel}
+                  onChange={(e) => setForm('chatModel', e.currentTarget.value)}
+                  class={controlClass()}
+                  disabled={saving()}
+                >
+                  <option value="">Use default model ({form.model || 'not set'})</option>
+                  <For each={Array.from(groupModelsByProvider(availableModels()).entries())}>
+                    {([provider, models]) => (
+                      <optgroup label={PROVIDER_DISPLAY_NAMES[provider] || provider}>
+                        <For each={models}>
+                          {(model) => (
+                            <option value={model.id}>
+                              {model.name || model.id.split(':').pop()}
+                            </option>
+                          )}
+                        </For>
+                      </optgroup>
+                    )}
+                  </For>
+                </select>
+              </Show>
+              <p class={formHelpText}>
+                Model for interactive AI chat. Use a more capable model for complex reasoning.
+              </p>
+            </div>
+
+            {/* Patrol Model Override */}
+            <div class={formField}>
+              <label class={labelClass()}>Patrol Model (Background)</label>
+              <Show when={availableModels().length > 0} fallback={
+                <input
+                  type="text"
+                  value={form.patrolModel}
+                  onInput={(e) => setForm('patrolModel', e.currentTarget.value)}
+                  placeholder="Leave empty to use default model"
+                  class={controlClass()}
+                  disabled={saving()}
+                />
+              }>
+                <select
+                  value={form.patrolModel}
+                  onChange={(e) => setForm('patrolModel', e.currentTarget.value)}
+                  class={controlClass()}
+                  disabled={saving()}
+                >
+                  <option value="">Use default model ({form.model || 'not set'})</option>
+                  <For each={Array.from(groupModelsByProvider(availableModels()).entries())}>
+                    {([provider, models]) => (
+                      <optgroup label={PROVIDER_DISPLAY_NAMES[provider] || provider}>
+                        <For each={models}>
+                          {(model) => (
+                            <option value={model.id}>
+                              {model.name || model.id.split(':').pop()}
+                            </option>
+                          )}
+                        </For>
+                      </optgroup>
+                    )}
+                  </For>
+                </select>
+              </Show>
+              <p class={formHelpText}>
+                Model for background patrol analysis. Use a cheaper/faster model to save tokens.
+              </p>
+            </div>
+
+            {/* AI Provider Configuration - Configure API keys for all providers */}
+            <div class={`${formField} p-4 rounded-lg border bg-gradient-to-br from-purple-50 to-indigo-50 dark:from-purple-900/20 dark:to-indigo-900/20 border-purple-200 dark:border-purple-800`}>
+              <div class="mb-3">
+                <h4 class="font-medium text-gray-900 dark:text-white flex items-center gap-2">
+                  <svg class="w-5 h-5 text-purple-600 dark:text-purple-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10" />
+                  </svg>
+                  AI Provider Configuration
+                </h4>
+                <p class="text-xs text-gray-600 dark:text-gray-400 mt-1">
+                  Configure API keys for each AI provider you want to use. Models from all configured providers will appear in the model selectors.
+                </p>
+              </div>
+
+              {/* Provider Accordions */}
+              <div class="space-y-2">
+                {/* Anthropic */}
+                <div class={`border rounded-lg overflow-hidden ${settings()?.anthropic_configured ? 'border-green-300 dark:border-green-700' : 'border-gray-200 dark:border-gray-700'}`}>
+                  <button
+                    type="button"
+                    class="w-full px-3 py-2 flex items-center justify-between bg-white dark:bg-gray-800 hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors"
+                    onClick={() => {
+                      const current = expandedProviders();
+                      const next = new Set(current);
+                      if (next.has('anthropic')) next.delete('anthropic');
+                      else next.add('anthropic');
+                      setExpandedProviders(next);
+                    }}
+                  >
+                    <div class="flex items-center gap-2">
+                      <span class="font-medium text-sm">Anthropic</span>
+                      <Show when={settings()?.anthropic_configured}>
+                        <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">Configured</span>
+                      </Show>
+                    </div>
+                    <svg class={`w-4 h-4 transition-transform ${expandedProviders().has('anthropic') ? 'rotate-180' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                    </svg>
+                  </button>
+                  <Show when={expandedProviders().has('anthropic')}>
+                    <div class="px-3 py-3 bg-gray-50 dark:bg-gray-800/50 border-t border-gray-200 dark:border-gray-700 space-y-2">
+                      <input
+                        type="password"
+                        value={form.anthropicApiKey}
+                        onInput={(e) => setForm('anthropicApiKey', e.currentTarget.value)}
+                        placeholder={settings()?.anthropic_configured ? '••••••••••• (configured)' : 'sk-ant-...'}
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                      <div class="flex items-center justify-between">
+                        <p class="text-xs text-gray-500">
+                          <a href="https://console.anthropic.com/settings/keys" target="_blank" rel="noopener" class="text-purple-600 hover:underline">Get API key →</a>
+                        </p>
+                        <Show when={settings()?.anthropic_configured}>
+                          <div class="flex gap-1">
+                            <button
+                              type="button"
+                              onClick={() => handleTestProvider('anthropic')}
+                              disabled={testingProvider() === 'anthropic' || saving()}
+                              class="px-2 py-1 text-xs bg-blue-100 dark:bg-blue-900 text-blue-700 dark:text-blue-300 rounded hover:bg-blue-200 dark:hover:bg-blue-800 disabled:opacity-50"
+                            >
+                              {testingProvider() === 'anthropic' ? 'Testing...' : 'Test'}
+                            </button>
+                            <button
+                              type="button"
+                              onClick={() => handleClearProvider('anthropic')}
+                              disabled={saving()}
+                              class="px-2 py-1 text-xs bg-red-100 dark:bg-red-900 text-red-700 dark:text-red-300 rounded hover:bg-red-200 dark:hover:bg-red-800 disabled:opacity-50"
+                              title="Clear API key"
+                            >
+                              Clear
+                            </button>
+                          </div>
+                        </Show>
+                      </div>
+                      <Show when={providerTestResult()?.provider === 'anthropic'}>
+                        <p class={`text-xs ${providerTestResult()?.success ? 'text-green-600' : 'text-red-600'}`}>
+                          {providerTestResult()?.message}
+                        </p>
+                      </Show>
+                    </div>
+                  </Show>
+                </div>
+
+                {/* OpenAI */}
+                <div class={`border rounded-lg overflow-hidden ${settings()?.openai_configured ? 'border-green-300 dark:border-green-700' : 'border-gray-200 dark:border-gray-700'}`}>
+                  <button
+                    type="button"
+                    class="w-full px-3 py-2 flex items-center justify-between bg-white dark:bg-gray-800 hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors"
+                    onClick={() => {
+                      const current = expandedProviders();
+                      const next = new Set(current);
+                      if (next.has('openai')) next.delete('openai');
+                      else next.add('openai');
+                      setExpandedProviders(next);
+                    }}
+                  >
+                    <div class="flex items-center gap-2">
+                      <span class="font-medium text-sm">OpenAI</span>
+                      <Show when={settings()?.openai_configured}>
+                        <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">Configured</span>
+                      </Show>
+                    </div>
+                    <svg class={`w-4 h-4 transition-transform ${expandedProviders().has('openai') ? 'rotate-180' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                    </svg>
+                  </button>
+                  <Show when={expandedProviders().has('openai')}>
+                    <div class="px-3 py-3 bg-gray-50 dark:bg-gray-800/50 border-t border-gray-200 dark:border-gray-700 space-y-2">
+                      <input
+                        type="password"
+                        value={form.openaiApiKey}
+                        onInput={(e) => setForm('openaiApiKey', e.currentTarget.value)}
+                        placeholder={settings()?.openai_configured ? '••••••••••• (configured)' : 'sk-...'}
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                      <input
+                        type="url"
+                        value={form.openaiBaseUrl}
+                        onInput={(e) => setForm('openaiBaseUrl', e.currentTarget.value)}
+                        placeholder="Custom base URL (optional, for Azure OpenAI)"
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                      <div class="flex items-center justify-between">
+                        <p class="text-xs text-gray-500">
+                          <a href="https://platform.openai.com/api-keys" target="_blank" rel="noopener" class="text-purple-600 hover:underline">Get API key →</a>
+                        </p>
+                        <Show when={settings()?.openai_configured}>
+                          <div class="flex gap-1">
+                            <button
+                              type="button"
+                              onClick={() => handleTestProvider('openai')}
+                              disabled={testingProvider() === 'openai' || saving()}
+                              class="px-2 py-1 text-xs bg-blue-100 dark:bg-blue-900 text-blue-700 dark:text-blue-300 rounded hover:bg-blue-200 dark:hover:bg-blue-800 disabled:opacity-50"
+                            >
+                              {testingProvider() === 'openai' ? 'Testing...' : 'Test'}
+                            </button>
+                            <button
+                              type="button"
+                              onClick={() => handleClearProvider('openai')}
+                              disabled={saving()}
+                              class="px-2 py-1 text-xs bg-red-100 dark:bg-red-900 text-red-700 dark:text-red-300 rounded hover:bg-red-200 dark:hover:bg-red-800 disabled:opacity-50"
+                              title="Clear API key"
+                            >
+                              Clear
+                            </button>
+                          </div>
+                        </Show>
+                      </div>
+                      <Show when={providerTestResult()?.provider === 'openai'}>
+                        <p class={`text-xs ${providerTestResult()?.success ? 'text-green-600' : 'text-red-600'}`}>
+                          {providerTestResult()?.message}
+                        </p>
+                      </Show>
+                    </div>
+                  </Show>
+                </div>
+
+                {/* DeepSeek */}
+                <div class={`border rounded-lg overflow-hidden ${settings()?.deepseek_configured ? 'border-green-300 dark:border-green-700' : 'border-gray-200 dark:border-gray-700'}`}>
+                  <button
+                    type="button"
+                    class="w-full px-3 py-2 flex items-center justify-between bg-white dark:bg-gray-800 hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors"
+                    onClick={() => {
+                      const current = expandedProviders();
+                      const next = new Set(current);
+                      if (next.has('deepseek')) next.delete('deepseek');
+                      else next.add('deepseek');
+                      setExpandedProviders(next);
+                    }}
+                  >
+                    <div class="flex items-center gap-2">
+                      <span class="font-medium text-sm">DeepSeek</span>
+                      <Show when={settings()?.deepseek_configured}>
+                        <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">Configured</span>
+                      </Show>
+                    </div>
+                    <svg class={`w-4 h-4 transition-transform ${expandedProviders().has('deepseek') ? 'rotate-180' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                    </svg>
+                  </button>
+                  <Show when={expandedProviders().has('deepseek')}>
+                    <div class="px-3 py-3 bg-gray-50 dark:bg-gray-800/50 border-t border-gray-200 dark:border-gray-700 space-y-2">
+                      <input
+                        type="password"
+                        value={form.deepseekApiKey}
+                        onInput={(e) => setForm('deepseekApiKey', e.currentTarget.value)}
+                        placeholder={settings()?.deepseek_configured ? '••••••••••• (configured)' : 'sk-...'}
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                      <div class="flex items-center justify-between">
+                        <p class="text-xs text-gray-500">
+                          <a href="https://platform.deepseek.com/api_keys" target="_blank" rel="noopener" class="text-purple-600 hover:underline">Get API key →</a>
+                        </p>
+                        <Show when={settings()?.deepseek_configured}>
+                          <div class="flex gap-1">
+                            <button
+                              type="button"
+                              onClick={() => handleTestProvider('deepseek')}
+                              disabled={testingProvider() === 'deepseek' || saving()}
+                              class="px-2 py-1 text-xs bg-blue-100 dark:bg-blue-900 text-blue-700 dark:text-blue-300 rounded hover:bg-blue-200 dark:hover:bg-blue-800 disabled:opacity-50"
+                            >
+                              {testingProvider() === 'deepseek' ? 'Testing...' : 'Test'}
+                            </button>
+                            <button
+                              type="button"
+                              onClick={() => handleClearProvider('deepseek')}
+                              disabled={saving()}
+                              class="px-2 py-1 text-xs bg-red-100 dark:bg-red-900 text-red-700 dark:text-red-300 rounded hover:bg-red-200 dark:hover:bg-red-800 disabled:opacity-50"
+                              title="Clear API key"
+                            >
+                              Clear
+                            </button>
+                          </div>
+                        </Show>
+                      </div>
+                      <Show when={providerTestResult()?.provider === 'deepseek'}>
+                        <p class={`text-xs ${providerTestResult()?.success ? 'text-green-600' : 'text-red-600'}`}>
+                          {providerTestResult()?.message}
+                        </p>
+                      </Show>
+                    </div>
+                  </Show>
+                </div>
+
+                {/* Ollama */}
+                <div class={`border rounded-lg overflow-hidden ${settings()?.ollama_configured ? 'border-green-300 dark:border-green-700' : 'border-gray-200 dark:border-gray-700'}`}>
+                  <button
+                    type="button"
+                    class="w-full px-3 py-2 flex items-center justify-between bg-white dark:bg-gray-800 hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors"
+                    onClick={() => {
+                      const current = expandedProviders();
+                      const next = new Set(current);
+                      if (next.has('ollama')) next.delete('ollama');
+                      else next.add('ollama');
+                      setExpandedProviders(next);
+                    }}
+                  >
+                    <div class="flex items-center gap-2">
+                      <span class="font-medium text-sm">Ollama</span>
+                      <Show when={settings()?.ollama_configured}>
+                        <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">Available</span>
+                      </Show>
+                    </div>
+                    <svg class={`w-4 h-4 transition-transform ${expandedProviders().has('ollama') ? 'rotate-180' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                    </svg>
+                  </button>
+                  <Show when={expandedProviders().has('ollama')}>
+                    <div class="px-3 py-3 bg-gray-50 dark:bg-gray-800/50 border-t border-gray-200 dark:border-gray-700 space-y-2">
+                      <input
+                        type="url"
+                        value={form.ollamaBaseUrl}
+                        onInput={(e) => setForm('ollamaBaseUrl', e.currentTarget.value)}
+                        placeholder="http://localhost:11434"
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                      <div class="flex items-center justify-between">
+                        <p class="text-xs text-gray-500">
+                          <a href="https://ollama.ai" target="_blank" rel="noopener" class="text-purple-600 hover:underline">Learn about Ollama →</a>
+                          <span class="text-gray-400"> · Free & local</span>
+                        </p>
+                        <Show when={settings()?.ollama_configured}>
+                          <div class="flex gap-1">
+                            <button
+                              type="button"
+                              onClick={() => handleTestProvider('ollama')}
+                              disabled={testingProvider() === 'ollama' || saving()}
+                              class="px-2 py-1 text-xs bg-blue-100 dark:bg-blue-900 text-blue-700 dark:text-blue-300 rounded hover:bg-blue-200 dark:hover:bg-blue-800 disabled:opacity-50"
+                            >
+                              {testingProvider() === 'ollama' ? 'Testing...' : 'Test'}
+                            </button>
+                            <button
+                              type="button"
+                              onClick={() => handleClearProvider('ollama')}
+                              disabled={saving()}
+                              class="px-2 py-1 text-xs bg-red-100 dark:bg-red-900 text-red-700 dark:text-red-300 rounded hover:bg-red-200 dark:hover:bg-red-800 disabled:opacity-50"
+                              title="Clear Ollama URL"
+                            >
+                              Clear
+                            </button>
+                          </div>
+                        </Show>
+                      </div>
+                      <Show when={providerTestResult()?.provider === 'ollama'}>
+                        <p class={`text-xs ${providerTestResult()?.success ? 'text-green-600' : 'text-red-600'}`}>
+                          {providerTestResult()?.message}
+                        </p>
+                      </Show>
+                    </div>
+                  </Show>
+                </div>
+              </div>
+            </div>
+
+            {/* Autonomous Mode */}
+            <div class={`${formField} p-4 rounded-lg border ${form.autonomousMode ? 'bg-amber-50 dark:bg-amber-900/20 border-amber-200 dark:border-amber-800' : 'bg-gray-50 dark:bg-gray-800/50 border-gray-200 dark:border-gray-700'}`}>
+              <div class="flex items-start justify-between gap-4">
+                <div class="flex-1">
+                  <label class={`${labelClass()} flex items-center gap-2`}>
+                    Autonomous Mode
+                    <Show when={form.autonomousMode}>
+                      <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-amber-200 dark:bg-amber-800 text-amber-800 dark:text-amber-200 rounded">
+                        ENABLED
+                      </span>
+                    </Show>
+                  </label>
+                  <p class="text-xs text-gray-600 dark:text-gray-400 mt-1">
+                    {form.autonomousMode
+                      ? 'AI will execute all commands without asking for approval. Only enable if you trust your configured model.'
+                      : 'AI will ask for approval before running commands that modify your system. Read-only commands (like df, ps, docker stats) run automatically.'}
+                  </p>
+                </div>
+                <Toggle
+                  checked={form.autonomousMode}
+                  onChange={(event) => setForm('autonomousMode', event.currentTarget.checked)}
+                  disabled={saving()}
+                />
+              </div>
+            </div>
+
+            {/* AI Patrol & Efficiency Settings */}
+            <div class={`${formField} p-4 rounded-lg border bg-blue-50 dark:bg-blue-900/20 border-blue-200 dark:border-blue-800`}>
+              <div class="mb-3">
+                <label class={`${labelClass()} flex items-center gap-2`}>
+                  <svg class="w-4 h-4 text-blue-600 dark:text-blue-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
+                  </svg>
+                  AI Patrol & Token Efficiency
+                </label>
+                <p class="text-xs text-blue-700 dark:text-blue-300 mt-1">
+                  Configure how AI monitors your infrastructure. Balance between coverage and token usage.
+                </p>
+              </div>
+
+              {/* Patrol Interval */}
+              <div class="space-y-3">
+                <div>
+                  <label class="block text-xs font-medium text-gray-700 dark:text-gray-300 mb-1.5">
+                    Background Patrol Interval (minutes)
+                  </label>
+                  <div class="flex items-center gap-2">
+                    <input
+                      type="number"
+                      class={controlClass()}
+                      value={form.patrolIntervalMinutes}
+                      onInput={(e) => {
+                        const value = parseInt(e.currentTarget.value, 10);
+                        if (!isNaN(value)) {
+                          setForm('patrolIntervalMinutes', Math.max(0, value));
+                        }
+                      }}
+                      min={0}
+                      max={10080}
+                      step={15}
+                      disabled={saving()}
+                      style={{ width: '120px' }}
+                    />
+                    <span class="text-xs text-gray-500 dark:text-gray-400">
+                      {form.patrolIntervalMinutes === 0
+                        ? 'Disabled'
+                        : form.patrolIntervalMinutes >= 60
+                          ? `${Math.floor(form.patrolIntervalMinutes / 60)}h ${form.patrolIntervalMinutes % 60 > 0 ? `${form.patrolIntervalMinutes % 60}m` : ''}`
+                          : `${form.patrolIntervalMinutes}m`}
+                    </span>
+                  </div>
+                  <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
+                    Set to 0 to disable scheduled patrol. Minimum 10 minutes when enabled.
+                  </p>
+                </div>
+
+                {/* Alert-Triggered Analysis Toggle */}
+                <div class="flex items-start justify-between gap-4 pt-2">
+                  <div class="flex-1">
+                    <label class="block text-xs font-medium text-gray-700 dark:text-gray-300 flex items-center gap-2">
+                      Alert-Triggered Analysis
+                      <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">
+                        TOKEN EFFICIENT
+                      </span>
+                    </label>
+                    <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
+                      When enabled, AI automatically analyzes specific resources when alerts fire.
+                      Uses minimal tokens since it only analyzes affected resources.
+                    </p>
+                  </div>
+                  <Toggle
+                    checked={form.alertTriggeredAnalysis}
+                    onChange={(event) => setForm('alertTriggeredAnalysis', event.currentTarget.checked)}
+                    disabled={saving()}
+                  />
+                </div>
+
+                {/* Auto-Fix Mode Toggle */}
+                <div class="flex items-start justify-between gap-4 pt-3 mt-3 border-t border-blue-200 dark:border-blue-800">
+                  <div class="flex-1">
+                    <label class="block text-xs font-medium text-gray-700 dark:text-gray-300 flex items-center gap-2">
+                      Auto-Fix Mode
+                      <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-amber-100 dark:bg-amber-900 text-amber-700 dark:text-amber-300 rounded">
+                        ADVANCED
+                      </span>
+                    </label>
+                    <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
+                      When enabled, patrol can attempt automatic remediation of issues.
+                      When disabled (default), patrol only observes and reports - it won't make changes.
+                    </p>
+                  </div>
+                  <Toggle
+                    checked={form.patrolAutoFix}
+                    onChange={(event) => {
+                      // Can only enable if acknowledged
+                      if (event.currentTarget.checked && !autoFixAcknowledged()) {
+                        return; // Prevent enabling without acknowledgement
+                      }
+                      setForm('patrolAutoFix', event.currentTarget.checked);
+                    }}
+                    disabled={saving() || (!form.patrolAutoFix && !autoFixAcknowledged())}
+                  />
+                </div>
+
+                {/* Auto-Fix Warning & Acknowledgement - Simplified inline flow */}
+                <Show when={!form.patrolAutoFix}>
+                  <div class="mt-3 p-4 bg-gradient-to-r from-amber-50 to-orange-50 dark:from-amber-900/30 dark:to-orange-900/30 border border-amber-200 dark:border-amber-800 rounded-xl">
+                    <div class="flex items-start gap-3">
+                      <div class="p-2 bg-amber-100 dark:bg-amber-800 rounded-lg flex-shrink-0">
+                        <svg class="w-5 h-5 text-amber-600 dark:text-amber-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                        </svg>
+                      </div>
+                      <div class="flex-1 min-w-0">
+                        <p class="text-sm font-semibold text-amber-800 dark:text-amber-200 mb-2">Enable Auto-Fix Mode?</p>
+                        <div class="text-xs text-amber-700 dark:text-amber-300 space-y-1 mb-3">
+                          <div class="flex items-center gap-2">
+                            <svg class="w-3.5 h-3.5 flex-shrink-0" fill="currentColor" viewBox="0 0 20 20"><circle cx="10" cy="10" r="3" /></svg>
+                            <span>AI executes remediation commands <strong>without approval</strong></span>
+                          </div>
+                          <div class="flex items-center gap-2">
+                            <svg class="w-3.5 h-3.5 flex-shrink-0" fill="currentColor" viewBox="0 0 20 20"><circle cx="10" cy="10" r="3" /></svg>
+                            <span>Actions may be <strong>irreversible</strong> (restarts, cache clears, etc.)</span>
+                          </div>
+                          <div class="flex items-center gap-2">
+                            <svg class="w-3.5 h-3.5 flex-shrink-0" fill="currentColor" viewBox="0 0 20 20"><circle cx="10" cy="10" r="3" /></svg>
+                            <span>Test in staging/dev environments first</span>
+                          </div>
+                        </div>
+                        <button
+                          type="button"
+                          onClick={() => {
+                            setAutoFixAcknowledged(true);
+                            setForm('patrolAutoFix', true);
+                          }}
+                          disabled={saving()}
+                          class="inline-flex items-center gap-2 px-4 py-2 bg-amber-600 hover:bg-amber-700 text-white text-sm font-medium rounded-lg transition-colors disabled:opacity-50"
+                        >
+                          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+                          </svg>
+                          I understand, enable Auto-Fix
+                        </button>
+                      </div>
+                    </div>
+                  </div>
+                </Show>
+
+                {/* Warning when enabled */}
+                <Show when={form.patrolAutoFix}>
+                  <div class="mt-3 p-3 bg-red-50 dark:bg-red-900/30 border border-red-200 dark:border-red-800 rounded-lg">
+                    <div class="flex gap-2">
+                      <svg class="w-4 h-4 text-red-600 dark:text-red-400 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                      </svg>
+                      <div class="text-xs text-red-800 dark:text-red-200">
+                        <p class="font-semibold">⚠️ Auto-Fix is ENABLED</p>
+                        <p class="mt-1">AI patrol will automatically attempt to fix issues without asking for approval. Review findings regularly.</p>
+                      </div>
+                    </div>
+                  </div>
+
+                  {/* Auto-Fix Model Selector - shown when auto-fix is enabled */}
+                  <div class="mt-3">
+                    <label class={labelClass()}>Auto-Fix Model (Remediation)</label>
+                    <Show when={availableModels().length > 0} fallback={
+                      <input
+                        type="text"
+                        value={form.autoFixModel}
+                        onInput={(e) => setForm('autoFixModel', e.currentTarget.value)}
+                        placeholder="Leave empty to use patrol model"
+                        class={controlClass()}
+                        disabled={saving()}
+                      />
+                    }>
+                      <select
+                        value={form.autoFixModel}
+                        onChange={(e) => setForm('autoFixModel', e.currentTarget.value)}
+                        class={controlClass()}
+                        disabled={saving()}
+                      >
+                        <option value="">Use patrol model ({form.patrolModel || form.model || 'not set'})</option>
+                        <For each={Array.from(groupModelsByProvider(availableModels()).entries())}>
+                          {([provider, models]) => (
+                            <optgroup label={PROVIDER_DISPLAY_NAMES[provider] || provider}>
+                              <For each={models}>
+                                {(model) => (
+                                  <option value={model.id}>
+                                    {model.name || model.id.split(':').pop()}
+                                  </option>
+                                )}
+                              </For>
+                            </optgroup>
+                          )}
+                        </For>
+                      </select>
+                    </Show>
+                    <p class={formHelpText}>
+                      Model for automatic remediation. Use a more capable model for better fix accuracy.
+                    </p>
+                  </div>
+                </Show>
+              </div>
+            </div>
+
+            {/* AI Cost Controls - Prominent positioning */}
+            <div class={`${formField} p-4 rounded-lg border bg-gradient-to-r from-emerald-50 to-teal-50 dark:from-emerald-900/20 dark:to-teal-900/20 border-emerald-200 dark:border-emerald-800`}>
+              <div class="flex items-center gap-3 mb-3">
+                <div class="p-2 bg-emerald-100 dark:bg-emerald-800 rounded-lg">
+                  <svg class="w-5 h-5 text-emerald-600 dark:text-emerald-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8c-1.657 0-3 .895-3 2s1.343 2 3 2 3 .895 3 2-1.343 2-3 2m0-8c1.11 0 2.08.402 2.599 1M12 8V7m0 1v8m0 0v1m0-1c-1.11 0-2.08-.402-2.599-1M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                </div>
+                <div class="flex-1">
+                  <label class={`${labelClass()} flex items-center gap-2`}>
+                    AI Cost Controls
+                    <span class="px-1.5 py-0.5 text-[10px] font-semibold bg-emerald-100 dark:bg-emerald-800 text-emerald-700 dark:text-emerald-300 rounded">RECOMMENDED</span>
+                  </label>
+                  <p class="text-xs text-emerald-700 dark:text-emerald-300 mt-0.5">
+                    Set a budget alert for cross-provider cost tracking
+                  </p>
+                </div>
+              </div>
+
+              <div class="flex flex-col sm:flex-row sm:items-center gap-4">
+                <div class="flex-shrink-0">
+                  <label class="block text-xs font-medium text-gray-700 dark:text-gray-300 mb-1.5">
+                    30-day budget (USD)
+                  </label>
+                  <div class="relative">
+                    <span class="absolute left-3 top-1/2 -translate-y-1/2 text-gray-500 dark:text-gray-400 text-sm">$</span>
+                    <input
+                      type="number"
+                      class="w-32 pl-7 pr-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 focus:ring-2 focus:ring-emerald-500 focus:border-transparent"
+                      value={form.costBudgetUSD30d}
+                      onInput={(e) => setForm('costBudgetUSD30d', e.currentTarget.value)}
+                      min={0}
+                      step={1}
+                      placeholder="0"
+                      disabled={saving()}
+                    />
+                  </div>
+                </div>
+                <div class="flex-1 min-w-0">
+                  <Show when={parseFloat(form.costBudgetUSD30d) > 0}>
+                    <div class="text-xs text-gray-600 dark:text-gray-400 space-y-1">
+                      <div class="flex items-center justify-between">
+                        <span>Daily equivalent</span>
+                        <span class="font-medium text-gray-900 dark:text-gray-100">${(parseFloat(form.costBudgetUSD30d) / 30).toFixed(2)}/day</span>
+                      </div>
+                      <div class="flex items-center justify-between">
+                        <span>Weekly equivalent</span>
+                        <span class="font-medium text-gray-900 dark:text-gray-100">${(parseFloat(form.costBudgetUSD30d) / 4.3).toFixed(2)}/week</span>
+                      </div>
+                    </div>
+                  </Show>
+                  <Show when={!form.costBudgetUSD30d || parseFloat(form.costBudgetUSD30d) === 0}>
+                    <div class="p-2 bg-amber-50 dark:bg-amber-900/30 border border-amber-200 dark:border-amber-700 rounded text-xs text-amber-700 dark:text-amber-300">
+                      💡 Set a budget to get proactive alerts before overspending
+                    </div>
+                  </Show>
+                </div>
+              </div>
+              <p class="text-[10px] text-emerald-600 dark:text-emerald-400 mt-2">
+                This is a cross-provider estimate. Provider dashboards are the source of truth for billing.
+              </p>
+            </div>
+
+
+          </div>
+
+          {/* Status indicator */}
+          <Show when={settings()}>
+            <div
+              class={`flex items-center gap-2 p-3 rounded-lg ${settings()?.configured
+                ? 'bg-green-50 dark:bg-green-900/30 text-green-800 dark:text-green-200'
+                : 'bg-amber-50 dark:bg-amber-900/30 text-amber-800 dark:text-amber-200'
+                }`}
+            >
+              <div
+                class={`w-2 h-2 rounded-full ${settings()?.configured ? 'bg-green-500' : 'bg-amber-500'
+                  }`}
+              />
+              <div class="flex-1">
+                <span class="text-xs font-medium">
+                  {settings()?.configured
+                    ? `Ready • ${settings()?.configured_providers?.length || 0} provider${(settings()?.configured_providers?.length || 0) !== 1 ? 's' : ''} • ${availableModels().length} models`
+                    : 'Configure at least one AI provider above to enable AI features'}
+                </span>
+                <Show when={settings()?.configured && settings()?.model}>
+                  <span class="text-xs opacity-75 ml-2">
+                    • Default: {settings()?.model?.split(':').pop() || settings()?.model}
+                  </span>
+                </Show>
+              </div>
+            </div>
+          </Show>
+
+          {/* Actions */}
+          <div class="flex flex-wrap items-center justify-between gap-3 pt-4">
+            <Show when={settings()?.api_key_set || settings()?.oauth_connected}>
+              <button
+                type="button"
+                class="px-4 py-2 text-sm border border-purple-300 dark:border-purple-600 text-purple-700 dark:text-purple-300 rounded-md hover:bg-purple-50 dark:hover:bg-purple-900/30 disabled:opacity-50 disabled:cursor-not-allowed"
+                onClick={handleTest}
+                disabled={testing() || saving() || loading()}
+              >
+                {testing() ? 'Testing...' : 'Test Connection'}
+              </button>
+            </Show>
+            <div class="flex gap-3 ml-auto">
+              <button
+                type="button"
+                class="px-4 py-2 border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 rounded-md hover:bg-gray-50 dark:hover:bg-gray-700"
+                onClick={() => resetForm(settings())}
+                disabled={saving() || loading()}
+              >
+                Reset
+              </button>
+              <button
+                type="submit"
+                class="px-4 py-2 bg-purple-600 text-white rounded-md hover:bg-purple-700 disabled:opacity-50 disabled:cursor-not-allowed"
+                disabled={saving() || loading()}
+              >
+                {saving() ? 'Saving...' : 'Save changes'}
+              </button>
+            </div>
+          </div>
+        </Show>
+      </form>
+    </Card>
+  );
+};
+
+export default AISettings;
diff --git a/frontend-modern/src/components/Settings/APIAccessPanel.tsx b/frontend-modern/src/components/Settings/APIAccessPanel.tsx
new file mode 100644
index 0000000..32445e2
--- /dev/null
+++ b/frontend-modern/src/components/Settings/APIAccessPanel.tsx
@@ -0,0 +1,57 @@
+import { Component } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import APITokenManager from './APITokenManager';
+import BadgeCheck from 'lucide-solid/icons/badge-check';
+
+interface APIAccessPanelProps {
+  currentTokenHint?: string;
+  onTokensChanged: () => void;
+  refreshing: boolean;
+}
+
+export const APIAccessPanel: Component<APIAccessPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <BadgeCheck class="w-5 h-5 text-blue-600 dark:text-blue-300" />
+            </div>
+            <SectionHeader
+              title="API Access"
+              description="Generate scoped tokens for agents and automation"
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+        <div class="p-6 space-y-3">
+          <p class="text-sm text-gray-600 dark:text-gray-400">
+            Generate scoped tokens for Docker agents, host agents, and automation pipelines. Tokens
+            are shown once—store them securely and rotate when infrastructure changes.
+          </p>
+          <a
+            href="https://github.com/rcourtman/Pulse/blob/main/docs/CONFIGURATION.md#token-scopes"
+            target="_blank"
+            rel="noreferrer"
+            class="inline-flex w-fit items-center gap-2 rounded-md border border-blue-200 bg-blue-50 px-3 py-1.5 text-xs font-semibold text-blue-700 transition-colors hover:bg-blue-100 dark:border-blue-700 dark:bg-blue-900/30 dark:text-blue-200"
+          >
+            View scope reference
+          </a>
+        </div>
+      </Card>
+
+      <APITokenManager
+        currentTokenHint={props.currentTokenHint}
+        onTokensChanged={props.onTokensChanged}
+        refreshing={props.refreshing}
+      />
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/APITokenManager.tsx b/frontend-modern/src/components/Settings/APITokenManager.tsx
index c0b81c4..dba976c 100644
--- a/frontend-modern/src/components/Settings/APITokenManager.tsx
+++ b/frontend-modern/src/components/Settings/APITokenManager.tsx
@@ -802,7 +802,7 @@ export const APITokenManager: Component<APITokenManagerProps> = (props) => {
       </Show>
 
       <Card tone="muted" padding="sm" class="text-xs text-gray-600 dark:text-gray-400">
-        💡 Separate tokens per integration • Rotate regularly •{' '}
+        Separate tokens per integration • Rotate regularly •{' '}
         <a
           class="font-medium text-blue-600 underline-offset-2 hover:underline dark:text-blue-400"
           href={SCOPES_DOC_URL}
diff --git a/frontend-modern/src/components/Settings/BackupsSettingsPanel.tsx b/frontend-modern/src/components/Settings/BackupsSettingsPanel.tsx
new file mode 100644
index 0000000..11ef052
--- /dev/null
+++ b/frontend-modern/src/components/Settings/BackupsSettingsPanel.tsx
@@ -0,0 +1,430 @@
+import { Component, Show, For, Accessor, Setter } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import Clock from 'lucide-solid/icons/clock';
+
+const BACKUP_INTERVAL_OPTIONS = [
+  { value: 0, label: 'Default (~90s)' },
+  { value: 300, label: '5 minutes' },
+  { value: 900, label: '15 minutes' },
+  { value: 1800, label: '30 minutes' },
+  { value: 3600, label: '1 hour' },
+  { value: 21600, label: '6 hours' },
+  { value: 86400, label: '24 hours' },
+];
+
+const BACKUP_INTERVAL_MAX_MINUTES = 7 * 24 * 60; // 7 days
+
+interface BackupsSettingsPanelProps {
+  backupPollingEnabled: Accessor<boolean>;
+  setBackupPollingEnabled: Setter<boolean>;
+  backupPollingInterval: Accessor<number>;
+  setBackupPollingInterval: Setter<number>;
+  backupPollingCustomMinutes: Accessor<number>;
+  setBackupPollingCustomMinutes: Setter<number>;
+  backupPollingUseCustom: Accessor<boolean>;
+  setBackupPollingUseCustom: Setter<boolean>;
+  backupPollingEnvLocked: () => boolean;
+  backupIntervalSelectValue: () => string;
+  backupIntervalSummary: () => string;
+  setHasUnsavedChanges: Setter<boolean>;
+
+  // Export/Import handlers
+  showExportDialog: Accessor<boolean>;
+  setShowExportDialog: Setter<boolean>;
+  showImportDialog: Accessor<boolean>;
+  setShowImportDialog: Setter<boolean>;
+  setUseCustomPassphrase: Setter<boolean>;
+  securityStatus: Accessor<{ hasAuthentication: boolean } | null>;
+}
+
+export const BackupsSettingsPanel: Component<BackupsSettingsPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        {/* Header */}
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <Clock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+            </div>
+            <SectionHeader
+              title="Backups"
+              description="Backup polling and configuration management"
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+
+        <div class="p-6 space-y-8">
+          {/* Backup Polling Section */}
+          <section class="space-y-3">
+            <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+              <svg
+                width="16"
+                height="16"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+              >
+                <circle cx="12" cy="12" r="9" stroke-width="2" />
+                <path
+                  d="M12 7v5l3 3"
+                  stroke-width="2"
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                />
+              </svg>
+              Backup polling
+            </h4>
+            <p class="text-xs text-gray-600 dark:text-gray-400">
+              Control how often Pulse queries Proxmox backup tasks, datastore contents, and guest
+              snapshots. Longer intervals reduce disk activity and API load.
+            </p>
+
+            <div class="space-y-3">
+              {/* Enable toggle */}
+              <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                <div>
+                  <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                    Enable backup polling
+                  </p>
+                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                    Required for dashboard backup status, storage snapshots, and alerting.
+                  </p>
+                </div>
+                <label class="relative inline-flex items-center cursor-pointer">
+                  <input
+                    type="checkbox"
+                    class="sr-only peer"
+                    checked={props.backupPollingEnabled()}
+                    disabled={props.backupPollingEnvLocked()}
+                    onChange={(e) => {
+                      props.setBackupPollingEnabled(e.currentTarget.checked);
+                      if (!props.backupPollingEnvLocked()) {
+                        props.setHasUnsavedChanges(true);
+                      }
+                    }}
+                  />
+                  <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
+                </label>
+              </div>
+
+              {/* Polling interval options */}
+              <Show when={props.backupPollingEnabled()}>
+                <div class="space-y-3 rounded-md border border-gray-200 dark:border-gray-600 p-3">
+                  <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                    <div>
+                      <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                        Polling interval
+                      </label>
+                      <p class="text-xs text-gray-600 dark:text-gray-400">
+                        {props.backupIntervalSummary()}
+                      </p>
+                    </div>
+                    <select
+                      value={props.backupIntervalSelectValue()}
+                      disabled={props.backupPollingEnvLocked()}
+                      onChange={(e) => {
+                        const value = e.currentTarget.value;
+                        if (value === 'custom') {
+                          props.setBackupPollingUseCustom(true);
+                          const minutes = Math.max(1, props.backupPollingCustomMinutes());
+                          props.setBackupPollingInterval(minutes * 60);
+                        } else {
+                          props.setBackupPollingUseCustom(false);
+                          const seconds = parseInt(value, 10);
+                          if (!Number.isNaN(seconds)) {
+                            props.setBackupPollingInterval(seconds);
+                            if (seconds > 0) {
+                              props.setBackupPollingCustomMinutes(
+                                Math.max(1, Math.round(seconds / 60))
+                              );
+                            }
+                          }
+                        }
+                        if (!props.backupPollingEnvLocked()) {
+                          props.setHasUnsavedChanges(true);
+                        }
+                      }}
+                      class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                    >
+                      <For each={BACKUP_INTERVAL_OPTIONS}>
+                        {(option) => <option value={String(option.value)}>{option.label}</option>}
+                      </For>
+                      <option value="custom">Custom interval...</option>
+                    </select>
+                  </div>
+
+                  {/* Custom interval input */}
+                  <Show when={props.backupIntervalSelectValue() === 'custom'}>
+                    <div class="space-y-2">
+                      <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                        Custom interval (minutes)
+                      </label>
+                      <div class="flex items-center gap-3">
+                        <input
+                          type="number"
+                          min="1"
+                          max={BACKUP_INTERVAL_MAX_MINUTES}
+                          value={props.backupPollingCustomMinutes()}
+                          disabled={props.backupPollingEnvLocked()}
+                          onInput={(e) => {
+                            const value = Number(e.currentTarget.value);
+                            if (Number.isNaN(value)) {
+                              return;
+                            }
+                            const clamped = Math.max(
+                              1,
+                              Math.min(BACKUP_INTERVAL_MAX_MINUTES, Math.floor(value))
+                            );
+                            props.setBackupPollingCustomMinutes(clamped);
+                            props.setBackupPollingInterval(clamped * 60);
+                            if (!props.backupPollingEnvLocked()) {
+                              props.setHasUnsavedChanges(true);
+                            }
+                          }}
+                          class="w-24 px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                        />
+                        <span class="text-xs text-gray-500 dark:text-gray-400">
+                          1 - {BACKUP_INTERVAL_MAX_MINUTES} minutes (~7 days max)
+                        </span>
+                      </div>
+                    </div>
+                  </Show>
+                </div>
+              </Show>
+
+              {/* Env override warning */}
+              <Show when={props.backupPollingEnvLocked()}>
+                <div class="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 dark:border-amber-700 dark:bg-amber-900/20 p-3 text-xs text-amber-700 dark:text-amber-200">
+                  <svg
+                    class="w-4 h-4 flex-shrink-0 mt-0.5"
+                    fill="none"
+                    stroke="currentColor"
+                    viewBox="0 0 24 24"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                    />
+                  </svg>
+                  <div>
+                    <p class="font-medium">Environment override detected</p>
+                    <p class="mt-1">
+                      The <code class="font-mono">ENABLE_BACKUP_POLLING</code> or{' '}
+                      <code class="font-mono">BACKUP_POLLING_INTERVAL</code> environment variables
+                      are set. Remove them and restart Pulse to manage backup polling here.
+                    </p>
+                  </div>
+                </div>
+              </Show>
+            </div>
+          </section>
+
+          {/* Backup & Restore Section */}
+          <SectionHeader
+            title="Backup & restore"
+            description="Backup your node configurations and credentials or restore from a previous backup."
+            size="md"
+            class="mb-4"
+          />
+
+          <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+            {/* Export Section */}
+            <div class="group border border-gray-200 dark:border-gray-700 rounded-xl p-5 bg-gradient-to-br from-blue-50/50 to-indigo-50/30 dark:from-blue-900/10 dark:to-indigo-900/10 hover:border-blue-300 dark:hover:border-blue-700 transition-all duration-200">
+              <div class="flex items-start gap-4">
+                <div class="flex-shrink-0 w-12 h-12 bg-gradient-to-br from-blue-500 to-indigo-600 rounded-xl flex items-center justify-center shadow-lg shadow-blue-500/20">
+                  {/* Archive/Download Box Icon */}
+                  <svg
+                    class="w-6 h-6 text-white"
+                    fill="none"
+                    stroke="currentColor"
+                    viewBox="0 0 24 24"
+                    stroke-width="2"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      d="M20 7l-8-4-8 4m16 0l-8 4m8-4v10l-8 4m0-10L4 7m8 4v10M4 7v10l8 4"
+                    />
+                  </svg>
+                </div>
+                <div class="flex-1 min-w-0">
+                  <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100 mb-1">
+                    Export Configuration
+                  </h4>
+                  <p class="text-sm text-gray-600 dark:text-gray-400 mb-3">
+                    Create an encrypted backup package
+                  </p>
+
+                  {/* Feature list */}
+                  <ul class="space-y-1 mb-4">
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-green-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M16.707 5.293a1 1 0 010 1.414l-8 8a1 1 0 01-1.414 0l-4-4a1 1 0 011.414-1.414L8 12.586l7.293-7.293a1 1 0 011.414 0z" clip-rule="evenodd" />
+                      </svg>
+                      <span>All node connections & credentials</span>
+                    </li>
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-green-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M16.707 5.293a1 1 0 010 1.414l-8 8a1 1 0 01-1.414 0l-4-4a1 1 0 011.414-1.414L8 12.586l7.293-7.293a1 1 0 011.414 0z" clip-rule="evenodd" />
+                      </svg>
+                      <span>Alert thresholds & overrides</span>
+                    </li>
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-green-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M16.707 5.293a1 1 0 010 1.414l-8 8a1 1 0 01-1.414 0l-4-4a1 1 0 011.414-1.414L8 12.586l7.293-7.293a1 1 0 011.414 0z" clip-rule="evenodd" />
+                      </svg>
+                      <span>AES-256 encryption</span>
+                    </li>
+                  </ul>
+
+                  <button
+                    type="button"
+                    onClick={() => {
+                      // Default to custom passphrase if no auth is configured
+                      props.setUseCustomPassphrase(!props.securityStatus()?.hasAuthentication);
+                      props.setShowExportDialog(true);
+                    }}
+                    class="w-full sm:w-auto px-4 py-2 bg-gradient-to-r from-blue-600 to-indigo-600 text-white text-sm font-medium rounded-lg hover:from-blue-700 hover:to-indigo-700 transition-all duration-200 inline-flex items-center justify-center gap-2 shadow-md hover:shadow-lg"
+                  >
+                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
+                      />
+                    </svg>
+                    Create Backup
+                  </button>
+                </div>
+              </div>
+            </div>
+
+            {/* Import Section */}
+            <div class="group border border-gray-200 dark:border-gray-700 rounded-xl p-5 bg-gradient-to-br from-gray-50/50 to-slate-50/30 dark:from-gray-800/30 dark:to-slate-800/20 hover:border-gray-400 dark:hover:border-gray-600 transition-all duration-200">
+              <div class="flex items-start gap-4">
+                <div class="flex-shrink-0 w-12 h-12 bg-gradient-to-br from-gray-500 to-slate-600 rounded-xl flex items-center justify-center shadow-lg shadow-gray-500/20">
+                  {/* Upload/Restore Icon */}
+                  <svg
+                    class="w-6 h-6 text-white"
+                    fill="none"
+                    stroke="currentColor"
+                    viewBox="0 0 24 24"
+                    stroke-width="2"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"
+                    />
+                  </svg>
+                </div>
+                <div class="flex-1 min-w-0">
+                  <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100 mb-1">
+                    Restore Configuration
+                  </h4>
+                  <p class="text-sm text-gray-600 dark:text-gray-400 mb-3">
+                    Import from an encrypted backup file
+                  </p>
+
+                  {/* Feature list */}
+                  <ul class="space-y-1 mb-4">
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-blue-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd" />
+                      </svg>
+                      <span>Merge or replace existing config</span>
+                    </li>
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-blue-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd" />
+                      </svg>
+                      <span>Validates backup before applying</span>
+                    </li>
+                    <li class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                      <svg class="w-3.5 h-3.5 text-blue-500" fill="currentColor" viewBox="0 0 20 20">
+                        <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd" />
+                      </svg>
+                      <span>Requires original passphrase</span>
+                    </li>
+                  </ul>
+
+                  <button
+                    type="button"
+                    onClick={() => props.setShowImportDialog(true)}
+                    class="w-full sm:w-auto px-4 py-2 bg-gradient-to-r from-gray-600 to-slate-600 text-white text-sm font-medium rounded-lg hover:from-gray-700 hover:to-slate-700 transition-all duration-200 inline-flex items-center justify-center gap-2 shadow-md hover:shadow-lg"
+                  >
+                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"
+                      />
+                    </svg>
+                    Restore Backup
+                  </button>
+                </div>
+              </div>
+            </div>
+          </div>
+
+          {/* Security Tips */}
+          <div class="mt-6 p-4 bg-gradient-to-r from-amber-50 to-yellow-50 dark:from-amber-900/20 dark:to-yellow-900/10 rounded-xl border border-amber-200 dark:border-amber-800/50">
+            <div class="flex gap-3">
+              {/* Shield Icon */}
+              <div class="flex-shrink-0 w-10 h-10 bg-amber-100 dark:bg-amber-900/40 rounded-lg flex items-center justify-center">
+                <svg
+                  class="w-5 h-5 text-amber-600 dark:text-amber-400"
+                  fill="none"
+                  stroke="currentColor"
+                  viewBox="0 0 24 24"
+                  stroke-width="2"
+                >
+                  <path
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"
+                  />
+                </svg>
+              </div>
+              <div class="flex-1">
+                <p class="text-sm font-medium text-amber-800 dark:text-amber-200 mb-2">Security Tips</p>
+                <ul class="space-y-2">
+                  <li class="flex items-start gap-2 text-xs text-amber-700 dark:text-amber-300">
+                    <svg class="w-4 h-4 text-amber-500 flex-shrink-0 mt-0.5" fill="currentColor" viewBox="0 0 20 20">
+                      <path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd" />
+                    </svg>
+                    <span>Backups contain encrypted credentials and sensitive data</span>
+                  </li>
+                  <li class="flex items-start gap-2 text-xs text-amber-700 dark:text-amber-300">
+                    <svg class="w-4 h-4 text-amber-500 flex-shrink-0 mt-0.5" fill="currentColor" viewBox="0 0 20 20">
+                      <path fill-rule="evenodd" d="M18 8a6 6 0 01-7.743 5.743L10 14l-1 1-1 1H6v2H2v-4l4.257-4.257A6 6 0 1118 8zm-6-4a1 1 0 100 2 2 2 0 012 2 1 1 0 102 0 4 4 0 00-4-4z" clip-rule="evenodd" />
+                    </svg>
+                    <span>Use a strong passphrase (12+ characters, mix of letters, numbers, symbols)</span>
+                  </li>
+                  <li class="flex items-start gap-2 text-xs text-amber-700 dark:text-amber-300">
+                    <svg class="w-4 h-4 text-amber-500 flex-shrink-0 mt-0.5" fill="currentColor" viewBox="0 0 20 20">
+                      <path d="M10 2a5 5 0 00-5 5v2a2 2 0 00-2 2v5a2 2 0 002 2h10a2 2 0 002-2v-5a2 2 0 00-2-2V7a5 5 0 00-5-5zm3 7V7a3 3 0 10-6 0v2h6z" />
+                    </svg>
+                    <span>Store backup files securely and never share the passphrase</span>
+                  </li>
+                </ul>
+              </div>
+            </div>
+          </div>
+        </div>
+      </Card>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/ConfiguredNodeTables.tsx b/frontend-modern/src/components/Settings/ConfiguredNodeTables.tsx
index 7c9f06a..01148ea 100644
--- a/frontend-modern/src/components/Settings/ConfiguredNodeTables.tsx
+++ b/frontend-modern/src/components/Settings/ConfiguredNodeTables.tsx
@@ -20,9 +20,16 @@ type TemperatureSocketCooldownInfo = {
   lastError?: string;
 };
 
+// Host agent info passed from state
+interface HostAgentInfo {
+  hostname: string;
+  status: string;
+}
+
 interface PveNodesTableProps {
   nodes: NodeConfigWithStatus[];
   stateNodes: { instance: string; status?: string; connectionHealth?: string }[];
+  stateHosts?: HostAgentInfo[];
   globalTemperatureMonitoringEnabled?: boolean;
   temperatureTransports?: TemperatureTransportInfo | null;
   onTestConnection: (nodeId: string) => void;
@@ -104,6 +111,7 @@ const resolveTemperatureTransport = (
   node: NodeConfigWithStatus,
   info: TemperatureTransportInfo | null | undefined,
   globalEnabled: boolean,
+  hostAgent?: HostAgentInfo,
 ): TemperatureTransportBadge => {
   const monitoringEnabled = isTemperatureMonitoringEnabled(node, globalEnabled);
   const normalizedTransport = (node.temperatureTransport || '').toLowerCase();
@@ -125,6 +133,15 @@ const resolveTemperatureTransport = (
     };
   }
 
+  // If a host agent is connected and online, it provides temperatures directly
+  if (hostAgent?.status === 'online') {
+    return {
+      label: 'Via agent',
+      badgeClass: 'bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300',
+      description: 'Temperature data from Pulse agent',
+    };
+  }
+
   const key = nodeKey;
   const httpEntry = key ? info?.httpMap?.[key] : undefined;
   const socketStatus = info?.socketStatus;
@@ -185,9 +202,9 @@ const resolveTemperatureTransport = (
         return buildSocketBadge();
       case 'ssh-blocked':
         return {
-          label: 'Proxy required',
+          label: 'Agent required',
           badgeClass: 'bg-amber-100 dark:bg-amber-900 text-amber-700 dark:text-amber-300',
-          description: 'Containerized Pulse requires pulse-sensor-proxy',
+          description: 'Install agent on node for temperature monitoring',
         };
       case 'ssh':
         return {
@@ -271,6 +288,16 @@ const resolvePveStatusMeta = (
   }
 };
 
+// Helper to find matching host agent for a node by hostname matching
+const findMatchingHostAgent = (
+  nodeName: string,
+  hosts: HostAgentInfo[] | undefined,
+): HostAgentInfo | undefined => {
+  if (!hosts || hosts.length === 0) return undefined;
+  const nodeNameLower = nodeName.toLowerCase().trim();
+  return hosts.find((h) => h.hostname.toLowerCase().trim() === nodeNameLower);
+};
+
 export const PveNodesTable: Component<PveNodesTableProps> = (props) => {
   return (
     <Card padding="none" tone="glass" class="overflow-x-auto rounded-lg">
@@ -304,11 +331,13 @@ export const PveNodesTable: Component<PveNodesTableProps> = (props) => {
               const clusterName = createMemo(() =>
                 'clusterName' in node && node.clusterName ? node.clusterName : 'Unknown',
               );
+              const hostAgent = createMemo(() => findMatchingHostAgent(node.name, props.stateHosts));
               const transportMeta = createMemo(() =>
                 resolveTemperatureTransport(
                   node,
                   props.temperatureTransports,
                   props.globalTemperatureMonitoringEnabled ?? true,
+                  hostAgent(),
                 ),
               );
               return (
@@ -410,9 +439,22 @@ export const PveNodesTable: Component<PveNodesTableProps> = (props) => {
                     </div>
                   </td>
                   <td class="align-top px-3 py-3">
-                    <span class="text-xs text-gray-600 dark:text-gray-400">
-                      {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
-                    </span>
+                    <div class="flex flex-col gap-1">
+                      <span class="text-xs text-gray-600 dark:text-gray-400">
+                        {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
+                      </span>
+                      <Show when={node.source === 'agent'}>
+                        <span class="inline-flex items-center gap-1 text-[0.65rem] px-1.5 py-0.5 bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300 rounded w-fit">
+                          <span class="h-1.5 w-1.5 rounded-full bg-purple-500"></span>
+                          Agent
+                        </span>
+                      </Show>
+                      <Show when={node.source === 'script' || (!node.source && node.tokenName)}>
+                        <span class="text-[0.65rem] px-1.5 py-0.5 bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 rounded w-fit">
+                          API only
+                        </span>
+                      </Show>
+                    </div>
                   </td>
                   <td class="align-top px-3 py-3">
                     <div class="flex flex-wrap gap-1">
@@ -603,9 +645,22 @@ export const PbsNodesTable: Component<PbsNodesTableProps> = (props) => {
                     </div>
                   </td>
                   <td class="align-top px-3 py-3">
-                    <span class="text-xs text-gray-600 dark:text-gray-400">
-                      {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
-                    </span>
+                    <div class="flex flex-col gap-1">
+                      <span class="text-xs text-gray-600 dark:text-gray-400">
+                        {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
+                      </span>
+                      <Show when={node.source === 'agent'}>
+                        <span class="inline-flex items-center gap-1 text-[0.65rem] px-1.5 py-0.5 bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300 rounded w-fit">
+                          <span class="h-1.5 w-1.5 rounded-full bg-purple-500"></span>
+                          Agent
+                        </span>
+                      </Show>
+                      <Show when={node.source === 'script' || (!node.source && node.tokenName)}>
+                        <span class="text-[0.65rem] px-1.5 py-0.5 bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 rounded w-fit">
+                          API only
+                        </span>
+                      </Show>
+                    </div>
                   </td>
                   <td class="align-top px-3 py-3">
                     <div class="flex flex-wrap gap-1">
@@ -786,9 +841,22 @@ export const PmgNodesTable: Component<PmgNodesTableProps> = (props) => {
                     </div>
                   </td>
                   <td class="align-top px-3 py-3">
-                    <span class="text-xs text-gray-600 dark:text-gray-400">
-                      {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
-                    </span>
+                    <div class="flex flex-col gap-1">
+                      <span class="text-xs text-gray-600 dark:text-gray-400">
+                        {node.user ? `User: ${node.user}` : `Token: ${node.tokenName}`}
+                      </span>
+                      <Show when={node.source === 'agent'}>
+                        <span class="inline-flex items-center gap-1 text-[0.65rem] px-1.5 py-0.5 bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300 rounded w-fit">
+                          <span class="h-1.5 w-1.5 rounded-full bg-purple-500"></span>
+                          Agent
+                        </span>
+                      </Show>
+                      <Show when={node.source === 'script' || (!node.source && node.tokenName)}>
+                        <span class="text-[0.65rem] px-1.5 py-0.5 bg-gray-100 dark:bg-gray-800 text-gray-600 dark:text-gray-400 rounded w-fit">
+                          API only
+                        </span>
+                      </Show>
+                    </div>
                   </td>
                   <td class="align-top px-3 py-3">
                     <div class="flex flex-wrap gap-1">
diff --git a/frontend-modern/src/components/Settings/DiagnosticsPanel.tsx b/frontend-modern/src/components/Settings/DiagnosticsPanel.tsx
new file mode 100644
index 0000000..bfb0d7c
--- /dev/null
+++ b/frontend-modern/src/components/Settings/DiagnosticsPanel.tsx
@@ -0,0 +1,674 @@
+import { Component, Show, For, createSignal } from 'solid-js';
+import { apiFetchJSON } from '@/utils/apiClient';
+import { showSuccess, showError } from '@/utils/toast';
+import { Card } from '@/components/shared/Card';
+import Activity from 'lucide-solid/icons/activity';
+import Server from 'lucide-solid/icons/server';
+import HardDrive from 'lucide-solid/icons/hard-drive';
+import Database from 'lucide-solid/icons/database';
+import Network from 'lucide-solid/icons/network';
+import Shield from 'lucide-solid/icons/shield';
+import Cpu from 'lucide-solid/icons/cpu';
+import RefreshCw from 'lucide-solid/icons/refresh-cw';
+import Download from 'lucide-solid/icons/download';
+import CheckCircle from 'lucide-solid/icons/check-circle';
+import XCircle from 'lucide-solid/icons/x-circle';
+import AlertTriangle from 'lucide-solid/icons/alert-triangle';
+
+// Type definitions
+interface DiagnosticsNode {
+    id: string;
+    name: string;
+    host: string;
+    type: string;
+    authMethod: string;
+    connected: boolean;
+    error?: string;
+    details?: Record<string, unknown>;
+    lastPoll?: string;
+    clusterInfo?: Record<string, unknown>;
+}
+
+interface DiagnosticsPBS {
+    id: string;
+    name: string;
+    host: string;
+    connected: boolean;
+    error?: string;
+    details?: Record<string, unknown>;
+}
+
+interface SystemDiagnostic {
+    os: string;
+    arch: string;
+    goVersion: string;
+    numCPU: number;
+    numGoroutine: number;
+    memoryMB: number;
+}
+
+interface DiscoveryDiagnostic {
+    enabled: boolean;
+    configuredSubnet?: string;
+    activeSubnet?: string;
+    environmentOverride?: string;
+    subnetAllowlist?: string[];
+    subnetBlocklist?: string[];
+    scanning?: boolean;
+    scanInterval?: string;
+    lastScanStartedAt?: string;
+    lastResultTimestamp?: string;
+    lastResultServers?: number;
+    lastResultErrors?: number;
+}
+
+interface TemperatureProxyDiagnostic {
+    legacySSHDetected: boolean;
+    recommendProxyUpgrade: boolean;
+    socketFound: boolean;
+    socketPath?: string;
+    socketPermissions?: string;
+    socketOwner?: string;
+    socketGroup?: string;
+    proxyReachable?: boolean;
+    proxyVersion?: string;
+    notes?: string[];
+}
+
+interface APITokenDiagnostic {
+    enabled: boolean;
+    tokenCount: number;
+    hasEnvTokens: boolean;
+    hasLegacyToken: boolean;
+    recommendTokenSetup: boolean;
+    recommendTokenRotation: boolean;
+    legacyDockerHostCount?: number;
+    unusedTokenCount?: number;
+    notes?: string[];
+}
+
+interface DockerAgentDiagnostic {
+    hostsTotal: number;
+    hostsOnline: number;
+    hostsReportingVersion: number;
+    hostsWithTokenBinding: number;
+    hostsWithoutTokenBinding: number;
+    hostsWithoutVersion?: number;
+    hostsOutdatedVersion?: number;
+    hostsWithStaleCommand?: number;
+    hostsPendingUninstall?: number;
+    hostsNeedingAttention: number;
+    recommendedAgentVersion?: string;
+    notes?: string[];
+}
+
+interface AlertsDiagnostic {
+    legacyThresholdsDetected: boolean;
+    legacyThresholdSources?: string[];
+    legacyScheduleSettings?: string[];
+    missingCooldown: boolean;
+    missingGroupingWindow: boolean;
+    notes?: string[];
+}
+
+interface DiagnosticsData {
+    version: string;
+    runtime: string;
+    uptime: number;
+    nodes: DiagnosticsNode[];
+    pbs: DiagnosticsPBS[];
+    system: SystemDiagnostic;
+    temperatureProxy?: TemperatureProxyDiagnostic | null;
+    apiTokens?: APITokenDiagnostic | null;
+    dockerAgents?: DockerAgentDiagnostic | null;
+    alerts?: AlertsDiagnostic | null;
+    discovery?: DiscoveryDiagnostic | null;
+    errors: string[];
+}
+
+// Utility functions
+function formatUptime(seconds: number): string {
+    if (seconds < 60) return `${seconds}s`;
+    if (seconds < 3600) return `${Math.floor(seconds / 60)}m ${seconds % 60}s`;
+    const hours = Math.floor(seconds / 3600);
+    const minutes = Math.floor((seconds % 3600) / 60);
+    if (hours < 24) return `${hours}h ${minutes}m`;
+    const days = Math.floor(hours / 24);
+    return `${days}d ${hours % 24}h`;
+}
+
+function formatRelativeTime(timestamp?: string | number): string {
+    if (!timestamp) return 'Never';
+    const date = typeof timestamp === 'string' ? new Date(timestamp) : new Date(timestamp);
+    const now = new Date();
+    const diffMs = now.getTime() - date.getTime();
+    const diffSec = Math.floor(diffMs / 1000);
+
+    if (diffSec < 60) return 'just now';
+    if (diffSec < 3600) return `${Math.floor(diffSec / 60)}m ago`;
+    if (diffSec < 86400) return `${Math.floor(diffSec / 3600)}h ago`;
+    return `${Math.floor(diffSec / 86400)}d ago`;
+}
+
+// DiagnosticCard - a mini card component for individual diagnostic items
+const DiagnosticCard: Component<{
+    title: string;
+    icon: Component<{ class?: string }>;
+    status?: 'success' | 'warning' | 'error' | 'info';
+    children: any;
+}> = (props) => {
+    const statusColors = {
+        success: 'border-green-200 dark:border-green-800 bg-green-50/50 dark:bg-green-900/20',
+        warning: 'border-amber-200 dark:border-amber-800 bg-amber-50/50 dark:bg-amber-900/20',
+        error: 'border-red-200 dark:border-red-800 bg-red-50/50 dark:bg-red-900/20',
+        info: 'border-blue-200 dark:border-blue-800 bg-blue-50/50 dark:bg-blue-900/20',
+    };
+
+    const iconColors = {
+        success: 'text-green-600 dark:text-green-400',
+        warning: 'text-amber-600 dark:text-amber-400',
+        error: 'text-red-600 dark:text-red-400',
+        info: 'text-blue-600 dark:text-blue-400',
+    };
+
+    return (
+        <div class={`rounded-xl border p-4 transition-all hover:shadow-md ${statusColors[props.status || 'info']}`}>
+            <div class="flex items-center gap-3 mb-3">
+                <div class={`p-2 rounded-lg bg-white/60 dark:bg-gray-800/60 ${iconColors[props.status || 'info']}`}>
+                    <props.icon class="w-4 h-4" />
+                </div>
+                <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">{props.title}</h4>
+            </div>
+            <div class="text-xs text-gray-600 dark:text-gray-400 space-y-1.5">
+                {props.children}
+            </div>
+        </div>
+    );
+};
+
+// StatusBadge component
+const StatusBadge: Component<{
+    status: 'online' | 'offline' | 'warning' | 'unknown';
+    label?: string;
+}> = (props) => {
+    const colors = {
+        online: 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300',
+        offline: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300',
+        warning: 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300',
+        unknown: 'bg-gray-100 text-gray-700 dark:bg-gray-700 dark:text-gray-300',
+    };
+
+    return (
+        <span class={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[10px] font-medium uppercase tracking-wide ${colors[props.status]}`}>
+            <span class={`w-1.5 h-1.5 rounded-full ${props.status === 'online' ? 'bg-green-500' : props.status === 'offline' ? 'bg-red-500' : props.status === 'warning' ? 'bg-amber-500' : 'bg-gray-400'}`} />
+            {props.label || props.status}
+        </span>
+    );
+};
+
+// MetricRow component for displaying key-value pairs
+const MetricRow: Component<{
+    label: string;
+    value: string | number | undefined;
+    mono?: boolean;
+}> = (props) => (
+    <div class="flex items-center justify-between py-1.5 border-b border-gray-100 dark:border-gray-700/50 last:border-0">
+        <span class="text-gray-500 dark:text-gray-400">{props.label}</span>
+        <span class={`text-gray-900 dark:text-gray-100 ${props.mono ? 'font-mono text-[11px]' : 'font-medium'}`}>
+            {props.value ?? 'Unknown'}
+        </span>
+    </div>
+);
+
+export const DiagnosticsPanel: Component = () => {
+    const [loading, setLoading] = createSignal(false);
+    const [diagnosticsData, setDiagnosticsData] = createSignal<DiagnosticsData | null>(null);
+    const [exportLoading, setExportLoading] = createSignal(false);
+
+    const runDiagnostics = async () => {
+        setLoading(true);
+        try {
+            const data = await apiFetchJSON('/api/diagnostics') as DiagnosticsData;
+            setDiagnosticsData(data);
+            showSuccess('Diagnostics completed');
+        } catch (error) {
+            showError(error instanceof Error ? error.message : 'Failed to run diagnostics');
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    const exportDiagnostics = async (sanitize: boolean) => {
+        setExportLoading(true);
+        try {
+            const data = diagnosticsData();
+            if (!data) {
+                showError('Run diagnostics first');
+                return;
+            }
+
+            const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+            const url = URL.createObjectURL(blob);
+            const a = document.createElement('a');
+            a.href = url;
+            const type = sanitize ? 'sanitized' : 'full';
+            a.download = `pulse-diagnostics-${type}-${new Date().toISOString().split('T')[0]}.json`;
+            document.body.appendChild(a);
+            a.click();
+            document.body.removeChild(a);
+            URL.revokeObjectURL(url);
+            showSuccess(`Diagnostics exported (${type})`);
+        } finally {
+            setExportLoading(false);
+        }
+    };
+
+    // Calculate overall system health
+    const systemHealth = () => {
+        const data = diagnosticsData();
+        if (!data) return 'unknown';
+
+        const issues: string[] = [];
+
+        // Check node connectivity
+        const disconnectedNodes = data.nodes?.filter(n => !n.connected).length || 0;
+        if (disconnectedNodes > 0) issues.push('nodes');
+
+        // Check PBS connectivity  
+        const disconnectedPbs = data.pbs?.filter(p => !p.connected).length || 0;
+        if (disconnectedPbs > 0) issues.push('pbs');
+
+        // Check for errors
+        if (data.errors?.length > 0) issues.push('errors');
+
+        // Check temperature proxy
+        if (data.temperatureProxy?.legacySSHDetected) issues.push('temperature');
+
+        // Check alerts config
+        if (data.alerts?.legacyThresholdsDetected || data.alerts?.missingCooldown) issues.push('alerts');
+
+        if (issues.length === 0) return 'healthy';
+        if (issues.length <= 2) return 'warning';
+        return 'critical';
+    };
+
+    const healthColor = () => {
+        const health = systemHealth();
+        if (health === 'healthy') return 'from-green-500 to-emerald-600';
+        if (health === 'warning') return 'from-amber-500 to-orange-600';
+        if (health === 'critical') return 'from-red-500 to-rose-600';
+        return 'from-gray-400 to-gray-500';
+    };
+
+    return (
+        <div class="space-y-6">
+            {/* Header Card */}
+            <Card
+                padding="none"
+                class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                border={false}
+            >
+                <div class={`bg-gradient-to-r ${healthColor()} px-6 py-5`}>
+                    <div class="flex items-center justify-between">
+                        <div class="flex items-center gap-4">
+                            <div class="p-3 bg-white/20 rounded-xl backdrop-blur-sm">
+                                <Activity class="w-6 h-6 text-white" />
+                            </div>
+                            <div>
+                                <h2 class="text-lg font-bold text-white">System Diagnostics</h2>
+                                <p class="text-sm text-white/80">
+                                    Connection health, configuration status, and troubleshooting tools
+                                </p>
+                            </div>
+                        </div>
+                        <div class="flex items-center gap-3">
+                            <Show when={diagnosticsData()}>
+                                <div class="text-right text-white/80 text-xs">
+                                    <div>Version {diagnosticsData()?.version}</div>
+                                    <div>Uptime: {formatUptime(diagnosticsData()?.uptime || 0)}</div>
+                                </div>
+                            </Show>
+                            <button
+                                type="button"
+                                onClick={runDiagnostics}
+                                disabled={loading()}
+                                class="flex items-center gap-2 px-4 py-2.5 bg-white/20 hover:bg-white/30 text-white rounded-lg font-medium text-sm transition-all disabled:opacity-50 backdrop-blur-sm"
+                            >
+                                <RefreshCw class={`w-4 h-4 ${loading() ? 'animate-spin' : ''}`} />
+                                {loading() ? 'Running...' : 'Run Diagnostics'}
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                {/* Quick Actions */}
+                <div class="px-6 py-4 bg-gray-50 dark:bg-gray-800/50 border-t border-gray-200 dark:border-gray-700 flex items-center justify-between">
+                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                        Test all connections and inspect runtime configuration
+                    </p>
+                    <Show when={diagnosticsData()}>
+                        <div class="flex items-center gap-2">
+                            <button
+                                type="button"
+                                onClick={() => exportDiagnostics(false)}
+                                disabled={exportLoading()}
+                                class="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium text-gray-700 dark:text-gray-300 bg-white dark:bg-gray-700 border border-gray-200 dark:border-gray-600 rounded-lg hover:bg-gray-50 dark:hover:bg-gray-600 transition-colors"
+                            >
+                                <Download class="w-3.5 h-3.5" />
+                                Export Full
+                            </button>
+                            <button
+                                type="button"
+                                onClick={() => exportDiagnostics(true)}
+                                disabled={exportLoading()}
+                                class="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium text-green-700 dark:text-green-300 bg-green-50 dark:bg-green-900/30 border border-green-200 dark:border-green-800 rounded-lg hover:bg-green-100 dark:hover:bg-green-900/50 transition-colors"
+                            >
+                                <Download class="w-3.5 h-3.5" />
+                                Export for GitHub
+                            </button>
+                        </div>
+                    </Show>
+                </div>
+            </Card>
+
+            {/* Diagnostics Content */}
+            <Show when={diagnosticsData()} fallback={
+                <Card padding="lg" class="text-center">
+                    <div class="py-12">
+                        <Activity class="w-12 h-12 mx-auto text-gray-300 dark:text-gray-600 mb-4" />
+                        <h3 class="text-lg font-medium text-gray-900 dark:text-gray-100 mb-2">
+                            No diagnostics data yet
+                        </h3>
+                        <p class="text-sm text-gray-500 dark:text-gray-400 mb-6">
+                            Click "Run Diagnostics" above to test connections and inspect system status
+                        </p>
+                        <button
+                            type="button"
+                            onClick={runDiagnostics}
+                            disabled={loading()}
+                            class="inline-flex items-center gap-2 px-5 py-2.5 bg-blue-600 hover:bg-blue-700 text-white rounded-lg font-medium text-sm transition-colors disabled:opacity-50"
+                        >
+                            <RefreshCw class={`w-4 h-4 ${loading() ? 'animate-spin' : ''}`} />
+                            Run Diagnostics
+                        </button>
+                    </div>
+                </Card>
+            }>
+                {/* Summary Grid */}
+                <div class="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-4 gap-4">
+                    {/* System Info Card */}
+                    <DiagnosticCard
+                        title="System Runtime"
+                        icon={Cpu}
+                        status="info"
+                    >
+                        <MetricRow label="OS / Arch" value={`${diagnosticsData()?.system?.os || '?'} / ${diagnosticsData()?.system?.arch || '?'}`} />
+                        <MetricRow label="Go Runtime" value={diagnosticsData()?.system?.goVersion} mono />
+                        <MetricRow label="CPU Cores" value={diagnosticsData()?.system?.numCPU} />
+                        <MetricRow label="Goroutines" value={diagnosticsData()?.system?.numGoroutine} />
+                        <MetricRow label="Memory" value={`${diagnosticsData()?.system?.memoryMB || 0} MB`} />
+                    </DiagnosticCard>
+
+                    {/* Nodes Status Card */}
+                    <DiagnosticCard
+                        title="PVE Nodes"
+                        icon={Server}
+                        status={diagnosticsData()?.nodes?.every(n => n.connected) ? 'success' : 'warning'}
+                    >
+                        <div class="flex items-center justify-between mb-2">
+                            <span>Total Nodes</span>
+                            <span class="font-bold text-lg text-gray-900 dark:text-gray-100">
+                                {diagnosticsData()?.nodes?.length || 0}
+                            </span>
+                        </div>
+                        <div class="space-y-1">
+                            <For each={diagnosticsData()?.nodes || []}>
+                                {(node) => (
+                                    <div class="flex items-center justify-between py-1 border-b border-gray-100 dark:border-gray-700/50 last:border-0">
+                                        <span class="truncate max-w-[120px]" title={node.host}>{node.name}</span>
+                                        <StatusBadge status={node.connected ? 'online' : 'offline'} />
+                                    </div>
+                                )}
+                            </For>
+                        </div>
+                    </DiagnosticCard>
+
+                    {/* PBS Status Card */}
+                    <DiagnosticCard
+                        title="PBS Instances"
+                        icon={HardDrive}
+                        status={diagnosticsData()?.pbs?.every(p => p.connected) ? 'success' : (diagnosticsData()?.pbs?.length ? 'warning' : 'info')}
+                    >
+                        <Show when={(diagnosticsData()?.pbs?.length || 0) > 0} fallback={
+                            <div class="text-center py-4 text-gray-400 dark:text-gray-500">
+                                No PBS configured
+                            </div>
+                        }>
+                            <div class="flex items-center justify-between mb-2">
+                                <span>Total Instances</span>
+                                <span class="font-bold text-lg text-gray-900 dark:text-gray-100">
+                                    {diagnosticsData()?.pbs?.length || 0}
+                                </span>
+                            </div>
+                            <div class="space-y-1">
+                                <For each={diagnosticsData()?.pbs || []}>
+                                    {(pbs) => (
+                                        <div class="flex items-center justify-between py-1 border-b border-gray-100 dark:border-gray-700/50 last:border-0">
+                                            <span class="truncate max-w-[120px]" title={pbs.host}>{pbs.name}</span>
+                                            <StatusBadge status={pbs.connected ? 'online' : 'offline'} />
+                                        </div>
+                                    )}
+                                </For>
+                            </div>
+                        </Show>
+                    </DiagnosticCard>
+
+                    {/* Discovery Status Card */}
+                    <DiagnosticCard
+                        title="Network Discovery"
+                        icon={Network}
+                        status={diagnosticsData()?.discovery?.enabled ? 'success' : 'info'}
+                    >
+                        <MetricRow
+                            label="Status"
+                            value={diagnosticsData()?.discovery?.enabled ? 'Enabled' : 'Disabled'}
+                        />
+                        <MetricRow
+                            label="Subnet"
+                            value={diagnosticsData()?.discovery?.configuredSubnet || 'auto'}
+                            mono
+                        />
+                        <MetricRow
+                            label="Scan Interval"
+                            value={diagnosticsData()?.discovery?.scanInterval || 'default'}
+                        />
+                        <MetricRow
+                            label="Last Scan"
+                            value={formatRelativeTime(diagnosticsData()?.discovery?.lastScanStartedAt)}
+                        />
+                        <MetricRow
+                            label="Servers Found"
+                            value={diagnosticsData()?.discovery?.lastResultServers ?? 0}
+                        />
+                    </DiagnosticCard>
+                </div>
+
+                {/* Detailed Status Cards */}
+                <div class="grid grid-cols-1 lg:grid-cols-2 gap-4">
+                    {/* Temperature Proxy */}
+                    <Show when={diagnosticsData()?.temperatureProxy}>
+                        <Card padding="md">
+                            <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                                <div class="p-2 rounded-lg bg-orange-100 dark:bg-orange-900/30">
+                                    <Activity class="w-4 h-4 text-orange-600 dark:text-orange-400" />
+                                </div>
+                                <div>
+                                    <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Temperature Proxy</h4>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">Hardware temperature monitoring</p>
+                                </div>
+                                <div class="ml-auto">
+                                    <StatusBadge
+                                        status={diagnosticsData()?.temperatureProxy?.socketFound ? 'online' : 'warning'}
+                                        label={diagnosticsData()?.temperatureProxy?.socketFound ? 'Connected' : 'Not Found'}
+                                    />
+                                </div>
+                            </div>
+                            <div class="grid grid-cols-2 gap-3 text-xs">
+                                <div class="flex items-center gap-2">
+                                    {diagnosticsData()?.temperatureProxy?.socketFound ?
+                                        <CheckCircle class="w-4 h-4 text-green-500" /> :
+                                        <XCircle class="w-4 h-4 text-red-500" />
+                                    }
+                                    <span>Proxy Socket</span>
+                                </div>
+                                <div class="flex items-center gap-2">
+                                    {diagnosticsData()?.temperatureProxy?.proxyReachable ?
+                                        <CheckCircle class="w-4 h-4 text-green-500" /> :
+                                        <AlertTriangle class="w-4 h-4 text-amber-500" />
+                                    }
+                                    <span>Daemon</span>
+                                </div>
+                            </div>
+                            <Show when={diagnosticsData()?.temperatureProxy?.proxyVersion}>
+                                <div class="mt-3 pt-3 border-t border-gray-100 dark:border-gray-700/50 text-xs text-gray-500 dark:text-gray-400">
+                                    Version: {diagnosticsData()?.temperatureProxy?.proxyVersion}
+                                </div>
+                            </Show>
+                            <Show when={diagnosticsData()?.temperatureProxy?.legacySSHDetected}>
+                                <div class="mt-3 p-2 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded text-xs text-amber-700 dark:text-amber-300">
+                                    ⚠️ Legacy SSH temperature collection detected - consider upgrading
+                                </div>
+                            </Show>
+                        </Card>
+                    </Show>
+
+                    {/* API Tokens */}
+                    <Show when={diagnosticsData()?.apiTokens}>
+                        <Card padding="md">
+                            <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                                <div class="p-2 rounded-lg bg-blue-100 dark:bg-blue-900/30">
+                                    <Shield class="w-4 h-4 text-blue-600 dark:text-blue-400" />
+                                </div>
+                                <div>
+                                    <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">API Tokens</h4>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">Authentication status</p>
+                                </div>
+                                <div class="ml-auto">
+                                    <StatusBadge
+                                        status={diagnosticsData()?.apiTokens?.enabled ? 'online' : 'warning'}
+                                        label={diagnosticsData()?.apiTokens?.enabled ? 'Enabled' : 'Disabled'}
+                                    />
+                                </div>
+                            </div>
+                            <div class="space-y-2 text-xs">
+                                <MetricRow label="Configured Tokens" value={diagnosticsData()?.apiTokens?.tokenCount} />
+                                <MetricRow label="Unused Tokens" value={diagnosticsData()?.apiTokens?.unusedTokenCount ?? 0} />
+                                <MetricRow label="Legacy Docker Hosts" value={diagnosticsData()?.apiTokens?.legacyDockerHostCount ?? 0} />
+                            </div>
+                            <Show when={diagnosticsData()?.apiTokens?.hasLegacyToken}>
+                                <div class="mt-3 p-2 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded text-xs text-amber-700 dark:text-amber-300">
+                                    ⚠️ Legacy token detected - consider migrating to scoped tokens
+                                </div>
+                            </Show>
+                        </Card>
+                    </Show>
+
+                    {/* Docker Agents */}
+                    <Show when={diagnosticsData()?.dockerAgents}>
+                        <Card padding="md">
+                            <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                                <div class="p-2 rounded-lg bg-purple-100 dark:bg-purple-900/30">
+                                    <Database class="w-4 h-4 text-purple-600 dark:text-purple-400" />
+                                </div>
+                                <div>
+                                    <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Docker Agents</h4>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">Container monitoring</p>
+                                </div>
+                                <div class="ml-auto text-right">
+                                    <div class="text-lg font-bold text-gray-900 dark:text-gray-100">
+                                        {diagnosticsData()?.dockerAgents?.hostsOnline}/{diagnosticsData()?.dockerAgents?.hostsTotal}
+                                    </div>
+                                    <div class="text-[10px] text-gray-500 dark:text-gray-400">online</div>
+                                </div>
+                            </div>
+                            <div class="space-y-2 text-xs">
+                                <MetricRow label="With Token Binding" value={diagnosticsData()?.dockerAgents?.hostsWithTokenBinding} />
+                                <MetricRow label="Need Attention" value={diagnosticsData()?.dockerAgents?.hostsNeedingAttention} />
+                                <MetricRow label="Outdated Version" value={diagnosticsData()?.dockerAgents?.hostsOutdatedVersion ?? 0} />
+                            </div>
+                            <Show when={diagnosticsData()?.dockerAgents?.recommendedAgentVersion}>
+                                <div class="mt-3 pt-2 border-t border-gray-100 dark:border-gray-700/50 text-xs text-gray-500 dark:text-gray-400">
+                                    Recommended version: {diagnosticsData()?.dockerAgents?.recommendedAgentVersion}
+                                </div>
+                            </Show>
+                        </Card>
+                    </Show>
+
+                    {/* Alerts Configuration */}
+                    <Show when={diagnosticsData()?.alerts}>
+                        <Card padding="md">
+                            <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                                <div class="p-2 rounded-lg bg-rose-100 dark:bg-rose-900/30">
+                                    <AlertTriangle class="w-4 h-4 text-rose-600 dark:text-rose-400" />
+                                </div>
+                                <div>
+                                    <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Alerts Configuration</h4>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">Alert system status</p>
+                                </div>
+                            </div>
+                            <div class="flex flex-wrap gap-2">
+                                <span class={`px-2 py-1 rounded text-xs font-medium ${diagnosticsData()?.alerts?.legacyThresholdsDetected
+                                    ? 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300'
+                                    : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
+                                    }`}>
+                                    Legacy thresholds: {diagnosticsData()?.alerts?.legacyThresholdsDetected ? 'Detected' : 'Migrated'}
+                                </span>
+                                <span class={`px-2 py-1 rounded text-xs font-medium ${diagnosticsData()?.alerts?.missingCooldown
+                                    ? 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300'
+                                    : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
+                                    }`}>
+                                    Cooldown: {diagnosticsData()?.alerts?.missingCooldown ? 'Missing' : 'Configured'}
+                                </span>
+                                <span class={`px-2 py-1 rounded text-xs font-medium ${diagnosticsData()?.alerts?.missingGroupingWindow
+                                    ? 'bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-300'
+                                    : 'bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
+                                    }`}>
+                                    Grouping: {diagnosticsData()?.alerts?.missingGroupingWindow ? 'Disabled' : 'Enabled'}
+                                </span>
+                            </div>
+                            <Show when={(diagnosticsData()?.alerts?.notes?.length || 0) > 0}>
+                                <ul class="mt-3 pt-2 border-t border-gray-100 dark:border-gray-700/50 space-y-1 text-xs text-gray-500 dark:text-gray-400 list-disc pl-4">
+                                    <For each={diagnosticsData()?.alerts?.notes || []}>
+                                        {(note) => <li>{note}</li>}
+                                    </For>
+                                </ul>
+                            </Show>
+                        </Card>
+                    </Show>
+                </div>
+
+                {/* Errors Section */}
+                <Show when={(diagnosticsData()?.errors?.length || 0) > 0}>
+                    <Card padding="md" class="border-red-200 dark:border-red-800 bg-red-50/50 dark:bg-red-900/20">
+                        <div class="flex items-center gap-3 mb-3">
+                            <XCircle class="w-5 h-5 text-red-600 dark:text-red-400" />
+                            <h4 class="text-sm font-semibold text-red-900 dark:text-red-100">Errors Detected</h4>
+                        </div>
+                        <ul class="space-y-2 text-xs text-red-700 dark:text-red-300">
+                            <For each={diagnosticsData()?.errors || []}>
+                                {(error) => (
+                                    <li class="flex items-start gap-2 p-2 bg-red-100 dark:bg-red-900/40 rounded">
+                                        <span class="text-red-500">•</span>
+                                        <span>{error}</span>
+                                    </li>
+                                )}
+                            </For>
+                        </ul>
+                    </Card>
+                </Show>
+            </Show>
+        </div>
+    );
+};
+
+export default DiagnosticsPanel;
diff --git a/frontend-modern/src/components/Settings/GeneralSettingsPanel.tsx b/frontend-modern/src/components/Settings/GeneralSettingsPanel.tsx
new file mode 100644
index 0000000..73d20ba
--- /dev/null
+++ b/frontend-modern/src/components/Settings/GeneralSettingsPanel.tsx
@@ -0,0 +1,224 @@
+import { Component, Show, For, Accessor, Setter } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { Toggle } from '@/components/shared/Toggle';
+import Sliders from 'lucide-solid/icons/sliders-horizontal';
+import Activity from 'lucide-solid/icons/activity';
+import Sun from 'lucide-solid/icons/sun';
+import Moon from 'lucide-solid/icons/moon';
+
+const PVE_POLLING_MIN_SECONDS = 10;
+const PVE_POLLING_MAX_SECONDS = 3600;
+const PVE_POLLING_PRESETS = [
+  { label: 'Realtime (10s)', value: 10 },
+  { label: 'Balanced (30s)', value: 30 },
+  { label: 'Low (60s)', value: 60 },
+  { label: 'Very low (5m)', value: 300 },
+];
+
+interface GeneralSettingsPanelProps {
+  darkMode: Accessor<boolean>;
+  toggleDarkMode: () => void;
+  pvePollingInterval: Accessor<number>;
+  setPVEPollingInterval: Setter<number>;
+  pvePollingSelection: Accessor<number | 'custom'>;
+  setPVEPollingSelection: Setter<number | 'custom'>;
+  pvePollingCustomSeconds: Accessor<number>;
+  setPVEPollingCustomSeconds: Setter<number>;
+  pvePollingEnvLocked: () => boolean;
+  setHasUnsavedChanges: Setter<boolean>;
+}
+
+export const GeneralSettingsPanel: Component<GeneralSettingsPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      {/* Appearance Card */}
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <Sliders class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+            </div>
+            <SectionHeader
+              title="General"
+              description="Appearance and display preferences"
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+        <div class="p-6 space-y-5">
+          <div class="flex items-center justify-between gap-4">
+            <div class="flex items-center gap-3">
+              {/* Animated theme icon */}
+              <div class={`relative p-2.5 rounded-xl transition-all duration-300 ${props.darkMode()
+                  ? 'bg-gradient-to-br from-indigo-500 to-purple-600 shadow-lg shadow-indigo-500/25'
+                  : 'bg-gradient-to-br from-amber-400 to-orange-500 shadow-lg shadow-amber-500/25'
+                }`}>
+                <div class="relative w-5 h-5">
+                  <Sun class={`absolute inset-0 w-5 h-5 text-white transition-all duration-300 ${props.darkMode() ? 'opacity-0 rotate-90 scale-50' : 'opacity-100 rotate-0 scale-100'
+                    }`} strokeWidth={2} />
+                  <Moon class={`absolute inset-0 w-5 h-5 text-white transition-all duration-300 ${props.darkMode() ? 'opacity-100 rotate-0 scale-100' : 'opacity-0 -rotate-90 scale-50'
+                    }`} strokeWidth={2} />
+                </div>
+              </div>
+              <div class="text-sm text-gray-600 dark:text-gray-400">
+                <p class="font-medium text-gray-900 dark:text-gray-100">
+                  {props.darkMode() ? 'Dark mode' : 'Light mode'}
+                </p>
+                <p class="text-xs text-gray-500 dark:text-gray-400">
+                  Toggle to match your environment. Pulse remembers this preference on each browser.
+                </p>
+              </div>
+            </div>
+            <Toggle
+              checked={props.darkMode()}
+              onChange={(event) => {
+                const desired = (event.currentTarget as HTMLInputElement).checked;
+                if (desired !== props.darkMode()) {
+                  props.toggleDarkMode();
+                }
+              }}
+            />
+          </div>
+        </div>
+      </Card>
+
+      {/* Monitoring Cadence Card */}
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <Activity class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+            </div>
+            <SectionHeader
+              title="Monitoring cadence"
+              description="Control how frequently Pulse polls Proxmox VE nodes."
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+        <div class="p-6 space-y-5">
+          <div class="space-y-2">
+            <p class="text-sm text-gray-600 dark:text-gray-400">
+              Shorter intervals provide near-real-time updates at the cost of higher API and CPU
+              usage on each node. Set a longer interval to reduce load on busy clusters.
+            </p>
+            <p class="text-xs text-gray-500 dark:text-gray-400">
+              Current cadence: {props.pvePollingInterval()} seconds (
+              {props.pvePollingInterval() >= 60
+                ? `${(props.pvePollingInterval() / 60).toFixed(
+                  props.pvePollingInterval() % 60 === 0 ? 0 : 1
+                )} minute${props.pvePollingInterval() / 60 === 1 ? '' : 's'}`
+                : 'under a minute'}
+              ).
+            </p>
+          </div>
+
+          <div class="space-y-4">
+            {/* Preset buttons */}
+            <div class="grid gap-2 sm:grid-cols-3">
+              <For each={PVE_POLLING_PRESETS}>
+                {(option) => (
+                  <button
+                    type="button"
+                    class={`rounded-lg border px-3 py-2 text-left text-sm transition-colors ${props.pvePollingSelection() === option.value
+                      ? 'border-blue-500 bg-blue-50 text-blue-700 dark:border-blue-400 dark:bg-blue-900/30 dark:text-blue-100'
+                      : 'border-gray-200 bg-white text-gray-700 hover:border-blue-400 hover:text-blue-600 dark:border-gray-600 dark:bg-gray-900/50 dark:text-gray-200'
+                      } ${props.pvePollingEnvLocked() ? 'opacity-60 cursor-not-allowed' : ''}`}
+                    disabled={props.pvePollingEnvLocked()}
+                    onClick={() => {
+                      if (props.pvePollingEnvLocked()) return;
+                      props.setPVEPollingSelection(option.value);
+                      props.setPVEPollingInterval(option.value);
+                      props.setHasUnsavedChanges(true);
+                    }}
+                  >
+                    {option.label}
+                  </button>
+                )}
+              </For>
+              <button
+                type="button"
+                class={`rounded-lg border px-3 py-2 text-left text-sm transition-colors ${props.pvePollingSelection() === 'custom'
+                  ? 'border-blue-500 bg-blue-50 text-blue-700 dark:border-blue-400 dark:bg-blue-900/30 dark:text-blue-100'
+                  : 'border-gray-200 bg-white text-gray-700 hover:border-blue-400 hover:text-blue-600 dark:border-gray-600 dark:bg-gray-900/50 dark:text-gray-200'
+                  } ${props.pvePollingEnvLocked() ? 'opacity-60 cursor-not-allowed' : ''}`}
+                disabled={props.pvePollingEnvLocked()}
+                onClick={() => {
+                  if (props.pvePollingEnvLocked()) return;
+                  props.setPVEPollingSelection('custom');
+                  props.setPVEPollingInterval(props.pvePollingCustomSeconds());
+                  props.setHasUnsavedChanges(true);
+                }}
+              >
+                Custom interval
+              </button>
+            </div>
+
+            {/* Custom interval input */}
+            <Show when={props.pvePollingSelection() === 'custom'}>
+              <div class="space-y-2 rounded-md border border-dashed border-gray-300 p-4 dark:border-gray-600">
+                <label class="text-xs font-medium text-gray-700 dark:text-gray-200">
+                  Custom polling interval (10-3600 seconds)
+                </label>
+                <input
+                  type="number"
+                  min={PVE_POLLING_MIN_SECONDS}
+                  max={PVE_POLLING_MAX_SECONDS}
+                  value={props.pvePollingCustomSeconds()}
+                  class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-900/60"
+                  disabled={props.pvePollingEnvLocked()}
+                  onInput={(e) => {
+                    if (props.pvePollingEnvLocked()) return;
+                    const parsed = Math.floor(Number(e.currentTarget.value));
+                    if (Number.isNaN(parsed)) {
+                      return;
+                    }
+                    const clamped = Math.min(
+                      PVE_POLLING_MAX_SECONDS,
+                      Math.max(PVE_POLLING_MIN_SECONDS, parsed)
+                    );
+                    props.setPVEPollingCustomSeconds(clamped);
+                    props.setPVEPollingInterval(clamped);
+                    props.setHasUnsavedChanges(true);
+                  }}
+                />
+                <p class="text-[0.68rem] text-gray-500 dark:text-gray-400">
+                  Applies to all PVE clusters and standalone nodes.
+                </p>
+              </div>
+            </Show>
+
+            {/* Env override warning */}
+            <Show when={props.pvePollingEnvLocked()}>
+              <div class="flex items-center gap-2 rounded-md border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-800 dark:border-amber-800 dark:bg-amber-900/30 dark:text-amber-200">
+                <svg
+                  class="h-4 w-4 flex-shrink-0"
+                  viewBox="0 0 24 24"
+                  fill="none"
+                  stroke="currentColor"
+                  stroke-width="2"
+                >
+                  <circle cx="12" cy="12" r="10" />
+                  <line x1="12" y1="8" x2="12" y2="12" />
+                  <circle cx="12" cy="16" r="0.5" />
+                </svg>
+                <span>Managed via environment variable PVE_POLLING_INTERVAL.</span>
+              </div>
+            </Show>
+          </div>
+        </div>
+      </Card>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/NetworkSettingsPanel.tsx b/frontend-modern/src/components/Settings/NetworkSettingsPanel.tsx
new file mode 100644
index 0000000..0e1a937
--- /dev/null
+++ b/frontend-modern/src/components/Settings/NetworkSettingsPanel.tsx
@@ -0,0 +1,621 @@
+import { Component, Show, For, Accessor, Setter } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { Toggle } from '@/components/shared/Toggle';
+import type { ToggleChangeEvent } from '@/components/shared/Toggle';
+import Network from 'lucide-solid/icons/network';
+
+const COMMON_DISCOVERY_SUBNETS = [
+  '192.168.1.0/24',
+  '192.168.0.0/24',
+  '10.0.0.0/24',
+  '172.16.0.0/24',
+  '192.168.10.0/24',
+];
+
+interface NetworkSettingsPanelProps {
+  // Discovery settings
+  discoveryEnabled: Accessor<boolean>;
+  discoveryMode: Accessor<'auto' | 'custom'>;
+  discoverySubnetDraft: Accessor<string>;
+  discoverySubnetError: Accessor<string | undefined>;
+  savingDiscoverySettings: Accessor<boolean>;
+  envOverrides: Accessor<Record<string, boolean>>;
+
+  // Network settings
+  allowedOrigins: Accessor<string>;
+  setAllowedOrigins: Setter<string>;
+  allowEmbedding: Accessor<boolean>;
+  setAllowEmbedding: Setter<boolean>;
+  allowedEmbedOrigins: Accessor<string>;
+  setAllowedEmbedOrigins: Setter<string>;
+  webhookAllowedPrivateCIDRs: Accessor<string>;
+  setWebhookAllowedPrivateCIDRs: Setter<string>;
+
+  // Handlers
+  handleDiscoveryEnabledChange: (enabled: boolean) => Promise<boolean>;
+  handleDiscoveryModeChange: (mode: 'auto' | 'custom') => Promise<void>;
+  setDiscoveryMode: Setter<'auto' | 'custom'>;
+  setDiscoverySubnetDraft: Setter<string>;
+  setDiscoverySubnetError: Setter<string | undefined>;
+  setLastCustomSubnet: Setter<string>;
+  commitDiscoverySubnet: (value: string) => Promise<boolean>;
+  setHasUnsavedChanges: Setter<boolean>;
+
+  // Utility functions
+  parseSubnetList: (value: string) => string[];
+  normalizeSubnetList: (value: string) => string;
+  isValidCIDR: (value: string) => boolean;
+  currentDraftSubnetValue: () => string;
+
+  // Ref for input
+  discoverySubnetInputRef?: (el: HTMLInputElement) => void;
+}
+
+export const NetworkSettingsPanel: Component<NetworkSettingsPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      {/* Info Card */}
+      <Card
+        tone="info"
+        padding="md"
+        border={false}
+        class="border border-blue-200 dark:border-blue-800"
+      >
+        <div class="flex items-start gap-3">
+          <svg
+            class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0"
+            fill="none"
+            stroke="currentColor"
+            viewBox="0 0 24 24"
+          >
+            <path
+              stroke-linecap="round"
+              stroke-linejoin="round"
+              stroke-width="2"
+              d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+            />
+          </svg>
+          <div class="text-sm text-blue-800 dark:text-blue-200">
+            <p class="font-medium mb-1">Configuration Priority</p>
+            <ul class="space-y-1">
+              <li>
+                • Some env vars override settings (API_TOKENS, legacy API_TOKEN, PORTS, AUTH)
+              </li>
+              <li>• Changes made here are saved to system.json immediately</li>
+              <li>• Settings persist unless overridden by env vars</li>
+            </ul>
+          </div>
+        </div>
+      </Card>
+
+      {/* Main Network Card */}
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        {/* Header */}
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <Network class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+            </div>
+            <SectionHeader
+              title="Network"
+              description="Discovery, CORS, and embedding settings"
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+
+        <div class="p-6 space-y-8">
+          {/* Network Discovery Section */}
+          <section class="space-y-5">
+            <SectionHeader
+              title="Network discovery"
+              description="Control how Pulse scans for Proxmox services on your network."
+              size="sm"
+              align="left"
+            />
+
+            {/* Discovery Toggle */}
+            <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+              <div class="text-sm text-gray-600 dark:text-gray-400">
+                <p class="font-medium text-gray-900 dark:text-gray-100">Automatic scanning</p>
+                <p class="text-xs text-gray-500 dark:text-gray-400">
+                  Enable discovery to surface Proxmox VE, PBS, and PMG endpoints automatically.
+                </p>
+              </div>
+              <Toggle
+                checked={props.discoveryEnabled()}
+                onChange={async (e: ToggleChangeEvent) => {
+                  if (props.envOverrides().discoveryEnabled || props.savingDiscoverySettings()) {
+                    e.preventDefault();
+                    return;
+                  }
+                  const success = await props.handleDiscoveryEnabledChange(e.currentTarget.checked);
+                  if (!success) {
+                    e.currentTarget.checked = props.discoveryEnabled();
+                  }
+                }}
+                disabled={props.envOverrides().discoveryEnabled || props.savingDiscoverySettings()}
+                containerClass="gap-2"
+                label={
+                  <span class="text-xs font-medium text-gray-600 dark:text-gray-400">
+                    {props.discoveryEnabled() ? 'On' : 'Off'}
+                  </span>
+                }
+              />
+            </div>
+
+            {/* Discovery Options (shown when enabled) */}
+            <Show when={props.discoveryEnabled()}>
+              <div class="space-y-4 rounded-lg border border-gray-200 bg-white/40 p-3 dark:border-gray-600 dark:bg-gray-800/40">
+                <fieldset class="space-y-2">
+                  <legend class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                    Scan scope
+                  </legend>
+                  <div class="space-y-2">
+                    {/* Auto mode */}
+                    <label
+                      class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
+                        props.discoveryMode() === 'auto'
+                          ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
+                          : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
+                      }`}
+                    >
+                      <input
+                        type="radio"
+                        name="discoveryMode"
+                        value="auto"
+                        checked={props.discoveryMode() === 'auto'}
+                        onChange={async () => {
+                          if (props.discoveryMode() !== 'auto') {
+                            await props.handleDiscoveryModeChange('auto');
+                          }
+                        }}
+                        disabled={
+                          props.envOverrides().discoverySubnet || props.savingDiscoverySettings()
+                        }
+                        class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
+                      />
+                      <div class="space-y-1">
+                        <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                          Auto (slower, full scan)
+                        </p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400">
+                          Scans container, local, and gateway networks. Large networks may time out
+                          after two minutes.
+                        </p>
+                      </div>
+                    </label>
+
+                    {/* Custom mode */}
+                    <label
+                      class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
+                        props.discoveryMode() === 'custom'
+                          ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
+                          : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
+                      }`}
+                    >
+                      <input
+                        type="radio"
+                        name="discoveryMode"
+                        value="custom"
+                        checked={props.discoveryMode() === 'custom'}
+                        onChange={() => {
+                          if (props.discoveryMode() !== 'custom') {
+                            props.handleDiscoveryModeChange('custom');
+                          }
+                        }}
+                        disabled={
+                          props.envOverrides().discoverySubnet || props.savingDiscoverySettings()
+                        }
+                        class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
+                      />
+                      <div class="space-y-1">
+                        <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                          Custom subnet (faster)
+                        </p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400">
+                          Limit discovery to one or more CIDR ranges to finish faster on large
+                          networks.
+                        </p>
+                      </div>
+                    </label>
+
+                    {/* Common subnet presets */}
+                    <Show when={props.discoveryMode() === 'custom'}>
+                      <div class="flex flex-wrap items-center gap-2 pl-9 pr-2">
+                        <span class="text-[0.68rem] uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                          Common networks:
+                        </span>
+                        <For each={COMMON_DISCOVERY_SUBNETS}>
+                          {(preset) => {
+                            const baseValue = props.currentDraftSubnetValue();
+                            const currentSelections = props.parseSubnetList(baseValue);
+                            const isActive = currentSelections.includes(preset);
+                            return (
+                              <button
+                                type="button"
+                                class={`rounded border px-2.5 py-1 text-[0.7rem] transition-colors ${
+                                  isActive
+                                    ? 'border-blue-500 bg-blue-600 text-white dark:border-blue-400 dark:bg-blue-500'
+                                    : 'border-gray-300 text-gray-700 hover:border-blue-400 hover:bg-blue-50 dark:border-gray-600 dark:text-gray-300 dark:hover:border-blue-500 dark:hover:bg-blue-900/30'
+                                }`}
+                                onClick={async () => {
+                                  if (props.envOverrides().discoverySubnet) {
+                                    return;
+                                  }
+                                  let selections = [...currentSelections];
+                                  if (isActive) {
+                                    selections = selections.filter((item) => item !== preset);
+                                  } else {
+                                    selections.push(preset);
+                                  }
+
+                                  if (selections.length === 0) {
+                                    props.setDiscoverySubnetDraft('');
+                                    props.setLastCustomSubnet('');
+                                    props.setDiscoverySubnetError(
+                                      'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)'
+                                    );
+                                    return;
+                                  }
+
+                                  const updatedValue = props.normalizeSubnetList(
+                                    selections.join(', ')
+                                  );
+                                  props.setDiscoveryMode('custom');
+                                  props.setDiscoverySubnetDraft(updatedValue);
+                                  props.setLastCustomSubnet(updatedValue);
+                                  props.setDiscoverySubnetError(undefined);
+                                  await props.commitDiscoverySubnet(updatedValue);
+                                }}
+                                disabled={props.envOverrides().discoverySubnet}
+                                classList={{
+                                  'cursor-not-allowed opacity-60':
+                                    props.envOverrides().discoverySubnet,
+                                }}
+                              >
+                                {preset}
+                              </button>
+                            );
+                          }}
+                        </For>
+                      </div>
+                    </Show>
+                  </div>
+                </fieldset>
+
+                {/* Subnet Input */}
+                <div class="space-y-2">
+                  <div class="flex items-center justify-between gap-2">
+                    <label
+                      for="discoverySubnetInput"
+                      class="text-xs font-medium text-gray-700 dark:text-gray-300"
+                    >
+                      Discovery subnet
+                    </label>
+                    <span
+                      class="text-gray-400 hover:text-gray-500 dark:text-gray-500 dark:hover:text-gray-300"
+                      title="Use CIDR notation (comma-separated for multiple), e.g. 192.168.1.0/24, 10.0.0.0/24. Smaller ranges keep scans quick."
+                    >
+                      <svg
+                        class="h-4 w-4"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        stroke-width="2"
+                      >
+                        <circle cx="12" cy="12" r="10"></circle>
+                        <path d="M12 16v-4"></path>
+                        <path d="M12 8h.01"></path>
+                      </svg>
+                    </span>
+                  </div>
+                  <input
+                    id="discoverySubnetInput"
+                    ref={props.discoverySubnetInputRef}
+                    type="text"
+                    value={props.discoverySubnetDraft()}
+                    placeholder={
+                      props.discoveryMode() === 'auto'
+                        ? 'auto (scan every network phase)'
+                        : '192.168.1.0/24, 10.0.0.0/24'
+                    }
+                    class={`w-full rounded-lg border px-3 py-2 text-sm transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 ${
+                      props.envOverrides().discoverySubnet
+                        ? 'border-amber-300 bg-amber-50 text-amber-800 dark:border-amber-600 dark:bg-amber-900/20 dark:text-amber-200 cursor-not-allowed opacity-60'
+                        : 'border-gray-300 bg-white dark:border-gray-600 dark:bg-gray-900/70'
+                    }`}
+                    disabled={props.envOverrides().discoverySubnet}
+                    onInput={(e) => {
+                      if (props.envOverrides().discoverySubnet) {
+                        return;
+                      }
+                      const rawValue = e.currentTarget.value;
+                      props.setDiscoverySubnetDraft(rawValue);
+                      if (props.discoveryMode() !== 'custom') {
+                        props.setDiscoveryMode('custom');
+                      }
+                      props.setLastCustomSubnet(rawValue);
+                      const trimmed = rawValue.trim();
+                      if (!trimmed) {
+                        props.setDiscoverySubnetError(undefined);
+                        return;
+                      }
+                      if (!props.isValidCIDR(trimmed)) {
+                        props.setDiscoverySubnetError(
+                          'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)'
+                        );
+                      } else {
+                        props.setDiscoverySubnetError(undefined);
+                      }
+                    }}
+                    onBlur={async (e) => {
+                      if (
+                        props.envOverrides().discoverySubnet ||
+                        props.discoveryMode() !== 'custom'
+                      ) {
+                        return;
+                      }
+                      const rawValue = e.currentTarget.value;
+                      props.setDiscoverySubnetDraft(rawValue);
+                      const trimmed = rawValue.trim();
+                      if (!trimmed) {
+                        props.setDiscoverySubnetError(
+                          'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)'
+                        );
+                        return;
+                      }
+                      if (!props.isValidCIDR(trimmed)) {
+                        props.setDiscoverySubnetError(
+                          'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)'
+                        );
+                        return;
+                      }
+                      props.setDiscoverySubnetError(undefined);
+                      await props.commitDiscoverySubnet(rawValue);
+                    }}
+                    onKeyDown={(e) => {
+                      if (e.key === 'Enter') {
+                        e.preventDefault();
+                        (e.currentTarget as HTMLInputElement).blur();
+                      }
+                    }}
+                  />
+                  <Show when={props.discoverySubnetError()}>
+                    <p class="text-xs text-red-600 dark:text-red-400">
+                      {props.discoverySubnetError()}
+                    </p>
+                  </Show>
+                  <Show when={!props.discoverySubnetError() && props.discoveryMode() === 'auto'}>
+                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                      Auto scans every reachable network phase. Large networks may time out — switch
+                      to custom subnets to narrow the search.
+                    </p>
+                  </Show>
+                  <Show when={!props.discoverySubnetError() && props.discoveryMode() === 'custom'}>
+                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                      Example: 192.168.1.0/24, 10.0.0.0/24 (comma-separated). Smaller ranges finish
+                      faster and avoid timeouts.
+                    </p>
+                  </Show>
+                </div>
+              </div>
+            </Show>
+
+            {/* Env override warning */}
+            <Show when={props.envOverrides().discoveryEnabled || props.envOverrides().discoverySubnet}>
+              <div class="rounded-lg border border-amber-200 bg-amber-100/80 p-3 text-xs text-amber-800 dark:border-amber-700 dark:bg-amber-900/20 dark:text-amber-200">
+                Discovery settings are locked by environment variables. Update the service
+                configuration and restart Pulse to change them here.
+              </div>
+            </Show>
+          </section>
+
+          {/* CORS Settings Section */}
+          <section class="space-y-3">
+            <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+              <svg
+                width="16"
+                height="16"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+              >
+                <circle cx="12" cy="12" r="10"></circle>
+                <path d="M2 12h20M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10 15.3 15.3 0 01-4-10 15.3 15.3 0 014-10z"></path>
+              </svg>
+              Network Settings
+            </h4>
+            <div class="space-y-2">
+              <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                CORS Allowed Origins
+              </label>
+              <p class="text-xs text-gray-600 dark:text-gray-400">
+                For reverse proxy setups (* = allow all, empty = same-origin only)
+              </p>
+              <div class="relative">
+                <input
+                  type="text"
+                  value={props.allowedOrigins()}
+                  onChange={(e) => {
+                    if (!props.envOverrides().allowedOrigins) {
+                      props.setAllowedOrigins(e.currentTarget.value);
+                      props.setHasUnsavedChanges(true);
+                    }
+                  }}
+                  disabled={props.envOverrides().allowedOrigins}
+                  placeholder="* or https://example.com"
+                  class={`w-full px-3 py-1.5 text-sm border rounded-lg ${
+                    props.envOverrides().allowedOrigins
+                      ? 'border-amber-300 dark:border-amber-600 bg-amber-50 dark:bg-amber-900/20 cursor-not-allowed opacity-75'
+                      : 'border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800'
+                  }`}
+                />
+                {props.envOverrides().allowedOrigins && (
+                  <div class="mt-2 p-2 bg-amber-100 dark:bg-amber-900/30 border border-amber-300 dark:border-amber-700 rounded text-xs text-amber-800 dark:text-amber-200">
+                    <div class="flex items-center gap-1">
+                      <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path
+                          stroke-linecap="round"
+                          stroke-linejoin="round"
+                          stroke-width="2"
+                          d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                        />
+                      </svg>
+                      <span>Overridden by ALLOWED_ORIGINS environment variable</span>
+                    </div>
+                    <div class="mt-1 text-amber-700 dark:text-amber-300">
+                      Remove the env var and restart to enable UI configuration
+                    </div>
+                  </div>
+                )}
+              </div>
+            </div>
+          </section>
+
+          {/* Embedding Section */}
+          <section class="space-y-3">
+            <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+              <svg
+                width="16"
+                height="16"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+              >
+                <rect x="3" y="4" width="18" height="14" rx="2"></rect>
+                <path d="M7 20h10"></path>
+              </svg>
+              Embedding
+            </h4>
+            <p class="text-xs text-gray-600 dark:text-gray-400">
+              Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
+            </p>
+            <div class="space-y-3">
+              <div class="flex items-center gap-2">
+                <input
+                  type="checkbox"
+                  id="allowEmbedding"
+                  checked={props.allowEmbedding()}
+                  onChange={(e) => {
+                    props.setAllowEmbedding(e.currentTarget.checked);
+                    props.setHasUnsavedChanges(true);
+                  }}
+                  class="rounded border-gray-300 dark:border-gray-600 text-blue-600 focus:ring-blue-500"
+                />
+                <label for="allowEmbedding" class="text-sm text-gray-700 dark:text-gray-300">
+                  Allow iframe embedding
+                </label>
+              </div>
+
+              <Show when={props.allowEmbedding()}>
+                <div class="space-y-2">
+                  <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                    Allowed Embed Origins (optional)
+                  </label>
+                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                    Comma-separated list of origins that can embed Pulse (leave empty for same-origin
+                    only)
+                  </p>
+                  <input
+                    type="text"
+                    value={props.allowedEmbedOrigins()}
+                    onChange={(e) => {
+                      props.setAllowedEmbedOrigins(e.currentTarget.value);
+                      props.setHasUnsavedChanges(true);
+                    }}
+                    placeholder="https://my.domain, https://dashboard.example.com"
+                    class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
+                  />
+                  <p class="text-xs text-gray-500 dark:text-gray-400">
+                    Example: If Pulse is at <code>pulse.my.domain</code> and your dashboard is at{' '}
+                    <code>my.domain</code>, add <code>https://my.domain</code> here.
+                  </p>
+                </div>
+              </Show>
+            </div>
+          </section>
+
+          {/* Webhook Security Section */}
+          <section class="space-y-3">
+            <h3 class="text-sm font-semibold text-gray-900 dark:text-gray-100 flex items-center gap-2">
+              <svg
+                xmlns="http://www.w3.org/2000/svg"
+                class="h-4 w-4"
+                fill="none"
+                viewBox="0 0 24 24"
+                stroke="currentColor"
+              >
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width={2}
+                  d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
+                />
+              </svg>
+              Webhook Security
+            </h3>
+            <div class="space-y-3">
+              <div>
+                <label class="text-sm font-medium text-gray-700 dark:text-gray-300">
+                  Allowed Private IP Ranges for Webhooks
+                </label>
+                <p class="text-xs text-gray-500 dark:text-gray-400 mb-2">
+                  By default, webhooks to private IP addresses are blocked for security. Enter
+                  trusted CIDR ranges to allow webhooks to internal services (leave empty to block
+                  all private IPs).
+                </p>
+                <input
+                  type="text"
+                  value={props.webhookAllowedPrivateCIDRs()}
+                  onChange={(e) => {
+                    props.setWebhookAllowedPrivateCIDRs(e.currentTarget.value);
+                    props.setHasUnsavedChanges(true);
+                  }}
+                  placeholder="192.168.1.0/24, 10.0.0.0/8"
+                  class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
+                />
+                <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
+                  Example: <code>192.168.1.0/24,10.0.0.0/8</code> allows webhooks to these private
+                  networks. Localhost and cloud metadata services remain blocked.
+                </p>
+              </div>
+            </div>
+          </section>
+
+          {/* Port Configuration Notice */}
+          <Card
+            tone="warning"
+            padding="sm"
+            border={false}
+            class="border border-amber-200 dark:border-amber-800"
+          >
+            <p class="text-xs text-amber-800 dark:text-amber-200 mb-2">
+              <strong>Port Configuration:</strong> Use{' '}
+              <code class="font-mono bg-amber-100 dark:bg-amber-800 px-1 rounded">
+                systemctl edit pulse
+              </code>
+            </p>
+            <p class="text-xs text-amber-700 dark:text-amber-300 font-mono">
+              [Service]
+              <br />
+              Environment="FRONTEND_PORT=8080"
+              <br />
+              <span class="text-xs text-amber-600 dark:text-amber-400">
+                Then restart: sudo systemctl restart pulse
+              </span>
+            </p>
+          </Card>
+        </div>
+      </Card>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/NodeModal.tsx b/frontend-modern/src/components/Settings/NodeModal.tsx
index 6379349..fd6c2ff 100644
--- a/frontend-modern/src/components/Settings/NodeModal.tsx
+++ b/frontend-modern/src/components/Settings/NodeModal.tsx
@@ -80,7 +80,7 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
     host: '',
     guestURL: '',
     authType: nodeType === 'pmg' ? 'password' : ('token' as 'password' | 'token'),
-    setupMode: 'auto' as 'auto' | 'manual',
+    setupMode: 'agent' as 'agent' | 'auto' | 'manual', // Default to agent install (recommended)
     user: '',
     password: '',
     tokenName: '',
@@ -101,6 +101,9 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
   const [proxyInstallCommand, setProxyInstallCommand] = createSignal('');
   const [loadingProxyCommand, setLoadingProxyCommand] = createSignal(false);
   const [proxyCommandError, setProxyCommandError] = createSignal<string | null>(null);
+  const [agentInstallCommand, setAgentInstallCommand] = createSignal('');
+  const [loadingAgentCommand, setLoadingAgentCommand] = createSignal(false);
+  const [agentCommandError, setAgentCommandError] = createSignal<string | null>(null);
   const showTemperatureMonitoringSection = () =>
     typeof props.temperatureMonitoringEnabled === 'boolean';
   const temperatureMonitoringEnabledValue = () => props.temperatureMonitoringEnabled ?? true;
@@ -114,7 +117,7 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
       case 'socket-proxy':
         return {
           tone: 'success',
-          message: 'Temperatures flow through the host sensor proxy mounted at /run/pulse-sensor-proxy.',
+          message: 'Temperatures flow through the socket proxy mounted at /run/pulse-sensor-proxy.',
         };
       case 'https-proxy':
         return {
@@ -126,7 +129,7 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
           tone: 'danger',
           disable: true,
           message:
-            'Pulse is running in a container without the pulse-sensor-proxy bind mount. Install the proxy on the host or register an HTTPS proxy before enabling temperatures.',
+            'Pulse is running in a container. Install the Pulse agent on this node for temperature monitoring (Settings → Agents).',
         };
       case 'ssh':
         return {
@@ -400,8 +403,13 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
 
     setFormData((prev) => ({ ...prev, [field]: value }));
 
-    if (field === 'setupMode' && value !== 'auto') {
-      setQuickSetupCommand('');
+    if (field === 'setupMode') {
+      if (value !== 'auto') {
+        setQuickSetupCommand('');
+      }
+      if (value !== 'agent') {
+        setAgentInstallCommand('');
+      }
     }
   };
 
@@ -764,7 +772,21 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                           <Show when={props.nodeType === 'pve'}>
                             <div class="space-y-3 text-xs">
                               {/* Tab buttons */}
-                              <div class="flex gap-2">
+                              <div class="flex gap-2 flex-wrap">
+                                <button
+                                  type="button"
+                                  onClick={() => updateField('setupMode', 'agent')}
+                                  class={`inline-flex items-center px-3 py-1.5 text-sm font-medium rounded-md border border-transparent transition-colors ${
+                                    formData().setupMode === 'agent'
+                                      ? 'bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-300 border-gray-300 dark:border-gray-600 shadow-sm'
+                                      : 'text-gray-600 dark:text-gray-400 hover:text-blue-600 dark:hover:text-blue-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60'
+                                  }`}
+                                >
+                                  Agent Install
+                                  <span class="ml-1.5 px-1.5 py-0.5 text-[10px] font-semibold bg-green-100 dark:bg-green-900/50 text-green-700 dark:text-green-300 rounded">
+                                    Recommended
+                                  </span>
+                                </button>
                                 <button
                                   type="button"
                                   onClick={() => updateField('setupMode', 'auto')}
@@ -774,7 +796,7 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                                       : 'text-gray-600 dark:text-gray-400 hover:text-blue-600 dark:hover:text-blue-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60'
                                   }`}
                                 >
-                                  Quick Setup
+                                  API Only
                                 </button>
                                 <button
                                   type="button"
@@ -785,17 +807,106 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                                       : 'text-gray-600 dark:text-gray-400 hover:text-blue-600 dark:hover:text-blue-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60'
                                   }`}
                                 >
-                                  Manual Setup
+                                  Manual
                                 </button>
                               </div>
 
-                              {/* Quick Setup Tab */}
-                              <Show when={formData().setupMode === 'auto' || !formData().setupMode}>
-                                <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
-                                  The command below creates the monitoring user, applies read-only
-                                  access, and adds the storage permissions Pulse needs to display
-                                  backups.
-                                </p>
+                              {/* Agent Install Tab (Recommended) */}
+                              <Show when={formData().setupMode === 'agent'}>
+                                <div class="space-y-3">
+                                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                                    Install the Pulse agent on your Proxmox node. This single command sets everything up:
+                                  </p>
+                                  <ul class="text-xs text-gray-600 dark:text-gray-400 list-disc list-inside space-y-1">
+                                    <li>Creates monitoring user and API token automatically</li>
+                                    <li>Registers the node with Pulse</li>
+                                    <li>Enables temperature monitoring (no SSH required)</li>
+                                    <li>Enables AI features for managing VMs/containers</li>
+                                  </ul>
+                                  <p class="text-blue-800 dark:text-blue-200 font-medium">
+                                    Run this command on your Proxmox VE node:
+                                  </p>
+                                  <div class="relative bg-gray-900 rounded-md p-3 font-mono text-xs overflow-x-auto">
+                                    <button
+                                      type="button"
+                                      disabled={loadingAgentCommand()}
+                                      onClick={async () => {
+                                        logger.debug('[Agent Install] Copy button clicked');
+                                        try {
+                                          setLoadingAgentCommand(true);
+                                          const { apiFetch } = await import('@/utils/apiClient');
+                                          const response = await apiFetch('/api/agent-install-command', {
+                                            method: 'POST',
+                                            headers: { 'Content-Type': 'application/json' },
+                                            body: JSON.stringify({
+                                              type: 'pve',
+                                              enableProxmox: true,
+                                            }),
+                                          });
+
+                                          if (response.ok) {
+                                            const data = await response.json();
+                                            if (data.command) {
+                                              setAgentInstallCommand(data.command);
+                                              const copied = await copyToClipboard(data.command);
+                                              if (copied) {
+                                                showSuccess('Command copied! Run it on your Proxmox node.');
+                                              } else {
+                                                showError('Failed to copy to clipboard');
+                                              }
+                                            }
+                                          } else {
+                                            showError('Failed to generate install command');
+                                          }
+                                        } catch (error) {
+                                          logger.error('[Agent Install] Error:', error);
+                                          showError('Failed to generate install command');
+                                        } finally {
+                                          setLoadingAgentCommand(false);
+                                        }
+                                      }}
+                                      class="absolute top-2 right-2 p-1.5 text-gray-400 hover:text-gray-200 bg-gray-700 rounded-md transition-colors disabled:opacity-50"
+                                      title="Copy command"
+                                    >
+                                      <Show when={loadingAgentCommand()} fallback={
+                                        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                          <rect x="9" y="9" width="13" height="13" rx="2" ry="2"></rect>
+                                          <path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"></path>
+                                        </svg>
+                                      }>
+                                        <svg class="animate-spin" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                          <circle cx="12" cy="12" r="10" stroke-opacity="0.25"></circle>
+                                          <path d="M12 2a10 10 0 0 1 10 10" stroke-linecap="round"></path>
+                                        </svg>
+                                      </Show>
+                                    </button>
+                                    <Show
+                                      when={agentInstallCommand().length > 0}
+                                      fallback={
+                                        <code class="text-blue-400">
+                                          Click the button above to copy the install command
+                                        </code>
+                                      }
+                                    >
+                                      <code class="block text-blue-100 whitespace-pre-wrap break-words">
+                                        {agentInstallCommand()}
+                                      </code>
+                                    </Show>
+                                  </div>
+                                  <p class="text-[11px] text-gray-500 dark:text-gray-400 italic">
+                                    The node will appear in Pulse automatically after the agent starts.
+                                  </p>
+                                </div>
+                              </Show>
+
+                              {/* API Only Tab (formerly Quick Setup) */}
+                              <Show when={formData().setupMode === 'auto'}>
+                                <div class="rounded-lg border border-amber-200 bg-amber-50 px-3 py-2 mb-3 dark:border-amber-700 dark:bg-amber-900/20">
+                                  <p class="text-xs text-amber-800 dark:text-amber-200">
+                                    <strong>Limited functionality:</strong> API-only mode does not include temperature monitoring or AI features.
+                                    For full functionality, use the Agent Install tab instead.
+                                  </p>
+                                </div>
                                 <p class="text-blue-800 dark:text-blue-200">
                                   Just copy and run this one command on your Proxmox VE server:
                                 </p>
@@ -1259,17 +1370,29 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                           <Show when={props.nodeType === 'pbs'}>
                             <div class="space-y-3 text-xs">
                               {/* Tab buttons for PBS */}
-                              <div class="flex gap-2">
+                              <div class="flex gap-2 flex-wrap">
                                 <button
                                   type="button"
-                                  onClick={() => updateField('setupMode', 'auto')}
-                                  class={`inline-flex items-center px-3 py-1.5 text-sm font-medium rounded-md border border-transparent transition-colors ${
-                                    formData().setupMode === 'auto' || !formData().setupMode
+                                  onClick={() => updateField('setupMode', 'agent')}
+                                  class={`inline-flex items-center gap-1.5 px-3 py-1.5 text-sm font-medium rounded-md border border-transparent transition-colors ${
+                                    formData().setupMode === 'agent'
                                       ? 'bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-300 border-gray-300 dark:border-gray-600 shadow-sm'
                                       : 'text-gray-600 dark:text-gray-400 hover:text-blue-600 dark:hover:text-blue-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60'
                                   }`}
                                 >
-                                  Quick Setup
+                                  Agent Install
+                                  <span class="text-[10px] px-1.5 py-0.5 bg-green-100 dark:bg-green-900/50 text-green-700 dark:text-green-300 rounded">Recommended</span>
+                                </button>
+                                <button
+                                  type="button"
+                                  onClick={() => updateField('setupMode', 'auto')}
+                                  class={`inline-flex items-center px-3 py-1.5 text-sm font-medium rounded-md border border-transparent transition-colors ${
+                                    formData().setupMode === 'auto'
+                                      ? 'bg-white dark:bg-gray-800 text-blue-600 dark:text-blue-300 border-gray-300 dark:border-gray-600 shadow-sm'
+                                      : 'text-gray-600 dark:text-gray-400 hover:text-blue-600 dark:hover:text-blue-300 hover:bg-gray-200/60 dark:hover:bg-gray-700/60'
+                                  }`}
+                                >
+                                  API Only
                                 </button>
                                 <button
                                   type="button"
@@ -1284,8 +1407,83 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                                 </button>
                               </div>
 
-                              {/* Quick Setup Tab for PBS */}
-                              <Show when={formData().setupMode === 'auto' || !formData().setupMode}>
+                              {/* Agent Install Tab for PBS */}
+                              <Show when={formData().setupMode === 'agent'}>
+                                <div class="space-y-3">
+                                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                                    Install the Pulse agent on your Proxmox Backup Server. This is the recommended method as it provides:
+                                  </p>
+                                  <ul class="text-xs text-gray-600 dark:text-gray-400 list-disc list-inside space-y-1">
+                                    <li>One-command setup (creates API user and token automatically)</li>
+                                    <li>Built-in temperature monitoring (no SSH required)</li>
+                                    <li>AI features (execute commands via Pulse AI)</li>
+                                    <li>Automatic reconnection on network issues</li>
+                                  </ul>
+                                  <p class="text-blue-800 dark:text-blue-200 text-xs mt-3">
+                                    Run this command on your PBS node:
+                                  </p>
+                                  <div class="relative bg-gray-900 rounded-md p-3 font-mono text-xs overflow-x-auto">
+                                    <button
+                                      type="button"
+                                      onClick={async () => {
+                                        try {
+                                          setLoadingAgentCommand(true);
+                                          setAgentCommandError(null);
+                                          const { apiFetch } = await import('@/utils/apiClient');
+                                          const response = await apiFetch('/api/agent-install-command', {
+                                            method: 'POST',
+                                            headers: { 'Content-Type': 'application/json' },
+                                            body: JSON.stringify({ type: 'pbs' }),
+                                          });
+                                          if (!response.ok) {
+                                            throw new Error(`Failed to generate command: ${response.status}`);
+                                          }
+                                          const data = await response.json();
+                                          if (data.command) {
+                                            setAgentInstallCommand(data.command);
+                                            const copied = await copyToClipboard(data.command);
+                                            if (copied) {
+                                              showSuccess('Command copied to clipboard');
+                                            }
+                                          }
+                                        } catch (error) {
+                                          logger.error('[Agent Install] Error:', error);
+                                          setAgentCommandError(error instanceof Error ? error.message : 'Failed to generate command');
+                                          showError('Failed to generate install command');
+                                        } finally {
+                                          setLoadingAgentCommand(false);
+                                        }
+                                      }}
+                                      class="absolute top-2 right-2 p-1.5 text-gray-400 hover:text-white rounded bg-gray-800 hover:bg-gray-700 transition-colors"
+                                      title="Copy to clipboard"
+                                      disabled={loadingAgentCommand()}
+                                    >
+                                      <Show when={loadingAgentCommand()} fallback={
+                                        <svg xmlns="http://www.w3.org/2000/svg" class="h-4 w-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                                        </svg>
+                                      }>
+                                        <svg class="animate-spin h-4 w-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24">
+                                          <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
+                                          <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
+                                        </svg>
+                                      </Show>
+                                    </button>
+                                    <code class="text-green-400 whitespace-pre-wrap break-all pr-10">
+                                      {agentInstallCommand() || 'Click the copy button to generate and copy the install command'}
+                                    </code>
+                                  </div>
+                                  <Show when={agentCommandError()}>
+                                    <p class="text-xs text-red-500">{agentCommandError()}</p>
+                                  </Show>
+                                  <p class="text-xs text-gray-500 dark:text-gray-500">
+                                    The node will automatically appear in Pulse once the agent connects.
+                                  </p>
+                                </div>
+                              </Show>
+
+                              {/* Quick Setup Tab for PBS (API Only) */}
+                              <Show when={formData().setupMode === 'auto'}>
                                 <p class="text-blue-800 dark:text-blue-200">
                                   Just copy and run this one command on your Proxmox Backup Server:
                                 </p>
@@ -1915,8 +2113,11 @@ export const NodeModal: Component<NodeModalProps> = (props) => {
                           </Show>
                           <Show when={shouldOfferProxyCommand()}>
                             <div class="mt-3 rounded border border-blue-200 bg-blue-50 p-2 text-xs text-blue-800 dark:border-blue-700 dark:bg-blue-900/20 dark:text-blue-100 space-y-2">
-                              <div class="font-semibold">Install HTTPS proxy on this host</div>
-                              <div>Generate a one-line installer command to run on the Proxmox host:</div>
+                              <div class="font-semibold">Temperature proxy (legacy)</div>
+                              <div class="text-amber-700 dark:text-amber-300 text-[11px]">
+                                Recommended: Install the Pulse agent instead (Settings → Agents) for temperatures + AI features.
+                              </div>
+                              <div>Or generate a one-line installer command for the standalone temperature proxy:</div>
                               <div class="flex flex-wrap gap-2">
                                 <button
                                   type="button"
diff --git a/frontend-modern/src/components/Settings/ProxmoxAgentNodesPanel.tsx b/frontend-modern/src/components/Settings/ProxmoxAgentNodesPanel.tsx
new file mode 100644
index 0000000..d199bd1
--- /dev/null
+++ b/frontend-modern/src/components/Settings/ProxmoxAgentNodesPanel.tsx
@@ -0,0 +1,590 @@
+import { Component, Show, For, Accessor, Setter, JSX } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { Toggle } from '@/components/shared/Toggle';
+import type { ToggleChangeEvent } from '@/components/shared/Toggle';
+import {
+  PveNodesTable,
+  PbsNodesTable,
+  PmgNodesTable,
+  type TemperatureTransportInfo,
+} from './ConfiguredNodeTables';
+import { notificationStore } from '@/stores/notifications';
+import Server from 'lucide-solid/icons/server';
+import HardDrive from 'lucide-solid/icons/hard-drive';
+import Mail from 'lucide-solid/icons/mail';
+import Loader from 'lucide-solid/icons/loader-2';
+import type { NodeConfig } from '@/types/nodes';
+
+type AgentType = 'pve' | 'pbs' | 'pmg';
+
+interface DiscoveredServer {
+  ip: string;
+  port: number;
+  type: 'pve' | 'pbs' | 'pmg';
+  hostname?: string;
+}
+
+interface DiscoveryScanStatus {
+  scanning: boolean;
+  lastScanStartedAt?: string;
+  lastResultAt?: string;
+  errors?: string[];
+}
+
+type NodeConfigWithStatus = NodeConfig & {
+  hasPassword?: boolean;
+  hasToken?: boolean;
+  connectionStatus?: 'connected' | 'error' | 'pending' | 'unknown';
+  connectionError?: string;
+  status?: 'connected' | 'error' | 'pending' | 'unknown';
+};
+
+interface ProxmoxAgentNodesPanelProps {
+  agentType: AgentType;
+
+  // Node data
+  nodes: Accessor<NodeConfigWithStatus[]>;
+  discoveredNodes: Accessor<DiscoveredServer[]>;
+
+  // State data for tables
+  stateNodes?: any[];
+  stateHosts?: any[];
+  statePbs?: any[];
+  statePmg?: any[];
+
+  // Temperature monitoring
+  temperatureMonitoringEnabled: Accessor<boolean>;
+  temperatureTransports?: Accessor<TemperatureTransportInfo | null>;
+
+  // Discovery settings
+  discoveryEnabled: Accessor<boolean>;
+  discoveryMode: Accessor<'auto' | 'custom'>;
+  discoveryScanStatus: Accessor<DiscoveryScanStatus>;
+  envOverrides: Accessor<Record<string, boolean>>;
+  savingDiscoverySettings: Accessor<boolean>;
+
+  // Loading state
+  initialLoadComplete: Accessor<boolean>;
+
+  // Actions
+  handleDiscoveryEnabledChange: (enabled: boolean) => Promise<boolean>;
+  triggerDiscoveryScan: (opts: { quiet: boolean }) => Promise<void>;
+  loadDiscoveredNodes: () => Promise<void>;
+  testNodeConnection: (nodeId: string) => void;
+  requestDeleteNode: (node: NodeConfig) => void;
+  refreshClusterNodes?: (nodeId: string) => void;
+
+  // Modal controls
+  setEditingNode: Setter<NodeConfigWithStatus | null>;
+  setCurrentNodeType: Setter<AgentType>;
+  setModalResetKey: Setter<number>;
+  setShowNodeModal: Setter<boolean>;
+
+  // For PMG edit workaround
+  allNodes?: Accessor<NodeConfig[]>;
+
+  // Utility
+  formatRelativeTime: (date: string | undefined) => string;
+}
+
+const AGENT_CONFIG: Record<AgentType, {
+  title: string;
+  addButtonText: string;
+  emptyTitle: string;
+  emptyDescription: string;
+  scanningText: string;
+  icon: () => JSX.Element;
+  discoveryTooltip: string;
+}> = {
+  pve: {
+    title: 'Proxmox VE nodes',
+    addButtonText: 'Add PVE Node',
+    emptyTitle: 'No PVE nodes configured',
+    emptyDescription: 'Add a Proxmox VE node to start monitoring your infrastructure',
+    scanningText: 'Scanning your network for Proxmox VE servers…',
+    icon: () => <Server class="h-8 w-8 text-gray-400 dark:text-gray-500" />,
+    discoveryTooltip: 'Enable automatic discovery of Proxmox servers on your network',
+  },
+  pbs: {
+    title: 'Proxmox Backup Server nodes',
+    addButtonText: 'Add PBS Node',
+    emptyTitle: 'No PBS nodes configured',
+    emptyDescription: 'Add a Proxmox Backup Server to monitor your backup infrastructure',
+    scanningText: 'Scanning your network for Proxmox Backup Servers…',
+    icon: () => <HardDrive class="h-8 w-8 text-gray-400 dark:text-gray-500" />,
+    discoveryTooltip: 'Enable automatic discovery of PBS servers on your network',
+  },
+  pmg: {
+    title: 'Proxmox Mail Gateway nodes',
+    addButtonText: 'Add PMG Node',
+    emptyTitle: 'No PMG nodes configured',
+    emptyDescription: 'Add a Proxmox Mail Gateway to monitor mail queue and quarantine metrics',
+    scanningText: 'Scanning network...',
+    icon: () => <Mail class="h-8 w-8 text-gray-400 dark:text-gray-500" />,
+    discoveryTooltip: 'Enable automatic discovery of PMG servers on your network',
+  },
+};
+
+export const ProxmoxAgentNodesPanel: Component<ProxmoxAgentNodesPanelProps> = (props) => {
+  const config = () => AGENT_CONFIG[props.agentType];
+  const filteredDiscoveredNodes = () => props.discoveredNodes().filter((n) => n.type === props.agentType);
+
+  const handleAddNode = () => {
+    props.setEditingNode(null);
+    props.setCurrentNodeType(props.agentType);
+    props.setModalResetKey((prev) => prev + 1);
+    props.setShowNodeModal(true);
+  };
+
+  const handleRefreshDiscovery = async () => {
+    notificationStore.info('Refreshing discovery...', 2000);
+    try {
+      await props.triggerDiscoveryScan({ quiet: true });
+    } finally {
+      await props.loadDiscoveredNodes();
+    }
+  };
+
+  const handleDiscoveredNodeClick = (server: DiscoveredServer) => {
+    if (props.agentType === 'pmg') {
+      // PMG uses a different approach - sets up modal then fills input
+      props.setEditingNode(null);
+      props.setCurrentNodeType('pmg');
+      props.setModalResetKey((prev) => prev + 1);
+      props.setShowNodeModal(true);
+      setTimeout(() => {
+        const hostInput = document.querySelector(
+          'input[placeholder*="192.168"]',
+        ) as HTMLInputElement;
+        if (hostInput) {
+          hostInput.value = server.ip;
+          hostInput.dispatchEvent(new Event('input', { bubbles: true }));
+        }
+      }, 50);
+    } else {
+      // PVE and PBS pre-fill the node object
+      const baseNode = {
+        id: '',
+        type: props.agentType,
+        name: server.hostname || `${props.agentType}-${server.ip}`,
+        host: `https://${server.ip}:${server.port}`,
+        user: '',
+        tokenName: '',
+        tokenValue: '',
+        verifySSL: false,
+        status: 'pending' as const,
+      } as NodeConfigWithStatus;
+
+      if (props.agentType === 'pve') {
+        Object.assign(baseNode, {
+          monitorVMs: true,
+          monitorContainers: true,
+          monitorStorage: true,
+          monitorBackups: true,
+          monitorPhysicalDisks: false,
+        });
+      } else if (props.agentType === 'pbs') {
+        Object.assign(baseNode, {
+          monitorDatastores: true,
+          monitorSyncJobs: true,
+          monitorVerifyJobs: true,
+          monitorPruneJobs: true,
+          monitorGarbageJobs: true,
+        });
+      }
+
+      props.setEditingNode(baseNode);
+      props.setCurrentNodeType(props.agentType);
+      props.setShowNodeModal(true);
+    }
+  };
+
+  const renderNodesTable = () => {
+    if (props.agentType === 'pve') {
+      return (
+        <PveNodesTable
+          nodes={props.nodes() as any}
+          stateNodes={props.stateNodes ?? []}
+          stateHosts={props.stateHosts ?? []}
+          globalTemperatureMonitoringEnabled={props.temperatureMonitoringEnabled()}
+          temperatureTransports={props.temperatureTransports?.() ?? null}
+          onTestConnection={props.testNodeConnection}
+          onEdit={(node) => {
+            props.setEditingNode(node as NodeConfigWithStatus);
+            props.setCurrentNodeType('pve');
+            props.setShowNodeModal(true);
+          }}
+          onDelete={(node) => props.requestDeleteNode(node)}
+          onRefreshCluster={props.refreshClusterNodes}
+        />
+      );
+    } else if (props.agentType === 'pbs') {
+      return (
+        <PbsNodesTable
+          nodes={props.nodes() as any}
+          statePbs={props.statePbs ?? []}
+          globalTemperatureMonitoringEnabled={props.temperatureMonitoringEnabled()}
+          onTestConnection={props.testNodeConnection}
+          onEdit={(node) => {
+            props.setEditingNode(node as NodeConfigWithStatus);
+            props.setCurrentNodeType('pbs');
+            props.setShowNodeModal(true);
+          }}
+          onDelete={(node) => props.requestDeleteNode(node)}
+        />
+      );
+    } else {
+      return (
+        <PmgNodesTable
+          nodes={props.nodes() as any}
+          statePmg={props.statePmg ?? []}
+          globalTemperatureMonitoringEnabled={props.temperatureMonitoringEnabled()}
+          onTestConnection={props.testNodeConnection}
+          onEdit={(node) => {
+            props.setEditingNode(props.allNodes?.().find((n) => n.id === node.id) as NodeConfigWithStatus ?? null);
+            props.setCurrentNodeType('pmg');
+            props.setModalResetKey((prev) => prev + 1);
+            props.setShowNodeModal(true);
+          }}
+          onDelete={(node) => props.requestDeleteNode(node)}
+        />
+      );
+    }
+  };
+
+  return (
+    <div class="space-y-6 mt-6">
+      <div class="space-y-4">
+        {/* Loading state */}
+        <Show when={!props.initialLoadComplete()}>
+          <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
+            Loading configuration...
+          </div>
+        </Show>
+
+        {/* Main content */}
+        <Show when={props.initialLoadComplete()}>
+          <Card padding="lg">
+            <div class="space-y-4">
+              {/* Header with actions */}
+              <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
+                <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">
+                  {config().title}
+                </h4>
+                <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
+                  {/* Discovery toggle */}
+                  <div
+                    class="flex items-center gap-2 sm:gap-3"
+                    title={config().discoveryTooltip}
+                  >
+                    <span class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">
+                      Discovery
+                    </span>
+                    <Toggle
+                      checked={props.discoveryEnabled()}
+                      onChange={async (e: ToggleChangeEvent) => {
+                        if (
+                          props.envOverrides().discoveryEnabled ||
+                          props.savingDiscoverySettings()
+                        ) {
+                          e.preventDefault();
+                          return;
+                        }
+                        const success = await props.handleDiscoveryEnabledChange(
+                          e.currentTarget.checked,
+                        );
+                        if (!success) {
+                          e.currentTarget.checked = props.discoveryEnabled();
+                        }
+                      }}
+                      disabled={
+                        props.envOverrides().discoveryEnabled || props.savingDiscoverySettings()
+                      }
+                      containerClass="gap-2"
+                      label={
+                        <span class="text-xs font-medium text-gray-600 dark:text-gray-400">
+                          {props.discoveryEnabled() ? 'On' : 'Off'}
+                        </span>
+                      }
+                    />
+                  </div>
+
+                  {/* Refresh button */}
+                  <Show when={props.discoveryEnabled()}>
+                    <button
+                      type="button"
+                      onClick={handleRefreshDiscovery}
+                      class="px-2 sm:px-4 py-1.5 sm:py-2 text-xs sm:text-sm bg-gray-600 text-white rounded-lg hover:bg-gray-700 transition-colors flex items-center gap-1"
+                      title="Refresh discovered servers"
+                    >
+                      <svg
+                        width="16"
+                        height="16"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        stroke-width="2"
+                      >
+                        <polyline points="23 4 23 10 17 10"></polyline>
+                        <polyline points="1 20 1 14 7 14"></polyline>
+                        <path d="M3.51 9a9 9 0 0114.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0020.49 15"></path>
+                      </svg>
+                      <span class="hidden sm:inline">Refresh</span>
+                    </button>
+                  </Show>
+
+                  {/* Add button */}
+                  <button
+                    type="button"
+                    onClick={handleAddNode}
+                    class="px-2 sm:px-4 py-1.5 sm:py-2 text-xs sm:text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors flex items-center gap-1"
+                  >
+                    <svg
+                      width="16"
+                      height="16"
+                      viewBox="0 0 24 24"
+                      fill="none"
+                      stroke="currentColor"
+                      stroke-width="2"
+                    >
+                      <line x1="12" y1="5" x2="12" y2="19"></line>
+                      <line x1="5" y1="12" x2="19" y2="12"></line>
+                    </svg>
+                    <span class="sm:hidden">Add</span>
+                    <span class="hidden sm:inline">{config().addButtonText}</span>
+                  </button>
+                </div>
+              </div>
+
+              {/* Nodes table */}
+              <Show when={props.nodes().length > 0}>
+                {renderNodesTable()}
+              </Show>
+
+              {/* Empty state */}
+              <Show
+                when={
+                  props.nodes().length === 0 &&
+                  filteredDiscoveredNodes().length === 0
+                }
+              >
+                <div class="flex flex-col items-center justify-center py-12 px-4 text-center">
+                  <div class="rounded-full bg-gray-100 dark:bg-gray-800 p-4 mb-4">
+                    {config().icon()}
+                  </div>
+                  <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">
+                    {config().emptyTitle}
+                  </p>
+                  <p class="text-sm text-gray-500 dark:text-gray-400">
+                    {config().emptyDescription}
+                  </p>
+                </div>
+              </Show>
+            </div>
+          </Card>
+        </Show>
+
+        {/* Discovery section */}
+        <Show when={props.discoveryEnabled()}>
+          <div class="space-y-3">
+            {/* Scan status */}
+            <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
+              <Show when={props.discoveryScanStatus().scanning}>
+                <span class="flex items-center gap-2">
+                  <Loader class="h-4 w-4 animate-spin" />
+                  <span>{config().scanningText}</span>
+                </span>
+              </Show>
+              <Show
+                when={
+                  !props.discoveryScanStatus().scanning &&
+                  (props.discoveryScanStatus().lastResultAt ||
+                    props.discoveryScanStatus().lastScanStartedAt)
+                }
+              >
+                <span>
+                  Last scan{' '}
+                  {props.formatRelativeTime(
+                    props.discoveryScanStatus().lastResultAt ??
+                    props.discoveryScanStatus().lastScanStartedAt,
+                  )}
+                </span>
+              </Show>
+            </div>
+
+            {/* Discovery errors */}
+            <Show
+              when={
+                props.discoveryScanStatus().errors && props.discoveryScanStatus().errors!.length
+              }
+            >
+              <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
+                <span class="font-medium">Discovery issues:</span>
+                <ul class="list-disc ml-4 mt-1 space-y-0.5">
+                  <For each={props.discoveryScanStatus().errors || []}>
+                    {(err) => <li>{err}</li>}
+                  </For>
+                </ul>
+                <Show
+                  when={
+                    props.discoveryMode() === 'auto' &&
+                    (props.discoveryScanStatus().errors || []).some((err) =>
+                      /timed out|timeout/i.test(err),
+                    )
+                  }
+                >
+                  <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
+                    Large networks can time out in auto mode. Switch to a custom subnet
+                    for faster, targeted scans.
+                  </p>
+                </Show>
+              </div>
+            </Show>
+
+            {/* Scanning placeholder */}
+            <Show
+              when={
+                props.discoveryScanStatus().scanning &&
+                filteredDiscoveredNodes().length === 0
+              }
+            >
+              <Show when={props.agentType === 'pmg'}>
+                <div class="text-center py-6 text-gray-500 dark:text-gray-400 bg-gray-50 dark:bg-gray-800/50 rounded-lg border-2 border-dashed border-gray-300 dark:border-gray-600">
+                  <svg
+                    class="h-8 w-8 mx-auto mb-2 animate-pulse text-purple-500"
+                    viewBox="0 0 24 24"
+                    fill="none"
+                    stroke="currentColor"
+                    stroke-width="2"
+                  >
+                    <circle cx="11" cy="11" r="8" />
+                    <path d="m21 21-4.35-4.35" />
+                  </svg>
+                  <p class="text-sm">Scanning for PMG servers...</p>
+                </div>
+              </Show>
+              <Show when={props.agentType !== 'pmg'}>
+                <div class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                  <Loader class="h-4 w-4 animate-spin" />
+                  <span>
+                    Waiting for responses… this can take up to a minute depending on your
+                    network size.
+                  </span>
+                </div>
+              </Show>
+            </Show>
+
+            {/* Discovered nodes list */}
+            <For each={filteredDiscoveredNodes()}>
+              {(server) => (
+                <Show when={props.agentType === 'pmg'}>
+                  {/* PMG style */}
+                  <div
+                    class="bg-gradient-to-r from-purple-50 to-transparent dark:from-purple-900/20 dark:to-transparent border-l-4 border-purple-500 rounded-lg p-4 cursor-pointer hover:shadow-md transition-all"
+                    onClick={() => handleDiscoveredNodeClick(server)}
+                  >
+                    <div class="flex items-start justify-between">
+                      <div class="flex items-start gap-3 flex-1 min-w-0">
+                        <svg
+                          width="24"
+                          height="24"
+                          viewBox="0 0 24 24"
+                          fill="none"
+                          stroke="currentColor"
+                          stroke-width="2"
+                          class="text-purple-500 flex-shrink-0 mt-0.5"
+                        >
+                          <path d="M4 4h16c1.1 0 2 .9 2 2v12c0 1.1-.9 2-2 2H4c-1.1 0-2-.9-2-2V6c0-1.1.9-2 2-2z"></path>
+                          <polyline points="22,6 12,13 2,6"></polyline>
+                        </svg>
+                        <div class="flex-1 min-w-0">
+                          <h4 class="font-medium text-gray-900 dark:text-gray-100 truncate">
+                            {server.hostname || `PMG at ${server.ip}`}
+                          </h4>
+                          <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
+                            {server.ip}:{server.port}
+                          </p>
+                          <div class="flex items-center gap-2 mt-2">
+                            <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
+                              Discovered
+                            </span>
+                            <span class="text-xs text-gray-500 dark:text-gray-400">
+                              Click to configure
+                            </span>
+                          </div>
+                        </div>
+                      </div>
+                      <svg
+                        width="20"
+                        height="20"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        class="text-gray-400 mt-1"
+                      >
+                        <path
+                          d="M12 5v14m-7-7h14"
+                          stroke="currentColor"
+                          stroke-width="2"
+                          stroke-linecap="round"
+                        />
+                      </svg>
+                    </div>
+                  </div>
+                </Show>
+              )}
+            </For>
+            <For each={filteredDiscoveredNodes()}>
+              {(server) => (
+                <Show when={props.agentType !== 'pmg'}>
+                  {/* PVE/PBS style */}
+                  <div
+                    class="bg-gray-50/50 dark:bg-gray-700/30 rounded-lg p-4 border border-gray-200/50 dark:border-gray-600/50 opacity-75 hover:opacity-100 transition-opacity cursor-pointer"
+                    onClick={() => handleDiscoveredNodeClick(server)}
+                  >
+                    <div class="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-2">
+                      <div class="flex-1 min-w-0">
+                        <div class="flex items-start gap-3">
+                          <div class="flex-shrink-0 w-3 h-3 mt-1.5 rounded-full bg-gray-400 animate-pulse"></div>
+                          <div class="flex-1 min-w-0">
+                            <h4 class="font-medium text-gray-700 dark:text-gray-300">
+                              {server.hostname || `${props.agentType === 'pve' ? 'Proxmox VE' : 'Backup Server'} at ${server.ip}`}
+                            </h4>
+                            <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
+                              {server.ip}:{server.port}
+                            </p>
+                            <div class="flex items-center gap-2 mt-2">
+                              <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
+                                Discovered
+                              </span>
+                              <span class="text-xs text-gray-500 dark:text-gray-400">
+                                Click to configure
+                              </span>
+                            </div>
+                          </div>
+                        </div>
+                      </div>
+                      <svg
+                        width="20"
+                        height="20"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        class="text-gray-400 mt-1"
+                      >
+                        <path
+                          d="M12 5v14m-7-7h14"
+                          stroke="currentColor"
+                          stroke-width="2"
+                          stroke-linecap="round"
+                        />
+                      </svg>
+                    </div>
+                  </div>
+                </Show>
+              )}
+            </For>
+          </div>
+        </Show>
+      </div>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/SecurityAuthPanel.tsx b/frontend-modern/src/components/Settings/SecurityAuthPanel.tsx
new file mode 100644
index 0000000..65c4177
--- /dev/null
+++ b/frontend-modern/src/components/Settings/SecurityAuthPanel.tsx
@@ -0,0 +1,320 @@
+import { Component, Show, Accessor, Setter } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { Toggle } from '@/components/shared/Toggle';
+import type { ToggleChangeEvent } from '@/components/shared/Toggle';
+import { QuickSecuritySetup } from './QuickSecuritySetup';
+import Lock from 'lucide-solid/icons/lock';
+import type { VersionInfo } from '@/api/updates';
+
+interface SecurityStatusInfo {
+  hasAuthentication: boolean;
+  apiTokenConfigured: boolean;
+  authUsername?: string;
+  configuredButPendingRestart?: boolean;
+  hasProxyAuth?: boolean;
+  proxyAuthUsername?: string;
+  proxyAuthIsAdmin?: boolean;
+  proxyAuthLogoutURL?: string;
+  deprecatedDisableAuth?: boolean;
+}
+
+interface SecurityAuthPanelProps {
+  securityStatus: Accessor<SecurityStatusInfo | null>;
+  securityStatusLoading: Accessor<boolean>;
+  versionInfo: Accessor<VersionInfo | null>;
+  authDisabledByEnv: Accessor<boolean>;
+  showQuickSecuritySetup: Accessor<boolean>;
+  setShowQuickSecuritySetup: Setter<boolean>;
+  showQuickSecurityWizard: Accessor<boolean>;
+  setShowQuickSecurityWizard: Setter<boolean>;
+  showPasswordModal: Accessor<boolean>;
+  setShowPasswordModal: Setter<boolean>;
+  hideLocalLogin: Accessor<boolean>;
+  hideLocalLoginLocked: () => boolean;
+  savingHideLocalLogin: Accessor<boolean>;
+  handleHideLocalLoginChange: (enabled: boolean) => Promise<void>;
+  loadSecurityStatus: () => Promise<void>;
+}
+
+export const SecurityAuthPanel: Component<SecurityAuthPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      {/* Show message when auth is disabled */}
+      <Show when={!props.securityStatus()?.hasAuthentication}>
+        <Card
+          padding="none"
+          class="overflow-hidden border border-amber-200 dark:border-amber-800"
+          border={false}
+        >
+          {/* Header */}
+          <div class="bg-gradient-to-r from-amber-50 to-amber-50 dark:from-amber-900/20 dark:to-amber-900/20 px-6 py-4 border-b border-amber-200 dark:border-amber-700">
+            <div class="flex items-center gap-3">
+              <div class="p-2 bg-amber-100 dark:bg-amber-900/50 rounded-lg">
+                <svg
+                  class="w-5 h-5 text-amber-600 dark:text-amber-400"
+                  fill="none"
+                  viewBox="0 0 24 24"
+                  stroke="currentColor"
+                >
+                  <path
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    stroke-width="2"
+                    d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                  />
+                </svg>
+              </div>
+              <SectionHeader title="Authentication disabled" size="sm" class="flex-1" />
+              <Show
+                when={!props.authDisabledByEnv()}
+                fallback={
+                  <span class="px-3 py-1.5 text-xs font-semibold rounded-lg border border-amber-300 text-amber-800 bg-amber-100/60 dark:border-amber-700 dark:text-amber-100 dark:bg-amber-900/40 whitespace-nowrap">
+                    Controlled by DISABLE_AUTH
+                  </span>
+                }
+              >
+                <button
+                  type="button"
+                  onClick={() => props.setShowQuickSecuritySetup(!props.showQuickSecuritySetup())}
+                  class="px-3 py-1.5 text-xs font-medium rounded-lg border border-amber-300 text-amber-800 bg-amber-100/50 hover:bg-amber-100 transition-colors dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 dark:hover:bg-amber-900/40 whitespace-nowrap"
+                >
+                  Setup
+                </button>
+              </Show>
+            </div>
+          </div>
+
+          {/* Content */}
+          <div class="p-6">
+            <p class="text-sm text-amber-700 dark:text-amber-300 mb-4">
+              <Show
+                when={props.authDisabledByEnv()}
+                fallback={
+                  <>
+                    Authentication is currently disabled. Set up password authentication to protect
+                    your Pulse instance.
+                  </>
+                }
+              >
+                Authentication settings are locked by the legacy{' '}
+                <code class="font-mono text-xs text-amber-800 dark:text-amber-200">
+                  DISABLE_AUTH
+                </code>{' '}
+                environment variable. Remove it from your deployment and restart Pulse before
+                enabling security from this page.
+              </Show>
+            </p>
+
+            <Show when={props.showQuickSecuritySetup() && !props.authDisabledByEnv()}>
+              <QuickSecuritySetup
+                onConfigured={() => {
+                  props.setShowQuickSecuritySetup(false);
+                  props.loadSecurityStatus();
+                }}
+              />
+            </Show>
+          </div>
+        </Card>
+      </Show>
+
+      {/* Authentication */}
+      <Show
+        when={
+          !props.securityStatusLoading() &&
+          (props.securityStatus()?.hasAuthentication || props.securityStatus()?.apiTokenConfigured)
+        }
+      >
+        <Card
+          padding="none"
+          class="overflow-hidden border border-gray-200 dark:border-gray-700"
+          border={false}
+        >
+          {/* Header */}
+          <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+            <div class="flex items-center gap-3">
+              <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                <Lock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+              </div>
+              <SectionHeader
+                title="Authentication"
+                description="Password management and credential rotation"
+                size="sm"
+                class="flex-1"
+              />
+            </div>
+          </div>
+
+          {/* Content */}
+          <div class="p-6">
+            <div class="flex flex-wrap items-center gap-3">
+              <button
+                type="button"
+                onClick={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  props.setShowPasswordModal(true);
+                }}
+                class="px-4 py-2 text-sm font-medium bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+              >
+                Change password
+              </button>
+              <Show
+                when={!props.authDisabledByEnv()}
+                fallback={
+                  <span class="px-4 py-2 text-sm font-semibold border border-amber-300 text-amber-800 bg-amber-50 dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 rounded-lg">
+                    Remove DISABLE_AUTH to rotate credentials
+                  </span>
+                }
+              >
+                <button
+                  type="button"
+                  onClick={() => props.setShowQuickSecurityWizard(!props.showQuickSecurityWizard())}
+                  class="px-4 py-2 text-sm font-medium border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 rounded-lg hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors"
+                >
+                  Rotate credentials
+                </button>
+              </Show>
+              <div class="flex-1"></div>
+              <div class="text-xs text-gray-600 dark:text-gray-400">
+                <span class="font-medium text-gray-800 dark:text-gray-200">User:</span>{' '}
+                {props.securityStatus()?.authUsername || 'Not configured'}
+              </div>
+            </div>
+
+            <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
+              <Toggle
+                label="Hide local login form"
+                description="Hide the username/password form on the login page. Users will only see SSO options unless ?show_local=true is used."
+                checked={props.hideLocalLogin()}
+                onChange={(e: ToggleChangeEvent) =>
+                  props.handleHideLocalLoginChange(e.currentTarget.checked)
+                }
+                disabled={props.hideLocalLoginLocked() || props.savingHideLocalLogin()}
+                locked={props.hideLocalLoginLocked()}
+                lockedMessage="This setting is managed by the PULSE_AUTH_HIDE_LOCAL_LOGIN environment variable"
+              />
+            </div>
+
+            <Show when={!props.authDisabledByEnv() && props.showQuickSecurityWizard()}>
+              <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
+                <QuickSecuritySetup
+                  mode="rotate"
+                  defaultUsername={props.securityStatus()?.authUsername || 'admin'}
+                  onConfigured={() => {
+                    props.setShowQuickSecurityWizard(false);
+                    props.loadSecurityStatus();
+                  }}
+                />
+              </div>
+            </Show>
+          </div>
+        </Card>
+      </Show>
+
+      {/* Show pending restart message if configured but not loaded */}
+      <Show when={props.securityStatus()?.configuredButPendingRestart}>
+        <div class="bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-4">
+          <div class="flex items-start space-x-3">
+            <div class="flex-shrink-0">
+              <svg
+                class="h-6 w-6 text-amber-600 dark:text-amber-400"
+                fill="none"
+                viewBox="0 0 24 24"
+                stroke="currentColor"
+              >
+                <path
+                  stroke-linecap="round"
+                  stroke-linejoin="round"
+                  stroke-width="2"
+                  d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                />
+              </svg>
+            </div>
+            <div class="flex-1">
+              <h4 class="text-sm font-semibold text-amber-900 dark:text-amber-100">
+                Security Configured - Restart Required
+              </h4>
+              <p class="text-xs text-amber-700 dark:text-amber-300 mt-1">
+                Security settings have been configured but the service needs to be restarted to
+                activate them.
+              </p>
+              <p class="text-xs text-amber-600 dark:text-amber-400 mt-2">
+                After restarting, you'll need to log in with your saved credentials.
+              </p>
+
+              <div class="mt-4 bg-white dark:bg-gray-800 rounded-lg p-3 border border-amber-200 dark:border-amber-700">
+                <p class="text-xs font-semibold text-gray-900 dark:text-gray-100 mb-2">
+                  How to restart Pulse:
+                </p>
+
+                <Show when={props.versionInfo()?.deploymentType === 'proxmoxve'}>
+                  <div class="space-y-2">
+                    <p class="text-xs text-gray-700 dark:text-gray-300">
+                      Type{' '}
+                      <code class="px-1 py-0.5 bg-gray-100 dark:bg-gray-700 rounded">update</code>{' '}
+                      in your ProxmoxVE console
+                    </p>
+                    <p class="text-xs text-gray-600 dark:text-gray-400 italic">
+                      Or restart manually with: <code class="text-xs">systemctl restart pulse</code>
+                    </p>
+                  </div>
+                </Show>
+
+                <Show when={props.versionInfo()?.deploymentType === 'docker'}>
+                  <div class="space-y-1">
+                    <p class="text-xs text-gray-700 dark:text-gray-300">
+                      Restart your Docker container:
+                    </p>
+                    <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                      docker restart pulse
+                    </code>
+                  </div>
+                </Show>
+
+                <Show
+                  when={
+                    props.versionInfo()?.deploymentType === 'systemd' ||
+                    props.versionInfo()?.deploymentType === 'manual'
+                  }
+                >
+                  <div class="space-y-1">
+                    <p class="text-xs text-gray-700 dark:text-gray-300">Restart the service:</p>
+                    <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                      sudo systemctl restart pulse
+                    </code>
+                  </div>
+                </Show>
+
+                <Show when={props.versionInfo()?.deploymentType === 'development'}>
+                  <div class="space-y-1">
+                    <p class="text-xs text-gray-700 dark:text-gray-300">
+                      Restart the development server:
+                    </p>
+                    <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                      sudo systemctl restart pulse-hot-dev
+                    </code>
+                  </div>
+                </Show>
+
+                <Show when={!props.versionInfo()?.deploymentType}>
+                  <div class="space-y-1">
+                    <p class="text-xs text-gray-700 dark:text-gray-300">
+                      Restart Pulse using your deployment method
+                    </p>
+                  </div>
+                </Show>
+              </div>
+
+              <div class="mt-3 p-2 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded">
+                <p class="text-xs text-green-700 dark:text-green-300">
+                  <strong>Tip:</strong> Make sure you've saved your credentials before restarting!
+                </p>
+              </div>
+            </div>
+          </div>
+        </div>
+      </Show>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/SecurityOverviewPanel.tsx b/frontend-modern/src/components/Settings/SecurityOverviewPanel.tsx
new file mode 100644
index 0000000..cd59bc8
--- /dev/null
+++ b/frontend-modern/src/components/Settings/SecurityOverviewPanel.tsx
@@ -0,0 +1,157 @@
+import { Component, Show, Accessor } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import { SecurityPostureSummary } from './SecurityPostureSummary';
+import Shield from 'lucide-solid/icons/shield';
+import Info from 'lucide-solid/icons/info';
+
+interface SecurityStatusInfo {
+  hasAuthentication: boolean;
+  oidcEnabled?: boolean;
+  hasProxyAuth?: boolean;
+  apiTokenConfigured: boolean;
+  exportProtected: boolean;
+  unprotectedExportAllowed?: boolean;
+  hasHTTPS?: boolean;
+  hasAuditLogging: boolean;
+  requiresAuth: boolean;
+  publicAccess?: boolean;
+  isPrivateNetwork?: boolean;
+  clientIP?: string;
+  proxyAuthUsername?: string;
+  proxyAuthIsAdmin?: boolean;
+  proxyAuthLogoutURL?: string;
+}
+
+interface SecurityOverviewPanelProps {
+  securityStatus: Accessor<SecurityStatusInfo | null>;
+  securityStatusLoading: Accessor<boolean>;
+}
+
+export const SecurityOverviewPanel: Component<SecurityOverviewPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      {/* Loading State */}
+      <Show when={props.securityStatusLoading()}>
+        <Card
+          padding="none"
+          class="overflow-hidden border border-gray-200 dark:border-gray-700"
+          border={false}
+        >
+          <div class="bg-gradient-to-r from-gray-100 to-gray-200 dark:from-gray-800 dark:to-gray-700 px-6 py-5 animate-pulse">
+            <div class="flex items-center gap-4">
+              <div class="w-12 h-12 bg-gray-300 dark:bg-gray-600 rounded-xl"></div>
+              <div class="flex-1 space-y-2">
+                <div class="h-5 bg-gray-300 dark:bg-gray-600 rounded w-1/3"></div>
+                <div class="h-4 bg-gray-300 dark:bg-gray-600 rounded w-1/2"></div>
+              </div>
+              <div class="text-right space-y-2">
+                <div class="h-8 bg-gray-300 dark:bg-gray-600 rounded w-16 ml-auto"></div>
+                <div class="h-4 bg-gray-300 dark:bg-gray-600 rounded w-12 ml-auto"></div>
+              </div>
+            </div>
+          </div>
+          <div class="p-6">
+            <div class="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
+              {[1, 2, 3, 4].map(() => (
+                <div class="rounded-xl border border-gray-200 dark:border-gray-700 p-4 animate-pulse">
+                  <div class="h-4 bg-gray-200 dark:bg-gray-700 rounded w-2/3 mb-2"></div>
+                  <div class="h-3 bg-gray-200 dark:bg-gray-700 rounded w-1/2"></div>
+                </div>
+              ))}
+            </div>
+          </div>
+        </Card>
+      </Show>
+
+      {/* Security Summary */}
+      <Show when={!props.securityStatusLoading() && props.securityStatus()}>
+        <SecurityPostureSummary status={props.securityStatus()!} />
+      </Show>
+
+      {/* Proxy Auth Notice */}
+      <Show when={!props.securityStatusLoading() && props.securityStatus()?.hasProxyAuth}>
+        <Card
+          padding="none"
+          class="overflow-hidden border border-blue-200 dark:border-blue-800"
+          border={false}
+        >
+          <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-blue-200 dark:border-blue-700">
+            <div class="flex items-center gap-3">
+              <div class="p-2 bg-blue-100 dark:bg-blue-900/50 rounded-lg">
+                <Shield class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+              </div>
+              <SectionHeader
+                title="Proxy Authentication Active"
+                description="Requests are validated by an upstream proxy"
+                size="sm"
+                class="flex-1"
+              />
+            </div>
+          </div>
+          <div class="p-4 text-sm text-blue-800 dark:text-blue-200 space-y-2">
+            <p>
+              The current proxied user is
+              <span class="font-semibold">
+                {props.securityStatus()?.proxyAuthUsername
+                  ? ` ${props.securityStatus()?.proxyAuthUsername}`
+                  : ' available once a request is received'}
+              </span>
+              .
+              {props.securityStatus()?.proxyAuthIsAdmin && (
+                <span class="ml-1 inline-flex items-center px-2 py-0.5 text-xs font-medium rounded-full bg-blue-100 text-blue-700 dark:bg-blue-800 dark:text-blue-200">
+                  Admin
+                </span>
+              )}
+            </p>
+            <div class="flex flex-wrap items-center gap-3 pt-2">
+              <Show when={props.securityStatus()?.proxyAuthLogoutURL}>
+                <a
+                  href={props.securityStatus()?.proxyAuthLogoutURL}
+                  class="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium rounded-lg border border-blue-300 dark:border-blue-600 bg-blue-50 dark:bg-blue-900/30 text-blue-700 dark:text-blue-200 hover:bg-blue-100 dark:hover:bg-blue-900/50 transition-colors"
+                >
+                  <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M17 16l4-4m0 0l-4-4m4 4H7m6 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h4a3 3 0 013 3v1" />
+                  </svg>
+                  Proxy Logout
+                </a>
+              </Show>
+              <a
+                href="https://github.com/rcourtman/Pulse/blob/main/docs/PROXY_AUTH.md"
+                target="_blank"
+                rel="noreferrer"
+                class="inline-flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium rounded-lg text-blue-600 dark:text-blue-300 hover:underline"
+              >
+                Read proxy auth guide →
+              </a>
+            </div>
+          </div>
+        </Card>
+      </Show>
+
+      {/* Security Tips Card */}
+      <Show when={!props.securityStatusLoading() && props.securityStatus()}>
+        <Card
+          padding="md"
+          class="border border-gray-200 dark:border-gray-700 bg-gray-50/50 dark:bg-gray-800/30"
+          border={false}
+        >
+          <div class="flex items-start gap-3">
+            <div class="p-1.5 bg-gray-100 dark:bg-gray-700 rounded-lg flex-shrink-0">
+              <Info class="w-4 h-4 text-gray-500 dark:text-gray-400" />
+            </div>
+            <div class="text-xs text-gray-600 dark:text-gray-400">
+              <p class="font-medium text-gray-700 dark:text-gray-300 mb-1">Security Best Practices</p>
+              <ul class="space-y-0.5 list-disc list-inside">
+                <li>Enable HTTPS via a reverse proxy for encrypted connections</li>
+                <li>Use strong, unique passwords and rotate credentials regularly</li>
+                <li>Consider SSO/OIDC for enterprise authentication needs</li>
+                <li>Review API token scopes and remove unused tokens</li>
+              </ul>
+            </div>
+          </div>
+        </Card>
+      </Show>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/SecurityPostureSummary.tsx b/frontend-modern/src/components/Settings/SecurityPostureSummary.tsx
index 47c5e6c..7c00efc 100644
--- a/frontend-modern/src/components/Settings/SecurityPostureSummary.tsx
+++ b/frontend-modern/src/components/Settings/SecurityPostureSummary.tsx
@@ -1,6 +1,10 @@
-import { Component, For, Show } from 'solid-js';
+import { Component, For, Show, createMemo } from 'solid-js';
 import { Card } from '@/components/shared/Card';
-import { SectionHeader } from '@/components/shared/SectionHeader';
+import Shield from 'lucide-solid/icons/shield';
+import ShieldCheck from 'lucide-solid/icons/shield-check';
+import ShieldAlert from 'lucide-solid/icons/shield-alert';
+import CheckCircle from 'lucide-solid/icons/check-circle';
+import XCircle from 'lucide-solid/icons/x-circle';
 
 interface SecurityPostureSummaryProps {
   status: {
@@ -26,24 +30,28 @@ export const SecurityPostureSummary: Component<SecurityPostureSummaryProps> = (p
       label: 'Password login',
       enabled: props.status.hasAuthentication,
       description: props.status.hasAuthentication ? 'Active' : 'Not configured',
+      critical: true, // Critical security feature
     },
     {
       key: 'oidc',
       label: 'Single sign-on',
       enabled: Boolean(props.status.oidcEnabled),
       description: props.status.oidcEnabled ? 'OIDC configured' : 'Not configured',
+      critical: false,
     },
     {
       key: 'proxy',
       label: 'Proxy auth',
       enabled: Boolean(props.status.hasProxyAuth),
       description: props.status.hasProxyAuth ? 'Active' : 'Not configured',
+      critical: false,
     },
     {
       key: 'token',
       label: 'API token',
       enabled: props.status.apiTokenConfigured,
       description: props.status.apiTokenConfigured ? 'Active' : 'Not configured',
+      critical: false,
     },
     {
       key: 'export',
@@ -52,79 +60,138 @@ export const SecurityPostureSummary: Component<SecurityPostureSummaryProps> = (p
       description: props.status.unprotectedExportAllowed
         ? 'Unprotected'
         : 'Token + passphrase required',
+      critical: true,
     },
     {
       key: 'https',
       label: 'HTTPS',
       enabled: Boolean(props.status.hasHTTPS),
       description: props.status.hasHTTPS ? 'Encrypted' : 'HTTP only',
+      critical: true,
     },
     {
       key: 'audit',
       label: 'Audit log',
       enabled: props.status.hasAuditLogging,
       description: props.status.hasAuditLogging ? 'Active' : 'Not enabled',
+      critical: false,
     },
   ];
 
-  const badgeClasses = (enabled: boolean) =>
-    enabled
-      ? 'inline-flex items-center gap-1 px-2.5 py-1 text-xs font-semibold rounded-full bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-300'
-      : 'inline-flex items-center gap-1 px-2.5 py-1 text-xs font-semibold rounded-full bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-200';
+  // Calculate security score
+  const securityScore = createMemo(() => {
+    const list = items();
+    const criticalItems = list.filter(i => i.critical);
+    const enabledCritical = criticalItems.filter(i => i.enabled).length;
+    const allItems = list.filter(i => i.enabled).length;
+
+    // Weight critical items more heavily
+    const criticalWeight = 0.7;
+    const optionalWeight = 0.3;
+
+    const criticalScore = criticalItems.length > 0 ? (enabledCritical / criticalItems.length) * criticalWeight : 0;
+    const optionalScore = list.length > 0 ? (allItems / list.length) * optionalWeight : 0;
+
+    return Math.round((criticalScore + optionalScore) * 100);
+  });
+
+  const scoreColor = () => {
+    const score = securityScore();
+    if (score >= 80) return 'from-green-500 to-emerald-600';
+    if (score >= 50) return 'from-amber-500 to-orange-600';
+    return 'from-red-500 to-rose-600';
+  };
+
+  const scoreLabel = () => {
+    const score = securityScore();
+    if (score >= 80) return 'Strong';
+    if (score >= 50) return 'Moderate';
+    return 'Weak';
+  };
+
+  const ScoreIcon = () => {
+    const score = securityScore();
+    if (score >= 80) return ShieldCheck;
+    if (score >= 50) return Shield;
+    return ShieldAlert;
+  };
 
   return (
-    <Card padding="md" class="border border-gray-200 dark:border-gray-700">
-      <div class="flex flex-col gap-4">
-        <div class="flex flex-col md:flex-row md:items-start md:justify-between gap-3">
-          <SectionHeader title="Security posture" size="sm" class="flex-1" />
-          <div class="flex items-center gap-2">
-            <span
-              class={`${
-                props.status.publicAccess && !props.status.isPrivateNetwork
-                  ? 'bg-red-100 text-red-700 dark:bg-red-900/30 dark:text-red-300'
-                  : 'bg-blue-100 text-blue-700 dark:bg-blue-900/30 dark:text-blue-200'
-              } px-3 py-1 text-xs font-semibold rounded-full`}
-            >
-              {props.status.publicAccess && !props.status.isPrivateNetwork
-                ? 'Public network access'
-                : 'Private network access'}
-            </span>
-            <Show when={props.status.clientIP}>
-              <span class="hidden md:inline-flex items-center px-3 py-1 text-xs font-medium rounded-full bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-300">
-                IP: {props.status.clientIP}
-              </span>
-            </Show>
+    <Card
+      padding="none"
+      class="overflow-hidden border border-gray-200 dark:border-gray-700"
+      border={false}
+    >
+      {/* Header with Security Score */}
+      <div class={`bg-gradient-to-r ${scoreColor()} px-6 py-5`}>
+        <div class="flex items-center justify-between">
+          <div class="flex items-center gap-4">
+            <div class="p-3 bg-white/20 rounded-xl backdrop-blur-sm">
+              {(() => {
+                const Icon = ScoreIcon();
+                return <Icon class="w-6 h-6 text-white" />;
+              })()}
+            </div>
+            <div>
+              <h2 class="text-lg font-bold text-white">Security Posture</h2>
+              <p class="text-sm text-white/80">
+                {props.status.publicAccess && !props.status.isPrivateNetwork
+                  ? 'Public network access detected'
+                  : 'Private network access'}
+              </p>
+            </div>
+          </div>
+          <div class="text-right">
+            <div class="text-3xl font-bold text-white">{securityScore()}%</div>
+            <div class="text-sm text-white/80">{scoreLabel()}</div>
           </div>
         </div>
+      </div>
 
-
-        <div class="grid gap-3 md:grid-cols-2 xl:grid-cols-3">
+      {/* Security Items Grid */}
+      <div class="p-6">
+        <div class="grid gap-3 md:grid-cols-2 xl:grid-cols-4">
           <For each={items()}>
             {(item) => (
-              <div class="rounded-lg border border-gray-200 dark:border-gray-700 p-3 bg-white dark:bg-gray-800">
+              <div class={`rounded-xl border p-4 transition-all ${item.enabled
+                  ? 'border-green-200 dark:border-green-800 bg-green-50/50 dark:bg-green-900/20'
+                  : item.critical
+                    ? 'border-red-200 dark:border-red-800 bg-red-50/50 dark:bg-red-900/20'
+                    : 'border-gray-200 dark:border-gray-700 bg-gray-50/50 dark:bg-gray-800/50'
+                }`}>
                 <div class="flex items-center justify-between mb-2">
                   <span class="text-sm font-semibold text-gray-900 dark:text-gray-100">
                     {item.label}
                   </span>
-                  <span class={badgeClasses(item.enabled)}>
-                    <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                      <path
-                        stroke-linecap="round"
-                        stroke-linejoin="round"
-                        stroke-width="2"
-                        d={item.enabled ? 'M5 13l4 4L19 7' : 'M6 18L18 6M6 6l12 12'}
-                      />
-                    </svg>
-                    {item.enabled ? 'On' : 'Off'}
-                  </span>
+                  <Show when={item.enabled} fallback={
+                    <XCircle class={`w-5 h-5 ${item.critical ? 'text-red-500' : 'text-gray-400 dark:text-gray-500'}`} />
+                  }>
+                    <CheckCircle class="w-5 h-5 text-green-500" />
+                  </Show>
+                </div>
+                <div class="flex items-center justify-between">
+                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                    {item.description}
+                  </p>
+                  <Show when={item.critical && !item.enabled}>
+                    <span class="text-[10px] font-medium text-red-600 dark:text-red-400 uppercase">
+                      Critical
+                    </span>
+                  </Show>
                 </div>
-                <p class="text-xs text-gray-600 dark:text-gray-400 leading-relaxed">
-                  {item.description}
-                </p>
               </div>
             )}
           </For>
         </div>
+
+        {/* Client IP Badge */}
+        <Show when={props.status.clientIP}>
+          <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700 flex items-center justify-end">
+            <span class="inline-flex items-center px-3 py-1.5 text-xs font-medium rounded-full bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-300">
+              Your IP: {props.status.clientIP}
+            </span>
+          </div>
+        </Show>
       </div>
     </Card>
   );
diff --git a/frontend-modern/src/components/Settings/Settings.tsx b/frontend-modern/src/components/Settings/Settings.tsx
index aeef9f6..859f84c 100644
--- a/frontend-modern/src/components/Settings/Settings.tsx
+++ b/frontend-modern/src/components/Settings/Settings.tsx
@@ -12,8 +12,6 @@ import {
 import { useNavigate, useLocation } from '@solidjs/router';
 import { useWebSocket } from '@/App';
 import { showSuccess, showError, showWarning } from '@/utils/toast';
-import { copyToClipboard } from '@/utils/clipboard';
-import { getPulsePort, getPulseWebSocketUrl } from '@/utils/url';
 import { logger } from '@/utils/logger';
 import {
   apiFetch,
@@ -25,10 +23,18 @@ import {
 import { NodeModal } from './NodeModal';
 import { ChangePasswordModal } from './ChangePasswordModal';
 import { UnifiedAgents } from './UnifiedAgents';
-import APITokenManager from './APITokenManager';
 import { OIDCPanel } from './OIDCPanel';
-import { QuickSecuritySetup } from './QuickSecuritySetup';
-import { SecurityPostureSummary } from './SecurityPostureSummary';
+import { AISettings } from './AISettings';
+import { AICostDashboard } from '@/components/AI/AICostDashboard';
+import { DiagnosticsPanel } from './DiagnosticsPanel';
+import { GeneralSettingsPanel } from './GeneralSettingsPanel';
+import { NetworkSettingsPanel } from './NetworkSettingsPanel';
+import { UpdatesSettingsPanel } from './UpdatesSettingsPanel';
+import { UpdateConfirmationModal } from '@/components/UpdateConfirmationModal';
+import { BackupsSettingsPanel } from './BackupsSettingsPanel';
+import { SecurityAuthPanel } from './SecurityAuthPanel';
+import { APIAccessPanel } from './APIAccessPanel';
+import { SecurityOverviewPanel } from './SecurityOverviewPanel';
 import {
   PveNodesTable,
   PbsNodesTable,
@@ -57,24 +63,16 @@ import Monitor from 'lucide-solid/icons/monitor';
 import Sliders from 'lucide-solid/icons/sliders-horizontal';
 import RefreshCw from 'lucide-solid/icons/refresh-cw';
 import Clock from 'lucide-solid/icons/clock';
+import Sparkles from 'lucide-solid/icons/sparkles';
 import { ProxmoxIcon } from '@/components/icons/ProxmoxIcon';
 import BadgeCheck from 'lucide-solid/icons/badge-check';
 import type { NodeConfig } from '@/types/nodes';
 import type { UpdateInfo, VersionInfo } from '@/api/updates';
-import type { APITokenRecord } from '@/api/security';
 import type { SecurityStatus as SecurityStatusInfo } from '@/types/config';
 import { eventBus } from '@/stores/events';
 import { notificationStore } from '@/stores/notifications';
-import { showTokenReveal } from '@/stores/tokenReveal';
 import { updateStore } from '@/stores/updates';
 
-const COMMON_DISCOVERY_SUBNETS = [
-  '192.168.1.0/24',
-  '192.168.0.0/24',
-  '10.0.0.0/24',
-  '172.16.0.0/24',
-  '192.168.10.0/24',
-];
 // Type definitions
 interface DiscoveredServer {
   ip: string;
@@ -278,20 +276,6 @@ interface AlertsDiagnostic {
   notes?: string[];
 }
 
-interface ProxyRegisterNode {
-  name: string;
-  sshReady: boolean;
-  error?: string;
-}
-
-interface DockerMigrationResult {
-  token: string;
-  installCommand: string;
-  systemdServiceSnippet: string;
-  pulseURL: string;
-  record: APITokenRecord;
-}
-
 interface DiagnosticsData {
   version: string;
   runtime: string;
@@ -324,6 +308,7 @@ type SettingsTab =
   | 'system-network'
   | 'system-updates'
   | 'system-backups'
+  | 'system-ai'
   | 'api'
   | 'security-overview'
   | 'security-auth'
@@ -369,6 +354,10 @@ const SETTINGS_HEADER_META: Record<SettingsTab, { title: string; description: st
     title: 'Backup Polling',
     description: 'Control how often Pulse queries Proxmox for backup tasks and snapshots.',
   },
+  'system-ai': {
+    title: 'AI Assistant',
+    description: 'Configure AI-powered infrastructure analysis and remediation suggestions.',
+  },
   api: {
     title: 'API access',
     description:
@@ -407,8 +396,6 @@ const BACKUP_INTERVAL_OPTIONS = [
   { label: '24 hours', value: 24 * 60 * 60 },
 ];
 
-const BACKUP_INTERVAL_MAX_MINUTES = 7 * 24 * 60; // 7 days
-
 const PVE_POLLING_MIN_SECONDS = 10;
 const PVE_POLLING_MAX_SECONDS = 3600;
 const PVE_POLLING_PRESETS = [
@@ -433,7 +420,7 @@ interface SettingsProps {
 }
 
 const Settings: Component<SettingsProps> = (props) => {
-  const { state, connected } = useWebSocket();
+  const { state, connected: _connected } = useWebSocket();
   const navigate = useNavigate();
   const location = useLocation();
 
@@ -456,6 +443,7 @@ const Settings: Component<SettingsProps> = (props) => {
     if (path.includes('/settings/system-network')) return 'system-network';
     if (path.includes('/settings/system-updates')) return 'system-updates';
     if (path.includes('/settings/system-backups')) return 'system-backups';
+    if (path.includes('/settings/system-ai')) return 'system-ai';
     if (path.includes('/settings/system')) return 'system-general';
     if (path.includes('/settings/api')) return 'api';
     if (path.includes('/settings/security-overview')) return 'security-overview';
@@ -530,9 +518,6 @@ const Settings: Component<SettingsProps> = (props) => {
       description: 'Manage Pulse configuration.',
     };
 
-  const pveBackupsState = () => state.backups?.pve ?? state.pveBackups;
-  const pbsBackupsState = () => state.backups?.pbs ?? state.pbsBackups;
-
   // Keep tab state in sync with URL and handle /settings redirect without flicker
   createEffect(
     on(
@@ -643,7 +628,7 @@ const Settings: Component<SettingsProps> = (props) => {
   const [envOverrides, setEnvOverrides] = createSignal<Record<string, boolean>>({});
   const [temperatureMonitoringEnabled, setTemperatureMonitoringEnabled] = createSignal(true);
   const [savingTemperatureSetting, setSavingTemperatureSetting] = createSignal(false);
-  const [hostProxyStatus, setHostProxyStatus] = createSignal<HostProxyStatusResponse | null>(null);
+  const [_hostProxyStatus, setHostProxyStatus] = createSignal<HostProxyStatusResponse | null>(null);
   const [hideLocalLogin, setHideLocalLogin] = createSignal(false);
   const [savingHideLocalLogin, setSavingHideLocalLogin] = createSignal(false);
 
@@ -780,6 +765,10 @@ const Settings: Component<SettingsProps> = (props) => {
   const [autoUpdateEnabled, setAutoUpdateEnabled] = createSignal(false);
   const [autoUpdateCheckInterval, setAutoUpdateCheckInterval] = createSignal(24);
   const [autoUpdateTime, setAutoUpdateTime] = createSignal('03:00');
+  // Update installation state
+  const [updatePlan, setUpdatePlan] = createSignal<import('@/api/updates').UpdatePlan | null>(null);
+  const [isInstallingUpdate, setIsInstallingUpdate] = createSignal(false);
+  const [showUpdateConfirmation, setShowUpdateConfirmation] = createSignal(false);
   const [backupPollingEnabled, setBackupPollingEnabled] = createSignal(true);
   const [backupPollingInterval, setBackupPollingInterval] = createSignal(0);
   const [backupPollingCustomMinutes, setBackupPollingCustomMinutes] = createSignal(60);
@@ -817,15 +806,7 @@ const Settings: Component<SettingsProps> = (props) => {
 
   // Diagnostics
   const [diagnosticsData, setDiagnosticsData] = createSignal<DiagnosticsData | null>(null);
-  const [runningDiagnostics, setRunningDiagnostics] = createSignal(false);
-  const [proxyActionLoading, setProxyActionLoading] = createSignal<'register-nodes' | null>(null);
-  const [proxyRegisterSummary, setProxyRegisterSummary] = createSignal<ProxyRegisterNode[] | null>(
-    null,
-  );
-  const [dockerActionLoading, setDockerActionLoading] = createSignal<string | null>(null);
-  const [dockerMigrationResults, setDockerMigrationResults] = createSignal<
-    Record<string, DockerMigrationResult>
-  >({});
+  const [_runningDiagnostics, setRunningDiagnostics] = createSignal(false);
 
   // Security
   const [securityStatus, setSecurityStatus] = createSignal<SecurityStatusInfo | null>(null);
@@ -873,75 +854,6 @@ const Settings: Component<SettingsProps> = (props) => {
     return new Date(timestamp).toLocaleString();
   };
 
-  const formatIsoDateTime = (iso?: string) => {
-    if (!iso) {
-      return '';
-    }
-    const timestamp = Date.parse(iso);
-    if (Number.isNaN(timestamp)) {
-      return '';
-    }
-    return new Date(timestamp).toLocaleString();
-  };
-
-  const formatIsoRelativeTime = (iso?: string) => {
-    if (!iso) {
-      return '';
-    }
-    const timestamp = Date.parse(iso);
-    if (Number.isNaN(timestamp)) {
-      return '';
-    }
-    return formatRelativeTime(timestamp);
-  };
-
-  const controlPlaneStatusLabel = (status?: string) => {
-    switch (status) {
-      case 'healthy':
-        return 'Healthy';
-      case 'stale':
-        return 'Behind';
-      case 'offline':
-        return 'Offline';
-      case 'pending':
-      default:
-        return 'Pending';
-    }
-  };
-
-  const controlPlaneStatusClass = (status?: string) => {
-    switch (status) {
-      case 'healthy':
-        return 'bg-green-500';
-      case 'stale':
-        return 'bg-yellow-500';
-      case 'offline':
-        return 'bg-red-500';
-      default:
-        return 'bg-gray-500';
-    }
-  };
-
-  const formatUptime = (seconds: number) => {
-    if (!seconds || seconds <= 0) {
-      return 'Unknown';
-    }
-
-    const days = Math.floor(seconds / 86400);
-    const hours = Math.floor((seconds % 86400) / 3600);
-    const minutes = Math.floor((seconds % 3600) / 60);
-
-    if (days > 0) {
-      return `${days}d ${hours}h`;
-    }
-    if (hours > 0) {
-      return `${hours}h ${minutes}m`;
-    }
-    if (minutes > 0) {
-      return `${minutes}m`;
-    }
-    return `${Math.floor(seconds)}s`;
-  };
 
   const normalizeHostKey = (value?: string | null) => {
     if (!value) {
@@ -1039,15 +951,7 @@ const Settings: Component<SettingsProps> = (props) => {
     return { httpMap, socketStatus, socketCooldowns: cooldowns };
   });
 
-  const proxyNodeChecksSupported = createMemo(() => {
-    const caps = diagnosticsData()?.temperatureProxy?.proxyCapabilities;
-    if (!caps || caps.length === 0) {
-      return true;
-    }
-    return caps.some(
-      (cap) => typeof cap === 'string' && cap.trim().toLowerCase() === 'admin',
-    );
-  });
+
 
   const runDiagnostics = async () => {
     setRunningDiagnostics(true);
@@ -1093,7 +997,7 @@ const Settings: Component<SettingsProps> = (props) => {
     if (typeof window === 'undefined') {
       return;
     }
-    const shouldPoll = currentTab() === 'proxmox' || currentTab() === 'diagnostics';
+    const shouldPoll = currentTab() === 'proxmox';
     if (!shouldPoll) {
       return;
     }
@@ -1108,119 +1012,6 @@ const Settings: Component<SettingsProps> = (props) => {
     });
   });
 
-  const handleRegisterProxyNodes = async () => {
-    if (proxyActionLoading()) return;
-    setProxyActionLoading('register-nodes');
-    try {
-      const response = await apiFetch('/api/diagnostics/temperature-proxy/register-nodes', {
-        method: 'POST',
-      });
-      const data = await response.json().catch(() => null);
-      if (!response.ok || !data || data.success !== true) {
-        const message =
-          (data && typeof data.error === 'string' && data.error) ||
-          (data && typeof data.message === 'string' && data.message) ||
-          'Failed to query proxy nodes';
-        if (response.status === 403) {
-          showWarning(message);
-        } else {
-          showError(message);
-        }
-        return;
-      }
-
-      const nodes = Array.isArray(data.nodes)
-        ? (data.nodes as Array<Record<string, unknown>>).map((node) => ({
-          name: typeof node.name === 'string' ? node.name : 'unknown',
-          sshReady: Boolean(node.ssh_ready),
-          error: typeof node.error === 'string' ? node.error : undefined,
-        }))
-        : [];
-
-      setProxyRegisterSummary(nodes);
-      showSuccess('Queried proxy node registration state');
-      await runDiagnostics();
-    } catch (err) {
-      logger.error('Failed to query proxy node registration state', err);
-      showError('Failed to query proxy nodes');
-    } finally {
-      setProxyActionLoading(null);
-    }
-  };
-
-  const handleDockerPrepareToken = async (hostId: string) => {
-    if (dockerActionLoading()) return;
-    setDockerActionLoading(hostId);
-    try {
-      const response = await apiFetch('/api/diagnostics/docker/prepare-token', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ hostId }),
-      });
-      const data = await response.json().catch(() => null);
-      if (!response.ok || !data || data.success !== true) {
-        const message =
-          data && typeof data.message === 'string'
-            ? data.message
-            : 'Failed to prepare Docker token';
-        showError(message);
-        return;
-      }
-
-      const recordPayload = data.record as APITokenRecord | undefined;
-      if (!recordPayload || typeof recordPayload.id !== 'string') {
-        showError('Server did not return a valid token record');
-        return;
-      }
-      const tokenRecord: APITokenRecord = {
-        id: recordPayload.id,
-        name: recordPayload.name,
-        prefix: recordPayload.prefix,
-        suffix: recordPayload.suffix,
-        createdAt: recordPayload.createdAt,
-        lastUsedAt: recordPayload.lastUsedAt,
-      };
-
-      const migrationResult: DockerMigrationResult = {
-        token: data.token as string,
-        installCommand: data.installCommand as string,
-        systemdServiceSnippet: data.systemdServiceSnippet as string,
-        pulseURL: data.pulseURL as string,
-        record: tokenRecord,
-      };
-
-      setDockerMigrationResults((prev) => ({
-        ...prev,
-        [hostId]: migrationResult,
-      }));
-
-      showTokenReveal({
-        token: migrationResult.token,
-        record: tokenRecord,
-        source: 'docker',
-        note: 'Copy this token into the install command shown in Diagnostics.',
-      });
-
-      const hostName = data.host && typeof data.host.name === 'string' ? data.host.name : hostId;
-      showSuccess(`Generated dedicated token for ${hostName}`);
-      await runDiagnostics();
-    } catch (err) {
-      logger.error('Failed to prepare Docker token', err);
-      showError('Failed to prepare Docker token');
-    } finally {
-      setDockerActionLoading(null);
-    }
-  };
-
-  const handleCopy = async (text: string, successMessage: string) => {
-    const success = await copyToClipboard(text);
-    if (success) {
-      showSuccess(successMessage);
-    } else {
-      showError('Failed to copy to clipboard');
-    }
-  };
-
   const tabGroups: {
     id: 'platforms' | 'operations' | 'system' | 'security';
     label: string;
@@ -1281,6 +1072,12 @@ const Settings: Component<SettingsProps> = (props) => {
             icon: Clock,
             iconProps: { strokeWidth: 2 },
           },
+          {
+            id: 'system-ai',
+            label: 'AI Assistant',
+            icon: Sparkles,
+            iconProps: { strokeWidth: 2 },
+          },
         ],
       },
       {
@@ -2040,7 +1837,23 @@ const Settings: Component<SettingsProps> = (props) => {
         const version = await UpdatesAPI.getVersion();
         setVersionInfo(version);
         // Also set it in the store so it's available globally
-        updateStore.checkForUpdates(); // This will load version info too
+        await updateStore.checkForUpdates(); // This will load version info too
+
+        // Fetch update info and plan from store
+        const storeInfo = updateStore.updateInfo();
+        if (storeInfo) {
+          setUpdateInfo(storeInfo);
+          // Fetch update plan if update is available
+          if (storeInfo.available && storeInfo.latestVersion) {
+            try {
+              const plan = await UpdatesAPI.getUpdatePlan(storeInfo.latestVersion);
+              setUpdatePlan(plan);
+            } catch (planError) {
+              logger.warn('Failed to fetch update plan on load', planError);
+            }
+          }
+        }
+
         // Only use version.channel as fallback if user hasn't configured a preference
         // The user's saved updateChannel preference should take priority
         // Check the signal value since systemSettings is scoped to the previous try block
@@ -2236,6 +2049,19 @@ const Settings: Component<SettingsProps> = (props) => {
       const info = updateStore.updateInfo();
       setUpdateInfo(info);
 
+      // Fetch update plan if update is available
+      if (info?.available && info.latestVersion) {
+        try {
+          const plan = await UpdatesAPI.getUpdatePlan(info.latestVersion);
+          setUpdatePlan(plan);
+        } catch (planError) {
+          logger.warn('Failed to fetch update plan', planError);
+          setUpdatePlan(null);
+        }
+      } else {
+        setUpdatePlan(null);
+      }
+
       // If update was dismissed, clear it so user can see it again
       if (info?.available && updateStore.isDismissed()) {
         updateStore.clearDismissed();
@@ -2252,6 +2078,28 @@ const Settings: Component<SettingsProps> = (props) => {
     }
   };
 
+  // Handle install update from settings panel
+  const handleInstallUpdate = () => {
+    setShowUpdateConfirmation(true);
+  };
+
+  const handleConfirmUpdate = async () => {
+    const info = updateInfo();
+    if (!info?.downloadUrl) return;
+
+    setIsInstallingUpdate(true);
+    try {
+      await UpdatesAPI.applyUpdate(info.downloadUrl);
+      // Close confirmation - GlobalUpdateProgressWatcher will auto-open the progress modal
+      setShowUpdateConfirmation(false);
+    } catch (error) {
+      logger.error('Failed to start update', error);
+      showError('Failed to start update. Please try again.');
+    } finally {
+      setIsInstallingUpdate(false);
+    }
+  };
+
   const handleExport = async () => {
     if (!exportPassphrase()) {
       const hasAuth = securityStatus()?.hasAuthentication;
@@ -2696,6 +2544,40 @@ const Settings: Component<SettingsProps> = (props) => {
                   class="mb-6"
                 />
               </Show>
+
+              {/* Recommendation banner for Proxmox tab */}
+              <Show when={activeTab() === 'proxmox'}>
+                <div class="rounded-lg border border-blue-200 bg-blue-50 px-4 py-3 mb-6 dark:border-blue-800 dark:bg-blue-900/20">
+                  <div class="flex items-start gap-3">
+                    <svg
+                      class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0"
+                      fill="none"
+                      viewBox="0 0 24 24"
+                      stroke="currentColor"
+                    >
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                      />
+                    </svg>
+                    <div class="flex-1">
+                      <p class="text-sm text-blue-800 dark:text-blue-200">
+                        <strong>Recommended:</strong> Install the Pulse agent on your Proxmox nodes for automatic setup, temperature monitoring, and AI features.
+                      </p>
+                      <button
+                        type="button"
+                        onClick={() => navigate('/settings/agents')}
+                        class="mt-2 text-sm font-medium text-blue-700 hover:text-blue-800 dark:text-blue-300 dark:hover:text-blue-200 underline"
+                      >
+                        Go to Agents tab →
+                      </button>
+                    </div>
+                  </div>
+                </div>
+              </Show>
+
               {/* PVE Nodes Tab */}
               <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pve'}>
                 <div class="space-y-6 mt-6">
@@ -2811,6 +2693,7 @@ const Settings: Component<SettingsProps> = (props) => {
                             <PveNodesTable
                               nodes={pveNodes()}
                               stateNodes={state.nodes ?? []}
+                              stateHosts={state.hosts ?? []}
                               globalTemperatureMonitoringEnabled={temperatureMonitoringEnabled()}
                               temperatureTransports={temperatureTransportInfo()}
                               onTestConnection={testNodeConnection}
@@ -3571,1749 +3454,147 @@ const Settings: Component<SettingsProps> = (props) => {
 
               {/* System General Tab */}
               <Show when={activeTab() === 'system-general'}>
-                <div class="space-y-6">
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <Sliders
-                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
-                            strokeWidth={2}
-                          />
-                        </div>
-                        <SectionHeader
-                          title="General"
-                          description="Appearance and display preferences"
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-5">
-                      <div class="flex items-center justify-between gap-3">
-                        <div class="text-sm text-gray-600 dark:text-gray-400">
-                          <p class="font-medium text-gray-900 dark:text-gray-100">Dark mode</p>
-                          <p class="text-xs text-gray-500 dark:text-gray-400">
-                            Toggle to match your environment. Pulse remembers this preference on
-                            each browser.
-                          </p>
-                        </div>
-                        <Toggle
-                          checked={props.darkMode()}
-                          onChange={(event) => {
-                            const desired = (event.currentTarget as HTMLInputElement).checked;
-                            if (desired !== props.darkMode()) {
-                              props.toggleDarkMode();
-                            }
-                          }}
-                        />
-                      </div>
-                    </div>
-                  </Card>
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <Activity class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                        </div>
-                        <SectionHeader
-                          title="Monitoring cadence"
-                          description="Control how frequently Pulse polls Proxmox VE nodes."
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-5">
-                      <div class="space-y-2">
-                        <p class="text-sm text-gray-600 dark:text-gray-400">
-                          Shorter intervals provide near-real-time updates at the cost of higher API
-                          and CPU usage on each node. Set a longer interval to reduce load on busy
-                          clusters.
-                        </p>
-                        <p class="text-xs text-gray-500 dark:text-gray-400">
-                          Current cadence: {pvePollingInterval()} seconds (
-                          {pvePollingInterval() >= 60
-                            ? `${(pvePollingInterval() / 60).toFixed(
-                              pvePollingInterval() % 60 === 0 ? 0 : 1,
-                            )} minute${pvePollingInterval() / 60 === 1 ? '' : 's'}`
-                            : 'under a minute'}
-                          ).
-                        </p>
-                      </div>
-                      <div class="space-y-4">
-                        <div class="grid gap-2 sm:grid-cols-3">
-                          <For each={PVE_POLLING_PRESETS}>
-                            {(option) => (
-                              <button
-                                type="button"
-                                class={`rounded-lg border px-3 py-2 text-left text-sm transition-colors ${pvePollingSelection() === option.value
-                                  ? 'border-blue-500 bg-blue-50 text-blue-700 dark:border-blue-400 dark:bg-blue-900/30 dark:text-blue-100'
-                                  : 'border-gray-200 bg-white text-gray-700 hover:border-blue-400 hover:text-blue-600 dark:border-gray-600 dark:bg-gray-900/50 dark:text-gray-200'
-                                  } ${pvePollingEnvLocked() ? 'opacity-60 cursor-not-allowed' : ''}`}
-                                disabled={pvePollingEnvLocked()}
-                                onClick={() => {
-                                  if (pvePollingEnvLocked()) return;
-                                  setPVEPollingSelection(option.value);
-                                  setPVEPollingInterval(option.value);
-                                  setHasUnsavedChanges(true);
-                                }}
-                              >
-                                {option.label}
-                              </button>
-                            )}
-                          </For>
-                          <button
-                            type="button"
-                            class={`rounded-lg border px-3 py-2 text-left text-sm transition-colors ${pvePollingSelection() === 'custom'
-                              ? 'border-blue-500 bg-blue-50 text-blue-700 dark:border-blue-400 dark:bg-blue-900/30 dark:text-blue-100'
-                              : 'border-gray-200 bg-white text-gray-700 hover:border-blue-400 hover:text-blue-600 dark:border-gray-600 dark:bg-gray-900/50 dark:text-gray-200'
-                              } ${pvePollingEnvLocked() ? 'opacity-60 cursor-not-allowed' : ''}`}
-                            disabled={pvePollingEnvLocked()}
-                            onClick={() => {
-                              if (pvePollingEnvLocked()) return;
-                              setPVEPollingSelection('custom');
-                              setPVEPollingInterval(pvePollingCustomSeconds());
-                              setHasUnsavedChanges(true);
-                            }}
-                          >
-                            Custom interval
-                          </button>
-                        </div>
-                        <Show when={pvePollingSelection() === 'custom'}>
-                          <div class="space-y-2 rounded-md border border-dashed border-gray-300 p-4 dark:border-gray-600">
-                            <label class="text-xs font-medium text-gray-700 dark:text-gray-200">
-                              Custom polling interval (10–3600 seconds)
-                            </label>
-                            <input
-                              type="number"
-                              min={PVE_POLLING_MIN_SECONDS}
-                              max={PVE_POLLING_MAX_SECONDS}
-                              value={pvePollingCustomSeconds()}
-                              class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-900/60"
-                              disabled={pvePollingEnvLocked()}
-                              onInput={(e) => {
-                                if (pvePollingEnvLocked()) return;
-                                const parsed = Math.floor(Number(e.currentTarget.value));
-                                if (Number.isNaN(parsed)) {
-                                  return;
-                                }
-                                const clamped = Math.min(
-                                  PVE_POLLING_MAX_SECONDS,
-                                  Math.max(PVE_POLLING_MIN_SECONDS, parsed),
-                                );
-                                setPVEPollingCustomSeconds(clamped);
-                                setPVEPollingInterval(clamped);
-                                setHasUnsavedChanges(true);
-                              }}
-                            />
-                            <p class="text-[0.68rem] text-gray-500 dark:text-gray-400">
-                              Applies to all PVE clusters and standalone nodes.
-                            </p>
-                          </div>
-                        </Show>
-                        <Show when={pvePollingEnvLocked()}>
-                          <div class="flex items-center gap-2 rounded-md border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-800 dark:border-amber-800 dark:bg-amber-900/30 dark:text-amber-200">
-                            <svg
-                              class="h-4 w-4 flex-shrink-0"
-                              viewBox="0 0 24 24"
-                              fill="none"
-                              stroke="currentColor"
-                              stroke-width="2"
-                            >
-                              <circle cx="12" cy="12" r="10" />
-                              <line x1="12" y1="8" x2="12" y2="12" />
-                              <circle cx="12" cy="16" r="0.5" />
-                            </svg>
-                            <span>Managed via environment variable PVE_POLLING_INTERVAL.</span>
-                          </div>
-                        </Show>
-                      </div>
-                    </div>
-                  </Card>
-                </div>
+                <GeneralSettingsPanel
+                  darkMode={props.darkMode}
+                  toggleDarkMode={props.toggleDarkMode}
+                  pvePollingInterval={pvePollingInterval}
+                  setPVEPollingInterval={setPVEPollingInterval}
+                  pvePollingSelection={pvePollingSelection}
+                  setPVEPollingSelection={setPVEPollingSelection}
+                  pvePollingCustomSeconds={pvePollingCustomSeconds}
+                  setPVEPollingCustomSeconds={setPVEPollingCustomSeconds}
+                  pvePollingEnvLocked={pvePollingEnvLocked}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                />
               </Show>
 
               {/* System Network Tab */}
               <Show when={activeTab() === 'system-network'}>
-                <div class="space-y-6">
-                  <Card
-                    tone="info"
-                    padding="md"
-                    border={false}
-                    class="border border-blue-200 dark:border-blue-800"
-                  >
-                    <div class="flex items-start gap-3">
-                      <svg
-                        class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0"
-                        fill="none"
-                        stroke="currentColor"
-                        viewBox="0 0 24 24"
-                      >
-                        <path
-                          stroke-linecap="round"
-                          stroke-linejoin="round"
-                          stroke-width="2"
-                          d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                        />
-                      </svg>
-                      <div class="text-sm text-blue-800 dark:text-blue-200">
-                        <p class="font-medium mb-1">Configuration Priority</p>
-                        <ul class="space-y-1">
-                          <li>
-                            • Some env vars override settings (API_TOKENS, legacy API_TOKEN, PORTS,
-                            AUTH)
-                          </li>
-                          <li>• Changes made here are saved to system.json immediately</li>
-                          <li>• Settings persist unless overridden by env vars</li>
-                        </ul>
-                      </div>
-                    </div>
-                  </Card>
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <Network
-                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
-                            strokeWidth={2}
-                          />
-                        </div>
-                        <SectionHeader
-                          title="Network"
-                          description="Discovery, CORS, and embedding settings"
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-8">
-                      <section class="space-y-5">
-                        <SectionHeader
-                          title="Network discovery"
-                          description="Control how Pulse scans for Proxmox services on your network."
-                          size="sm"
-                          align="left"
-                        />
-                        <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-                          <div class="text-sm text-gray-600 dark:text-gray-400">
-                            <p class="font-medium text-gray-900 dark:text-gray-100">
-                              Automatic scanning
-                            </p>
-                            <p class="text-xs text-gray-500 dark:text-gray-400">
-                              Enable discovery to surface Proxmox VE, PBS, and PMG endpoints
-                              automatically.
-                            </p>
-                          </div>
-                          <Toggle
-                            checked={discoveryEnabled()}
-                            onChange={async (e: ToggleChangeEvent) => {
-                              if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
-                                e.preventDefault();
-                                return;
-                              }
-                              const success = await handleDiscoveryEnabledChange(
-                                e.currentTarget.checked,
-                              );
-                              if (!success) {
-                                e.currentTarget.checked = discoveryEnabled();
-                              }
-                            }}
-                            disabled={envOverrides().discoveryEnabled || savingDiscoverySettings()}
-                            containerClass="gap-2"
-                            label={
-                              <span class="text-xs font-medium text-gray-600 dark:text-gray-400">
-                                {discoveryEnabled() ? 'On' : 'Off'}
-                              </span>
-                            }
-                          />
-                        </div>
-
-                        <Show when={discoveryEnabled()}>
-                          <div class="space-y-4 rounded-lg border border-gray-200 bg-white/40 p-3 dark:border-gray-600 dark:bg-gray-800/40">
-                            <fieldset class="space-y-2">
-                              <legend class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                                Scan scope
-                              </legend>
-                              <div class="space-y-2">
-                                <label
-                                  class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${discoveryMode() === 'auto'
-                                    ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
-                                    : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
-                                    }`}
-                                >
-                                  <input
-                                    type="radio"
-                                    name="discoveryMode"
-                                    value="auto"
-                                    checked={discoveryMode() === 'auto'}
-                                    onChange={async () => {
-                                      if (discoveryMode() !== 'auto') {
-                                        await handleDiscoveryModeChange('auto');
-                                      }
-                                    }}
-                                    disabled={
-                                      envOverrides().discoverySubnet || savingDiscoverySettings()
-                                    }
-                                    class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
-                                  />
-                                  <div class="space-y-1">
-                                    <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                      Auto (slower, full scan)
-                                    </p>
-                                    <p class="text-xs text-gray-500 dark:text-gray-400">
-                                      Scans container, local, and gateway networks. Large networks
-                                      may time out after two minutes.
-                                    </p>
-                                  </div>
-                                </label>
-
-                                <label
-                                  class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${discoveryMode() === 'custom'
-                                    ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
-                                    : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
-                                    }`}
-                                >
-                                  <input
-                                    type="radio"
-                                    name="discoveryMode"
-                                    value="custom"
-                                    checked={discoveryMode() === 'custom'}
-                                    onChange={() => {
-                                      if (discoveryMode() !== 'custom') {
-                                        handleDiscoveryModeChange('custom');
-                                      }
-                                    }}
-                                    disabled={
-                                      envOverrides().discoverySubnet || savingDiscoverySettings()
-                                    }
-                                    class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
-                                  />
-                                  <div class="space-y-1">
-                                    <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                      Custom subnet (faster)
-                                    </p>
-                                    <p class="text-xs text-gray-500 dark:text-gray-400">
-                                      Limit discovery to one or more CIDR ranges to finish faster on
-                                      large networks.
-                                    </p>
-                                  </div>
-                                </label>
-                                <Show when={discoveryMode() === 'custom'}>
-                                  <div class="flex flex-wrap items-center gap-2 pl-9 pr-2">
-                                    <span class="text-[0.68rem] uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                      Common networks:
-                                    </span>
-                                    <For each={COMMON_DISCOVERY_SUBNETS}>
-                                      {(preset) => {
-                                        const baseValue = currentDraftSubnetValue();
-                                        const currentSelections = parseSubnetList(baseValue);
-                                        const isActive = currentSelections.includes(preset);
-                                        return (
-                                          <button
-                                            type="button"
-                                            class={`rounded border px-2.5 py-1 text-[0.7rem] transition-colors ${isActive
-                                              ? 'border-blue-500 bg-blue-600 text-white dark:border-blue-400 dark:bg-blue-500'
-                                              : 'border-gray-300 text-gray-700 hover:border-blue-400 hover:bg-blue-50 dark:border-gray-600 dark:text-gray-300 dark:hover:border-blue-500 dark:hover:bg-blue-900/30'
-                                              }`}
-                                            onClick={async () => {
-                                              if (envOverrides().discoverySubnet) {
-                                                return;
-                                              }
-                                              let selections = [...currentSelections];
-                                              if (isActive) {
-                                                selections = selections.filter(
-                                                  (item) => item !== preset,
-                                                );
-                                              } else {
-                                                selections.push(preset);
-                                              }
-
-                                              if (selections.length === 0) {
-                                                setDiscoverySubnetDraft('');
-                                                setLastCustomSubnet('');
-                                                setDiscoverySubnetError(
-                                                  'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
-                                                );
-                                                return;
-                                              }
-
-                                              const updatedValue = normalizeSubnetList(
-                                                selections.join(', '),
-                                              );
-                                              setDiscoveryMode('custom');
-                                              setDiscoverySubnetDraft(updatedValue);
-                                              setLastCustomSubnet(updatedValue);
-                                              setDiscoverySubnetError(undefined);
-                                              await commitDiscoverySubnet(updatedValue);
-                                            }}
-                                            disabled={envOverrides().discoverySubnet}
-                                            classList={{
-                                              'cursor-not-allowed opacity-60':
-                                                envOverrides().discoverySubnet,
-                                            }}
-                                          >
-                                            {preset}
-                                          </button>
-                                        );
-                                      }}
-                                    </For>
-                                  </div>
-                                </Show>
-                              </div>
-                            </fieldset>
-
-                            <div class="space-y-2">
-                              <div class="flex items-center justify-between gap-2">
-                                <label
-                                  for="discoverySubnetInput"
-                                  class="text-xs font-medium text-gray-700 dark:text-gray-300"
-                                >
-                                  Discovery subnet
-                                </label>
-                                <span
-                                  class="text-gray-400 hover:text-gray-500 dark:text-gray-500 dark:hover:text-gray-300 cursor-help"
-                                  title="Use CIDR notation (comma-separated for multiple), e.g. 192.168.1.0/24, 10.0.0.0/24. Smaller ranges keep scans quick."
-                                >
-                                  <svg
-                                    class="h-4 w-4"
-                                    viewBox="0 0 24 24"
-                                    fill="none"
-                                    stroke="currentColor"
-                                    stroke-width="2"
-                                  >
-                                    <circle cx="12" cy="12" r="10"></circle>
-                                    <path d="M12 16v-4"></path>
-                                    <path d="M12 8h.01"></path>
-                                  </svg>
-                                </span>
-                              </div>
-                              <input
-                                id="discoverySubnetInput"
-                                ref={(el) => {
-                                  discoverySubnetInputRef = el;
-                                }}
-                                type="text"
-                                value={discoverySubnetDraft()}
-                                placeholder={
-                                  discoveryMode() === 'auto'
-                                    ? 'auto (scan every network phase)'
-                                    : '192.168.1.0/24, 10.0.0.0/24'
-                                }
-                                class={`w-full rounded-lg border px-3 py-2 text-sm transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 ${envOverrides().discoverySubnet
-                                  ? 'border-amber-300 bg-amber-50 text-amber-800 dark:border-amber-600 dark:bg-amber-900/20 dark:text-amber-200 cursor-not-allowed opacity-60'
-                                  : 'border-gray-300 bg-white dark:border-gray-600 dark:bg-gray-900/70'
-                                  }`}
-                                disabled={envOverrides().discoverySubnet}
-                                onInput={(e) => {
-                                  if (envOverrides().discoverySubnet) {
-                                    return;
-                                  }
-                                  const rawValue = e.currentTarget.value;
-                                  setDiscoverySubnetDraft(rawValue);
-                                  if (discoveryMode() !== 'custom') {
-                                    setDiscoveryMode('custom');
-                                  }
-                                  setLastCustomSubnet(rawValue);
-                                  const trimmed = rawValue.trim();
-                                  if (!trimmed) {
-                                    setDiscoverySubnetError(undefined);
-                                    return;
-                                  }
-                                  if (!isValidCIDR(trimmed)) {
-                                    setDiscoverySubnetError(
-                                      'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
-                                    );
-                                  } else {
-                                    setDiscoverySubnetError(undefined);
-                                  }
-                                }}
-                                onBlur={async (e) => {
-                                  if (
-                                    envOverrides().discoverySubnet ||
-                                    discoveryMode() !== 'custom'
-                                  ) {
-                                    return;
-                                  }
-                                  const rawValue = e.currentTarget.value;
-                                  setDiscoverySubnetDraft(rawValue);
-                                  const trimmed = rawValue.trim();
-                                  if (!trimmed) {
-                                    setDiscoverySubnetError(
-                                      'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
-                                    );
-                                    return;
-                                  }
-                                  if (!isValidCIDR(trimmed)) {
-                                    setDiscoverySubnetError(
-                                      'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
-                                    );
-                                    return;
-                                  }
-                                  setDiscoverySubnetError(undefined);
-                                  await commitDiscoverySubnet(rawValue);
-                                }}
-                                onKeyDown={(e) => {
-                                  if (e.key === 'Enter') {
-                                    e.preventDefault();
-                                    (e.currentTarget as HTMLInputElement).blur();
-                                  }
-                                }}
-                              />
-                              <Show when={discoverySubnetError()}>
-                                <p class="text-xs text-red-600 dark:text-red-400">
-                                  {discoverySubnetError()}
-                                </p>
-                              </Show>
-                              <Show when={!discoverySubnetError() && discoveryMode() === 'auto'}>
-                                <p class="text-xs text-gray-500 dark:text-gray-400">
-                                  Auto scans every reachable network phase. Large networks may time
-                                  out — switch to custom subnets to narrow the search.
-                                </p>
-                              </Show>
-                              <Show when={!discoverySubnetError() && discoveryMode() === 'custom'}>
-                                <p class="text-xs text-gray-500 dark:text-gray-400">
-                                  Example: 192.168.1.0/24, 10.0.0.0/24 (comma-separated). Smaller
-                                  ranges finish faster and avoid timeouts.
-                                </p>
-                              </Show>
-                            </div>
-                          </div>
-                        </Show>
-
-                        <Show
-                          when={envOverrides().discoveryEnabled || envOverrides().discoverySubnet}
-                        >
-                          <div class="rounded-lg border border-amber-200 bg-amber-100/80 p-3 text-xs text-amber-800 dark:border-amber-700 dark:bg-amber-900/20 dark:text-amber-200">
-                            Discovery settings are locked by environment variables. Update the
-                            service configuration and restart Pulse to change them here.
-                          </div>
-                        </Show>
-                      </section>
-
-                      <section class="space-y-3">
-                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                          <svg
-                            width="16"
-                            height="16"
-                            viewBox="0 0 24 24"
-                            fill="none"
-                            stroke="currentColor"
-                            stroke-width="2"
-                          >
-                            <circle cx="12" cy="12" r="10"></circle>
-                            <path d="M2 12h20M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10 15.3 15.3 0 01-4-10 15.3 15.3 0 014-10z"></path>
-                          </svg>
-                          Network Settings
-                        </h4>
-                        <div class="space-y-2">
-                          <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                            CORS Allowed Origins
-                          </label>
-                          <p class="text-xs text-gray-600 dark:text-gray-400">
-                            For reverse proxy setups (* = allow all, empty = same-origin only)
-                          </p>
-                          <div class="relative">
-                            <input
-                              type="text"
-                              value={allowedOrigins()}
-                              onChange={(e) => {
-                                if (!envOverrides().allowedOrigins) {
-                                  setAllowedOrigins(e.currentTarget.value);
-                                  setHasUnsavedChanges(true);
-                                }
-                              }}
-                              disabled={envOverrides().allowedOrigins}
-                              placeholder="* or https://example.com"
-                              class={`w-full px-3 py-1.5 text-sm border rounded-lg ${envOverrides().allowedOrigins
-                                ? 'border-amber-300 dark:border-amber-600 bg-amber-50 dark:bg-amber-900/20 cursor-not-allowed opacity-75'
-                                : 'border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800'
-                                }`}
-                            />
-                            {envOverrides().allowedOrigins && (
-                              <div class="mt-2 p-2 bg-amber-100 dark:bg-amber-900/30 border border-amber-300 dark:border-amber-700 rounded text-xs text-amber-800 dark:text-amber-200">
-                                <div class="flex items-center gap-1">
-                                  <svg
-                                    class="w-4 h-4"
-                                    fill="none"
-                                    stroke="currentColor"
-                                    viewBox="0 0 24 24"
-                                  >
-                                    <path
-                                      stroke-linecap="round"
-                                      stroke-linejoin="round"
-                                      stroke-width="2"
-                                      d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                                    />
-                                  </svg>
-                                  <span>Overridden by ALLOWED_ORIGINS environment variable</span>
-                                </div>
-                                <div class="mt-1 text-amber-700 dark:text-amber-300">
-                                  Remove the env var and restart to enable UI configuration
-                                </div>
-                              </div>
-                            )}
-                          </div>
-                        </div>
-                      </section>
-
-                      <section class="space-y-3">
-                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                          <svg
-                            width="16"
-                            height="16"
-                            viewBox="0 0 24 24"
-                            fill="none"
-                            stroke="currentColor"
-                            stroke-width="2"
-                          >
-                            <rect x="3" y="4" width="18" height="14" rx="2"></rect>
-                            <path d="M7 20h10"></path>
-                          </svg>
-                          Embedding
-                        </h4>
-                        <p class="text-xs text-gray-600 dark:text-gray-400">
-                          Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
-                        </p>
-                        <div class="space-y-3">
-                          <div class="flex items-center gap-2">
-                            <input
-                              type="checkbox"
-                              id="allowEmbedding"
-                              checked={allowEmbedding()}
-                              onChange={(e) => {
-                                setAllowEmbedding(e.currentTarget.checked);
-                                setHasUnsavedChanges(true);
-                              }}
-                              class="rounded border-gray-300 dark:border-gray-600 text-blue-600 focus:ring-blue-500"
-                            />
-                            <label
-                              for="allowEmbedding"
-                              class="text-sm text-gray-700 dark:text-gray-300"
-                            >
-                              Allow iframe embedding
-                            </label>
-                          </div>
-
-                          <Show when={allowEmbedding()}>
-                            <div class="space-y-2">
-                              <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                                Allowed Embed Origins (optional)
-                              </label>
-                              <p class="text-xs text-gray-600 dark:text-gray-400">
-                                Comma-separated list of origins that can embed Pulse (leave empty
-                                for same-origin only)
-                              </p>
-                              <input
-                                type="text"
-                                value={allowedEmbedOrigins()}
-                                onChange={(e) => {
-                                  setAllowedEmbedOrigins(e.currentTarget.value);
-                                  setHasUnsavedChanges(true);
-                                }}
-                                placeholder="https://my.domain, https://dashboard.example.com"
-                                class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
-                              />
-                              <p class="text-xs text-gray-500 dark:text-gray-400">
-                                Example: If Pulse is at <code>pulse.my.domain</code> and your
-                                dashboard is at <code>my.domain</code>, add{' '}
-                                <code>https://my.domain</code> here.
-                              </p>
-                            </div>
-                          </Show>
-                        </div>
-                      </section>
-
-                      {/* Webhook Security Settings */}
-                      <section class="space-y-3">
-                        <h3 class="text-sm font-semibold text-gray-900 dark:text-gray-100 flex items-center gap-2">
-                          <svg
-                            xmlns="http://www.w3.org/2000/svg"
-                            class="h-4 w-4"
-                            fill="none"
-                            viewBox="0 0 24 24"
-                            stroke="currentColor"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width={2}
-                              d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
-                            />
-                          </svg>
-                          Webhook Security
-                        </h3>
-                        <div class="space-y-3">
-                          <div>
-                            <label class="text-sm font-medium text-gray-700 dark:text-gray-300">
-                              Allowed Private IP Ranges for Webhooks
-                            </label>
-                            <p class="text-xs text-gray-500 dark:text-gray-400 mb-2">
-                              By default, webhooks to private IP addresses are blocked for
-                              security. Enter trusted CIDR ranges to allow webhooks to internal
-                              services (leave empty to block all private IPs).
-                            </p>
-                            <input
-                              type="text"
-                              value={webhookAllowedPrivateCIDRs()}
-                              onChange={(e) => {
-                                setWebhookAllowedPrivateCIDRs(e.currentTarget.value);
-                                setHasUnsavedChanges(true);
-                              }}
-                              placeholder="192.168.1.0/24, 10.0.0.0/8"
-                              class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
-                            />
-                            <p class="text-xs text-gray-500 dark:text-gray-400 mt-1">
-                              Example: <code>192.168.1.0/24,10.0.0.0/8</code> allows webhooks to
-                              these private networks. Localhost and cloud metadata services
-                              remain blocked.
-                            </p>
-                          </div>
-                        </div>
-                      </section>
-
-                      <Card
-                        tone="warning"
-                        padding="sm"
-                        border={false}
-                        class="border border-amber-200 dark:border-amber-800"
-                      >
-                        <p class="text-xs text-amber-800 dark:text-amber-200 mb-2">
-                          <strong>Port Configuration:</strong> Use{' '}
-                          <code class="font-mono bg-amber-100 dark:bg-amber-800 px-1 rounded">
-                            systemctl edit pulse
-                          </code>
-                        </p>
-                        <p class="text-xs text-amber-700 dark:text-amber-300 font-mono">
-                          [Service]
-                          <br />
-                          Environment="FRONTEND_PORT=8080"
-                          <br />
-                          <span class="text-xs text-amber-600 dark:text-amber-400">
-                            Then restart: sudo systemctl restart pulse
-                          </span>
-                        </p>
-                      </Card>
-                    </div>
-                  </Card>
-                </div>
+                <NetworkSettingsPanel
+                  discoveryEnabled={discoveryEnabled}
+                  discoveryMode={discoveryMode}
+                  discoverySubnetDraft={discoverySubnetDraft}
+                  discoverySubnetError={discoverySubnetError}
+                  savingDiscoverySettings={savingDiscoverySettings}
+                  envOverrides={envOverrides}
+                  allowedOrigins={allowedOrigins}
+                  setAllowedOrigins={setAllowedOrigins}
+                  allowEmbedding={allowEmbedding}
+                  setAllowEmbedding={setAllowEmbedding}
+                  allowedEmbedOrigins={allowedEmbedOrigins}
+                  setAllowedEmbedOrigins={setAllowedEmbedOrigins}
+                  webhookAllowedPrivateCIDRs={webhookAllowedPrivateCIDRs}
+                  setWebhookAllowedPrivateCIDRs={setWebhookAllowedPrivateCIDRs}
+                  handleDiscoveryEnabledChange={handleDiscoveryEnabledChange}
+                  handleDiscoveryModeChange={handleDiscoveryModeChange}
+                  setDiscoveryMode={setDiscoveryMode}
+                  setDiscoverySubnetDraft={setDiscoverySubnetDraft}
+                  setDiscoverySubnetError={setDiscoverySubnetError}
+                  setLastCustomSubnet={setLastCustomSubnet}
+                  commitDiscoverySubnet={commitDiscoverySubnet}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  parseSubnetList={parseSubnetList}
+                  normalizeSubnetList={normalizeSubnetList}
+                  isValidCIDR={isValidCIDR}
+                  currentDraftSubnetValue={currentDraftSubnetValue}
+                  discoverySubnetInputRef={(el) => {
+                    discoverySubnetInputRef = el;
+                  }}
+                />
               </Show>
 
               {/* System Updates Tab */}
               <Show when={activeTab() === 'system-updates'}>
-                <div class="space-y-6">
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <RefreshCw
-                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
-                            strokeWidth={2}
-                          />
-                        </div>
-                        <SectionHeader
-                          title="Updates"
-                          description="Version checking and automatic update configuration"
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-6">
-                      <section class="space-y-4">
-                        <div class="space-y-4">
-                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                            <div>
-                              <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Current Version
-                              </label>
-                              <p class="text-xs text-gray-600 dark:text-gray-400">
-                                {versionInfo()?.version || 'Loading...'}
-                                {versionInfo()?.isDevelopment && ' (Development)'}
-                                {versionInfo()?.isDocker && ' - Docker'}
-                              </p>
-                            </div>
-                            <button
-                              type="button"
-                              onClick={checkForUpdates}
-                              disabled={
-                                checkingForUpdates() ||
-                                versionInfo()?.isDocker ||
-                                versionInfo()?.isSourceBuild
-                              }
-                              class={`px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-2 ${versionInfo()?.isDocker || versionInfo()?.isSourceBuild
-                                ? 'bg-gray-100 dark:bg-gray-700 text-gray-400 dark:text-gray-500 cursor-not-allowed'
-                                : 'bg-blue-600 text-white hover:bg-blue-700'
-                                }`}
-                            >
-                              {checkingForUpdates() ? (
-                                <>
-                                  <div class="animate-spin h-4 w-4 border-2 border-white border-t-transparent rounded-full"></div>
-                                  Checking...
-                                </>
-                              ) : (
-                                <>Check for Updates</>
-                              )}
-                            </button>
-                          </div>
-
-                          <Show when={versionInfo()?.isDocker && !updateInfo()?.available}>
-                            <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
-                              <p class="text-xs text-blue-800 dark:text-blue-200">
-                                <strong>Docker Installation:</strong> Updates are managed through
-                                Docker. Pull the latest image to update.
-                              </p>
-                            </div>
-                          </Show>
-
-                          <Show when={versionInfo()?.isSourceBuild}>
-                            <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
-                              <p class="text-xs text-blue-800 dark:text-blue-200">
-                                <strong>Built from source:</strong> Pull the latest code from git
-                                and rebuild to update.
-                              </p>
-                            </div>
-                          </Show>
-
-                          <Show when={Boolean(updateInfo()?.warning)}>
-                            <div class="p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded-lg">
-                              <p class="text-xs text-amber-800 dark:text-amber-200">
-                                {updateInfo()?.warning}
-                              </p>
-                            </div>
-                          </Show>
-
-                          <Show when={updateInfo()?.available}>
-                            <div class="p-3 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded-lg space-y-3">
-                              <div>
-                                <p class="text-sm font-medium text-green-800 dark:text-green-200">
-                                  Update Available: {updateInfo()?.latestVersion}
-                                </p>
-                                <p class="text-xs text-green-700 dark:text-green-300 mt-1">
-                                  Released:{' '}
-                                  {updateInfo()?.releaseDate
-                                    ? new Date(updateInfo()!.releaseDate).toLocaleDateString()
-                                    : 'Unknown'}
-                                </p>
-                              </div>
-
-                              <div class="p-2 bg-green-100 dark:bg-green-900/40 rounded space-y-2">
-                                <p class="text-xs font-medium text-green-800 dark:text-green-200">
-                                  How to update:
-                                </p>
-                                <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
-                                  <p class="text-xs text-green-700 dark:text-green-300">
-                                    Type{' '}
-                                    <code class="px-1 py-0.5 bg-green-200 dark:bg-green-800 rounded">
-                                      update
-                                    </code>{' '}
-                                    in the LXC console
-                                  </p>
-                                </Show>
-                                <Show when={versionInfo()?.deploymentType === 'docker'}>
-                                  <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
-                                    <p>Run these commands:</p>
-                                    <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
-                                      docker pull rcourtman/pulse:latest
-                                      <br />
-                                      docker restart pulse
-                                    </code>
-                                  </div>
-                                </Show>
-                                <Show
-                                  when={
-                                    versionInfo()?.deploymentType === 'systemd' ||
-                                    versionInfo()?.deploymentType === 'manual'
-                                  }
-                                >
-                                  <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
-                                    <p>
-                                      Click the "Install Update" button below, or download and install manually:
-                                    </p>
-                                    <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
-                                      curl -LO https://github.com/rcourtman/Pulse/releases/download/{updateInfo()?.latestVersion}/pulse-{updateInfo()?.latestVersion}-linux-amd64.tar.gz
-                                      <br />
-                                      sudo systemctl stop pulse
-                                      <br />
-                                      sudo tar -xzf pulse-{updateInfo()?.latestVersion}-linux-amd64.tar.gz -C /usr/local/bin pulse
-                                      <br />
-                                      sudo systemctl start pulse
-                                    </code>
-                                  </div>
-                                </Show>
-                                <Show when={versionInfo()?.deploymentType === 'development'}>
-                                  <p class="text-xs text-green-700 dark:text-green-300">
-                                    Pull latest changes and rebuild
-                                  </p>
-                                </Show>
-                                <Show
-                                  when={!versionInfo()?.deploymentType && versionInfo()?.isDocker}
-                                >
-                                  <p class="text-xs text-green-700 dark:text-green-300">
-                                    Pull the latest Pulse Docker image and recreate your container.
-                                  </p>
-                                </Show>
-                              </div>
-
-                              <Show when={updateInfo()?.releaseNotes}>
-                                <details class="mt-1">
-                                  <summary class="text-xs text-green-700 dark:text-green-300 cursor-pointer">
-                                    Release Notes
-                                  </summary>
-                                  <pre class="mt-2 text-xs text-green-600 dark:text-green-400 whitespace-pre-wrap font-mono bg-green-100 dark:bg-green-900/30 p-2 rounded">
-                                    {updateInfo()?.releaseNotes}
-                                  </pre>
-                                </details>
-                              </Show>
-                            </div>
-                          </Show>
-
-                          <div class="border-t border-gray-200 dark:border-gray-600 pt-4 space-y-4">
-                            <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                              <div>
-                                <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                  Update Channel
-                                </label>
-                                <p class="text-xs text-gray-600 dark:text-gray-400">
-                                  Choose between stable and release candidate versions
-                                </p>
-                              </div>
-                              <select
-                                value={updateChannel()}
-                                onChange={(e) => {
-                                  setUpdateChannel(e.currentTarget.value as 'stable' | 'rc');
-                                  setHasUnsavedChanges(true);
-                                }}
-                                disabled={versionInfo()?.isDocker}
-                                class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
-                              >
-                                <option value="stable">Stable</option>
-                                <option value="rc">Release Candidate</option>
-                              </select>
-                            </div>
-
-                            <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                              <div>
-                                <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                  Update Checks
-                                </label>
-                                <p class="text-xs text-gray-600 dark:text-gray-400">
-                                  Automatically check for updates (installation is manual)
-                                </p>
-                              </div>
-                              <label class="relative inline-flex items-center cursor-pointer">
-                                <input
-                                  type="checkbox"
-                                  checked={autoUpdateEnabled()}
-                                  onChange={(e) => {
-                                    setAutoUpdateEnabled(e.currentTarget.checked);
-                                    setHasUnsavedChanges(true);
-                                  }}
-                                  disabled={versionInfo()?.isDocker}
-                                  class="sr-only peer"
-                                />
-                                <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
-                              </label>
-                            </div>
-
-                            <Show when={autoUpdateEnabled()}>
-                              <div class="space-y-4 rounded-md border border-gray-200 dark:border-gray-600 p-3">
-                                <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                                  <div>
-                                    <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                      Check Interval
-                                    </label>
-                                    <p class="text-xs text-gray-600 dark:text-gray-400">
-                                      How often to check for updates
-                                    </p>
-                                  </div>
-                                  <select
-                                    value={autoUpdateCheckInterval()}
-                                    onChange={(e) => {
-                                      setAutoUpdateCheckInterval(parseInt(e.currentTarget.value));
-                                      setHasUnsavedChanges(true);
-                                    }}
-                                    class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
-                                  >
-                                    <option value="6">Every 6 hours</option>
-                                    <option value="12">Every 12 hours</option>
-                                    <option value="24">Daily</option>
-                                    <option value="168">Weekly</option>
-                                  </select>
-                                </div>
-
-                                <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                                  <div>
-                                    <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                      Check Time
-                                    </label>
-                                    <p class="text-xs text-gray-600 dark:text-gray-400">
-                                      Preferred time to check for updates
-                                    </p>
-                                  </div>
-                                  <input
-                                    type="time"
-                                    value={autoUpdateTime()}
-                                    onChange={(e) => {
-                                      setAutoUpdateTime(e.currentTarget.value);
-                                      setHasUnsavedChanges(true);
-                                    }}
-                                    class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
-                                  />
-                                </div>
-                              </div>
-                            </Show>
-                          </div>
-                        </div>
-                      </section>
-                    </div>
-                  </Card>
-                </div>
+                <UpdatesSettingsPanel
+                  versionInfo={versionInfo}
+                  updateInfo={updateInfo}
+                  checkingForUpdates={checkingForUpdates}
+                  updateChannel={updateChannel}
+                  setUpdateChannel={setUpdateChannel}
+                  autoUpdateEnabled={autoUpdateEnabled}
+                  setAutoUpdateEnabled={setAutoUpdateEnabled}
+                  autoUpdateCheckInterval={autoUpdateCheckInterval}
+                  setAutoUpdateCheckInterval={setAutoUpdateCheckInterval}
+                  autoUpdateTime={autoUpdateTime}
+                  setAutoUpdateTime={setAutoUpdateTime}
+                  checkForUpdates={checkForUpdates}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  updatePlan={updatePlan}
+                  onInstallUpdate={handleInstallUpdate}
+                  isInstalling={isInstallingUpdate}
+                />
               </Show>
 
               {/* System Backups Tab */}
               <Show when={activeTab() === 'system-backups'}>
+                <BackupsSettingsPanel
+                  backupPollingEnabled={backupPollingEnabled}
+                  setBackupPollingEnabled={setBackupPollingEnabled}
+                  backupPollingInterval={backupPollingInterval}
+                  setBackupPollingInterval={setBackupPollingInterval}
+                  backupPollingCustomMinutes={backupPollingCustomMinutes}
+                  setBackupPollingCustomMinutes={setBackupPollingCustomMinutes}
+                  backupPollingUseCustom={backupPollingUseCustom}
+                  setBackupPollingUseCustom={setBackupPollingUseCustom}
+                  backupPollingEnvLocked={backupPollingEnvLocked}
+                  backupIntervalSelectValue={backupIntervalSelectValue}
+                  backupIntervalSummary={backupIntervalSummary}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  showExportDialog={showExportDialog}
+                  setShowExportDialog={setShowExportDialog}
+                  showImportDialog={showImportDialog}
+                  setShowImportDialog={setShowImportDialog}
+                  setUseCustomPassphrase={setUseCustomPassphrase}
+                  securityStatus={securityStatus}
+                />
+              </Show>
+
+              {/* AI Assistant Tab */}
+              <Show when={activeTab() === 'system-ai'}>
                 <div class="space-y-6">
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <Clock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                        </div>
-                        <SectionHeader
-                          title="Backups"
-                          description="Backup polling and configuration management"
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-8">
-                      <section class="space-y-3">
-                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                          <svg
-                            width="16"
-                            height="16"
-                            viewBox="0 0 24 24"
-                            fill="none"
-                            stroke="currentColor"
-                          >
-                            <circle cx="12" cy="12" r="9" stroke-width="2" />
-                            <path
-                              d="M12 7v5l3 3"
-                              stroke-width="2"
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                            />
-                          </svg>
-                          Backup polling
-                        </h4>
-                        <p class="text-xs text-gray-600 dark:text-gray-400">
-                          Control how often Pulse queries Proxmox backup tasks, datastore contents,
-                          and guest snapshots. Longer intervals reduce disk activity and API load.
-                        </p>
-                        <div class="space-y-3">
-                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                            <div>
-                              <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Enable backup polling
-                              </p>
-                              <p class="text-xs text-gray-600 dark:text-gray-400">
-                                Required for dashboard backup status, storage snapshots, and
-                                alerting.
-                              </p>
-                            </div>
-                            <label class="relative inline-flex items-center cursor-pointer">
-                              <input
-                                type="checkbox"
-                                class="sr-only peer"
-                                checked={backupPollingEnabled()}
-                                disabled={backupPollingEnvLocked()}
-                                onChange={(e) => {
-                                  setBackupPollingEnabled(e.currentTarget.checked);
-                                  if (!backupPollingEnvLocked()) {
-                                    setHasUnsavedChanges(true);
-                                  }
-                                }}
-                              />
-                              <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
-                            </label>
-                          </div>
-
-                          <Show when={backupPollingEnabled()}>
-                            <div class="space-y-3 rounded-md border border-gray-200 dark:border-gray-600 p-3">
-                              <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                                <div>
-                                  <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                    Polling interval
-                                  </label>
-                                  <p class="text-xs text-gray-600 dark:text-gray-400">
-                                    {backupIntervalSummary()}
-                                  </p>
-                                </div>
-                                <select
-                                  value={backupIntervalSelectValue()}
-                                  disabled={backupPollingEnvLocked()}
-                                  onChange={(e) => {
-                                    const value = e.currentTarget.value;
-                                    if (value === 'custom') {
-                                      setBackupPollingUseCustom(true);
-                                      const minutes = Math.max(1, backupPollingCustomMinutes());
-                                      setBackupPollingInterval(minutes * 60);
-                                    } else {
-                                      setBackupPollingUseCustom(false);
-                                      const seconds = parseInt(value, 10);
-                                      if (!Number.isNaN(seconds)) {
-                                        setBackupPollingInterval(seconds);
-                                        if (seconds > 0) {
-                                          setBackupPollingCustomMinutes(
-                                            Math.max(1, Math.round(seconds / 60)),
-                                          );
-                                        }
-                                      }
-                                    }
-                                    if (!backupPollingEnvLocked()) {
-                                      setHasUnsavedChanges(true);
-                                    }
-                                  }}
-                                  class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
-                                >
-                                  <For each={BACKUP_INTERVAL_OPTIONS}>
-                                    {(option) => (
-                                      <option value={String(option.value)}>{option.label}</option>
-                                    )}
-                                  </For>
-                                  <option value="custom">Custom interval…</option>
-                                </select>
-                              </div>
-
-                              <Show when={backupIntervalSelectValue() === 'custom'}>
-                                <div class="space-y-2">
-                                  <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                                    Custom interval (minutes)
-                                  </label>
-                                  <div class="flex items-center gap-3">
-                                    <input
-                                      type="number"
-                                      min="1"
-                                      max={BACKUP_INTERVAL_MAX_MINUTES}
-                                      value={backupPollingCustomMinutes()}
-                                      disabled={backupPollingEnvLocked()}
-                                      onInput={(e) => {
-                                        const value = Number(e.currentTarget.value);
-                                        if (Number.isNaN(value)) {
-                                          return;
-                                        }
-                                        const clamped = Math.max(
-                                          1,
-                                          Math.min(BACKUP_INTERVAL_MAX_MINUTES, Math.floor(value)),
-                                        );
-                                        setBackupPollingCustomMinutes(clamped);
-                                        setBackupPollingInterval(clamped * 60);
-                                        if (!backupPollingEnvLocked()) {
-                                          setHasUnsavedChanges(true);
-                                        }
-                                      }}
-                                      class="w-24 px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
-                                    />
-                                    <span class="text-xs text-gray-500 dark:text-gray-400">
-                                      1 – {BACKUP_INTERVAL_MAX_MINUTES} minutes (≈7 days max)
-                                    </span>
-                                  </div>
-                                </div>
-                              </Show>
-                            </div>
-                          </Show>
-
-                          <Show when={backupPollingEnvLocked()}>
-                            <div class="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 dark:border-amber-700 dark:bg-amber-900/20 p-3 text-xs text-amber-700 dark:text-amber-200">
-                              <svg
-                                class="w-4 h-4 flex-shrink-0 mt-0.5"
-                                fill="none"
-                                stroke="currentColor"
-                                viewBox="0 0 24 24"
-                              >
-                                <path
-                                  stroke-linecap="round"
-                                  stroke-linejoin="round"
-                                  stroke-width="2"
-                                  d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                                />
-                              </svg>
-                              <div>
-                                <p class="font-medium">Environment override detected</p>
-                                <p class="mt-1">
-                                  The <code class="font-mono">ENABLE_BACKUP_POLLING</code> or{' '}
-                                  <code class="font-mono">BACKUP_POLLING_INTERVAL</code> environment
-                                  variables are set. Remove them and restart Pulse to manage backup
-                                  polling here.
-                                </p>
-                              </div>
-                            </div>
-                          </Show>
-                        </div>
-                      </section>
-
-                      <SectionHeader
-                        title="Backup & restore"
-                        description="Backup your node configurations and credentials or restore from a previous backup."
-                        size="md"
-                        class="mb-4"
-                      />
-
-                      <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
-                        {/* Export Section */}
-                        <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
-                          <div class="flex items-start gap-3">
-                            <div class="flex-shrink-0 w-10 h-10 bg-blue-100 dark:bg-blue-900/30 rounded-lg flex items-center justify-center">
-                              <svg
-                                class="w-5 h-5 text-blue-600 dark:text-blue-400"
-                                fill="none"
-                                stroke="currentColor"
-                                viewBox="0 0 24 24"
-                              >
-                                <path
-                                  stroke-linecap="round"
-                                  stroke-linejoin="round"
-                                  stroke-width="2"
-                                  d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M9 19l3 3m0 0l3-3m-3 3V10"
-                                />
-                              </svg>
-                            </div>
-                            <div class="flex-1">
-                              <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
-                                Export Configuration
-                              </h4>
-                              <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
-                                Download an encrypted backup of all nodes and settings
-                              </p>
-                              <button
-                                type="button"
-                                onClick={() => {
-                                  // Default to custom passphrase if no auth is configured
-                                  setUseCustomPassphrase(!securityStatus()?.hasAuthentication);
-                                  setShowExportDialog(true);
-                                }}
-                                class="px-3 py-1.5 bg-blue-600 text-white text-sm rounded-md hover:bg-blue-700 transition-colors inline-flex items-center gap-2"
-                              >
-                                <svg
-                                  class="w-4 h-4"
-                                  fill="none"
-                                  stroke="currentColor"
-                                  viewBox="0 0 24 24"
-                                >
-                                  <path
-                                    stroke-linecap="round"
-                                    stroke-linejoin="round"
-                                    stroke-width="2"
-                                    d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
-                                  />
-                                </svg>
-                                Export Backup
-                              </button>
-                            </div>
-                          </div>
-                        </div>
-
-                        {/* Import Section */}
-                        <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
-                          <div class="flex items-start gap-3">
-                            <div class="flex-shrink-0 w-10 h-10 bg-gray-100 dark:bg-gray-700 rounded-lg flex items-center justify-center">
-                              <svg
-                                class="w-5 h-5 text-gray-600 dark:text-gray-400"
-                                fill="none"
-                                stroke="currentColor"
-                                viewBox="0 0 24 24"
-                              >
-                                <path
-                                  stroke-linecap="round"
-                                  stroke-linejoin="round"
-                                  stroke-width="2"
-                                  d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"
-                                />
-                              </svg>
-                            </div>
-                            <div class="flex-1">
-                              <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
-                                Restore Configuration
-                              </h4>
-                              <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
-                                Upload a backup file to restore nodes and settings
-                              </p>
-                              <button
-                                type="button"
-                                onClick={() => setShowImportDialog(true)}
-                                class="px-3 py-1.5 bg-gray-600 text-white text-sm rounded-md hover:bg-gray-700 transition-colors inline-flex items-center gap-2"
-                              >
-                                <svg
-                                  class="w-4 h-4"
-                                  fill="none"
-                                  stroke="currentColor"
-                                  viewBox="0 0 24 24"
-                                >
-                                  <path
-                                    stroke-linecap="round"
-                                    stroke-linejoin="round"
-                                    stroke-width="2"
-                                    d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"
-                                  />
-                                </svg>
-                                Restore Backup
-                              </button>
-                            </div>
-                          </div>
-                        </div>
-                      </div>
-
-                      <div class="mt-4 p-3 bg-amber-50 dark:bg-amber-900/20 rounded-lg border border-amber-200 dark:border-amber-800">
-                        <div class="flex gap-2">
-                          <svg
-                            class="w-4 h-4 text-amber-600 dark:text-amber-400 flex-shrink-0 mt-0.5"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                            />
-                          </svg>
-                          <div class="text-xs text-amber-700 dark:text-amber-300">
-                            <p class="font-medium mb-1">Important Notes</p>
-                            <ul class="space-y-0.5 text-amber-600 dark:text-amber-400">
-                              <li>• Backups contain encrypted credentials and sensitive data</li>
-                              <li>• Use a strong passphrase to protect your backup</li>
-                              <li>• Store backup files securely and never share the passphrase</li>
-                            </ul>
-                          </div>
-                        </div>
-                      </div>
-                    </div>
-                  </Card>
+                  <AISettings />
+                  <AICostDashboard />
                 </div>
               </Show>
 
               {/* API Access */}
               <Show when={activeTab() === 'api'}>
-                <div class="space-y-6">
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <BadgeCheck class="w-5 h-5 text-blue-600 dark:text-blue-300" />
-                        </div>
-                        <SectionHeader
-                          title="API Access"
-                          description="Generate scoped tokens for agents and automation"
-                          size="sm"
-                          class="flex-1"
-                        />
-                      </div>
-                    </div>
-                    <div class="p-6 space-y-3">
-                      <p class="text-sm text-gray-600 dark:text-gray-400">
-                        Generate scoped tokens for Docker agents, host agents, and automation
-                        pipelines. Tokens are shown once—store them securely and rotate when
-                        infrastructure changes.
-                      </p>
-                      <a
-                        href="https://github.com/rcourtman/Pulse/blob/main/docs/CONFIGURATION.md#token-scopes"
-                        target="_blank"
-                        rel="noreferrer"
-                        class="inline-flex w-fit items-center gap-2 rounded-md border border-blue-200 bg-blue-50 px-3 py-1.5 text-xs font-semibold text-blue-700 transition-colors hover:bg-blue-100 dark:border-blue-700 dark:bg-blue-900/30 dark:text-blue-200"
-                      >
-                        View scope reference
-                      </a>
-                    </div>
-                  </Card>
-
-                  <APITokenManager
-                    currentTokenHint={securityStatus()?.apiTokenHint}
-                    onTokensChanged={() => {
-                      void loadSecurityStatus();
-                    }}
-                    refreshing={securityStatusLoading()}
-                  />
-                </div>
+                <APIAccessPanel
+                  currentTokenHint={securityStatus()?.apiTokenHint}
+                  onTokensChanged={() => {
+                    void loadSecurityStatus();
+                  }}
+                  refreshing={securityStatusLoading()}
+                />
               </Show>
 
               {/* Security Overview Tab */}
               <Show when={activeTab() === 'security-overview'}>
-                <div class="space-y-6">
-                  <Show when={!securityStatusLoading() && securityStatus()}>
-                    <SecurityPostureSummary status={securityStatus()!} />
-                  </Show>
-
-                  <Show when={!securityStatusLoading() && securityStatus()?.hasProxyAuth}>
-                    <Card
-                      padding="sm"
-                      class="border border-blue-200 dark:border-blue-800 bg-blue-50 dark:bg-blue-900/20"
-                    >
-                      <div class="flex flex-col gap-2 text-xs text-blue-800 dark:text-blue-200">
-                        <div class="flex items-center gap-2">
-                          <svg
-                            class="w-4 h-4 flex-shrink-0"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                            />
-                          </svg>
-                          <span class="font-semibold text-blue-900 dark:text-blue-100">
-                            Proxy authentication detected
-                          </span>
-                        </div>
-                        <p>
-                          Requests are validated by an upstream proxy. The current proxied user is
-                          {securityStatus()?.proxyAuthUsername
-                            ? ` ${securityStatus()?.proxyAuthUsername}`
-                            : ' available once a request is received'}
-                          .
-                          {securityStatus()?.proxyAuthIsAdmin ? ' Admin privileges confirmed.' : ''}
-                          <Show when={securityStatus()?.proxyAuthLogoutURL}>
-                            {' '}
-                            <a
-                              class="underline font-medium"
-                              href={securityStatus()?.proxyAuthLogoutURL}
-                            >
-                              Proxy logout
-                            </a>
-                          </Show>
-                        </p>
-                        <p>
-                          Need configuration tips? Review the proxy auth guide in the docs.{' '}
-                          <a
-                            class="underline font-medium"
-                            href="https://github.com/rcourtman/Pulse/blob/main/docs/PROXY_AUTH.md"
-                            target="_blank"
-                            rel="noreferrer"
-                          >
-                            Read proxy auth guide →
-                          </a>
-                        </p>
-                      </div>
-                    </Card>
-                  </Show>
-                </div>
+                <SecurityOverviewPanel
+                  securityStatus={securityStatus}
+                  securityStatusLoading={securityStatusLoading}
+                />
               </Show>
 
               {/* Security Authentication Tab */}
               <Show when={activeTab() === 'security-auth'}>
-                <div class="space-y-6">
-                  {/* Show message when auth is disabled */}
-                  <Show when={!securityStatus()?.hasAuthentication}>
-                    <Card
-                      padding="none"
-                      class="overflow-hidden border border-amber-200 dark:border-amber-800"
-                      border={false}
-                    >
-                      {/* Header */}
-                      <div class="bg-gradient-to-r from-amber-50 to-amber-50 dark:from-amber-900/20 dark:to-amber-900/20 px-6 py-4 border-b border-amber-200 dark:border-amber-700">
-                        <div class="flex items-center gap-3">
-                          <div class="p-2 bg-amber-100 dark:bg-amber-900/50 rounded-lg">
-                            <svg
-                              class="w-5 h-5 text-amber-600 dark:text-amber-400"
-                              fill="none"
-                              viewBox="0 0 24 24"
-                              stroke="currentColor"
-                            >
-                              <path
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                                stroke-width="2"
-                                d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                              />
-                            </svg>
-                          </div>
-                          <SectionHeader title="Authentication disabled" size="sm" class="flex-1" />
-                          <Show
-                            when={!authDisabledByEnv()}
-                            fallback={
-                              <span class="px-3 py-1.5 text-xs font-semibold rounded-lg border border-amber-300 text-amber-800 bg-amber-100/60 dark:border-amber-700 dark:text-amber-100 dark:bg-amber-900/40 whitespace-nowrap">
-                                Controlled by DISABLE_AUTH
-                              </span>
-                            }
-                          >
-                            <button
-                              type="button"
-                              onClick={() => setShowQuickSecuritySetup(!showQuickSecuritySetup())}
-                              class="px-3 py-1.5 text-xs font-medium rounded-lg border border-amber-300 text-amber-800 bg-amber-100/50 hover:bg-amber-100 transition-colors dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 dark:hover:bg-amber-900/40 whitespace-nowrap"
-                            >
-                              Setup
-                            </button>
-                          </Show>
-                        </div>
-                      </div>
-
-                      {/* Content */}
-                      <div class="p-6">
-                        <p class="text-sm text-amber-700 dark:text-amber-300 mb-4">
-                          <Show
-                            when={authDisabledByEnv()}
-                            fallback={
-                              <>
-                                Authentication is currently disabled. Set up password authentication
-                                to protect your Pulse instance.
-                              </>
-                            }
-                          >
-                            Authentication settings are locked by the legacy{' '}
-                            <code class="font-mono text-xs text-amber-800 dark:text-amber-200">
-                              DISABLE_AUTH
-                            </code>{' '}
-                            environment variable. Remove it from your deployment and restart Pulse
-                            before enabling security from this page.
-                          </Show>
-                        </p>
-
-                        <Show when={showQuickSecuritySetup() && !authDisabledByEnv()}>
-                          <QuickSecuritySetup
-                            onConfigured={() => {
-                              setShowQuickSecuritySetup(false);
-                              loadSecurityStatus();
-                            }}
-                          />
-                        </Show>
-                      </div>
-                    </Card>
-                  </Show>
-
-                  {/* Authentication */}
-                  <Show
-                    when={
-                      !securityStatusLoading() &&
-                      (securityStatus()?.hasAuthentication || securityStatus()?.apiTokenConfigured)
-                    }
-                  >
-                    <Card
-                      padding="none"
-                      class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                      border={false}
-                    >
-                      {/* Header */}
-                      <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                        <div class="flex items-center gap-3">
-                          <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                            <Lock
-                              class="w-5 h-5 text-blue-600 dark:text-blue-300"
-                              strokeWidth={2}
-                            />
-                          </div>
-                          <SectionHeader
-                            title="Authentication"
-                            description="Password management and credential rotation"
-                            size="sm"
-                            class="flex-1"
-                          />
-                        </div>
-                      </div>
-
-                      {/* Content */}
-                      <div class="p-6">
-                        <div class="flex flex-wrap items-center gap-3">
-                          <button
-                            type="button"
-                            onClick={(e) => {
-                              e.preventDefault();
-                              e.stopPropagation();
-                              setShowPasswordModal(true);
-                            }}
-                            class="px-4 py-2 text-sm font-medium bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
-                          >
-                            Change password
-                          </button>
-                          <Show
-                            when={!authDisabledByEnv()}
-                            fallback={
-                              <span class="px-4 py-2 text-sm font-semibold border border-amber-300 text-amber-800 bg-amber-50 dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 rounded-lg">
-                                Remove DISABLE_AUTH to rotate credentials
-                              </span>
-                            }
-                          >
-                            <button
-                              type="button"
-                              onClick={() => setShowQuickSecurityWizard(!showQuickSecurityWizard())}
-                              class="px-4 py-2 text-sm font-medium border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 rounded-lg hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors"
-                            >
-                              Rotate credentials
-                            </button>
-                          </Show>
-                          <div class="flex-1"></div>
-                          <div class="text-xs text-gray-600 dark:text-gray-400">
-                            <span class="font-medium text-gray-800 dark:text-gray-200">User:</span>{' '}
-                            {securityStatus()?.authUsername || 'Not configured'}
-                          </div>
-                        </div>
-
-                        <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
-                          <Toggle
-                            label="Hide local login form"
-                            description="Hide the username/password form on the login page. Users will only see SSO options unless ?show_local=true is used."
-                            checked={hideLocalLogin()}
-                            onChange={(e: ToggleChangeEvent) => handleHideLocalLoginChange(e.currentTarget.checked)}
-                            disabled={hideLocalLoginLocked() || savingHideLocalLogin()}
-                            locked={hideLocalLoginLocked()}
-                            lockedMessage="This setting is managed by the PULSE_AUTH_HIDE_LOCAL_LOGIN environment variable"
-                          />
-                        </div>
-
-                        <Show when={!authDisabledByEnv() && showQuickSecurityWizard()}>
-                          <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
-                            <QuickSecuritySetup
-                              mode="rotate"
-                              defaultUsername={securityStatus()?.authUsername || 'admin'}
-                              onConfigured={() => {
-                                setShowQuickSecurityWizard(false);
-                                loadSecurityStatus();
-                              }}
-                            />
-                          </div>
-                        </Show>
-                      </div>
-                    </Card>
-                  </Show>
-
-                  {/* Show pending restart message if configured but not loaded */}
-                  <Show when={securityStatus()?.configuredButPendingRestart}>
-                    <div class="bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-4">
-                      <div class="flex items-start space-x-3">
-                        <div class="flex-shrink-0">
-                          <svg
-                            class="h-6 w-6 text-amber-600 dark:text-amber-400"
-                            fill="none"
-                            viewBox="0 0 24 24"
-                            stroke="currentColor"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                            />
-                          </svg>
-                        </div>
-                        <div class="flex-1">
-                          <h4 class="text-sm font-semibold text-amber-900 dark:text-amber-100">
-                            Security Configured - Restart Required
-                          </h4>
-                          <p class="text-xs text-amber-700 dark:text-amber-300 mt-1">
-                            Security settings have been configured but the service needs to be
-                            restarted to activate them.
-                          </p>
-                          <p class="text-xs text-amber-600 dark:text-amber-400 mt-2">
-                            After restarting, you'll need to log in with your saved credentials.
-                          </p>
-
-                          <div class="mt-4 bg-white dark:bg-gray-800 rounded-lg p-3 border border-amber-200 dark:border-amber-700">
-                            <p class="text-xs font-semibold text-gray-900 dark:text-gray-100 mb-2">
-                              How to restart Pulse:
-                            </p>
-
-                            <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
-                              <div class="space-y-2">
-                                <p class="text-xs text-gray-700 dark:text-gray-300">
-                                  Type{' '}
-                                  <code class="px-1 py-0.5 bg-gray-100 dark:bg-gray-700 rounded">
-                                    update
-                                  </code>{' '}
-                                  in your ProxmoxVE console
-                                </p>
-                                <p class="text-xs text-gray-600 dark:text-gray-400 italic">
-                                  Or restart manually with:{' '}
-                                  <code class="text-xs">systemctl restart pulse</code>
-                                </p>
-                              </div>
-                            </Show>
-
-                            <Show when={versionInfo()?.deploymentType === 'docker'}>
-                              <div class="space-y-1">
-                                <p class="text-xs text-gray-700 dark:text-gray-300">
-                                  Restart your Docker container:
-                                </p>
-                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                  docker restart pulse
-                                </code>
-                              </div>
-                            </Show>
-
-                            <Show
-                              when={
-                                versionInfo()?.deploymentType === 'systemd' ||
-                                versionInfo()?.deploymentType === 'manual'
-                              }
-                            >
-                              <div class="space-y-1">
-                                <p class="text-xs text-gray-700 dark:text-gray-300">
-                                  Restart the service:
-                                </p>
-                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                  sudo systemctl restart pulse
-                                </code>
-                              </div>
-                            </Show>
-
-                            <Show when={versionInfo()?.deploymentType === 'development'}>
-                              <div class="space-y-1">
-                                <p class="text-xs text-gray-700 dark:text-gray-300">
-                                  Restart the development server:
-                                </p>
-                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                  sudo systemctl restart pulse-hot-dev
-                                </code>
-                              </div>
-                            </Show>
-
-                            <Show when={!versionInfo()?.deploymentType}>
-                              <div class="space-y-1">
-                                <p class="text-xs text-gray-700 dark:text-gray-300">
-                                  Restart Pulse using your deployment method
-                                </p>
-                              </div>
-                            </Show>
-                          </div>
-
-                          <div class="mt-3 p-2 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded">
-                            <p class="text-xs text-green-700 dark:text-green-300">
-                              💡 <strong>Tip:</strong> Make sure you've saved your credentials
-                              before restarting!
-                            </p>
-                          </div>
-                        </div>
-                      </div>
-                    </div>
-                  </Show>
-                </div>
+                <SecurityAuthPanel
+                  securityStatus={securityStatus}
+                  securityStatusLoading={securityStatusLoading}
+                  versionInfo={versionInfo}
+                  authDisabledByEnv={authDisabledByEnv}
+                  showQuickSecuritySetup={showQuickSecuritySetup}
+                  setShowQuickSecuritySetup={setShowQuickSecuritySetup}
+                  showQuickSecurityWizard={showQuickSecurityWizard}
+                  setShowQuickSecurityWizard={setShowQuickSecurityWizard}
+                  showPasswordModal={showPasswordModal}
+                  setShowPasswordModal={setShowPasswordModal}
+                  hideLocalLogin={hideLocalLogin}
+                  hideLocalLoginLocked={hideLocalLoginLocked}
+                  savingHideLocalLogin={savingHideLocalLogin}
+                  handleHideLocalLoginChange={handleHideLocalLoginChange}
+                  loadSecurityStatus={loadSecurityStatus}
+                />
               </Show>
 
               {/* Security Single Sign-On Tab */}
@@ -5325,2093 +3606,15 @@ const Settings: Component<SettingsProps> = (props) => {
 
               {/* Diagnostics Tab */}
               <Show when={activeTab() === 'diagnostics'}>
-                <div class="space-y-6">
-                  <div>
-                    <SectionHeader title="System diagnostics" size="md" class="mb-4" />
-
-                    <div class="space-y-4">
-                      {/* Live Connection Diagnostics */}
-                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                          Connection Diagnostics
-                        </h4>
-                        <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
-                          Test all configured node connections and view detailed status
-                        </p>
-                        <button
-                          type="button"
-                          onClick={() => {
-                            void runDiagnostics();
-                          }}
-                          disabled={runningDiagnostics()}
-                          class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                        >
-                          {runningDiagnostics() ? 'Running...' : 'Run Diagnostics'}
-                        </button>
-
-                        <Show when={diagnosticsData()}>
-                          <div class="mt-4 space-y-3">
-                            {/* System Info */}
-                            <Card padding="sm">
-                              <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                System
-                              </h5>
-                              <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
-                                <div>Version: {diagnosticsData()?.version || 'Unknown'}</div>
-                                <div>Runtime: {diagnosticsData()?.runtime || 'Unknown'}</div>
-                                <div>Uptime: {formatUptime(diagnosticsData()?.uptime || 0)}</div>
-                                <div>
-                                  OS / Arch:{' '}
-                                  {diagnosticsData()?.system?.os
-                                    ? `${diagnosticsData()?.system?.os} / ${diagnosticsData()?.system?.arch || 'Unknown'}`
-                                    : 'Unknown'}
-                                </div>
-                                <div>
-                                  Go runtime: {diagnosticsData()?.system?.goVersion || 'Unknown'}
-                                </div>
-                                <div>
-                                  CPU cores: {diagnosticsData()?.system?.numCPU ?? 'Unknown'}
-                                </div>
-                                <div>
-                                  Goroutines: {diagnosticsData()?.system?.numGoroutine ?? 'Unknown'}
-                                </div>
-                                <div>Memory: {diagnosticsData()?.system?.memoryMB ?? 0} MB</div>
-                              </div>
-                            </Card>
-
-                            <Show when={diagnosticsData()?.discovery}>
-                              {(discovery) => {
-                                const lastScanAbsolute = () =>
-                                  formatIsoDateTime(discovery().lastScanStartedAt) || 'Never';
-                                const lastScanRelative = () =>
-                                  formatIsoRelativeTime(discovery().lastScanStartedAt);
-                                const lastResultAbsolute = () =>
-                                  formatIsoDateTime(discovery().lastResultTimestamp) || 'Never';
-                                const lastResultRelative = () =>
-                                  formatIsoRelativeTime(discovery().lastResultTimestamp);
-                                const blocklist = () => discovery().subnetBlocklist || [];
-                                const allowlist = () => discovery().subnetAllowlist || [];
-                                return (
-                                  <Card padding="sm">
-                                    <div class="flex items-start justify-between gap-3">
-                                      <div>
-                                        <h5 class="text-sm font-semibold text-gray-700 dark:text-gray-300">
-                                          Network discovery
-                                        </h5>
-                                        <p class="text-xs text-gray-600 dark:text-gray-400">
-                                          Active scan configuration and recent discovery results.
-                                        </p>
-                                      </div>
-                                      <span
-                                        class="rounded-full px-2 py-1 text-[0.65rem] font-medium uppercase tracking-wide"
-                                        classList={{
-                                          'bg-green-100 text-green-700 dark:bg-green-900/30 dark:text-green-300':
-                                            discovery().enabled,
-                                          'bg-gray-200 text-gray-700 dark:bg-gray-700 dark:text-gray-300':
-                                            !discovery().enabled,
-                                        }}
-                                      >
-                                        {discovery().enabled ? 'Enabled' : 'Disabled'}
-                                      </span>
-                                    </div>
-
-                                    <div class="mt-3 grid gap-1 text-xs text-gray-600 dark:text-gray-400">
-                                      <div>
-                                        Configured subnet:{' '}
-                                        <code class="rounded bg-gray-100 px-1.5 py-0.5 text-[0.7rem] font-mono dark:bg-gray-700 dark:text-gray-200">
-                                          {discovery().configuredSubnet || 'auto'}
-                                        </code>
-                                      </div>
-                                      <Show
-                                        when={
-                                          discovery().activeSubnet &&
-                                          discovery().activeSubnet !== discovery().configuredSubnet
-                                        }
-                                      >
-                                        <div>
-                                          Active subnet:{' '}
-                                          <code class="rounded bg-blue-50 px-1.5 py-0.5 text-[0.7rem] font-mono text-blue-700 dark:bg-blue-900/30 dark:text-blue-200">
-                                            {discovery().activeSubnet}
-                                          </code>
-                                        </div>
-                                      </Show>
-                                      <Show when={discovery().environmentOverride}>
-                                        <div>
-                                          Environment override:{' '}
-                                          <span class="font-medium text-gray-700 dark:text-gray-300">
-                                            {discovery().environmentOverride}
-                                          </span>
-                                        </div>
-                                      </Show>
-                                      <div>
-                                        Scan interval:{' '}
-                                        <span class="font-medium text-gray-700 dark:text-gray-300">
-                                          {discovery().scanInterval || 'default'}
-                                        </span>
-                                        <Show when={discovery().scanning}>
-                                          <span class="ml-2 inline-flex items-center gap-1 text-[0.65rem] text-blue-600 dark:text-blue-300">
-                                            <span class="h-1.5 w-1.5 animate-pulse rounded-full bg-blue-500" />
-                                            scanning
-                                          </span>
-                                        </Show>
-                                      </div>
-                                    </div>
-
-                                    <div class="mt-4 space-y-3">
-                                      <div>
-                                        <div class="text-[0.65rem] font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                          Blocked subnets
-                                        </div>
-                                        <Show
-                                          when={blocklist().length > 0}
-                                          fallback={
-                                            <div class="mt-1 text-xs text-gray-500 dark:text-gray-400">
-                                              None
-                                            </div>
-                                          }
-                                        >
-                                          <div class="mt-1 flex flex-wrap gap-2">
-                                            <For each={blocklist()}>
-                                              {(cidr) => (
-                                                <span class="rounded bg-gray-100 px-2 py-1 text-[0.7rem] font-mono text-gray-700 dark:bg-gray-700 dark:text-gray-200">
-                                                  {cidr}
-                                                </span>
-                                              )}
-                                            </For>
-                                          </div>
-                                        </Show>
-                                      </div>
-
-                                      <Show when={allowlist().length > 0}>
-                                        <div>
-                                          <div class="text-[0.65rem] font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                            Allowlist overrides
-                                          </div>
-                                          <div class="mt-1 flex flex-wrap gap-2">
-                                            <For each={allowlist()}>
-                                              {(cidr) => (
-                                                <span class="rounded bg-blue-50 px-2 py-1 text-[0.7rem] font-mono text-blue-700 dark:bg-blue-900/30 dark:text-blue-200">
-                                                  {cidr}
-                                                </span>
-                                              )}
-                                            </For>
-                                          </div>
-                                        </div>
-                                      </Show>
-                                    </div>
-
-                                    <div class="mt-4 grid gap-1 text-[0.7rem] text-gray-500 dark:text-gray-400">
-                                      <div>
-                                        Last scan:{' '}
-                                        <span class="text-gray-700 dark:text-gray-300">
-                                          {lastScanAbsolute()}
-                                        </span>
-                                        <Show when={lastScanRelative()}>
-                                          {(relative) => (
-                                            <span class="ml-2 text-[0.65rem] text-gray-400 dark:text-gray-500">
-                                              ({relative()})
-                                            </span>
-                                          )}
-                                        </Show>
-                                      </div>
-                                      <div>
-                                        Last result:{' '}
-                                        <span class="text-gray-700 dark:text-gray-300">
-                                          {lastResultAbsolute()}
-                                        </span>
-                                        <Show when={lastResultRelative()}>
-                                          {(relative) => (
-                                            <span class="ml-2 text-[0.65rem] text-gray-400 dark:text-gray-500">
-                                              ({relative()})
-                                            </span>
-                                          )}
-                                        </Show>
-                                      </div>
-                                      <div>
-                                        Servers found:{' '}
-                                        <span class="text-gray-700 dark:text-gray-300">
-                                          {discovery().lastResultServers ?? 0}
-                                        </span>
-                                        <span class="ml-3">
-                                          Errors:{' '}
-                                          <span class="text-gray-700 dark:text-gray-300">
-                                            {discovery().lastResultErrors ?? 0}
-                                          </span>
-                                        </span>
-                                      </div>
-                                    </div>
-                                  </Card>
-                                );
-                              }}
-                            </Show>
-
-                            {/* Temperature proxy guidance */}
-                            <Show when={diagnosticsData()?.temperatureProxy}>
-                              {(temp) => (
-                                <Card padding="sm">
-                                  <div class="flex items-center justify-between gap-3 mb-2">
-                                    <h5 class="text-sm font-semibold text-gray-700 dark:text-gray-300">
-                                      Temperature proxy
-                                    </h5>
-                                    <a
-                                      href="https://github.com/rcourtman/Pulse/blob/main/docs/TEMPERATURE_MONITORING.md#transport-decision-matrix"
-                                      target="_blank"
-                                      rel="noreferrer"
-                                      class="text-xs text-blue-600 hover:text-blue-700 dark:text-blue-300 dark:hover:text-blue-200 underline-offset-2 hover:underline"
-                                    >
-                                      Setup guide
-                                    </a>
-                                  </div>
-                                  <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
-                                    <div class="flex items-center justify-between">
-                                      <span>Proxy socket</span>
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-white text-xs ${temp().socketFound ? 'bg-green-500' : 'bg-red-500'
-                                          }`}
-                                      >
-                                        {temp().socketFound ? 'Detected' : 'Missing'}
-                                      </span>
-                                    </div>
-                                    <div class="flex items-center justify-between">
-                                      <span>Daemon</span>
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-white text-xs ${temp().proxyReachable ? 'bg-green-500' : 'bg-yellow-500'
-                                          }`}
-                                      >
-                                        {temp().proxyReachable ? 'Responding' : 'No response'}
-                                      </span>
-                                    </div>
-                                    <Show when={temp().socketPath}>
-                                      <div>Socket path: {temp().socketPath}</div>
-                                    </Show>
-                                    <Show when={temp().socketPermissions}>
-                                      <div>Permissions: {temp().socketPermissions}</div>
-                                    </Show>
-                                    <Show when={temp().socketOwner || temp().socketGroup}>
-                                      <div>
-                                        Owner:{' '}
-                                        {[temp().socketOwner, temp().socketGroup]
-                                          .filter(Boolean)
-                                          .join(' / ') || 'Unknown'}
-                                      </div>
-                                    </Show>
-                                    <Show when={temp().proxyVersion}>
-                                      <div>Proxy version: {temp().proxyVersion}</div>
-                                    </Show>
-                                    <Show when={temp().proxySshDirectory}>
-                                      <div>SSH directory: {temp().proxySshDirectory}</div>
-                                    </Show>
-                                    <Show when={temp().proxyPublicKeySha256}>
-                                      <div>Key fingerprint: {temp().proxyPublicKeySha256}</div>
-                                    </Show>
-                                    <Show when={typeof temp().legacySshKeyCount === 'number'}>
-                                      <div>Legacy SSH keys: {temp().legacySshKeyCount ?? 0}</div>
-                                    </Show>
-                                    <Show when={temp().legacySSHDetected}>
-                                      <div class="text-red-500">
-                                        Legacy SSH temperature collection detected
-                                      </div>
-                                    </Show>
-                                  </div>
-                                  <Show
-                                    when={
-                                      temp().controlPlaneStates &&
-                                      (temp().controlPlaneStates as TemperatureProxyControlPlaneState[]).length > 0
-                                    }
-                                  >
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                      <div class="flex items-center justify-between">
-                                        <div class="font-semibold text-gray-700 dark:text-gray-200">
-                                          Control plane sync
-                                        </div>
-                                        <span
-                                          class={`px-2 py-0.5 rounded text-white text-xs ${temp().controlPlaneEnabled ? 'bg-green-500' : 'bg-gray-500'
-                                            }`}
-                                        >
-                                          {temp().controlPlaneEnabled ? 'Enabled' : 'Disabled'}
-                                        </span>
-                                      </div>
-                                      <For each={temp().controlPlaneStates || []}>
-                                        {(state) => (
-                                          <div class="rounded border border-gray-200 dark:border-gray-700 px-2 py-1.5 space-y-1">
-                                            <div class="flex items-center justify-between">
-                                              <div class="font-medium text-gray-700 dark:text-gray-200">
-                                                {state.instance || 'Proxy'}
-                                              </div>
-                                              <span
-                                                class={`px-2 py-0.5 rounded text-white text-xs ${controlPlaneStatusClass(
-                                                  state.status,
-                                                )}`}
-                                              >
-                                                {controlPlaneStatusLabel(state.status)}
-                                              </span>
-                                            </div>
-                                            <Show when={state.lastSync}>
-                                              <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                                Last sync: {formatIsoRelativeTime(state.lastSync)}
-                                              </div>
-                                            </Show>
-                                            <Show when={typeof state.secondsBehind === 'number' && (state.secondsBehind || 0) > 0}>
-                                              <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                                Behind by ~{formatUptime(state.secondsBehind || 0)}
-                                              </div>
-                                            </Show>
-                                            <Show when={state.refreshIntervalSeconds}>
-                                              <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                                Target interval: {formatUptime(state.refreshIntervalSeconds || 0)}
-                                              </div>
-                                            </Show>
-                                          </div>
-                                        )}
-                                      </For>
-                                    </div>
-                                  </Show>
-                                  <Show
-                                    when={
-                                      temp().httpProxies && (temp().httpProxies as TemperatureProxyHTTPStatus[]).length > 0
-                                    }
-                                  >
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                      <div class="font-semibold text-gray-700 dark:text-gray-200">
-                                        HTTPS proxies
-                                      </div>
-                                      <For each={temp().httpProxies || []}>
-                                        {(proxy) => (
-                                          <div class="rounded border border-gray-200 dark:border-gray-700 px-2 py-1.5 space-y-1">
-                                            <div class="flex items-center justify-between">
-                                              <div>
-                                                <div class="font-medium text-gray-700 dark:text-gray-200">
-                                                  {proxy.node || 'Proxy'}
-                                                </div>
-                                                <Show when={proxy.url}>
-                                                  <div class="text-[0.65rem] text-gray-500 dark:text-gray-400 break-all">
-                                                    {proxy.url}
-                                                  </div>
-                                                </Show>
-                                              </div>
-                                              <span
-                                                class={`px-2 py-0.5 rounded text-white text-xs ${proxy.reachable ? 'bg-green-500' : 'bg-red-500'
-                                                  }`}
-                                              >
-                                                {proxy.reachable ? 'Healthy' : 'Error'}
-                                              </span>
-                                            </div>
-                                            <Show when={!proxy.reachable && proxy.error}>
-                                              <div class="text-[0.65rem] text-red-500">
-                                                {proxy.error}
-                                              </div>
-                                            </Show>
-                                          </div>
-                                        )}
-                                      </For>
-                                    </div>
-                                    <div class="mt-2 text-[0.65rem] text-blue-700 dark:text-blue-300">
-                                      Learn more:{" "}
-                                      <a
-                                        href="https://github.com/rcourtman/Pulse/blob/main/docs/TEMPERATURE_MONITORING.md"
-                                        target="_blank"
-                                        rel="noreferrer"
-                                        class="underline hover:text-blue-500"
-                                      >
-                                        Temperature Monitoring docs
-                                      </a>
-                                    </div>
-                                  </Show>
-                                  <Show
-                                    when={
-                                      temp().socketHostCooldowns &&
-                                      (temp().socketHostCooldowns as TemperatureProxySocketHost[]).length > 0
-                                    }
-                                  >
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                      <div class="font-semibold text-gray-700 dark:text-gray-200">
-                                        Socket cooldowns
-                                      </div>
-                                      <For each={temp().socketHostCooldowns || []}>
-                                        {(entry) => (
-                                          <div class="rounded border border-amber-200 dark:border-amber-700 px-2 py-1.5 space-y-1">
-                                            <div class="flex items-center justify-between">
-                                              <div>
-                                                <div class="font-medium text-gray-700 dark:text-gray-200">
-                                                  {entry.node || entry.host || 'Host'}
-                                                </div>
-                                                <Show when={entry.cooldownUntil}>
-                                                  <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                                    Until {entry.cooldownUntil}
-                                                  </div>
-                                                </Show>
-                                              </div>
-                                              <span class="px-2 py-0.5 rounded text-white text-xs bg-amber-500">
-                                                Cooling
-                                              </span>
-                                            </div>
-                                            <Show when={typeof entry.secondsRemaining === 'number'}>
-                                              <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                                Retrying in ~{formatUptime(entry.secondsRemaining || 0)}
-                                              </div>
-                                            </Show>
-                                            <Show when={entry.lastError}>
-                                              <div class="text-[0.65rem] text-red-500">
-                                                {entry.lastError}
-                                              </div>
-                                            </Show>
-                                          </div>
-                                        )}
-                                      </For>
-                                    </div>
-                                  </Show>
-                                  <Show
-                                    when={proxyNodeChecksSupported()}
-                                    fallback={
-                                      <div class="mt-3 text-xs text-gray-500 dark:text-gray-400">
-                                        Check proxy nodes is only available when the proxy socket
-                                        grants admin access. Run this diagnostic on the Proxmox host
-                                        or reinstall pulse-sensor-proxy in HTTP mode to manage nodes
-                                        remotely.
-                                      </div>
-                                    }
-                                  >
-                                    <div class="mt-3 flex flex-wrap gap-2">
-                                      <button
-                                        type="button"
-                                        onClick={() => {
-                                          if (!proxyActionLoading()) {
-                                            void handleRegisterProxyNodes();
-                                          }
-                                        }}
-                                        disabled={proxyActionLoading() !== null}
-                                        class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                                      >
-                                        {proxyActionLoading() === 'register-nodes'
-                                          ? 'Checking nodes...'
-                                          : 'Check proxy nodes'}
-                                      </button>
-                                    </div>
-                                    <Show when={hostProxyStatus()}>
-                                      {(status) => (
-                                        <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                          <div class="flex items-center justify-between">
-                                            <div class="font-semibold text-gray-700 dark:text-gray-200">
-                                              Pulse host proxy
-                                            </div>
-                                            <button
-                                              type="button"
-                                              class="text-xs rounded bg-blue-600 text-white px-2 py-1 hover:bg-blue-700 disabled:opacity-50"
-                                              onClick={() => void refreshHostProxyStatus(true)}
-                                            >
-                                              Refresh
-                                            </button>
-                                          </div>
-                                          <div class="grid grid-cols-2 gap-y-1">
-                                            <div>Requested</div>
-                                            <div>{status().summary?.requested ? 'Yes' : 'No'}</div>
-                                            <div>Installed</div>
-                                            <div>{status().summary?.installed ? 'Yes' : 'No'}</div>
-                                            <div>Host socket</div>
-                                            <div>{status().hostSocketPresent ? 'Present' : 'Missing'}</div>
-                                            <div>Container socket</div>
-                                            <div>{status().containerSocketPresent ? 'Present' : 'Missing'}</div>
-                                          </div>
-                                          <Show when={status().reinstallCommand}>
-                                            <div class="flex flex-wrap gap-2">
-                                              <button
-                                                type="button"
-                                                class="rounded bg-blue-600 text-white px-2 py-1 hover:bg-blue-700"
-                                                onClick={() => {
-                                                  const command = status().reinstallCommand;
-                                                  if (command) {
-                                                    void copyToClipboard(command);
-                                                    showSuccess(
-                                                      'Host proxy command copied',
-                                                      undefined,
-                                                      2000,
-                                                    );
-                                                  }
-                                                }}
-                                              >
-                                                Copy reinstall command
-                                              </button>
-                                              <Show when={status().installerURL}>
-                                                {(url) => (
-                                                  <a
-                                                    href={url()}
-                                                    target="_blank"
-                                                    rel="noreferrer"
-                                                    class="rounded border border-gray-300 px-2 py-1 text-gray-700 hover:bg-gray-100 dark:text-gray-200 dark:border-gray-600 dark:hover:bg-gray-800"
-                                                  >
-                                                    Download installer script
-                                                  </a>
-                                                )}
-                                              </Show>
-                                            </div>
-                                          </Show>
-                                          <Show when={status().summary?.lastUpdated}>
-                                            <div class="text-[0.65rem] text-gray-500 dark:text-gray-400">
-                                              Summary updated {status().summary?.lastUpdated}
-                                            </div>
-                                          </Show>
-                                        </div>
-                                      )}
-                                    </Show>
-                                  </Show>
-                                  <Show
-                                    when={
-                                      proxyRegisterSummary() && proxyRegisterSummary()!.length > 0
-                                    }
-                                  >
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
-                                      <div>Proxy node connectivity:</div>
-                                      <ul class="list-disc pl-4 space-y-0.5">
-                                        <For each={proxyRegisterSummary() || []}>
-                                          {(node) => (
-                                            <li>
-                                              <span
-                                                class={
-                                                  node.sshReady
-                                                    ? 'text-green-600 dark:text-green-400'
-                                                    : 'text-red-600 dark:text-red-400'
-                                                }
-                                              >
-                                                {node.name}:{' '}
-                                                {node.sshReady ? 'reachable' : 'unreachable'}
-                                              </span>
-                                              <Show when={node.error}>
-                                                <span class="ml-1 text-gray-500 dark:text-gray-400">
-                                                  ({node.error})
-                                                </span>
-                                              </Show>
-                                            </li>
-                                          )}
-                                        </For>
-                                      </ul>
-                                    </div>
-                                  </Show>
-                                  <Show when={temp().notes && temp().notes!.length > 0}>
-                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                      <For each={temp().notes || []}>
-                                        {(note) => <li>{note}</li>}
-                                      </For>
-                                    </ul>
-                                  </Show>
-                                </Card>
-                              )}
-                            </Show>
-
-                            {/* API token adoption */}
-                            <Show when={diagnosticsData()?.apiTokens}>
-                              {(apiDiag) => (
-                                <Card padding="sm">
-                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                    API tokens
-                                  </h5>
-                                  <div class="text-xs space-y-2 text-gray-600 dark:text-gray-400">
-                                    <div class="flex flex-wrap gap-2">
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-xs ${apiDiag().enabled
-                                          ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                          : 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          }`}
-                                      >
-                                        {apiDiag().enabled
-                                          ? 'Token auth enabled'
-                                          : 'Token auth disabled'}
-                                      </span>
-                                      <Show when={apiDiag().hasEnvTokens}>
-                                        <span class="px-2 py-0.5 rounded text-xs bg-orange-100 text-orange-700 dark:bg-orange-700/40 dark:text-orange-100">
-                                          Env override detected
-                                        </span>
-                                      </Show>
-                                      <Show when={apiDiag().hasLegacyToken}>
-                                        <span class="px-2 py-0.5 rounded text-xs bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100">
-                                          Legacy token present
-                                        </span>
-                                      </Show>
-                                    </div>
-                                    <div class="grid grid-cols-2 gap-2">
-                                      <div>Configured tokens: {apiDiag().tokenCount}</div>
-                                      <div>
-                                        Rotation needed:{' '}
-                                        {apiDiag().recommendTokenRotation ? 'Yes' : 'No'}
-                                      </div>
-                                      <div>
-                                        Docker hosts on shared token:{' '}
-                                        {apiDiag().legacyDockerHostCount ?? 0}
-                                      </div>
-                                      <div>Unused tokens: {apiDiag().unusedTokenCount ?? 0}</div>
-                                    </div>
-                                  </div>
-                                  <Show when={apiDiag().tokens && apiDiag().tokens!.length > 0}>
-                                    <div class="mt-3 border border-gray-200 dark:border-gray-700 rounded-md divide-y divide-gray-200 dark:divide-gray-700">
-                                      <For each={apiDiag().tokens || []}>
-                                        {(token) => (
-                                          <div class="p-2 text-xs text-gray-600 dark:text-gray-400 flex flex-wrap justify-between gap-2">
-                                            <div class="flex-1 min-w-[140px]">
-                                              <div class="font-medium text-gray-700 dark:text-gray-200">
-                                                {token.name || 'Unnamed token'}
-                                              </div>
-                                              <div class="text-2xs text-gray-500 dark:text-gray-400">
-                                                {token.hint || 'No hint available'}
-                                                <Show when={token.source}>
-                                                  <span class="ml-2 uppercase tracking-wide">
-                                                    ({token.source})
-                                                  </span>
-                                                </Show>
-                                              </div>
-                                            </div>
-                                            <div class="text-right min-w-[160px]">
-                                              <div>
-                                                Created:{' '}
-                                                {token.createdAt
-                                                  ? new Date(token.createdAt).toLocaleString()
-                                                  : 'Unknown'}
-                                              </div>
-                                              <div>
-                                                Last used:{' '}
-                                                {token.lastUsedAt
-                                                  ? formatRelativeTime(
-                                                    new Date(token.lastUsedAt).getTime(),
-                                                  )
-                                                  : 'Never'}
-                                              </div>
-                                            </div>
-                                          </div>
-                                        )}
-                                      </For>
-                                    </div>
-                                  </Show>
-                                  <Show when={apiDiag().usage && apiDiag().usage!.length > 0}>
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
-                                      <div class="font-semibold text-gray-700 dark:text-gray-200">
-                                        Token usage
-                                      </div>
-                                      <ul class="list-disc pl-4 space-y-1">
-                                        <For each={apiDiag().usage || []}>
-                                          {(usage) => (
-                                            <li>
-                                              {usage.tokenId}: {usage.hostCount}{' '}
-                                              {usage.hostCount === 1 ? 'host' : 'hosts'}
-                                              <Show when={usage.hosts && usage.hosts!.length > 0}>
-                                                <span class="ml-1 text-gray-500 dark:text-gray-400">
-                                                  ({usage.hosts!.join(', ')})
-                                                </span>
-                                              </Show>
-                                            </li>
-                                          )}
-                                        </For>
-                                      </ul>
-                                    </div>
-                                  </Show>
-                                  <Show when={apiDiag().notes && apiDiag().notes!.length > 0}>
-                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                      <For each={apiDiag().notes || []}>
-                                        {(note) => <li>{note}</li>}
-                                      </For>
-                                    </ul>
-                                  </Show>
-                                </Card>
-                              )}
-                            </Show>
-
-                            {/* Docker agent adoption */}
-                            <Show when={diagnosticsData()?.dockerAgents}>
-                              {(dockerDiag) => (
-                                <Card padding="sm">
-                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                    Docker agents
-                                  </h5>
-                                  <Show when={dockerDiag().hostsTotal > 0}>
-                                    <div class="text-xs text-gray-600 dark:text-gray-400 grid grid-cols-2 gap-2">
-                                      <div>Total hosts: {dockerDiag().hostsTotal}</div>
-                                      <div>Online: {dockerDiag().hostsOnline}</div>
-                                      <div>
-                                        With dedicated tokens: {dockerDiag().hostsWithTokenBinding}
-                                      </div>
-                                      <div>
-                                        Attention required: {dockerDiag().hostsNeedingAttention}
-                                      </div>
-                                      <div>
-                                        Missing version: {dockerDiag().hostsWithoutVersion ?? 0}
-                                      </div>
-                                      <div>
-                                        Outdated agents: {dockerDiag().hostsOutdatedVersion ?? 0}
-                                      </div>
-                                      <div>
-                                        Stale commands: {dockerDiag().hostsWithStaleCommand ?? 0}
-                                      </div>
-                                      <div>
-                                        Pending uninstall: {dockerDiag().hostsPendingUninstall ?? 0}
-                                      </div>
-                                    </div>
-                                    <Show when={dockerDiag().recommendedAgentVersion}>
-                                      <div class="mt-2 text-xs text-gray-500 dark:text-gray-400">
-                                        Recommended agent version:{' '}
-                                        {dockerDiag().recommendedAgentVersion}
-                                      </div>
-                                    </Show>
-                                  </Show>
-                                  <Show
-                                    when={
-                                      dockerDiag().attention && dockerDiag().attention!.length > 0
-                                    }
-                                  >
-                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 divide-y divide-gray-200 dark:divide-gray-700 border border-gray-200 dark:border-gray-700 rounded-md">
-                                      <For each={dockerDiag().attention || []}>
-                                        {(entry) => (
-                                          <div class="p-2 space-y-1">
-                                            <div class="flex items-center justify-between">
-                                              <span class="font-medium text-gray-700 dark:text-gray-200">
-                                                {entry.name}
-                                              </span>
-                                              <span
-                                                class={`px-2 py-0.5 rounded text-xs ${entry.status === 'online'
-                                                  ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                                  : 'bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100'
-                                                  }`}
-                                              >
-                                                {entry.status || 'unknown'}
-                                              </span>
-                                            </div>
-                                            <div class="text-2xs text-gray-500 dark:text-gray-400 space-x-2">
-                                              <Show when={entry.agentVersion}>
-                                                <span>Agent {entry.agentVersion}</span>
-                                              </Show>
-                                              <Show when={entry.tokenHint}>
-                                                <span>Token {entry.tokenHint}</span>
-                                              </Show>
-                                              <Show when={entry.lastSeen}>
-                                                <span>
-                                                  Seen{' '}
-                                                  {formatRelativeTime(
-                                                    new Date(entry.lastSeen!).getTime(),
-                                                  )}
-                                                </span>
-                                              </Show>
-                                            </div>
-                                            <ul class="list-disc pl-4 space-y-1 text-gray-600 dark:text-gray-400">
-                                              <For each={entry.issues}>
-                                                {(issue) => <li>{issue}</li>}
-                                              </For>
-                                            </ul>
-                                            <div class="mt-2 flex flex-wrap gap-2">
-                                              <button
-                                                type="button"
-                                                onClick={() => {
-                                                  if (dockerActionLoading() !== entry.hostId) {
-                                                    void handleDockerPrepareToken(entry.hostId);
-                                                  }
-                                                }}
-                                                disabled={dockerActionLoading() === entry.hostId}
-                                                class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                                              >
-                                                {dockerActionLoading() === entry.hostId
-                                                  ? 'Preparing token...'
-                                                  : 'Generate dedicated token'}
-                                              </button>
-                                            </div>
-                                            <Show when={dockerMigrationResults()[entry.hostId]}>
-                                              <div class="mt-3 w-full space-y-2 bg-gray-100 dark:bg-gray-800/60 border border-gray-200 dark:border-gray-700 rounded p-3 text-xs text-gray-700 dark:text-gray-200">
-                                                {(() => {
-                                                  const migration =
-                                                    dockerMigrationResults()[entry.hostId]!;
-                                                  return (
-                                                    <>
-                                                      <div class="font-semibold text-gray-800 dark:text-gray-100">
-                                                        Install command
-                                                      </div>
-                                                      <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
-                                                        {migration.installCommand}
-                                                      </pre>
-                                                      <button
-                                                        type="button"
-                                                        class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
-                                                        onClick={() =>
-                                                          void handleCopy(
-                                                            migration.installCommand,
-                                                            'Install command copied',
-                                                          )
-                                                        }
-                                                      >
-                                                        Copy install command
-                                                      </button>
-                                                      <div class="font-semibold text-gray-800 dark:text-gray-100 mt-2">
-                                                        Systemd snippet
-                                                      </div>
-                                                      <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
-                                                        {migration.systemdServiceSnippet}
-                                                      </pre>
-                                                      <button
-                                                        type="button"
-                                                        class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
-                                                        onClick={() =>
-                                                          void handleCopy(
-                                                            migration.systemdServiceSnippet,
-                                                            'Service snippet copied',
-                                                          )
-                                                        }
-                                                      >
-                                                        Copy service snippet
-                                                      </button>
-                                                      <div class="text-gray-600 dark:text-gray-400">
-                                                        Target URL: {migration.pulseURL}
-                                                      </div>
-                                                    </>
-                                                  );
-                                                })()}
-                                              </div>
-                                            </Show>
-                                          </div>
-                                        )}
-                                      </For>
-                                    </div>
-                                  </Show>
-                                  <Show when={dockerDiag().notes && dockerDiag().notes!.length > 0}>
-                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                      <For each={dockerDiag().notes || []}>
-                                        {(note) => <li>{note}</li>}
-                                      </For>
-                                    </ul>
-                                  </Show>
-                                </Card>
-                              )}
-                            </Show>
-
-                            {/* Alerts configuration */}
-                            <Show when={diagnosticsData()?.alerts}>
-                              {(alerts) => (
-                                <Card padding="sm">
-                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                    Alerts configuration
-                                  </h5>
-                                  <div class="text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                    <div class="flex flex-wrap gap-2">
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-xs ${alerts().legacyThresholdsDetected
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                          }`}
-                                      >
-                                        Legacy thresholds{' '}
-                                        {alerts().legacyThresholdsDetected
-                                          ? 'detected'
-                                          : 'migrated'}
-                                      </span>
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-xs ${alerts().missingCooldown
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                          }`}
-                                      >
-                                        Cooldown{' '}
-                                        {alerts().missingCooldown ? 'missing' : 'configured'}
-                                      </span>
-                                      <span
-                                        class={`px-2 py-0.5 rounded text-xs ${alerts().missingGroupingWindow
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                          }`}
-                                      >
-                                        Grouping window{' '}
-                                        {alerts().missingGroupingWindow ? 'disabled' : 'enabled'}
-                                      </span>
-                                    </div>
-                                    <Show
-                                      when={
-                                        alerts().legacyThresholdSources &&
-                                        alerts().legacyThresholdSources!.length > 0
-                                      }
-                                    >
-                                      <div>
-                                        Legacy sources:{' '}
-                                        {alerts().legacyThresholdSources!.join(', ')}
-                                      </div>
-                                    </Show>
-                                    <Show
-                                      when={
-                                        alerts().legacyScheduleSettings &&
-                                        alerts().legacyScheduleSettings!.length > 0
-                                      }
-                                    >
-                                      <div>
-                                        Legacy schedule settings:{' '}
-                                        {alerts().legacyScheduleSettings!.join(', ')}
-                                      </div>
-                                    </Show>
-                                  </div>
-                                  <Show when={alerts().notes && alerts().notes!.length > 0}>
-                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                      <For each={alerts().notes || []}>
-                                        {(note) => <li>{note}</li>}
-                                      </For>
-                                    </ul>
-                                  </Show>
-                                </Card>
-                              )}
-                            </Show>
-
-                            {/* Nodes Status */}
-                            <Show
-                              when={diagnosticsData()?.nodes && diagnosticsData()!.nodes.length > 0}
-                            >
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  PVE Nodes
-                                </h5>
-                                <For each={diagnosticsData()?.nodes || []}>
-                                  {(node) => (
-                                    <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
-                                      <div class="flex justify-between items-center mb-1">
-                                        <span class="font-medium text-gray-700 dark:text-gray-300">
-                                          {node.name}
-                                        </span>
-                                        <span
-                                          class={`px-2 py-0.5 rounded text-white text-xs ${node.connected ? 'bg-green-500' : 'bg-red-500'
-                                            }`}
-                                        >
-                                          {node.connected ? 'Connected' : 'Failed'}
-                                        </span>
-                                      </div>
-                                      <div class="text-gray-600 dark:text-gray-400">
-                                        <div>Host: {node.host}</div>
-                                        <div>Auth: {node.authMethod?.replace('_', ' ')}</div>
-                                        <Show when={node.error}>
-                                          <div class="text-red-500 mt-1 break-words">
-                                            {node.error}
-                                          </div>
-                                        </Show>
-                                      </div>
-                                    </div>
-                                  )}
-                                </For>
-                              </Card>
-                            </Show>
-
-                            {/* PBS Status */}
-                            <Show
-                              when={diagnosticsData()?.pbs && diagnosticsData()!.pbs.length > 0}
-                            >
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  PBS Instances
-                                </h5>
-                                <For each={diagnosticsData()?.pbs || []}>
-                                  {(pbs) => (
-                                    <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
-                                      <div class="flex justify-between items-center mb-1">
-                                        <span class="font-medium text-gray-700 dark:text-gray-300">
-                                          {pbs.name}
-                                        </span>
-                                        <span
-                                          class={`px-2 py-0.5 rounded text-white text-xs ${pbs.connected ? 'bg-green-500' : 'bg-red-500'
-                                            }`}
-                                        >
-                                          {pbs.connected ? 'Connected' : 'Failed'}
-                                        </span>
-                                      </div>
-                                      <Show when={pbs.error}>
-                                        <div class="text-red-500 break-words">{pbs.error}</div>
-                                      </Show>
-                                    </div>
-                                  )}
-                                </For>
-                              </Card>
-                            </Show>
-                          </div>
-                        </Show>
-                      </div>
-                      {/* System Information */}
-                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                          System Information
-                        </h4>
-                        <div class="space-y-2 text-sm">
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Version:</span>
-                            <span class="font-medium">2.0.0</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Backend:</span>
-                            <span class="font-medium">Go 1.21</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Frontend:</span>
-                            <span class="font-medium">SolidJS + TypeScript</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">WebSocket Status:</span>
-                            <span
-                              class={`font-medium ${connected() ? 'text-green-600' : 'text-red-600'}`}
-                            >
-                              {connected() ? 'Connected' : 'Disconnected'}
-                            </span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Server Port:</span>
-                            <span class="font-medium">
-                              {getPulsePort()}
-                            </span>
-                          </div>
-                        </div>
-                      </div>
-
-                      {/* Connection Status */}
-                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                          Connection Status
-                        </h4>
-                        <div class="space-y-2 text-sm">
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">PVE Nodes:</span>
-                            <span class="font-medium">{pveNodes().length}</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">PBS Nodes:</span>
-                            <span class="font-medium">{pbsNodes().length}</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Total VMs:</span>
-                            <span class="font-medium">{state.vms?.length || 0}</span>
-                          </div>
-                          <div class="flex justify-between">
-                            <span class="text-gray-600 dark:text-gray-400">Total Containers:</span>
-                            <span class="font-medium">{state.containers?.length || 0}</span>
-                          </div>
-                        </div>
-                      </div>
-
-                      {/* Export Diagnostics */}
-                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                          Export Diagnostics
-                        </h4>
-                        <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
-                          Export system diagnostics data for troubleshooting
-                        </p>
-
-                        {/* Helper function to sanitize sensitive data */}
-                        {(() => {
-                          const sanitizeForGitHub = (data: Record<string, unknown>) => {
-                            // Deep clone the data
-                            const sanitized = JSON.parse(JSON.stringify(data)) as Record<
-                              string,
-                              unknown
-                            >;
-
-                            const connectionKeyMap = new Map<string, string>();
-                            const instanceKeyMap = new Map<string, string>();
-
-                            const getSanitizedInstance = (instance: string) => {
-                              if (!instance) return instance;
-                              if (instanceKeyMap.has(instance)) {
-                                return instanceKeyMap.get(instance)!;
-                              }
-                              const suffixMatch = instance.match(/\.(lan|local|home|internal)$/);
-                              const suffix = suffixMatch ? suffixMatch[0] : '';
-                              const label = `instance-REDACTED${suffix}`;
-                              instanceKeyMap.set(instance, label);
-                              return label;
-                            };
-
-                            // Sanitize IP addresses (keep first octet for network type identification)
-                            const sanitizeIP = (ip: string) => {
-                              if (!ip) return ip;
-                              const parts = ip.split('.');
-                              if (parts.length === 4) {
-                                return `${parts[0]}.xxx.xxx.xxx`;
-                              }
-                              return 'xxx.xxx.xxx.xxx';
-                            };
-
-                            // Sanitize hostname but keep domain suffix for context
-                            const sanitizeHostname = (hostname: string) => {
-                              if (!hostname) return hostname;
-                              // Keep common suffixes like .lan, .local, .home
-                              const suffixMatch = hostname.match(/\.(lan|local|home|internal)$/);
-                              const suffix = suffixMatch ? suffixMatch[0] : '';
-                              return `node-REDACTED${suffix}`;
-                            };
-                            const sanitizeOptionalHostname = (value?: string) =>
-                              value && value.trim() ? sanitizeHostname(value) : undefined;
-
-                            const sanitizeText = (text: string | undefined) => {
-                              if (!text) return text;
-                              return text
-                                .replace(/https?:\/\/[^"'\s]+/g, 'https://REDACTED')
-                                .replace(/\b\d{1,3}(?:\.\d{1,3}){3}\b/g, 'xxx.xxx.xxx.xxx');
-                            };
-
-                            const sanitizeNotesArray = (notes: unknown) => {
-                              if (!Array.isArray(notes)) return notes;
-                              return notes.map((note) => {
-                                if (typeof note !== 'string') return note;
-                                const sanitizedNote = sanitizeText(note);
-                                return sanitizedNote ?? note;
-                              });
-                            };
-
-                            const sanitizeNodeSnapshots = (
-                              snapshots: Array<Record<string, unknown>>,
-                            ) =>
-                              snapshots.map((snapshot, index: number) => {
-                                const sanitizedSnapshot = { ...snapshot };
-                                const originalNode =
-                                  typeof sanitizedSnapshot.node === 'string'
-                                    ? (sanitizedSnapshot.node as string)
-                                    : '';
-                                if (originalNode) {
-                                  sanitizedSnapshot.node =
-                                    connectionKeyMap.get(originalNode) ||
-                                    sanitizeHostname(originalNode);
-                                }
-
-                                const originalInstance =
-                                  typeof sanitizedSnapshot.instance === 'string'
-                                    ? (sanitizedSnapshot.instance as string)
-                                    : '';
-                                if (originalInstance) {
-                                  sanitizedSnapshot.instance =
-                                    getSanitizedInstance(originalInstance);
-                                }
-
-                                if (
-                                  typeof sanitizedSnapshot.id === 'string' &&
-                                  sanitizedSnapshot.id
-                                ) {
-                                  sanitizedSnapshot.id = `node-snapshot-${index}`;
-                                }
-
-                                return sanitizedSnapshot;
-                              });
-
-                            const sanitizeGuestSnapshots = (
-                              snapshots: Array<Record<string, unknown>>,
-                            ) =>
-                              snapshots.map((snapshot, index: number) => {
-                                const sanitizedSnapshot = { ...snapshot };
-                                const originalNode =
-                                  typeof sanitizedSnapshot.node === 'string'
-                                    ? (sanitizedSnapshot.node as string)
-                                    : '';
-                                if (originalNode) {
-                                  sanitizedSnapshot.node =
-                                    connectionKeyMap.get(originalNode) ||
-                                    sanitizeHostname(originalNode);
-                                }
-
-                                const originalInstance =
-                                  typeof sanitizedSnapshot.instance === 'string'
-                                    ? (sanitizedSnapshot.instance as string)
-                                    : '';
-                                if (originalInstance) {
-                                  sanitizedSnapshot.instance =
-                                    getSanitizedInstance(originalInstance);
-                                }
-
-                                if (typeof sanitizedSnapshot.name === 'string') {
-                                  sanitizedSnapshot.name = 'vm-REDACTED';
-                                }
-
-                                if (typeof sanitizedSnapshot.vmid === 'number') {
-                                  sanitizedSnapshot.vmid = index + 1;
-                                } else if (typeof sanitizedSnapshot.vmid === 'string') {
-                                  sanitizedSnapshot.vmid = `vm-${index + 1}`;
-                                }
-
-                                if (Array.isArray(sanitizedSnapshot.notes)) {
-                                  sanitizedSnapshot.notes = sanitizeNotesArray(
-                                    sanitizedSnapshot.notes,
-                                  );
-                                }
-
-                                return sanitizedSnapshot;
-                              });
-
-                            // Sanitize nodes
-                            if (sanitized.nodes) {
-                              sanitized.nodes = (
-                                sanitized.nodes as Array<Record<string, unknown>>
-                              ).map((node, index: number) => {
-                                const nodeType =
-                                  typeof node.type === 'string' ? (node.type as string) : 'node';
-                                const nodeName =
-                                  typeof node.name === 'string' ? (node.name as string) : '';
-                                const nodeHost =
-                                  typeof node.host === 'string' ? (node.host as string) : '';
-                                const tokenName =
-                                  typeof node.tokenName === 'string'
-                                    ? (node.tokenName as string)
-                                    : undefined;
-                                const clusterName =
-                                  typeof node.clusterName === 'string'
-                                    ? (node.clusterName as string)
-                                    : undefined;
-                                const clusterEndpoints = Array.isArray(node.clusterEndpoints)
-                                  ? (node.clusterEndpoints as Array<Record<string, unknown>>).map(
-                                    (ep, epIndex: number) => ({
-                                      ...ep,
-                                      NodeName: `node-${epIndex + 1}`,
-                                      Host: `node-${epIndex + 1}`,
-                                      IP: sanitizeIP(typeof ep.IP === 'string' ? ep.IP : ''),
-                                    }),
-                                  )
-                                  : node.clusterEndpoints;
-
-                                const sanitizedId = `${nodeType}-${index}`;
-                                connectionKeyMap.set(nodeName, sanitizedId);
-
-                                // Sanitize nested physical disks data if present
-                                const physicalDisks = node.physicalDisks as
-                                  | Record<string, unknown>
-                                  | undefined;
-                                if (physicalDisks && Array.isArray(physicalDisks.nodeResults)) {
-                                  physicalDisks.nodeResults = (
-                                    physicalDisks.nodeResults as Array<Record<string, unknown>>
-                                  ).map((result) => ({
-                                    ...result,
-                                    nodeName: sanitizeHostname(
-                                      typeof result.nodeName === 'string' ? result.nodeName : '',
-                                    ),
-                                    apiResponse:
-                                      sanitizeText(
-                                        typeof result.apiResponse === 'string'
-                                          ? result.apiResponse
-                                          : undefined,
-                                      ) ?? result.apiResponse,
-                                    error:
-                                      sanitizeText(
-                                        typeof result.error === 'string' ? result.error : undefined,
-                                      ) ?? result.error,
-                                  }));
-                                }
-
-                                // Sanitize nested VM disk check data if present
-                                const vmDiskCheck = node.vmDiskCheck as
-                                  | Record<string, unknown>
-                                  | undefined;
-                                if (vmDiskCheck) {
-                                  if (typeof vmDiskCheck.testVMName === 'string') {
-                                    vmDiskCheck.testVMName = 'vm-REDACTED';
-                                  }
-                                  if (typeof vmDiskCheck.testResult === 'string') {
-                                    vmDiskCheck.testResult = sanitizeText(vmDiskCheck.testResult);
-                                  }
-                                  if (Array.isArray(vmDiskCheck.problematicVMs)) {
-                                    vmDiskCheck.problematicVMs = (
-                                      vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
-                                    ).map((problem) => ({
-                                      ...problem,
-                                      name: 'vm-REDACTED',
-                                      issue:
-                                        sanitizeText(
-                                          typeof problem.issue === 'string'
-                                            ? problem.issue
-                                            : undefined,
-                                        ) ?? problem.issue,
-                                    }));
-                                  }
-                                  if (Array.isArray(vmDiskCheck.recommendations)) {
-                                    vmDiskCheck.recommendations = (
-                                      vmDiskCheck.recommendations as Array<string>
-                                    ).map((rec) => sanitizeText(rec) ?? rec);
-                                  }
-                                }
-
-                                return {
-                                  ...node,
-                                  id: sanitizedId,
-                                  name: sanitizeHostname(nodeName),
-                                  host: nodeHost
-                                    ? nodeHost.replace(/https?:\/\/[^:\/]+/, 'https://REDACTED')
-                                    : nodeHost,
-                                  tokenName: tokenName ? 'token-REDACTED' : tokenName,
-                                  clusterName: clusterName ? 'cluster-REDACTED' : clusterName,
-                                  clusterEndpoints,
-                                  physicalDisks,
-                                  vmDiskCheck,
-                                };
-                              });
-                            }
-
-                            if (Array.isArray(sanitized.nodeSnapshots)) {
-                              sanitized.nodeSnapshots = sanitizeNodeSnapshots(
-                                sanitized.nodeSnapshots as Array<Record<string, unknown>>,
-                              );
-                            }
-
-                            if (Array.isArray(sanitized.guestSnapshots)) {
-                              sanitized.guestSnapshots = sanitizeGuestSnapshots(
-                                sanitized.guestSnapshots as Array<Record<string, unknown>>,
-                              );
-                            }
-
-                            if (
-                              sanitized.temperatureProxy &&
-                              typeof sanitized.temperatureProxy === 'object'
-                            ) {
-                              const proxyDiag = sanitized.temperatureProxy as Record<
-                                string,
-                                unknown
-                              >;
-                              if (typeof proxyDiag.socketPath === 'string') {
-                                proxyDiag.socketPath = proxyDiag.socketPath.includes(
-                                  'pulse-sensor-proxy',
-                                )
-                                  ? '/mnt/pulse-proxy/pulse-sensor-proxy.sock'
-                                  : 'proxy-socket';
-                              }
-                              if (Array.isArray(proxyDiag.notes)) {
-                                proxyDiag.notes = sanitizeNotesArray(proxyDiag.notes);
-                              }
-                              if (Array.isArray(proxyDiag.httpProxies)) {
-                                proxyDiag.httpProxies = (
-                                  proxyDiag.httpProxies as Array<Record<string, unknown>>
-                                ).map((entry, index: number) => {
-                                  const sanitizedEntry: TemperatureProxyHTTPStatus = {
-                                    node: sanitizeHostname(
-                                      typeof entry.node === 'string'
-                                        ? (entry.node as string)
-                                        : `http-proxy-${index + 1}`,
-                                    ),
-                                    reachable: Boolean(entry.reachable),
-                                  };
-                                  if (typeof entry.url === 'string') {
-                                    sanitizedEntry.url =
-                                      sanitizeText(entry.url as string) ?? (entry.url as string);
-                                  }
-                                  if (typeof entry.error === 'string') {
-                                    sanitizedEntry.error =
-                                      sanitizeText(entry.error as string) ?? (entry.error as string);
-                                  }
-                                  return sanitizedEntry;
-                                });
-                              }
-                              if (Array.isArray(proxyDiag.socketHostCooldowns)) {
-                                proxyDiag.socketHostCooldowns = (
-                                  proxyDiag.socketHostCooldowns as Array<Record<string, unknown>>
-                                ).map((entry) => {
-                                  const originalNode =
-                                    typeof entry.node === 'string' ? (entry.node as string) : undefined;
-                                  const originalHost =
-                                    typeof entry.host === 'string' ? (entry.host as string) : undefined;
-                                  return {
-                                    node: sanitizeOptionalHostname(originalNode),
-                                    host: sanitizeOptionalHostname(originalHost),
-                                    cooldownUntil:
-                                      typeof entry.cooldownUntil === 'string'
-                                        ? (entry.cooldownUntil as string)
-                                        : undefined,
-                                    secondsRemaining:
-                                      typeof entry.secondsRemaining === 'number'
-                                        ? (entry.secondsRemaining as number)
-                                        : undefined,
-                                    lastError:
-                                      typeof entry.lastError === 'string'
-                                        ? sanitizeText(entry.lastError as string) ?? (entry.lastError as string)
-                                        : undefined,
-                                  };
-                                });
-                              }
-                            }
-
-                            if (sanitized.apiTokens && typeof sanitized.apiTokens === 'object') {
-                              const apiTokens = sanitized.apiTokens as Record<string, unknown>;
-                              const tokenIdMap = new Map<string, string>();
-                              if (Array.isArray(apiTokens.tokens)) {
-                                apiTokens.tokens = (
-                                  apiTokens.tokens as Array<Record<string, unknown>>
-                                ).map((token, tokenIndex: number) => {
-                                  const sanitizedToken = { ...token } as Record<string, unknown>;
-                                  const originalId =
-                                    typeof token.id === 'string' ? (token.id as string) : '';
-                                  const sanitizedId = `token-${tokenIndex + 1}`;
-                                  if (originalId) {
-                                    tokenIdMap.set(originalId, sanitizedId);
-                                  }
-                                  sanitizedToken.id = sanitizedId;
-                                  sanitizedToken.name = sanitizedId;
-                                  if (typeof sanitizedToken.hint === 'string') {
-                                    sanitizedToken.hint = 'token-REDACTED';
-                                  }
-                                  return sanitizedToken;
-                                });
-                              }
-                              if (Array.isArray(apiTokens.usage)) {
-                                apiTokens.usage = (
-                                  apiTokens.usage as Array<Record<string, unknown>>
-                                ).map((usage, usageIndex: number) => {
-                                  const sanitizedUsage = { ...usage } as Record<string, unknown>;
-                                  const originalTokenId =
-                                    typeof usage.tokenId === 'string'
-                                      ? (usage.tokenId as string)
-                                      : '';
-                                  const mappedId =
-                                    tokenIdMap.get(originalTokenId) ?? `token-${usageIndex + 1}`;
-                                  sanitizedUsage.tokenId = mappedId;
-                                  if (Array.isArray(sanitizedUsage.hosts)) {
-                                    sanitizedUsage.hosts = (
-                                      sanitizedUsage.hosts as Array<string>
-                                    ).map((host, hostIndex) =>
-                                      sanitizeHostname(
-                                        typeof host === 'string' ? host : `host-${hostIndex + 1}`,
-                                      ),
-                                    );
-                                  }
-                                  return sanitizedUsage;
-                                });
-                              }
-                              if (Array.isArray(apiTokens.notes)) {
-                                apiTokens.notes = sanitizeNotesArray(apiTokens.notes);
-                              }
-                            }
-
-                            if (
-                              sanitized.dockerAgents &&
-                              typeof sanitized.dockerAgents === 'object'
-                            ) {
-                              const dockerDiag = sanitized.dockerAgents as Record<string, unknown>;
-                              if (Array.isArray(dockerDiag.attention)) {
-                                dockerDiag.attention = (
-                                  dockerDiag.attention as Array<Record<string, unknown>>
-                                ).map((entry, index: number) => {
-                                  const sanitizedEntry = { ...entry };
-                                  sanitizedEntry.hostId = `docker-host-${index + 1}`;
-                                  sanitizedEntry.name = `docker-host-${index + 1}`;
-                                  if (typeof sanitizedEntry.tokenHint === 'string') {
-                                    sanitizedEntry.tokenHint = 'token-REDACTED';
-                                  }
-                                  if (Array.isArray(sanitizedEntry.issues)) {
-                                    sanitizedEntry.issues = sanitizeNotesArray(
-                                      sanitizedEntry.issues,
-                                    );
-                                  }
-                                  return sanitizedEntry;
-                                });
-                              }
-                              if (Array.isArray(dockerDiag.notes)) {
-                                dockerDiag.notes = sanitizeNotesArray(dockerDiag.notes);
-                              }
-                            }
-
-                            if (sanitized.alerts && typeof sanitized.alerts === 'object') {
-                              const alerts = sanitized.alerts as Record<string, unknown>;
-                              if (Array.isArray(alerts.legacyThresholdSources)) {
-                                alerts.legacyThresholdSources = (
-                                  alerts.legacyThresholdSources as string[]
-                                ).map((source) => sanitizeText(source) ?? source);
-                              }
-                              if (Array.isArray(alerts.legacyScheduleSettings)) {
-                                alerts.legacyScheduleSettings = (
-                                  alerts.legacyScheduleSettings as string[]
-                                ).map((setting) => sanitizeText(setting) ?? setting);
-                              }
-                              if (Array.isArray(alerts.notes)) {
-                                alerts.notes = sanitizeNotesArray(alerts.notes);
-                              }
-                            }
-
-                            // Sanitize backend diagnostics (if present)
-                            if (
-                              sanitized.backendDiagnostics &&
-                              typeof sanitized.backendDiagnostics === 'object'
-                            ) {
-                              const backend = sanitized.backendDiagnostics as Record<
-                                string,
-                                unknown
-                              >;
-
-                              if (Array.isArray(backend.nodeSnapshots)) {
-                                backend.nodeSnapshots = sanitizeNodeSnapshots(
-                                  backend.nodeSnapshots as Array<Record<string, unknown>>,
-                                );
-                              }
-
-                              if (Array.isArray(backend.guestSnapshots)) {
-                                backend.guestSnapshots = sanitizeGuestSnapshots(
-                                  backend.guestSnapshots as Array<Record<string, unknown>>,
-                                );
-                              }
-
-                              if (Array.isArray(backend.nodes)) {
-                                backend.nodes = backend.nodes.map((rawNode, index: number) => {
-                                  const node = rawNode as Record<string, unknown>;
-                                  const originalName =
-                                    typeof node.name === 'string' ? node.name : '';
-                                  const sanitizedId = `diagnostic-node-${index}`;
-                                  connectionKeyMap.set(originalName, sanitizedId);
-
-                                  const vmDiskCheck = node.vmDiskCheck as
-                                    | Record<string, unknown>
-                                    | undefined;
-                                  const physicalDisks = node.physicalDisks as
-                                    | Record<string, unknown>
-                                    | undefined;
-
-                                  if (vmDiskCheck) {
-                                    if (typeof vmDiskCheck.testVMName === 'string') {
-                                      vmDiskCheck.testVMName = 'vm-REDACTED';
-                                    }
-                                    if (typeof vmDiskCheck.testResult === 'string') {
-                                      const sanitizedResult = sanitizeText(
-                                        vmDiskCheck.testResult as string,
-                                      );
-                                      vmDiskCheck.testResult =
-                                        sanitizedResult ?? vmDiskCheck.testResult;
-                                    }
-                                    if (Array.isArray(vmDiskCheck.problematicVMs)) {
-                                      vmDiskCheck.problematicVMs = (
-                                        vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
-                                      ).map((problem) => {
-                                        const issueText = sanitizeText(
-                                          typeof problem.issue === 'string'
-                                            ? problem.issue
-                                            : undefined,
-                                        );
-                                        return {
-                                          ...problem,
-                                          name: 'vm-REDACTED',
-                                          issue: issueText ?? problem.issue,
-                                        };
-                                      });
-                                    }
-                                    if (Array.isArray(vmDiskCheck.recommendations)) {
-                                      vmDiskCheck.recommendations = (
-                                        vmDiskCheck.recommendations as Array<string>
-                                      ).map((rec) => sanitizeText(rec) ?? rec);
-                                    }
-                                  }
-
-                                  if (physicalDisks) {
-                                    if (typeof physicalDisks.testResult === 'string') {
-                                      const sanitizedResult = sanitizeText(
-                                        physicalDisks.testResult as string,
-                                      );
-                                      physicalDisks.testResult =
-                                        sanitizedResult ?? physicalDisks.testResult;
-                                    }
-                                    if (Array.isArray(physicalDisks.nodeResults)) {
-                                      physicalDisks.nodeResults = (
-                                        physicalDisks.nodeResults as Array<Record<string, unknown>>
-                                      ).map((result) => ({
-                                        ...result,
-                                        nodeName: sanitizeHostname(
-                                          typeof result.nodeName === 'string'
-                                            ? result.nodeName
-                                            : '',
-                                        ),
-                                        apiResponse:
-                                          sanitizeText(
-                                            typeof result.apiResponse === 'string'
-                                              ? result.apiResponse
-                                              : undefined,
-                                          ) ?? result.apiResponse,
-                                        error:
-                                          sanitizeText(
-                                            typeof result.error === 'string'
-                                              ? result.error
-                                              : undefined,
-                                          ) ?? result.error,
-                                      }));
-                                    }
-                                  }
-
-                                  return {
-                                    ...node,
-                                    id: sanitizedId,
-                                    name: sanitizeHostname(originalName),
-                                    host:
-                                      typeof node.host === 'string'
-                                        ? (node.host as string).replace(
-                                          /https?:\/\/[^:\/]+/,
-                                          'https://REDACTED',
-                                        )
-                                        : node.host,
-                                    error:
-                                      sanitizeText(
-                                        typeof node.error === 'string' ? node.error : undefined,
-                                      ) ?? node.error,
-                                    vmDiskCheck,
-                                    physicalDisks,
-                                  };
-                                });
-                              }
-
-                              if (Array.isArray(backend.pbs)) {
-                                backend.pbs = backend.pbs.map((rawPbs, index: number) => {
-                                  const pbsNode = rawPbs as Record<string, unknown>;
-                                  const originalName =
-                                    typeof pbsNode.name === 'string' ? pbsNode.name : '';
-                                  const sanitizedId = `diagnostic-pbs-${index}`;
-                                  connectionKeyMap.set(originalName, sanitizedId);
-
-                                  return {
-                                    ...pbsNode,
-                                    id: sanitizedId,
-                                    name: sanitizeHostname(originalName),
-                                    host:
-                                      typeof pbsNode.host === 'string'
-                                        ? (pbsNode.host as string).replace(
-                                          /https?:\/\/[^:\/]+/,
-                                          'https://REDACTED',
-                                        )
-                                        : pbsNode.host,
-                                    error:
-                                      sanitizeText(
-                                        typeof pbsNode.error === 'string'
-                                          ? pbsNode.error
-                                          : undefined,
-                                      ) ?? pbsNode.error,
-                                  };
-                                });
-                              }
-                            }
-
-                            // Sanitize storage
-                            if (sanitized.storage) {
-                              sanitized.storage = (
-                                sanitized.storage as Array<Record<string, unknown>>
-                              ).map((s, index: number) => {
-                                const storageNode = typeof s.node === 'string' ? s.node : '';
-                                return {
-                                  ...s,
-                                  id: `storage-${index}`,
-                                  node: sanitizeHostname(storageNode),
-                                  name: `storage-${index}`,
-                                };
-                              });
-                            }
-
-                            // Sanitize backups
-                            const backups = sanitized.backups as
-                              | Record<string, unknown>
-                              | undefined;
-                            if (backups) {
-                              // Sanitize PVE backup tasks
-                              if (Array.isArray(backups.pveBackupTasks)) {
-                                backups.pveBackupTasks = (
-                                  backups.pveBackupTasks as Array<Record<string, unknown>>
-                                ).map((b, index: number) => {
-                                  const backupNode = typeof b.node === 'string' ? b.node : '';
-                                  const backupVmid =
-                                    typeof b.vmid === 'number' ? b.vmid : undefined;
-                                  return {
-                                    ...b,
-                                    node: sanitizeHostname(backupNode),
-                                    storage: `storage-${index}`,
-                                    vmid:
-                                      backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
-                                  };
-                                });
-                              }
-
-                              // Sanitize PVE storage backups
-                              if (Array.isArray(backups.pveStorageBackups)) {
-                                backups.pveStorageBackups = (
-                                  backups.pveStorageBackups as Array<Record<string, unknown>>
-                                ).map((b, index: number) => {
-                                  const backupNode = typeof b.node === 'string' ? b.node : '';
-                                  const backupVmid =
-                                    typeof b.vmid === 'number' ? b.vmid : undefined;
-                                  const volid = typeof b.volid === 'string' ? b.volid : undefined;
-                                  return {
-                                    ...b,
-                                    node: sanitizeHostname(backupNode),
-                                    storage: `storage-${index}`,
-                                    vmid:
-                                      backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
-                                    volid: volid ? 'vol-REDACTED' : volid,
-                                  };
-                                });
-                              }
-
-                              // Sanitize PBS backups
-                              if (Array.isArray(backups.pbsBackups)) {
-                                backups.pbsBackups = (
-                                  backups.pbsBackups as Array<Record<string, unknown>>
-                                ).map((b, index: number) => {
-                                  const backupId =
-                                    typeof b.backupId === 'string' ? b.backupId : undefined;
-                                  const vmName =
-                                    typeof b.vmName === 'string' ? b.vmName : undefined;
-                                  return {
-                                    ...b,
-                                    datastore: `datastore-${index}`,
-                                    backupId: backupId ? `backup-${index}` : backupId,
-                                    vmName: vmName ? 'vm-REDACTED' : vmName,
-                                  };
-                                });
-                              }
-                            }
-
-                            // Sanitize active alerts
-                            const activeAlerts = sanitized.activeAlerts as
-                              | Array<Record<string, unknown>>
-                              | undefined;
-                            if (activeAlerts) {
-                              sanitized.activeAlerts = activeAlerts.map((alert) => {
-                                const alertNode = typeof alert.node === 'string' ? alert.node : '';
-                                const details =
-                                  typeof alert.details === 'string' ? alert.details : undefined;
-                                return {
-                                  ...alert,
-                                  node: sanitizeHostname(alertNode),
-                                  details: details
-                                    ? details.replace(
-                                      /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g,
-                                      'xxx.xxx.xxx.xxx',
-                                    )
-                                    : details,
-                                };
-                              });
-                            }
-
-                            // Sanitize websocket URL
-                            const websocketInfo = sanitized.websocket as
-                              | Record<string, unknown>
-                              | undefined;
-                            if (websocketInfo && typeof websocketInfo.url === 'string') {
-                              websocketInfo.url = websocketInfo.url.replace(
-                                /\/\/[^\/]+/,
-                                '//REDACTED',
-                              );
-                            }
-
-                            if (
-                              sanitized.connectionHealth &&
-                              typeof sanitized.connectionHealth === 'object'
-                            ) {
-                              const newConnectionHealth: Record<string, unknown> = {};
-                              let index = 1;
-                              Object.entries(
-                                sanitized.connectionHealth as Record<string, unknown>,
-                              ).forEach(([key, value]) => {
-                                const mappedKey = connectionKeyMap.get(key) || `resource-${index}`;
-                                newConnectionHealth[mappedKey] = value;
-                                index += 1;
-                              });
-                              sanitized.connectionHealth = newConnectionHealth;
-                            }
-
-                            // Add sanitization notice
-                            sanitized._notice =
-                              'This diagnostic data has been sanitized for sharing on GitHub. IP addresses, hostnames, and tokens have been redacted.';
-
-                            return sanitized;
-                          };
-
-                          const exportDiagnostics = (sanitize: boolean) => {
-                            let diagnostics: Record<string, unknown> = {
-                              timestamp: new Date().toISOString(),
-                              version: '2.1.0',
-                              pulseVersion: state.stats?.version || 'unknown',
-                              environment: {
-                                userAgent: navigator.userAgent,
-                                platform: navigator.platform,
-                                language: navigator.language,
-                                screenResolution: `${window.screen.width}x${window.screen.height}`,
-                                windowSize: `${window.innerWidth}x${window.innerHeight}`,
-                                timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
-                              },
-                              websocket: {
-                                connected: connected(),
-                                url: getPulseWebSocketUrl(),
-                              },
-                              // Include backend diagnostics if available
-                              backendDiagnostics: diagnosticsData() || null,
-                              nodes:
-                                nodes()?.map((n) => ({
-                                  ...n,
-                                  status:
-                                    state.nodes?.find((sn) => sn.id === n.id)?.status || 'unknown',
-                                  online:
-                                    state.nodes?.find((sn) => sn.id === n.id)?.status === 'online',
-                                })) || [],
-                              state: {
-                                nodesCount: state.nodes?.length || 0,
-                                nodesOnline:
-                                  state.nodes?.filter((n) => n.status === 'online').length || 0,
-                                nodesOffline:
-                                  state.nodes?.filter((n) => n.status !== 'online').length || 0,
-                                vmsCount: state.vms?.length || 0,
-                                containersCount: state.containers?.length || 0,
-                                storageCount: state.storage?.length || 0,
-                                physicalDisksCount: state.physicalDisks?.length || 0,
-                                pbsCount: state.pbs?.length || 0,
-                                pbsBackupsCount: pbsBackupsState()?.length || 0,
-                                pveBackups: {
-                                  backupTasksCount: pveBackupsState()?.backupTasks?.length || 0,
-                                  storageBackupsCount:
-                                    pveBackupsState()?.storageBackups?.length || 0,
-                                  guestSnapshotsCount:
-                                    pveBackupsState()?.guestSnapshots?.length || 0,
-                                },
-                              },
-                              // Node status details
-                              nodeStatus:
-                                state.nodes?.map((n) => ({
-                                  id: n.id,
-                                  name: n.name,
-                                  status: n.status,
-                                  online: n.status === 'online',
-                                  cpu: n.cpu,
-                                  memory: n.memory,
-                                  uptime: n.uptime,
-                                  version: n.pveVersion ?? n.kernelVersion,
-                                })) || [],
-                              storage:
-                                state.storage?.map((s) => ({
-                                  id: s.id,
-                                  node: s.node,
-                                  name: s.name,
-                                  type: s.type,
-                                  status: s.status,
-                                  enabled: s.enabled,
-                                  content: s.content,
-                                  shared: s.shared,
-                                  used: s.used,
-                                  total: s.total,
-                                  zfsPool: s.zfsPool
-                                    ? {
-                                      state: s.zfsPool.state,
-                                      readErrors: s.zfsPool.readErrors,
-                                      writeErrors: s.zfsPool.writeErrors,
-                                      checksumErrors: s.zfsPool.checksumErrors,
-                                      deviceCount: s.zfsPool.devices?.length || 0,
-                                    }
-                                    : undefined,
-                                  hasBackups:
-                                    (pveBackupsState()?.storageBackups ?? []).filter(
-                                      (b) => b.storage === s.name,
-                                    ).length > 0,
-                                })) || [],
-                              // Physical disks - critical for troubleshooting
-                              physicalDisks:
-                                state.physicalDisks?.map((d) => ({
-                                  node: d.node,
-                                  device: d.device || d.devPath,
-                                  model: d.model,
-                                  size: d.size,
-                                  type: d.type,
-                                  health: d.health,
-                                  wearout: d.wearout,
-                                  rpm: d.rpm,
-                                  smart: d.smart ?? null,
-                                })) || [],
-                              backups: {
-                                pveBackupTasks: pveBackupsState()?.backupTasks?.slice(0, 10) || [],
-                                pveStorageBackups:
-                                  pveBackupsState()?.storageBackups?.slice(0, 10) || [],
-                                pbsBackups: pbsBackupsState()?.slice(0, 10) || [],
-                              },
-                              connectionHealth: state.connectionHealth || {},
-                              performance: {
-                                lastPollDuration: state.performance?.lastPollDuration || 0,
-                                totalApiCalls: state.performance?.totalApiCalls || 0,
-                                failedApiCalls: state.performance?.failedApiCalls || 0,
-                                apiCallDuration: state.performance?.apiCallDuration || {},
-                              },
-                              activeAlerts: state.activeAlerts?.slice(0, 20) || [],
-                              settings: {},
-                            };
-
-                            if (sanitize) {
-                              diagnostics = sanitizeForGitHub(diagnostics);
-
-                              // Rebuild nodeStatus from sanitized nodes to avoid leaking real names
-                              // Both arrays are built in the same order, so we can match by index
-                              if (
-                                Array.isArray(diagnostics.nodes) &&
-                                Array.isArray(diagnostics.nodeStatus)
-                              ) {
-                                const sanitizedNodes = diagnostics.nodes as Array<
-                                  Record<string, unknown>
-                                >;
-                                const originalNodeStatus = diagnostics.nodeStatus as Array<
-                                  Record<string, unknown>
-                                >;
-
-                                diagnostics.nodeStatus = sanitizedNodes.map(
-                                  (sanitizedNode, index) => {
-                                    // Get corresponding runtime data using same index
-                                    const originalStatus = originalNodeStatus[index];
-
-                                    // Use sanitized node name/id but preserve runtime metrics
-                                    return {
-                                      id: sanitizedNode.id,
-                                      name: sanitizedNode.name, // Already sanitized
-                                      status: originalStatus?.status || 'unknown',
-                                      online: originalStatus?.online || false,
-                                      cpu: originalStatus?.cpu,
-                                      memory: originalStatus?.memory,
-                                      uptime: originalStatus?.uptime,
-                                      version: originalStatus?.version,
-                                    };
-                                  },
-                                );
-                              }
-
-                              // Sanitize storage entries that have nodes arrays or instance fields
-                              if (Array.isArray(diagnostics.storage)) {
-                                diagnostics.storage = (
-                                  diagnostics.storage as Array<Record<string, unknown>>
-                                ).map((storageItem, index) => {
-                                  const sanitizedItem = { ...storageItem };
-
-                                  // Sanitize storage name field (original Proxmox storage name)
-                                  // This field often contains node names (e.g., "pbs-delly")
-                                  if (
-                                    typeof sanitizedItem.storage === 'string' &&
-                                    sanitizedItem.storage
-                                  ) {
-                                    sanitizedItem.storage = `storage-${index}`;
-                                  }
-
-                                  // Sanitize nodes array if present (cluster storage has this)
-                                  if (Array.isArray(sanitizedItem.nodes)) {
-                                    sanitizedItem.nodes = (
-                                      sanitizedItem.nodes as Array<string>
-                                    ).map(() => 'node-REDACTED');
-                                  }
-
-                                  // Sanitize nodeIds array if present
-                                  if (Array.isArray(sanitizedItem.nodeIds)) {
-                                    sanitizedItem.nodeIds = (
-                                      sanitizedItem.nodeIds as Array<string>
-                                    ).map(() => 'node-REDACTED');
-                                  }
-
-                                  // Sanitize instance field if present
-                                  if (
-                                    typeof sanitizedItem.instance === 'string' &&
-                                    sanitizedItem.instance
-                                  ) {
-                                    const instanceMatch = (sanitizedItem.instance as string).match(
-                                      /\.(lan|local|home|internal)$/,
-                                    );
-                                    const suffix = instanceMatch ? instanceMatch[0] : '';
-                                    sanitizedItem.instance = `instance-REDACTED${suffix}`;
-                                  }
-
-                                  return sanitizedItem;
-                                });
-                              }
-
-                              // Sanitize activeAlerts resourceName field
-                              if (Array.isArray(diagnostics.activeAlerts)) {
-                                diagnostics.activeAlerts = (
-                                  diagnostics.activeAlerts as Array<Record<string, unknown>>
-                                ).map((alert, index) => {
-                                  const sanitizedAlert = { ...alert };
-
-                                  // Sanitize resourceName if present
-                                  if (
-                                    typeof sanitizedAlert.resourceName === 'string' &&
-                                    sanitizedAlert.resourceName
-                                  ) {
-                                    const hostnameMatch = (
-                                      sanitizedAlert.resourceName as string
-                                    ).match(/\.(lan|local|home|internal)$/);
-                                    const suffix = hostnameMatch ? hostnameMatch[0] : '';
-                                    sanitizedAlert.resourceName = `resource-REDACTED${suffix}`;
-                                  }
-
-                                  // Sanitize node field if present
-                                  if (
-                                    typeof sanitizedAlert.node === 'string' &&
-                                    sanitizedAlert.node
-                                  ) {
-                                    sanitizedAlert.node = 'node-REDACTED';
-                                  }
-
-                                  // Sanitize instance field if present
-                                  if (
-                                    typeof sanitizedAlert.instance === 'string' &&
-                                    sanitizedAlert.instance
-                                  ) {
-                                    const instanceMatch = (sanitizedAlert.instance as string).match(
-                                      /\.(lan|local|home|internal)$/,
-                                    );
-                                    const suffix = instanceMatch ? instanceMatch[0] : '';
-                                    sanitizedAlert.instance = `instance-REDACTED${suffix}`;
-                                  }
-
-                                  // Sanitize resourceId (e.g., "delly.lan-delly" → "alert-resource-0")
-                                  if (
-                                    typeof sanitizedAlert.resourceId === 'string' &&
-                                    sanitizedAlert.resourceId
-                                  ) {
-                                    sanitizedAlert.resourceId = `alert-resource-${index}`;
-                                  }
-
-                                  // Sanitize id field (e.g., "delly.lan-delly-temperature" → "alert-0-temperature")
-                                  if (typeof sanitizedAlert.id === 'string' && sanitizedAlert.id) {
-                                    // Extract the alert type from the end (e.g., "temperature")
-                                    const idParts = (sanitizedAlert.id as string).split('-');
-                                    const alertType = idParts[idParts.length - 1];
-                                    sanitizedAlert.id = `alert-${index}-${alertType}`;
-                                  }
-
-                                  return sanitizedAlert;
-                                });
-                              }
-                            }
-
-                            const blob = new Blob([JSON.stringify(diagnostics, null, 2)], {
-                              type: 'application/json',
-                            });
-                            const url = URL.createObjectURL(blob);
-                            const a = document.createElement('a');
-                            a.href = url;
-                            const type = sanitize ? 'sanitized' : 'full';
-                            a.download = `pulse-diagnostics-${type}-${new Date().toISOString().split('T')[0]}.json`;
-                            document.body.appendChild(a);
-                            a.click();
-                            document.body.removeChild(a);
-                            URL.revokeObjectURL(url);
-                          };
-
-                          return (
-                            <div class="space-y-3">
-                              <Show when={!diagnosticsData()}>
-                                <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 rounded p-2">
-                                  💡 Run diagnostics first for more comprehensive export data
-                                </div>
-                              </Show>
-                              <div class="flex gap-2">
-                                <button
-                                  type="button"
-                                  onClick={() => exportDiagnostics(false)}
-                                  class="px-4 py-2 text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
-                                >
-                                  Export Full
-                                </button>
-                                <button
-                                  type="button"
-                                  onClick={() => exportDiagnostics(true)}
-                                  class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors"
-                                >
-                                  Export for GitHub
-                                </button>
-                              </div>
-                            </div>
-                          );
-                        })()}
-
-                        <p class="text-xs text-gray-500 dark:text-gray-400 mt-3">
-                          <strong>Export Full:</strong> Complete data for private troubleshooting
-                          <br />
-                          <strong>Export for GitHub:</strong> Sanitized data safe for public sharing
-                        </p>
-                      </div>
-                    </div>
-                  </div>
-                </div>
+                <DiagnosticsPanel />
               </Show>
             </div>
           </div>
-        </Card>
-      </div>
+        </Card >
+      </div >
 
       {/* Delete Node Modal */}
-      <Show when={showDeleteNodeModal()}>
+      < Show when={showDeleteNodeModal()} >
         <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
           <Card padding="lg" class="w-full max-w-lg space-y-5">
             <SectionHeader title={`Remove ${nodePendingDeleteLabel()}`} size="md" class="mb-1" />
@@ -7475,10 +3678,10 @@ const Settings: Component<SettingsProps> = (props) => {
             </div>
           </Card>
         </div>
-      </Show>
+      </Show >
 
       {/* Node Modal - Use separate modals for PVE and PBS to ensure clean state */}
-      <Show when={isNodeModalVisible('pve')}>
+      < Show when={isNodeModalVisible('pve')} >
         <NodeModal
           isOpen={true}
           resetKey={modalResetKey()}
@@ -7547,10 +3750,10 @@ const Settings: Component<SettingsProps> = (props) => {
             }
           }}
         />
-      </Show>
+      </Show >
 
       {/* PBS Node Modal - Separate instance to prevent contamination */}
-      <Show when={isNodeModalVisible('pbs')}>
+      < Show when={isNodeModalVisible('pbs')} >
         <NodeModal
           isOpen={true}
           resetKey={modalResetKey()}
@@ -7618,10 +3821,10 @@ const Settings: Component<SettingsProps> = (props) => {
             }
           }}
         />
-      </Show>
+      </Show >
 
       {/* PMG Node Modal */}
-      <Show when={isNodeModalVisible('pmg')}>
+      < Show when={isNodeModalVisible('pmg')} >
         <NodeModal
           isOpen={true}
           resetKey={modalResetKey()}
@@ -7681,9 +3884,25 @@ const Settings: Component<SettingsProps> = (props) => {
             }
           }}
         />
-      </Show>
+      </Show >
+
+      {/* Update Confirmation Modal */}
+      <UpdateConfirmationModal
+        isOpen={showUpdateConfirmation()}
+        onClose={() => setShowUpdateConfirmation(false)}
+        onConfirm={handleConfirmUpdate}
+        currentVersion={versionInfo()?.version || 'Unknown'}
+        latestVersion={updateInfo()?.latestVersion || ''}
+        plan={updatePlan() || {
+          canAutoUpdate: false,
+          requiresRoot: false,
+          rollbackSupport: false,
+        }}
+        isApplying={isInstallingUpdate()}
+      />
+
       {/* Export Dialog */}
-      <Show when={showExportDialog()}>
+      < Show when={showExportDialog()} >
         <div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50">
           <Card padding="lg" class="max-w-md w-full">
             <SectionHeader title="Export configuration" size="md" class="mb-4" />
@@ -7820,10 +4039,10 @@ const Settings: Component<SettingsProps> = (props) => {
             </div>
           </Card>
         </div>
-      </Show>
+      </Show >
 
       {/* API Token Modal */}
-      <Show when={showApiTokenModal()}>
+      < Show when={showApiTokenModal()} >
         <div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50">
           <Card padding="lg" class="max-w-md w-full">
             <SectionHeader title="API token required" size="md" class="mb-4" />
@@ -7890,10 +4109,10 @@ const Settings: Component<SettingsProps> = (props) => {
             </div>
           </Card>
         </div>
-      </Show>
+      </Show >
 
       {/* Import Dialog */}
-      <Show when={showImportDialog()}>
+      < Show when={showImportDialog()} >
         <div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50">
           <Card padding="lg" class="max-w-md w-full">
             <SectionHeader title="Import configuration" size="md" class="mb-4" />
@@ -7957,7 +4176,7 @@ const Settings: Component<SettingsProps> = (props) => {
             </div>
           </Card>
         </div>
-      </Show>
+      </Show >
 
       <ChangePasswordModal
         isOpen={showPasswordModal()}
diff --git a/frontend-modern/src/components/Settings/UnifiedAgents.tsx b/frontend-modern/src/components/Settings/UnifiedAgents.tsx
index b8c84bf..d161c6d 100644
--- a/frontend-modern/src/components/Settings/UnifiedAgents.tsx
+++ b/frontend-modern/src/components/Settings/UnifiedAgents.tsx
@@ -8,7 +8,7 @@ import { notificationStore } from '@/stores/notifications';
 import type { SecurityStatus } from '@/types/config';
 import type { HostLookupResponse } from '@/types/api';
 import type { APITokenRecord } from '@/api/security';
-import { HOST_AGENT_SCOPE, DOCKER_REPORT_SCOPE } from '@/constants/apiScopes';
+import { HOST_AGENT_SCOPE, DOCKER_REPORT_SCOPE, KUBERNETES_REPORT_SCOPE } from '@/constants/apiScopes';
 import { copyToClipboard } from '@/utils/clipboard';
 import { getPulseBaseUrl } from '@/utils/url';
 import { logger } from '@/utils/logger';
@@ -108,6 +108,8 @@ export const UnifiedAgents: Component = () => {
     const [lookupError, setLookupError] = createSignal<string | null>(null);
     const [lookupLoading, setLookupLoading] = createSignal(false);
     const [enableDocker, setEnableDocker] = createSignal(false); // Default to false - user must opt-in for Docker monitoring
+    const [enableKubernetes, setEnableKubernetes] = createSignal(false); // Default to false - user must opt-in for Kubernetes monitoring
+    const [enableProxmox, setEnableProxmox] = createSignal(false); // For Proxmox VE/PBS nodes - creates API token and auto-registers
     const [insecureMode, setInsecureMode] = createSignal(false); // For self-signed certificates (issue #806)
 
     createEffect(() => {
@@ -182,15 +184,15 @@ export const UnifiedAgents: Component = () => {
         setIsGeneratingToken(true);
         try {
             const desiredName = tokenName().trim() || buildDefaultTokenName();
-            // Generate token with BOTH scopes
-            const scopes = [HOST_AGENT_SCOPE, DOCKER_REPORT_SCOPE];
+            // Generate token with unified agent reporting scopes
+            const scopes = [HOST_AGENT_SCOPE, DOCKER_REPORT_SCOPE, KUBERNETES_REPORT_SCOPE];
             const { token, record } = await SecurityAPI.createToken(desiredName, scopes);
 
             setCurrentToken(token);
             setLatestRecord(record);
             setTokenName('');
             setConfirmedNoToken(false);
-            notificationStore.success('Token generated with Host and Docker permissions.', 4000);
+            notificationStore.success('Token generated with Host, Docker, and Kubernetes permissions.', 4000);
         } catch (err) {
             logger.error('Failed to generate agent token', err);
             notificationStore.error('Failed to generate agent token. Confirm you are signed in as an administrator.', 6000);
@@ -236,6 +238,8 @@ export const UnifiedAgents: Component = () => {
     };
 
     const getDockerFlag = () => enableDocker() ? ' --enable-docker' : '';
+    const getKubernetesFlag = () => enableKubernetes() ? ' --enable-kubernetes' : '';
+    const getProxmoxFlag = () => enableProxmox() ? ' --enable-proxmox' : '';
     const getInsecureFlag = () => insecureMode() ? ' --insecure' : '';
     const getCurlInsecureFlag = () => insecureMode() ? '-k' : '';
 
@@ -342,19 +346,32 @@ export const UnifiedAgents: Component = () => {
     });
     const hasRemovedDockerHosts = createMemo(() => removedDockerHosts().length > 0);
 
+    const kubernetesClusters = createMemo(() => {
+        const clusters = state.kubernetesClusters || [];
+        return clusters.slice().sort((a, b) => (a.displayName || a.name || a.id).localeCompare(b.displayName || b.name || b.id));
+    });
+
+    const removedKubernetesClusters = createMemo(() => {
+        const removed = state.removedKubernetesClusters || [];
+        return removed.sort((a, b) => b.removedAt - a.removedAt);
+    });
+    const hasRemovedKubernetesClusters = createMemo(() => removedKubernetesClusters().length > 0);
+
     const getUpgradeCommand = (_hostname: string) => {
         const token = resolvedToken();
         return `curl ${getCurlInsecureFlag()}-fsSL ${pulseUrl()}/install.sh | sudo bash -s -- --url ${pulseUrl()} --token ${token}${getInsecureFlag()}`;
     };
 
-    const handleRemoveAgent = async (id: string, type: 'host' | 'docker') => {
+    const handleRemoveAgent = async (id: string, type: 'host' | 'docker' | 'kubernetes') => {
         if (!confirm('Are you sure you want to remove this agent? This will stop monitoring but will not uninstall the agent from the remote machine.')) return;
 
         try {
             if (type === 'host') {
                 await MonitoringAPI.deleteHostAgent(id);
-            } else {
+            } else if (type === 'docker') {
                 await MonitoringAPI.deleteDockerHost(id);
+            } else {
+                await MonitoringAPI.deleteKubernetesCluster(id);
             }
             notificationStore.success('Agent removed from Pulse');
         } catch (err) {
@@ -373,6 +390,16 @@ export const UnifiedAgents: Component = () => {
         }
     };
 
+    const handleAllowKubernetesReenroll = async (clusterId: string, name?: string) => {
+        try {
+            await MonitoringAPI.allowKubernetesClusterReenroll(clusterId);
+            notificationStore.success(`Re-enrollment allowed for ${name || clusterId}. Restart the agent to reconnect.`);
+        } catch (err) {
+            logger.error('Failed to allow kubernetes re-enrollment', err);
+            notificationStore.error('Failed to allow kubernetes re-enrollment');
+        }
+    };
+
     return (
         <div class="space-y-6">
             <Card padding="lg" class="space-y-5">
@@ -389,7 +416,7 @@ export const UnifiedAgents: Component = () => {
                             <div class="space-y-1">
                                 <p class="text-sm font-semibold text-gray-900 dark:text-gray-100">Generate API token</p>
                                 <p class="text-sm text-gray-600 dark:text-gray-400">
-                                    Create a fresh token scoped for both Host and Docker monitoring.
+                                    Create a fresh token scoped for Host, Docker, and Kubernetes monitoring.
                                 </p>
                             </div>
 
@@ -451,26 +478,57 @@ export const UnifiedAgents: Component = () => {
 
                     <Show when={commandsUnlocked()}>
                         <div class="space-y-3">
-                            <div class="flex items-center justify-between">
-                                <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Installation commands</h4>
-                                <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer">
-                                    <input
-                                        type="checkbox"
-                                        checked={enableDocker()}
-                                        onChange={(e) => setEnableDocker(e.currentTarget.checked)}
-                                        class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
-                                    />
-                                    Enable Docker monitoring
-                                </label>
-                                <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer" title="Skip TLS certificate verification (for self-signed certificates)">
-                                    <input
-                                        type="checkbox"
-                                        checked={insecureMode()}
-                                        onChange={(e) => setInsecureMode(e.currentTarget.checked)}
-                                        class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
-                                    />
-                                    Skip certificate verification
-                                </label>
+                            <div class="space-y-3">
+                                <div class="flex items-center justify-between">
+                                    <h4 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Installation commands</h4>
+                                    <div class="flex items-center gap-4">
+                                        <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer">
+                                            <input
+                                                type="checkbox"
+                                                checked={enableDocker()}
+                                                onChange={(e) => setEnableDocker(e.currentTarget.checked)}
+                                                class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                                            />
+                                            Docker monitoring
+                                        </label>
+                                        <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer">
+                                            <input
+                                                type="checkbox"
+                                                checked={enableKubernetes()}
+                                                onChange={(e) => setEnableKubernetes(e.currentTarget.checked)}
+                                                class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                                            />
+                                            Kubernetes monitoring
+                                        </label>
+                                        <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer" title="For Proxmox VE/PBS nodes - auto-creates API token and registers the node">
+                                            <input
+                                                type="checkbox"
+                                                checked={enableProxmox()}
+                                                onChange={(e) => setEnableProxmox(e.currentTarget.checked)}
+                                                class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                                            />
+                                            Proxmox setup
+                                        </label>
+                                        <label class="flex items-center gap-2 text-sm text-gray-700 dark:text-gray-300 cursor-pointer" title="Skip TLS certificate verification (for self-signed certificates)">
+                                            <input
+                                                type="checkbox"
+                                                checked={insecureMode()}
+                                                onChange={(e) => setInsecureMode(e.currentTarget.checked)}
+                                                class="rounded border-gray-300 text-blue-600 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-700"
+                                            />
+                                            Skip TLS verify
+                                        </label>
+                                    </div>
+                                </div>
+                                <Show when={enableProxmox()}>
+                                    <div class="rounded-lg border border-blue-200 bg-blue-50 px-4 py-3 text-sm text-blue-800 dark:border-blue-800 dark:bg-blue-900/20 dark:text-blue-200">
+                                        <p class="font-medium">Proxmox auto-setup enabled</p>
+                                        <p class="text-xs mt-1 text-blue-700 dark:text-blue-300">
+                                            The agent will create a <code class="bg-blue-100 dark:bg-blue-900/40 px-1 rounded">pulse-monitor</code> user and API token on the Proxmox node,
+                                            then register it with Pulse automatically. Includes temperature monitoring.
+                                        </p>
+                                    </div>
+                                </Show>
                             </div>
 
                             <div class="space-y-4">
@@ -490,25 +548,30 @@ export const UnifiedAgents: Component = () => {
                                                             if (insecureMode() && cmd.includes('curl -fsSL')) {
                                                                 cmd = cmd.replace('curl -fsSL', 'curl -kfsSL');
                                                             }
+                                                            // For bash scripts (not PowerShell), append flags directly
+                                                            const isBashScript = !cmd.includes('$env:') && !cmd.includes('irm');
                                                             // Append docker flag if enabled
                                                             if (enableDocker()) {
-                                                                // For PowerShell, we need to handle the env var or args differently
                                                                 if (cmd.includes('$env:PULSE_URL')) {
-                                                                    // Env var style: add $env:PULSE_ENABLE_DOCKER="true";
                                                                     cmd = `$env:PULSE_ENABLE_DOCKER="true"; ` + cmd;
-                                                                } else if (cmd.includes('irm')) {
-                                                                    // Simple irm style: no args passed to script directly in this snippet style
-                                                                    // Actually, the simple irm style relies on prompts, so flags don't apply directly unless we change the snippet
-                                                                    // But for the bash script, we append flags
-                                                                    if (!cmd.includes('irm')) {
-                                                                        cmd += getDockerFlag();
-                                                                    }
-                                                                } else {
+                                                                } else if (isBashScript) {
                                                                     cmd += getDockerFlag();
                                                                 }
                                                             }
+                                                            // Append kubernetes flag if enabled
+                                                            if (enableKubernetes()) {
+                                                                if (cmd.includes('$env:PULSE_URL')) {
+                                                                    cmd = `$env:PULSE_ENABLE_KUBERNETES="true"; ` + cmd;
+                                                                } else if (isBashScript) {
+                                                                    cmd += getKubernetesFlag();
+                                                                }
+                                                            }
+                                                            // Append proxmox flag if enabled (Linux only - Proxmox doesn't run on Windows/macOS)
+                                                            if (enableProxmox() && isBashScript) {
+                                                                cmd += getProxmoxFlag();
+                                                            }
                                                             // Append insecure flag for agent if enabled
-                                                            if (insecureMode() && !cmd.includes('$env:') && !cmd.includes('irm')) {
+                                                            if (insecureMode() && isBashScript) {
                                                                 cmd += getInsecureFlag();
                                                             }
                                                             return cmd;
@@ -779,6 +842,68 @@ export const UnifiedAgents: Component = () => {
                 </Card>
             </Card>
 
+            <Card padding="lg" class="space-y-4">
+                <div class="space-y-1">
+                    <h3 class="text-base font-semibold text-gray-900 dark:text-gray-100">Kubernetes Clusters</h3>
+                    <p class="text-sm text-gray-600 dark:text-gray-400">
+                        Kubernetes clusters currently reporting to Pulse.
+                    </p>
+                </div>
+
+                <Card padding="none" tone="glass" class="overflow-hidden rounded-lg">
+                    <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                        <thead class="bg-gray-50 dark:bg-gray-800">
+                            <tr>
+                                <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Cluster</th>
+                                <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Status</th>
+                                <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Version</th>
+                                <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Last Seen</th>
+                                <th scope="col" class="px-4 py-3 text-right text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Actions</th>
+                            </tr>
+                        </thead>
+                        <tbody class="divide-y divide-gray-200 bg-white dark:divide-gray-700 dark:bg-gray-900">
+                            <For each={kubernetesClusters()} fallback={
+                                <tr>
+                                    <td colspan="5" class="px-4 py-8 text-center text-sm text-gray-500 dark:text-gray-400">
+                                        No Kubernetes clusters reporting yet.
+                                    </td>
+                                </tr>
+                            }>
+                                {(cluster) => (
+                                    <tr>
+                                        <td class="whitespace-nowrap px-4 py-3 text-sm font-medium text-gray-900 dark:text-gray-100">
+                                            {cluster.customDisplayName || cluster.displayName || cluster.name || cluster.id}
+                                        </td>
+                                        <td class="whitespace-nowrap px-4 py-3 text-sm">
+                                            <span class={`inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${connectedFromStatus(cluster.status)
+                                                ? 'bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-300'
+                                                : 'bg-gray-100 text-gray-800 dark:bg-gray-700 dark:text-gray-300'
+                                                }`}>
+                                                {cluster.status}
+                                            </span>
+                                        </td>
+                                        <td class="whitespace-nowrap px-4 py-3 text-sm text-gray-500 dark:text-gray-400">
+                                            {cluster.version || cluster.agentVersion || '—'}
+                                        </td>
+                                        <td class="whitespace-nowrap px-4 py-3 text-sm text-gray-500 dark:text-gray-400">
+                                            {cluster.lastSeen ? formatRelativeTime(cluster.lastSeen) : '—'}
+                                        </td>
+                                        <td class="whitespace-nowrap px-4 py-3 text-right text-sm font-medium">
+                                            <button
+                                                onClick={() => handleRemoveAgent(cluster.id, 'kubernetes')}
+                                                class="text-red-600 hover:text-red-900 dark:text-red-400 dark:hover:text-red-300"
+                                            >
+                                                Remove
+                                            </button>
+                                        </td>
+                                    </tr>
+                                )}
+                            </For>
+                        </tbody>
+                    </table>
+                </Card>
+            </Card>
+
             <Show when={hasRemovedDockerHosts()}>
                 <Card padding="lg" class="space-y-4">
                     <div class="space-y-1">
@@ -827,6 +952,55 @@ export const UnifiedAgents: Component = () => {
                     </Card>
                 </Card>
             </Show>
+
+            <Show when={hasRemovedKubernetesClusters()}>
+                <Card padding="lg" class="space-y-4">
+                    <div class="space-y-1">
+                        <h3 class="text-base font-semibold text-gray-900 dark:text-gray-100">Removed Kubernetes Clusters</h3>
+                        <p class="text-sm text-gray-600 dark:text-gray-400">
+                            Kubernetes clusters that were removed and are blocked from re-enrolling. Allow re-enrollment to let them report again.
+                        </p>
+                    </div>
+
+                    <Card padding="none" tone="glass" class="overflow-hidden rounded-lg">
+                        <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-700">
+                            <thead class="bg-gray-50 dark:bg-gray-800">
+                                <tr>
+                                    <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Cluster</th>
+                                    <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Cluster ID</th>
+                                    <th scope="col" class="px-4 py-3 text-left text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Removed</th>
+                                    <th scope="col" class="px-4 py-3 text-right text-xs font-medium uppercase tracking-wider text-gray-500 dark:text-gray-400">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-y divide-gray-200 bg-white dark:divide-gray-700 dark:bg-gray-900">
+                                <For each={removedKubernetesClusters()}>
+                                    {(cluster) => (
+                                        <tr>
+                                            <td class="whitespace-nowrap px-4 py-3 text-sm font-medium text-gray-900 dark:text-gray-100">
+                                                {cluster.displayName || cluster.name || 'Unknown'}
+                                            </td>
+                                            <td class="whitespace-nowrap px-4 py-3 text-sm text-gray-500 dark:text-gray-400 font-mono text-xs">
+                                                {cluster.id.slice(0, 8)}...
+                                            </td>
+                                            <td class="whitespace-nowrap px-4 py-3 text-sm text-gray-500 dark:text-gray-400">
+                                                {formatRelativeTime(cluster.removedAt)}
+                                            </td>
+                                            <td class="whitespace-nowrap px-4 py-3 text-right text-sm font-medium">
+                                                <button
+                                                    onClick={() => handleAllowKubernetesReenroll(cluster.id, cluster.displayName || cluster.name)}
+                                                    class="text-blue-600 hover:text-blue-900 dark:text-blue-400 dark:hover:text-blue-300"
+                                                >
+                                                    Allow re-enroll
+                                                </button>
+                                            </td>
+                                        </tr>
+                                    )}
+                                </For>
+                            </tbody>
+                        </table>
+                    </Card>
+                </Card>
+            </Show>
         </div >
     );
 };
diff --git a/frontend-modern/src/components/Settings/UpdatesSettingsPanel.tsx b/frontend-modern/src/components/Settings/UpdatesSettingsPanel.tsx
new file mode 100644
index 0000000..daf72ad
--- /dev/null
+++ b/frontend-modern/src/components/Settings/UpdatesSettingsPanel.tsx
@@ -0,0 +1,654 @@
+import { Component, Show, Accessor, Setter } from 'solid-js';
+import { Card } from '@/components/shared/Card';
+import { SectionHeader } from '@/components/shared/SectionHeader';
+import RefreshCw from 'lucide-solid/icons/refresh-cw';
+import CheckCircle from 'lucide-solid/icons/check-circle';
+import ArrowRight from 'lucide-solid/icons/arrow-right';
+import Package from 'lucide-solid/icons/package';
+import Download from 'lucide-solid/icons/download';
+import type { UpdateInfo, VersionInfo, UpdatePlan } from '@/api/updates';
+
+interface UpdatesSettingsPanelProps {
+  versionInfo: Accessor<VersionInfo | null>;
+  updateInfo: Accessor<UpdateInfo | null>;
+  checkingForUpdates: Accessor<boolean>;
+  updateChannel: Accessor<'stable' | 'rc'>;
+  setUpdateChannel: Setter<'stable' | 'rc'>;
+  autoUpdateEnabled: Accessor<boolean>;
+  setAutoUpdateEnabled: Setter<boolean>;
+  autoUpdateCheckInterval: Accessor<number>;
+  setAutoUpdateCheckInterval: Setter<number>;
+  autoUpdateTime: Accessor<string>;
+  setAutoUpdateTime: Setter<string>;
+  checkForUpdates: () => Promise<void>;
+  setHasUnsavedChanges: Setter<boolean>;
+  // Update installation props
+  updatePlan: Accessor<UpdatePlan | null>;
+  onInstallUpdate: () => void;
+  isInstalling: Accessor<boolean>;
+}
+
+export const UpdatesSettingsPanel: Component<UpdatesSettingsPanelProps> = (props) => {
+  return (
+    <div class="space-y-6">
+      <Card
+        padding="none"
+        class="overflow-hidden border border-gray-200 dark:border-gray-700"
+        border={false}
+      >
+        {/* Header */}
+        <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+          <div class="flex items-center gap-3">
+            <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+              <RefreshCw class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+            </div>
+            <SectionHeader
+              title="Updates"
+              description="Version checking and automatic update configuration"
+              size="sm"
+              class="flex-1"
+            />
+          </div>
+        </div>
+
+        <div class="p-6 space-y-6">
+          <section class="space-y-4">
+            <div class="space-y-4">
+              {/* Version Status Section */}
+              <div class="rounded-xl border border-gray-200 dark:border-gray-700 overflow-hidden">
+                {/* Version Grid */}
+                <div class={`grid gap-px ${props.updateInfo()?.available ? 'sm:grid-cols-3' : 'sm:grid-cols-2'}`}>
+                  {/* Current Version */}
+                  <div class="bg-gray-50 dark:bg-gray-800/60 p-4">
+                    <div class="flex items-start gap-3">
+                      <div class="p-2 bg-blue-100 dark:bg-blue-900/50 rounded-lg">
+                        <Package class="w-5 h-5 text-blue-600 dark:text-blue-400" />
+                      </div>
+                      <div class="flex-1 min-w-0">
+                        <p class="text-xs font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                          Current Version
+                        </p>
+                        <p class="mt-1 text-lg font-bold text-gray-900 dark:text-gray-100 truncate">
+                          {props.versionInfo()?.version || 'Loading...'}
+                        </p>
+                        <div class="mt-1.5 flex flex-wrap items-center gap-1.5">
+                          <Show when={props.versionInfo()?.isDevelopment}>
+                            <span class="inline-flex items-center px-2 py-0.5 text-[10px] font-medium rounded-full bg-amber-100 text-amber-700 dark:bg-amber-900/50 dark:text-amber-300">
+                              Development
+                            </span>
+                          </Show>
+                          <Show when={props.versionInfo()?.isDocker}>
+                            <span class="inline-flex items-center px-2 py-0.5 text-[10px] font-medium rounded-full bg-blue-100 text-blue-700 dark:bg-blue-900/50 dark:text-blue-300">
+                              Docker
+                            </span>
+                          </Show>
+                          <Show when={props.versionInfo()?.isSourceBuild}>
+                            <span class="inline-flex items-center px-2 py-0.5 text-[10px] font-medium rounded-full bg-purple-100 text-purple-700 dark:bg-purple-900/50 dark:text-purple-300">
+                              Source
+                            </span>
+                          </Show>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+
+                  {/* Update Status / Arrow */}
+                  <Show when={props.updateInfo()?.available}>
+                    <div class="bg-gradient-to-r from-green-50 to-emerald-50 dark:from-green-900/30 dark:to-emerald-900/30 p-4 flex items-center justify-center">
+                      <div class="flex flex-col items-center gap-1.5">
+                        <div class="flex items-center gap-2 text-green-600 dark:text-green-400">
+                          <ArrowRight class="w-5 h-5" />
+                        </div>
+                        <span class="text-xs font-semibold text-green-700 dark:text-green-300 uppercase tracking-wide">
+                          Update Ready
+                        </span>
+                      </div>
+                    </div>
+                  </Show>
+
+                  {/* Latest Version / Status */}
+                  <div class={`p-4 ${props.updateInfo()?.available
+                    ? 'bg-gradient-to-br from-green-50 to-emerald-50 dark:from-green-900/20 dark:to-emerald-900/20'
+                    : 'bg-gray-50 dark:bg-gray-800/60'
+                    }`}>
+                    <div class="flex items-start gap-3">
+                      <div class={`p-2 rounded-lg ${props.updateInfo()?.available
+                        ? 'bg-green-100 dark:bg-green-900/50'
+                        : 'bg-gray-100 dark:bg-gray-700'
+                        }`}>
+                        <Show when={props.updateInfo()?.available} fallback={
+                          <CheckCircle class="w-5 h-5 text-gray-500 dark:text-gray-400" />
+                        }>
+                          <CheckCircle class="w-5 h-5 text-green-600 dark:text-green-400" />
+                        </Show>
+                      </div>
+                      <div class="flex-1 min-w-0">
+                        <p class="text-xs font-medium uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                          {props.updateInfo()?.available ? 'Available' : 'Status'}
+                        </p>
+                        <Show when={props.updateInfo()?.available} fallback={
+                          <p class="mt-1 text-lg font-bold text-gray-900 dark:text-gray-100">
+                            Up to date
+                          </p>
+                        }>
+                          <p class="mt-1 text-lg font-bold text-green-700 dark:text-green-300">
+                            {props.updateInfo()?.latestVersion}
+                          </p>
+                          <Show when={props.updateInfo()?.releaseDate}>
+                            <p class="mt-0.5 text-xs text-green-600 dark:text-green-400">
+                              Released {new Date(props.updateInfo()!.releaseDate).toLocaleDateString()}
+                            </p>
+                          </Show>
+                        </Show>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+
+                {/* Check for updates button */}
+                <div class="bg-white dark:bg-gray-900/50 border-t border-gray-200 dark:border-gray-700 px-4 py-3 flex items-center justify-between">
+                  <p class="text-xs text-gray-500 dark:text-gray-400">
+                    <Show when={props.autoUpdateEnabled()}>
+                      Auto-check enabled
+                    </Show>
+                    <Show when={!props.autoUpdateEnabled()}>
+                      Manual checks only
+                    </Show>
+                  </p>
+                  <button
+                    type="button"
+                    onClick={props.checkForUpdates}
+                    disabled={
+                      props.checkingForUpdates() ||
+                      props.versionInfo()?.isDocker ||
+                      props.versionInfo()?.isSourceBuild
+                    }
+                    class={`px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-2 ${props.versionInfo()?.isDocker || props.versionInfo()?.isSourceBuild
+                      ? 'bg-gray-100 dark:bg-gray-700 text-gray-400 dark:text-gray-500 cursor-not-allowed'
+                      : 'bg-blue-600 text-white hover:bg-blue-700'
+                      }`}
+                  >
+                    {props.checkingForUpdates() ? (
+                      <>
+                        <div class="animate-spin h-4 w-4 border-2 border-white border-t-transparent rounded-full"></div>
+                        Checking...
+                      </>
+                    ) : (
+                      <>
+                        <RefreshCw class="w-4 h-4" />
+                        Check Now
+                      </>
+                    )}
+                  </button>
+                </div>
+              </div>
+
+              {/* Docker installation notice */}
+              <Show when={props.versionInfo()?.isDocker && !props.updateInfo()?.available}>
+                <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
+                  <p class="text-xs text-blue-800 dark:text-blue-200">
+                    <strong>Docker Installation:</strong> Updates are managed through Docker. Pull
+                    the latest image to update.
+                  </p>
+                </div>
+              </Show>
+
+              {/* Source build notice */}
+              <Show when={props.versionInfo()?.isSourceBuild}>
+                <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
+                  <p class="text-xs text-blue-800 dark:text-blue-200">
+                    <strong>Built from source:</strong> Pull the latest code from git and rebuild to
+                    update.
+                  </p>
+                </div>
+              </Show>
+
+              {/* Warning message */}
+              <Show when={Boolean(props.updateInfo()?.warning)}>
+                <div class="p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded-lg">
+                  <p class="text-xs text-amber-800 dark:text-amber-200">
+                    {props.updateInfo()?.warning}
+                  </p>
+                </div>
+              </Show>
+
+              {/* Update available */}
+              <Show when={props.updateInfo()?.available}>
+                <div class="rounded-xl border border-green-200 dark:border-green-700 overflow-hidden bg-gradient-to-br from-green-50 to-emerald-50 dark:from-green-900/20 dark:to-emerald-900/10">
+                  {/* Header */}
+                  <div class="px-5 py-4 border-b border-green-200 dark:border-green-800/50 bg-gradient-to-r from-green-100/80 to-emerald-100/50 dark:from-green-900/40 dark:to-emerald-900/30">
+                    <div class="flex items-center justify-between gap-3">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-gradient-to-br from-green-500 to-emerald-600 rounded-lg shadow-lg shadow-green-500/20">
+                          <svg class="w-5 h-5 text-white" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12" />
+                          </svg>
+                        </div>
+                        <div>
+                          <h4 class="text-base font-semibold text-green-900 dark:text-green-100">
+                            Update Available
+                          </h4>
+                          <p class="text-xs text-green-700 dark:text-green-300">
+                            Version {props.updateInfo()?.latestVersion} is ready to install
+                          </p>
+                        </div>
+                      </div>
+
+                      {/* Automated Install Button */}
+                      <Show when={props.updatePlan()?.canAutoUpdate}>
+                        <button
+                          type="button"
+                          onClick={props.onInstallUpdate}
+                          disabled={props.isInstalling()}
+                          class={`px-4 py-2.5 rounded-lg text-sm font-medium transition-all flex items-center gap-2 ${props.isInstalling()
+                              ? 'bg-green-400 dark:bg-green-600 text-white cursor-not-allowed'
+                              : 'bg-gradient-to-r from-green-600 to-emerald-600 hover:from-green-700 hover:to-emerald-700 text-white shadow-lg shadow-green-500/25 hover:shadow-green-500/40'
+                            }`}
+                        >
+                          <Show when={props.isInstalling()} fallback={
+                            <>
+                              <Download class="w-4 h-4" />
+                              Install Update
+                            </>
+                          }>
+                            <div class="animate-spin h-4 w-4 border-2 border-white border-t-transparent rounded-full"></div>
+                            Installing...
+                          </Show>
+                        </button>
+                      </Show>
+                    </div>
+                  </div>
+
+                  {/* Installation Steps */}
+                  <div class="p-5 space-y-4">
+                    {/* Manual Steps Header */}
+                    <Show when={!props.updatePlan()?.canAutoUpdate}>
+                      <div class="text-sm font-medium text-green-800 dark:text-green-200 mb-3">
+                        Follow these steps to update manually:
+                      </div>
+                    </Show>
+
+                    <Show when={props.updatePlan()?.canAutoUpdate}>
+                      <div class="text-sm text-green-700 dark:text-green-300 mb-3">
+                        Click "Install Update" above for automatic installation, or update manually:
+                      </div>
+                    </Show>
+
+                    {/* ProxmoxVE LXC Installation */}
+                    <Show when={props.versionInfo()?.deploymentType === 'proxmoxve'}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">1</span>
+                          Open your Pulse LXC console
+                        </div>
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">2</span>
+                          Run the update command:
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            update
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('update')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+                        <p class="ml-8 text-xs text-green-600 dark:text-green-400">
+                          The script will automatically download and install the latest version.
+                        </p>
+                      </div>
+                    </Show>
+
+                    {/* Docker Installation */}
+                    <Show when={props.versionInfo()?.deploymentType === 'docker' || (!props.versionInfo()?.deploymentType && props.versionInfo()?.isDocker)}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">1</span>
+                          Pull the latest image
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            docker pull rcourtman/pulse:latest
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('docker pull rcourtman/pulse:latest')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">2</span>
+                          Restart the container
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            docker restart pulse
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('docker restart pulse')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+                        <p class="ml-8 text-xs text-green-600 dark:text-green-400">
+                          Or use Docker Compose: <code class="px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">docker-compose pull && docker-compose up -d</code>
+                        </p>
+                      </div>
+                    </Show>
+
+                    {/* Systemd/Manual Installation */}
+                    <Show when={props.versionInfo()?.deploymentType === 'systemd' || props.versionInfo()?.deploymentType === 'manual'}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">1</span>
+                          Stop the service
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            sudo systemctl stop pulse
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('sudo systemctl stop pulse')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">2</span>
+                          Download and extract the new version
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700 whitespace-pre-wrap break-all">
+                            {`curl -LO https://github.com/rcourtman/Pulse/releases/download/${props.updateInfo()?.latestVersion}/pulse-${props.updateInfo()?.latestVersion}-linux-amd64.tar.gz
+sudo tar -xzf pulse-${props.updateInfo()?.latestVersion}-linux-amd64.tar.gz -C /usr/local/bin pulse`}
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText(`curl -LO https://github.com/rcourtman/Pulse/releases/download/${props.updateInfo()?.latestVersion}/pulse-${props.updateInfo()?.latestVersion}-linux-amd64.tar.gz\nsudo tar -xzf pulse-${props.updateInfo()?.latestVersion}-linux-amd64.tar.gz -C /usr/local/bin pulse`)}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">3</span>
+                          Start the service
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            sudo systemctl start pulse
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('sudo systemctl start pulse')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+                      </div>
+                    </Show>
+
+                    {/* Development Installation */}
+                    <Show when={props.versionInfo()?.deploymentType === 'development'}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">1</span>
+                          Pull the latest changes
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            git pull origin main
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('git pull origin main')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+
+                        <div class="flex items-center gap-2 text-sm font-medium text-green-800 dark:text-green-200">
+                          <span class="flex items-center justify-center w-6 h-6 rounded-full bg-green-200 dark:bg-green-800 text-xs font-bold text-green-700 dark:text-green-300">2</span>
+                          Rebuild and restart
+                        </div>
+                        <div class="ml-8 relative group">
+                          <code class="block p-3 bg-gray-900 dark:bg-gray-950 rounded-lg text-sm font-mono text-green-400 border border-gray-700">
+                            make build && make run
+                          </code>
+                          <button
+                            type="button"
+                            onClick={() => navigator.clipboard.writeText('make build && make run')}
+                            class="absolute top-2 right-2 p-1.5 rounded bg-gray-700 hover:bg-gray-600 text-gray-300 opacity-0 group-hover:opacity-100 transition-opacity"
+                            title="Copy to clipboard"
+                          >
+                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                              <path stroke-linecap="round" stroke-linejoin="round" d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
+                            </svg>
+                          </button>
+                        </div>
+                      </div>
+                    </Show>
+                  </div>
+
+                  {/* Release notes footer */}
+                  <Show when={props.updateInfo()?.releaseNotes}>
+                    <div class="px-5 py-3 border-t border-green-200 dark:border-green-800/50 bg-white/50 dark:bg-gray-900/30">
+                      <details class="group">
+                        <summary class="flex items-center gap-2 text-sm font-medium text-green-700 dark:text-green-300 cursor-pointer hover:text-green-800 dark:hover:text-green-200 transition-colors">
+                          <svg class="w-4 h-4 transition-transform group-open:rotate-90" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                            <path stroke-linecap="round" stroke-linejoin="round" d="M9 5l7 7-7 7" />
+                          </svg>
+                          View Release Notes
+                        </summary>
+                        <pre class="mt-3 p-4 text-xs text-gray-700 dark:text-gray-300 whitespace-pre-wrap font-mono bg-gray-100 dark:bg-gray-800 rounded-lg border border-gray-200 dark:border-gray-700 max-h-64 overflow-y-auto">
+                          {props.updateInfo()?.releaseNotes}
+                        </pre>
+                      </details>
+                    </div>
+                  </Show>
+                </div>
+              </Show>
+
+              {/* Update settings */}
+              <div class="border-t border-gray-200 dark:border-gray-700 pt-6 space-y-5">
+                <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+                  <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.065 2.572c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.572 1.065c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.065-2.572c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z" />
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+                  </svg>
+                  Update Preferences
+                </h4>
+
+                {/* Update Channel */}
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
+                  <button
+                    type="button"
+                    onClick={() => {
+                      props.setUpdateChannel('stable');
+                      props.setHasUnsavedChanges(true);
+                    }}
+                    disabled={props.versionInfo()?.isDocker}
+                    class={`p-4 rounded-xl border-2 transition-all text-left disabled:opacity-50 disabled:cursor-not-allowed ${props.updateChannel() === 'stable'
+                      ? 'border-green-500 bg-green-50 dark:bg-green-900/20'
+                      : 'border-gray-200 dark:border-gray-700 hover:border-gray-300 dark:hover:border-gray-600'
+                      }`}
+                  >
+                    <div class="flex items-center gap-3">
+                      <div class={`p-2 rounded-lg ${props.updateChannel() === 'stable'
+                        ? 'bg-green-100 dark:bg-green-900/40'
+                        : 'bg-gray-100 dark:bg-gray-800'
+                        }`}>
+                        <svg class={`w-5 h-5 ${props.updateChannel() === 'stable'
+                          ? 'text-green-600 dark:text-green-400'
+                          : 'text-gray-500 dark:text-gray-400'
+                          }`} fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
+                        </svg>
+                      </div>
+                      <div>
+                        <p class={`text-sm font-semibold ${props.updateChannel() === 'stable'
+                          ? 'text-green-900 dark:text-green-100'
+                          : 'text-gray-900 dark:text-gray-100'
+                          }`}>Stable</p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400">
+                          Production-ready releases
+                        </p>
+                      </div>
+                    </div>
+                  </button>
+
+                  <button
+                    type="button"
+                    onClick={() => {
+                      props.setUpdateChannel('rc');
+                      props.setHasUnsavedChanges(true);
+                    }}
+                    disabled={props.versionInfo()?.isDocker}
+                    class={`p-4 rounded-xl border-2 transition-all text-left disabled:opacity-50 disabled:cursor-not-allowed ${props.updateChannel() === 'rc'
+                      ? 'border-purple-500 bg-purple-50 dark:bg-purple-900/20'
+                      : 'border-gray-200 dark:border-gray-700 hover:border-gray-300 dark:hover:border-gray-600'
+                      }`}
+                  >
+                    <div class="flex items-center gap-3">
+                      <div class={`p-2 rounded-lg ${props.updateChannel() === 'rc'
+                        ? 'bg-purple-100 dark:bg-purple-900/40'
+                        : 'bg-gray-100 dark:bg-gray-800'
+                        }`}>
+                        <svg class={`w-5 h-5 ${props.updateChannel() === 'rc'
+                          ? 'text-purple-600 dark:text-purple-400'
+                          : 'text-gray-500 dark:text-gray-400'
+                          }`} fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                          <path stroke-linecap="round" stroke-linejoin="round" d="M19.428 15.428a2 2 0 00-1.022-.547l-2.387-.477a6 6 0 00-3.86.517l-.318.158a6 6 0 01-3.86.517L6.05 15.21a2 2 0 00-1.806.547M8 4h8l-1 1v5.172a2 2 0 00.586 1.414l5 5c1.26 1.26.367 3.414-1.415 3.414H4.828c-1.782 0-2.674-2.154-1.414-3.414l5-5A2 2 0 009 10.172V5L8 4z" />
+                        </svg>
+                      </div>
+                      <div>
+                        <p class={`text-sm font-semibold ${props.updateChannel() === 'rc'
+                          ? 'text-purple-900 dark:text-purple-100'
+                          : 'text-gray-900 dark:text-gray-100'
+                          }`}>Release Candidate</p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400">
+                          Preview upcoming features
+                        </p>
+                      </div>
+                    </div>
+                  </button>
+                </div>
+
+                {/* Auto Update Toggle */}
+                <div class="p-4 rounded-xl border border-gray-200 dark:border-gray-700 bg-gray-50/50 dark:bg-gray-800/30">
+                  <div class="flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">
+                    <div class="flex items-center gap-3">
+                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                        <svg class="w-5 h-5 text-blue-600 dark:text-blue-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                          <path stroke-linecap="round" stroke-linejoin="round" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+                        </svg>
+                      </div>
+                      <div>
+                        <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                          Automatic Update Checks
+                        </label>
+                        <p class="text-xs text-gray-600 dark:text-gray-400">
+                          Periodically check for new versions (installation is always manual)
+                        </p>
+                      </div>
+                    </div>
+                    <label class="relative inline-flex items-center cursor-pointer">
+                      <input
+                        type="checkbox"
+                        checked={props.autoUpdateEnabled()}
+                        onChange={(e) => {
+                          props.setAutoUpdateEnabled(e.currentTarget.checked);
+                          props.setHasUnsavedChanges(true);
+                        }}
+                        disabled={props.versionInfo()?.isDocker}
+                        class="sr-only peer"
+                      />
+                      <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
+                    </label>
+                  </div>
+
+                  {/* Auto update options (shown when enabled) */}
+                  <Show when={props.autoUpdateEnabled()}>
+                    <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700 grid grid-cols-1 sm:grid-cols-2 gap-4">
+                      {/* Check Interval */}
+                      <div class="space-y-2">
+                        <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                          Check Interval
+                        </label>
+                        <select
+                          value={props.autoUpdateCheckInterval()}
+                          onChange={(e) => {
+                            props.setAutoUpdateCheckInterval(parseInt(e.currentTarget.value));
+                            props.setHasUnsavedChanges(true);
+                          }}
+                          class="w-full px-3 py-2 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
+                        >
+                          <option value="6">Every 6 hours</option>
+                          <option value="12">Every 12 hours</option>
+                          <option value="24">Daily</option>
+                          <option value="168">Weekly</option>
+                        </select>
+                      </div>
+
+                      {/* Check Time */}
+                      <div class="space-y-2">
+                        <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                          Preferred Time
+                        </label>
+                        <input
+                          type="time"
+                          value={props.autoUpdateTime()}
+                          onChange={(e) => {
+                            props.setAutoUpdateTime(e.currentTarget.value);
+                            props.setHasUnsavedChanges(true);
+                          }}
+                          class="w-full px-3 py-2 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
+                        />
+                      </div>
+                    </div>
+                  </Show>
+                </div>
+              </div>
+            </div>
+          </section>
+        </div>
+      </Card>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/Settings/__tests__/UnifiedAgents.test.tsx b/frontend-modern/src/components/Settings/__tests__/UnifiedAgents.test.tsx
index e3f6c02..c54492a 100644
--- a/frontend-modern/src/components/Settings/__tests__/UnifiedAgents.test.tsx
+++ b/frontend-modern/src/components/Settings/__tests__/UnifiedAgents.test.tsx
@@ -177,7 +177,7 @@ describe('UnifiedAgents token generation', () => {
       { interval: 0 },
     );
     expect(notificationSuccessMock).toHaveBeenCalledWith(
-      'Token generated with Host and Docker permissions.',
+      'Token generated with Host, Docker, and Kubernetes permissions.',
       4000,
     );
   });
@@ -379,15 +379,15 @@ describe('UnifiedAgents platform commands', () => {
     const generateButton = screen.getByRole('button', { name: /Generate token/i });
     fireEvent.click(generateButton);
 
-    await waitFor(() => expect(createTokenMock).toHaveBeenCalled(), { interval: 0 });
+	    await waitFor(() => expect(createTokenMock).toHaveBeenCalled(), { interval: 0 });
 
-    await waitFor(() => {
-      expect(screen.getByText('Enable Docker monitoring')).toBeInTheDocument();
-    });
+	    await waitFor(() => {
+	      expect(screen.getByText('Docker monitoring')).toBeInTheDocument();
+	    });
 
-    // Docker monitoring is disabled by default
-    const checkbox = screen.getByRole('checkbox', { name: /Enable Docker monitoring/i });
-    expect(checkbox).not.toBeChecked();
+	    // Docker monitoring is disabled by default
+	    const checkbox = screen.getByRole('checkbox', { name: /Docker monitoring/i });
+	    expect(checkbox).not.toBeChecked();
 
     // Enable it
     fireEvent.click(checkbox);
diff --git a/frontend-modern/src/components/SetupWizard/SetupWizard.tsx b/frontend-modern/src/components/SetupWizard/SetupWizard.tsx
new file mode 100644
index 0000000..a98327b
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/SetupWizard.tsx
@@ -0,0 +1,145 @@
+import { Component, createSignal, Show } from 'solid-js';
+import { WelcomeStep } from './steps/WelcomeStep';
+import { SecurityStep } from './steps/SecurityStep';
+import { ConnectStep } from './steps/ConnectStep';
+import { FeaturesStep } from './steps/FeaturesStep';
+import { CompleteStep } from './steps/CompleteStep';
+import { StepIndicator } from './StepIndicator';
+
+export type WizardStep = 'welcome' | 'security' | 'connect' | 'features' | 'complete';
+
+export interface WizardState {
+    // Security
+    username: string;
+    password: string;
+    apiToken: string;
+    // Node
+    nodeAdded: boolean;
+    nodeName: string;
+    // Features
+    aiEnabled: boolean;
+    autoUpdatesEnabled: boolean;
+}
+
+interface SetupWizardProps {
+    onComplete: () => void;
+    bootstrapToken?: string;
+    isUnlocked?: boolean;
+}
+
+export const SetupWizard: Component<SetupWizardProps> = (props) => {
+    const [currentStep, setCurrentStep] = createSignal<WizardStep>('welcome');
+    const [wizardState, setWizardState] = createSignal<WizardState>({
+        username: 'admin',
+        password: '',
+        apiToken: '',
+        nodeAdded: false,
+        nodeName: '',
+        aiEnabled: false,
+        autoUpdatesEnabled: true,
+    });
+    const [bootstrapToken, setBootstrapToken] = createSignal(props.bootstrapToken || '');
+    const [isUnlocked, setIsUnlocked] = createSignal(props.isUnlocked || false);
+
+    const steps: WizardStep[] = ['welcome', 'security', 'connect', 'features', 'complete'];
+
+    const currentStepIndex = () => steps.indexOf(currentStep());
+
+    const nextStep = () => {
+        const idx = currentStepIndex();
+        if (idx < steps.length - 1) {
+            setCurrentStep(steps[idx + 1]);
+        }
+    };
+
+    const prevStep = () => {
+        const idx = currentStepIndex();
+        if (idx > 0) {
+            setCurrentStep(steps[idx - 1]);
+        }
+    };
+
+    const updateState = (updates: Partial<WizardState>) => {
+        setWizardState(prev => ({ ...prev, ...updates }));
+    };
+
+    const skipToComplete = () => {
+        setCurrentStep('complete');
+    };
+
+    return (
+        <div
+            class="min-h-screen bg-gradient-to-br from-slate-900 via-blue-900 to-indigo-900 flex flex-col"
+            role="main"
+            aria-label="Pulse Setup Wizard"
+        >
+            {/* Background decoration */}
+            <div class="fixed inset-0 overflow-hidden pointer-events-none" aria-hidden="true">
+                <div class="absolute -top-40 -right-40 w-80 h-80 bg-blue-500/20 rounded-full blur-3xl" />
+                <div class="absolute top-1/2 -left-40 w-80 h-80 bg-indigo-500/20 rounded-full blur-3xl" />
+                <div class="absolute -bottom-40 right-1/3 w-80 h-80 bg-purple-500/20 rounded-full blur-3xl" />
+            </div>
+
+            {/* Step indicator - only show after welcome */}
+            <Show when={currentStep() !== 'welcome' && currentStep() !== 'complete'}>
+                <div class="relative z-10 pt-8 px-4" role="navigation" aria-label="Setup progress">
+                    <StepIndicator
+                        steps={['Security', 'Connect', 'Features']}
+                        currentStep={currentStepIndex() - 1}
+                    />
+                </div>
+            </Show>
+
+            {/* Main content */}
+            <div class="flex-1 flex items-center justify-center p-4 relative z-10">
+                <div class="w-full max-w-2xl" role="region" aria-live="polite">
+                    <Show when={currentStep() === 'welcome'}>
+                        <WelcomeStep
+                            onNext={nextStep}
+                            bootstrapToken={bootstrapToken()}
+                            setBootstrapToken={setBootstrapToken}
+                            isUnlocked={isUnlocked()}
+                            setIsUnlocked={setIsUnlocked}
+                        />
+                    </Show>
+
+                    <Show when={currentStep() === 'security'}>
+                        <SecurityStep
+                            state={wizardState()}
+                            updateState={updateState}
+                            bootstrapToken={bootstrapToken()}
+                            onNext={nextStep}
+                            onBack={prevStep}
+                        />
+                    </Show>
+
+                    <Show when={currentStep() === 'connect'}>
+                        <ConnectStep
+                            state={wizardState()}
+                            updateState={updateState}
+                            onNext={nextStep}
+                            onBack={prevStep}
+                            onSkip={skipToComplete}
+                        />
+                    </Show>
+
+                    <Show when={currentStep() === 'features'}>
+                        <FeaturesStep
+                            state={wizardState()}
+                            updateState={updateState}
+                            onNext={nextStep}
+                            onBack={prevStep}
+                        />
+                    </Show>
+
+                    <Show when={currentStep() === 'complete'}>
+                        <CompleteStep
+                            state={wizardState()}
+                            onComplete={props.onComplete}
+                        />
+                    </Show>
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/StepIndicator.tsx b/frontend-modern/src/components/SetupWizard/StepIndicator.tsx
new file mode 100644
index 0000000..191ce34
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/StepIndicator.tsx
@@ -0,0 +1,37 @@
+import { Component } from 'solid-js';
+
+interface StepIndicatorProps {
+    steps: string[];
+    currentStep: number;
+}
+
+export const StepIndicator: Component<StepIndicatorProps> = (props) => {
+    return (
+        <div class="flex items-center justify-center gap-2">
+            {props.steps.map((step, index) => (
+                <div class="flex items-center">
+                    <div class={`flex items-center gap-2 px-3 py-1.5 rounded-full text-sm font-medium transition-all ${index < props.currentStep
+                            ? 'bg-green-500/20 text-green-300'
+                            : index === props.currentStep
+                                ? 'bg-blue-500/30 text-white border border-blue-400/50'
+                                : 'bg-white/10 text-white/50'
+                        }`}>
+                        <span class={`w-5 h-5 flex items-center justify-center rounded-full text-xs ${index < props.currentStep
+                                ? 'bg-green-500 text-white'
+                                : index === props.currentStep
+                                    ? 'bg-blue-500 text-white'
+                                    : 'bg-white/20 text-white/50'
+                            }`}>
+                            {index < props.currentStep ? '✓' : index + 1}
+                        </span>
+                        <span class="hidden sm:inline">{step}</span>
+                    </div>
+                    {index < props.steps.length - 1 && (
+                        <div class={`w-8 h-0.5 mx-1 ${index < props.currentStep ? 'bg-green-500/50' : 'bg-white/20'
+                            }`} />
+                    )}
+                </div>
+            ))}
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/index.ts b/frontend-modern/src/components/SetupWizard/index.ts
new file mode 100644
index 0000000..88370ca
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/index.ts
@@ -0,0 +1,3 @@
+export { SetupWizard } from './SetupWizard';
+export { StepIndicator } from './StepIndicator';
+export type { WizardState, WizardStep } from './SetupWizard';
diff --git a/frontend-modern/src/components/SetupWizard/steps/CompleteStep.tsx b/frontend-modern/src/components/SetupWizard/steps/CompleteStep.tsx
new file mode 100644
index 0000000..c74b5c2
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/steps/CompleteStep.tsx
@@ -0,0 +1,155 @@
+import { Component, createSignal } from 'solid-js';
+import { copyToClipboard } from '@/utils/clipboard';
+import { getPulseBaseUrl } from '@/utils/url';
+import type { WizardState } from '../SetupWizard';
+
+interface CompleteStepProps {
+    state: WizardState;
+    onComplete: () => void;
+}
+
+export const CompleteStep: Component<CompleteStepProps> = (props) => {
+    const [copied, setCopied] = createSignal<'password' | 'token' | null>(null);
+
+    const handleCopy = async (type: 'password' | 'token') => {
+        const value = type === 'password' ? props.state.password : props.state.apiToken;
+        const success = await copyToClipboard(value);
+        if (success) {
+            setCopied(type);
+            setTimeout(() => setCopied(null), 2000);
+        }
+    };
+
+    const downloadCredentials = () => {
+        const baseUrl = getPulseBaseUrl();
+        const content = `Pulse Credentials
+==================
+Generated: ${new Date().toISOString()}
+
+Web Login:
+----------
+URL: ${baseUrl}
+Username: ${props.state.username}
+Password: ${props.state.password}
+
+API Token:
+----------
+${props.state.apiToken}
+
+Example: curl -H "X-API-Token: ${props.state.apiToken}" ${baseUrl}/api/state
+
+⚠️ Keep these credentials secure!
+`;
+
+        const blob = new Blob([content], { type: 'text/plain' });
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = `pulse-credentials-${Date.now()}.txt`;
+        document.body.appendChild(a);
+        a.click();
+        document.body.removeChild(a);
+        URL.revokeObjectURL(url);
+    };
+
+    return (
+        <div class="text-center">
+            {/* Success animation */}
+            <div class="mb-8">
+                <div class="inline-flex items-center justify-center w-24 h-24 rounded-full bg-gradient-to-br from-green-500 to-emerald-600 shadow-2xl shadow-green-500/30 mb-6">
+                    <svg class="w-12 h-12 text-white" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="3">
+                        <path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7" />
+                    </svg>
+                </div>
+                <h1 class="text-3xl font-bold text-white mb-3">
+                    You're All Set! 🎉
+                </h1>
+                <p class="text-xl text-green-200/80">
+                    Pulse is ready to monitor your infrastructure
+                </p>
+            </div>
+
+            {/* Credentials box */}
+            <div class="bg-white/10 backdrop-blur-xl rounded-2xl border border-white/20 p-6 text-left mb-6">
+                <div class="flex items-center justify-between mb-4">
+                    <h3 class="text-lg font-semibold text-white">Your Credentials</h3>
+                    <button
+                        onClick={downloadCredentials}
+                        class="text-sm text-blue-300 hover:text-blue-200 flex items-center gap-1"
+                    >
+                        <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 10v6m0 0l-3-3m3 3l3-3m2 8H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
+                        </svg>
+                        Download
+                    </button>
+                </div>
+
+                <div class="space-y-3">
+                    {/* Username */}
+                    <div class="bg-black/20 rounded-xl p-3">
+                        <div class="text-xs text-white/60 mb-1">Username</div>
+                        <div class="text-white font-mono">{props.state.username}</div>
+                    </div>
+
+                    {/* Password */}
+                    <div class="bg-black/20 rounded-xl p-3">
+                        <div class="text-xs text-white/60 mb-1">Password</div>
+                        <div class="flex items-center justify-between">
+                            <code class="text-white font-mono text-sm break-all">{props.state.password}</code>
+                            <button
+                                onClick={() => handleCopy('password')}
+                                class="ml-2 p-1.5 hover:bg-white/10 rounded transition-all"
+                            >
+                                {copied() === 'password' ? '✓' : '📋'}
+                            </button>
+                        </div>
+                    </div>
+
+                    {/* API Token */}
+                    <div class="bg-black/20 rounded-xl p-3">
+                        <div class="text-xs text-white/60 mb-1">API Token</div>
+                        <div class="flex items-center justify-between">
+                            <code class="text-white font-mono text-xs break-all">{props.state.apiToken}</code>
+                            <button
+                                onClick={() => handleCopy('token')}
+                                class="ml-2 p-1.5 hover:bg-white/10 rounded transition-all"
+                            >
+                                {copied() === 'token' ? '✓' : '📋'}
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="mt-4 p-3 bg-amber-500/20 border border-amber-400/30 rounded-xl">
+                    <p class="text-amber-200 text-sm">
+                        ⚠️ Save these now — they won't be shown again!
+                    </p>
+                </div>
+            </div>
+
+            {/* Quick links */}
+            <div class="grid grid-cols-3 gap-3 mb-8">
+                <a href="/proxmox/overview" class="bg-white/5 hover:bg-white/10 border border-white/10 rounded-xl p-4 text-center transition-all">
+                    <div class="text-2xl mb-2">📊</div>
+                    <div class="text-sm text-white/80">Dashboard</div>
+                </a>
+                <a href="/settings/proxmox" class="bg-white/5 hover:bg-white/10 border border-white/10 rounded-xl p-4 text-center transition-all">
+                    <div class="text-2xl mb-2">⚙️</div>
+                    <div class="text-sm text-white/80">Add More Nodes</div>
+                </a>
+                <a href="/settings/system-ai" class="bg-white/5 hover:bg-white/10 border border-white/10 rounded-xl p-4 text-center transition-all">
+                    <div class="text-2xl mb-2">🤖</div>
+                    <div class="text-sm text-white/80">Configure AI</div>
+                </a>
+            </div>
+
+            {/* Launch button */}
+            <button
+                onClick={props.onComplete}
+                class="w-full py-4 px-8 bg-gradient-to-r from-green-500 to-emerald-600 hover:from-green-600 hover:to-emerald-700 text-white text-lg font-medium rounded-xl transition-all shadow-lg shadow-green-500/25"
+            >
+                Launch Pulse →
+            </button>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/steps/ConnectStep.tsx b/frontend-modern/src/components/SetupWizard/steps/ConnectStep.tsx
new file mode 100644
index 0000000..21ca58e
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/steps/ConnectStep.tsx
@@ -0,0 +1,293 @@
+import { Component, createSignal, For, Show } from 'solid-js';
+import { showError, showSuccess } from '@/utils/toast';
+import type { WizardState } from '../SetupWizard';
+
+interface ConnectStepProps {
+    state: WizardState;
+    updateState: (updates: Partial<WizardState>) => void;
+    onNext: () => void;
+    onBack: () => void;
+    onSkip: () => void;
+}
+
+type Platform = 'proxmox' | 'docker' | 'kubernetes';
+
+interface DiscoveredNode {
+    ip: string;
+    port: number;
+    type: string;
+    hostname?: string;
+}
+
+export const ConnectStep: Component<ConnectStepProps> = (props) => {
+    const [selectedPlatform, setSelectedPlatform] = createSignal<Platform | null>(null);
+    const [isScanning, setIsScanning] = createSignal(false);
+    const [discoveredNodes, setDiscoveredNodes] = createSignal<DiscoveredNode[]>([]);
+    const [showManualForm, setShowManualForm] = createSignal(false);
+    const [isConnecting, setIsConnecting] = createSignal(false);
+
+    // Manual form fields
+    const [host, setHost] = createSignal('');
+    const [port, _setPort] = createSignal('8006');
+    const [tokenId, setTokenId] = createSignal('');
+    const [tokenSecret, setTokenSecret] = createSignal('');
+
+    const platforms = [
+        { id: 'proxmox' as Platform, name: 'Proxmox VE', icon: '🖥️', desc: 'Hypervisor & containers', ports: ['8006'] },
+        { id: 'docker' as Platform, name: 'Docker', icon: '🐳', desc: 'Container hosts', ports: ['2375', '2376'] },
+        { id: 'kubernetes' as Platform, name: 'Kubernetes', icon: '☸️', desc: 'Container orchestration', ports: ['6443'] },
+    ];
+
+    const runDiscovery = async () => {
+        setIsScanning(true);
+        setDiscoveredNodes([]);
+
+        try {
+            const response = await fetch('/api/discover', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ subnet: 'auto' }),
+            });
+
+            if (!response.ok) throw new Error('Discovery failed');
+
+            // Poll for results
+            for (let i = 0; i < 10; i++) {
+                await new Promise(r => setTimeout(r, 2000));
+                const results = await fetch('/api/discover/results');
+                if (results.ok) {
+                    const data = await results.json();
+                    if (data.nodes && data.nodes.length > 0) {
+                        setDiscoveredNodes(data.nodes.filter((n: DiscoveredNode) =>
+                            selectedPlatform() === 'proxmox' ? ['pve', 'pbs', 'pmg'].includes(n.type) : true
+                        ));
+                        break;
+                    }
+                }
+            }
+
+            if (discoveredNodes().length === 0) {
+                showSuccess('Scan complete - no nodes found. Try manual setup.');
+            }
+        } catch (_error) {
+            showError('Discovery failed. Try manual setup.');
+        } finally {
+            setIsScanning(false);
+        }
+    };
+
+    const connectNode = async (node?: DiscoveredNode) => {
+        setIsConnecting(true);
+
+        try {
+            const nodeData = node ? {
+                type: node.type === 'pbs' ? 'pbs' : node.type === 'pmg' ? 'pmg' : 'pve',
+                name: node.hostname || node.ip,
+                host: node.ip,
+                port: node.port,
+            } : {
+                type: 'pve',
+                name: host().replace(/:\d+$/, ''),
+                host: host(),
+                port: parseInt(port()),
+                tokenId: tokenId(),
+                tokenValue: tokenSecret(),
+            };
+
+            const response = await fetch('/api/nodes', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(nodeData),
+            });
+
+            if (!response.ok) throw new Error(await response.text());
+
+            props.updateState({ nodeAdded: true, nodeName: nodeData.name });
+            showSuccess(`Connected to ${nodeData.name}!`);
+            props.onNext();
+        } catch (error) {
+            showError(`Connection failed: ${error}`);
+        } finally {
+            setIsConnecting(false);
+        }
+    };
+
+    return (
+        <div class="bg-white/10 backdrop-blur-xl rounded-2xl border border-white/20 overflow-hidden">
+            <div class="p-6 border-b border-white/10">
+                <h2 class="text-2xl font-bold text-white">Connect Your Infrastructure</h2>
+                <p class="text-white/70 mt-1">Add monitoring for your systems</p>
+            </div>
+
+            <div class="p-6">
+                {/* Platform selection */}
+                <Show when={!selectedPlatform()}>
+                    <div class="grid grid-cols-3 gap-4 mb-6">
+                        <For each={platforms}>
+                            {(platform) => (
+                                <button
+                                    onClick={() => setSelectedPlatform(platform.id)}
+                                    class="bg-white/5 hover:bg-white/10 border border-white/10 hover:border-white/30 rounded-xl p-4 text-center transition-all"
+                                >
+                                    <div class="text-3xl mb-2">{platform.icon}</div>
+                                    <div class="text-white font-medium">{platform.name}</div>
+                                    <div class="text-white/50 text-xs mt-1">{platform.desc}</div>
+                                </button>
+                            )}
+                        </For>
+                    </div>
+                </Show>
+
+                {/* Proxmox connection */}
+                <Show when={selectedPlatform() === 'proxmox'}>
+                    <div class="space-y-4">
+                        <div class="flex items-center gap-2 mb-4">
+                            <button
+                                onClick={() => setSelectedPlatform(null)}
+                                class="text-white/60 hover:text-white"
+                            >
+                                ←
+                            </button>
+                            <span class="text-xl">🖥️</span>
+                            <span class="text-white font-medium">Proxmox VE</span>
+                        </div>
+
+                        {/* Options */}
+                        <div class="grid grid-cols-2 gap-3">
+                            <button
+                                onClick={runDiscovery}
+                                disabled={isScanning()}
+                                class="bg-blue-500/20 hover:bg-blue-500/30 border border-blue-400/30 rounded-xl p-4 text-left transition-all"
+                            >
+                                <div class="text-lg mb-1">🔍 Auto-Discover</div>
+                                <div class="text-sm text-white/60">Scan your network</div>
+                            </button>
+                            <button
+                                onClick={() => setShowManualForm(true)}
+                                class="bg-white/5 hover:bg-white/10 border border-white/20 rounded-xl p-4 text-left transition-all"
+                            >
+                                <div class="text-lg mb-1">✏️ Manual Setup</div>
+                                <div class="text-sm text-white/60">Enter details</div>
+                            </button>
+                        </div>
+
+                        {/* Scanning indicator */}
+                        <Show when={isScanning()}>
+                            <div class="bg-blue-500/10 border border-blue-400/20 rounded-xl p-4 text-center">
+                                <div class="animate-spin inline-block w-6 h-6 border-2 border-blue-400 border-t-transparent rounded-full mb-2" />
+                                <p class="text-blue-200">Scanning network...</p>
+                            </div>
+                        </Show>
+
+                        {/* Discovered nodes */}
+                        <Show when={discoveredNodes().length > 0}>
+                            <div class="space-y-2">
+                                <p class="text-sm text-white/60">Found {discoveredNodes().length} node(s):</p>
+                                <For each={discoveredNodes()}>
+                                    {(node) => (
+                                        <button
+                                            onClick={() => connectNode(node)}
+                                            disabled={isConnecting()}
+                                            class="w-full bg-green-500/10 hover:bg-green-500/20 border border-green-400/30 rounded-xl p-3 flex items-center justify-between transition-all"
+                                        >
+                                            <div class="text-left">
+                                                <div class="text-white font-medium">{node.hostname || node.ip}</div>
+                                                <div class="text-white/50 text-sm">{node.ip}:{node.port}</div>
+                                            </div>
+                                            <span class="text-green-400">Connect →</span>
+                                        </button>
+                                    )}
+                                </For>
+                            </div>
+                        </Show>
+
+                        {/* Manual form */}
+                        <Show when={showManualForm()}>
+                            <div class="space-y-3 bg-white/5 rounded-xl p-4">
+                                <input
+                                    type="text"
+                                    value={host()}
+                                    onInput={(e) => setHost(e.currentTarget.value)}
+                                    class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40"
+                                    placeholder="Host (e.g., 192.168.1.100)"
+                                />
+                                <input
+                                    type="text"
+                                    value={tokenId()}
+                                    onInput={(e) => setTokenId(e.currentTarget.value)}
+                                    class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40"
+                                    placeholder="API Token ID (e.g., root@pam!pulse)"
+                                />
+                                <input
+                                    type="password"
+                                    value={tokenSecret()}
+                                    onInput={(e) => setTokenSecret(e.currentTarget.value)}
+                                    class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40"
+                                    placeholder="API Token Secret"
+                                />
+                                <button
+                                    onClick={() => connectNode()}
+                                    disabled={isConnecting() || !host()}
+                                    class="w-full py-3 bg-blue-500 hover:bg-blue-600 disabled:opacity-50 text-white font-medium rounded-xl transition-all"
+                                >
+                                    {isConnecting() ? 'Connecting...' : 'Connect'}
+                                </button>
+                            </div>
+                        </Show>
+                    </div>
+                </Show>
+
+                {/* Docker placeholder */}
+                <Show when={selectedPlatform() === 'docker'}>
+                    <div class="text-center py-8">
+                        <div class="text-4xl mb-4">🐳</div>
+                        <p class="text-white/70 mb-4">
+                            Docker monitoring requires the Pulse Agent.<br />
+                            Install it on your Docker host after setup.
+                        </p>
+                        <button
+                            onClick={props.onNext}
+                            class="px-6 py-3 bg-blue-500 hover:bg-blue-600 text-white rounded-xl"
+                        >
+                            Continue Setup →
+                        </button>
+                    </div>
+                </Show>
+
+                {/* Kubernetes placeholder */}
+                <Show when={selectedPlatform() === 'kubernetes'}>
+                    <div class="text-center py-8">
+                        <div class="text-4xl mb-4">☸️</div>
+                        <p class="text-white/70 mb-4">
+                            Kubernetes monitoring requires the Pulse Agent.<br />
+                            Deploy via Helm after setup.
+                        </p>
+                        <button
+                            onClick={props.onNext}
+                            class="px-6 py-3 bg-blue-500 hover:bg-blue-600 text-white rounded-xl"
+                        >
+                            Continue Setup →
+                        </button>
+                    </div>
+                </Show>
+            </div>
+
+            {/* Actions */}
+            <div class="p-6 bg-black/20 flex gap-3">
+                <button
+                    onClick={props.onBack}
+                    class="px-6 py-3 bg-white/10 hover:bg-white/20 text-white rounded-xl"
+                >
+                    ← Back
+                </button>
+                <div class="flex-1" />
+                <button
+                    onClick={props.onSkip}
+                    class="px-6 py-3 bg-white/10 hover:bg-white/20 text-white/60 rounded-xl"
+                >
+                    Skip for now
+                </button>
+            </div>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/steps/FeaturesStep.tsx b/frontend-modern/src/components/SetupWizard/steps/FeaturesStep.tsx
new file mode 100644
index 0000000..9f7dd32
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/steps/FeaturesStep.tsx
@@ -0,0 +1,138 @@
+import { Component, createSignal } from 'solid-js';
+import { showSuccess } from '@/utils/toast';
+import { SettingsAPI } from '@/api/settings';
+import type { WizardState } from '../SetupWizard';
+
+interface FeaturesStepProps {
+    state: WizardState;
+    updateState: (updates: Partial<WizardState>) => void;
+    onNext: () => void;
+    onBack: () => void;
+}
+
+export const FeaturesStep: Component<FeaturesStepProps> = (props) => {
+    const [aiEnabled, setAiEnabled] = createSignal(false);
+    const [autoUpdates, setAutoUpdates] = createSignal(true);
+    const [isSaving, setIsSaving] = createSignal(false);
+
+    const features = [
+        {
+            id: 'ai',
+            name: 'Pulse AI',
+            icon: '🤖',
+            desc: 'Intelligent monitoring assistant with auto-fix capabilities',
+            enabled: aiEnabled,
+            setEnabled: setAiEnabled,
+            badge: 'New in 5.0',
+        },
+        {
+            id: 'updates',
+            name: 'Automatic Updates',
+            icon: '🔄',
+            desc: 'Keep Pulse up-to-date automatically',
+            enabled: autoUpdates,
+            setEnabled: setAutoUpdates,
+            badge: null,
+        },
+    ];
+
+    const handleContinue = async () => {
+        setIsSaving(true);
+
+        try {
+            // Only save auto-update setting through SystemConfig
+            // AI settings are configured separately via Settings → AI
+            await SettingsAPI.updateSystemSettings({
+                autoUpdateEnabled: autoUpdates(),
+            });
+
+            props.updateState({
+                aiEnabled: aiEnabled(),
+                autoUpdatesEnabled: autoUpdates(),
+            });
+
+            showSuccess('Preferences saved!');
+            props.onNext();
+        } catch (_error) {
+            // Continue anyway - settings can be changed later
+            props.onNext();
+        } finally {
+            setIsSaving(false);
+        }
+    };
+
+    return (
+        <div class="bg-white/10 backdrop-blur-xl rounded-2xl border border-white/20 overflow-hidden">
+            <div class="p-6 border-b border-white/10">
+                <h2 class="text-2xl font-bold text-white">Enable Features</h2>
+                <p class="text-white/70 mt-1">Customize your Pulse experience</p>
+            </div>
+
+            <div class="p-6 space-y-4">
+                {features.map((feature) => (
+                    <button
+                        onClick={() => feature.setEnabled(!feature.enabled())}
+                        class={`w-full p-4 rounded-xl border transition-all text-left flex items-start gap-4 ${feature.enabled()
+                            ? 'bg-blue-500/20 border-blue-400/40'
+                            : 'bg-white/5 border-white/10 hover:bg-white/10'
+                            }`}
+                    >
+                        <div class="text-3xl">{feature.icon}</div>
+                        <div class="flex-1">
+                            <div class="flex items-center gap-2">
+                                <span class="text-white font-medium">{feature.name}</span>
+                                {feature.badge && (
+                                    <span class="px-2 py-0.5 bg-green-500/30 text-green-300 text-xs rounded-full">
+                                        {feature.badge}
+                                    </span>
+                                )}
+                            </div>
+                            <p class="text-white/60 text-sm mt-1">{feature.desc}</p>
+                        </div>
+                        <div class={`w-12 h-7 rounded-full transition-all flex items-center px-1 ${feature.enabled() ? 'bg-blue-500' : 'bg-white/20'
+                            }`}>
+                            <div class={`w-5 h-5 rounded-full bg-white transition-transform ${feature.enabled() ? 'translate-x-5' : ''
+                                }`} />
+                        </div>
+                    </button>
+                ))}
+
+                {/* AI info box */}
+                <div class="bg-gradient-to-r from-purple-500/10 to-blue-500/10 border border-purple-400/20 rounded-xl p-4">
+                    <div class="flex items-start gap-3">
+                        <div class="text-2xl">✨</div>
+                        <div>
+                            <p class="text-white font-medium">Pulse AI Features</p>
+                            <p class="text-white/60 text-sm mt-1">
+                                • Chat assistant for infrastructure questions<br />
+                                • Patrol mode for proactive monitoring<br />
+                                • Auto-fix for common issues<br />
+                                • Predictive failure detection
+                            </p>
+                            <p class="text-white/40 text-xs mt-2">
+                                Requires API key configuration in Settings → AI after setup
+                            </p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            {/* Actions */}
+            <div class="p-6 bg-black/20 flex gap-3">
+                <button
+                    onClick={props.onBack}
+                    class="px-6 py-3 bg-white/10 hover:bg-white/20 text-white rounded-xl"
+                >
+                    ← Back
+                </button>
+                <button
+                    onClick={handleContinue}
+                    disabled={isSaving()}
+                    class="flex-1 py-3 px-6 bg-gradient-to-r from-blue-500 to-indigo-600 hover:from-blue-600 hover:to-indigo-700 disabled:opacity-50 text-white font-medium rounded-xl transition-all"
+                >
+                    {isSaving() ? 'Saving...' : 'Continue →'}
+                </button>
+            </div>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx b/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx
new file mode 100644
index 0000000..d2b5763
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx
@@ -0,0 +1,191 @@
+import { Component, createSignal, Show } from 'solid-js';
+import { showError, showSuccess } from '@/utils/toast';
+import { setApiToken as setApiClientToken } from '@/utils/apiClient';
+import type { WizardState } from '../SetupWizard';
+
+interface SecurityStepProps {
+    state: WizardState;
+    updateState: (updates: Partial<WizardState>) => void;
+    bootstrapToken: string;
+    onNext: () => void;
+    onBack: () => void;
+}
+
+export const SecurityStep: Component<SecurityStepProps> = (props) => {
+    const [username, setUsername] = createSignal(props.state.username || 'admin');
+    const [useCustomPassword, setUseCustomPassword] = createSignal(false);
+    const [password, setPassword] = createSignal('');
+    const [confirmPassword, setConfirmPassword] = createSignal('');
+    const [isSettingUp, setIsSettingUp] = createSignal(false);
+
+    const generatePassword = () => {
+        const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#$%';
+        let pass = '';
+        for (let i = 0; i < 16; i++) {
+            pass += chars.charAt(Math.floor(Math.random() * chars.length));
+        }
+        return pass;
+    };
+
+    const generateToken = (): string => {
+        const array = new Uint8Array(24);
+        crypto.getRandomValues(array);
+        return Array.from(array, (byte) => byte.toString(16).padStart(2, '0')).join('');
+    };
+
+    const handleSetup = async () => {
+        if (useCustomPassword()) {
+            if (!password() || password().length < 12) {
+                showError('Password must be at least 12 characters');
+                return;
+            }
+            if (password() !== confirmPassword()) {
+                showError('Passwords do not match');
+                return;
+            }
+        }
+
+        setIsSettingUp(true);
+        const finalPassword = useCustomPassword() ? password() : generatePassword();
+        const token = generateToken();
+
+        try {
+            setApiClientToken(token);
+
+            const response = await fetch('/api/security/quick-setup', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Setup-Token': props.bootstrapToken,
+                },
+                credentials: 'include',
+                body: JSON.stringify({
+                    username: username(),
+                    password: finalPassword,
+                    apiToken: token,
+                    force: false,
+                    setupToken: props.bootstrapToken,
+                }),
+            });
+
+            if (!response.ok) {
+                throw new Error(await response.text());
+            }
+
+            props.updateState({
+                username: username(),
+                password: finalPassword,
+                apiToken: token,
+            });
+
+            showSuccess('Security configured!');
+            props.onNext();
+        } catch (error) {
+            showError(`Setup failed: ${error}`);
+        } finally {
+            setIsSettingUp(false);
+        }
+    };
+
+    return (
+        <div class="bg-white/10 backdrop-blur-xl rounded-2xl border border-white/20 overflow-hidden">
+            <div class="p-6 border-b border-white/10">
+                <h2 class="text-2xl font-bold text-white">Secure Your Dashboard</h2>
+                <p class="text-white/70 mt-1">Create your admin account</p>
+            </div>
+
+            <div class="p-6 space-y-6">
+                {/* Username */}
+                <div>
+                    <label class="block text-sm font-medium text-white/80 mb-2">Username</label>
+                    <input
+                        type="text"
+                        value={username()}
+                        onInput={(e) => setUsername(e.currentTarget.value)}
+                        class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                        placeholder="admin"
+                    />
+                </div>
+
+                {/* Password choice */}
+                <div>
+                    <label class="block text-sm font-medium text-white/80 mb-3">Password</label>
+                    <div class="grid grid-cols-2 gap-3 mb-4">
+                        <button
+                            type="button"
+                            onClick={() => setUseCustomPassword(false)}
+                            class={`py-3 px-4 rounded-xl text-sm font-medium transition-all ${!useCustomPassword()
+                                    ? 'bg-blue-500 text-white'
+                                    : 'bg-white/10 text-white/70 hover:bg-white/20'
+                                }`}
+                        >
+                            🔐 Generate Secure
+                        </button>
+                        <button
+                            type="button"
+                            onClick={() => setUseCustomPassword(true)}
+                            class={`py-3 px-4 rounded-xl text-sm font-medium transition-all ${useCustomPassword()
+                                    ? 'bg-blue-500 text-white'
+                                    : 'bg-white/10 text-white/70 hover:bg-white/20'
+                                }`}
+                        >
+                            ✏️ Custom Password
+                        </button>
+                    </div>
+
+                    <Show when={useCustomPassword()}>
+                        <div class="space-y-3">
+                            <input
+                                type="password"
+                                value={password()}
+                                onInput={(e) => setPassword(e.currentTarget.value)}
+                                class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                                placeholder="Password (min 12 characters)"
+                            />
+                            <input
+                                type="password"
+                                value={confirmPassword()}
+                                onInput={(e) => setConfirmPassword(e.currentTarget.value)}
+                                class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40 focus:outline-none focus:ring-2 focus:ring-blue-500"
+                                placeholder="Confirm password"
+                            />
+                        </div>
+                    </Show>
+
+                    <Show when={!useCustomPassword()}>
+                        <div class="bg-blue-500/20 border border-blue-400/30 rounded-xl p-4">
+                            <p class="text-sm text-blue-200">
+                                A secure 16-character password will be generated and shown after setup.
+                            </p>
+                        </div>
+                    </Show>
+                </div>
+
+                {/* Info */}
+                <div class="bg-white/5 rounded-xl p-4">
+                    <p class="text-sm text-white/60">
+                        This creates your admin account and an API token for automation.
+                        Credentials will be displayed once - save them securely!
+                    </p>
+                </div>
+            </div>
+
+            {/* Actions */}
+            <div class="p-6 bg-black/20 flex gap-3">
+                <button
+                    onClick={props.onBack}
+                    class="px-6 py-3 bg-white/10 hover:bg-white/20 text-white rounded-xl transition-all"
+                >
+                    ← Back
+                </button>
+                <button
+                    onClick={handleSetup}
+                    disabled={isSettingUp()}
+                    class="flex-1 py-3 px-6 bg-gradient-to-r from-blue-500 to-indigo-600 hover:from-blue-600 hover:to-indigo-700 disabled:opacity-50 text-white font-medium rounded-xl transition-all"
+                >
+                    {isSettingUp() ? 'Setting up...' : 'Create Account →'}
+                </button>
+            </div>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx b/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx
new file mode 100644
index 0000000..6a88bda
--- /dev/null
+++ b/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx
@@ -0,0 +1,157 @@
+import { Component, createSignal, Show } from 'solid-js';
+import { showError, showSuccess } from '@/utils/toast';
+import { logger } from '@/utils/logger';
+
+interface WelcomeStepProps {
+    onNext: () => void;
+    bootstrapToken: string;
+    setBootstrapToken: (token: string) => void;
+    isUnlocked: boolean;
+    setIsUnlocked: (unlocked: boolean) => void;
+}
+
+export const WelcomeStep: Component<WelcomeStepProps> = (props) => {
+    const [isValidating, setIsValidating] = createSignal(false);
+    const [tokenPath, setTokenPath] = createSignal('');
+    const [isDocker, setIsDocker] = createSignal(false);
+    const [inContainer, setInContainer] = createSignal(false);
+    const [lxcCtid, setLxcCtid] = createSignal('');
+
+    // Fetch bootstrap info on mount
+    const fetchBootstrapInfo = async () => {
+        try {
+            const response = await fetch('/api/security/status');
+            if (response.ok) {
+                const data = await response.json();
+                if (data.bootstrapTokenPath) {
+                    setTokenPath(data.bootstrapTokenPath);
+                    setIsDocker(data.isDocker || false);
+                    setInContainer(data.inContainer || false);
+                    setLxcCtid(data.lxcCtid || '');
+                }
+            }
+        } catch (error) {
+            logger.error('Failed to fetch bootstrap info:', error);
+        }
+    };
+
+    // Call on component load
+    fetchBootstrapInfo();
+
+    const handleUnlock = async () => {
+        if (!props.bootstrapToken.trim()) {
+            showError('Please enter the bootstrap token');
+            return;
+        }
+
+        setIsValidating(true);
+        try {
+            const response = await fetch('/api/security/validate-bootstrap-token', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token: props.bootstrapToken.trim() }),
+            });
+
+            if (!response.ok) {
+                throw new Error('Invalid bootstrap token');
+            }
+
+            props.setIsUnlocked(true);
+            showSuccess('Token verified!');
+            props.onNext();
+        } catch (_error) {
+            showError('Invalid bootstrap token. Please check and try again.');
+        } finally {
+            setIsValidating(false);
+        }
+    };
+
+    const getTokenCommand = () => {
+        const path = tokenPath() || '/etc/pulse/.bootstrap_token';
+        if (isDocker()) {
+            return `docker exec <container> cat ${path}`;
+        }
+        if (inContainer() && lxcCtid()) {
+            return `pct exec ${lxcCtid()} -- cat ${path}`;
+        }
+        if (inContainer()) {
+            return `pct exec <ctid> -- cat ${path}`;
+        }
+        return `cat ${path}`;
+    };
+
+    return (
+        <div class="text-center">
+            {/* Logo */}
+            <div class="mb-8">
+                <div class="inline-flex items-center justify-center w-24 h-24 rounded-full bg-gradient-to-br from-blue-500 to-indigo-600 shadow-2xl shadow-blue-500/30 mb-6">
+                    <svg width="56" height="56" viewBox="0 0 256 256" class="text-white">
+                        <circle class="fill-current opacity-20" cx="128" cy="128" r="122" />
+                        <circle class="fill-none stroke-current" stroke-width="14" cx="128" cy="128" r="84" opacity="0.9" />
+                        <circle class="fill-current" cx="128" cy="128" r="26" />
+                    </svg>
+                </div>
+                <h1 class="text-4xl font-bold text-white mb-3">
+                    Welcome to Pulse
+                </h1>
+                <p class="text-xl text-blue-200/80">
+                    Unified infrastructure monitoring
+                </p>
+            </div>
+
+            {/* Feature highlights */}
+            <div class="grid grid-cols-3 gap-4 mb-8">
+                <div class="bg-white/5 backdrop-blur rounded-xl p-4 border border-white/10">
+                    <div class="text-2xl mb-2">🖥️</div>
+                    <div class="text-sm text-white/80">Proxmox</div>
+                </div>
+                <div class="bg-white/5 backdrop-blur rounded-xl p-4 border border-white/10">
+                    <div class="text-2xl mb-2">🐳</div>
+                    <div class="text-sm text-white/80">Docker</div>
+                </div>
+                <div class="bg-white/5 backdrop-blur rounded-xl p-4 border border-white/10">
+                    <div class="text-2xl mb-2">☸️</div>
+                    <div class="text-sm text-white/80">Kubernetes</div>
+                </div>
+            </div>
+
+            {/* Bootstrap token unlock */}
+            <Show when={!props.isUnlocked}>
+                <div class="bg-white/10 backdrop-blur-xl rounded-2xl p-6 border border-white/20 text-left">
+                    <h3 class="text-lg font-semibold text-white mb-2">Unlock Setup</h3>
+                    <p class="text-sm text-white/70 mb-4">
+                        Retrieve the bootstrap token from your host:
+                    </p>
+                    <div class="bg-black/30 rounded-lg p-3 font-mono text-sm text-green-400 mb-4">
+                        {getTokenCommand()}
+                    </div>
+                    <input
+                        type="text"
+                        value={props.bootstrapToken}
+                        onInput={(e) => props.setBootstrapToken(e.currentTarget.value)}
+                        onKeyPress={(e) => e.key === 'Enter' && handleUnlock()}
+                        class="w-full px-4 py-3 bg-white/10 border border-white/20 rounded-xl text-white placeholder-white/40 focus:outline-none focus:ring-2 focus:ring-blue-500 font-mono"
+                        placeholder="Paste your bootstrap token"
+                        autofocus
+                    />
+                    <button
+                        onClick={handleUnlock}
+                        disabled={isValidating() || !props.bootstrapToken.trim()}
+                        class="w-full mt-4 py-3 px-6 bg-gradient-to-r from-blue-500 to-indigo-600 hover:from-blue-600 hover:to-indigo-700 disabled:opacity-50 disabled:cursor-not-allowed text-white font-medium rounded-xl transition-all shadow-lg shadow-blue-500/25"
+                    >
+                        {isValidating() ? 'Validating...' : 'Continue →'}
+                    </button>
+                </div>
+            </Show>
+
+            <Show when={props.isUnlocked}>
+                <button
+                    onClick={props.onNext}
+                    class="py-4 px-8 bg-gradient-to-r from-blue-500 to-indigo-600 hover:from-blue-600 hover:to-indigo-700 text-white text-lg font-medium rounded-xl transition-all shadow-lg shadow-blue-500/25"
+                >
+                    Get Started →
+                </button>
+            </Show>
+        </div>
+    );
+};
diff --git a/frontend-modern/src/components/Storage/EnhancedStorageBar.tsx b/frontend-modern/src/components/Storage/EnhancedStorageBar.tsx
index 4e7e4c5..d59b915 100644
--- a/frontend-modern/src/components/Storage/EnhancedStorageBar.tsx
+++ b/frontend-modern/src/components/Storage/EnhancedStorageBar.tsx
@@ -57,7 +57,7 @@ export function EnhancedStorageBar(props: EnhancedStorageBarProps) {
     return (
         <div ref={containerRef} class="metric-text w-full h-4 flex items-center justify-center">
             <div
-                class="relative w-full max-w-[150px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded cursor-help"
+                class="relative w-full max-w-[150px] h-full overflow-hidden bg-gray-200 dark:bg-gray-600 rounded"
                 onMouseEnter={handleMouseEnter}
                 onMouseLeave={handleMouseLeave}
             >
diff --git a/frontend-modern/src/components/Storage/ZFSHealthMap.tsx b/frontend-modern/src/components/Storage/ZFSHealthMap.tsx
index 03417d5..20f7d39 100644
--- a/frontend-modern/src/components/Storage/ZFSHealthMap.tsx
+++ b/frontend-modern/src/components/Storage/ZFSHealthMap.tsx
@@ -46,7 +46,7 @@ export const ZFSHealthMap: Component<ZFSHealthMapProps> = (props) => {
             <For each={devices()}>
                 {(device) => (
                     <div
-                        class={`w-2.5 h-3 rounded-sm cursor-help transition-colors duration-200 ${getDeviceColor(device)} ${isResilvering(device) ? 'animate-pulse' : ''}`}
+                        class={`w-2.5 h-3 rounded-sm transition-colors duration-200 ${getDeviceColor(device)} ${isResilvering(device) ? 'animate-pulse' : ''}`}
                         onMouseEnter={(e) => handleMouseEnter(e, device)}
                         onMouseLeave={handleMouseLeave}
                     />
@@ -72,8 +72,8 @@ export const ZFSHealthMap: Component<ZFSHealthMapProps> = (props) => {
                             </div>
                             <div class="flex items-center gap-2 border-t border-gray-700/50 pt-1">
                                 <span class={`font-semibold ${hoveredDevice()?.state === 'ONLINE' ? 'text-green-400' :
-                                        hoveredDevice()?.state === 'DEGRADED' ? 'text-yellow-400' :
-                                            'text-red-400'
+                                    hoveredDevice()?.state === 'DEGRADED' ? 'text-yellow-400' :
+                                        'text-red-400'
                                     }`}>
                                     {hoveredDevice()?.state}
                                 </span>
diff --git a/frontend-modern/src/components/shared/AIInsightsPanel.tsx b/frontend-modern/src/components/shared/AIInsightsPanel.tsx
new file mode 100644
index 0000000..2aa2e12
--- /dev/null
+++ b/frontend-modern/src/components/shared/AIInsightsPanel.tsx
@@ -0,0 +1,197 @@
+import { Component, createSignal, createEffect, Show, For } from 'solid-js';
+import { AIAPI } from '@/api/ai';
+import type { FailurePrediction, ResourceCorrelation } from '@/types/aiIntelligence';
+
+/**
+ * AIInsightsPanel displays AI-learned predictions and correlations
+ * Shows failure predictions with confidence levels and resource dependencies
+ */
+export const AIInsightsPanel: Component<{ resourceId?: string }> = (props) => {
+    const [predictions, setPredictions] = createSignal<FailurePrediction[]>([]);
+    const [correlations, setCorrelations] = createSignal<ResourceCorrelation[]>([]);
+    const [loading, setLoading] = createSignal(false);
+    const [expanded, setExpanded] = createSignal(false);
+
+    const loadData = async () => {
+        setLoading(true);
+        try {
+            const [predResp, corrResp] = await Promise.all([
+                AIAPI.getPredictions(props.resourceId),
+                AIAPI.getCorrelations(props.resourceId),
+            ]);
+            setPredictions(predResp.predictions || []);
+            setCorrelations(corrResp.correlations || []);
+        } catch (e) {
+            console.error('Failed to load AI insights:', e);
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    createEffect(() => {
+        loadData();
+    });
+
+    const totalInsights = () => predictions().length + correlations().length;
+
+    // Format days until in a human-readable way
+    const formatDaysUntil = (days: number) => {
+        if (days < 0) return 'Overdue';
+        if (days < 1) return 'Today';
+        if (days < 2) return 'Tomorrow';
+        return `In ${Math.round(days)} days`;
+    };
+
+    // Get severity color based on days until and confidence
+    const getPredictionColor = (pred: FailurePrediction) => {
+        if (pred.is_overdue || pred.days_until < 0) return 'text-red-600 dark:text-red-400';
+        if (pred.days_until < 3) return 'text-amber-600 dark:text-amber-400';
+        if (pred.days_until < 7) return 'text-yellow-600 dark:text-yellow-400';
+        return 'text-blue-600 dark:text-blue-400';
+    };
+
+    // Get event type display name
+    const getEventDisplayName = (eventType: string) => {
+        const names: Record<string, string> = {
+            high_memory: 'High Memory',
+            high_cpu: 'High CPU',
+            disk_full: 'Disk Full',
+            oom: 'Out of Memory',
+            restart: 'Restart',
+            unresponsive: 'Unresponsive',
+            backup_failed: 'Backup Failure',
+        };
+        return names[eventType] || eventType;
+    };
+
+    return (
+        <Show when={totalInsights() > 0 || loading()}>
+            <div class="bg-gradient-to-r from-purple-50 to-indigo-50 dark:from-purple-900/20 dark:to-indigo-900/20 border border-purple-200 dark:border-purple-700 rounded-lg overflow-hidden">
+                {/* Header */}
+                <button
+                    type="button"
+                    onClick={() => setExpanded(!expanded())}
+                    class="w-full px-4 py-3 flex items-center justify-between hover:bg-purple-100/50 dark:hover:bg-purple-800/30 transition-colors"
+                >
+                    <div class="flex items-center gap-2">
+                        <svg class="w-5 h-5 text-purple-600 dark:text-purple-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z" />
+                        </svg>
+                        <span class="font-medium text-purple-900 dark:text-purple-100">
+                            AI Insights
+                        </span>
+                        <Show when={totalInsights() > 0}>
+                            <span class="px-2 py-0.5 text-xs font-medium bg-purple-200 dark:bg-purple-700 text-purple-800 dark:text-purple-200 rounded-full">
+                                {totalInsights()}
+                            </span>
+                        </Show>
+                    </div>
+                    <svg
+                        class={`w-5 h-5 text-purple-600 dark:text-purple-400 transition-transform ${expanded() ? 'rotate-180' : ''}`}
+                        fill="none"
+                        stroke="currentColor"
+                        viewBox="0 0 24 24"
+                    >
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                    </svg>
+                </button>
+
+                {/* Content */}
+                <Show when={expanded()}>
+                    <div class="px-4 pb-4 space-y-4">
+                        {/* Loading state */}
+                        <Show when={loading()}>
+                            <div class="text-sm text-gray-500 dark:text-gray-400 flex items-center gap-2">
+                                <span class="h-4 w-4 border-2 border-current border-t-transparent rounded-full animate-spin" />
+                                Loading insights...
+                            </div>
+                        </Show>
+
+                        {/* Predictions */}
+                        <Show when={predictions().length > 0}>
+                            <div>
+                                <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-2 flex items-center gap-1">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+                                    </svg>
+                                    Failure Predictions
+                                </h4>
+                                <div class="space-y-2">
+                                    <For each={predictions()}>
+                                        {(pred) => (
+                                            <div class="bg-white/50 dark:bg-gray-800/50 rounded-lg p-3 border border-purple-100 dark:border-purple-800">
+                                                <div class="flex items-start justify-between gap-2">
+                                                    <div class="flex-1">
+                                                        <div class={`font-medium ${getPredictionColor(pred)}`}>
+                                                            {getEventDisplayName(pred.event_type)}
+                                                            <span class="ml-2 text-sm font-normal">
+                                                                {formatDaysUntil(pred.days_until)}
+                                                            </span>
+                                                        </div>
+                                                        <p class="text-sm text-gray-600 dark:text-gray-400 mt-1">
+                                                            {pred.basis}
+                                                        </p>
+                                                    </div>
+                                                    <div class="text-right shrink-0">
+                                                        <div class="text-xs text-gray-500 dark:text-gray-400">
+                                                            {Math.round(pred.confidence * 100)}% confidence
+                                                        </div>
+                                                    </div>
+                                                </div>
+                                            </div>
+                                        )}
+                                    </For>
+                                </div>
+                            </div>
+                        </Show>
+
+                        {/* Correlations */}
+                        <Show when={correlations().length > 0}>
+                            <div>
+                                <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-2 flex items-center gap-1">
+                                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13.828 10.172a4 4 0 00-5.656 0l-4 4a4 4 0 105.656 5.656l1.102-1.101m-.758-4.899a4 4 0 005.656 0l4-4a4 4 0 00-5.656-5.656l-1.1 1.1" />
+                                    </svg>
+                                    Resource Dependencies
+                                </h4>
+                                <div class="space-y-2">
+                                    <For each={correlations()}>
+                                        {(corr) => (
+                                            <div class="bg-white/50 dark:bg-gray-800/50 rounded-lg p-3 border border-purple-100 dark:border-purple-800">
+                                                <div class="flex items-center gap-2 text-sm">
+                                                    <span class="font-medium text-gray-800 dark:text-gray-200">
+                                                        {corr.source_name || corr.source_id}
+                                                    </span>
+                                                    <svg class="w-4 h-4 text-purple-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M17 8l4 4m0 0l-4 4m4-4H3" />
+                                                    </svg>
+                                                    <span class="font-medium text-gray-800 dark:text-gray-200">
+                                                        {corr.target_name || corr.target_id}
+                                                    </span>
+                                                </div>
+                                                <p class="text-sm text-gray-600 dark:text-gray-400 mt-1">
+                                                    {corr.description || `${corr.event_pattern} (${corr.occurrences} observations)`}
+                                                </p>
+                                                <div class="flex items-center gap-3 mt-1 text-xs text-gray-500 dark:text-gray-400">
+                                                    <span>Avg delay: {corr.avg_delay}</span>
+                                                    <span>Confidence: {Math.round(corr.confidence * 100)}%</span>
+                                                </div>
+                                            </div>
+                                        )}
+                                    </For>
+                                </div>
+                            </div>
+                        </Show>
+
+                        {/* Empty state */}
+                        <Show when={!loading() && totalInsights() === 0}>
+                            <p class="text-sm text-gray-500 dark:text-gray-400 text-center py-2">
+                                No predictions or correlations detected yet. The AI will learn patterns over time.
+                            </p>
+                        </Show>
+                    </div>
+                </Show>
+            </div>
+        </Show>
+    );
+};
diff --git a/frontend-modern/src/components/shared/ColumnPicker.tsx b/frontend-modern/src/components/shared/ColumnPicker.tsx
new file mode 100644
index 0000000..d372b61
--- /dev/null
+++ b/frontend-modern/src/components/shared/ColumnPicker.tsx
@@ -0,0 +1,127 @@
+import { Component, Show, For, createSignal, onCleanup, createEffect } from 'solid-js';
+import type { ColumnDef } from '@/hooks/useColumnVisibility';
+
+interface ColumnPickerProps {
+  /** Columns that can be toggled */
+  columns: ColumnDef[];
+  /** Check if a column is currently hidden */
+  isHidden: (id: string) => boolean;
+  /** Toggle a column's visibility */
+  onToggle: (id: string) => void;
+  /** Reset all columns to visible */
+  onReset?: () => void;
+}
+
+export const ColumnPicker: Component<ColumnPickerProps> = (props) => {
+  const [isOpen, setIsOpen] = createSignal(false);
+  let containerRef: HTMLDivElement | undefined;
+
+  // Close on click outside
+  const handleClickOutside = (e: MouseEvent) => {
+    if (containerRef && !containerRef.contains(e.target as Node)) {
+      setIsOpen(false);
+    }
+  };
+
+  createEffect(() => {
+    if (isOpen()) {
+      document.addEventListener('mousedown', handleClickOutside);
+    } else {
+      document.removeEventListener('mousedown', handleClickOutside);
+    }
+  });
+
+  onCleanup(() => {
+    document.removeEventListener('mousedown', handleClickOutside);
+  });
+
+  // Count how many are hidden
+  const hiddenCount = () => props.columns.filter(c => props.isHidden(c.id)).length;
+
+  return (
+    <div ref={containerRef} class="relative">
+      <button
+        type="button"
+        onClick={() => setIsOpen(!isOpen())}
+        class={`inline-flex items-center gap-1.5 px-2.5 py-1.5 text-xs font-medium rounded-lg transition-all
+          ${isOpen()
+            ? 'bg-blue-100 dark:bg-blue-900/40 text-blue-700 dark:text-blue-300'
+            : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-300 hover:bg-gray-200 dark:hover:bg-gray-600'
+          }`}
+        title="Choose which columns to display"
+      >
+        {/* Columns icon */}
+        <svg class="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+          <path stroke-linecap="round" stroke-linejoin="round" d="M9 4v16M15 4v16M4 9h16M4 15h16" />
+        </svg>
+        <span>Columns</span>
+        <Show when={hiddenCount() > 0}>
+          <span class="ml-0.5 px-1.5 py-0.5 text-[10px] font-semibold rounded-full bg-gray-200 dark:bg-gray-600 text-gray-700 dark:text-gray-200">
+            {hiddenCount()} hidden
+          </span>
+        </Show>
+      </button>
+
+      <Show when={isOpen()}>
+        <div
+          class="absolute right-0 mt-1 w-56 rounded-lg border border-gray-200 bg-white shadow-xl z-50
+                 dark:border-gray-700 dark:bg-gray-800"
+        >
+          <div class="px-3 py-2 border-b border-gray-100 dark:border-gray-700">
+            <div class="flex items-center justify-between">
+              <span class="text-xs font-medium text-gray-700 dark:text-gray-200">Show Columns</span>
+              <Show when={props.onReset && hiddenCount() > 0}>
+                <button
+                  type="button"
+                  onClick={() => props.onReset?.()}
+                  class="text-[10px] text-blue-600 dark:text-blue-400 hover:underline"
+                >
+                  Show all
+                </button>
+              </Show>
+            </div>
+          </div>
+
+          <div class="max-h-64 overflow-y-auto py-1">
+            <For each={props.columns}>
+              {(col) => {
+                const isChecked = () => !props.isHidden(col.id);
+                return (
+                  <label
+                    class="flex items-center gap-2.5 px-3 py-2 cursor-pointer
+                           hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors"
+                  >
+                    <input
+                      type="checkbox"
+                      checked={isChecked()}
+                      onChange={() => props.onToggle(col.id)}
+                      class="w-3.5 h-3.5 rounded border-gray-300 text-blue-600
+                             focus:ring-blue-500 focus:ring-offset-0
+                             dark:border-gray-600 dark:bg-gray-700 dark:checked:bg-blue-600"
+                    />
+                    <span class={`text-sm ${isChecked() ? 'text-gray-700 dark:text-gray-200' : 'text-gray-400 dark:text-gray-500'}`}>
+                      {col.label}
+                    </span>
+                    <Show when={col.priority !== 'essential'}>
+                      <span class="ml-auto text-[10px] text-gray-400 dark:text-gray-500">
+                        {col.priority === 'secondary' && 'md+'}
+                        {col.priority === 'supplementary' && 'lg+'}
+                        {col.priority === 'detailed' && 'xl+'}
+                      </span>
+                    </Show>
+                  </label>
+                );
+              }}
+            </For>
+          </div>
+
+          <Show when={props.columns.length === 0}>
+            <div class="px-3 py-4 text-xs text-gray-500 dark:text-gray-400 text-center">
+              No columns available to toggle at this screen size
+            </div>
+          </Show>
+        </div>
+      </Show>
+    </div>
+  );
+};
diff --git a/frontend-modern/src/components/shared/MetricsViewToggle.tsx b/frontend-modern/src/components/shared/MetricsViewToggle.tsx
index 597175a..33b0219 100644
--- a/frontend-modern/src/components/shared/MetricsViewToggle.tsx
+++ b/frontend-modern/src/components/shared/MetricsViewToggle.tsx
@@ -2,41 +2,72 @@
  * Metrics View Mode Toggle
  *
  * Toggle button to switch between progress bars and sparkline views for metrics.
+ * When in sparklines mode, also shows time range selection buttons.
  * This is a global setting that affects all tables throughout the app.
  */
 
-import { Component } from 'solid-js';
-import { useMetricsViewMode } from '@/stores/metricsViewMode';
+import { Component, Show } from 'solid-js';
+import { useMetricsViewMode, TIME_RANGE_OPTIONS } from '@/stores/metricsViewMode';
+import type { TimeRange } from '@/api/charts';
 
 export const MetricsViewToggle: Component = () => {
-  const { viewMode, setViewMode } = useMetricsViewMode();
+  const { viewMode, setViewMode, timeRange, setTimeRange } = useMetricsViewMode();
 
   return (
-    <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
-      <button
-        type="button"
-        onClick={() => setViewMode('bars')}
-        class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-          viewMode() === 'bars'
-            ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-            : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-        }`}
-        title="Bar view"
-      >
-        Bars
-      </button>
-      <button
-        type="button"
-        onClick={() => setViewMode('sparklines')}
-        class={`px-2.5 py-1 text-xs font-medium rounded-md transition-all ${
-          viewMode() === 'sparklines'
-            ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-            : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-        }`}
-        title="Sparkline view"
-      >
-        Trends
-      </button>
+    <div class="inline-flex items-center gap-2">
+      {/* View Mode Toggle */}
+      <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+        <button
+          type="button"
+          onClick={() => setViewMode('bars')}
+          class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'bars'
+            ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+            : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+            }`}
+          title="Bar view"
+        >
+          <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <rect x="3" y="12" width="4" height="9" rx="1" />
+            <rect x="10" y="6" width="4" height="15" rx="1" />
+            <rect x="17" y="3" width="4" height="18" rx="1" />
+          </svg>
+          Bars
+        </button>
+        <button
+          type="button"
+          onClick={() => setViewMode('sparklines')}
+          class={`inline-flex items-center gap-1.5 px-2.5 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${viewMode() === 'sparklines'
+            ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+            : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+            }`}
+          title="Sparkline view"
+        >
+          <svg class="w-3 h-3" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <polyline points="3 17 9 11 13 15 21 7" />
+            <polyline points="17 7 21 7 21 11" />
+          </svg>
+          Trends
+        </button>
+      </div>
+
+      {/* Time Range Selector - only shown in sparklines mode, appears to the right */}
+      <Show when={viewMode() === 'sparklines'}>
+        <div class="inline-flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5">
+          {TIME_RANGE_OPTIONS.map((option) => (
+            <button
+              type="button"
+              onClick={() => setTimeRange(option.value as TimeRange)}
+              class={`px-2 py-1 text-xs font-medium rounded-md transition-all duration-150 active:scale-95 ${timeRange() === option.value
+                ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm ring-1 ring-gray-200 dark:ring-gray-600'
+                : 'text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200 hover:bg-gray-50 dark:hover:bg-gray-600/50'
+                }`}
+              title={`Show last ${option.label} of data`}
+            >
+              {option.label}
+            </button>
+          ))}
+        </div>
+      </Show>
     </div>
   );
 };
diff --git a/frontend-modern/src/components/shared/NodeSummaryTable.tsx b/frontend-modern/src/components/shared/NodeSummaryTable.tsx
index a3b65e0..82dd883 100644
--- a/frontend-modern/src/components/shared/NodeSummaryTable.tsx
+++ b/frontend-modern/src/components/shared/NodeSummaryTable.tsx
@@ -15,6 +15,7 @@ import { StackedMemoryBar } from '@/components/Dashboard/StackedMemoryBar';
 import { EnhancedCPUBar } from '@/components/Dashboard/EnhancedCPUBar';
 import { TemperatureGauge } from '@/components/shared/TemperatureGauge';
 import { useBreakpoint } from '@/hooks/useBreakpoint';
+import { useMetricsViewMode } from '@/stores/metricsViewMode';
 
 interface NodeSummaryTableProps {
   nodes: Node[];
@@ -34,6 +35,7 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
   const alertsActivation = useAlertsActivation();
   const alertsEnabled = createMemo(() => alertsActivation.activationState() === 'active');
   const { isMobile } = useBreakpoint();
+  const { viewMode } = useMetricsViewMode();
 
   const isTemperatureMonitoringEnabled = (node: Node): boolean => {
     const globalEnabled = props.globalTemperatureMonitoringEnabled ?? true;
@@ -335,55 +337,60 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
     return sortDirection() === 'asc' ? '▲' : '▼';
   };
 
-  const thClass = "px-2 py-1 text-center text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap";
+  const thClassBase = "px-2 py-1 text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-200 dark:hover:bg-gray-600 whitespace-nowrap";
+  const thClass = `${thClassBase} text-center`;
+
+  // Cell class constants for consistency
+  const tdClass = "px-2 py-1 align-middle";
+  const metricColumnStyle = { width: "200px", "min-width": "200px", "max-width": "200px" } as const;
 
   return (
     <Card padding="none" tone="glass" class="mb-4 overflow-hidden">
       <div class="overflow-x-auto">
-        <table class="w-full border-collapse whitespace-nowrap">
+        <table class="w-full border-collapse whitespace-nowrap" style={{ "min-width": "800px" }}>
           <thead>
             <tr class="bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-300 border-b border-gray-200 dark:border-gray-700">
               <th
-                class={`${thClass} text-left pl-3`}
+                class={`${thClassBase} text-left pl-3`}
                 onClick={() => handleSort('name')}
               >
                 {props.currentTab === 'backups' ? 'Node / PBS' : 'Node'} {renderSortIndicator('name')}
               </th>
-              <th class={thClass} onClick={() => handleSort('uptime')}>
+              <th class={thClass} style={{ "min-width": '80px' }} onClick={() => handleSort('uptime')}>
                 Uptime {renderSortIndicator('uptime')}
               </th>
-              <th class={thClass} onClick={() => handleSort('cpu')}>
+              <th class={thClass} style={{ width: "200px", "min-width": "200px", "max-width": "200px" }} onClick={() => handleSort('cpu')}>
                 CPU {renderSortIndicator('cpu')}
               </th>
-              <th class={thClass} onClick={() => handleSort('memory')}>
+              <th class={thClass} style={{ width: "200px", "min-width": "200px", "max-width": "200px" }} onClick={() => handleSort('memory')}>
                 Memory {renderSortIndicator('memory')}
               </th>
-              <th class={thClass} onClick={() => handleSort('disk')}>
+              <th class={thClass} style={{ width: "200px", "min-width": "200px", "max-width": "200px" }} onClick={() => handleSort('disk')}>
                 Disk {renderSortIndicator('disk')}
               </th>
               <Show when={hasAnyTemperatureData()}>
-                <th class={thClass} onClick={() => handleSort('temperature')}>
+                <th class={thClass} style={{ "min-width": '60px' }} onClick={() => handleSort('temperature')}>
                   Temp {renderSortIndicator('temperature')}
                 </th>
               </Show>
               <Show when={props.currentTab === 'dashboard'}>
-                <th class={thClass} onClick={() => handleSort('vmCount')}>
+                <th class={thClass} style={{ "min-width": '50px' }} onClick={() => handleSort('vmCount')}>
                   VMs {renderSortIndicator('vmCount')}
                 </th>
-                <th class={thClass} onClick={() => handleSort('containerCount')}>
+                <th class={thClass} style={{ "min-width": '50px' }} onClick={() => handleSort('containerCount')}>
                   CTs {renderSortIndicator('containerCount')}
                 </th>
               </Show>
               <Show when={props.currentTab === 'storage'}>
-                <th class={thClass} onClick={() => handleSort('storageCount')}>
+                <th class={thClass} style={{ "min-width": '70px' }} onClick={() => handleSort('storageCount')}>
                   Storage {renderSortIndicator('storageCount')}
                 </th>
-                <th class={thClass} onClick={() => handleSort('diskCount')}>
+                <th class={thClass} style={{ "min-width": '60px' }} onClick={() => handleSort('diskCount')}>
                   Disks {renderSortIndicator('diskCount')}
                 </th>
               </Show>
               <Show when={props.currentTab === 'backups'}>
-                <th class={thClass} onClick={() => handleSort('backupCount')}>
+                <th class={thClass} style={{ "min-width": '70px' }} onClick={() => handleSort('backupCount')}>
                   Backups {renderSortIndicator('backupCount')}
                 </th>
               </Show>
@@ -475,7 +482,7 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
                 return (
                   <tr
                     class={rowClass()}
-                    style={rowStyle()}
+                    style={{ ...rowStyle(), height: '29px', 'max-height': '29px' }}
                     onClick={() => props.onNodeClick(nodeId, isPVEItem ? 'pve' : 'pbs')}
                   >
                     {/* Name */}
@@ -541,7 +548,7 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
                     </td>
 
                     {/* Uptime */}
-                    <td class="px-2 py-1 align-middle">
+                    <td class={tdClass}>
                       <div class="flex justify-center">
                         <span
                           class={`text-xs whitespace-nowrap ${isPVEItem && (node?.uptime ?? 0) < 3600
@@ -559,13 +566,13 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
                     </td>
 
                     {/* CPU */}
-                    <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+                    <td class={tdClass} style={metricColumnStyle}>
                       <Show when={isMobile()}>
-                        <div class="md:hidden flex justify-center">
+                        <div class="md:hidden h-4 flex items-center justify-center">
                           <MetricText value={cpuPercentValue} type="cpu" />
                         </div>
                       </Show>
-                      <div class="hidden md:block">
+                      <div class="hidden md:block h-4">
                         <Show when={isPVEItem} fallback={
                           <ResponsiveMetricCell
                             value={cpuPercentValue}
@@ -587,13 +594,13 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
                     </td>
 
                     {/* Memory */}
-                    <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+                    <td class={tdClass} style={metricColumnStyle}>
                       <Show when={isMobile()}>
-                        <div class="md:hidden flex justify-center">
+                        <div class="md:hidden h-4 flex items-center justify-center">
                           <MetricText value={memoryPercentValue} type="memory" />
                         </div>
                       </Show>
-                      <div class="hidden md:block">
+                      <div class="hidden md:block h-4">
                         <Show when={isPVEItem} fallback={
                           <ResponsiveMetricCell
                             value={memoryPercentValue}
@@ -604,19 +611,33 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
                             showMobile={false}
                           />
                         }>
-                          <StackedMemoryBar
-                            used={node!.memory?.used || 0}
-                            total={node!.memory?.total || 0}
-                            balloon={node!.memory?.balloon || 0}
-                            swapUsed={node!.memory?.swapUsed || 0}
-                            swapTotal={node!.memory?.swapTotal || 0}
-                          />
+                          <Show
+                            when={viewMode() === 'sparklines'}
+                            fallback={
+                              <StackedMemoryBar
+                                used={node!.memory?.used || 0}
+                                total={node!.memory?.total || 0}
+                                balloon={node!.memory?.balloon || 0}
+                                swapUsed={node!.memory?.swapUsed || 0}
+                                swapTotal={node!.memory?.swapTotal || 0}
+                                resourceId={metricsKey}
+                              />
+                            }
+                          >
+                            <ResponsiveMetricCell
+                              value={memoryPercentValue}
+                              type="memory"
+                              resourceId={metricsKey}
+                              isRunning={online}
+                              showMobile={false}
+                            />
+                          </Show>
                         </Show>
                       </div>
                     </td>
 
                     {/* Disk */}
-                    <td class="px-2 py-1 align-middle" style={{ "min-width": "140px" }}>
+                    <td class={tdClass} style={metricColumnStyle}>
                       <ResponsiveMetricCell
                         value={diskPercentValue}
                         type="disk"
@@ -629,7 +650,7 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
 
                     {/* Temperature */}
                     <Show when={hasAnyTemperatureData()}>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <Show
                             when={
@@ -681,14 +702,14 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
 
                     {/* Dashboard tab: VMs and CTs */}
                     <Show when={props.currentTab === 'dashboard'}>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <span class={online ? 'text-xs text-gray-700 dark:text-gray-300' : 'text-xs text-gray-400 dark:text-gray-500'}>
                             {online ? getCountValue(item, 'vmCount') ?? '-' : '-'}
                           </span>
                         </div>
                       </td>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <span class={online ? 'text-xs text-gray-700 dark:text-gray-300' : 'text-xs text-gray-400 dark:text-gray-500'}>
                             {online ? getCountValue(item, 'containerCount') ?? '-' : '-'}
@@ -699,14 +720,14 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
 
                     {/* Storage tab: Storage and Disks */}
                     <Show when={props.currentTab === 'storage'}>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <span class={online ? 'text-xs text-gray-700 dark:text-gray-300' : 'text-xs text-gray-400 dark:text-gray-500'}>
                             {online ? getCountValue(item, 'storageCount') ?? '-' : '-'}
                           </span>
                         </div>
                       </td>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <span class={online ? 'text-xs text-gray-700 dark:text-gray-300' : 'text-xs text-gray-400 dark:text-gray-500'}>
                             {online ? getCountValue(item, 'diskCount') ?? '-' : '-'}
@@ -717,7 +738,7 @@ export const NodeSummaryTable: Component<NodeSummaryTableProps> = (props) => {
 
                     {/* Backups tab: Backups */}
                     <Show when={props.currentTab === 'backups'}>
-                      <td class="px-2 py-1 align-middle">
+                      <td class={tdClass}>
                         <div class="flex justify-center">
                           <span class={online ? 'text-xs text-gray-700 dark:text-gray-300' : 'text-xs text-gray-400 dark:text-gray-500'}>
                             {online ? getCountValue(item, 'backupCount') ?? '-' : '-'}
diff --git a/frontend-modern/src/components/shared/Sparkline.tsx b/frontend-modern/src/components/shared/Sparkline.tsx
index 268051d..6fc3394 100644
--- a/frontend-modern/src/components/shared/Sparkline.tsx
+++ b/frontend-modern/src/components/shared/Sparkline.tsx
@@ -41,7 +41,7 @@ export const Sparkline: Component<SparklineProps> = (props) => {
     }
     return props.width || 120;
   };
-  const height = () => props.height || 24;
+  const height = () => props.height || 16;
 
   // Default thresholds based on metric type
   const getDefaultThresholds = () => {
@@ -95,6 +95,8 @@ export const Sparkline: Component<SparklineProps> = (props) => {
     const dpr = window.devicePixelRatio || 1;
     canvas.width = w * dpr;
     canvas.height = h * dpr;
+    // Always set explicit width style to prevent canvas from expanding beyond container
+    // When width=0, we use the calculated container width
     canvas.style.width = `${w}px`;
     canvas.style.height = `${h}px`;
     ctx.scale(dpr, dpr);
@@ -102,6 +104,22 @@ export const Sparkline: Component<SparklineProps> = (props) => {
     // Clear canvas
     ctx.clearRect(0, 0, w, h);
 
+    // Detect dark mode for reference line color
+    const isDark = document.documentElement.classList.contains('dark');
+
+    // Draw subtle reference lines at 25%, 50%, 75% to help understand scale
+    // These provide visual anchors so users can distinguish 17% from 70%
+    ctx.strokeStyle = isDark ? 'rgba(255, 255, 255, 0.08)' : 'rgba(0, 0, 0, 0.06)';
+    ctx.lineWidth = 1;
+    ctx.setLineDash([]);
+    [0.25, 0.5, 0.75].forEach(pct => {
+      const y = h - (pct * h);
+      ctx.beginPath();
+      ctx.moveTo(0, y);
+      ctx.lineTo(w, y);
+      ctx.stroke();
+    });
+
     if (!data || data.length === 0) {
       // No data - show empty state
       ctx.strokeStyle = '#d1d5db'; // gray-300
@@ -138,34 +156,10 @@ export const Sparkline: Component<SparklineProps> = (props) => {
       points.push({ x, y });
     });
 
-    // Draw threshold reference lines
-    const t = thresholds();
-    ctx.strokeStyle = '#94a3b8'; // gray-400
-    ctx.lineWidth = 0.5;
-    ctx.globalAlpha = 0.3;
-    ctx.setLineDash([2, 2]);
-
-    // Warning threshold line
-    const warningY = h - ((t.warning - minValue) / (maxValue - minValue)) * h;
-    ctx.beginPath();
-    ctx.moveTo(0, warningY);
-    ctx.lineTo(w, warningY);
-    ctx.stroke();
-
-    // Critical threshold line
-    const criticalY = h - ((t.critical - minValue) / (maxValue - minValue)) * h;
-    ctx.beginPath();
-    ctx.moveTo(0, criticalY);
-    ctx.lineTo(w, criticalY);
-    ctx.stroke();
-
-    ctx.setLineDash([]);
-    ctx.globalAlpha = 1;
-
     // Draw gradient fill
     const gradient = ctx.createLinearGradient(0, 0, 0, h);
-    gradient.addColorStop(0, `${color}40`); // 25% opacity at top
-    gradient.addColorStop(1, `${color}10`); // 6% opacity at bottom
+    gradient.addColorStop(0, `${color}5A`); // 35% opacity at top
+    gradient.addColorStop(1, `${color}1F`); // 12% opacity at bottom
 
     ctx.fillStyle = gradient;
     ctx.beginPath();
@@ -189,19 +183,15 @@ export const Sparkline: Component<SparklineProps> = (props) => {
       }
     });
     ctx.stroke();
-
-    // Draw current value dot with opacity
-    if (points.length > 0) {
-      const lastPoint = points[points.length - 1];
-      ctx.fillStyle = colorWithOpacity;
-      ctx.beginPath();
-      ctx.arc(lastPoint.x, lastPoint.y, 2, 0, Math.PI * 2);
-      ctx.fill();
-    }
   };
 
   // Redraw when data or dimensions change
   createEffect(() => {
+    void props.data;
+    void props.metric;
+    void width();
+    void height();
+
     // Unregister previous draw callback if it exists
     if (unregister) {
       unregister();
@@ -249,22 +239,21 @@ export const Sparkline: Component<SparklineProps> = (props) => {
     setHoveredPoint(null);
   };
 
-  // Format timestamp for tooltip
+  // Format timestamp for tooltip (24-hour clock)
   const formatTime = (timestamp: number) => {
     const date = new Date(timestamp);
-    return date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', second: '2-digit' });
+    return date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', second: '2-digit', hour12: false });
   };
 
   return (
     <>
-      <div class="relative block w-full">
+      <div class="relative block w-full overflow-hidden" style={{ height: `${height()}px`, 'max-width': '100%' }}>
         <canvas
           ref={canvasRef}
-          class="block cursor-crosshair transition-opacity duration-150"
+          class="block cursor-crosshair"
           style={{
-            width: `${width()}px`,
             height: `${height()}px`,
-            opacity: hoveredPoint() ? '1' : '0.7',
+            'max-width': '100%',
           }}
           onMouseMove={handleMouseMove}
           onMouseLeave={handleMouseLeave}
diff --git a/frontend-modern/src/components/shared/StatusDot.tsx b/frontend-modern/src/components/shared/StatusDot.tsx
index 8b1b4b7..03b6905 100644
--- a/frontend-modern/src/components/shared/StatusDot.tsx
+++ b/frontend-modern/src/components/shared/StatusDot.tsx
@@ -27,14 +27,15 @@ const SIZE_CLASSES: Record<StatusDotSize, string> = {
 };
 
 export function StatusDot(props: StatusDotProps): JSX.Element {
-  const variant = props.variant ?? 'muted';
-  const size = props.size ?? 'sm';
-  const ariaHidden = props.ariaHidden ?? !props.ariaLabel;
+  // Use getters to maintain reactivity - props can change over time
+  const variant = () => props.variant ?? 'muted';
+  const size = () => props.size ?? 'sm';
+  const ariaHidden = () => props.ariaHidden ?? !props.ariaLabel;
 
-  const className = [
+  const className = () => [
     'inline-block rounded-full flex-shrink-0',
-    SIZE_CLASSES[size],
-    VARIANT_CLASSES[variant],
+    SIZE_CLASSES[size()],
+    VARIANT_CLASSES[variant()],
     props.pulse ? 'animate-pulse' : '',
     props.class ?? '',
   ]
@@ -43,10 +44,10 @@ export function StatusDot(props: StatusDotProps): JSX.Element {
 
   return (
     <span
-      class={className}
+      class={className()}
       title={props.title}
       aria-label={props.ariaLabel}
-      aria-hidden={ariaHidden}
+      aria-hidden={ariaHidden()}
       role={props.ariaLabel ? 'img' : undefined}
     />
   );
diff --git a/frontend-modern/src/components/shared/responsive/ResponsiveMetricCell.tsx b/frontend-modern/src/components/shared/responsive/ResponsiveMetricCell.tsx
index b9adb76..c5f65c6 100644
--- a/frontend-modern/src/components/shared/responsive/ResponsiveMetricCell.tsx
+++ b/frontend-modern/src/components/shared/responsive/ResponsiveMetricCell.tsx
@@ -78,7 +78,9 @@ export const ResponsiveMetricCell: Component<ResponsiveMetricCellProps> = (props
   const isRunning = () => props.isRunning !== false; // Default to true if not specified
 
   const defaultFallback = (
-    <span class="text-xs text-gray-400 dark:text-gray-500">—</span>
+    <div class="h-4 flex items-center justify-center">
+      <span class="text-xs text-gray-400 dark:text-gray-500">—</span>
+    </div>
   );
 
   return (
@@ -148,7 +150,9 @@ export const DualMetricCell: Component<{
   const isRunning = () => props.isRunning !== false;
 
   const defaultFallback = (
-    <span class="text-xs text-gray-400 dark:text-gray-500">—</span>
+    <div class="h-4 flex items-center justify-center">
+      <span class="text-xs text-gray-400 dark:text-gray-500">—</span>
+    </div>
   );
 
   const defaultMobileContent = (
diff --git a/frontend-modern/src/constants/apiScopes.ts b/frontend-modern/src/constants/apiScopes.ts
index b078858..f2e5daa 100644
--- a/frontend-modern/src/constants/apiScopes.ts
+++ b/frontend-modern/src/constants/apiScopes.ts
@@ -8,6 +8,8 @@ export interface APIScopeOption {
 export const HOST_AGENT_SCOPE = 'host-agent:report';
 export const DOCKER_REPORT_SCOPE = 'docker:report';
 export const DOCKER_MANAGE_SCOPE = 'docker:manage';
+export const KUBERNETES_REPORT_SCOPE = 'kubernetes:report';
+export const KUBERNETES_MANAGE_SCOPE = 'kubernetes:manage';
 export const MONITORING_READ_SCOPE = 'monitoring:read';
 export const MONITORING_WRITE_SCOPE = 'monitoring:write';
 export const SETTINGS_READ_SCOPE = 'settings:read';
@@ -38,6 +40,18 @@ export const API_SCOPE_OPTIONS: APIScopeOption[] = [
     description: 'Enable agent-triggered runtime commands and host actions.',
     group: 'Agents',
   },
+  {
+    value: KUBERNETES_REPORT_SCOPE,
+    label: 'Kubernetes agent reporting',
+    description: 'Allow the Kubernetes agent to submit cluster, node, and workload telemetry.',
+    group: 'Agents',
+  },
+  {
+    value: KUBERNETES_MANAGE_SCOPE,
+    label: 'Kubernetes cluster management',
+    description: 'Allow administrative actions for Kubernetes cluster agents.',
+    group: 'Agents',
+  },
   {
     value: HOST_AGENT_SCOPE,
     label: 'Host agent reporting',
diff --git a/frontend-modern/src/hooks/__tests__/useResources.test.ts b/frontend-modern/src/hooks/__tests__/useResources.test.ts
new file mode 100644
index 0000000..ca8b5ba
--- /dev/null
+++ b/frontend-modern/src/hooks/__tests__/useResources.test.ts
@@ -0,0 +1,519 @@
+/**
+ * Tests for useResources hook functionality
+ * 
+ * Note: These tests focus on the logic and type conversions rather than
+ * reactive behavior, which requires a full SolidJS testing environment.
+ */
+import { describe, expect, it } from 'vitest';
+import type { Resource, ResourceStatus } from '@/types/resource';
+
+// Helper to create mock resources for testing conversion logic
+function createMockResource(overrides: Partial<Resource> = {}): Resource {
+    return {
+        id: 'test-resource-1',
+        type: 'vm',
+        name: 'test-vm',
+        displayName: 'Test VM',
+        platformId: 'pve1',
+        platformType: 'proxmox-pve',
+        sourceType: 'api',
+        status: 'running',
+        lastSeen: Date.now(),
+        cpu: { current: 25.5 },
+        memory: { current: 50, total: 4294967296, used: 2147483648 },
+        disk: { current: 30, total: 107374182400, used: 32212254720 },
+        ...overrides,
+    };
+}
+
+describe('useResources - Resource Filtering Logic', () => {
+    describe('byType filtering', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: '1', type: 'vm' }),
+            createMockResource({ id: '2', type: 'vm' }),
+            createMockResource({ id: '3', type: 'container' }),
+            createMockResource({ id: '4', type: 'node' }),
+            createMockResource({ id: '5', type: 'docker-container' }),
+        ];
+
+        it('filters resources by single type', () => {
+            const vms = resources.filter(r => r.type === 'vm');
+            expect(vms).toHaveLength(2);
+        });
+
+        it('returns empty array when no matches', () => {
+            const filtered = resources.filter(r => r.type === 'pbs');
+            expect(filtered).toHaveLength(0);
+        });
+    });
+
+    describe('byPlatform filtering', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: '1', platformType: 'proxmox-pve' }),
+            createMockResource({ id: '2', platformType: 'proxmox-pve' }),
+            createMockResource({ id: '3', platformType: 'docker' }),
+            createMockResource({ id: '4', platformType: 'host-agent' }),
+        ];
+
+        it('filters resources by platform', () => {
+            const pveResources = resources.filter(r => r.platformType === 'proxmox-pve');
+            expect(pveResources).toHaveLength(2);
+        });
+
+        it('filters Docker resources', () => {
+            const dockerResources = resources.filter(r => r.platformType === 'docker');
+            expect(dockerResources).toHaveLength(1);
+        });
+    });
+
+    describe('children filtering', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: 'node-1', type: 'node' }),
+            createMockResource({ id: 'vm-1', type: 'vm', parentId: 'node-1' }),
+            createMockResource({ id: 'vm-2', type: 'vm', parentId: 'node-1' }),
+            createMockResource({ id: 'vm-3', type: 'vm', parentId: 'node-2' }),
+        ];
+
+        it('finds children of a parent', () => {
+            const children = resources.filter(r => r.parentId === 'node-1');
+            expect(children).toHaveLength(2);
+        });
+
+        it('returns empty array for parent with no children', () => {
+            const children = resources.filter(r => r.parentId === 'node-3');
+            expect(children).toHaveLength(0);
+        });
+    });
+
+    describe('complex filtering', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: '1', type: 'vm', status: 'running', platformType: 'proxmox-pve' }),
+            createMockResource({ id: '2', type: 'vm', status: 'stopped', platformType: 'proxmox-pve' }),
+            createMockResource({ id: '3', type: 'container', status: 'running', platformType: 'proxmox-pve' }),
+            createMockResource({ id: '4', type: 'docker-container', status: 'running', platformType: 'docker' }),
+        ];
+
+        it('filters by multiple criteria', () => {
+            const runningPveVms = resources.filter(r =>
+                r.type === 'vm' &&
+                r.status === 'running' &&
+                r.platformType === 'proxmox-pve'
+            );
+            expect(runningPveVms).toHaveLength(1);
+        });
+
+        it('filters by search term in name', () => {
+            const searchTerm = 'test';
+            const matched = resources.filter(r =>
+                r.name.toLowerCase().includes(searchTerm.toLowerCase())
+            );
+            expect(matched).toHaveLength(4);
+        });
+    });
+
+    describe('status counts', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: '1', status: 'running' }),
+            createMockResource({ id: '2', status: 'running' }),
+            createMockResource({ id: '3', status: 'stopped' }),
+            createMockResource({ id: '4', status: 'online' }),
+            createMockResource({ id: '5', status: 'degraded' }),
+        ];
+
+        it('counts resources by status', () => {
+            const counts: Record<ResourceStatus, number> = {
+                online: 0,
+                offline: 0,
+                running: 0,
+                stopped: 0,
+                degraded: 0,
+                paused: 0,
+                unknown: 0,
+            };
+
+            for (const r of resources) {
+                if (r.status in counts) {
+                    counts[r.status]++;
+                }
+            }
+
+            expect(counts.running).toBe(2);
+            expect(counts.stopped).toBe(1);
+            expect(counts.online).toBe(1);
+            expect(counts.degraded).toBe(1);
+        });
+    });
+
+    describe('topByCpu sorting', () => {
+        const resources: Resource[] = [
+            createMockResource({ id: '1', name: 'low', cpu: { current: 10 } }),
+            createMockResource({ id: '2', name: 'high', cpu: { current: 90 } }),
+            createMockResource({ id: '3', name: 'medium', cpu: { current: 50 } }),
+            createMockResource({ id: '4', name: 'no-cpu', cpu: undefined }), // Explicitly no CPU data
+        ];
+
+        it('sorts by CPU descending and limits results', () => {
+            const sorted = [...resources]
+                .filter(r => r.cpu && r.cpu.current > 0)
+                .sort((a, b) => (b.cpu?.current ?? 0) - (a.cpu?.current ?? 0))
+                .slice(0, 2);
+
+            expect(sorted).toHaveLength(2);
+            expect(sorted[0].name).toBe('high');
+            expect(sorted[1].name).toBe('medium');
+        });
+
+        it('excludes resources without CPU data', () => {
+            const withCpu = resources.filter(r => r.cpu && r.cpu.current > 0);
+            expect(withCpu).toHaveLength(3);
+        });
+    });
+});
+
+describe('useResourcesAsLegacy - Legacy Format Conversion', () => {
+    describe('VM conversion', () => {
+        it('converts Resource to legacy VM format', () => {
+            const resource = createMockResource({
+                type: 'vm',
+                cpu: { current: 50 },
+                memory: { current: 60, total: 4294967296, used: 2576980378 },
+                disk: { current: 30, total: 107374182400, used: 32212254720 },
+                uptime: 86400,
+                network: { rxBytes: 1000000, txBytes: 500000 },
+                tags: ['web', 'production'],
+                platformData: {
+                    vmid: 100,
+                    node: 'pve1',
+                    instance: 'pve1/qemu/100',
+                    cpus: 4,
+                    template: false,
+                    osName: 'Ubuntu',
+                    osVersion: '22.04',
+                },
+            });
+
+            // Simulate the conversion logic from useResourcesAsLegacy
+            const platformData = resource.platformData as Record<string, unknown>;
+            const legacyVm = {
+                id: resource.id,
+                vmid: platformData?.vmid as number ?? parseInt(resource.id.split('-').pop() ?? '0', 10),
+                name: resource.name,
+                node: platformData?.node as string ?? '',
+                instance: platformData?.instance as string ?? resource.platformId,
+                status: resource.status === 'running' ? 'running' : 'stopped',
+                type: 'qemu',
+                cpu: (resource.cpu?.current ?? 0) / 100, // Convert percentage to ratio
+                cpus: platformData?.cpus as number ?? 1,
+                memory: resource.memory ? {
+                    total: resource.memory.total ?? 0,
+                    used: resource.memory.used ?? 0,
+                    free: resource.memory.free ?? 0,
+                    usage: resource.memory.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                uptime: resource.uptime ?? 0,
+                networkIn: resource.network?.rxBytes ?? 0,
+                networkOut: resource.network?.txBytes ?? 0,
+                tags: resource.tags ?? [],
+            };
+
+            expect(legacyVm.vmid).toBe(100);
+            expect(legacyVm.node).toBe('pve1');
+            expect(legacyVm.cpu).toBe(0.5); // 50% -> 0.5 ratio
+            expect(legacyVm.memory.total).toBe(4294967296);
+            expect(legacyVm.uptime).toBe(86400);
+            expect(legacyVm.networkIn).toBe(1000000);
+            expect(legacyVm.tags).toEqual(['web', 'production']);
+        });
+
+        it('handles missing platformData gracefully', () => {
+            const resource = createMockResource({
+                type: 'vm',
+                platformData: undefined,
+            });
+
+            const platformData = resource.platformData as Record<string, unknown> | undefined;
+            const vmid = platformData?.vmid as number ?? 0;
+            const node = platformData?.node as string ?? '';
+
+            expect(vmid).toBe(0);
+            expect(node).toBe('');
+        });
+    });
+
+	    describe('Container conversion', () => {
+	        it('converts container Resource to legacy Container format', () => {
+	            const resource = createMockResource({
+	                type: 'container',
+	                platformData: {
+	                    vmid: 200,
+	                    node: 'pve1',
+	                },
+	            });
+
+	            const platformData = resource.platformData as Record<string, unknown>;
+	            const isOCI = resource.type === 'oci-container' || platformData?.isOci === true || platformData?.type === 'oci';
+	            const legacyContainer = {
+	                id: resource.id,
+	                vmid: platformData?.vmid as number,
+	                name: resource.name,
+	                type: isOCI ? 'oci' : ((platformData?.type as string) ?? 'lxc'),
+	                isOci: isOCI,
+	                osTemplate: platformData?.osTemplate as string | undefined,
+	                status: resource.status === 'running' ? 'running' : 'stopped',
+	            };
+
+	            expect(legacyContainer.vmid).toBe(200);
+	            expect(legacyContainer.type).toBe('lxc');
+	        });
+
+	        it('converts oci-container Resource to legacy Container format', () => {
+	            const resource = createMockResource({
+	                type: 'oci-container',
+	                platformData: {
+	                    vmid: 300,
+	                    node: 'pve1',
+	                    type: 'oci',
+	                    isOci: true,
+	                    osTemplate: 'oci:docker.io/library/alpine:latest',
+	                },
+	            });
+
+	            const platformData = resource.platformData as Record<string, unknown>;
+	            const isOCI = resource.type === 'oci-container' || platformData?.isOci === true || platformData?.type === 'oci';
+	            const legacyContainer = {
+	                id: resource.id,
+	                vmid: platformData?.vmid as number,
+	                name: resource.name,
+	                type: isOCI ? 'oci' : ((platformData?.type as string) ?? 'lxc'),
+	                isOci: isOCI,
+	                osTemplate: platformData?.osTemplate as string | undefined,
+	                status: resource.status === 'running' ? 'running' : 'stopped',
+	            };
+
+	            expect(legacyContainer.vmid).toBe(300);
+	            expect(legacyContainer.type).toBe('oci');
+	            expect(legacyContainer.isOci).toBe(true);
+	            expect(legacyContainer.osTemplate).toBe('oci:docker.io/library/alpine:latest');
+	        });
+	    });
+
+    describe('Node conversion', () => {
+        it('converts Resource to legacy Node format with temperature', () => {
+            const now = Date.now();
+            const resource = createMockResource({
+                type: 'node',
+                name: 'pve1',
+                status: 'online',
+                temperature: 45.5,
+                lastSeen: now,
+                cpu: { current: 35 },
+                platformData: {
+                    host: '192.168.1.10',
+                    loadAverage: [1.5, 1.2, 0.9],
+                    kernelVersion: '6.1.0-pve',
+                    pveVersion: '8.0.3',
+                },
+            });
+
+            // Simulate temperature conversion
+            let temperature = undefined;
+            if (resource.temperature !== undefined && resource.temperature !== null && resource.temperature > 0) {
+                temperature = {
+                    cpuPackage: resource.temperature,
+                    cpuMax: resource.temperature,
+                    available: true,
+                    hasCPU: true,
+                    hasGPU: false,
+                    hasNVMe: false,
+                    lastUpdate: new Date(resource.lastSeen).toISOString(),
+                };
+            }
+
+            expect(temperature).toBeDefined();
+            expect(temperature!.cpuPackage).toBe(45.5);
+            expect(temperature!.available).toBe(true);
+        });
+
+        it('handles node without temperature', () => {
+            const resource = createMockResource({
+                type: 'node',
+                temperature: undefined,
+            });
+
+            let temperature = undefined;
+            if (resource.temperature !== undefined && resource.temperature !== null && resource.temperature > 0) {
+                temperature = { cpuPackage: resource.temperature };
+            }
+
+            expect(temperature).toBeUndefined();
+        });
+
+        it('converts CPU from percentage to ratio', () => {
+            const resource = createMockResource({
+                type: 'node',
+                cpu: { current: 75 },
+            });
+
+            const legacyCpu = (resource.cpu?.current ?? 0) / 100;
+            expect(legacyCpu).toBe(0.75);
+        });
+    });
+
+    describe('DockerHost conversion', () => {
+        it('converts Resource to legacy DockerHost format with containers', () => {
+            const dockerHost = createMockResource({
+                id: 'docker-host-1',
+                type: 'docker-host',
+                name: 'docker-server',
+                platformType: 'docker',
+                cpu: { current: 25 },
+                memory: { current: 50, total: 8589934592, used: 4294967296 },
+                platformData: {
+                    agentId: 'agent-123',
+                    runtime: 'docker',
+                    runtimeVersion: '24.0.0',
+                    dockerVersion: '24.0.0',
+                    cpus: 8,
+                },
+            });
+
+            const dockerContainers: Resource[] = [
+                createMockResource({
+                    id: 'docker-host-1/container-abc',
+                    type: 'docker-container',
+                    name: 'nginx',
+                    parentId: 'docker-host-1',
+                    status: 'running',
+                    cpu: { current: 5 },
+                    memory: { current: 10, total: 134217728, used: 13421772 },
+                    platformData: {
+                        image: 'nginx:latest',
+                        health: 'healthy',
+                    },
+                }),
+            ];
+
+            // Simulate container ID extraction for sparklines
+            const originalContainerId = dockerContainers[0].id.includes('/')
+                ? dockerContainers[0].id.split('/').pop()!
+                : dockerContainers[0].id;
+
+            expect(originalContainerId).toBe('container-abc');
+
+            const legacyHost = {
+                id: dockerHost.id,
+                agentId: (dockerHost.platformData as any).agentId ?? dockerHost.id,
+                hostname: dockerHost.identity?.hostname ?? dockerHost.name,
+                cpuUsagePercent: dockerHost.cpu?.current,
+                containers: dockerContainers.filter(c => c.parentId === dockerHost.id),
+            };
+
+            expect(legacyHost.agentId).toBe('agent-123');
+            expect(legacyHost.containers).toHaveLength(1);
+        });
+    });
+
+    describe('Host conversion', () => {
+        it('converts Resource to legacy Host format with sensors', () => {
+            const resource = createMockResource({
+                type: 'host',
+                name: 'server1',
+                platformType: 'host-agent',
+                status: 'online',
+                platformData: {
+                    platform: 'linux',
+                    osName: 'Ubuntu',
+                    osVersion: '22.04 LTS',
+                    kernelVersion: '6.2.0',
+                    architecture: 'x86_64',
+                    cpuCount: 16,
+                    loadAverage: [2.5, 1.8, 1.2],
+                    sensors: {
+                        temperatureCelsius: { 'CPU Package': 55.0, 'nvme0': 42.0 },
+                        fanRpm: { 'CPU Fan': 1200 },
+                    },
+                    raid: [
+                        {
+                            device: '/dev/md0',
+                            level: 'raid1',
+                            state: 'active',
+                            totalDevices: 2,
+                            activeDevices: 2,
+                            workingDevices: 2,
+                            failedDevices: 0,
+                            spareDevices: 0,
+                            devices: [
+                                { device: 'sda1', state: 'active', slot: 0 },
+                                { device: 'sdb1', state: 'active', slot: 1 },
+                            ],
+                            rebuildPercent: 0,
+                        },
+                    ],
+                },
+            });
+
+            const platformData = resource.platformData as Record<string, unknown>;
+
+            expect(platformData.sensors).toBeDefined();
+            expect((platformData.sensors as any).temperatureCelsius['CPU Package']).toBe(55.0);
+            expect(platformData.raid).toHaveLength(1);
+            expect((platformData.raid as any[])[0].level).toBe('raid1');
+        });
+
+        it('maps interfaces correctly to networkInterfaces', () => {
+            const resource = createMockResource({
+                type: 'host',
+                platformData: {
+                    interfaces: [
+                        { name: 'eth0', mac: '00:11:22:33:44:55', addresses: ['192.168.1.10'] },
+                        { name: 'docker0', mac: '02:42:00:00:00:01', addresses: ['172.17.0.1'] },
+                    ],
+                },
+            });
+
+            const platformData = resource.platformData as Record<string, unknown>;
+            const interfaces = platformData.interfaces as any[];
+
+            expect(interfaces).toHaveLength(2);
+            expect(interfaces[0].name).toBe('eth0');
+            expect(interfaces[1].addresses).toContain('172.17.0.1');
+        });
+    });
+});
+
+describe('Fallback Logic', () => {
+    describe('hasUnifiedResources check', () => {
+        it('returns true when resources array has items', () => {
+            const resources: Resource[] = [createMockResource()];
+            expect(resources.length > 0).toBe(true);
+        });
+
+        it('returns false when resources array is empty', () => {
+            const resources: Resource[] = [];
+            expect(resources.length > 0).toBe(false);
+        });
+    });
+
+    describe('legacy array fallback', () => {
+        // This tests the concept - actual implementation uses WebSocket store
+        it('uses legacy array when unified resources not available', () => {
+            const unifiedResources: Resource[] = [];
+            const legacyVms = [{ id: 'vm-1', name: 'Legacy VM' }];
+
+            const hasUnifiedResources = unifiedResources.length > 0;
+            const result = hasUnifiedResources ? unifiedResources : legacyVms;
+
+            expect(result).toEqual(legacyVms);
+        });
+
+        it('uses unified resources when available', () => {
+            const unifiedResources: Resource[] = [createMockResource({ id: 'unified-1' })];
+            const legacyVms = [{ id: 'vm-1', name: 'Legacy VM' }];
+
+            const hasUnifiedResources = unifiedResources.length > 0;
+            const result = hasUnifiedResources ? unifiedResources : legacyVms;
+
+            expect(result).toEqual(unifiedResources);
+        });
+    });
+});
diff --git a/frontend-modern/src/hooks/useColumnVisibility.ts b/frontend-modern/src/hooks/useColumnVisibility.ts
new file mode 100644
index 0000000..a88811d
--- /dev/null
+++ b/frontend-modern/src/hooks/useColumnVisibility.ts
@@ -0,0 +1,147 @@
+import { createMemo, Accessor } from 'solid-js';
+import type { JSX } from 'solid-js';
+import { usePersistentSignal } from './usePersistentSignal';
+import { useBreakpoint, type ColumnPriority, PRIORITY_BREAKPOINTS, type Breakpoint } from './useBreakpoint';
+
+export interface ColumnDef {
+  id: string;
+  label: string;
+  icon?: JSX.Element; // Optional icon for compact column headers
+  priority: ColumnPriority;
+  toggleable?: boolean;
+  width?: string;      // Fixed width for consistent column sizing
+  minWidth?: string;
+  maxWidth?: string;
+  flex?: number;
+  sortKey?: string;
+}
+
+const BREAKPOINT_ORDER: Breakpoint[] = ['xs', 'sm', 'md', 'lg', 'xl', '2xl'];
+
+function breakpointIndex(bp: Breakpoint): number {
+  return BREAKPOINT_ORDER.indexOf(bp);
+}
+
+/**
+ * Hook for managing column visibility with persistence and responsive behavior.
+ *
+ * Columns are shown if:
+ * 1. The current breakpoint supports their priority level, AND
+ * 2. The user hasn't explicitly hidden them (for toggleable columns)
+ *
+ * @param storageKey - localStorage key for persisting user preferences
+ * @param columns - Array of column definitions
+ * @param defaultHidden - Optional array of column IDs to hide by default (only used if no user preference exists)
+ */
+export function useColumnVisibility(
+  storageKey: string,
+  columns: ColumnDef[],
+  defaultHidden: string[] = []
+) {
+  const { breakpoint } = useBreakpoint();
+
+  // Get list of toggleable column IDs
+  const toggleableIds = columns.filter(c => c.toggleable).map(c => c.id);
+
+  // Check if user has any saved preference
+  const hasUserPreference = typeof window !== 'undefined' && window.localStorage.getItem(storageKey) !== null;
+
+  // Persist hidden columns to localStorage
+  // Use defaultHidden only if no user preference exists yet
+  const [hiddenColumns, setHiddenColumns] = usePersistentSignal<string[]>(
+    storageKey,
+    hasUserPreference ? [] : defaultHidden,
+    {
+      serialize: (arr) => JSON.stringify(arr),
+      deserialize: (str) => {
+        try {
+          const parsed = JSON.parse(str);
+          return Array.isArray(parsed) ? parsed : [];
+        } catch {
+          return [];
+        }
+      },
+    }
+  );
+
+  // Check if a column is hidden by user preference
+  const isHiddenByUser = (id: string): boolean => {
+    return hiddenColumns().includes(id);
+  };
+
+  // Check if breakpoint supports showing this column
+  const hasSpaceForColumn = (col: ColumnDef): boolean => {
+    const minBreakpoint = PRIORITY_BREAKPOINTS[col.priority];
+    return breakpointIndex(breakpoint()) >= breakpointIndex(minBreakpoint);
+  };
+
+  // Toggle a column's visibility
+  const toggle = (id: string) => {
+    const current = hiddenColumns();
+    if (current.includes(id)) {
+      setHiddenColumns(current.filter(c => c !== id));
+    } else {
+      setHiddenColumns([...current, id]);
+    }
+  };
+
+  // Show a column (remove from hidden)
+  const show = (id: string) => {
+    setHiddenColumns(hiddenColumns().filter(c => c !== id));
+  };
+
+  // Hide a column (add to hidden)
+  const hide = (id: string) => {
+    if (!hiddenColumns().includes(id)) {
+      setHiddenColumns([...hiddenColumns(), id]);
+    }
+  };
+
+  // Reset to defaults (restore default hidden columns)
+  const resetToDefaults = () => {
+    setHiddenColumns(defaultHidden);
+  };
+
+  // Compute visible columns based on breakpoint and user preferences
+  const visibleColumns: Accessor<ColumnDef[]> = createMemo(() => {
+    return columns.filter(col => {
+      // Always show essential columns regardless of breakpoint
+      if (col.priority === 'essential') return true;
+
+      // Check if screen has space for this priority level
+      if (!hasSpaceForColumn(col)) return false;
+
+      // If toggleable, check user preference
+      if (col.toggleable && isHiddenByUser(col.id)) return false;
+
+      return true;
+    });
+  });
+
+  // Get columns that could be toggled at the current breakpoint
+  // (i.e., screen is wide enough to show them)
+  const availableToggles: Accessor<ColumnDef[]> = createMemo(() => {
+    return columns.filter(col => {
+      if (!col.toggleable) return false;
+      return hasSpaceForColumn(col);
+    });
+  });
+
+  // Check if a specific column is currently visible
+  const isColumnVisible = (id: string): boolean => {
+    return visibleColumns().some(col => col.id === id);
+  };
+
+  return {
+    visibleColumns,
+    availableToggles,
+    toggleableIds,
+    hiddenColumns,
+    isColumnVisible,
+    isHiddenByUser,
+    toggle,
+    show,
+    hide,
+    resetToDefaults,
+  };
+}
diff --git a/frontend-modern/src/hooks/useResources.ts b/frontend-modern/src/hooks/useResources.ts
new file mode 100644
index 0000000..db0a296
--- /dev/null
+++ b/frontend-modern/src/hooks/useResources.ts
@@ -0,0 +1,660 @@
+/**
+ * useResources Hook
+ * 
+ * Provides reactive access to unified resources from the WebSocket state.
+ * This is the primary way for frontend components to access resource data
+ * as we migrate away from legacy arrays (nodes, vms, containers, etc.).
+ * 
+ * Example usage:
+ * ```tsx
+ * const { resources, infra, workloads, filtered } = useResources();
+ * 
+ * // Get all resources
+ * <For each={resources()}>{r => <div>{r.name}</div>}</For>
+ * 
+ * // Get only infrastructure (nodes, hosts)
+ * <For each={infra()}>{r => <div>{r.name}</div>}</For>
+ * 
+ * // Get filtered workloads
+ * const vms = filtered({ types: ['vm'], statuses: ['running'] });
+ * <For each={vms}>{r => <div>{r.name}</div>}</For>
+ * ```
+ */
+
+import { createMemo, type Accessor } from 'solid-js';
+import { unwrap } from 'solid-js/store';
+import { getGlobalWebSocketStore } from '@/stores/websocket-global';
+import type {
+    Resource,
+    ResourceType,
+    PlatformType,
+    ResourceStatus,
+    ResourceFilter,
+} from '@/types/resource';
+import {
+    isInfrastructure,
+    isWorkload,
+    getDisplayName,
+    getCpuPercent,
+    getMemoryPercent,
+    getDiskPercent,
+} from '@/types/resource';
+
+export interface UseResourcesReturn {
+    /** All unified resources */
+    resources: Accessor<Resource[]>;
+
+    /** Infrastructure resources only (nodes, hosts, docker-hosts) */
+    infra: Accessor<Resource[]>;
+
+    /** Workload resources only (vms, containers, docker-containers) */
+    workloads: Accessor<Resource[]>;
+
+    /** Resources by type */
+    byType: (type: ResourceType) => Resource[];
+
+    /** Resources by platform */
+    byPlatform: (platform: PlatformType) => Resource[];
+
+    /** Filter resources with multiple criteria */
+    filtered: (filter: ResourceFilter) => Resource[];
+
+    /** Get a single resource by ID */
+    get: (id: string) => Resource | undefined;
+
+    /** Get children of a resource (e.g., VMs of a node) */
+    children: (parentId: string) => Resource[];
+
+    /** Count of resources by status */
+    statusCounts: Accessor<Record<ResourceStatus, number>>;
+
+    /** Top consumers by CPU */
+    topByCpu: (limit?: number) => Resource[];
+
+    /** Top consumers by memory */
+    topByMemory: (limit?: number) => Resource[];
+
+    /** Whether resources are available */
+    hasResources: Accessor<boolean>;
+}
+
+/**
+ * Hook for accessing unified resources with reactive filtering.
+ */
+export function useResources(): UseResourcesReturn {
+    // Get the WebSocket store instance
+    const wsStore = getGlobalWebSocketStore();
+
+    // All resources from WebSocket state
+    const resources = createMemo<Resource[]>(() => {
+        return wsStore.state.resources ?? [];
+    });
+
+    // Pre-filtered memos for common use cases
+    const infra = createMemo<Resource[]>(() => {
+        return resources().filter(isInfrastructure);
+    });
+
+    const workloads = createMemo<Resource[]>(() => {
+        return resources().filter(isWorkload);
+    });
+
+    const hasResources = createMemo<boolean>(() => {
+        return resources().length > 0;
+    });
+
+    // Status counts
+    const statusCounts = createMemo<Record<ResourceStatus, number>>(() => {
+        const counts: Record<ResourceStatus, number> = {
+            online: 0,
+            offline: 0,
+            running: 0,
+            stopped: 0,
+            degraded: 0,
+            paused: 0,
+            unknown: 0,
+        };
+
+        for (const r of resources()) {
+            if (r.status in counts) {
+                counts[r.status as ResourceStatus]++;
+            }
+        }
+
+        return counts;
+    });
+
+    // Filter by type
+    const byType = (type: ResourceType): Resource[] => {
+        return resources().filter(r => r.type === type);
+    };
+
+    // Filter by platform
+    const byPlatform = (platform: PlatformType): Resource[] => {
+        return resources().filter(r => r.platformType === platform);
+    };
+
+    // Complex filtering
+    const filtered = (filter: ResourceFilter): Resource[] => {
+        let result = resources();
+
+        // Filter by types
+        if (filter.types && filter.types.length > 0) {
+            result = result.filter(r => filter.types!.includes(r.type));
+        }
+
+        // Filter by platforms
+        if (filter.platforms && filter.platforms.length > 0) {
+            result = result.filter(r => filter.platforms!.includes(r.platformType));
+        }
+
+        // Filter by statuses
+        if (filter.statuses && filter.statuses.length > 0) {
+            result = result.filter(r => filter.statuses!.includes(r.status));
+        }
+
+        // Filter by parent
+        if (filter.parentId) {
+            result = result.filter(r => r.parentId === filter.parentId);
+        }
+
+        // Filter by cluster
+        if (filter.clusterId) {
+            result = result.filter(r => r.clusterId === filter.clusterId);
+        }
+
+        // Filter by alerts
+        if (filter.hasAlerts) {
+            result = result.filter(r => r.alerts && r.alerts.length > 0);
+        }
+
+        // Search filter (name, displayName)
+        if (filter.search && filter.search.trim()) {
+            const term = filter.search.toLowerCase().trim();
+            result = result.filter(r => {
+                const name = getDisplayName(r).toLowerCase();
+                const id = r.id.toLowerCase();
+                return name.includes(term) || id.includes(term);
+            });
+        }
+
+        return result;
+    };
+
+    // Get single resource by ID
+    const get = (id: string): Resource | undefined => {
+        return resources().find(r => r.id === id);
+    };
+
+    // Get children of a parent
+    const children = (parentId: string): Resource[] => {
+        return resources().filter(r => r.parentId === parentId);
+    };
+
+    // Top by CPU
+    const topByCpu = (limit: number = 10): Resource[] => {
+        return [...resources()]
+            .filter(r => r.cpu && r.cpu.current > 0)
+            .sort((a, b) => getCpuPercent(b) - getCpuPercent(a))
+            .slice(0, limit);
+    };
+
+    // Top by memory
+    const topByMemory = (limit: number = 10): Resource[] => {
+        return [...resources()]
+            .filter(r => r.memory)
+            .sort((a, b) => getMemoryPercent(b) - getMemoryPercent(a))
+            .slice(0, limit);
+    };
+
+    return {
+        resources,
+        infra,
+        workloads,
+        byType,
+        byPlatform,
+        filtered,
+        get,
+        children,
+        statusCounts,
+        topByCpu,
+        topByMemory,
+        hasResources,
+    };
+}
+
+/**
+ * Helper hook for resource-to-legacy-type conversion.
+ * This helps during migration when components still expect legacy types.
+ * 
+ * IMPORTANT: This hook includes fallback logic for initial page loads.
+ * The unified resources array is populated by monitor broadcasts, but the
+ * initial WebSocket state may not include it. In that case, we fall back
+ * to the legacy arrays (nodes, vms, containers, etc.) from the WebSocket state.
+ */
+export function useResourcesAsLegacy() {
+    const { resources, byType } = useResources();
+
+    // Get the WebSocket store for legacy array fallback
+    const wsStore = getGlobalWebSocketStore();
+
+    // Check if we have unified resources (populated after first broadcast)
+    const hasUnifiedResources = createMemo(() => resources().length > 0);
+
+    // Prefer legacy arrays when they exist. The backend currently broadcasts both the
+    // legacy arrays and unified resources, and the legacy arrays are already reconciled
+    // by id in the WebSocket store (stable identities, fine-grained updates).
+    // Only synthesize legacy types from unified resources when it looks like the backend
+    // isn't providing that legacy field (e.g., resources include the type but legacy array is empty).
+    const hasVmResources = createMemo(() => resources().some((r) => r.type === 'vm'));
+    const hasNodeResources = createMemo(() => resources().some((r) => r.type === 'node'));
+    const hasContainerResources = createMemo(() =>
+        resources().some((r) => r.type === 'container' || r.type === 'oci-container'),
+    );
+    const hasHostResources = createMemo(() => resources().some((r) => r.type === 'host'));
+    const hasDockerHostResources = createMemo(() => resources().some((r) => r.type === 'docker-host'));
+
+    // Convert resources to legacy VM format
+    // Falls back to legacy state.vms array when unified resources aren't yet populated
+    const asVMs = createMemo(() => {
+        const legacy = wsStore.state.vms ?? [];
+        // If we don't have unified resources yet, use legacy arrays directly
+        if (!hasUnifiedResources()) {
+            return legacy;
+        }
+        // If legacy data exists (or there are no VM resources), keep using it.
+        if (legacy.length > 0 || !hasVmResources()) {
+            return legacy;
+        }
+
+        return byType('vm').map(r => {
+            const platformData = r.platformData as Record<string, unknown> | undefined;
+            return {
+                id: r.id,
+                vmid: platformData?.vmid as number ?? parseInt(r.id.split('-').pop() ?? '0', 10),
+                name: r.name,
+                node: platformData?.node as string ?? '',
+                instance: platformData?.instance as string ?? r.platformId,
+                status: r.status === 'running' ? 'running' : 'stopped',
+                type: 'qemu',
+                cpu: (r.cpu?.current ?? 0) / 100, // Convert from percentage to ratio for Dashboard
+                cpus: platformData?.cpus as number ?? 1,
+                memory: r.memory ? {
+                    total: r.memory.total ?? 0,
+                    used: r.memory.used ?? 0,
+                    free: r.memory.free ?? 0,
+                    usage: r.memory.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                disk: r.disk ? {
+                    total: r.disk.total ?? 0,
+                    used: r.disk.used ?? 0,
+                    free: r.disk.free ?? 0,
+                    usage: r.disk.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                // IP and OS fields - crucial for the Dashboard columns
+                ipAddresses: (platformData?.ipAddresses as string[] | undefined) ?? (r.identity?.ips as string[] | undefined),
+                osName: platformData?.osName as string | undefined,
+                osVersion: platformData?.osVersion as string | undefined,
+                agentVersion: platformData?.agentVersion as string | undefined,
+                networkInterfaces: platformData?.networkInterfaces as Array<{
+                    name: string;
+                    mac?: string;
+                    addresses?: string[];
+                }> | undefined,
+                networkIn: r.network?.rxBytes ?? 0,
+                networkOut: r.network?.txBytes ?? 0,
+                diskRead: platformData?.diskRead as number ?? 0,
+                diskWrite: platformData?.diskWrite as number ?? 0,
+                uptime: r.uptime ?? 0,
+                template: platformData?.template as boolean ?? false,
+                lastBackup: platformData?.lastBackup as number ?? 0,
+                tags: r.tags ?? [],
+                lock: platformData?.lock as string ?? '',
+                lastSeen: new Date(r.lastSeen).toISOString(),
+            };
+        });
+    });
+
+    // Convert resources to legacy Container format
+    // Falls back to legacy state.containers array when unified resources aren't yet populated
+    const asContainers = createMemo(() => {
+        const legacy = wsStore.state.containers ?? [];
+        // If we don't have unified resources yet, use legacy arrays directly
+        if (!hasUnifiedResources()) {
+            return legacy;
+        }
+        // If legacy data exists (or there are no container resources), keep using it.
+        if (legacy.length > 0 || !hasContainerResources()) {
+            return legacy;
+        }
+
+        // Include both traditional LXC containers and OCI containers (Proxmox VE 9.1+).
+        const containerResources = [...byType('container'), ...byType('oci-container')];
+
+        return containerResources.map(r => {
+            const platformData = r.platformData as Record<string, unknown> | undefined;
+            const isOCI =
+                r.type === 'oci-container' ||
+                platformData?.isOci === true ||
+                platformData?.type === 'oci';
+            const legacyType = isOCI ? 'oci' : ((platformData?.type as string) ?? 'lxc');
+            return {
+                id: r.id,
+                vmid: platformData?.vmid as number ?? parseInt(r.id.split('-').pop() ?? '0', 10),
+                name: r.name,
+                node: platformData?.node as string ?? '',
+                instance: platformData?.instance as string ?? r.platformId,
+                status: r.status === 'running' ? 'running' : 'stopped',
+                type: legacyType,
+                isOci: isOCI,
+                osTemplate: platformData?.osTemplate as string | undefined,
+                cpu: (r.cpu?.current ?? 0) / 100, // Convert from percentage to ratio for Dashboard
+                cpus: platformData?.cpus as number ?? 1,
+                memory: r.memory ? {
+                    total: r.memory.total ?? 0,
+                    used: r.memory.used ?? 0,
+                    free: r.memory.free ?? 0,
+                    usage: r.memory.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                disk: r.disk ? {
+                    total: r.disk.total ?? 0,
+                    used: r.disk.used ?? 0,
+                    free: r.disk.free ?? 0,
+                    usage: r.disk.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                // IP and OS fields - crucial for the Dashboard columns
+                ipAddresses: (platformData?.ipAddresses as string[] | undefined) ?? (r.identity?.ips as string[] | undefined),
+                osName: platformData?.osName as string | undefined,
+                osVersion: platformData?.osVersion as string | undefined,
+                networkInterfaces: platformData?.networkInterfaces as Array<{
+                    name: string;
+                    mac?: string;
+                    addresses?: string[];
+                }> | undefined,
+                networkIn: r.network?.rxBytes ?? 0,
+                networkOut: r.network?.txBytes ?? 0,
+                diskRead: platformData?.diskRead as number ?? 0,
+                diskWrite: platformData?.diskWrite as number ?? 0,
+                uptime: r.uptime ?? 0,
+                template: platformData?.template as boolean ?? false,
+                lastBackup: platformData?.lastBackup as number ?? 0,
+                tags: r.tags ?? [],
+                lock: platformData?.lock as string ?? '',
+                lastSeen: new Date(r.lastSeen).toISOString(),
+            };
+        });
+    });
+
+    // Convert resources to legacy Host format
+    // Falls back to legacy state.hosts array when unified resources aren't yet populated
+    const asHosts = createMemo(() => {
+        const legacy = wsStore.state.hosts ?? [];
+        // If we don't have unified resources yet, use legacy arrays directly
+        if (!hasUnifiedResources()) {
+            return legacy;
+        }
+        // If legacy data exists (or there are no host resources), keep using it.
+        if (legacy.length > 0 || !hasHostResources()) {
+            return legacy;
+        }
+
+        return byType('host').map((r) => {
+            // Extract platform-specific data - unwrap SolidJS Proxy objects into plain JS objects
+            const platformData = r.platformData ? (unwrap(r.platformData) as Record<string, unknown>) : undefined;
+
+            // Interfaces from platformData
+            const interfaces = platformData?.interfaces as Array<{
+                name: string;
+                mac?: string;
+                addresses?: string[];
+                rxBytes?: number;
+                txBytes?: number;
+            }> | undefined;
+
+            return {
+                id: r.id,
+                hostname: r.identity?.hostname ?? r.name,
+                displayName: r.displayName || r.name,
+                platform: platformData?.platform as string | undefined,
+                osName: platformData?.osName as string | undefined,
+                osVersion: platformData?.osVersion as string | undefined,
+                kernelVersion: platformData?.kernelVersion as string | undefined,
+                architecture: platformData?.architecture as string | undefined,
+                cpuCount: platformData?.cpuCount as number | undefined,
+                cpuUsage: r.cpu?.current,
+                loadAverage: platformData?.loadAverage as number[] | undefined,
+                memory: r.memory ? {
+                    total: r.memory.total ?? 0,
+                    used: r.memory.used ?? 0,
+                    free: r.memory.free ?? 0,
+                    usage: r.memory.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                disks: platformData?.disks as Array<{
+                    total: number;
+                    used: number;
+                    free: number;
+                    usage: number;
+                    mountpoint?: string;
+                    type?: string;
+                    device?: string;
+                }> | undefined,
+                diskIO: platformData?.diskIO as Array<{
+                    device: string;
+                    readBytes?: number;
+                    writeBytes?: number;
+                }> | undefined,
+                // Map backend 'interfaces' to frontend 'networkInterfaces'
+                networkInterfaces: interfaces,
+                sensors: platformData?.sensors as {
+                    temperatureCelsius?: Record<string, number>;
+                    fanRpm?: Record<string, number>;
+                } | undefined,
+                raid: platformData?.raid as Array<{
+                    device: string;
+                    name?: string;
+                    level: string;
+                    state: string;
+                    totalDevices: number;
+                    activeDevices: number;
+                    workingDevices: number;
+                    failedDevices: number;
+                    spareDevices: number;
+                    devices: Array<{ device: string; state: string; slot: number }>;
+                    rebuildPercent: number;
+                }> | undefined,
+                status: r.status === 'online' || r.status === 'running' ? 'online' : r.status,
+                uptimeSeconds: r.uptime,
+                lastSeen: r.lastSeen,
+                intervalSeconds: platformData?.intervalSeconds as number | undefined,
+                agentVersion: platformData?.agentVersion as string | undefined,
+                tokenId: platformData?.tokenId as string | undefined,
+                tokenName: platformData?.tokenName as string | undefined,
+                tags: r.tags ? [...r.tags] : undefined,
+            };
+        });
+    });
+
+    // Convert resources to legacy Node format
+    // Falls back to legacy state.nodes array when unified resources aren't yet populated
+    const asNodes = createMemo(() => {
+        const legacy = wsStore.state.nodes ?? [];
+        // If we don't have unified resources yet, use legacy arrays directly
+        if (!hasUnifiedResources()) {
+            // Return legacy nodes array as-is (it's already in the right format)
+            return legacy;
+        }
+        // If legacy data exists (or there are no node resources), keep using it.
+        if (legacy.length > 0 || !hasNodeResources()) {
+            return legacy;
+        }
+
+        return byType('node').map(r => {
+            // Unwrap SolidJS Proxy objects into plain JS objects
+            const platformData = r.platformData ? (unwrap(r.platformData) as Record<string, unknown>) : undefined;
+
+            // Build temperature object from unified resource
+            // The unified resource has temperature as a simple number,
+            // but legacy components expect the full Temperature struct
+            let temperature = undefined;
+            if (r.temperature !== undefined && r.temperature !== null && r.temperature > 0) {
+                temperature = {
+                    cpuPackage: r.temperature,
+                    cpuMax: r.temperature,
+                    available: true,
+                    hasCPU: true,
+                    hasGPU: false,
+                    hasNVMe: false,
+                    lastUpdate: new Date(r.lastSeen).toISOString(),
+                };
+            }
+
+            return {
+                id: r.id,
+                name: r.name,
+                displayName: r.displayName,
+                instance: r.platformId,
+                host: platformData?.host as string ?? '',
+                status: r.status,
+                type: 'node',
+                cpu: (r.cpu?.current ?? 0) / 100, // Convert from percentage to ratio for legacy components
+                memory: r.memory ? {
+                    total: r.memory.total ?? 0,
+                    used: r.memory.used ?? 0,
+                    free: r.memory.free ?? 0,
+                    usage: r.memory.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                disk: r.disk ? {
+                    total: r.disk.total ?? 0,
+                    used: r.disk.used ?? 0,
+                    free: r.disk.free ?? 0,
+                    usage: r.disk.current,
+                } : { total: 0, used: 0, free: 0, usage: 0 },
+                uptime: r.uptime ?? 0,
+                loadAverage: platformData?.loadAverage as number[] ?? [],
+                kernelVersion: platformData?.kernelVersion as string ?? '',
+                pveVersion: platformData?.pveVersion as string ?? '',
+                cpuInfo: platformData?.cpuInfo ?? { model: '', cores: 0, sockets: 0, mhz: '' },
+                temperature,
+                lastSeen: new Date(r.lastSeen).toISOString(),
+                connectionHealth: platformData?.connectionHealth as string ?? 'unknown',
+                isClusterMember: platformData?.isClusterMember as boolean | undefined,
+                clusterName: platformData?.clusterName as string | undefined,
+            };
+        });
+    });
+
+    // Convert resources to legacy DockerHost format (including nested containers)
+    // Falls back to legacy state.dockerHosts array when unified resources aren't yet populated
+    const asDockerHosts = createMemo(() => {
+        const legacy = wsStore.state.dockerHosts ?? [];
+        // If we don't have unified resources yet, use legacy arrays directly
+        if (!hasUnifiedResources()) {
+            return legacy;
+        }
+        // If legacy data exists (or there are no docker-host resources), keep using it.
+        if (legacy.length > 0 || !hasDockerHostResources()) {
+            return legacy;
+        }
+
+        const dockerHostResources = byType('docker-host');
+        const dockerContainerResources = byType('docker-container');
+
+        return dockerHostResources.map(h => {
+            // Unwrap SolidJS Proxy objects into plain JS objects
+            const platformData = h.platformData ? (unwrap(h.platformData) as Record<string, unknown>) : undefined;
+
+            // Find containers belonging to this host
+            const hostContainers = dockerContainerResources
+                .filter(c => c.parentId === h.id)
+                .map(c => {
+                    const cPlatform = c.platformData ? (unwrap(c.platformData) as Record<string, unknown>) : undefined;
+                    // Extract original container ID from compound resource ID (hostID/containerID)
+                    // This is needed for sparkline metrics to match the sampler which uses original IDs
+                    const originalContainerId = c.id.includes('/') ? c.id.split('/').pop()! : c.id;
+                    return {
+                        id: originalContainerId,
+                        name: c.name,
+                        image: cPlatform?.image as string ?? '',
+                        state: c.status === 'running' ? 'running' : 'exited',
+                        status: c.status,
+                        health: cPlatform?.health as string | undefined,
+                        cpuPercent: c.cpu?.current ?? 0,
+                        memoryUsageBytes: c.memory?.used ?? 0,
+                        memoryLimitBytes: c.memory?.total ?? 0,
+                        memoryPercent: c.memory?.current ?? 0,
+                        uptimeSeconds: c.uptime ?? 0,
+                        restartCount: cPlatform?.restartCount as number ?? 0,
+                        exitCode: cPlatform?.exitCode as number ?? 0,
+                        createdAt: cPlatform?.createdAt as number ?? 0,
+                        startedAt: cPlatform?.startedAt as number | undefined,
+                        finishedAt: cPlatform?.finishedAt as number | undefined,
+                        ports: cPlatform?.ports,
+                        labels: cPlatform?.labels as Record<string, string> | undefined,
+                        networks: cPlatform?.networks,
+                        mounts: cPlatform?.mounts,
+                        blockIo: cPlatform?.blockIo,
+                        writableLayerBytes: cPlatform?.writableLayerBytes as number | undefined,
+                        rootFilesystemBytes: cPlatform?.rootFilesystemBytes as number | undefined,
+                    };
+                });
+
+            return {
+                id: h.id,
+                agentId: platformData?.agentId as string ?? h.id,
+                hostname: h.identity?.hostname ?? h.name,
+                displayName: h.displayName || h.name,
+                customDisplayName: platformData?.customDisplayName as string | undefined,
+                machineId: h.identity?.machineId,
+                os: platformData?.os as string | undefined,
+                kernelVersion: platformData?.kernelVersion as string | undefined,
+                architecture: platformData?.architecture as string | undefined,
+                runtime: platformData?.runtime as string ?? 'docker',
+                runtimeVersion: platformData?.runtimeVersion as string | undefined,
+                dockerVersion: platformData?.dockerVersion as string | undefined,
+                cpus: platformData?.cpus as number ?? 0,
+                totalMemoryBytes: h.memory?.total ?? 0,
+                uptimeSeconds: h.uptime ?? 0,
+                cpuUsagePercent: h.cpu?.current,
+                loadAverage: platformData?.loadAverage as number[] | undefined,
+                memory: h.memory ? {
+                    total: h.memory.total ?? 0,
+                    used: h.memory.used ?? 0,
+                    free: h.memory.free ?? 0,
+                    usage: h.memory.current,
+                } : undefined,
+                disks: platformData?.disks,
+                // Map backend 'interfaces' to frontend 'networkInterfaces'
+                networkInterfaces: platformData?.interfaces,
+                status: h.status === 'online' || h.status === 'running' ? 'online' : h.status,
+                lastSeen: h.lastSeen,
+                intervalSeconds: platformData?.intervalSeconds as number ?? 30,
+                agentVersion: platformData?.agentVersion as string | undefined,
+                containers: hostContainers,
+                services: platformData?.services,
+                tasks: platformData?.tasks,
+                swarm: platformData?.swarm,
+                tokenId: platformData?.tokenId as string | undefined,
+                tokenName: platformData?.tokenName as string | undefined,
+                tokenHint: platformData?.tokenHint as string | undefined,
+                tokenLastUsedAt: platformData?.tokenLastUsedAt as number | undefined,
+                hidden: platformData?.hidden as boolean | undefined,
+                pendingUninstall: platformData?.pendingUninstall as boolean | undefined,
+                command: platformData?.command,
+                isLegacy: platformData?.isLegacy as boolean | undefined,
+            };
+        });
+    });
+
+    return {
+        resources,
+        asVMs,
+        asContainers,
+        asHosts,
+        asNodes,
+        asDockerHosts,
+    };
+}
+
+// Re-export types and helpers
+export type { Resource, ResourceType, PlatformType, ResourceStatus, ResourceFilter };
+export { isInfrastructure, isWorkload, getDisplayName, getCpuPercent, getMemoryPercent, getDiskPercent };
diff --git a/frontend-modern/src/pages/Alerts.tsx b/frontend-modern/src/pages/Alerts.tsx
index 75a63b3..111c00b 100644
--- a/frontend-modern/src/pages/Alerts.tsx
+++ b/frontend-modern/src/pages/Alerts.tsx
@@ -4,6 +4,7 @@ import type { JSX } from 'solid-js';
 import { EmailProviderSelect } from '@/components/Alerts/EmailProviderSelect';
 import { WebhookConfig } from '@/components/Alerts/WebhookConfig';
 import { ThresholdsTable } from '@/components/Alerts/ThresholdsTable';
+import { InvestigateAlertButton } from '@/components/Alerts/InvestigateAlertButton';
 import type { RawOverrideConfig, PMGThresholdDefaults, SnapshotAlertConfig, BackupAlertConfig } from '@/types/alerts';
 import { Card } from '@/components/shared/Card';
 import { SectionHeader } from '@/components/shared/SectionHeader';
@@ -27,6 +28,8 @@ import History from 'lucide-solid/icons/history';
 import Gauge from 'lucide-solid/icons/gauge';
 import Send from 'lucide-solid/icons/send';
 import Calendar from 'lucide-solid/icons/calendar';
+import { getPatrolStatus, getFindings, getFindingsHistory, getPatrolRunHistory, forcePatrol, subscribeToPatrolStream, dismissFinding, suppressFinding, getSuppressionRules, addSuppressionRule, deleteSuppressionRule, type Finding, type PatrolStatus, type PatrolRunRecord, type SuppressionRule, severityColors, formatTimestamp, categoryLabels } from '@/api/patrol';
+import { aiChatStore } from '@/stores/aiChat';
 
 type AlertTab = 'overview' | 'thresholds' | 'destinations' | 'schedule' | 'history';
 
@@ -492,11 +495,11 @@ export function Alerts() {
   >({}); // Store raw config
 
   // Email configuration state moved to parent to persist across tab changes
-const [emailConfig, setEmailConfig] = createSignal<UIEmailConfig>({
-  enabled: false,
-  provider: '',
-  server: '', // Fixed: use 'server' not 'smtpHost'
-  port: 587, // Fixed: use 'port' not 'smtpPort'
+  const [emailConfig, setEmailConfig] = createSignal<UIEmailConfig>({
+    enabled: false,
+    provider: '',
+    server: '', // Fixed: use 'server' not 'smtpHost'
+    port: 587, // Fixed: use 'port' not 'smtpPort'
     username: '',
     password: '',
     from: '',
@@ -506,12 +509,12 @@ const [emailConfig, setEmailConfig] = createSignal<UIEmailConfig>({
     replyTo: '',
     maxRetries: 3,
     retryDelay: 5,
-  rateLimit: 60,
-});
+    rateLimit: 60,
+  });
 
-const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
-  createDefaultAppriseConfig(),
-);
+  const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
+    createDefaultAppriseConfig(),
+  );
 
   // Schedule configuration state moved to parent to persist across tab changes
   const [scheduleQuietHours, setScheduleQuietHours] =
@@ -782,7 +785,7 @@ const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
           const severityChanged =
             (newOverride.type === 'guest' || newOverride.type === 'dockerContainer') &&
             (newOverride.poweredOffSeverity ?? null) !==
-              (existing.poweredOffSeverity ?? null);
+            (existing.poweredOffSeverity ?? null);
           return (
             thresholdsChanged ||
             connectivityChanged ||
@@ -1432,27 +1435,29 @@ const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
     label: string;
     items: { id: AlertTab; label: string; icon: JSX.Element }[];
   }[] = [
-    {
-      id: 'status',
-      label: 'Status',
-      items: [
-        { id: 'overview', label: 'Overview', icon: <LayoutDashboard class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'history', label: 'History', icon: <History class="w-4 h-4" strokeWidth={2} /> },
-      ],
-    },
-    {
-      id: 'configuration',
-      label: 'Configuration',
-      items: [
-        { id: 'thresholds', label: 'Thresholds', icon: <Gauge class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'destinations', label: 'Notifications', icon: <Send class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'schedule', label: 'Schedule', icon: <Calendar class="w-4 h-4" strokeWidth={2} /> },
-      ],
-    },
-  ];
+      {
+        id: 'status',
+        label: 'Status',
+        items: [
+          { id: 'overview', label: 'Overview', icon: <LayoutDashboard class="w-4 h-4" strokeWidth={2} /> },
+          { id: 'history', label: 'History', icon: <History class="w-4 h-4" strokeWidth={2} /> },
+        ],
+      },
+      {
+        id: 'configuration',
+        label: 'Configuration',
+        items: [
+          { id: 'thresholds', label: 'Thresholds', icon: <Gauge class="w-4 h-4" strokeWidth={2} /> },
+          { id: 'destinations', label: 'Notifications', icon: <Send class="w-4 h-4" strokeWidth={2} /> },
+          { id: 'schedule', label: 'Schedule', icon: <Calendar class="w-4 h-4" strokeWidth={2} /> },
+        ],
+      },
+    ];
 
   const flatTabs = tabGroups.flatMap((group) => group.items);
-  const [sidebarCollapsed, setSidebarCollapsed] = createSignal(true);
+  // Sidebar always starts expanded for discoverability (consistent with Settings)
+  // Users can collapse during session but it resets on page reload
+  const [sidebarCollapsed, setSidebarCollapsed] = createSignal(false);
 
   return (
     <div class="space-y-4">
@@ -1467,9 +1472,8 @@ const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
           <Show when={activeTab() === 'overview'}>
             <div class="flex items-center gap-3">
               <span
-                class={`text-sm font-medium ${
-                  isAlertsActive() ? 'text-green-600 dark:text-green-400' : 'text-gray-500 dark:text-gray-400'
-                }`}
+                class={`text-sm font-medium ${isAlertsActive() ? 'text-green-600 dark:text-green-400' : 'text-gray-500 dark:text-gray-400'
+                  }`}
               >
                 {isAlertsActive() ? 'Alerts enabled' : 'Alerts disabled'}
               </span>
@@ -1489,14 +1493,12 @@ const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
                   }}
                 />
                 <div
-                  class={`relative w-11 h-6 rounded-full transition ${
-                    isAlertsActive() ? 'bg-blue-600' : 'bg-gray-200 dark:bg-gray-700'
-                  } ${alertsActivation.isLoading() || isSwitchingActivation() ? 'opacity-50' : ''}`}
+                  class={`relative w-11 h-6 rounded-full transition ${isAlertsActive() ? 'bg-blue-600' : 'bg-gray-200 dark:bg-gray-700'
+                    } ${alertsActivation.isLoading() || isSwitchingActivation() ? 'opacity-50' : ''}`}
                 >
                   <span
-                    class={`absolute top-[2px] left-[2px] h-5 w-5 rounded-full bg-white transition-all shadow ${
-                      isAlertsActive() ? 'translate-x-5' : 'translate-x-0'
-                    }`}
+                    class={`absolute top-[2px] left-[2px] h-5 w-5 rounded-full bg-white transition-all shadow ${isAlertsActive() ? 'translate-x-5' : 'translate-x-0'
+                      }`}
                   />
                 </div>
               </label>
@@ -1745,247 +1747,280 @@ const [appriseConfig, setAppriseConfig] = createSignal<UIAppriseConfig>(
         </Card>
       </Show>
 
-      <div class={`transition-opacity ${
-        isAlertsActive() ? 'opacity-100' : 'opacity-50 pointer-events-none'
-      }`}>
+      <div class={`transition-opacity ${isAlertsActive() ? 'opacity-100' : 'opacity-50 pointer-events-none'
+        }`}>
 
-      <Card padding="none" class="relative lg:flex">
-        <div
-          class={`hidden lg:flex lg:flex-col ${sidebarCollapsed() ? 'w-16' : 'w-72'} ${sidebarCollapsed() ? 'lg:min-w-[4rem] lg:max-w-[4rem] lg:basis-[4rem]' : 'lg:min-w-[18rem] lg:max-w-[18rem] lg:basis-[18rem]'} relative border-b border-gray-200 dark:border-gray-700 lg:border-b-0 lg:border-r lg:border-gray-200 dark:lg:border-gray-700 lg:align-top flex-shrink-0 transition-all duration-300`}
-          onMouseEnter={() => setSidebarCollapsed(false)}
-          onMouseLeave={() => setSidebarCollapsed(true)}
-          aria-label="Alerts navigation"
-          aria-expanded={!sidebarCollapsed()}
-        >
-          <div class={`sticky top-24 ${sidebarCollapsed() ? 'px-2' : 'px-5'} py-6 space-y-6 transition-all duration-300`}>
-            <div id="alerts-sidebar-menu" class="space-y-6">
-              <For each={tabGroups}>
-                {(group) => (
-                  <div class="space-y-2">
-                    <Show when={!sidebarCollapsed()}>
-                      <p class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                        {group.label}
-                      </p>
-                    </Show>
-                    <div class="space-y-1.5">
-                      <For each={group.items}>
-                        {(item) => {
-                          const disabled = () => item.id !== 'overview' && !isAlertsActive();
-                          return (
-                            <button
-                              type="button"
-                              aria-current={activeTab() === item.id ? 'page' : undefined}
-                              class={`flex w-full items-center ${sidebarCollapsed() ? 'justify-center' : 'gap-2.5'} rounded-md ${sidebarCollapsed() ? 'px-2 py-2.5' : 'px-3 py-2'} text-sm font-medium transition-colors ${
-                                activeTab() === item.id
-                                  ? 'bg-blue-50 text-blue-600 dark:bg-blue-900/30 dark:text-blue-200'
-                                  : 'text-gray-600 hover:bg-gray-100 hover:text-gray-900 dark:text-gray-300 dark:hover:bg-gray-700/60 dark:hover:text-gray-100'
-                              } ${disabled() ? 'opacity-50 cursor-not-allowed pointer-events-none' : ''}`}
-                              disabled={disabled()}
-                              onClick={() => {
-                                if (disabled()) return;
-                                handleTabChange(item.id);
-                              }}
-                              title={
-                                sidebarCollapsed()
-                                  ? disabled()
-                                    ? 'Activate alerts to configure'
-                                    : item.label
-                                  : disabled()
-                                    ? 'Activate alerts to configure'
-                                    : undefined
-                              }
-                            >
-                              {item.icon}
-                              <Show when={!sidebarCollapsed()}>
-                                <span class="truncate">{item.label}</span>
-                              </Show>
-                            </button>
-                          );
-                        }}
-                      </For>
-                    </div>
-                  </div>
-                )}
-              </For>
-            </div>
-          </div>
-        </div>
-
-        <div class="flex-1 min-w-0">
-          <Show when={flatTabs.length > 0}>
-            <div class="lg:hidden border-b border-gray-200 dark:border-gray-700">
-              <div class="p-1">
-                <div
-                  class="flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5 w-full overflow-x-auto"
-                  style="-webkit-overflow-scrolling: touch;"
-                >
-                  <For each={flatTabs}>
-                    {(tab) => {
-                      const disabled = () => tab.id !== 'overview' && !isAlertsActive();
-                      return (
-                        <button
-                          type="button"
-                          class={`flex-1 px-3 py-2 text-xs font-medium rounded-md transition-all whitespace-nowrap ${
-                            activeTab() === tab.id
-                              ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
-                              : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
-                          } ${disabled() ? 'opacity-50 cursor-not-allowed pointer-events-none' : ''}`}
-                          disabled={disabled()}
-                          onClick={() => {
-                            if (disabled()) return;
-                            handleTabChange(tab.id);
-                          }}
-                          title={disabled() ? 'Activate alerts to configure' : undefined}
-                        >
-                          {tab.label}
-                        </button>
-                      );
-                    }}
-                  </For>
+        <Card padding="none" class="relative lg:flex overflow-hidden">
+          <div
+            class={`hidden lg:flex lg:flex-col ${sidebarCollapsed() ? 'w-16' : 'w-72'} ${sidebarCollapsed() ? 'lg:min-w-[4rem] lg:max-w-[4rem] lg:basis-[4rem]' : 'lg:min-w-[18rem] lg:max-w-[18rem] lg:basis-[18rem]'} relative border-b border-gray-200 dark:border-gray-700 lg:border-b-0 lg:border-r lg:border-gray-200 dark:lg:border-gray-700 lg:align-top flex-shrink-0 transition-all duration-200`}
+            aria-label="Alerts navigation"
+            aria-expanded={!sidebarCollapsed()}
+          >
+            <div
+              class={`sticky top-0 ${sidebarCollapsed() ? 'px-2' : 'px-4'} py-5 space-y-5 transition-all duration-200`}
+            >
+              <Show when={!sidebarCollapsed()}>
+                <div class="flex items-center justify-between pb-2 border-b border-gray-200 dark:border-gray-700">
+                  <h2 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Alerts</h2>
+                  <button
+                    type="button"
+                    onClick={() => setSidebarCollapsed(true)}
+                    class="p-1 rounded-md text-gray-500 hover:bg-gray-100 dark:hover:bg-gray-800 transition-colors"
+                    aria-label="Collapse sidebar"
+                  >
+                    <svg class="w-5 h-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M11 19l-7-7 7-7m8 14l-7-7 7-7"
+                      />
+                    </svg>
+                  </button>
                 </div>
+              </Show>
+              <Show when={sidebarCollapsed()}>
+                <button
+                  type="button"
+                  onClick={() => setSidebarCollapsed(false)}
+                  class="w-full p-2 rounded-md text-gray-500 hover:bg-gray-100 dark:hover:bg-gray-800 transition-colors"
+                  aria-label="Expand sidebar"
+                >
+                  <svg
+                    class="w-5 h-5 mx-auto"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M13 5l7 7-7 7M5 5l7 7-7 7"
+                    />
+                  </svg>
+                </button>
+              </Show>
+              <div id="alerts-sidebar-menu" class="space-y-5">
+                <For each={tabGroups}>
+                  {(group) => (
+                    <div class="space-y-2">
+                      <Show when={!sidebarCollapsed()}>
+                        <p class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                          {group.label}
+                        </p>
+                      </Show>
+                      <div class="space-y-1.5">
+                        <For each={group.items}>
+                          {(item) => {
+                            const disabled = () => item.id !== 'overview' && !isAlertsActive();
+                            return (
+                              <button
+                                type="button"
+                                aria-current={activeTab() === item.id ? 'page' : undefined}
+                                disabled={disabled()}
+                                class={`flex w-full items-center ${sidebarCollapsed() ? 'justify-center' : 'gap-2.5'} rounded-md ${sidebarCollapsed() ? 'px-2 py-2.5' : 'px-3 py-2'} text-sm font-medium transition-colors ${disabled()
+                                  ? 'opacity-60 cursor-not-allowed text-gray-400 dark:text-gray-600'
+                                  : activeTab() === item.id
+                                    ? 'bg-blue-50 text-blue-600 dark:bg-blue-900/30 dark:text-blue-200'
+                                    : 'text-gray-600 hover:bg-gray-100 hover:text-gray-900 dark:text-gray-300 dark:hover:bg-gray-700/60 dark:hover:text-gray-100'
+                                  }`}
+                                onClick={() => {
+                                  if (disabled()) return;
+                                  handleTabChange(item.id);
+                                }}
+                                title={sidebarCollapsed() ? item.label : undefined}
+                              >
+                                {item.icon}
+                                <Show when={!sidebarCollapsed()}>
+                                  <span class="truncate">{item.label}</span>
+                                </Show>
+                              </button>
+                            );
+                          }}
+                        </For>
+                      </div>
+                    </div>
+                  )}
+                </For>
               </div>
             </div>
-          </Show>
-
-          {/* Tab Content */}
-          <div class="p-3 sm:p-6">
-            <Show when={activeTab() === 'overview'}>
-              <OverviewTab
-                overrides={overrides()}
-                activeAlerts={activeAlerts}
-                updateAlert={updateAlert}
-              showQuickTip={showQuickTip}
-              dismissQuickTip={dismissQuickTip}
-              showAcknowledged={showAcknowledged}
-              setShowAcknowledged={setShowAcknowledged}
-            />
-          </Show>
-
-          <Show when={activeTab() === 'thresholds'}>
-            <ThresholdsTab
-              overrides={overrides}
-              setOverrides={setOverrides}
-              rawOverridesConfig={rawOverridesConfig}
-              setRawOverridesConfig={setRawOverridesConfig}
-              allGuests={allGuests}
-              state={state}
-              hosts={state.hosts || []}
-              guestDefaults={guestDefaults}
-              guestDisableConnectivity={guestDisableConnectivity}
-              setGuestDefaults={setGuestDefaults}
-              setGuestDisableConnectivity={setGuestDisableConnectivity}
-              guestPoweredOffSeverity={guestPoweredOffSeverity}
-              setGuestPoweredOffSeverity={setGuestPoweredOffSeverity}
-              nodeDefaults={nodeDefaults}
-              setNodeDefaults={setNodeDefaults}
-              hostDefaults={hostDefaults}
-              setHostDefaults={setHostDefaults}
-              dockerDefaults={dockerDefaults}
-              dockerDisableConnectivity={dockerDisableConnectivity}
-              setDockerDisableConnectivity={setDockerDisableConnectivity}
-              dockerPoweredOffSeverity={dockerPoweredOffSeverity}
-              setDockerPoweredOffSeverity={setDockerPoweredOffSeverity}
-              setDockerDefaults={setDockerDefaults}
-              dockerIgnoredPrefixes={dockerIgnoredPrefixes}
-              setDockerIgnoredPrefixes={setDockerIgnoredPrefixes}
-              storageDefault={storageDefault}
-              setStorageDefault={setStorageDefault}
-              resetGuestDefaults={resetGuestDefaults}
-              resetNodeDefaults={resetNodeDefaults}
-              resetHostDefaults={resetHostDefaults}
-              resetDockerDefaults={resetDockerDefaults}
-              resetDockerIgnoredPrefixes={resetDockerIgnoredPrefixes}
-              resetStorageDefault={resetStorageDefault}
-              resetSnapshotDefaults={resetSnapshotDefaults}
-              resetBackupDefaults={resetBackupDefaults}
-              factoryGuestDefaults={FACTORY_GUEST_DEFAULTS}
-              factoryNodeDefaults={FACTORY_NODE_DEFAULTS}
-              factoryHostDefaults={FACTORY_HOST_DEFAULTS}
-              factoryDockerDefaults={FACTORY_DOCKER_DEFAULTS}
-              factoryStorageDefault={FACTORY_STORAGE_DEFAULT}
-              snapshotFactoryDefaults={FACTORY_SNAPSHOT_DEFAULTS}
-              backupFactoryDefaults={FACTORY_BACKUP_DEFAULTS}
-              timeThresholds={timeThresholds}
-              metricTimeThresholds={metricTimeThresholds}
-              setMetricTimeThresholds={setMetricTimeThresholds}
-              backupDefaults={backupDefaults}
-              setBackupDefaults={setBackupDefaults}
-              snapshotDefaults={snapshotDefaults}
-              setSnapshotDefaults={setSnapshotDefaults}
-              pmgThresholds={pmgThresholds}
-              setPMGThresholds={setPMGThresholds}
-              activeAlerts={activeAlerts}
-              setHasUnsavedChanges={setHasUnsavedChanges}
-              hasUnsavedChanges={hasUnsavedChanges}
-              removeAlerts={removeAlerts}
-              disableAllNodes={disableAllNodes}
-              setDisableAllNodes={setDisableAllNodes}
-              disableAllGuests={disableAllGuests}
-              setDisableAllGuests={setDisableAllGuests}
-              disableAllHosts={disableAllHosts}
-              setDisableAllHosts={setDisableAllHosts}
-              disableAllStorage={disableAllStorage}
-              setDisableAllStorage={setDisableAllStorage}
-              disableAllPBS={disableAllPBS}
-              setDisableAllPBS={setDisableAllPBS}
-              disableAllPMG={disableAllPMG}
-              setDisableAllPMG={setDisableAllPMG}
-  disableAllDockerHosts={disableAllDockerHosts}
-  setDisableAllDockerHosts={setDisableAllDockerHosts}
-  disableAllDockerServices={disableAllDockerServices}
-  setDisableAllDockerServices={setDisableAllDockerServices}
-  disableAllDockerContainers={disableAllDockerContainers}
-  setDisableAllDockerContainers={setDisableAllDockerContainers}
-              disableAllNodesOffline={disableAllNodesOffline}
-              setDisableAllNodesOffline={setDisableAllNodesOffline}
-              disableAllGuestsOffline={disableAllGuestsOffline}
-              setDisableAllGuestsOffline={setDisableAllGuestsOffline}
-              disableAllHostsOffline={disableAllHostsOffline}
-              setDisableAllHostsOffline={setDisableAllHostsOffline}
-              disableAllPBSOffline={disableAllPBSOffline}
-              setDisableAllPBSOffline={setDisableAllPBSOffline}
-              disableAllPMGOffline={disableAllPMGOffline}
-              setDisableAllPMGOffline={setDisableAllPMGOffline}
-              disableAllDockerHostsOffline={disableAllDockerHostsOffline}
-              setDisableAllDockerHostsOffline={setDisableAllDockerHostsOffline}
-            />
-          </Show>
-
-          <Show when={activeTab() === 'destinations'}>
-            <DestinationsTab
-              ref={destinationsRef}
-              hasUnsavedChanges={hasUnsavedChanges}
-              setHasUnsavedChanges={setHasUnsavedChanges}
-              emailConfig={emailConfig}
-              setEmailConfig={setEmailConfig}
-              appriseConfig={appriseConfig}
-              setAppriseConfig={setAppriseConfig}
-            />
-          </Show>
-
-          <Show when={activeTab() === 'schedule'}>
-            <ScheduleTab
-              hasUnsavedChanges={hasUnsavedChanges}
-              setHasUnsavedChanges={setHasUnsavedChanges}
-              quietHours={scheduleQuietHours}
-              setQuietHours={setScheduleQuietHours}
-              cooldown={scheduleCooldown}
-              setCooldown={setScheduleCooldown}
-              grouping={scheduleGrouping}
-              setGrouping={setScheduleGrouping}
-              notifyOnResolve={notifyOnResolve}
-              setNotifyOnResolve={setNotifyOnResolve}
-              escalation={scheduleEscalation}
-              setEscalation={setScheduleEscalation}
-            />
-          </Show>
-
-          <Show when={activeTab() === 'history'}>
-            <HistoryTab />
-          </Show>
           </div>
-        </div>
-      </Card>
+
+          <div class="flex-1 overflow-hidden">
+            <Show when={flatTabs.length > 0}>
+              <div class="lg:hidden border-b border-gray-200 dark:border-gray-700">
+                <div class="p-1">
+                  <div
+                    class="flex rounded-lg bg-gray-100 dark:bg-gray-700 p-0.5 w-full overflow-x-auto"
+                    style="-webkit-overflow-scrolling: touch;"
+                  >
+                    <For each={flatTabs}>
+                      {(tab) => {
+                        const disabled = () => tab.id !== 'overview' && !isAlertsActive();
+                        return (
+                          <button
+                            type="button"
+                            class={`flex-1 px-3 py-2 text-xs font-medium rounded-md transition-all whitespace-nowrap ${activeTab() === tab.id
+                              ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 shadow-sm'
+                              : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-100'
+                              } ${disabled() ? 'opacity-50 cursor-not-allowed pointer-events-none' : ''}`}
+                            disabled={disabled()}
+                            onClick={() => {
+                              if (disabled()) return;
+                              handleTabChange(tab.id);
+                            }}
+                            title={disabled() ? 'Activate alerts to configure' : undefined}
+                          >
+                            {tab.label}
+                          </button>
+                        );
+                      }}
+                    </For>
+                  </div>
+                </div>
+              </div>
+            </Show>
+
+            {/* Tab Content */}
+            <div class="p-3 sm:p-6">
+              <Show when={activeTab() === 'overview'}>
+                <OverviewTab
+                  overrides={overrides()}
+                  activeAlerts={activeAlerts}
+                  updateAlert={updateAlert}
+                  showQuickTip={showQuickTip}
+                  dismissQuickTip={dismissQuickTip}
+                  showAcknowledged={showAcknowledged}
+                  setShowAcknowledged={setShowAcknowledged}
+                />
+              </Show>
+
+              <Show when={activeTab() === 'thresholds'}>
+                <ThresholdsTab
+                  overrides={overrides}
+                  setOverrides={setOverrides}
+                  rawOverridesConfig={rawOverridesConfig}
+                  setRawOverridesConfig={setRawOverridesConfig}
+                  allGuests={allGuests}
+                  state={state}
+                  hosts={state.hosts || []}
+                  guestDefaults={guestDefaults}
+                  guestDisableConnectivity={guestDisableConnectivity}
+                  setGuestDefaults={setGuestDefaults}
+                  setGuestDisableConnectivity={setGuestDisableConnectivity}
+                  guestPoweredOffSeverity={guestPoweredOffSeverity}
+                  setGuestPoweredOffSeverity={setGuestPoweredOffSeverity}
+                  nodeDefaults={nodeDefaults}
+                  setNodeDefaults={setNodeDefaults}
+                  hostDefaults={hostDefaults}
+                  setHostDefaults={setHostDefaults}
+                  dockerDefaults={dockerDefaults}
+                  dockerDisableConnectivity={dockerDisableConnectivity}
+                  setDockerDisableConnectivity={setDockerDisableConnectivity}
+                  dockerPoweredOffSeverity={dockerPoweredOffSeverity}
+                  setDockerPoweredOffSeverity={setDockerPoweredOffSeverity}
+                  setDockerDefaults={setDockerDefaults}
+                  dockerIgnoredPrefixes={dockerIgnoredPrefixes}
+                  setDockerIgnoredPrefixes={setDockerIgnoredPrefixes}
+                  storageDefault={storageDefault}
+                  setStorageDefault={setStorageDefault}
+                  resetGuestDefaults={resetGuestDefaults}
+                  resetNodeDefaults={resetNodeDefaults}
+                  resetHostDefaults={resetHostDefaults}
+                  resetDockerDefaults={resetDockerDefaults}
+                  resetDockerIgnoredPrefixes={resetDockerIgnoredPrefixes}
+                  resetStorageDefault={resetStorageDefault}
+                  resetSnapshotDefaults={resetSnapshotDefaults}
+                  resetBackupDefaults={resetBackupDefaults}
+                  factoryGuestDefaults={FACTORY_GUEST_DEFAULTS}
+                  factoryNodeDefaults={FACTORY_NODE_DEFAULTS}
+                  factoryHostDefaults={FACTORY_HOST_DEFAULTS}
+                  factoryDockerDefaults={FACTORY_DOCKER_DEFAULTS}
+                  factoryStorageDefault={FACTORY_STORAGE_DEFAULT}
+                  snapshotFactoryDefaults={FACTORY_SNAPSHOT_DEFAULTS}
+                  backupFactoryDefaults={FACTORY_BACKUP_DEFAULTS}
+                  timeThresholds={timeThresholds}
+                  metricTimeThresholds={metricTimeThresholds}
+                  setMetricTimeThresholds={setMetricTimeThresholds}
+                  backupDefaults={backupDefaults}
+                  setBackupDefaults={setBackupDefaults}
+                  snapshotDefaults={snapshotDefaults}
+                  setSnapshotDefaults={setSnapshotDefaults}
+                  pmgThresholds={pmgThresholds}
+                  setPMGThresholds={setPMGThresholds}
+                  activeAlerts={activeAlerts}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  hasUnsavedChanges={hasUnsavedChanges}
+                  removeAlerts={removeAlerts}
+                  disableAllNodes={disableAllNodes}
+                  setDisableAllNodes={setDisableAllNodes}
+                  disableAllGuests={disableAllGuests}
+                  setDisableAllGuests={setDisableAllGuests}
+                  disableAllHosts={disableAllHosts}
+                  setDisableAllHosts={setDisableAllHosts}
+                  disableAllStorage={disableAllStorage}
+                  setDisableAllStorage={setDisableAllStorage}
+                  disableAllPBS={disableAllPBS}
+                  setDisableAllPBS={setDisableAllPBS}
+                  disableAllPMG={disableAllPMG}
+                  setDisableAllPMG={setDisableAllPMG}
+                  disableAllDockerHosts={disableAllDockerHosts}
+                  setDisableAllDockerHosts={setDisableAllDockerHosts}
+                  disableAllDockerServices={disableAllDockerServices}
+                  setDisableAllDockerServices={setDisableAllDockerServices}
+                  disableAllDockerContainers={disableAllDockerContainers}
+                  setDisableAllDockerContainers={setDisableAllDockerContainers}
+                  disableAllNodesOffline={disableAllNodesOffline}
+                  setDisableAllNodesOffline={setDisableAllNodesOffline}
+                  disableAllGuestsOffline={disableAllGuestsOffline}
+                  setDisableAllGuestsOffline={setDisableAllGuestsOffline}
+                  disableAllHostsOffline={disableAllHostsOffline}
+                  setDisableAllHostsOffline={setDisableAllHostsOffline}
+                  disableAllPBSOffline={disableAllPBSOffline}
+                  setDisableAllPBSOffline={setDisableAllPBSOffline}
+                  disableAllPMGOffline={disableAllPMGOffline}
+                  setDisableAllPMGOffline={setDisableAllPMGOffline}
+                  disableAllDockerHostsOffline={disableAllDockerHostsOffline}
+                  setDisableAllDockerHostsOffline={setDisableAllDockerHostsOffline}
+                />
+              </Show>
+
+              <Show when={activeTab() === 'destinations'}>
+                <DestinationsTab
+                  ref={destinationsRef}
+                  hasUnsavedChanges={hasUnsavedChanges}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  emailConfig={emailConfig}
+                  setEmailConfig={setEmailConfig}
+                  appriseConfig={appriseConfig}
+                  setAppriseConfig={setAppriseConfig}
+                />
+              </Show>
+
+              <Show when={activeTab() === 'schedule'}>
+                <ScheduleTab
+                  hasUnsavedChanges={hasUnsavedChanges}
+                  setHasUnsavedChanges={setHasUnsavedChanges}
+                  quietHours={scheduleQuietHours}
+                  setQuietHours={setScheduleQuietHours}
+                  cooldown={scheduleCooldown}
+                  setCooldown={setScheduleCooldown}
+                  grouping={scheduleGrouping}
+                  setGrouping={setScheduleGrouping}
+                  notifyOnResolve={notifyOnResolve}
+                  setNotifyOnResolve={setNotifyOnResolve}
+                  escalation={scheduleEscalation}
+                  setEscalation={setScheduleEscalation}
+                />
+              </Show>
+
+              <Show when={activeTab() === 'history'}>
+                <HistoryTab />
+              </Show>
+            </div>
+          </div>
+        </Card>
       </div>
     </div>
   );
@@ -2004,6 +2039,232 @@ function OverviewTab(props: {
   // Loading states for buttons
   const [processingAlerts, setProcessingAlerts] = createSignal<Set<string>>(new Set());
 
+  // AI Patrol findings state
+  const [aiFindings, setAiFindings] = createSignal<Finding[]>([]);
+  const [patrolStatus, setPatrolStatus] = createSignal<PatrolStatus | null>(null);
+  const [patrolRunHistory, setPatrolRunHistory] = createSignal<PatrolRunRecord[]>([]);
+  // Track findings user marked as "I Fixed It" - hidden until next patrol verifies
+  const [pendingFixFindings, setPendingFixFindings] = createSignal<Set<string>>(new Set());
+  const [lastKnownPatrolAt, setLastKnownPatrolAt] = createSignal<string | null>(null);
+  const [showRunHistory, setShowRunHistory] = createSignal(false);
+  const [forcePatrolLoading, setForcePatrolLoading] = createSignal(false);
+  const [expandedRunId, setExpandedRunId] = createSignal<string | null>(null);
+  const [historyTimeFilter, setHistoryTimeFilter] = createSignal<'24h' | '7d' | 'all'>('all');
+  // Suppression rules management
+  const [suppressionRules, setSuppressionRules] = createSignal<SuppressionRule[]>([]);
+  const [showSuppressionRules, setShowSuppressionRules] = createSignal(false);
+  const [showAddRuleForm, setShowAddRuleForm] = createSignal(false);
+  const [newRuleResource, setNewRuleResource] = createSignal('');
+  const [newRuleCategory, setNewRuleCategory] = createSignal('');
+  const [newRuleDescription, setNewRuleDescription] = createSignal('');
+  // Live streaming state for running patrol
+  const [expandedLiveStream, setExpandedLiveStream] = createSignal(false);
+  // Track streaming blocks for sequential display (like AI chat)
+  interface StreamBlock {
+    type: 'phase' | 'content' | 'thinking';
+    text: string;
+    timestamp: number;
+  }
+  const [liveStreamBlocks, setLiveStreamBlocks] = createSignal<StreamBlock[]>([]);
+  const [currentThinking, setCurrentThinking] = createSignal('');
+  let liveStreamUnsubscribe: (() => void) | null = null;
+
+  // Effect to manage live stream subscription when expanded
+  createEffect(() => {
+    const isExpanded = expandedLiveStream();
+    const isRunning = patrolStatus()?.running;
+
+    if (isExpanded && isRunning && !liveStreamUnsubscribe) {
+      // Subscribe to stream
+      liveStreamUnsubscribe = subscribeToPatrolStream(
+        (event) => {
+          if (event.type === 'start') {
+            // Clear previous content
+            setLiveStreamBlocks([]);
+            setCurrentThinking('');
+          } else if (event.type === 'thinking' && event.content) {
+            // Thinking events are separate blocks - just like AI chat
+            // Finalize any current content first
+            const current = currentThinking();
+            if (current.trim()) {
+              setLiveStreamBlocks(prev => [...prev, {
+                type: 'thinking',
+                text: current.trim(),
+                timestamp: Date.now()
+              }]);
+              setCurrentThinking('');
+            }
+            // Add the thinking chunk as a new block
+            setLiveStreamBlocks(prev => [...prev, {
+              type: 'thinking',
+              text: event.content!.trim(),
+              timestamp: Date.now()
+            }]);
+          } else if (event.type === 'content' && event.content) {
+            // Content streams into current block
+            setCurrentThinking(prev => prev + event.content);
+          } else if (event.type === 'complete') {
+            // Finalize current thinking block
+            const finalThinking = currentThinking();
+            if (finalThinking.trim()) {
+              setLiveStreamBlocks(prev => [...prev, {
+                type: 'thinking',
+                text: finalThinking.trim(),
+                timestamp: Date.now()
+              }]);
+              setCurrentThinking('');
+            }
+            // Mark as complete
+            setLiveStreamBlocks(prev => [...prev, {
+              type: 'phase',
+              text: 'Analysis complete',
+              timestamp: Date.now()
+            }]);
+            // Patrol completed, refresh data
+            fetchAiData();
+          }
+          // Ignore 'phase' events - they're internal
+        },
+        () => {
+          // Error - just log it
+          console.error('Patrol stream error');
+        }
+      );
+    } else if ((!isExpanded || !isRunning) && liveStreamUnsubscribe) {
+      // Unsubscribe
+      liveStreamUnsubscribe();
+      liveStreamUnsubscribe = null;
+      if (!isRunning) {
+        setLiveStreamBlocks([]);
+        setCurrentThinking('');
+        setExpandedLiveStream(false);
+      }
+    }
+  });
+
+  // Cleanup on unmount
+  onCleanup(() => {
+    if (liveStreamUnsubscribe) {
+      liveStreamUnsubscribe();
+      liveStreamUnsubscribe = null;
+    }
+  });
+
+  // Fetch AI data - extracted for reuse
+  const fetchAiData = async () => {
+    try {
+      const [status, findings, runHistory, rules] = await Promise.all([
+        getPatrolStatus(),
+        getFindings(),
+        getPatrolRunHistory(50), // Fetch more for filtering
+        getSuppressionRules().catch(() => []) // May not be available
+      ]);
+
+      // Check if a new patrol has completed - if so, clear pending fix findings
+      const newPatrolAt = status.last_patrol_at;
+      if (newPatrolAt && newPatrolAt !== lastKnownPatrolAt()) {
+        setLastKnownPatrolAt(newPatrolAt);
+        // Clear pending fixes - the patrol has now verified what's actually fixed
+        if (pendingFixFindings().size > 0) {
+          setPendingFixFindings(new Set<string>());
+        }
+      }
+
+      setPatrolStatus(status);
+      setAiFindings(findings || []);
+      setPatrolRunHistory(runHistory || []);
+      setSuppressionRules(rules || []);
+
+      // Auto-expand history if most recent run found issues
+      if (runHistory && runHistory.length > 0 && runHistory[0].status !== 'healthy') {
+        setShowRunHistory(true);
+      }
+    } catch (_e) {
+      // AI patrol may not be enabled - silently fail
+    }
+  };
+
+  // Handle force patrol button click
+  const handleForcePatrol = async (deep: boolean = false) => {
+    setForcePatrolLoading(true);
+    try {
+      const result = await forcePatrol(deep);
+      if (!result.success) {
+        showError(result.message || 'Failed to start patrol');
+        setForcePatrolLoading(false);
+        return;
+      }
+      showSuccess('Patrol started - results will appear shortly');
+      // Wait a bit for the patrol to start and potentially complete
+      setTimeout(() => {
+        fetchAiData();
+        setForcePatrolLoading(false);
+      }, 2000);
+    } catch (e) {
+      console.error('Force patrol error:', e);
+      showError('Failed to start patrol: ' + (e instanceof Error ? e.message : 'Unknown error'));
+      setForcePatrolLoading(false);
+    }
+  };
+
+  // Filter patrol history by time
+  const filteredPatrolHistory = createMemo(() => {
+    const history = patrolRunHistory();
+    const filter = historyTimeFilter();
+    if (filter === 'all') return history;
+
+    const now = Date.now();
+    const cutoffs = {
+      '24h': now - 24 * 60 * 60 * 1000,
+      '7d': now - 7 * 24 * 60 * 60 * 1000,
+    };
+    const cutoff = cutoffs[filter];
+    return history.filter(r => new Date(r.completed_at).getTime() > cutoff);
+  });
+
+  // Calculate next patrol time
+  const nextPatrolIn = createMemo(() => {
+    const status = patrolStatus();
+    if (!status) return null;
+
+    let nextPatrolTime: number;
+
+    // Use next_patrol_at from backend if available
+    if (status.next_patrol_at) {
+      nextPatrolTime = new Date(status.next_patrol_at).getTime();
+    } else if (status.last_patrol_at && status.interval_ms) {
+      // Calculate from last patrol + interval
+      const lastPatrol = new Date(status.last_patrol_at).getTime();
+      nextPatrolTime = lastPatrol + status.interval_ms;
+    } else {
+      return null;
+    }
+
+    const now = Date.now();
+    const remainingMs = nextPatrolTime - now;
+
+    if (remainingMs <= 0) return 'Soon';
+
+    const hours = Math.floor(remainingMs / 3600000);
+    const minutes = Math.floor((remainingMs % 3600000) / 60000);
+    const seconds = Math.floor((remainingMs % 60000) / 1000);
+
+    if (hours > 0) {
+      return `${hours}h ${minutes}m`;
+    }
+    if (minutes > 0) {
+      return `${minutes}m ${seconds}s`;
+    }
+    return `${seconds}s`;
+  });
+
+  // Fetch AI findings on mount and every 30 seconds
+  onMount(() => {
+    fetchAiData();
+    const interval = setInterval(fetchAiData, 30000);
+    onCleanup(() => clearInterval(interval));
+  });
+
   // Get alert stats from actual active alerts
   const alertStats = createMemo(() => {
     // Access the store properly for reactivity
@@ -2017,6 +2278,7 @@ function OverviewTab(props: {
     };
   });
 
+
   const filteredAlerts = createMemo(() => {
     const alerts = Object.values(props.activeAlerts);
     // Sort: unacknowledged first, then by start time (newest first)
@@ -2038,34 +2300,23 @@ function OverviewTab(props: {
 
   const [bulkAckProcessing, setBulkAckProcessing] = createSignal(false);
 
+  // Sub-tab for switching between AI Insights and Active Alerts
+  type OverviewSubTab = 'ai-insights' | 'active-alerts';
+
+  // Read subtab from URL query parameter to allow deep linking
+  const location = useLocation();
+  const getInitialSubTab = (): OverviewSubTab => {
+    const params = new URLSearchParams(location.search);
+    const subtab = params.get('subtab');
+    if (subtab === 'ai-insights') return 'ai-insights';
+    return 'active-alerts';
+  };
+  const [overviewSubTab, setOverviewSubTab] = createSignal<OverviewSubTab>(getInitialSubTab());
+
   return (
     <div class="space-y-6">
-      {/* Stats Cards */}
-      <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 sm:gap-4 lg:grid-cols-4">
-        <Card padding="sm" class="sm:p-4">
-          <div class="flex items-center justify-between">
-            <div>
-              <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Active Alerts</p>
-              <p class="text-xl sm:text-2xl font-semibold text-gray-600 dark:text-gray-300">
-                {alertStats().active}
-              </p>
-            </div>
-            <div class="w-8 h-8 sm:w-10 sm:h-10 bg-red-100 dark:bg-red-900/50 rounded-full flex items-center justify-center">
-              <svg
-                width="16"
-                height="16"
-                class="sm:w-5 sm:h-5 text-red-600 dark:text-red-400"
-                viewBox="0 0 24 24"
-                fill="none"
-                stroke="currentColor"
-                stroke-width="2"
-              >
-                <path d="M18 8A6 6 0 0 0 6 8c0 7-3 9-3 9h18s-3-2-3-9"></path>
-                <path d="M13.73 21a2 2 0 0 1-3.46 0"></path>
-              </svg>
-            </div>
-          </div>
-        </Card>
+      {/* Stats Cards - only show cards not duplicated in sub-tabs */}
+      <div class="grid grid-cols-1 gap-3 sm:grid-cols-2 sm:gap-4 lg:grid-cols-3">
 
         <Card padding="sm" class="sm:p-4">
           <div class="flex items-center justify-between">
@@ -2143,257 +2394,1154 @@ function OverviewTab(props: {
         </Card>
       </div>
 
-      {/* Recent Alerts */}
-      <div>
-        <SectionHeader title="Active Alerts" size="md" class="mb-3" />
-        <Show
-          when={Object.keys(props.activeAlerts).length > 0}
-          fallback={
-            <div class="text-center py-8 text-gray-500 dark:text-gray-400">
-              <div class="flex justify-center mb-3">
-                <svg class="w-12 h-12 text-green-500 dark:text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                  <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="2" fill="none" />
-                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4" />
+      {/* Sub-tabs for AI Insights vs Active Alerts */}
+      <Show when={patrolStatus()?.enabled}>
+        <div class="flex items-center gap-1 border-b border-gray-200 dark:border-gray-700/50 pb-1">
+          <button
+            class={`px-4 py-2 text-sm font-medium rounded-t-lg transition-colors ${overviewSubTab() === 'active-alerts'
+              ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 border border-b-0 border-gray-200 dark:border-gray-700'
+              : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-200'
+              }`}
+            onClick={() => setOverviewSubTab('active-alerts')}
+          >
+            Active Alerts
+            <Show when={alertStats().active > 0}>
+              <span class="ml-2 px-1.5 py-0.5 text-xs font-medium rounded bg-red-100 dark:bg-red-900/40 text-red-700 dark:text-red-300">
+                {alertStats().active}
+              </span>
+            </Show>
+          </button>
+          <button
+            class={`px-4 py-2 text-sm font-medium rounded-t-lg transition-colors ${overviewSubTab() === 'ai-insights'
+              ? 'bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 border border-b-0 border-gray-200 dark:border-gray-700'
+              : 'text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-200'
+              }`}
+            onClick={() => setOverviewSubTab('ai-insights')}
+          >
+            AI Insights
+            <Show when={aiFindings().length > 0}>
+              <span class="ml-2 px-1.5 py-0.5 text-xs font-medium rounded bg-purple-100 dark:bg-purple-900/40 text-purple-700 dark:text-purple-300">
+                {aiFindings().length}
+              </span>
+            </Show>
+          </button>
+        </div>
+      </Show>
+
+      {/* AI Insights Section - show when AI tab selected and there are findings */}
+      <Show when={overviewSubTab() === 'ai-insights' && patrolStatus()?.enabled}>
+        <div>
+          <div class="flex items-center justify-between mb-3">
+            <SectionHeader
+              title="AI Insights"
+              size="md"
+              class="mb-0"
+            />
+            <button
+              class="px-3 py-1.5 text-xs font-medium rounded-lg transition-all bg-purple-100 dark:bg-purple-900/40 text-purple-700 dark:text-purple-300 border border-purple-300 dark:border-purple-700 hover:bg-purple-200 dark:hover:bg-purple-900/60 disabled:opacity-50 disabled:cursor-not-allowed"
+              onClick={() => handleForcePatrol(true)}
+              disabled={forcePatrolLoading() || patrolStatus()?.running}
+              title={patrolStatus()?.running ? 'Patrol in progress - see table below' : 'Run a patrol check now'}
+            >
+              <span class="flex items-center gap-1.5">
+                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M14.752 11.168l-3.197-2.132A1 1 0 0010 9.87v4.263a1 1 0 001.555.832l3.197-2.132a1 1 0 000-1.664z" />
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
                 </svg>
-              </div>
-              <p class="text-sm">No active alerts</p>
-              <p class="text-xs mt-1">Alerts will appear here when thresholds are exceeded</p>
+                Run Patrol
+              </span>
+            </button>
+          </div>
+
+          {/* Summary Stats Bar */}
+          <div class="bg-gray-50 dark:bg-gray-800/50 rounded-lg p-3 mb-4 flex flex-wrap items-center gap-4 text-xs">
+            <div class="flex items-center gap-1.5">
+              <span class="text-gray-500 dark:text-gray-400">Runs:</span>
+              <span class="font-medium text-gray-700 dark:text-gray-300">{patrolRunHistory().length}</span>
             </div>
-          }
-        >
-          <Show when={alertStats().acknowledged > 0 || alertStats().active > 0}>
-            <div class="flex flex-wrap items-center justify-between gap-2 p-2 bg-gray-50 dark:bg-gray-800 rounded-t-lg border border-gray-200 dark:border-gray-700">
-              <Show when={alertStats().acknowledged > 0}>
-                <button
-                  onClick={() => props.setShowAcknowledged(!props.showAcknowledged())}
-                  class="text-xs text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200 transition-colors"
-                >
-                  {props.showAcknowledged() ? 'Hide' : 'Show'} acknowledged
-                </button>
-              </Show>
-              <Show when={alertStats().active > 0}>
-                <button
-                  type="button"
-                  class="inline-flex items-center gap-1 px-3 py-1.5 text-xs font-medium rounded-lg border border-blue-200 dark:border-blue-700 bg-blue-50 dark:bg-blue-900/40 text-blue-700 dark:text-blue-200 transition-colors hover:bg-blue-100 dark:hover:bg-blue-900/60 disabled:opacity-60 disabled:cursor-not-allowed"
-                  disabled={bulkAckProcessing()}
-                  onClick={async () => {
-                    if (bulkAckProcessing()) return;
-                    const pending = unacknowledgedAlerts();
-                    if (pending.length === 0) {
-                      return;
-                    }
-                    setBulkAckProcessing(true);
-                    try {
-                      const result = await AlertsAPI.bulkAcknowledge(pending.map((alert) => alert.id));
-                      const successes = result.results.filter((r) => r.success);
-                      const failures = result.results.filter((r) => !r.success);
-
-                      successes.forEach((res) => {
-                        props.updateAlert(res.alertId, {
-                          acknowledged: true,
-                          ackTime: new Date().toISOString(),
-                        });
-                      });
-
-                      if (successes.length > 0) {
-                        showSuccess(
-                          `Acknowledged ${successes.length} ${successes.length === 1 ? 'alert' : 'alerts'}.`,
-                        );
-                      }
-
-                      if (failures.length > 0) {
-                        showError(
-                          `Failed to acknowledge ${failures.length} ${failures.length === 1 ? 'alert' : 'alerts'}.`,
-                        );
-                      }
-                    } catch (error) {
-                      logger.error('Bulk acknowledge failed', error);
-                      showError('Failed to acknowledge alerts');
-                    } finally {
-                      setBulkAckProcessing(false);
-                    }
-                  }}
-                >
-                  {bulkAckProcessing()
-                    ? 'Acknowledging…'
-                    : `Acknowledge all (${alertStats().active})`}
-                </button>
-              </Show>
+            <div class="flex items-center gap-1.5">
+              <span class="text-gray-500 dark:text-gray-400">Healthy:</span>
+              <span class="font-medium text-green-600 dark:text-green-400">
+                {patrolRunHistory().filter(r => r.status === 'healthy').length}
+              </span>
             </div>
-          </Show>
-          <div class="space-y-2">
-            <Show when={filteredAlerts().length === 0}>
-              <div class="text-center py-8 text-gray-500 dark:text-gray-400">
-                {props.showAcknowledged() ? 'No active alerts' : 'No unacknowledged alerts'}
+            <Show when={patrolRunHistory().filter(r => r.status !== 'healthy').length > 0}>
+              <div class="flex items-center gap-1.5">
+                <span class="text-gray-500 dark:text-gray-400">Issues:</span>
+                <span class="font-medium text-yellow-600 dark:text-yellow-400">
+                  {patrolRunHistory().filter(r => r.status !== 'healthy').length}
+                </span>
               </div>
             </Show>
-            <For each={filteredAlerts()}>
-              {(alert) => (
-                <div
-                  class={`border rounded-lg p-4 transition-all ${
-                    processingAlerts().has(alert.id) ? 'opacity-50' : ''
-                  } ${
-                    alert.acknowledged
-                      ? 'opacity-60 border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-900/20'
-                      : alert.level === 'critical'
-                        ? 'border-red-300 dark:border-red-800 bg-red-50 dark:bg-red-900/20'
-                        : 'border-yellow-300 dark:border-yellow-800 bg-yellow-50 dark:bg-yellow-900/20'
-                  }`}
-                >
-                  <div class="flex flex-col sm:flex-row sm:items-start">
-                    <div class="flex items-start flex-1">
-                      {/* Status icon */}
+            <div class="flex items-center gap-1.5">
+              <span class="text-gray-500 dark:text-gray-400">Last:</span>
+              <span class="font-medium text-gray-700 dark:text-gray-300">
+                {patrolStatus()?.last_patrol_at ? formatTimestamp(patrolStatus()!.last_patrol_at!) : 'never'}
+              </span>
+            </div>
+            <Show when={patrolStatus()?.resources_checked}>
+              <div class="flex items-center gap-1.5">
+                <span class="text-gray-500 dark:text-gray-400">Resources:</span>
+                <span class="font-medium text-gray-700 dark:text-gray-300">{patrolStatus()?.resources_checked}</span>
+              </div>
+            </Show>
+          </div>
+          <div class="space-y-2">
+            <Show
+              when={aiFindings().length > 0}
+              fallback={
+                <div class="text-center py-6 border border-green-200 dark:border-green-800 bg-green-50 dark:bg-green-900/20 rounded-lg">
+                  <div class="flex justify-center mb-2">
+                    <svg class="w-10 h-10 text-green-500 dark:text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="2" fill="none" />
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4" />
+                    </svg>
+                  </div>
+                  <p class="text-sm font-medium text-green-700 dark:text-green-400">All Systems Healthy</p>
+                  <p class="text-xs text-green-600 dark:text-green-500 mt-1">AI patrol found no issues to report</p>
+                </div>
+              }
+            >
+              <For each={aiFindings().filter(f => !pendingFixFindings().has(f.id))}>
+                {(finding) => {
+                  const colors = severityColors[finding.severity];
+                  const [isExpanded, setIsExpanded] = createSignal(false);
+                  return (
+                    <div
+                      class="border rounded-lg transition-all"
+                      style={{
+                        'background-color': colors.bg,
+                        'border-color': colors.border,
+                      }}
+                    >
+                      {/* Compact header - always visible, clickable */}
                       <div
-                        class={`mr-3 mt-0.5 transition-all ${
-                          alert.acknowledged
+                        class="flex items-center gap-3 p-3 cursor-pointer hover:opacity-80"
+                        onClick={() => setIsExpanded(!isExpanded())}
+                      >
+                        {/* Expand chevron */}
+                        <svg
+                          class={`w-4 h-4 text-gray-500 transition-transform flex-shrink-0 ${isExpanded() ? 'rotate-90' : ''}`}
+                          fill="none" stroke="currentColor" viewBox="0 0 24 24"
+                        >
+                          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
+                        </svg>
+                        {/* Severity badge */}
+                        <span
+                          class="px-2 py-0.5 text-xs rounded capitalize font-medium flex-shrink-0"
+                          style={{ 'background-color': colors.border, color: colors.text }}
+                        >
+                          {finding.severity}
+                        </span>
+                        {/* Title (main info) */}
+                        <span class="text-sm font-medium text-gray-800 dark:text-gray-200 truncate flex-1">
+                          {finding.title}
+                        </span>
+                        {/* Recurrence badge - show if raised multiple times */}
+                        <Show when={finding.times_raised > 1}>
+                          <span
+                            class="text-[10px] px-1.5 py-0.5 rounded bg-amber-100 dark:bg-amber-900/30 text-amber-700 dark:text-amber-400 flex-shrink-0"
+                            title={`This issue has been detected ${finding.times_raised} times`}
+                          >
+                            ×{finding.times_raised}
+                          </span>
+                        </Show>
+                        {/* Dismissed status badge */}
+                        <Show when={finding.dismissed_reason}>
+                          <span class="text-[10px] px-1.5 py-0.5 rounded bg-gray-200 dark:bg-gray-700 text-gray-500 dark:text-gray-400 flex-shrink-0">
+                            {finding.dismissed_reason === 'not_an_issue' && '✓ Dismissed'}
+                            {finding.dismissed_reason === 'expected_behavior' && '✓ Expected'}
+                            {finding.dismissed_reason === 'will_fix_later' && '⏱ Noted'}
+                          </span>
+                        </Show>
+                        {/* Suppressed badge */}
+                        <Show when={finding.suppressed}>
+                          <span class="text-[10px] px-1.5 py-0.5 rounded bg-red-100 dark:bg-red-900/30 text-red-600 dark:text-red-400 flex-shrink-0">
+                            🔇 Suppressed
+                          </span>
+                        </Show>
+                        {/* Resource name pill */}
+                        <span class="text-xs px-2 py-0.5 rounded bg-gray-200 dark:bg-gray-700 text-gray-600 dark:text-gray-400 flex-shrink-0 hidden sm:inline">
+                          {finding.resource_name}
+                        </span>
+                        {/* AI badge */}
+                        <span
+                          class="inline-flex items-center justify-center w-5 h-5 rounded text-[9px] font-bold flex-shrink-0"
+                          style={{ 'background-color': colors.border, color: colors.text }}
+                        >
+                          AI
+                        </span>
+                      </div>
+
+                      {/* Expanded details */}
+                      <Show when={isExpanded()}>
+                        <div class="px-4 pb-4 pt-1 border-t" style={{ 'border-color': colors.border }}>
+                          {/* Resource and category info */}
+                          <div class="flex flex-wrap items-center gap-2 mb-2">
+                            <span class="text-sm font-medium" style={{ color: colors.text }}>
+                              {finding.resource_name}
+                            </span>
+                            <span class="text-xs text-gray-600 dark:text-gray-400">
+                              ({finding.category})
+                            </span>
+                            <Show when={finding.node}>
+                              <span class="text-xs text-gray-500 dark:text-gray-500">
+                                on {finding.node}
+                              </span>
+                            </Show>
+                          </div>
+
+                          {/* Description */}
+                          <p class="text-sm text-gray-600 dark:text-gray-400">
+                            {finding.description}
+                          </p>
+
+                          {/* Recommendation */}
+                          <Show when={finding.recommendation}>
+                            <p class="text-xs text-gray-500 dark:text-gray-500 mt-2 italic">
+                              Suggested: {finding.recommendation}
+                            </p>
+                          </Show>
+
+                          {/* User note if present */}
+                          <Show when={finding.user_note}>
+                            <div class="mt-2 p-2 rounded bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800">
+                              <p class="text-xs text-blue-700 dark:text-blue-300">
+                                <span class="font-medium">Your note:</span> {finding.user_note}
+                              </p>
+                            </div>
+                          </Show>
+
+                          {/* Footer with time and actions */}
+                          <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-2 mt-3 pt-2 border-t border-gray-200 dark:border-gray-600">
+                            <p class="text-xs text-gray-500 dark:text-gray-500">
+                              Detected: {formatTimestamp(finding.detected_at)}
+                            </p>
+                            <div class="flex items-center gap-2">
+                              {/* Get Help with AI button */}
+                              <button
+                                class="px-3 py-1.5 text-xs font-medium border rounded-lg transition-all bg-purple-50 dark:bg-purple-900/30 text-purple-700 dark:text-purple-300 border-purple-300 dark:border-purple-700 hover:bg-purple-100 dark:hover:bg-purple-900/50 flex items-center gap-1.5"
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  aiChatStore.openWithPrompt(
+                                    `Help me fix this issue on ${finding.resource_name}: ${finding.title}\n\nDescription: ${finding.description}\n\nSuggested fix: ${finding.recommendation || 'None provided'}\n\nPlease guide me through applying this fix. When you've successfully fixed the issue, use the resolve_finding tool to mark it as resolved.`,
+                                    { findingId: finding.id }
+                                  );
+                                }}
+                              >
+                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z" />
+                                </svg>
+                                Get Help
+                              </button>
+                              {/* I Fixed It button - hides until next patrol verifies */}
+                              <button
+                                class="px-3 py-1.5 text-xs font-medium border rounded-lg transition-all bg-green-50 dark:bg-green-900/30 text-green-700 dark:text-green-300 border-green-300 dark:border-green-700 hover:bg-green-100 dark:hover:bg-green-900/50 flex items-center gap-1.5"
+                                onClick={(e) => {
+                                  e.stopPropagation();
+                                  setPendingFixFindings(prev => {
+                                    const next = new Set(prev);
+                                    next.add(finding.id);
+                                    return next;
+                                  });
+                                }}
+                                title="Hide until next patrol verifies the fix"
+                              >
+                                <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
+                                </svg>
+                                I Fixed It
+                              </button>
+                              {/* Not an Issue dropdown - LLM memory system */}
+                              <div class="relative group">
+                                <button
+                                  class="px-3 py-1.5 text-xs font-medium border rounded-lg transition-all bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-400 border-gray-300 dark:border-gray-600 hover:bg-gray-100 dark:hover:bg-gray-700 flex items-center gap-1.5"
+                                  onClick={(e) => e.stopPropagation()}
+                                  title="Dismiss this finding - AI won't re-raise it"
+                                >
+                                  <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M18.364 18.364A9 9 0 005.636 5.636m12.728 12.728A9 9 0 015.636 5.636m12.728 12.728L5.636 5.636" />
+                                  </svg>
+                                  Dismiss
+                                  <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 9l-7 7-7-7" />
+                                  </svg>
+                                </button>
+                                {/* Dropdown menu - pt-2 creates visual gap while maintaining hover area */}
+                                <div class="absolute right-0 top-full pt-1 w-48 opacity-0 invisible group-hover:opacity-100 group-hover:visible transition-all z-50">
+                                  <div class="bg-white dark:bg-gray-800 rounded-lg shadow-lg border border-gray-200 dark:border-gray-700">
+                                    <button
+                                      class="w-full px-3 py-2 text-left text-xs hover:bg-gray-100 dark:hover:bg-gray-700 rounded-t-lg transition-colors"
+                                      onClick={async (e) => {
+                                        e.stopPropagation();
+                                        try {
+                                          await dismissFinding(finding.id, 'not_an_issue');
+                                          showSuccess('Dismissed - AI will not raise this again');
+                                          fetchAiData();
+                                        } catch (_err) {
+                                          showError('Failed to dismiss finding');
+                                        }
+                                      }}
+                                    >
+                                      <span class="font-medium text-gray-700 dark:text-gray-300">Not an Issue</span>
+                                      <p class="text-gray-500 dark:text-gray-500 mt-0.5">This isn't actually a problem</p>
+                                    </button>
+                                    <button
+                                      class="w-full px-3 py-2 text-left text-xs hover:bg-gray-100 dark:hover:bg-gray-700 transition-colors"
+                                      onClick={async (e) => {
+                                        e.stopPropagation();
+                                        const note = prompt('Why is this expected? (optional - helps AI understand your environment)');
+                                        try {
+                                          await dismissFinding(finding.id, 'expected_behavior', note || undefined);
+                                          showSuccess('Dismissed - AI will not raise this again');
+                                          fetchAiData();
+                                        } catch (_err) {
+                                          showError('Failed to dismiss finding');
+                                        }
+                                      }}
+                                    >
+                                      <span class="font-medium text-gray-700 dark:text-gray-300">Expected Behavior</span>
+                                      <p class="text-gray-500 dark:text-gray-500 mt-0.5">This is intentional/by design</p>
+                                    </button>
+                                    <button
+                                      class="w-full px-3 py-2 text-left text-xs hover:bg-gray-100 dark:hover:bg-gray-700 transition-colors"
+                                      onClick={async (e) => {
+                                        e.stopPropagation();
+                                        try {
+                                          await dismissFinding(finding.id, 'will_fix_later');
+                                          showSuccess('Acknowledged - AI will check again later');
+                                          fetchAiData();
+                                        } catch (_err) {
+                                          showError('Failed to dismiss finding');
+                                        }
+                                      }}
+                                    >
+                                      <span class="font-medium text-gray-700 dark:text-gray-300">Will Fix Later</span>
+                                      <p class="text-gray-500 dark:text-gray-500 mt-0.5">I know about it, will address</p>
+                                    </button>
+                                    <div class="border-t border-gray-200 dark:border-gray-700">
+                                      <button
+                                        class="w-full px-3 py-2 text-left text-xs hover:bg-red-50 dark:hover:bg-red-900/30 rounded-b-lg transition-colors text-red-600 dark:text-red-400"
+                                        onClick={async (e) => {
+                                          e.stopPropagation();
+                                          if (confirm('Permanently suppress this type of finding for this resource?\n\nThe AI will never raise this issue again.')) {
+                                            try {
+                                              await suppressFinding(finding.id);
+                                              showSuccess('Suppressed - AI will never raise this again');
+                                              fetchAiData();
+                                            } catch (_err) {
+                                              showError('Failed to suppress finding');
+                                            }
+                                          }
+                                        }}
+                                      >
+                                        <span class="font-medium">Never Alert Again</span>
+                                        <p class="text-red-500/80 dark:text-red-400/80 mt-0.5">Permanently suppress for this resource</p>
+                                      </button>
+                                    </div>
+                                  </div>
+                                </div>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                      </Show>
+                    </div>
+                  );
+                }}
+              </For>
+            </Show>
+          </div>
+
+          {/* Suppression Rules - What's being ignored */}
+          <div class="mt-6">
+            <div class="flex items-center justify-between">
+              <button
+                class="flex items-center gap-2 text-sm font-medium text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-200 transition-colors"
+                onClick={() => setShowSuppressionRules(!showSuppressionRules())}
+              >
+                <svg
+                  class={`w-4 h-4 transition-transform ${showSuppressionRules() ? 'rotate-90' : ''}`}
+                  fill="none"
+                  stroke="currentColor"
+                  viewBox="0 0 24 24"
+                >
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
+                </svg>
+                🔇 Suppression Rules ({suppressionRules().length} active)
+              </button>
+              <button
+                class="text-xs text-blue-600 dark:text-blue-400 hover:underline"
+                onClick={() => setShowAddRuleForm(!showAddRuleForm())}
+              >
+                + Add Rule
+              </button>
+            </div>
+
+            {/* Add rule form */}
+            <Show when={showAddRuleForm()}>
+              <div class="mt-3 p-4 bg-blue-50 dark:bg-blue-900/20 rounded-lg border border-blue-200 dark:border-blue-800">
+                <p class="text-sm font-medium text-blue-800 dark:text-blue-200 mb-3">
+                  Add a suppression rule to prevent alerts
+                </p>
+                <div class="grid grid-cols-1 md:grid-cols-3 gap-3 mb-3">
+                  <input
+                    type="text"
+                    class="px-3 py-2 text-sm rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100"
+                    placeholder="Resource ID (or leave empty for any)"
+                    value={newRuleResource()}
+                    onInput={(e) => setNewRuleResource(e.currentTarget.value)}
+                  />
+                  <select
+                    class="px-3 py-2 text-sm rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100"
+                    value={newRuleCategory()}
+                    onChange={(e) => setNewRuleCategory(e.currentTarget.value)}
+                  >
+                    <option value="">Any category</option>
+                    <option value="performance">Performance</option>
+                    <option value="capacity">Capacity</option>
+                    <option value="reliability">Reliability</option>
+                    <option value="backup">Backup</option>
+                    <option value="security">Security</option>
+                    <option value="general">General</option>
+                  </select>
+                  <input
+                    type="text"
+                    class="px-3 py-2 text-sm rounded border border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100"
+                    placeholder="Reason (e.g., 'Dev container runs hot')"
+                    value={newRuleDescription()}
+                    onInput={(e) => setNewRuleDescription(e.currentTarget.value)}
+                  />
+                </div>
+                <div class="flex gap-2">
+                  <button
+                    class="px-3 py-1.5 text-sm font-medium rounded bg-blue-600 text-white hover:bg-blue-700 transition-colors disabled:opacity-50"
+                    disabled={!newRuleDescription()}
+                    onClick={async () => {
+                      try {
+                        await addSuppressionRule(
+                          newRuleResource(),
+                          newRuleResource() || 'Any resource',
+                          (newRuleCategory() as 'performance' | 'capacity' | 'reliability' | 'backup' | 'security' | 'general' | ''),
+                          newRuleDescription()
+                        );
+                        showSuccess('Suppression rule created');
+                        setShowAddRuleForm(false);
+                        setNewRuleResource('');
+                        setNewRuleCategory('');
+                        setNewRuleDescription('');
+                        fetchAiData();
+                      } catch (_err) {
+                        showError('Failed to create rule');
+                      }
+                    }}
+                  >
+                    Create Rule
+                  </button>
+                  <button
+                    class="px-3 py-1.5 text-sm font-medium rounded bg-gray-200 dark:bg-gray-700 text-gray-700 dark:text-gray-300 hover:bg-gray-300 dark:hover:bg-gray-600 transition-colors"
+                    onClick={() => setShowAddRuleForm(false)}
+                  >
+                    Cancel
+                  </button>
+                </div>
+              </div>
+            </Show>
+
+            {/* Rules list */}
+            <Show when={showSuppressionRules()}>
+              <div class="mt-3 space-y-2">
+                <Show when={suppressionRules().length === 0}>
+                  <p class="text-sm text-gray-500 dark:text-gray-500 italic">
+                    No suppression rules. Dismiss findings or add rules to prevent unwanted alerts.
+                  </p>
+                </Show>
+                <For each={suppressionRules()}>
+                  {(rule) => (
+                    <div class="flex items-center justify-between p-3 bg-gray-50 dark:bg-gray-800/50 rounded-lg border border-gray-200 dark:border-gray-700">
+                      <div class="flex-1 min-w-0">
+                        <div class="flex items-center gap-2 text-sm">
+                          <span class="font-medium text-gray-800 dark:text-gray-200">
+                            {rule.resource_name || rule.resource_id || 'Any resource'}
+                          </span>
+                          <Show when={rule.category}>
+                            <span class="px-2 py-0.5 text-xs rounded-full bg-gray-200 dark:bg-gray-700 text-gray-600 dark:text-gray-400">
+                              {categoryLabels[rule.category!] || rule.category}
+                            </span>
+                          </Show>
+                          <Show when={!rule.category}>
+                            <span class="px-2 py-0.5 text-xs rounded-full bg-gray-200 dark:bg-gray-700 text-gray-600 dark:text-gray-400">
+                              Any category
+                            </span>
+                          </Show>
+                          <span class="px-1.5 py-0.5 text-xs rounded bg-purple-100 dark:bg-purple-900/30 text-purple-700 dark:text-purple-300">
+                            {rule.created_from === 'finding' ? 'From Finding' : 'Manual'}
+                          </span>
+                        </div>
+                        <p class="text-xs text-gray-500 dark:text-gray-500 mt-1 truncate">
+                          {rule.description || 'No description'}
+                        </p>
+                      </div>
+                      <button
+                        class="ml-3 px-2 py-1 text-xs text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/30 rounded transition-colors"
+                        onClick={async () => {
+                          try {
+                            await deleteSuppressionRule(rule.id);
+                            showSuccess('Rule deleted');
+                            fetchAiData();
+                          } catch (_err) {
+                            showError('Failed to delete rule');
+                          }
+                        }}
+                        title="Delete this rule"
+                      >
+                        Delete
+                      </button>
+                    </div>
+                  )}
+                </For>
+              </div>
+            </Show>
+          </div>
+
+          {/* Patrol Check History */}
+          <div class="mt-6">
+            <div class="flex items-center justify-between">
+              <button
+                class="flex items-center gap-2 text-sm font-medium text-gray-600 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-200 transition-colors"
+                onClick={() => setShowRunHistory(!showRunHistory())}
+              >
+                <svg
+                  class={`w-4 h-4 transition-transform ${showRunHistory() ? 'rotate-90' : ''}`}
+                  fill="none"
+                  stroke="currentColor"
+                  viewBox="0 0 24 24"
+                >
+                  <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
+                </svg>
+                Patrol Check History ({filteredPatrolHistory().length} runs)
+                <Show when={patrolRunHistory().length > 0 && patrolRunHistory()[0].status !== 'healthy'}>
+                  <span class="ml-1 px-1.5 py-0.5 text-[10px] bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300 rounded">Issues Found</span>
+                </Show>
+              </button>
+
+              {/* Next Patrol Timer */}
+              <Show when={nextPatrolIn()}>
+                <span class="text-xs text-gray-500 dark:text-gray-400">
+                  Next patrol in <span class="font-mono font-medium text-purple-600 dark:text-purple-400">{nextPatrolIn()}</span>
+                </span>
+              </Show>
+            </div>
+
+            <Show when={showRunHistory()}>
+              <div class="mt-3">
+                {/* Time Filter + Mini Health Chart */}
+                <div class="flex flex-wrap items-center gap-3 mb-3">
+                  <div class="flex gap-1">
+                    <button
+                      class={`px-2 py-1 text-xs rounded transition-colors ${historyTimeFilter() === '24h' ? 'bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300' : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-600'}`}
+                      onClick={() => setHistoryTimeFilter('24h')}
+                    >
+                      24h
+                    </button>
+                    <button
+                      class={`px-2 py-1 text-xs rounded transition-colors ${historyTimeFilter() === '7d' ? 'bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300' : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-600'}`}
+                      onClick={() => setHistoryTimeFilter('7d')}
+                    >
+                      7d
+                    </button>
+                    <button
+                      class={`px-2 py-1 text-xs rounded transition-colors ${historyTimeFilter() === 'all' ? 'bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300' : 'bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-400 hover:bg-gray-200 dark:hover:bg-gray-600'}`}
+                      onClick={() => setHistoryTimeFilter('all')}
+                    >
+                      All
+                    </button>
+                  </div>
+
+                  {/* Mini Health Chart */}
+                  <Show when={filteredPatrolHistory().length > 0}>
+                    <div class="flex items-center gap-0.5 h-4">
+                      <For each={filteredPatrolHistory().slice(0, 20).reverse()}>
+                        {(run) => (
+                          <div
+                            class={`w-1.5 h-full rounded-sm transition-all hover:opacity-75 ${run.status === 'healthy' ? 'bg-green-400 dark:bg-green-500' :
+                              run.status === 'critical' || run.status === 'error' ? 'bg-red-400 dark:bg-red-500' :
+                                'bg-yellow-400 dark:bg-yellow-500'
+                              }`}
+                            title={`${formatTimestamp(run.completed_at)}: ${run.findings_summary}`}
+                          />
+                        )}
+                      </For>
+                      <span class="ml-1.5 text-[10px] text-gray-400">← newest</span>
+                    </div>
+                  </Show>
+                </div>
+
+                <Show
+                  when={filteredPatrolHistory().length > 0}
+                  fallback={
+                    <p class="text-sm text-gray-500 dark:text-gray-400 italic py-4">No patrol runs in selected time range.</p>
+                  }
+                >
+                  <div class="border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
+                    <table class="w-full text-xs sm:text-sm">
+                      <thead>
+                        <tr class="bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-300 border-b border-gray-300 dark:border-gray-600">
+                          <th class="p-1.5 px-2 text-left text-[10px] sm:text-xs font-medium uppercase tracking-wider w-4"></th>
+                          <th class="p-1.5 px-2 text-left text-[10px] sm:text-xs font-medium uppercase tracking-wider">Time</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">Type</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">Status</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">Resources</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">New</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">Resolved</th>
+                          <th class="p-1.5 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">Duration</th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        {/* Show "Currently Running" row when patrol is in progress */}
+                        <Show when={patrolStatus()?.running}>
+                          <tr
+                            class="border-b border-gray-200 dark:border-gray-600 bg-purple-50 dark:bg-purple-900/20 cursor-pointer hover:bg-purple-100 dark:hover:bg-purple-900/30"
+                            onClick={() => setExpandedLiveStream(!expandedLiveStream())}
+                          >
+                            <td class="p-1.5 px-2 text-purple-500">
+                              <svg class={`w-3 h-3 transition-transform ${expandedLiveStream() ? 'rotate-90' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
+                              </svg>
+                            </td>
+                            <td class="p-1.5 px-2 text-purple-600 dark:text-purple-400 font-mono whitespace-nowrap">
+                              <div class="flex items-center gap-1.5">
+                                <svg class="w-3 h-3 animate-spin" viewBox="0 0 24 24" fill="none">
+                                  <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                  <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                                </svg>
+                                Now
+                              </div>
+                            </td>
+                            <td class="p-1.5 px-2 text-center">
+                              <span class="text-[10px] px-1.5 py-0.5 rounded font-medium bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300">
+                                Running
+                              </span>
+                            </td>
+                            <td class="p-1.5 px-2 text-center" colspan="5">
+                              <span class="text-xs text-purple-600 dark:text-purple-400">
+                                {expandedLiveStream() ? 'Click to collapse' : 'Click to view live AI analysis'}
+                              </span>
+                            </td>
+                          </tr>
+                          {/* Expanded Live Stream Row */}
+                          <Show when={expandedLiveStream()}>
+                            <tr class="bg-purple-50 dark:bg-purple-900/10 border-b border-gray-200 dark:border-gray-600">
+                              <td colspan="8" class="p-3">
+                                <div class="flex items-center justify-between mb-3">
+                                  <span class="text-[10px] text-purple-500 dark:text-purple-400 uppercase tracking-wider flex items-center gap-1.5">
+                                    <svg class="w-3 h-3 animate-pulse" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z" />
+                                    </svg>
+                                    Live AI Analysis
+                                  </span>
+                                  <span class="text-[9px] text-purple-400 dark:text-purple-500">
+                                    Streaming in real-time...
+                                  </span>
+                                </div>
+                                {/* Sequential blocks display - like AI chat */}
+                                <div class="space-y-2 max-h-80 overflow-y-auto">
+                                  {/* Rendered blocks */}
+                                  <For each={liveStreamBlocks()}>
+                                    {(block) => (
+                                      <Show
+                                        when={block.type === 'phase'}
+                                        fallback={
+                                          /* Thinking block */
+                                          <div class="px-3 py-2 text-xs bg-blue-50 dark:bg-blue-900/20 text-gray-700 dark:text-gray-300 rounded-lg border-l-2 border-blue-400 whitespace-pre-wrap font-mono leading-relaxed">
+                                            {block.text.length > 800 ? block.text.substring(0, 800) + '...' : block.text}
+                                          </div>
+                                        }
+                                      >
+                                        {/* Phase marker */}
+                                        <div class="flex items-center gap-2 px-2 py-1">
+                                          <Show
+                                            when={block.text === 'Analysis complete'}
+                                            fallback={
+                                              <svg class="w-3 h-3 animate-spin text-purple-500" viewBox="0 0 24 24" fill="none">
+                                                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                                <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                                              </svg>
+                                            }
+                                          >
+                                            <svg class="w-3 h-3 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
+                                            </svg>
+                                          </Show>
+                                          <span class="text-[10px] font-medium text-purple-600 dark:text-purple-400">
+                                            {block.text}
+                                          </span>
+                                        </div>
+                                      </Show>
+                                    )}
+                                  </For>
+                                  {/* Currently streaming content */}
+                                  <Show when={currentThinking()}>
+                                    <div class="px-3 py-2 text-xs bg-blue-50 dark:bg-blue-900/20 text-gray-700 dark:text-gray-300 rounded-lg border-l-2 border-blue-400 whitespace-pre-wrap font-mono leading-relaxed">
+                                      {currentThinking().length > 500 ? currentThinking().substring(0, 500) + '...' : currentThinking()}
+                                      <span class="inline-block w-1.5 h-3 bg-blue-500 ml-0.5 animate-pulse" />
+                                    </div>
+                                  </Show>
+                                  {/* Empty state */}
+                                  <Show when={liveStreamBlocks().length === 0 && !currentThinking()}>
+                                    <div class="flex items-center gap-2 px-2 py-3 text-xs text-gray-500 dark:text-gray-400">
+                                      <svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" fill="none">
+                                        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                        <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                                      </svg>
+                                      <span class="italic">Waiting for AI response...</span>
+                                    </div>
+                                  </Show>
+                                </div>
+                              </td>
+                            </tr>
+                          </Show>
+                        </Show>
+                        <For each={filteredPatrolHistory()}>
+                          {(run) => {
+                            const statusStyles = {
+                              healthy: 'bg-green-100 dark:bg-green-900/50 text-green-700 dark:text-green-300',
+                              issues_found: 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300',
+                              critical: 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300',
+                              error: 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300',
+                            };
+                            const statusStyle = statusStyles[run.status] || statusStyles.healthy;
+                            const hasDetails = run.nodes_checked > 0 || run.guests_checked > 0 || run.docker_checked > 0 || run.storage_checked > 0 || run.ai_analysis;
+
+                            return (
+                              <>
+                                <tr
+                                  class={`border-b border-gray-200 dark:border-gray-600 hover:bg-gray-50 dark:hover:bg-gray-700/50 ${hasDetails ? 'cursor-pointer' : ''}`}
+                                  onClick={() => hasDetails && setExpandedRunId(expandedRunId() === run.id ? null : run.id)}
+                                >
+                                  <td class="p-1.5 px-2 text-gray-400">
+                                    <Show when={hasDetails}>
+                                      <svg class={`w-3 h-3 transition-transform ${expandedRunId() === run.id ? 'rotate-90' : ''}`} fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
+                                      </svg>
+                                    </Show>
+                                  </td>
+                                  <td class="p-1.5 px-2 text-gray-600 dark:text-gray-400 font-mono whitespace-nowrap">
+                                    {formatTimestamp(run.completed_at)}
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center">
+                                    <span class={`text-[10px] px-1.5 py-0.5 rounded font-medium ${run.type === 'deep'
+                                      ? 'bg-violet-100 dark:bg-violet-900/50 text-violet-700 dark:text-violet-300'
+                                      : 'bg-sky-100 dark:bg-sky-900/50 text-sky-700 dark:text-sky-300'
+                                      }`}>
+                                      {run.type === 'deep' ? 'Deep' : 'Quick'}
+                                    </span>
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center">
+                                    <span class={`text-[10px] px-1.5 py-0.5 rounded font-medium ${statusStyle}`}>
+                                      {run.findings_summary}
+                                    </span>
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center text-gray-700 dark:text-gray-300">
+                                    {run.resources_checked}
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center">
+                                    <Show when={run.new_findings > 0} fallback={<span class="text-gray-400">-</span>}>
+                                      <span class="text-yellow-600 dark:text-yellow-400 font-medium">{run.new_findings}</span>
+                                    </Show>
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center">
+                                    <Show when={run.resolved_findings > 0} fallback={<span class="text-gray-400">-</span>}>
+                                      <span class="text-green-600 dark:text-green-400 font-medium">{run.resolved_findings}</span>
+                                    </Show>
+                                  </td>
+                                  <td class="p-1.5 px-2 text-center text-gray-500 dark:text-gray-400 font-mono">
+                                    {(() => {
+                                      const totalSeconds = Math.round(run.duration_ms / 1000000000);
+                                      if (totalSeconds < 60) {
+                                        return `${totalSeconds}s`;
+                                      }
+                                      const minutes = Math.floor(totalSeconds / 60);
+                                      const seconds = totalSeconds % 60;
+                                      return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
+                                    })()}
+                                  </td>
+                                </tr>
+                                {/* Expanded Details Row */}
+                                <Show when={expandedRunId() === run.id}>
+                                  <tr class="bg-gray-50 dark:bg-gray-800/50">
+                                    <td colspan="8" class="p-3">
+                                      <div class="grid grid-cols-2 sm:grid-cols-4 gap-3 text-xs">
+                                        <Show when={run.nodes_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300 rounded text-[10px]">Nodes</span>
+                                            <span class="font-medium">{run.nodes_checked}</span>
+                                          </div>
+                                        </Show>
+                                        <Show when={run.guests_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300 rounded text-[10px]">VMs/CTs</span>
+                                            <span class="font-medium">{run.guests_checked}</span>
+                                          </div>
+                                        </Show>
+                                        <Show when={run.docker_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-cyan-100 dark:bg-cyan-900/50 text-cyan-700 dark:text-cyan-300 rounded text-[10px]">Docker</span>
+                                            <span class="font-medium">{run.docker_checked}</span>
+                                          </div>
+                                        </Show>
+                                        <Show when={run.storage_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-orange-100 dark:bg-orange-900/50 text-orange-700 dark:text-orange-300 rounded text-[10px]">Storage</span>
+                                            <span class="font-medium">{run.storage_checked}</span>
+                                          </div>
+                                        </Show>
+                                        <Show when={run.hosts_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-teal-100 dark:bg-teal-900/50 text-teal-700 dark:text-teal-300 rounded text-[10px]">Hosts</span>
+                                            <span class="font-medium">{run.hosts_checked}</span>
+                                          </div>
+                                        </Show>
+                                        <Show when={run.pbs_checked > 0}>
+                                          <div class="flex items-center gap-2">
+                                            <span class="px-1.5 py-0.5 bg-amber-100 dark:bg-amber-900/50 text-amber-700 dark:text-amber-300 rounded text-[10px]">PBS</span>
+                                            <span class="font-medium">{run.pbs_checked}</span>
+                                          </div>
+                                        </Show>
+                                      </div>
+                                      {/* Only show findings section if we have active findings to display */}
+                                      {(() => {
+                                        const activeFindings = (run.finding_ids || [])
+                                          .map(id => aiFindings().find(f => f.id === id))
+                                          .filter(f => f !== undefined);
+                                        const resolvedCount = (run.finding_ids?.length || 0) - activeFindings.length;
+
+                                        if (activeFindings.length === 0 && resolvedCount === 0) return null;
+
+                                        return (
+                                          <div class="mt-2 pt-2 border-t border-gray-200 dark:border-gray-700">
+                                            <span class="text-[10px] text-gray-500 dark:text-gray-400 uppercase tracking-wider">
+                                              Findings from this run:
+                                            </span>
+                                            <div class="flex flex-col gap-1 mt-1">
+                                              <For each={activeFindings}>
+                                                {(finding) => (
+                                                  <div class="flex items-center gap-2 text-xs">
+                                                    <span class={`px-1.5 py-0.5 rounded text-[10px] ${finding!.severity === 'critical' ? 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300' :
+                                                      finding!.severity === 'warning' ? 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300' :
+                                                        'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300'
+                                                      }`}>
+                                                      {finding!.severity}
+                                                    </span>
+                                                    <span class="font-medium text-gray-700 dark:text-gray-300">{finding!.title}</span>
+                                                    <span class="text-gray-500 dark:text-gray-400">on {finding!.resource_name}</span>
+                                                  </div>
+                                                )}
+                                              </For>
+                                              <Show when={resolvedCount > 0}>
+                                                <div class="flex items-center gap-1.5 text-xs text-green-600 dark:text-green-400">
+                                                  <svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
+                                                  </svg>
+                                                  {resolvedCount} finding{resolvedCount > 1 ? 's' : ''} since resolved
+                                                </div>
+                                              </Show>
+                                            </div>
+                                          </div>
+                                        );
+                                      })()}
+                                      {/* AI Analysis Section */}
+                                      <Show when={run.ai_analysis}>
+                                        <div class="mt-3 pt-3 border-t border-gray-200 dark:border-gray-700">
+                                          <div class="flex items-center justify-between mb-2">
+                                            <span class="text-[10px] text-gray-500 dark:text-gray-400 uppercase tracking-wider flex items-center gap-1.5">
+                                              <svg class="w-3 h-3 text-purple-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z" />
+                                              </svg>
+                                              AI Analysis
+                                            </span>
+                                            <Show when={run.input_tokens || run.output_tokens}>
+                                              <span class="text-[9px] text-gray-400 dark:text-gray-500">
+                                                {run.input_tokens?.toLocaleString()} in / {run.output_tokens?.toLocaleString()} out tokens
+                                              </span>
+                                            </Show>
+                                          </div>
+                                          <div class="bg-gray-100 dark:bg-gray-900 rounded-lg p-3 max-h-64 overflow-y-auto">
+                                            <pre class="text-xs text-gray-700 dark:text-gray-300 whitespace-pre-wrap font-mono leading-relaxed">{run.ai_analysis}</pre>
+                                          </div>
+                                        </div>
+                                      </Show>
+                                    </td>
+                                  </tr>
+                                </Show>
+                              </>
+                            );
+                          }}
+                        </For>
+                      </tbody>
+                    </table>
+                  </div>
+                </Show>
+              </div>
+            </Show>
+          </div>
+        </div>
+      </Show >
+
+      {/* Active Alerts - show when alerts tab selected OR when patrol is disabled (no sub-tabs) */}
+      < Show when={overviewSubTab() === 'active-alerts' || !patrolStatus()?.enabled
+      }>
+        <div>
+          <SectionHeader title="Active Alerts" size="md" class="mb-3" />
+          <Show
+            when={Object.keys(props.activeAlerts).length > 0}
+            fallback={
+              <div class="text-center py-8 text-gray-500 dark:text-gray-400">
+                <div class="flex justify-center mb-3">
+                  <svg class="w-12 h-12 text-green-500 dark:text-green-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <circle cx="12" cy="12" r="10" stroke="currentColor" stroke-width="2" fill="none" />
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4" />
+                  </svg>
+                </div>
+                <p class="text-sm">No active alerts</p>
+                <p class="text-xs mt-1">Alerts will appear here when thresholds are exceeded</p>
+              </div>
+            }
+          >
+            <Show when={alertStats().acknowledged > 0 || alertStats().active > 0}>
+              <div class="flex flex-wrap items-center justify-between gap-2 p-2 bg-gray-50 dark:bg-gray-800 rounded-t-lg border border-gray-200 dark:border-gray-700">
+                <Show when={alertStats().acknowledged > 0}>
+                  <button
+                    onClick={() => props.setShowAcknowledged(!props.showAcknowledged())}
+                    class="text-xs text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200 transition-colors"
+                  >
+                    {props.showAcknowledged() ? 'Hide' : 'Show'} acknowledged
+                  </button>
+                </Show>
+                <Show when={alertStats().active > 0}>
+                  <button
+                    type="button"
+                    class="inline-flex items-center gap-1 px-3 py-1.5 text-xs font-medium rounded-lg border border-blue-200 dark:border-blue-700 bg-blue-50 dark:bg-blue-900/40 text-blue-700 dark:text-blue-200 transition-colors hover:bg-blue-100 dark:hover:bg-blue-900/60 disabled:opacity-60 disabled:cursor-not-allowed"
+                    disabled={bulkAckProcessing()}
+                    onClick={async () => {
+                      if (bulkAckProcessing()) return;
+                      const pending = unacknowledgedAlerts();
+                      if (pending.length === 0) {
+                        return;
+                      }
+                      setBulkAckProcessing(true);
+                      try {
+                        const result = await AlertsAPI.bulkAcknowledge(pending.map((alert) => alert.id));
+                        const successes = result.results.filter((r) => r.success);
+                        const failures = result.results.filter((r) => !r.success);
+
+                        successes.forEach((res) => {
+                          props.updateAlert(res.alertId, {
+                            acknowledged: true,
+                            ackTime: new Date().toISOString(),
+                          });
+                        });
+
+                        if (successes.length > 0) {
+                          showSuccess(
+                            `Acknowledged ${successes.length} ${successes.length === 1 ? 'alert' : 'alerts'}.`,
+                          );
+                        }
+
+                        if (failures.length > 0) {
+                          showError(
+                            `Failed to acknowledge ${failures.length} ${failures.length === 1 ? 'alert' : 'alerts'}.`,
+                          );
+                        }
+                      } catch (error) {
+                        logger.error('Bulk acknowledge failed', error);
+                        showError('Failed to acknowledge alerts');
+                      } finally {
+                        setBulkAckProcessing(false);
+                      }
+                    }}
+                  >
+                    {bulkAckProcessing()
+                      ? 'Acknowledging…'
+                      : `Acknowledge all (${alertStats().active})`}
+                  </button>
+                </Show>
+              </div>
+            </Show>
+            <div class="space-y-2">
+              <Show when={filteredAlerts().length === 0}>
+                <div class="text-center py-8 text-gray-500 dark:text-gray-400">
+                  {props.showAcknowledged() ? 'No active alerts' : 'No unacknowledged alerts'}
+                </div>
+              </Show>
+              <For each={filteredAlerts()}>
+                {(alert) => (
+                  <div
+                    class={`border rounded-lg p-4 transition-all ${processingAlerts().has(alert.id) ? 'opacity-50' : ''
+                      } ${alert.acknowledged
+                        ? 'opacity-60 border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-900/20'
+                        : alert.level === 'critical'
+                          ? 'border-red-300 dark:border-red-800 bg-red-50 dark:bg-red-900/20'
+                          : 'border-yellow-300 dark:border-yellow-800 bg-yellow-50 dark:bg-yellow-900/20'
+                      }`}
+                  >
+                    <div class="flex flex-col sm:flex-row sm:items-start">
+                      <div class="flex items-start flex-1">
+                        {/* Status icon */}
+                        <div
+                          class={`mr-3 mt-0.5 transition-all ${alert.acknowledged
                             ? 'text-green-600 dark:text-green-400'
                             : alert.level === 'critical'
                               ? 'text-red-600 dark:text-red-400'
                               : 'text-yellow-600 dark:text-yellow-400'
-                        }`}
-                      >
-                        {alert.acknowledged ? (
-                          // Checkmark for acknowledged
-                          <svg
-                            class="w-5 h-5"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"
-                            />
-                          </svg>
-                        ) : (
-                          // Warning/Alert icon
-                          <svg
-                            class="w-5 h-5"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                            />
-                          </svg>
-                        )}
-                      </div>
-                      <div class="flex-1 min-w-0">
-                        <div class="flex flex-wrap items-center gap-2">
-                          <span
-                            class={`text-sm font-medium truncate ${
-                              alert.level === 'critical'
+                            }`}
+                        >
+                          {alert.acknowledged ? (
+                            // Checkmark for acknowledged
+                            <svg
+                              class="w-5 h-5"
+                              fill="none"
+                              stroke="currentColor"
+                              viewBox="0 0 24 24"
+                            >
+                              <path
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z"
+                              />
+                            </svg>
+                          ) : (
+                            // Warning/Alert icon
+                            <svg
+                              class="w-5 h-5"
+                              fill="none"
+                              stroke="currentColor"
+                              viewBox="0 0 24 24"
+                            >
+                              <path
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                              />
+                            </svg>
+                          )}
+                        </div>
+                        <div class="flex-1 min-w-0">
+                          <div class="flex flex-wrap items-center gap-2">
+                            <span
+                              class={`text-sm font-medium truncate ${alert.level === 'critical'
                                 ? 'text-red-700 dark:text-red-400'
                                 : 'text-yellow-700 dark:text-yellow-400'
-                            }`}
-                          >
-                            {alert.resourceName}
-                          </span>
-                          <span class="text-xs text-gray-600 dark:text-gray-400">
-                            ({alert.type})
-                          </span>
-                          <Show when={alert.node}>
-                            <span class="text-xs text-gray-500 dark:text-gray-500">
-                              on {alert.node}
+                                }`}
+                            >
+                              {alert.resourceName}
                             </span>
-                          </Show>
-                          <Show when={alert.acknowledged}>
-                            <span class="px-2 py-0.5 text-xs bg-yellow-200 dark:bg-yellow-800 text-yellow-800 dark:text-yellow-200 rounded">
-                              Acknowledged
+                            <span class="text-xs text-gray-600 dark:text-gray-400">
+                              ({alert.type})
                             </span>
-                          </Show>
+                            <Show when={alert.node}>
+                              <span class="text-xs text-gray-500 dark:text-gray-500">
+                                on {alert.node}
+                              </span>
+                            </Show>
+                            <Show when={alert.acknowledged}>
+                              <span class="px-2 py-0.5 text-xs bg-yellow-200 dark:bg-yellow-800 text-yellow-800 dark:text-yellow-200 rounded">
+                                Acknowledged
+                              </span>
+                            </Show>
+                          </div>
+                          <p class="text-sm text-gray-700 dark:text-gray-300 mt-1 break-words">
+                            {alert.message}
+                          </p>
+                          <p class="text-xs text-gray-600 dark:text-gray-400 mt-1">
+                            Started: {new Date(alert.startTime).toLocaleString()}
+                          </p>
                         </div>
-                        <p class="text-sm text-gray-700 dark:text-gray-300 mt-1 break-words">
-                          {alert.message}
-                        </p>
-                        <p class="text-xs text-gray-600 dark:text-gray-400 mt-1">
-                          Started: {new Date(alert.startTime).toLocaleString()}
-                        </p>
                       </div>
-                    </div>
-                    <div class="flex gap-2 mt-3 sm:mt-0 sm:ml-4 self-end sm:self-start">
-                      <button
-                        class={`px-3 py-1.5 text-xs font-medium border rounded-lg transition-all disabled:opacity-50 disabled:cursor-not-allowed ${
-                          alert.acknowledged
+                      <div class="flex gap-2 mt-3 sm:mt-0 sm:ml-4 self-end sm:self-start">
+                        <button
+                          class={`px-3 py-1.5 text-xs font-medium border rounded-lg transition-all disabled:opacity-50 disabled:cursor-not-allowed ${alert.acknowledged
                             ? 'bg-white dark:bg-gray-700 text-gray-700 dark:text-gray-300 border-gray-300 dark:border-gray-600 hover:bg-gray-50 dark:hover:bg-gray-600'
                             : 'bg-white dark:bg-gray-700 text-yellow-700 dark:text-yellow-300 border-yellow-300 dark:border-yellow-700 hover:bg-yellow-50 dark:hover:bg-yellow-900/20'
-                        }`}
-                        disabled={processingAlerts().has(alert.id)}
-                        onClick={async (e) => {
-                          e.preventDefault();
-                          e.stopPropagation();
+                            }`}
+                          disabled={processingAlerts().has(alert.id)}
+                          onClick={async (e) => {
+                            e.preventDefault();
+                            e.stopPropagation();
 
-                          // Prevent double-clicks
-                          if (processingAlerts().has(alert.id)) return;
+                            // Prevent double-clicks
+                            if (processingAlerts().has(alert.id)) return;
 
-                          setProcessingAlerts((prev) => new Set(prev).add(alert.id));
+                            setProcessingAlerts((prev) => new Set(prev).add(alert.id));
 
-                          // Store current state to avoid race conditions
-                          const wasAcknowledged = alert.acknowledged;
+                            // Store current state to avoid race conditions
+                            const wasAcknowledged = alert.acknowledged;
 
-                          try {
-                            if (wasAcknowledged) {
-                              // Call API first, only update local state if successful
-                              await AlertsAPI.unacknowledge(alert.id);
-                              // Only update local state after successful API call
-                              props.updateAlert(alert.id, {
-                                acknowledged: false,
-                                ackTime: undefined,
-                                ackUser: undefined,
-                              });
-                              showSuccess('Alert restored');
-                            } else {
-                              // Call API first, only update local state if successful
-                              await AlertsAPI.acknowledge(alert.id);
-                              // Only update local state after successful API call
-                              props.updateAlert(alert.id, {
-                                acknowledged: true,
-                                ackTime: new Date().toISOString(),
-                              });
-                              showSuccess('Alert acknowledged');
+                            try {
+                              if (wasAcknowledged) {
+                                // Call API first, only update local state if successful
+                                await AlertsAPI.unacknowledge(alert.id);
+                                // Only update local state after successful API call
+                                props.updateAlert(alert.id, {
+                                  acknowledged: false,
+                                  ackTime: undefined,
+                                  ackUser: undefined,
+                                });
+                                showSuccess('Alert restored');
+                              } else {
+                                // Call API first, only update local state if successful
+                                await AlertsAPI.acknowledge(alert.id);
+                                // Only update local state after successful API call
+                                props.updateAlert(alert.id, {
+                                  acknowledged: true,
+                                  ackTime: new Date().toISOString(),
+                                });
+                                showSuccess('Alert acknowledged');
+                              }
+                            } catch (err) {
+                              logger.error(
+                                `Failed to ${wasAcknowledged ? 'unacknowledge' : 'acknowledge'} alert:`,
+                                err,
+                              );
+                              showError(
+                                `Failed to ${wasAcknowledged ? 'restore' : 'acknowledge'} alert`,
+                              );
+                              // Don't update local state on error - let WebSocket keep the correct state
+                            } finally {
+                              // Keep button disabled for longer to prevent race conditions with WebSocket updates
+                              setTimeout(() => {
+                                setProcessingAlerts((prev) => {
+                                  const next = new Set(prev);
+                                  next.delete(alert.id);
+                                  return next;
+                                });
+                              }, 1500); // 1.5 seconds to allow server to process and WebSocket to sync
                             }
-                          } catch (err) {
-                            logger.error(
-                              `Failed to ${wasAcknowledged ? 'unacknowledge' : 'acknowledge'} alert:`,
-                              err,
-                            );
-                            showError(
-                              `Failed to ${wasAcknowledged ? 'restore' : 'acknowledge'} alert`,
-                            );
-                            // Don't update local state on error - let WebSocket keep the correct state
-                          } finally {
-                            // Keep button disabled for longer to prevent race conditions with WebSocket updates
-                            setTimeout(() => {
-                              setProcessingAlerts((prev) => {
-                                const next = new Set(prev);
-                                next.delete(alert.id);
-                                return next;
-                              });
-                            }, 1500); // 1.5 seconds to allow server to process and WebSocket to sync
-                          }
-                        }}
-                      >
-                        {processingAlerts().has(alert.id)
-                          ? 'Processing...'
-                          : alert.acknowledged
-                            ? 'Unacknowledge'
-                            : 'Acknowledge'}
-                      </button>
+                          }}
+                        >
+                          {processingAlerts().has(alert.id)
+                            ? 'Processing...'
+                            : alert.acknowledged
+                              ? 'Unacknowledge'
+                              : 'Acknowledge'}
+                        </button>
+                        <InvestigateAlertButton
+                          alert={alert}
+                          variant="text"
+                          size="sm"
+                        />
+                      </div>
                     </div>
                   </div>
-                </div>
-              )}
-            </For>
-          </div>
-        </Show>
-      </div>
-    </div>
+                )}
+              </For>
+            </div>
+          </Show>
+        </div>
+      </Show >
+    </div >
   );
 }
 
@@ -2452,37 +3600,37 @@ interface ThresholdsTabProps {
   setDockerDefaults: (
     value:
       | {
-          cpu: number;
-          memory: number;
-          disk: number;
-          restartCount: number;
-          restartWindow: number;
-          memoryWarnPct: number;
-          memoryCriticalPct: number;
-          serviceWarnGapPercent: number;
-          serviceCriticalGapPercent: number;
-        }
+        cpu: number;
+        memory: number;
+        disk: number;
+        restartCount: number;
+        restartWindow: number;
+        memoryWarnPct: number;
+        memoryCriticalPct: number;
+        serviceWarnGapPercent: number;
+        serviceCriticalGapPercent: number;
+      }
       | ((prev: {
-          cpu: number;
-          memory: number;
-          disk: number;
-          restartCount: number;
-          restartWindow: number;
-          memoryWarnPct: number;
-          memoryCriticalPct: number;
-          serviceWarnGapPercent: number;
-          serviceCriticalGapPercent: number;
-        }) => {
-          cpu: number;
-          memory: number;
-          disk: number;
-          restartCount: number;
-          restartWindow: number;
-          memoryWarnPct: number;
-          memoryCriticalPct: number;
-          serviceWarnGapPercent: number;
-          serviceCriticalGapPercent: number;
-        }),
+        cpu: number;
+        memory: number;
+        disk: number;
+        restartCount: number;
+        restartWindow: number;
+        memoryWarnPct: number;
+        memoryCriticalPct: number;
+        serviceWarnGapPercent: number;
+        serviceCriticalGapPercent: number;
+      }) => {
+        cpu: number;
+        memory: number;
+        disk: number;
+        restartCount: number;
+        restartWindow: number;
+        memoryWarnPct: number;
+        memoryCriticalPct: number;
+        serviceWarnGapPercent: number;
+        serviceCriticalGapPercent: number;
+      }),
   ) => void;
   setDockerDisableConnectivity: (value: boolean) => void;
   setDockerPoweredOffSeverity: (value: 'warning' | 'critical') => void;
@@ -3177,22 +4325,22 @@ function ScheduleTab(props: ScheduleTabProps) {
     label: string;
     description: string;
   }> = [
-    {
-      key: 'performance',
-      label: 'Performance alerts',
-      description: 'CPU, memory, disk, and network thresholds stay quiet.',
-    },
-    {
-      key: 'storage',
-      label: 'Storage alerts',
-      description: 'Silence storage usage, disk health, and ZFS events.',
-    },
-    {
-      key: 'offline',
-      label: 'Offline & power state',
-      description: 'Skip connectivity and powered-off alerts during backups.',
-    },
-  ];
+      {
+        key: 'performance',
+        label: 'Performance alerts',
+        description: 'CPU, memory, disk, and network thresholds stay quiet.',
+      },
+      {
+        key: 'storage',
+        label: 'Storage alerts',
+        description: 'Silence storage usage, disk health, and ZFS events.',
+      },
+      {
+        key: 'offline',
+        label: 'Offline & power state',
+        description: 'Skip connectivity and powered-off alerts during backups.',
+      },
+    ];
 
   const days = [
     { id: 'monday', label: 'M', fullLabel: 'Monday' },
@@ -3322,11 +4470,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                           props.setHasUnsavedChanges(true);
                         }}
                         title={day.fullLabel}
-                        class={`px-2 py-2 text-xs font-medium transition-all duration-200 ${
-                          quietHours().days[day.id]
-                            ? 'rounded-md bg-blue-500 text-white shadow-sm'
-                            : 'rounded-md bg-gray-100 text-gray-600 hover:bg-gray-200 dark:bg-gray-700 dark:text-gray-400 dark:hover:bg-gray-600'
-                        }`}
+                        class={`px-2 py-2 text-xs font-medium transition-all duration-200 ${quietHours().days[day.id]
+                          ? 'rounded-md bg-blue-500 text-white shadow-sm'
+                          : 'rounded-md bg-gray-100 text-gray-600 hover:bg-gray-200 dark:bg-gray-700 dark:text-gray-400 dark:hover:bg-gray-600'
+                          }`}
                       >
                         {day.label}
                       </button>
@@ -3374,11 +4521,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                   <For each={quietHourSuppressOptions}>
                     {(option) => (
                       <label
-                        class={`flex cursor-pointer items-start gap-3 rounded-lg border px-3 py-2 transition-colors ${
-                          quietHours().suppress[option.key]
-                            ? 'border-blue-500 bg-blue-50 dark:border-blue-400 dark:bg-blue-500/10'
-                            : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
-                        }`}
+                        class={`flex cursor-pointer items-start gap-3 rounded-lg border px-3 py-2 transition-colors ${quietHours().suppress[option.key]
+                          ? 'border-blue-500 bg-blue-50 dark:border-blue-400 dark:bg-blue-500/10'
+                          : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
+                          }`}
                       >
                         <input
                           type="checkbox"
@@ -3396,11 +4542,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                           class="sr-only"
                         />
                         <div
-                          class={`mt-1 flex h-4 w-4 items-center justify-center rounded border-2 ${
-                            quietHours().suppress[option.key]
-                              ? 'border-blue-500 bg-blue-500'
-                              : 'border-gray-300 dark:border-gray-600'
-                          }`}
+                          class={`mt-1 flex h-4 w-4 items-center justify-center rounded border-2 ${quietHours().suppress[option.key]
+                            ? 'border-blue-500 bg-blue-500'
+                            : 'border-gray-300 dark:border-gray-600'
+                            }`}
                         >
                           <Show when={quietHours().suppress[option.key]}>
                             <svg
@@ -3579,11 +4724,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                 </span>
                 <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
                   <label
-                    class={`relative flex items-center gap-2 rounded-lg border-2 p-3 transition-all ${
-                      grouping().byNode
-                        ? 'border-blue-500 bg-blue-50 shadow-sm dark:bg-blue-900/20'
-                        : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
-                    }`}
+                    class={`relative flex items-center gap-2 rounded-lg border-2 p-3 transition-all ${grouping().byNode
+                      ? 'border-blue-500 bg-blue-50 shadow-sm dark:bg-blue-900/20'
+                      : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
+                      }`}
                   >
                     <input
                       type="checkbox"
@@ -3595,11 +4739,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                       class="sr-only"
                     />
                     <div
-                      class={`flex h-4 w-4 items-center justify-center rounded border-2 ${
-                        grouping().byNode
-                          ? 'border-blue-500 bg-blue-500'
-                          : 'border-gray-300 dark:border-gray-600'
-                      }`}
+                      class={`flex h-4 w-4 items-center justify-center rounded border-2 ${grouping().byNode
+                        ? 'border-blue-500 bg-blue-500'
+                        : 'border-gray-300 dark:border-gray-600'
+                        }`}
                     >
                       <Show when={grouping().byNode}>
                         <svg
@@ -3619,11 +4762,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                   </label>
 
                   <label
-                    class={`relative flex items-center gap-2 rounded-lg border-2 p-3 transition-all ${
-                      grouping().byGuest
-                        ? 'border-blue-500 bg-blue-50 shadow-sm dark:bg-blue-900/20'
-                        : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
-                    }`}
+                    class={`relative flex items-center gap-2 rounded-lg border-2 p-3 transition-all ${grouping().byGuest
+                      ? 'border-blue-500 bg-blue-50 shadow-sm dark:bg-blue-900/20'
+                      : 'border-gray-200 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700'
+                      }`}
                   >
                     <input
                       type="checkbox"
@@ -3635,11 +4777,10 @@ function ScheduleTab(props: ScheduleTabProps) {
                       class="sr-only"
                     />
                     <div
-                      class={`flex h-4 w-4 items-center justify-center rounded border-2 ${
-                        grouping().byGuest
-                          ? 'border-blue-500 bg-blue-500'
-                          : 'border-gray-300 dark:border-gray-600'
-                      }`}
+                      class={`flex h-4 w-4 items-center justify-center rounded border-2 ${grouping().byGuest
+                        ? 'border-blue-500 bg-blue-500'
+                        : 'border-gray-300 dark:border-gray-600'
+                        }`}
                     >
                       <Show when={grouping().byGuest}>
                         <svg
@@ -3909,8 +5050,16 @@ function HistoryTab() {
       deserialize: (raw) => (raw === 'warning' || raw === 'critical' ? raw : 'all'),
     },
   );
+  const [sourceFilter, setSourceFilter] = usePersistentSignal<'all' | 'alerts' | 'ai'>(
+    'alertHistorySourceFilter',
+    'all',
+    {
+      deserialize: (raw) => (raw === 'alerts' || raw === 'ai' ? raw : 'all'),
+    },
+  );
   const [searchTerm, setSearchTerm] = createSignal('');
   const [alertHistory, setAlertHistory] = createSignal<Alert[]>([]);
+  const [aiFindingsHistory, setAiFindingsHistory] = createSignal<Finding[]>([]);
   const [loading, setLoading] = createSignal(true);
   const [selectedBarIndex, setSelectedBarIndex] = createSignal<number | null>(null);
   const MS_PER_HOUR = 60 * 60 * 1000;
@@ -3947,18 +5096,27 @@ function HistoryTab() {
   };
 
   let fetchRequestId = 0;
-  const fetchAlertHistory = async (range: string) => {
+  const fetchHistory = async (range: string) => {
     const requestId = ++fetchRequestId;
     setLoading(true);
 
     try {
-      const history = await AlertsAPI.getHistory(buildHistoryParams(range));
+      // Fetch both alert history and AI findings history in parallel
+      const params = buildHistoryParams(range);
+      const startTimeStr = params.startTime;
+
+      const [alertHistoryData, aiFindingsData] = await Promise.all([
+        AlertsAPI.getHistory(params),
+        getFindingsHistory(startTimeStr),
+      ]);
+
       if (requestId === fetchRequestId) {
-        setAlertHistory(history);
+        setAlertHistory(alertHistoryData);
+        setAiFindingsHistory(aiFindingsData);
       }
     } catch (err) {
       if (requestId === fetchRequestId) {
-        logger.error('Failed to load alert history:', err);
+        logger.error('Failed to load history:', err);
       }
     } finally {
       if (requestId === fetchRequestId) {
@@ -3993,7 +5151,7 @@ function HistoryTab() {
 
   // Load alert history on mount
   onMount(() => {
-    fetchAlertHistory(timeFilter());
+    fetchHistory(timeFilter());
 
     // Add keyboard event listeners
     const handleKeydown = (e: KeyboardEvent) => {
@@ -4035,7 +5193,7 @@ function HistoryTab() {
       skipInitialFetchEffect = false;
       return;
     }
-    fetchAlertHistory(range);
+    fetchHistory(range);
   });
 
   // Format duration for display
@@ -4152,66 +5310,155 @@ function HistoryTab() {
     return 'Unknown';
   };
 
-  // Extended alert type for display
-  interface ExtendedAlert extends Alert {
-    status?: string;
-    duration?: string;
-    resourceType?: string;
+  // Unified history item type that can be either an alert or an AI finding
+  type HistoryItemSource = 'alert' | 'ai';
+  interface HistoryItem {
+    id: string;
+    source: HistoryItemSource;
+    status: string;
+    startTime: string;
+    endTime?: string;
+    duration: string;
+    resourceName: string;
+    resourceType: string;
+    resourceId?: string;
+    node?: string;
+    severity: string; // warning, critical for alerts; severity for findings
+    // Aliases for backward compat with existing rendering code
+    level: string; // same as severity
+    type: string; // same as title
+    message?: string; // same as description
+    title: string;
+    description?: string;
+    acknowledged?: boolean;
+    autoResolved?: boolean;
   }
 
-  // Prepare all alerts without filtering
-  const allAlertsData = createMemo(() => {
-    // Combine active and historical alerts
-    const allAlerts: ExtendedAlert[] = [];
+  // Prepare all history items (alerts + AI findings) based on source filter
+  const allHistoryData = createMemo(() => {
+    const items: HistoryItem[] = [];
+    const currentSource = sourceFilter();
 
-    // Add active alerts
-    Object.values(activeAlerts || {}).forEach((alert) => {
-      allAlerts.push({
-        ...alert,
-        status: 'active',
-        duration: formatDuration(alert.startTime),
-        resourceType: getResourceType(alert.resourceName, alert.metadata),
+    // Add alerts if not filtering to AI only
+    if (currentSource === 'all' || currentSource === 'alerts') {
+      // Add active alerts
+      Object.values(activeAlerts || {}).forEach((alert) => {
+        items.push({
+          id: alert.id,
+          source: 'alert',
+          status: 'active',
+          startTime: alert.startTime,
+          duration: formatDuration(alert.startTime),
+          resourceName: alert.resourceName,
+          resourceType: getResourceType(alert.resourceName, alert.metadata),
+          resourceId: alert.resourceId,
+          node: alert.node,
+          severity: alert.level,
+          level: alert.level,
+          type: alert.type,
+          message: alert.message,
+          title: alert.type,
+          description: alert.message,
+          acknowledged: false,
+        });
       });
-    });
 
-    // Create a set of active alert IDs for quick lookup
-    const activeAlertIds = new Set(Object.keys(activeAlerts || {}));
+      // Create a set of active alert IDs for quick lookup
+      const activeAlertIds = new Set(Object.keys(activeAlerts || {}));
 
-    // Add historical alerts
-    alertHistory().forEach((alert) => {
-      // Skip if this alert is already in active alerts (avoid duplicates)
-      if (activeAlertIds.has(alert.id)) {
-        return;
-      }
+      // Add historical alerts
+      alertHistory().forEach((alert) => {
+        if (activeAlertIds.has(alert.id)) return;
 
-      allAlerts.push({
-        ...alert,
-        status: alert.acknowledged ? 'acknowledged' : 'resolved',
-        duration: formatDuration(alert.startTime, alert.lastSeen),
-        resourceType: getResourceType(alert.resourceName, alert.metadata),
+        items.push({
+          id: alert.id,
+          source: 'alert',
+          status: alert.acknowledged ? 'acknowledged' : 'resolved',
+          startTime: alert.startTime,
+          endTime: alert.lastSeen,
+          duration: formatDuration(alert.startTime, alert.lastSeen),
+          resourceName: alert.resourceName,
+          resourceType: getResourceType(alert.resourceName, alert.metadata),
+          resourceId: alert.resourceId,
+          node: alert.node,
+          severity: alert.level,
+          level: alert.level,
+          type: alert.type,
+          message: alert.message,
+          title: alert.type,
+          description: alert.message,
+          acknowledged: alert.acknowledged,
+        });
       });
-    });
+    }
 
-    return allAlerts;
+    // Add AI findings if not filtering to alerts only
+    if (currentSource === 'all' || currentSource === 'ai') {
+      aiFindingsHistory().forEach((finding) => {
+        const isSnoozed = finding.snoozed_until && new Date(finding.snoozed_until) > new Date();
+
+        let status = 'active';
+        if (finding.resolved_at) {
+          status = finding.auto_resolved ? 'auto-resolved' : 'resolved';
+        } else if (isSnoozed) {
+          status = 'snoozed';
+        } else if (finding.acknowledged_at) {
+          status = 'acknowledged';
+        }
+
+        items.push({
+          id: finding.id,
+          source: 'ai',
+          status,
+          startTime: finding.detected_at,
+          endTime: finding.resolved_at,
+          duration: formatDuration(finding.detected_at, finding.resolved_at),
+          resourceName: finding.resource_name,
+          resourceType: finding.resource_type,
+          resourceId: finding.resource_id,
+          node: finding.node,
+          severity: finding.severity,
+          level: finding.severity, // Map severity to level for compatibility
+          type: `AI: ${finding.title}`, // Prefix with AI to distinguish
+          message: finding.description,
+          title: finding.title,
+          description: finding.description,
+          acknowledged: !!finding.acknowledged_at,
+          autoResolved: finding.auto_resolved,
+        });
+      });
+    }
+
+    return items;
   });
 
   // Apply severity & search filters (time filtering is layered separately)
-  const severityAndSearchFilteredAlerts = createMemo(() => {
-    let filtered = allAlertsData();
+  const severityAndSearchFilteredItems = createMemo(() => {
+    let filtered = allHistoryData();
 
+    // Filter by severity (map AI severity to alert levels for consistent filtering)
     if (severityFilter() !== 'all') {
-      filtered = filtered.filter((a) => a.level === severityFilter());
+      const sevFilter = severityFilter();
+      filtered = filtered.filter((item) => {
+        // For alerts, use level; for AI findings, map severity
+        if (item.source === 'alert') {
+          return item.severity === sevFilter;
+        } else {
+          // AI findings: map warning->warning, critical->critical
+          return item.severity === sevFilter;
+        }
+      });
     }
 
     if (searchTerm()) {
       const term = searchTerm().toLowerCase();
-      filtered = filtered.filter((alert) => {
-        const name = alert.resourceName?.toLowerCase() ?? '';
-        const message = alert.message?.toLowerCase() ?? '';
-        const type = alert.type?.toLowerCase() ?? '';
-        const nodeName = alert.node?.toLowerCase() ?? '';
+      filtered = filtered.filter((item) => {
+        const name = item.resourceName?.toLowerCase() ?? '';
+        const title = item.title?.toLowerCase() ?? '';
+        const description = item.description?.toLowerCase() ?? '';
+        const nodeName = item.node?.toLowerCase() ?? '';
         return (
-          name.includes(term) || message.includes(term) || type.includes(term) || nodeName.includes(term)
+          name.includes(term) || title.includes(term) || description.includes(term) || nodeName.includes(term)
         );
       });
     }
@@ -4221,7 +5468,7 @@ function HistoryTab() {
 
   // Apply filters to get the final alert data
   const alertData = createMemo(() => {
-    let filtered = severityAndSearchFilteredAlerts();
+    let filtered = severityAndSearchFilteredItems();
     const currentTimeFilter = timeFilter();
 
     // Selected bar filter (takes precedence over time filter)
@@ -4355,7 +5602,7 @@ function HistoryTab() {
   const alertTrends = createMemo(() => {
     const now = Date.now();
     const msPerHour = MS_PER_HOUR;
-    const filteredAlerts = severityAndSearchFilteredAlerts();
+    const filteredAlerts = severityAndSearchFilteredItems();
     const niceBucketSizes = [1, 2, 3, 6, 12, 24, 48, 72, 168, 336, 720, 1440]; // hours
     const maxBuckets = 30;
 
@@ -4772,6 +6019,16 @@ function HistoryTab() {
           <option value="warning">Warning Only</option>
         </select>
 
+        <select
+          value={sourceFilter()}
+          onChange={(e) => setSourceFilter(e.currentTarget.value as 'all' | 'alerts' | 'ai')}
+          class="w-full sm:w-auto px-3 py-2 text-sm border rounded-lg dark:bg-gray-700 dark:border-gray-600"
+        >
+          <option value="all">All Sources</option>
+          <option value="alerts">Alerts Only</option>
+          <option value="ai">AI Insights Only</option>
+        </select>
+
         <div class="w-full sm:flex-1 sm:max-w-xs">
           <input
             ref={searchInputRef}
@@ -4806,13 +6063,16 @@ function HistoryTab() {
           >
             {/* Table */}
             <div class="mb-2 border border-gray-200 dark:border-gray-700 rounded overflow-hidden">
-              <ScrollableTable minWidth="900px">
-                <table class="w-full min-w-[900px] text-xs sm:text-sm">
+              <ScrollableTable minWidth="1000px">
+                <table class="w-full min-w-[1000px] text-xs sm:text-sm">
                   <thead>
                     <tr class="bg-gray-100 dark:bg-gray-700 text-gray-600 dark:text-gray-300 border-b border-gray-300 dark:border-gray-600">
                       <th class="p-1 px-2 text-left text-[10px] sm:text-xs font-medium uppercase tracking-wider">
                         Timestamp
                       </th>
+                      <th class="p-1 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">
+                        Source
+                      </th>
                       <th class="p-1 px-2 text-left text-[10px] sm:text-xs font-medium uppercase tracking-wider">
                         Resource
                       </th>
@@ -4834,6 +6094,9 @@ function HistoryTab() {
                       <th class="p-1 px-2 text-left text-[10px] sm:text-xs font-medium uppercase tracking-wider">
                         Node
                       </th>
+                      <th class="p-1 px-2 text-center text-[10px] sm:text-xs font-medium uppercase tracking-wider">
+                        Actions
+                      </th>
                     </tr>
                   </thead>
                   <tbody>
@@ -4843,7 +6106,7 @@ function HistoryTab() {
                           {/* Date divider */}
                           <tr class="bg-gray-50 dark:bg-gray-900/40">
                             <td
-                              colspan="8"
+                              colspan="10"
                               class="py-1.5 pr-3 pl-4 text-[12px] sm:text-sm font-semibold text-slate-700 dark:text-slate-100"
                             >
                               <div class="flex flex-col gap-1 sm:flex-row sm:items-center sm:justify-between sm:gap-3">
@@ -4851,8 +6114,14 @@ function HistoryTab() {
                                   {group.label}
                                 </span>
                                 <span class="text-[10px] font-medium text-slate-500 dark:text-slate-400">
-                                  {group.alerts.length}{' '}
-                                  {group.alerts.length === 1 ? 'alert' : 'alerts'}
+                                  {(() => {
+                                    const alertCount = group.alerts.filter(a => a.source === 'alert').length;
+                                    const aiCount = group.alerts.filter(a => a.source === 'ai').length;
+                                    const parts = [];
+                                    if (alertCount > 0) parts.push(`${alertCount} alert${alertCount === 1 ? '' : 's'}`);
+                                    if (aiCount > 0) parts.push(`${aiCount} AI insight${aiCount === 1 ? '' : 's'}`);
+                                    return parts.join(', ') || `${group.alerts.length} item${group.alerts.length === 1 ? '' : 's'}`;
+                                  })()}
                                 </span>
                               </div>
                             </td>
@@ -4862,9 +6131,8 @@ function HistoryTab() {
                           <For each={group.alerts}>
                             {(alert) => (
                               <tr
-                                class={`border-b border-gray-200 dark:border-gray-600 hover:bg-gray-50 dark:hover:bg-gray-700 ${
-                                  alert.status === 'active' ? 'bg-red-50 dark:bg-red-900/10' : ''
-                                }`}
+                                class={`border-b border-gray-200 dark:border-gray-600 hover:bg-gray-50 dark:hover:bg-gray-700 ${alert.status === 'active' ? 'bg-red-50 dark:bg-red-900/10' : ''
+                                  }`}
                               >
                                 {/* Timestamp */}
                                 <td class="p-1 px-2 text-gray-600 dark:text-gray-400 font-mono">
@@ -4874,6 +6142,18 @@ function HistoryTab() {
                                   })}
                                 </td>
 
+                                {/* Source */}
+                                <td class="p-1 px-2 text-center">
+                                  <span
+                                    class={`text-[10px] px-1.5 py-0.5 rounded font-medium ${alert.source === 'ai'
+                                      ? 'bg-violet-100 dark:bg-violet-900/50 text-violet-700 dark:text-violet-300'
+                                      : 'bg-sky-100 dark:bg-sky-900/50 text-sky-700 dark:text-sky-300'
+                                      }`}
+                                  >
+                                    {alert.source === 'ai' ? 'AI' : 'Alert'}
+                                  </span>
+                                </td>
+
                                 {/* Resource */}
                                 <td class="p-1 px-2 font-medium text-gray-900 dark:text-gray-100 truncate max-w-[150px]">
                                   {alert.resourceName}
@@ -4882,17 +6162,16 @@ function HistoryTab() {
                                 {/* Type */}
                                 <td class="p-1 px-2">
                                   <span
-                                    class={`text-xs px-1 py-0.5 rounded ${
-                                      alert.resourceType === 'VM'
-                                        ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300'
-                                        : alert.resourceType === 'CT'
-                                          ? 'bg-green-100 dark:bg-green-900/50 text-green-700 dark:text-green-300'
-                                          : alert.resourceType === 'Node'
-                                            ? 'bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300'
-                                            : alert.resourceType === 'Storage'
-                                              ? 'bg-orange-100 dark:bg-orange-900/50 text-orange-700 dark:text-orange-300'
-                                              : 'bg-gray-100 dark:bg-gray-700 text-gray-700 dark:text-gray-300'
-                                    }`}
+                                    class={`text-xs px-1 py-0.5 rounded ${alert.resourceType === 'VM'
+                                      ? 'bg-blue-100 dark:bg-blue-900/50 text-blue-700 dark:text-blue-300'
+                                      : alert.resourceType === 'CT'
+                                        ? 'bg-green-100 dark:bg-green-900/50 text-green-700 dark:text-green-300'
+                                        : alert.resourceType === 'Node'
+                                          ? 'bg-purple-100 dark:bg-purple-900/50 text-purple-700 dark:text-purple-300'
+                                          : alert.resourceType === 'Storage'
+                                            ? 'bg-orange-100 dark:bg-orange-900/50 text-orange-700 dark:text-orange-300'
+                                            : 'bg-gray-100 dark:bg-gray-700 text-gray-700 dark:text-gray-300'
+                                      }`}
                                   >
                                     {alert.type}
                                   </span>
@@ -4901,11 +6180,10 @@ function HistoryTab() {
                                 {/* Severity */}
                                 <td class="p-1 px-2 text-center">
                                   <span
-                                    class={`text-xs px-2 py-0.5 rounded font-medium ${
-                                      alert.level === 'critical'
-                                        ? 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300'
-                                        : 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300'
-                                    }`}
+                                    class={`text-xs px-2 py-0.5 rounded font-medium ${alert.level === 'critical'
+                                      ? 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300'
+                                      : 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300'
+                                      }`}
                                   >
                                     {alert.level}
                                   </span>
@@ -4927,13 +6205,12 @@ function HistoryTab() {
                                 {/* Status */}
                                 <td class="p-1 px-2 text-center">
                                   <span
-                                    class={`text-xs px-2 py-0.5 rounded ${
-                                      alert.status === 'active'
-                                        ? 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300 font-medium'
-                                        : alert.status === 'acknowledged'
-                                          ? 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300'
-                                          : 'bg-gray-100 dark:bg-gray-700 text-gray-700 dark:text-gray-300'
-                                    }`}
+                                    class={`text-xs px-2 py-0.5 rounded ${alert.status === 'active'
+                                      ? 'bg-red-100 dark:bg-red-900/50 text-red-700 dark:text-red-300 font-medium'
+                                      : alert.status === 'acknowledged'
+                                        ? 'bg-yellow-100 dark:bg-yellow-900/50 text-yellow-700 dark:text-yellow-300'
+                                        : 'bg-gray-100 dark:bg-gray-700 text-gray-700 dark:text-gray-300'
+                                      }`}
                                   >
                                     {alert.status}
                                   </span>
@@ -4943,6 +6220,31 @@ function HistoryTab() {
                                 <td class="p-1 px-2 text-gray-600 dark:text-gray-400 truncate">
                                   {alert.node || '—'}
                                 </td>
+
+                                {/* Actions */}
+                                <td class="p-1 px-2 text-center">
+                                  <Show when={alert.status === 'active' || alert.status === 'acknowledged'}>
+                                    <InvestigateAlertButton
+                                      alert={{
+                                        id: alert.id,
+                                        type: alert.type,
+                                        level: alert.level as 'warning' | 'critical',
+                                        resourceId: alert.resourceId || '',
+                                        resourceName: alert.resourceName,
+                                        node: alert.node || '',
+                                        instance: '',
+                                        message: alert.message || '',
+                                        value: 0,
+                                        threshold: 0,
+                                        startTime: alert.startTime,
+                                        lastSeen: alert.startTime,
+                                        acknowledged: alert.status === 'acknowledged',
+                                      }}
+                                      variant="icon"
+                                      size="sm"
+                                    />
+                                  </Show>
+                                </td>
                               </tr>
                             )}
                           </For>
diff --git a/frontend-modern/src/pages/Ceph.tsx b/frontend-modern/src/pages/Ceph.tsx
new file mode 100644
index 0000000..372bec1
--- /dev/null
+++ b/frontend-modern/src/pages/Ceph.tsx
@@ -0,0 +1,671 @@
+import { Component, For, Show, createMemo, createSignal, createEffect, onCleanup } from 'solid-js';
+import { Portal } from 'solid-js/web';
+import { useWebSocket } from '@/App';
+import { ProxmoxSectionNav } from '@/components/Proxmox/ProxmoxSectionNav';
+import { Card } from '@/components/shared/Card';
+import { EmptyState } from '@/components/shared/EmptyState';
+import type { CephPool, CephServiceStatus } from '@/types/api';
+import { formatBytes } from '@/utils/format';
+
+// Service type icon component with proper styling
+const ServiceIcon: Component<{ type: string; class?: string }> = (props) => {
+    const iconClass = () => `${props.class || 'w-4 h-4'}`;
+
+    switch (props.type.toLowerCase()) {
+        case 'mon':
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M2.036 12.322a1.012 1.012 0 010-.639C3.423 7.51 7.36 4.5 12 4.5c4.638 0 8.573 3.007 9.963 7.178.07.207.07.431 0 .639C20.577 16.49 16.64 19.5 12 19.5c-4.638 0-8.573-3.007-9.963-7.178z" />
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+                </svg>
+            );
+        case 'mgr':
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M9.594 3.94c.09-.542.56-.94 1.11-.94h2.593c.55 0 1.02.398 1.11.94l.213 1.281c.063.374.313.686.645.87.074.04.147.083.22.127.324.196.72.257 1.075.124l1.217-.456a1.125 1.125 0 011.37.49l1.296 2.247a1.125 1.125 0 01-.26 1.431l-1.003.827c-.293.24-.438.613-.431.992a6.759 6.759 0 010 .255c-.007.378.138.75.43.99l1.005.828c.424.35.534.954.26 1.43l-1.298 2.247a1.125 1.125 0 01-1.369.491l-1.217-.456c-.355-.133-.75-.072-1.076.124a6.57 6.57 0 01-.22.128c-.331.183-.581.495-.644.869l-.213 1.28c-.09.543-.56.941-1.11.941h-2.594c-.55 0-1.02-.398-1.11-.94l-.213-1.281c-.062-.374-.312-.686-.644-.87a6.52 6.52 0 01-.22-.127c-.325-.196-.72-.257-1.076-.124l-1.217.456a1.125 1.125 0 01-1.369-.49l-1.297-2.247a1.125 1.125 0 01.26-1.431l1.004-.827c.292-.24.437-.613.43-.992a6.932 6.932 0 010-.255c.007-.378-.138-.75-.43-.99l-1.004-.828a1.125 1.125 0 01-.26-1.43l1.297-2.247a1.125 1.125 0 011.37-.491l1.216.456c.356.133.751.072 1.076-.124.072-.044.146-.087.22-.128.332-.183.582-.495.644-.869l.214-1.281z" />
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M15 12a3 3 0 11-6 0 3 3 0 016 0z" />
+                </svg>
+            );
+        case 'osd':
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M20.25 6.375c0 2.278-3.694 4.125-8.25 4.125S3.75 8.653 3.75 6.375m16.5 0c0-2.278-3.694-4.125-8.25-4.125S3.75 4.097 3.75 6.375m16.5 0v11.25c0 2.278-3.694 4.125-8.25 4.125s-8.25-1.847-8.25-4.125V6.375m16.5 0v3.75m-16.5-3.75v3.75m16.5 0v3.75C20.25 16.153 16.556 18 12 18s-8.25-1.847-8.25-4.125v-3.75m16.5 0c0 2.278-3.694 4.125-8.25 4.125s-8.25-1.847-8.25-4.125" />
+                </svg>
+            );
+        case 'mds':
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M2.25 12.75V12A2.25 2.25 0 014.5 9.75h15A2.25 2.25 0 0121.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z" />
+                </svg>
+            );
+        case 'rgw':
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M12 21a9.004 9.004 0 008.716-6.747M12 21a9.004 9.004 0 01-8.716-6.747M12 21c2.485 0 4.5-4.03 4.5-9S14.485 3 12 3m0 18c-2.485 0-4.5-4.03-4.5-9S9.515 3 12 3m0 0a8.997 8.997 0 017.843 4.582M12 3a8.997 8.997 0 00-7.843 4.582m15.686 0A11.953 11.953 0 0112 10.5c-2.998 0-5.74-1.1-7.843-2.918m15.686 0A8.959 8.959 0 0121 12c0 .778-.099 1.533-.284 2.253m0 0A17.919 17.919 0 0112 16.5c-3.162 0-6.133-.815-8.716-2.247m0 0A9.015 9.015 0 013 12c0-1.605.42-3.113 1.157-4.418" />
+                </svg>
+            );
+        default:
+            return (
+                <svg class={iconClass()} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                    <path stroke-linecap="round" stroke-linejoin="round" d="M5.25 14.25h13.5m-13.5 0a3 3 0 01-3-3m3 3a3 3 0 100 6h13.5a3 3 0 100-6m-16.5-3a3 3 0 013-3h13.5a3 3 0 013 3m-19.5 0a4.5 4.5 0 01.9-2.7L5.737 5.1a3.375 3.375 0 012.7-1.35h7.126c1.062 0 2.062.5 2.7 1.35l2.587 3.45a4.5 4.5 0 01.9 2.7m0 0a3 3 0 01-3 3m0 3h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008zm-3 6h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008z" />
+                </svg>
+            );
+    }
+};
+
+// Get health color classes
+const getHealthInfo = (health: string) => {
+    const h = health?.toUpperCase() || '';
+    if (h === 'OK' || h === 'HEALTH_OK') {
+        return {
+            bgClass: 'bg-green-100 dark:bg-green-900/30',
+            textClass: 'text-green-700 dark:text-green-400',
+            borderClass: 'border-green-200 dark:border-green-700',
+            dotClass: 'bg-green-500',
+            label: 'OK',
+        };
+    }
+    if (h === 'WARN' || h === 'HEALTH_WARN' || h === 'WARNING') {
+        return {
+            bgClass: 'bg-yellow-100 dark:bg-yellow-900/30',
+            textClass: 'text-yellow-700 dark:text-yellow-400',
+            borderClass: 'border-yellow-200 dark:border-yellow-700',
+            dotClass: 'bg-yellow-500',
+            label: 'WARN',
+        };
+    }
+    if (h === 'ERR' || h === 'HEALTH_ERR' || h === 'ERROR' || h === 'CRITICAL') {
+        return {
+            bgClass: 'bg-red-100 dark:bg-red-900/30',
+            textClass: 'text-red-700 dark:text-red-400',
+            borderClass: 'border-red-200 dark:border-red-700',
+            dotClass: 'bg-red-500',
+            label: 'ERROR',
+        };
+    }
+    return {
+        bgClass: 'bg-gray-100 dark:bg-gray-800',
+        textClass: 'text-gray-600 dark:text-gray-400',
+        borderClass: 'border-gray-200 dark:border-gray-700',
+        dotClass: 'bg-gray-400',
+        label: 'UNKNOWN',
+    };
+};
+
+// Cluster health status badge with tooltip
+const HealthBadge: Component<{ health: string; message?: string }> = (props) => {
+    const [showTooltip, setShowTooltip] = createSignal(false);
+    const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+    const healthInfo = createMemo(() => getHealthInfo(props.health));
+
+    const handleMouseEnter = (e: MouseEvent) => {
+        if (!props.message) return;
+        const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+        setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+        setShowTooltip(true);
+    };
+
+    return (
+        <>
+            <span
+                class={`inline-flex items-center gap-1.5 px-2 py-0.5 rounded-full text-[10px] font-semibold uppercase tracking-wide ${healthInfo().bgClass} ${healthInfo().textClass} border ${healthInfo().borderClass}`}
+                onMouseEnter={handleMouseEnter}
+                onMouseLeave={() => setShowTooltip(false)}
+            >
+                <span class={`w-1.5 h-1.5 rounded-full ${healthInfo().dotClass} animate-pulse`} />
+                {healthInfo().label}
+            </span>
+
+            <Show when={showTooltip() && props.message}>
+                <Portal mount={document.body}>
+                    <div
+                        class="fixed z-[9999] pointer-events-none"
+                        style={{
+                            left: `${tooltipPos().x}px`,
+                            top: `${tooltipPos().y - 8}px`,
+                            transform: 'translate(-50%, -100%)',
+                        }}
+                    >
+                        <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2.5 py-1.5 max-w-[280px] border border-gray-700">
+                            {props.message}
+                        </div>
+                    </div>
+                </Portal>
+            </Show>
+        </>
+    );
+};
+
+// Service status cell with tooltip
+const ServiceStatusCell: Component<{ services: CephServiceStatus[] }> = (props) => {
+    const [showTooltip, setShowTooltip] = createSignal(false);
+    const [tooltipPos, setTooltipPos] = createSignal({ x: 0, y: 0 });
+
+    const handleMouseEnter = (e: MouseEvent) => {
+        const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+        setTooltipPos({ x: rect.left + rect.width / 2, y: rect.top });
+        setShowTooltip(true);
+    };
+
+    const getServiceStatus = (svc: CephServiceStatus) => {
+        if (svc.running === svc.total) return { color: 'text-green-600 dark:text-green-400', status: 'healthy' };
+        if (svc.running > 0) return { color: 'text-yellow-600 dark:text-yellow-400', status: 'degraded' };
+        return { color: 'text-red-600 dark:text-red-400', status: 'down' };
+    };
+
+    return (
+        <>
+            <div
+                class="flex items-center gap-1.5 cursor-help"
+                onMouseEnter={handleMouseEnter}
+                onMouseLeave={() => setShowTooltip(false)}
+            >
+                <For each={props.services.slice(0, 4)}>
+                    {(svc) => {
+                        const status = getServiceStatus(svc);
+                        return (
+                            <span class={`inline-flex items-center gap-0.5 text-xs ${status.color}`}>
+                                <ServiceIcon type={svc.type} class="w-3.5 h-3.5" />
+                                <span class="font-mono text-[10px]">{svc.running}/{svc.total}</span>
+                            </span>
+                        );
+                    }}
+                </For>
+                <Show when={props.services.length > 4}>
+                    <span class="text-[10px] text-gray-500">+{props.services.length - 4}</span>
+                </Show>
+            </div>
+
+            <Show when={showTooltip() && props.services.length > 0}>
+                <Portal mount={document.body}>
+                    <div
+                        class="fixed z-[9999] pointer-events-none"
+                        style={{
+                            left: `${tooltipPos().x}px`,
+                            top: `${tooltipPos().y - 8}px`,
+                            transform: 'translate(-50%, -100%)',
+                        }}
+                    >
+                        <div class="bg-gray-900 dark:bg-gray-800 text-white text-[10px] rounded-md shadow-lg px-2.5 py-2 min-w-[180px] border border-gray-700">
+                            <div class="font-medium mb-1.5 text-gray-300 border-b border-gray-700 pb-1">
+                                Ceph Services
+                            </div>
+                            <div class="space-y-1">
+                                <For each={props.services}>
+                                    {(svc) => {
+                                        const status = getServiceStatus(svc);
+                                        return (
+                                            <div class="flex items-center justify-between gap-3">
+                                                <span class="flex items-center gap-1.5 text-gray-400">
+                                                    <ServiceIcon type={svc.type} class="w-3.5 h-3.5" />
+                                                    <span class="uppercase">{svc.type}</span>
+                                                </span>
+                                                <span class={`font-mono ${status.color}`}>
+                                                    {svc.running}/{svc.total}
+                                                </span>
+                                            </div>
+                                        );
+                                    }}
+                                </For>
+                            </div>
+                        </div>
+                    </div>
+                </Portal>
+            </Show>
+        </>
+    );
+};
+
+// Usage bar component
+const UsageBar: Component<{ percent: number; size?: 'sm' | 'md' }> = (props) => {
+    const barHeight = () => props.size === 'sm' ? 'h-1.5' : 'h-2';
+    const barColor = () => {
+        const p = props.percent || 0;
+        if (p > 90) return 'bg-red-500';
+        if (p > 75) return 'bg-yellow-500';
+        return 'bg-blue-500';
+    };
+
+    return (
+        <div class={`w-full bg-gray-200 dark:bg-gray-700 rounded-full ${barHeight()} overflow-hidden`}>
+            <div
+                class={`${barHeight()} rounded-full transition-all duration-500 ${barColor()}`}
+                style={{ width: `${Math.min(props.percent || 0, 100)}%` }}
+            />
+        </div>
+    );
+};
+
+// Main Ceph Page Component
+const Ceph: Component = () => {
+    const { state, connected, initialDataReceived, reconnecting, reconnect } = useWebSocket();
+
+    const [searchTerm, setSearchTerm] = createSignal('');
+    let searchInputRef: HTMLInputElement | undefined;
+
+    // Keyboard handler for type-to-search
+    createEffect(() => {
+        const handleKeyDown = (e: KeyboardEvent) => {
+            const target = e.target as HTMLElement;
+            const isInputField =
+                target.tagName === 'INPUT' ||
+                target.tagName === 'TEXTAREA' ||
+                target.tagName === 'SELECT' ||
+                target.contentEditable === 'true';
+
+            if (e.key === 'Escape') {
+                if (searchTerm().trim()) {
+                    setSearchTerm('');
+                    searchInputRef?.blur();
+                }
+            } else if (!isInputField && e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey) {
+                if (searchInputRef) {
+                    searchInputRef.focus();
+                }
+            }
+        };
+
+        document.addEventListener('keydown', handleKeyDown);
+        onCleanup(() => document.removeEventListener('keydown', handleKeyDown));
+    });
+
+    const clusters = createMemo(() => state.cephClusters || []);
+    const hasClusters = createMemo(() => clusters().length > 0);
+
+    // Aggregate all pools from all clusters
+    const allPools = createMemo(() => {
+        const pools: (CephPool & { clusterName: string })[] = [];
+        for (const cluster of clusters()) {
+            if (cluster.pools) {
+                for (const pool of cluster.pools) {
+                    pools.push({
+                        ...pool,
+                        clusterName: cluster.name || 'Ceph Cluster',
+                    });
+                }
+            }
+        }
+        return pools;
+    });
+
+    // Aggregate services from all clusters
+    const allServices = createMemo(() => {
+        const serviceMap = new Map<string, { running: number; total: number }>();
+        for (const cluster of clusters()) {
+            if (cluster.services) {
+                for (const svc of cluster.services) {
+                    const existing = serviceMap.get(svc.type) || { running: 0, total: 0 };
+                    serviceMap.set(svc.type, {
+                        running: existing.running + svc.running,
+                        total: existing.total + svc.total,
+                    });
+                }
+            }
+        }
+        return Array.from(serviceMap.entries()).map(([type, counts]) => ({
+            type,
+            running: counts.running,
+            total: counts.total,
+        }));
+    });
+
+    // Filter pools by search term
+    const filteredPools = createMemo(() => {
+        const term = searchTerm().toLowerCase().trim();
+        if (!term) return allPools();
+        return allPools().filter(
+            pool =>
+                pool.name.toLowerCase().includes(term) ||
+                pool.clusterName.toLowerCase().includes(term)
+        );
+    });
+
+    // Calculate total storage stats
+    const totalStats = createMemo(() => {
+        let totalBytes = 0;
+        let usedBytes = 0;
+        for (const cluster of clusters()) {
+            totalBytes += cluster.totalBytes || 0;
+            usedBytes += cluster.usedBytes || 0;
+        }
+        const usagePercent = totalBytes > 0 ? (usedBytes / totalBytes) * 100 : 0;
+        return { totalBytes, usedBytes, usagePercent };
+    });
+
+    const isLoading = createMemo(() => connected() && !initialDataReceived());
+
+    const thClass = "px-2 py-1.5 text-left text-[11px] sm:text-xs font-medium uppercase tracking-wider cursor-pointer hover:bg-gray-100 dark:hover:bg-gray-600/50 whitespace-nowrap transition-colors";
+
+    return (
+        <div class="space-y-4">
+            {/* Navigation */}
+            <ProxmoxSectionNav current="ceph" />
+
+            {/* Loading State */}
+            <Show when={isLoading()}>
+                <Card padding="lg">
+                    <EmptyState
+                        icon={
+                            <svg class="h-12 w-12 animate-spin text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
+                                <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z" />
+                            </svg>
+                        }
+                        title="Loading Ceph data..."
+                        description="Connecting to the monitoring service."
+                    />
+                </Card>
+            </Show>
+
+            {/* Disconnected State */}
+            <Show when={!connected() && !isLoading()}>
+                <Card padding="lg" tone="danger">
+                    <EmptyState
+                        icon={
+                            <svg class="h-12 w-12 text-red-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                            </svg>
+                        }
+                        title="Connection lost"
+                        description={reconnecting() ? 'Attempting to reconnect…' : 'Unable to connect to the backend server'}
+                        tone="danger"
+                        actions={
+                            !reconnecting() ? (
+                                <button
+                                    onClick={() => reconnect()}
+                                    class="mt-2 inline-flex items-center px-4 py-2 text-xs font-medium rounded bg-red-600 text-white hover:bg-red-700 transition-colors"
+                                >
+                                    Reconnect now
+                                </button>
+                            ) : undefined
+                        }
+                    />
+                </Card>
+            </Show>
+
+            <Show when={connected() && initialDataReceived()}>
+                {/* No Clusters Empty State */}
+                <Show when={!hasClusters()}>
+                    <Card padding="lg">
+                        <EmptyState
+                            icon={
+                                <svg class="h-12 w-12 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M20 13V6a2 2 0 00-2-2H6a2 2 0 00-2 2v7m16 0v5a2 2 0 01-2 2H6a2 2 0 01-2-2v-5m16 0h-2.586a1 1 0 00-.707.293l-2.414 2.414a1 1 0 01-.707.293h-3.172a1 1 0 01-.707-.293l-2.414-2.414A1 1 0 006.586 13H4" />
+                                </svg>
+                            }
+                            title="No Ceph Clusters Detected"
+                            description="Ceph cluster data will appear here when detected via the Pulse agent on your Proxmox nodes. Install the agent on a node with Ceph configured."
+                        />
+                    </Card>
+                </Show>
+
+                {/* Clusters Found - Show Content */}
+                <Show when={hasClusters()}>
+                    {/* Summary Cards */}
+                    <div class="grid gap-3 sm:gap-4 grid-cols-1 sm:grid-cols-2 xl:grid-cols-4">
+                        {/* Total Storage Card */}
+                        <Card padding="sm" tone="glass">
+                            <div class="flex items-center justify-between mb-2">
+                                <span class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Total Storage</span>
+                                <svg class="w-4 h-4 text-blue-500" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                                    <path stroke-linecap="round" stroke-linejoin="round" d="M20.25 6.375c0 2.278-3.694 4.125-8.25 4.125S3.75 8.653 3.75 6.375m16.5 0c0-2.278-3.694-4.125-8.25-4.125S3.75 4.097 3.75 6.375m16.5 0v11.25c0 2.278-3.694 4.125-8.25 4.125s-8.25-1.847-8.25-4.125V6.375m16.5 0v3.75m-16.5-3.75v3.75m16.5 0v3.75C20.25 16.153 16.556 18 12 18s-8.25-1.847-8.25-4.125v-3.75m16.5 0c0 2.278-3.694 4.125-8.25 4.125s-8.25-1.847-8.25-4.125" />
+                                </svg>
+                            </div>
+                            <div class="text-xl sm:text-2xl font-bold text-gray-900 dark:text-gray-100">
+                                {formatBytes(totalStats().totalBytes)}
+                            </div>
+                            <div class="mt-1.5">
+                                <UsageBar percent={totalStats().usagePercent} size="sm" />
+                                <div class="flex justify-between text-[10px] text-gray-500 dark:text-gray-400 mt-1">
+                                    <span>{formatBytes(totalStats().usedBytes)} used</span>
+                                    <span>{totalStats().usagePercent.toFixed(1)}%</span>
+                                </div>
+                            </div>
+                        </Card>
+
+                        {/* Clusters Card */}
+                        <Card padding="sm" tone="glass">
+                            <div class="flex items-center justify-between mb-2">
+                                <span class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Clusters</span>
+                                <svg class="w-4 h-4 text-purple-500" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                                    <path stroke-linecap="round" stroke-linejoin="round" d="M21 7.5l-2.25-1.313M21 7.5v2.25m0-2.25l-2.25 1.313M3 7.5l2.25-1.313M3 7.5l2.25 1.313M3 7.5v2.25m9 3l2.25-1.313M12 12.75l-2.25-1.313M12 12.75V15m0 6.75l2.25-1.313M12 21.75V19.5m0 2.25l-2.25-1.313m0-16.875L12 2.25l2.25 1.313M21 14.25v2.25l-2.25 1.313m-13.5 0L3 16.5v-2.25" />
+                                </svg>
+                            </div>
+                            <div class="text-xl sm:text-2xl font-bold text-gray-900 dark:text-gray-100">
+                                {clusters().length}
+                            </div>
+                            <div class="flex flex-wrap gap-1 mt-2">
+                                <For each={clusters()}>
+                                    {(cluster) => (
+                                        <HealthBadge health={cluster.health || ''} message={cluster.healthMessage} />
+                                    )}
+                                </For>
+                            </div>
+                        </Card>
+
+                        {/* Services Card */}
+                        <Card padding="sm" tone="glass">
+                            <div class="flex items-center justify-between mb-2">
+                                <span class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Services</span>
+                                <svg class="w-4 h-4 text-green-500" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                                    <path stroke-linecap="round" stroke-linejoin="round" d="M5.25 14.25h13.5m-13.5 0a3 3 0 01-3-3m3 3a3 3 0 100 6h13.5a3 3 0 100-6m-16.5-3a3 3 0 013-3h13.5a3 3 0 013 3m-19.5 0a4.5 4.5 0 01.9-2.7L5.737 5.1a3.375 3.375 0 012.7-1.35h7.126c1.062 0 2.062.5 2.7 1.35l2.587 3.45a4.5 4.5 0 01.9 2.7m0 0a3 3 0 01-3 3m0 3h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008zm-3 6h.008v.008h-.008v-.008zm0-6h.008v.008h-.008v-.008z" />
+                                </svg>
+                            </div>
+                            <div class="text-xl sm:text-2xl font-bold text-gray-900 dark:text-gray-100">
+                                {allServices().reduce((acc, svc) => acc + svc.running, 0)}
+                                <span class="text-sm font-normal text-gray-500 dark:text-gray-400">
+                                    /{allServices().reduce((acc, svc) => acc + svc.total, 0)}
+                                </span>
+                            </div>
+                            <div class="mt-2">
+                                <ServiceStatusCell services={allServices() as CephServiceStatus[]} />
+                            </div>
+                        </Card>
+
+                        {/* Pools Card */}
+                        <Card padding="sm" tone="glass">
+                            <div class="flex items-center justify-between mb-2">
+                                <span class="text-xs font-medium text-gray-500 dark:text-gray-400 uppercase tracking-wide">Pools</span>
+                                <svg class="w-4 h-4 text-cyan-500" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="1.5">
+                                    <path stroke-linecap="round" stroke-linejoin="round" d="M6 6.878V6a2.25 2.25 0 012.25-2.25h7.5A2.25 2.25 0 0118 6v.878m-12 0c.235-.083.487-.128.75-.128h10.5c.263 0 .515.045.75.128m-12 0A2.25 2.25 0 004.5 9v.878m13.5-3A2.25 2.25 0 0119.5 9v.878m0 0a2.246 2.246 0 00-.75-.128H5.25c-.263 0-.515.045-.75.128m15 0A2.25 2.25 0 0121 12v6a2.25 2.25 0 01-2.25 2.25H5.25A2.25 2.25 0 013 18v-6c0-.98.626-1.813 1.5-2.122" />
+                                </svg>
+                            </div>
+                            <div class="text-xl sm:text-2xl font-bold text-gray-900 dark:text-gray-100">
+                                {allPools().length}
+                            </div>
+                            <div class="text-xs text-gray-500 dark:text-gray-400 mt-2">
+                                {allPools().reduce((acc, pool) => acc + (pool.objects || 0), 0).toLocaleString()} objects
+                            </div>
+                        </Card>
+                    </div>
+
+                    {/* Cluster Details Table */}
+                    <Show when={clusters().length > 0}>
+                        <Card padding="none" tone="glass" class="overflow-hidden">
+                            <div class="px-4 py-3 border-b border-gray-200 dark:border-gray-700 bg-gray-50/50 dark:bg-gray-800/50">
+                                <h3 class="text-sm font-semibold text-gray-900 dark:text-gray-100">
+                                    Cluster Overview
+                                </h3>
+                            </div>
+                            <div class="overflow-x-auto">
+                                <table class="w-full border-collapse whitespace-nowrap">
+                                    <thead>
+                                        <tr class="bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-300 border-b border-gray-200 dark:border-gray-700">
+                                            <th class={`${thClass} pl-4`}>Cluster</th>
+                                            <th class={thClass}>Health</th>
+                                            <th class={thClass}>Monitors</th>
+                                            <th class={thClass}>Managers</th>
+                                            <th class={thClass}>OSDs</th>
+                                            <th class={thClass}>PGs</th>
+                                            <th class={`${thClass} min-w-[160px]`}>Capacity</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody class="divide-y divide-gray-100 dark:divide-gray-700">
+                                        <For each={clusters()}>
+                                            {(cluster) => (
+                                                <tr class="hover:bg-gray-50/80 dark:hover:bg-gray-700/30 transition-colors">
+                                                    <td class="px-4 py-2.5">
+                                                        <div class="font-medium text-sm text-gray-900 dark:text-gray-100">
+                                                            {cluster.name || 'Ceph Cluster'}
+                                                        </div>
+                                                        <Show when={cluster.fsid}>
+                                                            <div class="text-[10px] text-gray-500 dark:text-gray-400 font-mono truncate max-w-[180px]">
+                                                                {cluster.fsid}
+                                                            </div>
+                                                        </Show>
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <HealthBadge health={cluster.health || ''} message={cluster.healthMessage} />
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <span class="inline-flex items-center gap-1 text-xs text-blue-600 dark:text-blue-400">
+                                                            <ServiceIcon type="mon" class="w-3.5 h-3.5" />
+                                                            <span class="font-semibold">{cluster.numMons || 0}</span>
+                                                        </span>
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <span class="inline-flex items-center gap-1 text-xs text-purple-600 dark:text-purple-400">
+                                                            <ServiceIcon type="mgr" class="w-3.5 h-3.5" />
+                                                            <span class="font-semibold">{cluster.numMgrs || 0}</span>
+                                                        </span>
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <span class="inline-flex items-center gap-1 text-xs">
+                                                            <ServiceIcon type="osd" class="w-3.5 h-3.5 text-green-600 dark:text-green-400" />
+                                                            <span class={`font-semibold ${(cluster.numOsdsUp || 0) < (cluster.numOsds || 0) ? 'text-yellow-600 dark:text-yellow-400' : 'text-green-600 dark:text-green-400'}`}>
+                                                                {cluster.numOsdsUp || 0}
+                                                            </span>
+                                                            <span class="text-gray-400 dark:text-gray-500">
+                                                                /{cluster.numOsds || 0}
+                                                            </span>
+                                                        </span>
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <span class="text-xs text-gray-700 dark:text-gray-300 font-medium">
+                                                            {(cluster.numPGs || 0).toLocaleString()}
+                                                        </span>
+                                                    </td>
+                                                    <td class="px-2 py-2.5">
+                                                        <div class="w-full max-w-[160px]">
+                                                            <UsageBar percent={cluster.usagePercent || 0} size="sm" />
+                                                            <div class="flex justify-between text-[10px] text-gray-500 dark:text-gray-400 mt-0.5">
+                                                                <span>{formatBytes(cluster.usedBytes || 0)}</span>
+                                                                <span>{(cluster.usagePercent || 0).toFixed(1)}%</span>
+                                                            </div>
+                                                        </div>
+                                                    </td>
+                                                </tr>
+                                            )}
+                                        </For>
+                                    </tbody>
+                                </table>
+                            </div>
+                        </Card>
+                    </Show>
+
+                    {/* Pools Table */}
+                    <Show when={allPools().length > 0}>
+                        <Card padding="none" tone="glass" class="overflow-hidden">
+                            <div class="px-4 py-3 border-b border-gray-200 dark:border-gray-700 bg-gray-50/50 dark:bg-gray-800/50 flex items-center justify-between gap-4">
+                                <h3 class="text-sm font-semibold text-gray-900 dark:text-gray-100">
+                                    Storage Pools ({filteredPools().length})
+                                </h3>
+                                {/* Search Input */}
+                                <div class="relative max-w-xs flex-1">
+                                    <input
+                                        ref={(el) => (searchInputRef = el)}
+                                        type="text"
+                                        placeholder="Search pools..."
+                                        value={searchTerm()}
+                                        onInput={(e) => setSearchTerm(e.currentTarget.value)}
+                                        class="w-full pl-8 pr-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg 
+                                               bg-white dark:bg-gray-900 text-gray-800 dark:text-gray-200 placeholder-gray-400 dark:placeholder-gray-500
+                                               focus:ring-2 focus:ring-blue-500/20 focus:border-blue-500 dark:focus:border-blue-400 outline-none transition-all"
+                                    />
+                                    <svg
+                                        class="absolute left-2.5 top-2 h-4 w-4 text-gray-400 dark:text-gray-500"
+                                        fill="none"
+                                        viewBox="0 0 24 24"
+                                        stroke="currentColor"
+                                    >
+                                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
+                                    </svg>
+                                    <Show when={searchTerm()}>
+                                        <button
+                                            onClick={() => setSearchTerm('')}
+                                            class="absolute right-2.5 top-2 text-gray-400 hover:text-gray-600 dark:hover:text-gray-300"
+                                        >
+                                            <svg class="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2">
+                                                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+                                            </svg>
+                                        </button>
+                                    </Show>
+                                </div>
+                            </div>
+
+                            <Show
+                                when={filteredPools().length > 0}
+                                fallback={
+                                    <div class="p-8 text-center text-gray-500 dark:text-gray-400">
+                                        No pools match "{searchTerm()}"
+                                    </div>
+                                }
+                            >
+                                <div class="overflow-x-auto">
+                                    <table class="w-full border-collapse whitespace-nowrap">
+                                        <thead>
+                                            <tr class="bg-gray-50 dark:bg-gray-700/50 text-gray-600 dark:text-gray-300 border-b border-gray-200 dark:border-gray-700">
+                                                <th class={`${thClass} pl-4`}>Pool</th>
+                                                <th class={thClass}>Cluster</th>
+                                                <th class={thClass}>Used</th>
+                                                <th class={thClass}>Available</th>
+                                                <th class={thClass}>Objects</th>
+                                                <th class={`${thClass} min-w-[120px]`}>Usage</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody class="divide-y divide-gray-100 dark:divide-gray-700">
+                                            <For each={filteredPools()}>
+                                                {(pool) => (
+                                                    <tr class="hover:bg-gray-50/80 dark:hover:bg-gray-700/30 transition-colors">
+                                                        <td class="px-4 py-2.5 font-medium text-sm text-gray-900 dark:text-gray-100">
+                                                            {pool.name}
+                                                        </td>
+                                                        <td class="px-2 py-2.5 text-xs text-gray-600 dark:text-gray-400">
+                                                            {pool.clusterName}
+                                                        </td>
+                                                        <td class="px-2 py-2.5 text-xs text-gray-700 dark:text-gray-300 font-mono">
+                                                            {formatBytes(pool.storedBytes || 0)}
+                                                        </td>
+                                                        <td class="px-2 py-2.5 text-xs text-gray-700 dark:text-gray-300 font-mono">
+                                                            {formatBytes(pool.availableBytes || 0)}
+                                                        </td>
+                                                        <td class="px-2 py-2.5 text-xs text-gray-700 dark:text-gray-300 font-mono">
+                                                            {(pool.objects || 0).toLocaleString()}
+                                                        </td>
+                                                        <td class="px-2 py-2.5">
+                                                            <div class="flex items-center gap-2">
+                                                                <div class="w-16">
+                                                                    <UsageBar percent={pool.percentUsed || 0} size="sm" />
+                                                                </div>
+                                                                <span class="text-xs text-gray-600 dark:text-gray-400 font-mono w-12 text-right">
+                                                                    {(pool.percentUsed || 0).toFixed(1)}%
+                                                                </span>
+                                                            </div>
+                                                        </td>
+                                                    </tr>
+                                                )}
+                                            </For>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </Show>
+                        </Card>
+                    </Show>
+                </Show>
+            </Show>
+        </div>
+    );
+};
+
+export default Ceph;
diff --git a/frontend-modern/src/stores/__tests__/metricsHistory.test.ts b/frontend-modern/src/stores/__tests__/metricsHistory.test.ts
new file mode 100644
index 0000000..65b9191
--- /dev/null
+++ b/frontend-modern/src/stores/__tests__/metricsHistory.test.ts
@@ -0,0 +1,409 @@
+/**
+ * Tests for metricsHistory store functionality
+ * 
+ * These tests focus on the ring buffer operations and metric recording logic.
+ */
+import { describe, expect, it } from 'vitest';
+
+// We can't directly test the module due to side effects (localStorage, window),
+// so we test the core logic patterns used in the implementation.
+
+describe('Ring Buffer Logic', () => {
+    // Implementation of ring buffer matching metricsHistory.ts
+    interface MetricSnapshot {
+        timestamp: number;
+        cpu: number;
+        memory: number;
+        disk: number;
+    }
+
+    interface RingBuffer {
+        buffer: (MetricSnapshot | undefined)[];
+        head: number;
+        size: number;
+    }
+
+    const MAX_POINTS = 100;
+
+    function createRingBuffer(): RingBuffer {
+        return {
+            buffer: new Array(MAX_POINTS),
+            head: 0,
+            size: 0,
+        };
+    }
+
+    function pushToRingBuffer(ring: RingBuffer, snapshot: MetricSnapshot): void {
+        const index = (ring.head + ring.size) % MAX_POINTS;
+        ring.buffer[index] = snapshot;
+
+        if (ring.size < MAX_POINTS) {
+            ring.size++;
+        } else {
+            ring.head = (ring.head + 1) % MAX_POINTS;
+        }
+    }
+
+    function getRingBufferData(ring: RingBuffer, cutoffTime: number): MetricSnapshot[] {
+        const result: MetricSnapshot[] = [];
+
+        for (let i = 0; i < ring.size; i++) {
+            const index = (ring.head + i) % MAX_POINTS;
+            const snapshot = ring.buffer[index];
+
+            if (snapshot && snapshot.timestamp >= cutoffTime) {
+                result.push(snapshot);
+            }
+        }
+
+        return result;
+    }
+
+    describe('createRingBuffer', () => {
+        it('creates an empty ring buffer', () => {
+            const ring = createRingBuffer();
+            expect(ring.head).toBe(0);
+            expect(ring.size).toBe(0);
+            expect(ring.buffer.length).toBe(MAX_POINTS);
+        });
+    });
+
+    describe('pushToRingBuffer', () => {
+        it('adds snapshots to the buffer', () => {
+            const ring = createRingBuffer();
+            const snapshot: MetricSnapshot = {
+                timestamp: Date.now(),
+                cpu: 50,
+                memory: 60,
+                disk: 70,
+            };
+
+            pushToRingBuffer(ring, snapshot);
+
+            expect(ring.size).toBe(1);
+            expect(ring.buffer[0]).toEqual(snapshot);
+        });
+
+        it('increments size correctly', () => {
+            const ring = createRingBuffer();
+
+            for (let i = 0; i < 10; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: Date.now() + i,
+                    cpu: i,
+                    memory: i,
+                    disk: i,
+                });
+            }
+
+            expect(ring.size).toBe(10);
+        });
+
+        it('wraps around and overwrites oldest when full', () => {
+            const ring = createRingBuffer();
+
+            // Fill the buffer
+            for (let i = 0; i < MAX_POINTS; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i,
+                    memory: i,
+                    disk: i,
+                });
+            }
+
+            expect(ring.size).toBe(MAX_POINTS);
+            expect(ring.head).toBe(0);
+
+            // Add one more - should overwrite first entry
+            pushToRingBuffer(ring, {
+                timestamp: 2000,
+                cpu: 999,
+                memory: 999,
+                disk: 999,
+            });
+
+            expect(ring.size).toBe(MAX_POINTS);
+            expect(ring.head).toBe(1); // Head moved forward
+            expect(ring.buffer[0]!.cpu).toBe(999); // New entry at position 0
+        });
+
+        it('maintains O(1) insertion performance', () => {
+            const ring = createRingBuffer();
+            const iterations = 10000;
+            const start = performance.now();
+
+            for (let i = 0; i < iterations; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: Date.now(),
+                    cpu: Math.random() * 100,
+                    memory: Math.random() * 100,
+                    disk: Math.random() * 100,
+                });
+            }
+
+            const duration = performance.now() - start;
+            // Should complete quickly (< 100ms for 10k insertions)
+            expect(duration).toBeLessThan(100);
+        });
+    });
+
+    describe('getRingBufferData', () => {
+        it('returns all data when no cutoff', () => {
+            const ring = createRingBuffer();
+
+            for (let i = 0; i < 5; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i * 10,
+                    memory: i * 10,
+                    disk: i * 10,
+                });
+            }
+
+            const data = getRingBufferData(ring, 0);
+            expect(data).toHaveLength(5);
+        });
+
+        it('returns data in chronological order', () => {
+            const ring = createRingBuffer();
+
+            for (let i = 0; i < 5; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i,
+                    memory: i,
+                    disk: i,
+                });
+            }
+
+            const data = getRingBufferData(ring, 0);
+            expect(data[0].timestamp).toBe(1000);
+            expect(data[4].timestamp).toBe(1004);
+        });
+
+        it('filters by cutoff time', () => {
+            const ring = createRingBuffer();
+
+            for (let i = 0; i < 10; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i,
+                    memory: i,
+                    disk: i,
+                });
+            }
+
+            const data = getRingBufferData(ring, 1005);
+            expect(data).toHaveLength(5); // Only timestamps >= 1005
+            expect(data[0].timestamp).toBe(1005);
+        });
+
+        it('handles wrapped buffer correctly', () => {
+            const ring = createRingBuffer();
+
+            // Fill buffer completely and then some
+            for (let i = 0; i < MAX_POINTS + 20; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i % 100,
+                    memory: i % 100,
+                    disk: i % 100,
+                });
+            }
+
+            const data = getRingBufferData(ring, 0);
+            expect(data).toHaveLength(MAX_POINTS);
+
+            // First entry should be the 21st one (index 20)
+            expect(data[0].timestamp).toBe(1020);
+            // Last entry should be the most recent
+            expect(data[MAX_POINTS - 1].timestamp).toBe(1000 + MAX_POINTS + 19);
+        });
+
+        it('returns empty array for empty buffer', () => {
+            const ring = createRingBuffer();
+            const data = getRingBufferData(ring, 0);
+            expect(data).toHaveLength(0);
+        });
+
+        it('returns empty array when all data is before cutoff', () => {
+            const ring = createRingBuffer();
+
+            for (let i = 0; i < 5; i++) {
+                pushToRingBuffer(ring, {
+                    timestamp: 1000 + i,
+                    cpu: i,
+                    memory: i,
+                    disk: i,
+                });
+            }
+
+            const data = getRingBufferData(ring, 2000);
+            expect(data).toHaveLength(0);
+        });
+    });
+});
+
+describe('Metric Key Generation', () => {
+    // Test metric key pattern matching
+    function buildMetricKey(kind: string, id: string): string {
+        return `${kind}:${id}`;
+    }
+
+    describe('key format', () => {
+        it('creates properly namespaced keys', () => {
+            expect(buildMetricKey('vm', '100')).toBe('vm:100');
+            expect(buildMetricKey('node', 'pve1')).toBe('node:pve1');
+            expect(buildMetricKey('dockerContainer', 'abc123')).toBe('dockerContainer:abc123');
+        });
+
+        it('allows filtering by prefix', () => {
+            const keys = [
+                'vm:100',
+                'vm:101',
+                'node:pve1',
+                'dockerContainer:abc',
+            ];
+
+            const vmKeys = keys.filter(k => k.startsWith('vm:'));
+            expect(vmKeys).toHaveLength(2);
+
+            const dockerKeys = keys.filter(k => k.startsWith('dockerContainer:'));
+            expect(dockerKeys).toHaveLength(1);
+        });
+    });
+});
+
+describe('Time Range Calculations', () => {
+    type TimeRange = '5m' | '15m' | '30m' | '1h' | '4h' | '12h' | '24h' | '7d';
+
+    function timeRangeToMs(range: TimeRange): number {
+        switch (range) {
+            case '5m': return 5 * 60 * 1000;
+            case '15m': return 15 * 60 * 1000;
+            case '30m': return 30 * 60 * 1000;
+            case '1h': return 60 * 60 * 1000;
+            case '4h': return 4 * 60 * 60 * 1000;
+            case '12h': return 12 * 60 * 60 * 1000;
+            case '24h': return 24 * 60 * 60 * 1000;
+            case '7d': return 7 * 24 * 60 * 60 * 1000;
+            default: return 60 * 60 * 1000;
+        }
+    }
+
+    it('converts all time ranges correctly', () => {
+        expect(timeRangeToMs('5m')).toBe(300000);
+        expect(timeRangeToMs('15m')).toBe(900000);
+        expect(timeRangeToMs('30m')).toBe(1800000);
+        expect(timeRangeToMs('1h')).toBe(3600000);
+        expect(timeRangeToMs('4h')).toBe(14400000);
+        expect(timeRangeToMs('12h')).toBe(43200000);
+        expect(timeRangeToMs('24h')).toBe(86400000);
+        expect(timeRangeToMs('7d')).toBe(604800000);
+    });
+
+    it('calculates correct cutoff times', () => {
+        const now = Date.now();
+        const oneHourAgo = now - timeRangeToMs('1h');
+
+        expect(now - oneHourAgo).toBe(3600000);
+    });
+});
+
+describe('Sample Interval Enforcement', () => {
+    const SAMPLE_INTERVAL_MS = 30 * 1000; // 30 seconds
+
+    function shouldRecordSample(lastSampleTime: number, now: number): boolean {
+        return now - lastSampleTime >= SAMPLE_INTERVAL_MS;
+    }
+
+    it('allows recording when interval has passed', () => {
+        const now = Date.now();
+        const lastSample = now - 31000; // 31 seconds ago
+        expect(shouldRecordSample(lastSample, now)).toBe(true);
+    });
+
+    it('blocks recording when too soon', () => {
+        const now = Date.now();
+        const lastSample = now - 15000; // 15 seconds ago
+        expect(shouldRecordSample(lastSample, now)).toBe(false);
+    });
+
+    it('allows recording exactly at interval', () => {
+        const now = Date.now();
+        const lastSample = now - SAMPLE_INTERVAL_MS;
+        expect(shouldRecordSample(lastSample, now)).toBe(true);
+    });
+
+    it('always allows first sample (lastSample = 0)', () => {
+        const now = Date.now();
+        expect(shouldRecordSample(0, now)).toBe(true);
+    });
+});
+
+describe('Metric Value Rounding', () => {
+    function roundMetric(value: number): number {
+        return Math.round(value * 10) / 10;
+    }
+
+    it('rounds to 1 decimal place', () => {
+        expect(roundMetric(45.123)).toBe(45.1);
+        expect(roundMetric(45.156)).toBe(45.2);
+        expect(roundMetric(45.149)).toBe(45.1);
+        expect(roundMetric(100.0)).toBe(100.0);
+        expect(roundMetric(0.05)).toBe(0.1);
+        expect(roundMetric(0.04)).toBe(0.0);
+    });
+
+    it('handles edge cases', () => {
+        expect(roundMetric(0)).toBe(0);
+        expect(roundMetric(-45.123)).toBe(-45.1);
+        expect(roundMetric(99.95)).toBe(100.0);
+    });
+});
+
+describe('Duplicate Timestamp Prevention', () => {
+    interface MetricSnapshot {
+        timestamp: number;
+        cpu: number;
+    }
+
+    function shouldSkipDuplicate(
+        existingData: MetricSnapshot[],
+        newTimestamp: number,
+        toleranceMs: number = 15000
+    ): boolean {
+        for (const existing of existingData) {
+            if (Math.abs(existing.timestamp - newTimestamp) < toleranceMs) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    it('skips timestamps within tolerance', () => {
+        const existing: MetricSnapshot[] = [
+            { timestamp: 1000000, cpu: 50 },
+            { timestamp: 1030000, cpu: 55 },
+        ];
+
+        // Within 15s of existing
+        expect(shouldSkipDuplicate(existing, 1010000)).toBe(true);
+        expect(shouldSkipDuplicate(existing, 1025000)).toBe(true);
+    });
+
+    it('allows timestamps outside tolerance', () => {
+        const existing: MetricSnapshot[] = [
+            { timestamp: 1000000, cpu: 50 },
+        ];
+
+        // More than 15s from existing
+        expect(shouldSkipDuplicate(existing, 1020000)).toBe(false);
+    });
+
+    it('allows all timestamps when no existing data', () => {
+        const existing: MetricSnapshot[] = [];
+        expect(shouldSkipDuplicate(existing, 1000000)).toBe(false);
+    });
+});
diff --git a/frontend-modern/src/stores/aiChat.ts b/frontend-modern/src/stores/aiChat.ts
new file mode 100644
index 0000000..ef84812
--- /dev/null
+++ b/frontend-modern/src/stores/aiChat.ts
@@ -0,0 +1,210 @@
+import { createSignal } from 'solid-js';
+
+interface AIChatContext {
+  targetType?: string;
+  targetId?: string;
+  context?: Record<string, unknown>;
+  initialPrompt?: string;
+  findingId?: string; // If opened from AI Insights "Get Help", the finding ID to resolve on success
+}
+
+// A single context item that can be accumulated
+interface ContextItem {
+  id: string; // unique identifier (e.g., "vm-delly-101")
+  type: string; // "vm", "container", "storage", "node", etc.
+  name: string; // display name
+  data: Record<string, unknown>; // the actual context data
+  addedAt: Date;
+}
+
+// Message type for persisted conversation
+interface Message {
+  id: string;
+  role: 'user' | 'assistant';
+  content: string;
+  timestamp: Date;
+  model?: string;
+  tokens?: { input: number; output: number };
+  toolCalls?: Array<{
+    name: string;
+    input: string;
+    output: string;
+    success: boolean;
+  }>;
+}
+
+// Global state for the AI chat drawer
+const [isAIChatOpen, setIsAIChatOpen] = createSignal(false);
+const [aiChatContext, setAIChatContext] = createSignal<AIChatContext>({});
+const [contextItems, setContextItems] = createSignal<ContextItem[]>([]);
+const [messages, setMessages] = createSignal<Message[]>([]);
+const [aiEnabled, setAiEnabled] = createSignal<boolean | null>(null); // null = not checked yet
+
+// Store reference to AI input for focusing from keyboard shortcuts
+let aiInputRef: HTMLTextAreaElement | null = null;
+
+export const aiChatStore = {
+  // Check if chat is open
+  get isOpen() {
+    return isAIChatOpen();
+  },
+
+  // Get current context (legacy single-item)
+  get context() {
+    return aiChatContext();
+  },
+
+  // Get all accumulated context items
+  get contextItems() {
+    return contextItems();
+  },
+
+  // Get messages (for persistence)
+  get messages() {
+    return messages();
+  },
+
+  // Get AI enabled state
+  get enabled() {
+    return aiEnabled();
+  },
+
+  // Check if a specific item is in context
+  hasContextItem(id: string) {
+    return contextItems().some(item => item.id === id);
+  },
+
+  // Set AI enabled state (called from settings check)
+  setEnabled(enabled: boolean) {
+    setAiEnabled(enabled);
+  },
+
+  // Set messages (for persistence from AIChat component)
+  setMessages(msgs: Message[]) {
+    setMessages(msgs);
+  },
+
+  // Toggle the AI chat panel
+  toggle() {
+    setIsAIChatOpen(!isAIChatOpen());
+  },
+
+  // Open the AI chat with optional context
+  open(context?: AIChatContext) {
+    if (context) {
+      setAIChatContext(context);
+    }
+    setIsAIChatOpen(true);
+  },
+
+  // Close the AI chat
+  close() {
+    setIsAIChatOpen(false);
+    // Keep context and messages for when user reopens
+  },
+
+  // Update context without opening (for navigation-based context changes)
+  setContext(context: AIChatContext) {
+    setAIChatContext(context);
+  },
+
+  // Clear single-item context (legacy)
+  clearContext() {
+    setAIChatContext({});
+  },
+
+  // Add an item to the context (accumulative)
+  addContextItem(type: string, id: string, name: string, data: Record<string, unknown>) {
+    setContextItems(prev => {
+      // Don't add duplicates
+      if (prev.some(item => item.id === id)) {
+        // Update existing item with new data
+        return prev.map(item =>
+          item.id === id
+            ? { ...item, data, addedAt: new Date() }
+            : item
+        );
+      }
+      return [...prev, { id, type, name, data, addedAt: new Date() }];
+    });
+    // Also update legacy context to point to most recently added
+    setAIChatContext({
+      targetType: type,
+      targetId: id,
+      context: data,
+    });
+  },
+
+  // Remove an item from context
+  removeContextItem(id: string) {
+    setContextItems(prev => prev.filter(item => item.id !== id));
+    // Update legacy context if we removed the current one
+    const current = aiChatContext();
+    if (current.targetId === id) {
+      const remaining = contextItems().filter(item => item.id !== id);
+      if (remaining.length > 0) {
+        const last = remaining[remaining.length - 1];
+        setAIChatContext({
+          targetType: last.type,
+          targetId: last.id,
+          context: last.data,
+        });
+      } else {
+        setAIChatContext({});
+      }
+    }
+  },
+
+  // Clear all context items
+  clearAllContext() {
+    setContextItems([]);
+    setAIChatContext({});
+  },
+
+  // Clear conversation (start fresh)
+  clearConversation() {
+    setMessages([]);
+  },
+
+  // Convenience method to update context for a specific target (host, VM, container, etc.)
+  // This is called when user selects/views a specific resource
+  setTargetContext(targetType: string, targetId: string, additionalContext?: Record<string, unknown>) {
+    // Use addContextItem instead of replacing
+    const name = (additionalContext?.guestName as string) ||
+      (additionalContext?.name as string) ||
+      targetId;
+    this.addContextItem(targetType, targetId, name, additionalContext || {});
+  },
+
+  // Open for a specific target - opens the panel and adds to context
+  openForTarget(targetType: string, targetId: string, additionalContext?: Record<string, unknown>) {
+    const name = (additionalContext?.guestName as string) ||
+      (additionalContext?.name as string) ||
+      targetId;
+    this.addContextItem(targetType, targetId, name, additionalContext || {});
+    setIsAIChatOpen(true);
+  },
+
+  // Open with a pre-filled prompt
+  openWithPrompt(prompt: string, context?: Omit<AIChatContext, 'initialPrompt'>) {
+    setAIChatContext({
+      ...context,
+      initialPrompt: prompt,
+    });
+    setIsAIChatOpen(true);
+  },
+
+  // Register the AI input element (called by AIChat component)
+  registerInput(ref: HTMLTextAreaElement | null) {
+    aiInputRef = ref;
+  },
+
+  // Focus the AI input (called by keyboard handlers)
+  focusInput() {
+    if (aiInputRef && isAIChatOpen()) {
+      aiInputRef.focus();
+      return true;
+    }
+    return false;
+  },
+};
diff --git a/frontend-modern/src/stores/metricsHistory.ts b/frontend-modern/src/stores/metricsHistory.ts
index 60f17ce..569ca0e 100644
--- a/frontend-modern/src/stores/metricsHistory.ts
+++ b/frontend-modern/src/stores/metricsHistory.ts
@@ -6,6 +6,8 @@
  */
 
 import { logger } from '@/utils/logger';
+import { ChartsAPI, type ChartData, type TimeRange } from '@/api/charts';
+import { buildMetricKey } from '@/utils/metricsKeys';
 
 export interface MetricSnapshot {
   timestamp: number; // Unix timestamp in ms
@@ -21,11 +23,28 @@ interface RingBuffer {
 }
 
 // Configuration
-const MAX_AGE_MS = 2 * 60 * 60 * 1000; // 2 hours
+const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours (to support all time ranges)
 const SAMPLE_INTERVAL_MS = 30 * 1000;   // 30 seconds
-const MAX_POINTS = Math.ceil(MAX_AGE_MS / SAMPLE_INTERVAL_MS); // ~240 points
+const MAX_POINTS = Math.ceil(MAX_AGE_MS / SAMPLE_INTERVAL_MS); // ~2880 points
 const STORAGE_KEY = 'pulse_metrics_history';
-const STORAGE_VERSION = 1;
+const STORAGE_VERSION = 2; // Bumped version due to increased buffer size
+
+/**
+ * Convert TimeRange string to milliseconds
+ */
+function timeRangeToMs(range: TimeRange): number {
+  switch (range) {
+    case '5m': return 5 * 60 * 1000;
+    case '15m': return 15 * 60 * 1000;
+    case '30m': return 30 * 60 * 1000;
+    case '1h': return 60 * 60 * 1000;
+    case '4h': return 4 * 60 * 60 * 1000;
+    case '12h': return 12 * 60 * 60 * 1000;
+    case '24h': return 24 * 60 * 60 * 1000;
+    case '7d': return 7 * 24 * 60 * 60 * 1000;
+    default: return 60 * 60 * 1000; // Default 1h
+  }
+}
 
 // Store - map of resourceId to ring buffer
 const metricsHistoryMap = new Map<string, RingBuffer>();
@@ -33,6 +52,17 @@ const metricsHistoryMap = new Map<string, RingBuffer>();
 // Track last sample time per resource to enforce sampling interval
 const lastSampleTimes = new Map<string, number>();
 
+// Reactive version counter - increments when data is seeded, used to trigger component re-renders
+import { createSignal } from 'solid-js';
+const [metricsVersion, setMetricsVersion] = createSignal(0);
+
+/**
+ * Get the current metrics version (for reactivity)
+ */
+export function getMetricsVersion(): number {
+  return metricsVersion();
+}
+
 /**
  * Create a new ring buffer
  */
@@ -218,8 +248,205 @@ function debouncedSave() {
   }, 5000); // Save 5 seconds after last change
 }
 
+// Track if we've already seeded from backend to avoid redundant fetches
+let hasSeededFromBackend = false;
+let seedingPromise: Promise<void> | null = null;
+
 /**
- * Get metric history for a resource
+ * Seed metrics history from backend historical data.
+ * This provides immediate trend data instead of waiting for 30s samples.
+ * Called automatically when switching to sparklines/trends view.
+ */
+export async function seedFromBackend(range: TimeRange = '1h'): Promise<void> {
+  // Don't re-fetch if we've already seeded
+  if (hasSeededFromBackend) {
+    return;
+  }
+
+  // If already seeding, wait for that request
+  if (seedingPromise) {
+    return seedingPromise;
+  }
+
+  seedingPromise = (async () => {
+    try {
+      logger.info('[MetricsHistory] Seeding from backend', { range });
+      const response = await ChartsAPI.getCharts(range);
+
+      const now = Date.now();
+      const cutoff = now - MAX_AGE_MS;
+      let seededCount = 0;
+
+      // Helper to convert backend ChartData to our MetricSnapshot format
+      const processChartData = (resourceId: string, chartData: ChartData) => {
+        const cpuPoints = chartData.cpu || [];
+        const memPoints = chartData.memory || [];
+        const diskPoints = chartData.disk || [];
+
+        // If no data, skip
+        if (cpuPoints.length === 0 && memPoints.length === 0 && diskPoints.length === 0) {
+          return;
+        }
+
+        // Get or create ring buffer
+        let ring = metricsHistoryMap.get(resourceId);
+        if (!ring) {
+          ring = createRingBuffer();
+          metricsHistoryMap.set(resourceId, ring);
+        }
+
+        // Find all unique timestamps across all metrics
+        const timestampSet = new Set<number>();
+        cpuPoints.forEach(p => timestampSet.add(p.timestamp));
+        memPoints.forEach(p => timestampSet.add(p.timestamp));
+        diskPoints.forEach(p => timestampSet.add(p.timestamp));
+
+        // Create lookup maps for efficient access
+        const cpuMap = new Map(cpuPoints.map(p => [p.timestamp, p.value]));
+        const memMap = new Map(memPoints.map(p => [p.timestamp, p.value]));
+        const diskMap = new Map(diskPoints.map(p => [p.timestamp, p.value]));
+
+        // Sort timestamps and create snapshots
+        const timestamps = Array.from(timestampSet).sort((a, b) => a - b);
+
+        for (const ts of timestamps) {
+          // Skip if too old
+          if (ts < cutoff) continue;
+
+          // Skip if we already have data around this timestamp (within 15s)
+          let skipDuplicate = false;
+          for (let i = 0; i < ring.size; i++) {
+            const idx = (ring.head + i) % MAX_POINTS;
+            const existing = ring.buffer[idx];
+            if (existing && Math.abs(existing.timestamp - ts) < 15000) {
+              skipDuplicate = true;
+              break;
+            }
+          }
+          if (skipDuplicate) continue;
+
+          const snapshot: MetricSnapshot = {
+            timestamp: ts,
+            cpu: Math.round((cpuMap.get(ts) ?? 0) * 10) / 10,
+            memory: Math.round((memMap.get(ts) ?? 0) * 10) / 10,
+            disk: Math.round((diskMap.get(ts) ?? 0) * 10) / 10,
+          };
+
+          pushToRingBuffer(ring, snapshot);
+          seededCount++;
+        }
+      };
+
+      // Process VMs and containers using backend-provided guest types
+      // This avoids race conditions with WebSocket state
+      if (response.data) {
+        // Use guestTypes from backend response (available since backend update)
+        // Falls back to WebSocket state for backwards compatibility
+        let guestTypeMap: Map<string, 'vm' | 'container'>;
+
+        if (response.guestTypes) {
+          // Preferred: Use backend-provided types (no race condition)
+          guestTypeMap = new Map(Object.entries(response.guestTypes) as [string, 'vm' | 'container'][]);
+          logger.debug('[MetricsHistory] Using backend-provided guestTypes', { count: guestTypeMap.size });
+        } else {
+          // Fallback: Try WebSocket state (legacy backends without guestTypes)
+          guestTypeMap = new Map<string, 'vm' | 'container'>();
+          try {
+            const { getGlobalWebSocketStore } = await import('./websocket-global');
+            const wsStore = getGlobalWebSocketStore();
+            const state = wsStore?.state;
+
+            if (state?.vms) {
+              for (const vm of state.vms) {
+                if (vm.id) guestTypeMap.set(vm.id, 'vm');
+              }
+            }
+            if (state?.containers) {
+              for (const ct of state.containers) {
+                if (ct.id) guestTypeMap.set(ct.id, 'container');
+              }
+            }
+          } catch {
+            logger.warn('[MetricsHistory] Failed to load WebSocket state for guest types');
+          }
+          logger.debug('[MetricsHistory] Using WebSocket state for guestTypes', { count: guestTypeMap.size });
+        }
+
+        for (const [id, chartData] of Object.entries(response.data)) {
+          // Look up the guest type, default to 'vm' if unknown
+          const guestType = guestTypeMap.get(id) ?? 'vm';
+          const resourceKey = buildMetricKey(guestType, id);
+          processChartData(resourceKey, chartData as ChartData);
+        }
+      }
+
+      // Process nodes
+      if (response.nodeData) {
+        for (const [id, chartData] of Object.entries(response.nodeData)) {
+          const resourceKey = buildMetricKey('node', id);
+          processChartData(resourceKey, chartData as ChartData);
+        }
+      }
+
+      // Process Docker containers
+      if (response.dockerData) {
+        for (const [id, chartData] of Object.entries(response.dockerData)) {
+          const resourceKey = buildMetricKey('dockerContainer', id);
+          processChartData(resourceKey, chartData as ChartData);
+        }
+        logger.debug('[MetricsHistory] Processed Docker container data', {
+          count: Object.keys(response.dockerData).length
+        });
+      }
+
+      // Process Docker hosts
+      if (response.dockerHostData) {
+        for (const [id, chartData] of Object.entries(response.dockerHostData)) {
+          const resourceKey = buildMetricKey('dockerHost', id);
+          processChartData(resourceKey, chartData as ChartData);
+        }
+        logger.debug('[MetricsHistory] Processed Docker host data', {
+          count: Object.keys(response.dockerHostData).length
+        });
+      }
+
+
+      hasSeededFromBackend = true;
+      logger.info('[MetricsHistory] Seeded from backend', { seededCount, totalResources: metricsHistoryMap.size });
+
+      // Increment version to trigger reactive component updates
+      setMetricsVersion(v => v + 1);
+
+      // Save to localStorage
+      saveToLocalStorage();
+    } catch (error) {
+      logger.error('[MetricsHistory] Failed to seed from backend', { error });
+      // Don't throw - gracefully degrade to client-side sampling
+    } finally {
+      seedingPromise = null;
+    }
+  })();
+
+  return seedingPromise;
+}
+
+/**
+ * Force re-seed from backend (useful when range changes)
+ */
+export function resetSeedingState(): void {
+  hasSeededFromBackend = false;
+}
+
+/**
+ * Check if we have seeded from backend
+ */
+export function hasSeedData(): boolean {
+  return hasSeededFromBackend;
+}
+
+
+/**
+ * Get metric history for a resource (full history)
  */
 export function getMetricHistory(resourceId: string): MetricSnapshot[] {
   const ring = metricsHistoryMap.get(resourceId);
@@ -229,6 +456,18 @@ export function getMetricHistory(resourceId: string): MetricSnapshot[] {
   return getRingBufferData(ring, cutoffTime);
 }
 
+/**
+ * Get metric history for a resource filtered by time range
+ */
+export function getMetricHistoryForRange(resourceId: string, range: TimeRange): MetricSnapshot[] {
+  const ring = metricsHistoryMap.get(resourceId);
+  if (!ring) return [];
+
+  const rangeMs = timeRangeToMs(range);
+  const cutoffTime = Date.now() - rangeMs;
+  return getRingBufferData(ring, cutoffTime);
+}
+
 /**
  * Clear history for a specific resource
  */
diff --git a/frontend-modern/src/stores/metricsViewMode.ts b/frontend-modern/src/stores/metricsViewMode.ts
index 4d0df7e..a3979c5 100644
--- a/frontend-modern/src/stores/metricsViewMode.ts
+++ b/frontend-modern/src/stores/metricsViewMode.ts
@@ -2,15 +2,26 @@
  * Metrics View Mode Store
  *
  * Global preference for displaying metrics as progress bars or sparklines.
+ * Also manages the time range for sparkline data.
  * This affects all tables: node summaries, guest tables, and container tables.
  */
 
 import { createSignal } from 'solid-js';
 import { STORAGE_KEYS } from '@/utils/localStorage';
+import { seedFromBackend, resetSeedingState } from './metricsHistory';
+import type { TimeRange } from '@/api/charts';
 
 export type MetricsViewMode = 'bars' | 'sparklines';
 
-// Read initial value from localStorage
+// Available time ranges for sparklines
+export const TIME_RANGE_OPTIONS: { value: TimeRange; label: string }[] = [
+  { value: '15m', label: '15m' },
+  { value: '1h', label: '1h' },
+  { value: '4h', label: '4h' },
+  { value: '24h', label: '24h' },
+];
+
+// Read initial view mode from localStorage
 const getInitialViewMode = (): MetricsViewMode => {
   if (typeof window === 'undefined') return 'bars';
 
@@ -26,11 +37,31 @@ const getInitialViewMode = (): MetricsViewMode => {
   return 'bars'; // Default to bars (current behavior)
 };
 
-// Create signal
+// Read initial time range from localStorage
+const getInitialTimeRange = (): TimeRange => {
+  if (typeof window === 'undefined') return '1h';
+
+  try {
+    const stored = localStorage.getItem(STORAGE_KEYS.METRICS_TIME_RANGE);
+    if (stored && ['5m', '15m', '30m', '1h', '4h', '12h', '24h', '7d'].includes(stored)) {
+      return stored as TimeRange;
+    }
+  } catch (_err) {
+    // Ignore localStorage errors
+  }
+
+  return '1h'; // Default to 1 hour
+};
+
+// Create signals
 const [metricsViewMode, setMetricsViewMode] = createSignal<MetricsViewMode>(
   getInitialViewMode()
 );
 
+const [metricsTimeRange, setMetricsTimeRange] = createSignal<TimeRange>(
+  getInitialTimeRange()
+);
+
 /**
  * Get the current metrics view mode
  */
@@ -38,6 +69,13 @@ export function getMetricsViewMode(): MetricsViewMode {
   return metricsViewMode();
 }
 
+/**
+ * Get the current metrics time range
+ */
+export function getMetricsTimeRange(): TimeRange {
+  return metricsTimeRange();
+}
+
 /**
  * Set the metrics view mode and persist to localStorage
  */
@@ -52,6 +90,41 @@ export function setMetricsViewModePreference(mode: MetricsViewMode): void {
       console.warn('Failed to save metrics view mode preference', err);
     }
   }
+
+  // When switching to sparklines, seed historical data from backend
+  if (mode === 'sparklines') {
+    // Fire and forget - don't block the UI
+    seedFromBackend(metricsTimeRange()).catch(() => {
+      // Errors are already logged in seedFromBackend
+    });
+  }
+}
+
+/**
+ * Set the metrics time range and persist to localStorage
+ */
+export function setMetricsTimeRangePreference(range: TimeRange): void {
+  const previousRange = metricsTimeRange();
+  setMetricsTimeRange(range);
+
+  if (typeof window !== 'undefined') {
+    try {
+      localStorage.setItem(STORAGE_KEYS.METRICS_TIME_RANGE, range);
+    } catch (err) {
+      // Ignore localStorage errors
+      console.warn('Failed to save metrics time range preference', err);
+    }
+  }
+
+  // If we're in sparklines mode and range changed, re-seed from backend
+  if (metricsViewMode() === 'sparklines' && range !== previousRange) {
+    // Reset seeding state to force a fresh fetch
+    resetSeedingState();
+    // Fire and forget - don't block the UI
+    seedFromBackend(range).catch(() => {
+      // Errors are already logged in seedFromBackend
+    });
+  }
 }
 
 /**
@@ -71,5 +144,7 @@ export function useMetricsViewMode() {
     viewMode: metricsViewMode,
     setViewMode: setMetricsViewModePreference,
     toggle: toggleMetricsViewMode,
+    timeRange: metricsTimeRange,
+    setTimeRange: setMetricsTimeRangePreference,
   };
 }
diff --git a/frontend-modern/src/stores/websocket.ts b/frontend-modern/src/stores/websocket.ts
index 78c4443..e420a91 100644
--- a/frontend-modern/src/stores/websocket.ts
+++ b/frontend-modern/src/stores/websocket.ts
@@ -10,6 +10,8 @@ import type {
   Container,
   DockerHost,
   Host,
+  KubernetesCluster,
+  RemovedKubernetesCluster,
 } from '@/types/api';
 import type { ActivationState as ActivationStateType } from '@/types/alerts';
 import { logger } from '@/utils/logger';
@@ -30,6 +32,8 @@ export function createWebSocketStore(url: string) {
     vms: [],
     containers: [],
     dockerHosts: [],
+    kubernetesClusters: [],
+    removedKubernetesClusters: [],
     hosts: [],
     replicationJobs: [],
     storage: [],
@@ -74,6 +78,8 @@ export function createWebSocketStore(url: string) {
     activeAlerts: [],
     recentlyResolved: [],
     lastUpdate: '',
+    // Unified resources for cross-platform monitoring
+    resources: [],
   });
   const [activeAlerts, setActiveAlerts] = createStore<Record<string, Alert>>({});
   const [recentlyResolved, setRecentlyResolved] = createStore<Record<string, ResolvedAlert>>({});
@@ -328,16 +334,17 @@ export function createWebSocketStore(url: string) {
       try {
         const message: WSMessage = data;
 
-        if (
-          message.type === WEBSOCKET.MESSAGE_TYPES.INITIAL_STATE ||
-          message.type === WEBSOCKET.MESSAGE_TYPES.RAW_DATA
-        ) {
-          // Update state properties individually to ensure reactivity
-          if (message.data) {
-            // Mark that we've received usable data (initial payload or raw update)
-            if (!initialDataReceived()) {
-              setInitialDataReceived(true);
-            }
+	        if (
+	          message.type === WEBSOCKET.MESSAGE_TYPES.INITIAL_STATE ||
+	          message.type === WEBSOCKET.MESSAGE_TYPES.RAW_DATA
+	        ) {
+	          // Update state properties individually, but batch the whole payload to
+	          // reduce reactive recomputations and UI thrash on large updates.
+	          if (message.data) batch(() => {
+	            // Mark that we've received usable data (initial payload or raw update)
+	            if (!initialDataReceived()) {
+	              setInitialDataReceived(true);
+	            }
 
             // Only update if we have actual data, don't overwrite with empty arrays
             if (message.data.nodes !== undefined) {
@@ -550,6 +557,18 @@ export function createWebSocketStore(url: string) {
                 setState('hosts', reconcile(processedHosts, { key: 'id' }));
               }
             }
+            if (message.data.kubernetesClusters !== undefined) {
+              const clusters = Array.isArray(message.data.kubernetesClusters)
+                ? (message.data.kubernetesClusters as KubernetesCluster[])
+                : [];
+              setState('kubernetesClusters', reconcile(clusters, { key: 'id' }));
+            }
+            if (message.data.removedKubernetesClusters !== undefined) {
+              const removed = Array.isArray(message.data.removedKubernetesClusters)
+                ? (message.data.removedKubernetesClusters as RemovedKubernetesCluster[])
+                : [];
+              setState('removedKubernetesClusters', reconcile(removed, { key: 'id' }));
+            }
             if (message.data.storage !== undefined) setState('storage', reconcile(message.data.storage, { key: 'id' }));
             if (message.data.cephClusters !== undefined)
               setState('cephClusters', reconcile(message.data.cephClusters, { key: 'id' }));
@@ -580,6 +599,14 @@ export function createWebSocketStore(url: string) {
             if (message.data.stats !== undefined) setState('stats', message.data.stats);
             if (message.data.physicalDisks !== undefined)
               setState('physicalDisks', reconcile(message.data.physicalDisks, { key: 'id' }));
+            // Handle unified resources
+            if (message.data.resources !== undefined) {
+              logger.debug('[WebSocket] Updating resources', {
+                count: message.data.resources?.length || 0,
+                types: [...new Set(message.data.resources?.map((r: any) => r.type) || [])],
+              });
+              setState('resources', reconcile(message.data.resources, { key: 'id' }));
+            }
             // Sync active alerts from state
             if (message.data.activeAlerts !== undefined) {
               const newAlerts: Record<string, Alert> = {};
@@ -619,11 +646,11 @@ export function createWebSocketStore(url: string) {
 
               // Updated recentlyResolved
             }
-            setState('lastUpdate', message.data.lastUpdate || new Date().toISOString());
-          }
-          logger.debug('message', {
-            type: message.type,
-            hasData: !!message.data,
+	            setState('lastUpdate', message.data.lastUpdate || new Date().toISOString());
+	          });
+	          logger.debug('message', {
+	            type: message.type,
+	            hasData: !!message.data,
             nodeCount: message.data?.nodes?.length || 0,
             vmCount: message.data?.vms?.length || 0,
             containerCount: message.data?.containers?.length || 0,
diff --git a/frontend-modern/src/styles/animations.css b/frontend-modern/src/styles/animations.css
index 3668a55..03b660b 100644
--- a/frontend-modern/src/styles/animations.css
+++ b/frontend-modern/src/styles/animations.css
@@ -210,3 +210,53 @@
 .node-click {
   animation: nodeClick 0.15s ease-out;
 }
+
+/* AI Context row highlight - subtle left accent bar */
+/* Using purple-500 for a clean, modern look */
+
+.ai-context-row {
+  background-color: rgba(147, 51, 234, 0.04);
+  box-shadow: inset 3px 0 0 0 rgba(147, 51, 234, 0.6);
+}
+
+.ai-context-row:hover {
+  background-color: rgba(147, 51, 234, 0.08);
+}
+
+/* Adjacent rows - keep the left border consistent */
+.ai-context-row.ai-context-no-top,
+.ai-context-row.ai-context-no-bottom,
+.ai-context-row.ai-context-no-top.ai-context-no-bottom {
+  background-color: rgba(147, 51, 234, 0.04);
+  box-shadow: inset 3px 0 0 0 rgba(147, 51, 234, 0.6);
+}
+
+.ai-context-row.ai-context-no-top:hover,
+.ai-context-row.ai-context-no-bottom:hover,
+.ai-context-row.ai-context-no-top.ai-context-no-bottom:hover {
+  background-color: rgba(147, 51, 234, 0.08);
+}
+
+/* Dark mode - using purple-400 for better visibility */
+.dark .ai-context-row {
+  background-color: rgba(167, 139, 250, 0.06);
+  box-shadow: inset 3px 0 0 0 rgba(167, 139, 250, 0.5);
+}
+
+.dark .ai-context-row:hover {
+  background-color: rgba(167, 139, 250, 0.12);
+}
+
+.dark .ai-context-row.ai-context-no-top,
+.dark .ai-context-row.ai-context-no-bottom,
+.dark .ai-context-row.ai-context-no-top.ai-context-no-bottom {
+  background-color: rgba(167, 139, 250, 0.06);
+  box-shadow: inset 3px 0 0 0 rgba(167, 139, 250, 0.5);
+}
+
+.dark .ai-context-row.ai-context-no-top:hover,
+.dark .ai-context-row.ai-context-no-bottom:hover,
+.dark .ai-context-row.ai-context-no-top.ai-context-no-bottom:hover {
+  background-color: rgba(167, 139, 250, 0.12);
+}
+
diff --git a/frontend-modern/src/types/__tests__/resource.test.ts b/frontend-modern/src/types/__tests__/resource.test.ts
new file mode 100644
index 0000000..b9783f4
--- /dev/null
+++ b/frontend-modern/src/types/__tests__/resource.test.ts
@@ -0,0 +1,251 @@
+/**
+ * Tests for resource type guards and helper functions
+ */
+import { describe, expect, it } from 'vitest';
+import {
+    isInfrastructure,
+    isWorkload,
+    isStorage,
+    getDisplayName,
+    getCpuPercent,
+    getMemoryPercent,
+    getDiskPercent,
+    type Resource,
+    type ResourceType,
+} from '@/types/resource';
+
+// Helper to create a minimal resource for testing
+function createResource(overrides: Partial<Resource> = {}): Resource {
+    return {
+        id: 'test-1',
+        type: 'vm',
+        name: 'test-resource',
+        displayName: '',
+        platformId: 'platform-1',
+        platformType: 'proxmox-pve',
+        sourceType: 'api',
+        status: 'running',
+        lastSeen: Date.now(),
+        ...overrides,
+    };
+}
+
+describe('Resource Type Guards', () => {
+    describe('isInfrastructure', () => {
+        const infrastructureTypes: ResourceType[] = ['node', 'host', 'docker-host', 'k8s-node', 'truenas'];
+        const nonInfrastructureTypes: ResourceType[] = ['vm', 'container', 'docker-container', 'pod', 'jail', 'storage'];
+
+        it.each(infrastructureTypes)('returns true for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isInfrastructure(resource)).toBe(true);
+        });
+
+        it.each(nonInfrastructureTypes)('returns false for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isInfrastructure(resource)).toBe(false);
+        });
+    });
+
+    describe('isWorkload', () => {
+        const workloadTypes: ResourceType[] = ['vm', 'container', 'docker-container', 'pod', 'jail'];
+        const nonWorkloadTypes: ResourceType[] = ['node', 'host', 'docker-host', 'storage', 'pbs'];
+
+        it.each(workloadTypes)('returns true for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isWorkload(resource)).toBe(true);
+        });
+
+        it.each(nonWorkloadTypes)('returns false for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isWorkload(resource)).toBe(false);
+        });
+    });
+
+    describe('isStorage', () => {
+        const storageTypes: ResourceType[] = ['storage', 'datastore', 'pool', 'dataset'];
+        const nonStorageTypes: ResourceType[] = ['vm', 'node', 'container', 'docker-host'];
+
+        it.each(storageTypes)('returns true for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isStorage(resource)).toBe(true);
+        });
+
+        it.each(nonStorageTypes)('returns false for %s', (type) => {
+            const resource = createResource({ type });
+            expect(isStorage(resource)).toBe(false);
+        });
+    });
+});
+
+describe('Resource Helper Functions', () => {
+    describe('getDisplayName', () => {
+        it('returns displayName when set', () => {
+            const resource = createResource({ name: 'machine-1', displayName: 'Production Server' });
+            expect(getDisplayName(resource)).toBe('Production Server');
+        });
+
+        it('returns name when displayName is empty', () => {
+            const resource = createResource({ name: 'machine-1', displayName: '' });
+            expect(getDisplayName(resource)).toBe('machine-1');
+        });
+
+        it('returns name when displayName is undefined', () => {
+            const resource = createResource({ name: 'machine-1' });
+            // Force displayName to be falsy
+            (resource as any).displayName = undefined;
+            expect(getDisplayName(resource)).toBe('machine-1');
+        });
+    });
+
+    describe('getCpuPercent', () => {
+        it('returns current CPU value when available', () => {
+            const resource = createResource({ cpu: { current: 75.5 } });
+            expect(getCpuPercent(resource)).toBe(75.5);
+        });
+
+        it('returns 0 when cpu is undefined', () => {
+            const resource = createResource({});
+            expect(getCpuPercent(resource)).toBe(0);
+        });
+
+        it('returns 0 when cpu.current is undefined', () => {
+            const resource = createResource({ cpu: {} as any });
+            expect(getCpuPercent(resource)).toBe(0);
+        });
+    });
+
+    describe('getMemoryPercent', () => {
+        it('calculates percentage from used/total when available', () => {
+            const resource = createResource({
+                memory: { current: 0, total: 1000, used: 250 },
+            });
+            expect(getMemoryPercent(resource)).toBe(25);
+        });
+
+        it('returns current when used/total not available', () => {
+            const resource = createResource({
+                memory: { current: 45.5 },
+            });
+            expect(getMemoryPercent(resource)).toBe(45.5);
+        });
+
+        it('returns 0 when memory is undefined', () => {
+            const resource = createResource({});
+            expect(getMemoryPercent(resource)).toBe(0);
+        });
+
+        it('handles zero total gracefully', () => {
+            const resource = createResource({
+                memory: { current: 50, total: 0, used: 0 },
+            });
+            // When total is 0 (falsy), it should fall back to current
+            expect(getMemoryPercent(resource)).toBe(50);
+        });
+    });
+
+    describe('getDiskPercent', () => {
+        it('calculates percentage from used/total when available', () => {
+            const resource = createResource({
+                disk: { current: 0, total: 1000000000, used: 500000000 },
+            });
+            expect(getDiskPercent(resource)).toBe(50);
+        });
+
+        it('returns current when used/total not available', () => {
+            const resource = createResource({
+                disk: { current: 80.2 },
+            });
+            expect(getDiskPercent(resource)).toBe(80.2);
+        });
+
+        it('returns 0 when disk is undefined', () => {
+            const resource = createResource({});
+            expect(getDiskPercent(resource)).toBe(0);
+        });
+    });
+});
+
+describe('Resource Interface', () => {
+    it('allows all valid resource types', () => {
+        const types: ResourceType[] = [
+            'node', 'host', 'docker-host', 'k8s-node', 'truenas',
+            'vm', 'container', 'docker-container', 'pod', 'jail',
+            'docker-service', 'k8s-deployment', 'k8s-service',
+            'storage', 'datastore', 'pool', 'dataset',
+            'pbs', 'pmg',
+        ];
+
+        types.forEach(type => {
+            const resource = createResource({ type });
+            expect(resource.type).toBe(type);
+        });
+    });
+
+    it('supports hierarchy with parentId and clusterId', () => {
+        const vm = createResource({
+            type: 'vm',
+            parentId: 'node-1',
+            clusterId: 'pve-cluster-1',
+        });
+
+        expect(vm.parentId).toBe('node-1');
+        expect(vm.clusterId).toBe('pve-cluster-1');
+    });
+
+    it('supports tags and labels', () => {
+        const resource = createResource({
+            tags: ['production', 'web'],
+            labels: { env: 'prod', role: 'frontend' },
+        });
+
+        expect(resource.tags).toEqual(['production', 'web']);
+        expect(resource.labels).toEqual({ env: 'prod', role: 'frontend' });
+    });
+
+    it('supports alerts array', () => {
+        const resource = createResource({
+            alerts: [
+                {
+                    id: 'alert-1',
+                    type: 'cpu',
+                    level: 'warning',
+                    message: 'High CPU usage',
+                    value: 85,
+                    threshold: 80,
+                    startTime: Date.now(),
+                },
+            ],
+        });
+
+        expect(resource.alerts).toHaveLength(1);
+        expect(resource.alerts![0].type).toBe('cpu');
+    });
+
+    it('supports identity for deduplication', () => {
+        const resource = createResource({
+            identity: {
+                hostname: 'server-1',
+                machineId: 'abc-123',
+                ips: ['192.168.1.10', '10.0.0.5'],
+            },
+        });
+
+        expect(resource.identity?.hostname).toBe('server-1');
+        expect(resource.identity?.machineId).toBe('abc-123');
+        expect(resource.identity?.ips).toHaveLength(2);
+    });
+
+    it('supports platformData for type-specific data', () => {
+        const dockerContainer = createResource({
+            type: 'docker-container',
+            platformData: {
+                image: 'nginx:latest',
+                health: 'healthy',
+                restartCount: 0,
+                ports: [{ hostPort: 8080, containerPort: 80 }],
+            },
+        });
+
+        expect((dockerContainer.platformData as any).image).toBe('nginx:latest');
+    });
+});
diff --git a/frontend-modern/src/types/ai.ts b/frontend-modern/src/types/ai.ts
new file mode 100644
index 0000000..be28a93
--- /dev/null
+++ b/frontend-modern/src/types/ai.ts
@@ -0,0 +1,233 @@
+// AI feature types
+
+export type AIProvider = 'anthropic' | 'openai' | 'ollama' | 'deepseek';
+export type AuthMethod = 'api_key' | 'oauth';
+
+export interface ModelInfo {
+  id: string;
+  name: string;
+  description?: string;
+  is_default?: boolean;
+}
+
+export interface AISettings {
+  enabled: boolean;
+  provider: AIProvider; // DEPRECATED: legacy single provider
+  api_key_set: boolean; // DEPRECATED: whether legacy API key is set
+  model: string;
+  chat_model?: string; // Model for interactive chat (empty = use default)
+  patrol_model?: string; // Model for background patrol (empty = use default)
+  auto_fix_model?: string; // Model for auto-fix remediation (empty = use patrol model)
+  base_url?: string; // DEPRECATED: legacy base URL
+  configured: boolean; // true if AI is ready to use
+  autonomous_mode: boolean; // true if AI can execute commands without approval
+  custom_context: string; // user-provided infrastructure context
+  // OAuth fields for Claude Pro/Max subscription authentication
+  auth_method: AuthMethod; // "api_key" or "oauth"
+  oauth_connected: boolean; // true if OAuth tokens are configured
+  // Patrol settings for token efficiency
+  patrol_schedule_preset?: string; // DEPRECATED: use patrol_interval_minutes
+  patrol_interval_minutes?: number; // Patrol interval in minutes (0 = disabled, minimum 10)
+  alert_triggered_analysis?: boolean; // true if AI should analyze when alerts fire
+  patrol_auto_fix?: boolean; // true if patrol can attempt automatic remediation
+  available_models?: ModelInfo[]; // DEPRECATED: use /api/ai/models endpoint
+  // Multi-provider configuration
+  anthropic_configured: boolean; // true if Anthropic API key or OAuth is set
+  openai_configured: boolean; // true if OpenAI API key is set
+  deepseek_configured: boolean; // true if DeepSeek API key is set
+  ollama_configured: boolean; // true (always available for attempt)
+  ollama_base_url: string; // Ollama server URL
+  openai_base_url?: string; // Custom OpenAI base URL
+  configured_providers: AIProvider[]; // List of providers with credentials
+
+  // Cost controls (30-day budget, pro-rated in UI)
+  cost_budget_usd_30d?: number;
+}
+
+export interface AISettingsUpdateRequest {
+  enabled?: boolean;
+  provider?: AIProvider; // DEPRECATED: use model selection instead
+  api_key?: string; // DEPRECATED: use per-provider keys
+  model?: string;
+  base_url?: string; // DEPRECATED: use per-provider URLs
+  autonomous_mode?: boolean;
+  custom_context?: string; // user-provided infrastructure context
+  auth_method?: AuthMethod; // "api_key" or "oauth"
+  // Model overrides for different use cases
+  chat_model?: string; // Model for interactive chat
+  patrol_model?: string; // Model for background patrol
+  auto_fix_model?: string; // Model for auto-fix remediation
+  // Patrol settings for token efficiency
+  patrol_schedule_preset?: string; // DEPRECATED: use patrol_interval_minutes
+  patrol_interval_minutes?: number; // Custom interval in minutes (0 = disabled, minimum 10)
+  alert_triggered_analysis?: boolean; // true if AI should analyze when alerts fire
+  patrol_auto_fix?: boolean; // true if patrol can attempt automatic remediation
+  // Multi-provider credentials
+  anthropic_api_key?: string; // Set Anthropic API key
+  openai_api_key?: string; // Set OpenAI API key
+  deepseek_api_key?: string; // Set DeepSeek API key
+  ollama_base_url?: string; // Set Ollama server URL
+  openai_base_url?: string; // Set custom OpenAI base URL
+  // Clear flags for removing credentials
+  clear_anthropic_key?: boolean; // Clear Anthropic API key
+  clear_openai_key?: boolean; // Clear OpenAI API key
+  clear_deepseek_key?: boolean; // Clear DeepSeek API key
+  clear_ollama_url?: boolean; // Clear Ollama URL
+
+  // Cost controls
+  cost_budget_usd_30d?: number;
+}
+
+
+export interface AITestResult {
+  success: boolean;
+  message: string;
+  model?: string;
+}
+
+// Default models for each provider
+export const DEFAULT_MODELS: Record<AIProvider, string> = {
+  anthropic: 'claude-opus-4-5-20251101',
+  openai: 'gpt-4o',
+  ollama: 'llama3',
+  deepseek: 'deepseek-reasoner',
+};
+
+// Provider display names
+export const PROVIDER_NAMES: Record<AIProvider, string> = {
+  anthropic: 'Anthropic',
+  openai: 'OpenAI',
+  ollama: 'Ollama',
+  deepseek: 'DeepSeek',
+};
+
+// Provider descriptions
+export const PROVIDER_DESCRIPTIONS: Record<AIProvider, string> = {
+  anthropic: 'Claude models from Anthropic',
+  openai: 'GPT models from OpenAI',
+  ollama: 'Local models via Ollama',
+  deepseek: 'DeepSeek reasoning models',
+};
+
+// Conversation history for multi-turn chats
+export interface AIConversationMessage {
+  role: 'user' | 'assistant';
+  content: string;
+}
+
+// AI Execute request/response types
+export interface AIExecuteRequest {
+  prompt: string;
+  target_type?: string; // "host", "container", "vm", "node"
+  target_id?: string;
+  context?: Record<string, unknown>;
+  history?: AIConversationMessage[]; // Previous conversation messages
+  finding_id?: string; // If fixing a patrol finding, the ID to resolve on success
+  model?: string; // Override model for this request (user selection in chat)
+  use_case?: 'chat' | 'patrol'; // Optional server-side routing/model selection
+}
+
+// Tool execution info
+export interface AIToolExecution {
+  name: string;      // "run_command", "read_file"
+  input: string;     // The command or file path
+  output: string;    // Result of execution
+  success: boolean;
+}
+
+export interface AIExecuteResponse {
+  content: string;
+  model: string;
+  input_tokens: number;
+  output_tokens: number;
+  tool_calls?: AIToolExecution[]; // Commands that were executed
+  pending_approvals?: AIStreamApprovalNeededData[]; // Non-streaming approvals
+}
+
+// Streaming event types
+export type AIStreamEventType = 'tool_start' | 'tool_end' | 'content' | 'thinking' | 'done' | 'error' | 'complete' | 'approval_needed' | 'processing';
+
+export interface AIStreamToolStartData {
+  name: string;
+  input: string;
+}
+
+export interface AIStreamToolEndData {
+  name: string;
+  input: string;
+  output: string;
+  success: boolean;
+}
+
+export interface AIStreamApprovalNeededData {
+  command: string;
+  tool_id: string;
+  tool_name: string;
+  run_on_host: boolean;
+  target_host?: string; // Explicit host to route the command to
+}
+
+
+export interface AIStreamEvent {
+  type: AIStreamEventType;
+  data?: string | AIStreamToolStartData | AIStreamToolEndData | AIStreamCompleteData | AIStreamApprovalNeededData;
+}
+
+export interface AIStreamCompleteData {
+  model: string;
+  input_tokens: number;
+  output_tokens: number;
+  tool_calls?: AIToolExecution[];
+}
+
+// AI cost/usage summary types
+export interface AICostProviderModelSummary {
+  provider: string;
+  model: string;
+  input_tokens: number;
+  output_tokens: number;
+  total_tokens: number;
+  estimated_usd?: number;
+  pricing_known: boolean;
+}
+
+export interface AICostDailySummary {
+  date: string;
+  input_tokens: number;
+  output_tokens: number;
+  total_tokens: number;
+  estimated_usd?: number;
+}
+
+export interface AICostUseCaseSummary {
+  use_case: string;
+  input_tokens: number;
+  output_tokens: number;
+  total_tokens: number;
+  estimated_usd?: number;
+  pricing_known: boolean;
+}
+
+export interface AICostTargetSummary {
+  target_type: string;
+  target_id: string;
+  calls: number;
+  input_tokens: number;
+  output_tokens: number;
+  total_tokens: number;
+  estimated_usd?: number;
+  pricing_known: boolean;
+}
+
+export interface AICostSummary {
+  days: number;
+  retention_days: number;
+  effective_days: number;
+  truncated: boolean;
+  pricing_as_of?: string;
+  provider_models: AICostProviderModelSummary[];
+  use_cases: AICostUseCaseSummary[];
+  targets: AICostTargetSummary[];
+  daily_totals: AICostDailySummary[];
+  totals: AICostProviderModelSummary;
+}
diff --git a/frontend-modern/src/types/aiIntelligence.ts b/frontend-modern/src/types/aiIntelligence.ts
new file mode 100644
index 0000000..0b385f8
--- /dev/null
+++ b/frontend-modern/src/types/aiIntelligence.ts
@@ -0,0 +1,88 @@
+// AI Intelligence types for patterns, predictions, and correlations
+
+export interface FailurePattern {
+    key: string;
+    resource_id: string;
+    event_type: string;
+    occurrences: number;
+    average_interval: string;
+    average_duration: string;
+    last_occurrence: string;
+    confidence: number;
+}
+
+export interface FailurePrediction {
+    resource_id: string;
+    event_type: string;
+    predicted_at: string;
+    days_until: number;
+    confidence: number;
+    basis: string;
+    is_overdue: boolean;
+}
+
+export interface ResourceCorrelation {
+    source_id: string;
+    source_name: string;
+    source_type: string;
+    target_id: string;
+    target_name: string;
+    target_type: string;
+    event_pattern: string;
+    occurrences: number;
+    avg_delay: string;
+    confidence: number;
+    last_seen: string;
+    description: string;
+}
+
+export interface InfrastructureChange {
+    id: string;
+    resource_id: string;
+    resource_name: string;
+    resource_type: string;
+    change_type: string;
+    before: unknown;
+    after: unknown;
+    detected_at: string;
+    description: string;
+}
+
+export interface ResourceBaseline {
+    key: string;
+    resource_id: string;
+    metric: string;
+    mean: number;
+    std_dev: number;
+    min: number;
+    max: number;
+    samples: number;
+    last_update: string;
+}
+
+// API response types
+export interface PatternsResponse {
+    patterns: FailurePattern[];
+    count: number;
+}
+
+export interface PredictionsResponse {
+    predictions: FailurePrediction[];
+    count: number;
+}
+
+export interface CorrelationsResponse {
+    correlations: ResourceCorrelation[];
+    count: number;
+}
+
+export interface ChangesResponse {
+    changes: InfrastructureChange[];
+    count: number;
+    hours: number;
+}
+
+export interface BaselinesResponse {
+    baselines: ResourceBaseline[];
+    count: number;
+}
diff --git a/frontend-modern/src/types/api.ts b/frontend-modern/src/types/api.ts
index 9a38ba0..eb82bdc 100644
--- a/frontend-modern/src/types/api.ts
+++ b/frontend-modern/src/types/api.ts
@@ -1,11 +1,15 @@
 // Properly typed TypeScript interfaces for Pulse API
 
+import type { Resource } from './resource';
+
 export interface State {
   nodes: Node[];
   vms: VM[];
   containers: Container[];
   dockerHosts: DockerHost[];
   removedDockerHosts?: RemovedDockerHost[];
+  kubernetesClusters?: KubernetesCluster[];
+  removedKubernetesClusters?: RemovedKubernetesCluster[];
   hosts: Host[];
   replicationJobs: ReplicationJob[];
   storage: Storage[];
@@ -25,6 +29,8 @@ export interface State {
   recentlyResolved: ResolvedAlert[];
   lastUpdate: string;
   temperatureMonitoringEnabled?: boolean;
+  // Unified resources (new data model - eventually replaces legacy arrays above)
+  resources?: Resource[];
 }
 
 export interface RemovedDockerHost {
@@ -34,6 +40,95 @@ export interface RemovedDockerHost {
   removedAt: number;
 }
 
+export interface KubernetesCluster {
+  id: string;
+  agentId: string;
+  name?: string;
+  displayName?: string;
+  customDisplayName?: string;
+  server?: string;
+  context?: string;
+  version?: string;
+  status: string;
+  lastSeen: number;
+  intervalSeconds: number;
+  agentVersion?: string;
+  tokenId?: string;
+  tokenName?: string;
+  tokenHint?: string;
+  tokenLastUsedAt?: number;
+  hidden?: boolean;
+  pendingUninstall?: boolean;
+  nodes?: KubernetesNode[];
+  pods?: KubernetesPod[];
+  deployments?: KubernetesDeployment[];
+}
+
+export interface RemovedKubernetesCluster {
+  id: string;
+  name?: string;
+  displayName?: string;
+  removedAt: number;
+}
+
+export interface KubernetesNode {
+  uid: string;
+  name: string;
+  ready: boolean;
+  unschedulable?: boolean;
+  kubeletVersion?: string;
+  containerRuntimeVersion?: string;
+  osImage?: string;
+  kernelVersion?: string;
+  architecture?: string;
+  capacityCpuCores?: number;
+  capacityMemoryBytes?: number;
+  capacityPods?: number;
+  allocatableCpuCores?: number;
+  allocatableMemoryBytes?: number;
+  allocatablePods?: number;
+  roles?: string[];
+}
+
+export interface KubernetesPodContainer {
+  name: string;
+  image?: string;
+  ready: boolean;
+  restartCount?: number;
+  state?: string;
+  reason?: string;
+  message?: string;
+}
+
+export interface KubernetesPod {
+  uid: string;
+  name: string;
+  namespace: string;
+  nodeName?: string;
+  phase?: string;
+  reason?: string;
+  message?: string;
+  qosClass?: string;
+  createdAt?: number;
+  startTime?: number;
+  restarts?: number;
+  labels?: Record<string, string>;
+  ownerKind?: string;
+  ownerName?: string;
+  containers?: KubernetesPodContainer[];
+}
+
+export interface KubernetesDeployment {
+  uid: string;
+  name: string;
+  namespace: string;
+  desiredReplicas?: number;
+  updatedReplicas?: number;
+  readyReplicas?: number;
+  availableReplicas?: number;
+  labels?: Record<string, string>;
+}
+
 export interface Node {
   id: string;
   name: string;
@@ -126,6 +221,9 @@ export interface Container {
   tags: string[] | string | null;
   lock: string;
   lastSeen: string;
+  // OCI container support (Proxmox VE 9.1+)
+  isOci?: boolean; // True if this is an OCI container
+  osTemplate?: string; // Template or OCI image used (e.g., "oci:docker.io/library/alpine:latest")
 }
 
 export interface DockerHost {
@@ -329,6 +427,7 @@ export interface Host {
   loadAverage?: number[];
   memory: Memory;
   disks?: Disk[];
+  diskIO?: HostDiskIO[];
   networkInterfaces?: HostNetworkInterface[];
   sensors?: HostSensorSummary;
   raid?: HostRAIDArray[];
@@ -384,6 +483,17 @@ export interface HostRAIDDevice {
   slot: number;
 }
 
+export interface HostDiskIO {
+  device: string;
+  readBytes?: number;
+  writeBytes?: number;
+  readOps?: number;
+  writeOps?: number;
+  readTimeMs?: number;
+  writeTimeMs?: number;
+  ioTimeMs?: number;
+}
+
 export interface HostLookupResponse {
   success: boolean;
   host: {
diff --git a/frontend-modern/src/types/nodes.ts b/frontend-modern/src/types/nodes.ts
index 82efd16..cf53e38 100644
--- a/frontend-modern/src/types/nodes.ts
+++ b/frontend-modern/src/types/nodes.ts
@@ -91,6 +91,7 @@ export type NodeConfig = (PVENodeConfig | PBSNodeConfig | PMGNodeConfig) & {
   temperature?: Temperature;
   displayName?: string;
   temperatureTransport?: TemperatureTransport;
+  source?: 'agent' | 'script' | ''; // How this node was registered
 };
 
 export interface NodesResponse {
diff --git a/frontend-modern/src/types/resource.ts b/frontend-modern/src/types/resource.ts
new file mode 100644
index 0000000..78d1ae8
--- /dev/null
+++ b/frontend-modern/src/types/resource.ts
@@ -0,0 +1,196 @@
+/**
+ * Unified Resource Types
+ * 
+ * These types define the unified resource model that normalizes all monitored
+ * entities (VMs, containers, hosts, etc.) into a common structure.
+ * 
+ * The frontend receives these via WebSocket state.resources[].
+ */
+
+// Resource types - what kind of entity is being monitored
+export type ResourceType =
+    | 'node'            // Proxmox VE node
+    | 'host'            // Standalone host (via host-agent)
+    | 'docker-host'     // Docker/Podman host
+    | 'k8s-cluster'     // Kubernetes cluster
+    | 'k8s-node'        // Kubernetes node
+    | 'truenas'         // TrueNAS system
+    | 'vm'              // Proxmox VM
+    | 'container'       // LXC container
+    | 'oci-container'   // OCI container (Proxmox VE 9.1+)
+    | 'docker-container' // Docker container
+    | 'pod'             // Kubernetes pod
+    | 'jail'            // BSD jail
+    | 'docker-service'  // Docker Swarm service
+    | 'k8s-deployment'  // Kubernetes deployment
+    | 'k8s-service'     // Kubernetes service
+    | 'storage'         // Storage resource
+    | 'datastore'       // PBS datastore
+    | 'pool'            // ZFS/Ceph pool
+    | 'dataset'         // ZFS dataset
+    | 'pbs'             // Proxmox Backup Server
+    | 'pmg';            // Proxmox Mail Gateway
+
+// Platform types - which system the resource comes from
+export type PlatformType =
+    | 'proxmox-pve'
+    | 'proxmox-pbs'
+    | 'proxmox-pmg'
+    | 'docker'
+    | 'kubernetes'
+    | 'truenas'
+    | 'host-agent';
+
+// Source types - how data is collected
+export type SourceType =
+    | 'api'     // Data from polling an API
+    | 'agent'   // Data pushed from agent
+    | 'hybrid'; // Both sources, agent preferred
+
+// Resource status - operational state
+export type ResourceStatus =
+    | 'online'
+    | 'offline'
+    | 'running'
+    | 'stopped'
+    | 'degraded'
+    | 'paused'
+    | 'unknown';
+
+// Metric value with optional limits
+export interface ResourceMetric {
+    current: number;       // Current value (percentage or bytes)
+    total?: number;        // Total capacity (bytes) - null for percentages
+    used?: number;         // Used amount (bytes)
+    free?: number;         // Free amount (bytes)
+}
+
+// Network I/O metrics
+export interface ResourceNetwork {
+    rxBytes: number;       // Total bytes received
+    txBytes: number;       // Total bytes transmitted
+}
+
+// Alert associated with a resource
+export interface ResourceAlert {
+    id: string;
+    type: string;         // cpu, memory, disk, temperature, etc.
+    level: string;        // warning, critical
+    message: string;
+    value: number;
+    threshold: number;
+    startTime: number;    // Unix milliseconds
+}
+
+// Identity information for deduplication
+export interface ResourceIdentity {
+    hostname?: string;
+    machineId?: string;
+    ips?: string[];
+}
+
+/**
+ * The core unified Resource type.
+ * This is what the frontend receives from WebSocket state.resources[].
+ */
+export interface Resource {
+    // Identity
+    id: string;
+    type: ResourceType;
+    name: string;
+    displayName: string;
+
+    // Platform/Source
+    platformId: string;
+    platformType: PlatformType;
+    sourceType: SourceType;
+
+    // Hierarchy
+    parentId?: string;    // Parent resource (e.g., VM -> Node)
+    clusterId?: string;   // Cluster membership
+
+    // Universal Metrics
+    status: ResourceStatus;
+    cpu?: ResourceMetric;
+    memory?: ResourceMetric;
+    disk?: ResourceMetric;
+    network?: ResourceNetwork;
+    temperature?: number;
+    uptime?: number;      // Seconds
+
+    // Metadata
+    tags?: string[];
+    labels?: Record<string, string>;
+    lastSeen: number;     // Unix milliseconds
+    alerts?: ResourceAlert[];
+
+    // Identity for deduplication
+    identity?: ResourceIdentity;
+
+    // Platform-specific data (varies by type)
+    platformData?: Record<string, unknown>;
+}
+
+/**
+ * Helper type guards
+ */
+export function isInfrastructure(r: Resource): boolean {
+    return ['node', 'host', 'docker-host', 'k8s-cluster', 'k8s-node', 'truenas'].includes(r.type);
+}
+
+export function isWorkload(r: Resource): boolean {
+    return ['vm', 'container', 'oci-container', 'docker-container', 'pod', 'jail'].includes(r.type);
+}
+
+export function isStorage(r: Resource): boolean {
+    return ['storage', 'datastore', 'pool', 'dataset'].includes(r.type);
+}
+
+/**
+ * Resource filtering options
+ */
+export interface ResourceFilter {
+    types?: ResourceType[];
+    platforms?: PlatformType[];
+    statuses?: ResourceStatus[];
+    parentId?: string;
+    clusterId?: string;
+    hasAlerts?: boolean;
+    search?: string;
+}
+
+/**
+ * Helper to get effective display name
+ */
+export function getDisplayName(r: Resource): string {
+    return r.displayName || r.name;
+}
+
+/**
+ * Helper to get CPU percentage
+ */
+export function getCpuPercent(r: Resource): number {
+    return r.cpu?.current ?? 0;
+}
+
+/**
+ * Helper to get memory percentage
+ */
+export function getMemoryPercent(r: Resource): number {
+    if (!r.memory) return 0;
+    if (r.memory.total && r.memory.used) {
+        return (r.memory.used / r.memory.total) * 100;
+    }
+    return r.memory.current;
+}
+
+/**
+ * Helper to get disk percentage
+ */
+export function getDiskPercent(r: Resource): number {
+    if (!r.disk) return 0;
+    if (r.disk.total && r.disk.used) {
+        return (r.disk.used / r.disk.total) * 100;
+    }
+    return r.disk.current;
+}
diff --git a/frontend-modern/src/utils/__tests__/format.test.ts b/frontend-modern/src/utils/__tests__/format.test.ts
new file mode 100644
index 0000000..1d7d887
--- /dev/null
+++ b/frontend-modern/src/utils/__tests__/format.test.ts
@@ -0,0 +1,315 @@
+/**
+ * Tests for format utility functions
+ */
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import {
+    formatBytes,
+    formatSpeed,
+    formatPercent,
+    formatNumber,
+    formatUptime,
+    formatAbsoluteTime,
+    formatRelativeTime,
+    getBackupInfo,
+} from '@/utils/format';
+
+describe('formatBytes', () => {
+    it('formats bytes correctly', () => {
+        expect(formatBytes(0)).toBe('0 B');
+        expect(formatBytes(512)).toBe('512.0 B');
+        expect(formatBytes(1024)).toBe('1.0 KB');
+        expect(formatBytes(1536)).toBe('1.5 KB');
+    });
+
+    it('formats kilobytes correctly', () => {
+        expect(formatBytes(1024 * 1024)).toBe('1.0 MB');
+        expect(formatBytes(1536 * 1024)).toBe('1.5 MB');
+    });
+
+    it('formats megabytes correctly', () => {
+        expect(formatBytes(1024 * 1024 * 1024)).toBe('1.0 GB');
+        expect(formatBytes(1.5 * 1024 * 1024 * 1024)).toBe('1.5 GB');
+    });
+
+    it('formats gigabytes correctly', () => {
+        expect(formatBytes(1024 * 1024 * 1024 * 1024)).toBe('1.0 TB');
+    });
+
+    it('handles negative values', () => {
+        expect(formatBytes(-1024)).toBe('0 B');
+    });
+
+    it('handles custom decimal places', () => {
+        expect(formatBytes(1536 * 1024, 2)).toBe('1.50 MB');
+        expect(formatBytes(1536 * 1024, 0)).toBe('2 MB');
+    });
+});
+
+describe('formatSpeed', () => {
+    it('formats speed correctly', () => {
+        expect(formatSpeed(0)).toBe('0 B/s');
+        expect(formatSpeed(1024)).toBe('1 KB/s');
+        expect(formatSpeed(1024 * 1024)).toBe('1 MB/s');
+    });
+
+    it('handles negative values', () => {
+        expect(formatSpeed(-1024)).toBe('0 B/s');
+    });
+});
+
+describe('formatPercent', () => {
+    it('formats percentages correctly', () => {
+        expect(formatPercent(0)).toBe('0%');
+        expect(formatPercent(50)).toBe('50%');
+        expect(formatPercent(100)).toBe('100%');
+    });
+
+    it('rounds to nearest integer', () => {
+        expect(formatPercent(50.4)).toBe('50%');
+        expect(formatPercent(50.5)).toBe('51%');
+        expect(formatPercent(50.6)).toBe('51%');
+    });
+
+    it('handles very small values', () => {
+        expect(formatPercent(0.1)).toBe('0%');
+        expect(formatPercent(0.49)).toBe('0%');
+    });
+
+    it('handles non-finite values', () => {
+        expect(formatPercent(NaN)).toBe('0%');
+        expect(formatPercent(Infinity)).toBe('0%');
+        expect(formatPercent(-Infinity)).toBe('0%');
+    });
+});
+
+describe('formatNumber', () => {
+    it('formats numbers with locale separators', () => {
+        expect(formatNumber(0)).toBe('0');
+        expect(formatNumber(1000)).toMatch(/1[,.]000/); // Locale-dependent
+    });
+
+    it('handles non-finite values', () => {
+        expect(formatNumber(NaN)).toBe('0');
+        expect(formatNumber(Infinity)).toBe('0');
+    });
+});
+
+describe('formatUptime', () => {
+    it('formats seconds correctly', () => {
+        expect(formatUptime(0)).toBe('0s');
+        expect(formatUptime(30)).toBe('0m');
+    });
+
+    it('formats minutes correctly', () => {
+        expect(formatUptime(60)).toBe('1m');
+        expect(formatUptime(120)).toBe('2m');
+        expect(formatUptime(3599)).toBe('59m');
+    });
+
+    it('formats hours correctly', () => {
+        expect(formatUptime(3600)).toBe('1h 0m');
+        expect(formatUptime(7200)).toBe('2h 0m');
+        expect(formatUptime(7230)).toBe('2h 0m'); // 2 hours, 0 minutes, 30 seconds
+        expect(formatUptime(7260)).toBe('2h 1m');
+    });
+
+    it('formats days correctly', () => {
+        expect(formatUptime(86400)).toBe('1d 0h');
+        expect(formatUptime(86400 + 3600)).toBe('1d 1h');
+        expect(formatUptime(86400 * 7 + 3600 * 12)).toBe('7d 12h');
+    });
+
+    it('uses condensed format when requested', () => {
+        expect(formatUptime(86400 + 3600, true)).toBe('1d');
+        expect(formatUptime(3600 + 60, true)).toBe('1h');
+        expect(formatUptime(60, true)).toBe('1m');
+    });
+
+    it('handles negative values', () => {
+        expect(formatUptime(-100)).toBe('0s');
+    });
+});
+
+describe('formatAbsoluteTime', () => {
+    it('returns empty string for falsy input', () => {
+        expect(formatAbsoluteTime(0)).toBe('');
+    });
+
+    it('formats timestamp correctly', () => {
+        // Create a known date: March 15, 2024 at 14:30
+        const date = new Date(2024, 2, 15, 14, 30); // Month is 0-indexed
+        const timestamp = date.getTime();
+        const result = formatAbsoluteTime(timestamp);
+        expect(result).toBe('15 Mar 14:30');
+    });
+
+    it('pads hours and minutes with zeros', () => {
+        const date = new Date(2024, 0, 5, 9, 5); // Jan 5 at 09:05
+        const result = formatAbsoluteTime(date.getTime());
+        expect(result).toBe('5 Jan 09:05');
+    });
+});
+
+describe('formatRelativeTime', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.setSystemTime(new Date('2024-03-15T12:00:00Z'));
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    it('returns empty string for falsy input', () => {
+        expect(formatRelativeTime(0)).toBe('');
+    });
+
+    it('formats seconds ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 30 * 1000)).toBe('30s ago');
+        expect(formatRelativeTime(now - 1 * 1000)).toBe('1s ago');
+    });
+
+    it('formats minutes ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 60 * 1000)).toBe('1 min ago');
+        expect(formatRelativeTime(now - 5 * 60 * 1000)).toBe('5 mins ago');
+        expect(formatRelativeTime(now - 59 * 60 * 1000)).toBe('59 mins ago');
+    });
+
+    it('formats hours ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 60 * 60 * 1000)).toBe('1 hour ago');
+        expect(formatRelativeTime(now - 5 * 60 * 60 * 1000)).toBe('5 hours ago');
+        expect(formatRelativeTime(now - 23 * 60 * 60 * 1000)).toBe('23 hours ago');
+    });
+
+    it('formats days ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 24 * 60 * 60 * 1000)).toBe('1 day ago');
+        expect(formatRelativeTime(now - 7 * 24 * 60 * 60 * 1000)).toBe('7 days ago');
+    });
+
+    it('formats months ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 30 * 24 * 60 * 60 * 1000)).toBe('1 month ago');
+        expect(formatRelativeTime(now - 60 * 24 * 60 * 60 * 1000)).toBe('2 months ago');
+    });
+
+    it('formats years ago', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now - 365 * 24 * 60 * 60 * 1000)).toBe('1 year ago');
+        expect(formatRelativeTime(now - 2 * 365 * 24 * 60 * 60 * 1000)).toBe('2 years ago');
+    });
+
+    it('handles future timestamps', () => {
+        const now = Date.now();
+        expect(formatRelativeTime(now + 60 * 1000)).toBe('0s ago');
+    });
+});
+
+describe('getBackupInfo', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.setSystemTime(new Date('2024-03-15T12:00:00Z'));
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    it('returns never status for null/undefined input', () => {
+        expect(getBackupInfo(null)).toEqual({
+            status: 'never',
+            ageMs: null,
+            ageFormatted: 'Never',
+        });
+        expect(getBackupInfo(undefined)).toEqual({
+            status: 'never',
+            ageMs: null,
+            ageFormatted: 'Never',
+        });
+    });
+
+    it('returns never status for invalid timestamp', () => {
+        expect(getBackupInfo('invalid')).toEqual({
+            status: 'never',
+            ageMs: null,
+            ageFormatted: 'Never',
+        });
+        expect(getBackupInfo(0)).toEqual({
+            status: 'never',
+            ageMs: null,
+            ageFormatted: 'Never',
+        });
+    });
+
+    it('returns fresh status for backup within 24 hours', () => {
+        const now = Date.now();
+        const oneHourAgo = now - 60 * 60 * 1000;
+        const result = getBackupInfo(oneHourAgo);
+        expect(result.status).toBe('fresh');
+        expect(result.ageMs).toBe(60 * 60 * 1000);
+        expect(result.ageFormatted).toBe('1 hour ago');
+    });
+
+    it('returns stale status for backup between 24-72 hours', () => {
+        const now = Date.now();
+        const twoDaysAgo = now - 48 * 60 * 60 * 1000;
+        const result = getBackupInfo(twoDaysAgo);
+        expect(result.status).toBe('stale');
+        expect(result.ageFormatted).toBe('2 days ago');
+    });
+
+    it('returns critical status for backup older than 72 hours', () => {
+        const now = Date.now();
+        const fourDaysAgo = now - 4 * 24 * 60 * 60 * 1000;
+        const result = getBackupInfo(fourDaysAgo);
+        expect(result.status).toBe('critical');
+        expect(result.ageFormatted).toBe('4 days ago');
+    });
+
+    it('handles ISO date string input', () => {
+        const now = Date.now();
+        const oneHourAgo = new Date(now - 60 * 60 * 1000).toISOString();
+        const result = getBackupInfo(oneHourAgo);
+        expect(result.status).toBe('fresh');
+    });
+
+    it('handles numeric timestamp input', () => {
+        const now = Date.now();
+        const oneHourAgo = now - 60 * 60 * 1000;
+        const result = getBackupInfo(oneHourAgo);
+        expect(result.status).toBe('fresh');
+    });
+
+    describe('threshold boundaries', () => {
+        it('fresh at exactly 24 hours', () => {
+            const now = Date.now();
+            const exactly24Hours = now - 24 * 60 * 60 * 1000;
+            const result = getBackupInfo(exactly24Hours);
+            expect(result.status).toBe('fresh');
+        });
+
+        it('stale just after 24 hours', () => {
+            const now = Date.now();
+            const justOver24Hours = now - (24 * 60 * 60 * 1000 + 1000);
+            const result = getBackupInfo(justOver24Hours);
+            expect(result.status).toBe('stale');
+        });
+
+        it('stale at exactly 72 hours', () => {
+            const now = Date.now();
+            const exactly72Hours = now - 72 * 60 * 60 * 1000;
+            const result = getBackupInfo(exactly72Hours);
+            expect(result.status).toBe('stale');
+        });
+
+        it('critical just after 72 hours', () => {
+            const now = Date.now();
+            const justOver72Hours = now - (72 * 60 * 60 * 1000 + 1000);
+            const result = getBackupInfo(justOver72Hours);
+            expect(result.status).toBe('critical');
+        });
+    });
+});
diff --git a/frontend-modern/src/utils/__tests__/metricsKeys.test.ts b/frontend-modern/src/utils/__tests__/metricsKeys.test.ts
new file mode 100644
index 0000000..539904f
--- /dev/null
+++ b/frontend-modern/src/utils/__tests__/metricsKeys.test.ts
@@ -0,0 +1,67 @@
+/**
+ * Tests for metricsKeys utility functions
+ */
+import { describe, expect, it } from 'vitest';
+import {
+    buildMetricKey,
+    getMetricKeyPrefix,
+    type MetricResourceKind,
+} from '@/utils/metricsKeys';
+
+describe('metricsKeys', () => {
+    describe('buildMetricKey', () => {
+        it('builds a key for node resources', () => {
+            expect(buildMetricKey('node', 'pve1')).toBe('node:pve1');
+        });
+
+        it('builds a key for VM resources', () => {
+            expect(buildMetricKey('vm', 'vm-100')).toBe('vm:vm-100');
+        });
+
+        it('builds a key for container resources', () => {
+            expect(buildMetricKey('container', 'ct-200')).toBe('container:ct-200');
+        });
+
+        it('builds a key for docker host resources', () => {
+            expect(buildMetricKey('dockerHost', 'docker-host-1')).toBe('dockerHost:docker-host-1');
+        });
+
+        it('builds a key for docker container resources', () => {
+            expect(buildMetricKey('dockerContainer', 'abc123def')).toBe('dockerContainer:abc123def');
+        });
+
+        it('handles IDs with special characters', () => {
+            expect(buildMetricKey('vm', 'pve1/qemu/100')).toBe('vm:pve1/qemu/100');
+        });
+
+        it('handles empty IDs', () => {
+            expect(buildMetricKey('node', '')).toBe('node:');
+        });
+
+        it('handles IDs with colons (should not conflict)', () => {
+            expect(buildMetricKey('container', 'host:123')).toBe('container:host:123');
+        });
+    });
+
+    describe('getMetricKeyPrefix', () => {
+        const kinds: MetricResourceKind[] = ['node', 'vm', 'container', 'dockerHost', 'dockerContainer'];
+
+        it.each(kinds)('returns correct prefix for %s', (kind) => {
+            expect(getMetricKeyPrefix(kind)).toBe(`${kind}:`);
+        });
+
+        it('prefixes can be used to filter keys', () => {
+            const keys = [
+                'node:pve1',
+                'node:pve2',
+                'vm:100',
+                'dockerContainer:abc123',
+            ];
+
+            const nodePrefix = getMetricKeyPrefix('node');
+            const nodeKeys = keys.filter(k => k.startsWith(nodePrefix));
+
+            expect(nodeKeys).toEqual(['node:pve1', 'node:pve2']);
+        });
+    });
+});
diff --git a/frontend-modern/src/utils/__tests__/status.test.ts b/frontend-modern/src/utils/__tests__/status.test.ts
new file mode 100644
index 0000000..d9efec1
--- /dev/null
+++ b/frontend-modern/src/utils/__tests__/status.test.ts
@@ -0,0 +1,275 @@
+/**
+ * Tests for status utility functions
+ * 
+ * These tests verify the status indicator logic for various resource types.
+ */
+import { describe, expect, it } from 'vitest';
+import {
+    isNodeOnline,
+    isGuestRunning,
+    getNodeStatusIndicator,
+    getGuestPowerIndicator,
+    getHostStatusIndicator,
+    getDockerHostStatusIndicator,
+    getDockerContainerStatusIndicator,
+    getDockerServiceStatusIndicator,
+    OFFLINE_HEALTH_STATUSES,
+    DEGRADED_HEALTH_STATUSES,
+    STOPPED_CONTAINER_STATES,
+    ERROR_CONTAINER_STATES,
+} from '@/utils/status';
+
+describe('isNodeOnline', () => {
+    it('returns false for null/undefined', () => {
+        expect(isNodeOnline(null)).toBe(false);
+        expect(isNodeOnline(undefined)).toBe(false);
+    });
+
+    it('returns true for online node with uptime', () => {
+        expect(isNodeOnline({ status: 'online', uptime: 1000 })).toBe(true);
+    });
+
+    it('returns false for offline status', () => {
+        expect(isNodeOnline({ status: 'offline', uptime: 1000 })).toBe(false);
+    });
+
+    it('returns false for zero uptime', () => {
+        expect(isNodeOnline({ status: 'online', uptime: 0 })).toBe(false);
+    });
+
+    it('returns false for negative uptime', () => {
+        expect(isNodeOnline({ status: 'online', uptime: -1 })).toBe(false);
+    });
+
+    it('returns false for error connection health', () => {
+        expect(isNodeOnline({ status: 'online', uptime: 1000, connectionHealth: 'error' })).toBe(false);
+        expect(isNodeOnline({ status: 'online', uptime: 1000, connectionHealth: 'offline' })).toBe(false);
+    });
+});
+
+describe('isGuestRunning', () => {
+    it('returns false for null/undefined', () => {
+        expect(isGuestRunning(null)).toBe(false);
+        expect(isGuestRunning(undefined)).toBe(false);
+    });
+
+    it('returns true for running guest with online parent', () => {
+        expect(isGuestRunning({ status: 'running' }, true)).toBe(true);
+    });
+
+    it('returns false for running guest with offline parent', () => {
+        expect(isGuestRunning({ status: 'running' }, false)).toBe(false);
+    });
+
+    it('returns false for stopped guest', () => {
+        expect(isGuestRunning({ status: 'stopped' }, true)).toBe(false);
+    });
+});
+
+describe('getNodeStatusIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getNodeStatusIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+        expect(getNodeStatusIndicator(undefined)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('returns success for online node', () => {
+        const result = getNodeStatusIndicator({ status: 'online', uptime: 1000 });
+        expect(result.variant).toBe('success');
+        expect(result.label).toBe('Online');
+    });
+
+    it('returns danger for offline node', () => {
+        const result = getNodeStatusIndicator({ status: 'offline', uptime: 0 });
+        expect(result.variant).toBe('danger');
+    });
+
+    it('returns warning for degraded node', () => {
+        const result = getNodeStatusIndicator({ status: 'degraded', uptime: 1000 });
+        expect(result.variant).toBe('warning');
+    });
+});
+
+describe('getGuestPowerIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getGuestPowerIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('returns success for running guest', () => {
+        const result = getGuestPowerIndicator({ status: 'running' }, true);
+        expect(result.variant).toBe('success');
+        expect(result.label).toBe('Running');
+    });
+
+    it('returns danger for stopped guest', () => {
+        const result = getGuestPowerIndicator({ status: 'stopped' }, true);
+        expect(result.variant).toBe('danger');
+        expect(result.label).toBe('Stopped');
+    });
+
+    it('returns danger when parent node is offline', () => {
+        const result = getGuestPowerIndicator({ status: 'running' }, false);
+        expect(result.variant).toBe('danger');
+        expect(result.label).toBe('Node offline');
+    });
+});
+
+describe('getHostStatusIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getHostStatusIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('returns success for online host', () => {
+        const result = getHostStatusIndicator({ status: 'online' });
+        expect(result.variant).toBe('success');
+        expect(result.label).toBe('Online');
+    });
+
+    it('returns danger for offline host', () => {
+        const result = getHostStatusIndicator({ status: 'offline' });
+        expect(result.variant).toBe('danger');
+    });
+
+    it('returns warning for degraded host', () => {
+        const result = getHostStatusIndicator({ status: 'degraded' });
+        expect(result.variant).toBe('warning');
+    });
+});
+
+describe('getDockerHostStatusIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getDockerHostStatusIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('accepts string status directly', () => {
+        const result = getDockerHostStatusIndicator('online');
+        expect(result.variant).toBe('success');
+    });
+
+    it('returns success for healthy Docker host', () => {
+        const result = getDockerHostStatusIndicator({ status: 'healthy' });
+        expect(result.variant).toBe('success');
+    });
+
+    it('returns danger for offline Docker host', () => {
+        const result = getDockerHostStatusIndicator({ status: 'offline' });
+        expect(result.variant).toBe('danger');
+    });
+});
+
+describe('getDockerContainerStatusIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getDockerContainerStatusIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('returns success for running healthy container', () => {
+        const result = getDockerContainerStatusIndicator({ state: 'running', health: 'healthy' });
+        expect(result.variant).toBe('success');
+        expect(result.label).toBe('Running');
+    });
+
+    it('returns success for running container without health', () => {
+        const result = getDockerContainerStatusIndicator({ state: 'running' });
+        expect(result.variant).toBe('success');
+    });
+
+    it('returns danger for unhealthy container', () => {
+        const result = getDockerContainerStatusIndicator({ state: 'running', health: 'unhealthy' });
+        expect(result.variant).toBe('danger');
+        expect(result.label).toBe('Unhealthy');
+    });
+
+    it('returns danger for exited container', () => {
+        const result = getDockerContainerStatusIndicator({ state: 'exited' });
+        expect(result.variant).toBe('danger');
+    });
+
+    it('returns danger for dead container', () => {
+        const result = getDockerContainerStatusIndicator({ state: 'dead' });
+        expect(result.variant).toBe('danger');
+    });
+});
+
+describe('getDockerServiceStatusIndicator', () => {
+    it('returns muted for null/undefined', () => {
+        expect(getDockerServiceStatusIndicator(null)).toEqual({ variant: 'muted', label: 'Unknown' });
+    });
+
+    it('returns success when running >= desired', () => {
+        const result = getDockerServiceStatusIndicator({ desiredTasks: 3, runningTasks: 3 });
+        expect(result.variant).toBe('success');
+        expect(result.label).toBe('Healthy');
+    });
+
+    it('returns warning when running < desired but > 0', () => {
+        const result = getDockerServiceStatusIndicator({ desiredTasks: 3, runningTasks: 2 });
+        expect(result.variant).toBe('warning');
+        expect(result.label).toBe('Degraded (2/3)');
+    });
+
+    it('returns danger when running is 0', () => {
+        const result = getDockerServiceStatusIndicator({ desiredTasks: 3, runningTasks: 0 });
+        expect(result.variant).toBe('danger');
+        expect(result.label).toBe('Stopped (0/3)');
+    });
+
+    it('returns muted when desired is 0 and running is 0', () => {
+        const result = getDockerServiceStatusIndicator({ desiredTasks: 0, runningTasks: 0 });
+        expect(result.variant).toBe('muted');
+        expect(result.label).toBe('No tasks');
+    });
+
+    it('returns warning when desired is 0 but running > 0', () => {
+        const result = getDockerServiceStatusIndicator({ desiredTasks: 0, runningTasks: 2 });
+        expect(result.variant).toBe('warning');
+        expect(result.label).toBe('Running 2 tasks');
+    });
+});
+
+describe('Status sets', () => {
+    describe('OFFLINE_HEALTH_STATUSES', () => {
+        it('contains expected offline statuses', () => {
+            expect(OFFLINE_HEALTH_STATUSES.has('offline')).toBe(true);
+            expect(OFFLINE_HEALTH_STATUSES.has('error')).toBe(true);
+            expect(OFFLINE_HEALTH_STATUSES.has('failed')).toBe(true);
+            expect(OFFLINE_HEALTH_STATUSES.has('timeout')).toBe(true);
+            expect(OFFLINE_HEALTH_STATUSES.has('stopped')).toBe(true);
+        });
+
+        it('does not contain online statuses', () => {
+            expect(OFFLINE_HEALTH_STATUSES.has('online')).toBe(false);
+            expect(OFFLINE_HEALTH_STATUSES.has('running')).toBe(false);
+            expect(OFFLINE_HEALTH_STATUSES.has('healthy')).toBe(false);
+        });
+    });
+
+    describe('DEGRADED_HEALTH_STATUSES', () => {
+        it('contains expected degraded statuses', () => {
+            expect(DEGRADED_HEALTH_STATUSES.has('degraded')).toBe(true);
+            expect(DEGRADED_HEALTH_STATUSES.has('warning')).toBe(true);
+            expect(DEGRADED_HEALTH_STATUSES.has('syncing')).toBe(true);
+            expect(DEGRADED_HEALTH_STATUSES.has('pending')).toBe(true);
+        });
+    });
+
+    describe('STOPPED_CONTAINER_STATES', () => {
+        it('contains expected stopped states', () => {
+            expect(STOPPED_CONTAINER_STATES.has('exited')).toBe(true);
+            expect(STOPPED_CONTAINER_STATES.has('stopped')).toBe(true);
+            expect(STOPPED_CONTAINER_STATES.has('created')).toBe(true);
+            expect(STOPPED_CONTAINER_STATES.has('paused')).toBe(true);
+        });
+
+        it('does not contain running state', () => {
+            expect(STOPPED_CONTAINER_STATES.has('running')).toBe(false);
+        });
+    });
+
+    describe('ERROR_CONTAINER_STATES', () => {
+        it('contains expected error states', () => {
+            expect(ERROR_CONTAINER_STATES.has('dead')).toBe(true);
+            expect(ERROR_CONTAINER_STATES.has('oomkilled')).toBe(true);
+            expect(ERROR_CONTAINER_STATES.has('unhealthy')).toBe(true);
+            expect(ERROR_CONTAINER_STATES.has('restarting')).toBe(true);
+        });
+    });
+});
diff --git a/frontend-modern/src/utils/alertFormatters.ts b/frontend-modern/src/utils/alertFormatters.ts
new file mode 100644
index 0000000..8ae4f08
--- /dev/null
+++ b/frontend-modern/src/utils/alertFormatters.ts
@@ -0,0 +1,88 @@
+/**
+ * Utility functions for formatting alert values based on their metric type.
+ * Temperature metrics should show °C, not percentages.
+ */
+
+/**
+ * Metric types that are measured in degrees Celsius rather than percentages.
+ */
+const TEMPERATURE_METRIC_TYPES = new Set(['temperature', 'temp']);
+
+/**
+ * Metric types that are measured in MB/s rather than percentages.
+ */
+const THROUGHPUT_METRIC_TYPES = new Set(['diskRead', 'diskWrite', 'networkIn', 'networkOut']);
+
+/**
+ * Returns the appropriate unit suffix for a given metric type.
+ * @param metricType The alert's metric type (e.g., 'cpu', 'memory', 'temperature')
+ * @returns The unit suffix to append to values (e.g., '%', '°C', ' MB/s')
+ */
+export function getAlertUnit(metricType?: string): string {
+    if (!metricType) return '%';
+    const typeLower = metricType.toLowerCase();
+
+    if (TEMPERATURE_METRIC_TYPES.has(typeLower)) {
+        return '°C';
+    }
+
+    if (THROUGHPUT_METRIC_TYPES.has(typeLower)) {
+        return ' MB/s';
+    }
+
+    return '%';
+}
+
+/**
+ * Formats an alert value with the appropriate unit based on metric type.
+ * @param value The numeric value to format
+ * @param metricType The alert's metric type (e.g., 'cpu', 'memory', 'temperature')
+ * @param decimals Number of decimal places (default: 1)
+ * @returns Formatted string with appropriate unit (e.g., '82.5%', '74.0°C')
+ */
+export function formatAlertValue(
+    value: number | undefined,
+    metricType?: string,
+    decimals = 1
+): string {
+    if (value === undefined || !Number.isFinite(value)) {
+        return 'N/A';
+    }
+    return `${value.toFixed(decimals)}${getAlertUnit(metricType)}`;
+}
+
+/**
+ * Formats a threshold value with the appropriate unit based on metric type.
+ * Returns 'Disabled' for values <= 0 and 'Not configured' for undefined values.
+ * @param value The threshold value to format
+ * @param metricType The alert's metric type (e.g., 'cpu', 'memory', 'temperature')
+ * @returns Formatted threshold string
+ */
+export function formatAlertThreshold(
+    value: number | undefined,
+    metricType?: string
+): string {
+    if (value === undefined || Number.isNaN(value)) {
+        return 'Not configured';
+    }
+    if (value <= 0) {
+        return 'Disabled';
+    }
+    return `${value}${getAlertUnit(metricType)}`;
+}
+
+/**
+ * Checks if a metric type represents a temperature measurement.
+ */
+export function isTemperatureMetric(metricType?: string): boolean {
+    if (!metricType) return false;
+    return TEMPERATURE_METRIC_TYPES.has(metricType.toLowerCase());
+}
+
+/**
+ * Checks if a metric type represents a throughput measurement (MB/s).
+ */
+export function isThroughputMetric(metricType?: string): boolean {
+    if (!metricType) return false;
+    return THROUGHPUT_METRIC_TYPES.has(metricType);
+}
diff --git a/frontend-modern/src/utils/apiClient.ts b/frontend-modern/src/utils/apiClient.ts
index eb0514f..ed4684f 100644
--- a/frontend-modern/src/utils/apiClient.ts
+++ b/frontend-modern/src/utils/apiClient.ts
@@ -181,6 +181,28 @@ class ApiClient {
     return false;
   }
 
+  // Ensure CSRF token is available by making a GET request if needed
+  // The backend issues CSRF cookies on GET requests to /api/* endpoints
+  private async ensureCSRFToken(): Promise<string | null> {
+    try {
+      // Make a simple GET request to trigger CSRF cookie issuance
+      const response = await fetch('/api/health', {
+        method: 'GET',
+        credentials: 'include',
+      });
+
+      // The response should have set the pulse_csrf cookie
+      if (response.ok) {
+        // Small delay to ensure cookie is set
+        await new Promise(resolve => setTimeout(resolve, 10));
+        return this.loadCSRFToken();
+      }
+    } catch (err) {
+      logger.warn('Failed to fetch CSRF token', err);
+    }
+    return null;
+  }
+
   // Main fetch wrapper that adds authentication
   async fetch(url: string, options: FetchOptions = {}): Promise<Response> {
     const { skipAuth = false, headers = {}, ...fetchOptions } = options;
@@ -206,7 +228,12 @@ class ApiClient {
     // Add CSRF token for state-changing requests
     const method = (fetchOptions.method || 'GET').toUpperCase();
     if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
-      const token = this.loadCSRFToken();
+      // Try to get CSRF token, or fetch one if missing
+      let token = this.loadCSRFToken();
+      if (!token) {
+        // No CSRF token available - try to get one by making a GET request
+        token = await this.ensureCSRFToken();
+      }
       if (token) {
         finalHeaders['X-CSRF-Token'] = token;
       }
@@ -222,8 +249,10 @@ class ApiClient {
     const response = await fetch(url, finalOptions);
 
     // If we get a 401 on an API call (not during initial auth check), redirect to login
-    // Skip redirect for specific auth-check endpoints to avoid loops
-    if (response.status === 401 && !url.includes('/api/security/status') && !url.includes('/api/state')) {
+    // Skip redirect for specific auth-check endpoints and background data fetching to avoid loops
+    const skipRedirectUrls = ['/api/security/status', '/api/state', '/api/settings/ai', '/api/charts', '/api/resources'];
+    const shouldSkipRedirect = skipRedirectUrls.some(path => url.includes(path));
+    if (response.status === 401 && !shouldSkipRedirect) {
       logger.warn('Authentication expired - redirecting to login');
       // Clear auth and redirect to login
       if (typeof window !== 'undefined') {
@@ -234,13 +263,15 @@ class ApiClient {
       return response;
     }
 
-    // Handle CSRF token failures
+    // Handle CSRF token failures - the 403 response should have set a new CSRF cookie
     if (response.status === 403) {
-      const csrfHeader = response.headers.get('X-CSRF-Token');
-      let refreshedToken: string | null = null;
-      if (csrfHeader) {
-        refreshedToken = csrfHeader;
-      } else {
+      // First try the response header (backend sends new token in X-CSRF-Token header)
+      let refreshedToken = response.headers.get('X-CSRF-Token');
+
+      // If not in header, reload from cookie (backend also sets pulse_csrf cookie on 403)
+      if (!refreshedToken) {
+        // Force reload from cookie - the 403 response just set it
+        this.csrfToken = null;
         refreshedToken = this.loadCSRFToken();
       }
 
diff --git a/frontend-modern/src/utils/format.ts b/frontend-modern/src/utils/format.ts
index d3ab5c0..d57b5b2 100644
--- a/frontend-modern/src/utils/format.ts
+++ b/frontend-modern/src/utils/format.ts
@@ -25,6 +25,11 @@ export function formatPercent(value: number): string {
   return `${Math.round(value)}%`;
 }
 
+export function formatNumber(value: number): string {
+  if (!Number.isFinite(value)) return '0';
+  return value.toLocaleString();
+}
+
 export function formatUptime(seconds: number, condensed = false): string {
   if (!seconds || seconds < 0) return '0s';
 
diff --git a/frontend-modern/src/utils/localStorage.ts b/frontend-modern/src/utils/localStorage.ts
index 1e0af9b..05acfdf 100644
--- a/frontend-modern/src/utils/localStorage.ts
+++ b/frontend-modern/src/utils/localStorage.ts
@@ -108,4 +108,13 @@ export const STORAGE_KEYS = {
 
   // Metrics display
   METRICS_VIEW_MODE: 'metricsViewMode', // 'bars' | 'sparklines'
+  METRICS_TIME_RANGE: 'metricsTimeRange', // '15m' | '1h' | '4h' | '24h'
+
+  // Column visibility
+  DASHBOARD_HIDDEN_COLUMNS: 'dashboardHiddenColumns',
+  HOSTS_HIDDEN_COLUMNS: 'hostsHiddenColumns',
+  DOCKER_HIDDEN_COLUMNS: 'dockerHiddenColumns',
+
+  // Resources search
+  RESOURCES_SEARCH_HISTORY: 'resourcesSearchHistory',
 } as const;
diff --git a/frontend-modern/tailwind.config.js b/frontend-modern/tailwind.config.js
index 891b93e..f2cf47d 100644
--- a/frontend-modern/tailwind.config.js
+++ b/frontend-modern/tailwind.config.js
@@ -1,3 +1,5 @@
+import typography from '@tailwindcss/typography';
+
 export default {
   content: [
     "./index.html",
@@ -23,5 +25,5 @@ export default {
       }
     },
   },
-  plugins: [],
+  plugins: [typography],
 }
\ No newline at end of file
diff --git a/frontend-modern/vite.config.ts b/frontend-modern/vite.config.ts
index 72306c7..8e52b67 100644
--- a/frontend-modern/vite.config.ts
+++ b/frontend-modern/vite.config.ts
@@ -51,10 +51,150 @@ export default defineConfig({
         target: backendWsUrl,
         ws: true,
         changeOrigin: true,
+        // Browser WebSocket connections are long-lived, disable timeouts
+        proxyTimeout: 0,
+        timeout: 0,
+        configure: (proxy, _options) => {
+          proxy.options.timeout = 0;
+          proxy.options.proxyTimeout = 0;
+
+          proxy.on('proxyReqWs', (proxyReq, req, socket) => {
+            socket.setTimeout(0);
+            socket.setNoDelay(true);
+            socket.setKeepAlive(true, 30000);
+          });
+          proxy.on('open', (proxySocket) => {
+            proxySocket.setTimeout(0);
+            proxySocket.setNoDelay(true);
+            proxySocket.setKeepAlive(true, 30000);
+          });
+        },
+      },
+      // SSE endpoint for AI chat streaming
+      '/api/ai/execute/stream': {
+        target: backendUrl,
+        changeOrigin: true,
+        // SSE requires special handling to prevent proxy timeouts
+        // Set timeout to 0 to completely disable
+        timeout: 0,
+        proxyTimeout: 0,
+        configure: (proxy, _options) => {
+          // Completely disable http-proxy internal timeouts
+          proxy.options.timeout = 0;
+          proxy.options.proxyTimeout = 0;
+
+          // Set proxy-level timeouts
+          proxy.on('proxyReq', (proxyReq, req, res) => {
+            // Disable socket timeouts for SSE
+            req.socket.setTimeout(0);
+            req.socket.setNoDelay(true);
+            req.socket.setKeepAlive(true, 30000);
+            // Also set on the proxy request
+            proxyReq.socket?.setTimeout(0);
+          });
+          proxy.on('proxyRes', (proxyRes, req, res) => {
+            // Disable response socket timeout
+            res.socket?.setTimeout(0);
+            res.socket?.setNoDelay(true);
+            res.socket?.setKeepAlive(true, 30000);
+            // Also disable on proxy response socket
+            proxyRes.socket?.setTimeout(0);
+          });
+          proxy.on('error', (err, req, res) => {
+            console.error('[SSE Proxy Error]', err.message);
+          });
+        },
+      },
+      // SSE endpoint for AI alert investigation (one-click investigate from alerts page)
+      '/api/ai/investigate-alert': {
+        target: backendUrl,
+        changeOrigin: true,
+        // SSE requires special handling to prevent proxy timeouts
+        timeout: 0,
+        proxyTimeout: 0,
+        configure: (proxy, _options) => {
+          proxy.options.timeout = 0;
+          proxy.options.proxyTimeout = 0;
+
+          proxy.on('proxyReq', (proxyReq, req, res) => {
+            req.socket.setTimeout(0);
+            req.socket.setNoDelay(true);
+            req.socket.setKeepAlive(true, 30000);
+            proxyReq.socket?.setTimeout(0);
+          });
+          proxy.on('proxyRes', (proxyRes, req, res) => {
+            res.socket?.setTimeout(0);
+            res.socket?.setNoDelay(true);
+            res.socket?.setKeepAlive(true, 30000);
+            proxyRes.socket?.setTimeout(0);
+          });
+          proxy.on('error', (err, req, res) => {
+            console.error('[SSE Proxy Error - Investigate Alert]', err.message);
+          });
+        },
+      },
+      // SSE endpoint for AI patrol streaming
+      '/api/ai/patrol/stream': {
+        target: backendUrl,
+        changeOrigin: true,
+        timeout: 0,
+        proxyTimeout: 0,
+        configure: (proxy, _options) => {
+          proxy.options.timeout = 0;
+          proxy.options.proxyTimeout = 0;
+
+          proxy.on('proxyReq', (proxyReq, req, res) => {
+            req.socket.setTimeout(0);
+            req.socket.setNoDelay(true);
+            req.socket.setKeepAlive(true, 30000);
+            proxyReq.socket?.setTimeout(0);
+          });
+          proxy.on('proxyRes', (proxyRes, req, res) => {
+            res.socket?.setTimeout(0);
+            res.socket?.setNoDelay(true);
+            res.socket?.setKeepAlive(true, 30000);
+            proxyRes.socket?.setTimeout(0);
+          });
+          proxy.on('error', (err, req, res) => {
+            console.error('[SSE Proxy Error - Patrol Stream]', err.message);
+          });
+        },
+      },
+      '/api/agent/ws': {
+        target: backendWsUrl,
+        ws: true,
+        changeOrigin: true,
+        // Agent WebSocket connections are long-lived, disable timeouts
+        // proxyTimeout: 0 disables the proxy-to-target timeout
+        // timeout: 0 disables the client-to-proxy timeout
+        proxyTimeout: 0,
+        timeout: 0,
+        configure: (proxy, _options) => {
+          // Disable http-proxy's internal timeout (default is 2 minutes but seems to be 10s)
+          proxy.options.timeout = 0;
+          proxy.options.proxyTimeout = 0;
+
+          proxy.on('proxyReqWs', (proxyReq, req, socket) => {
+            // Disable socket timeouts for WebSocket connections
+            socket.setTimeout(0);
+            socket.setNoDelay(true);
+            socket.setKeepAlive(true, 30000);
+          });
+          proxy.on('open', (proxySocket) => {
+            // Also disable timeout on the proxy socket
+            proxySocket.setTimeout(0);
+            proxySocket.setNoDelay(true);
+            proxySocket.setKeepAlive(true, 30000);
+          });
+          proxy.on('error', (err, req, res) => {
+            console.error('[Agent WS Proxy Error]', err.message);
+          });
+        },
       },
       '/api': {
         target: backendUrl,
         changeOrigin: true,
+        cookieDomainRewrite: '',
       },
       '/install-docker-agent.sh': {
         target: backendUrl,
diff --git a/go.mod b/go.mod
index 8fe201a..be0e260 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,6 @@ require (
 	github.com/rs/zerolog v1.34.0
 	github.com/shirou/gopsutil/v4 v4.25.11
 	github.com/spf13/cobra v1.10.1
-	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.45.0
 	golang.org/x/oauth2 v0.33.0
 	golang.org/x/sync v0.18.0
@@ -27,6 +26,10 @@ require (
 	golang.org/x/term v0.37.0
 	golang.org/x/time v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/api v0.32.0
+	k8s.io/apimachinery v0.32.0
+	k8s.io/client-go v0.32.0
+	modernc.org/sqlite v1.40.1
 )
 
 require (
@@ -36,38 +39,56 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.9.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/prometheus/common v0.67.4 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
@@ -76,7 +97,21 @@ require (
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	google.golang.org/grpc v1.75.1 // indirect
 	google.golang.org/protobuf v1.36.10 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
+	modernc.org/libc v1.66.10 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 39ca4b2..46a8ff4 100644
Binary files a/go.sum and b/go.sum differ
diff --git a/internal/agentexec/policy.go b/internal/agentexec/policy.go
new file mode 100644
index 0000000..5236b23
--- /dev/null
+++ b/internal/agentexec/policy.go
@@ -0,0 +1,261 @@
+package agentexec
+
+import (
+	"regexp"
+	"strings"
+)
+
+// CommandPolicy defines what commands are allowed, blocked, or require approval
+type CommandPolicy struct {
+	// AutoApprove patterns - commands matching these are automatically allowed
+	AutoApprove []string
+
+	// RequireApproval patterns - commands matching these need user approval
+	RequireApproval []string
+
+	// Blocked patterns - commands matching these are never allowed
+	Blocked []string
+
+	// compiled regex patterns
+	autoApproveRe     []*regexp.Regexp
+	requireApprovalRe []*regexp.Regexp
+	blockedRe         []*regexp.Regexp
+}
+
+// DefaultPolicy returns a sensible default command policy
+func DefaultPolicy() *CommandPolicy {
+	p := &CommandPolicy{
+		AutoApprove: []string{
+			// System inspection
+			`^ps(\s|$)`,
+			`^top\s+-bn`,
+			`^df(\s|$)`,
+			`^free(\s|$)`,
+			`^uptime$`,
+			`^hostname$`,
+			`^uname(\s|$)`,
+			`^cat\s+/proc/`,
+			`^cat\s+/etc/os-release`,
+			`^lsof(\s|$)`,
+			`^netstat(\s|$)`,
+			`^ss(\s|$)`,
+			`^ip\s+(addr|route|link)`,
+			`^ifconfig`,
+			`^w$`,
+			`^who$`,
+			`^last(\s|$)`,
+
+			// Log reading (read-only)
+			`^cat\s+/var/log/`,
+			`^tail\s+.*(/var/log/|/log/)`,
+			`^head\s+.*(/var/log/|/log/)`,
+			`^grep\s+.*(/var/log/|/log/)`,
+			`^journalctl\s`,
+
+			// Service status (read-only)
+			`^systemctl\s+status\s`,
+			`^systemctl\s+is-active\s`,
+			`^systemctl\s+is-enabled\s`,
+			`^systemctl\s+list-units`,
+			`^service\s+\S+\s+status`,
+
+			// Docker inspection (read-only)
+			`^docker\s+ps`,
+			`^docker\s+logs\s`,
+			`^docker\s+inspect\s`,
+			`^docker\s+stats\s+--no-stream`,
+			`^docker\s+top\s`,
+			`^docker\s+images`,
+			`^docker\s+network\s+ls`,
+			`^docker\s+volume\s+ls`,
+
+			// Proxmox inspection (read-only)
+			`^pct\s+list`,
+			`^pct\s+config\s`,
+			`^pct\s+status\s`,
+			`^qm\s+list`,
+			`^qm\s+config\s`,
+			`^qm\s+status\s`,
+			`^pvesh\s+get\s`,
+
+			// Disk/storage info
+			`^lsblk`,
+			`^blkid`,
+			`^fdisk\s+-l`,
+			`^du(\s|$)`,
+			`^ls(\s|$)`,
+			`^stat(\s|$)`,
+			`^file(\s|$)`,
+			`^find\s+/.*-size`,  // Find large files
+			`^find\s+/.*-mtime`, // Find by modification time
+			`^find\s+/.*-type`,  // Find by type
+
+			// Memory inspection
+			`^vmstat`,
+			`^sar\s`,
+			`^iostat`,
+			`^mpstat`,
+
+			// Docker inspection (read-only)
+			`^docker\s+system\s+df`,
+
+			// APT inspection (read-only)
+			`^apt\s+list`,
+			`^apt-cache\s`,
+			`^dpkg\s+-l`,
+			`^dpkg\s+--list`,
+		},
+
+		RequireApproval: []string{
+			// Service control
+			`^systemctl\s+(restart|stop|start|reload)\s`,
+			`^service\s+\S+\s+(restart|stop|start|reload)`,
+
+			// Docker control
+			`^docker\s+(restart|stop|start|kill)\s`,
+			`^docker\s+exec\s`,
+			`^docker\s+rm\s`,
+
+			// Process control
+			`^kill\s`,
+			`^pkill\s`,
+			`^killall\s`,
+
+			// Package management
+			`^apt\s`,
+			`^apt-get\s`,
+			`^yum\s`,
+			`^dnf\s`,
+			`^pacman\s`,
+
+			// Proxmox control
+			`^pct\s+(start|stop|shutdown|reboot|resize|set)\s`,
+			`^qm\s+(start|stop|shutdown|reboot|reset|resize|set)\s`,
+
+			// journalctl maintenance (modifies logs / persistent state)
+			`^journalctl\s+--vacuum`,
+			`^journalctl\s+--rotate`,
+		},
+
+		Blocked: []string{
+			// Destructive filesystem operations
+			`rm\s+-rf\s+/`,
+			`rm\s+--no-preserve-root`,
+			`mkfs`,
+			`dd\s+.*of=/dev/`,
+			`>\s*/dev/sd`,
+			`>\s*/dev/nvme`,
+
+			// System destruction
+			`shutdown`,
+			`reboot`,
+			`init\s+0`,
+			`poweroff`,
+			`halt`,
+
+			// Dangerous permissions
+			`chmod\s+777`,
+			`chmod\s+-R\s+777`,
+			`chown\s+-R\s+.*:.*\s+/`,
+
+			// Remote code execution
+			`curl.*\|\s*(ba)?sh`,
+			`wget.*\|\s*(ba)?sh`,
+			`bash\s+-c\s+.*curl`,
+			`bash\s+-c\s+.*wget`,
+
+			// Crypto mining indicators
+			`xmrig`,
+			`minerd`,
+			`cpuminer`,
+
+			// Fork bomb patterns
+			`:\(\)\s*{\s*:\s*\|\s*:`,
+
+			// Clear system logs
+			`>\s*/var/log/`,
+			`truncate.*--size.*0.*/var/log/`,
+		},
+	}
+
+	p.compile()
+	return p
+}
+
+func (p *CommandPolicy) compile() {
+	p.autoApproveRe = compilePatterns(p.AutoApprove)
+	p.requireApprovalRe = compilePatterns(p.RequireApproval)
+	p.blockedRe = compilePatterns(p.Blocked)
+}
+
+func compilePatterns(patterns []string) []*regexp.Regexp {
+	result := make([]*regexp.Regexp, 0, len(patterns))
+	for _, pattern := range patterns {
+		re, err := regexp.Compile(pattern)
+		if err == nil {
+			result = append(result, re)
+		}
+	}
+	return result
+}
+
+// PolicyDecision represents the policy decision for a command
+type PolicyDecision string
+
+const (
+	PolicyAllow           PolicyDecision = "allow"
+	PolicyRequireApproval PolicyDecision = "require_approval"
+	PolicyBlock           PolicyDecision = "block"
+)
+
+// Evaluate checks a command against the policy
+func (p *CommandPolicy) Evaluate(command string) PolicyDecision {
+	command = strings.TrimSpace(command)
+	// Normalize simple sudo prefix so policy applies consistently.
+	// For complex sudo invocations (sudo flags), keep the command as-is (conservative).
+	if strings.HasPrefix(command, "sudo ") {
+		parts := strings.Fields(command)
+		if len(parts) >= 2 && !strings.HasPrefix(parts[1], "-") {
+			command = strings.Join(parts[1:], " ")
+		}
+	}
+
+	// Check blocked first (highest priority)
+	for _, re := range p.blockedRe {
+		if re.MatchString(command) {
+			return PolicyBlock
+		}
+	}
+
+	// Check require approval
+	for _, re := range p.requireApprovalRe {
+		if re.MatchString(command) {
+			return PolicyRequireApproval
+		}
+	}
+
+	// Check auto-approve
+	for _, re := range p.autoApproveRe {
+		if re.MatchString(command) {
+			return PolicyAllow
+		}
+	}
+
+	// Default: require approval for unknown commands
+	return PolicyRequireApproval
+}
+
+// IsBlocked returns true if a command is blocked
+func (p *CommandPolicy) IsBlocked(command string) bool {
+	return p.Evaluate(command) == PolicyBlock
+}
+
+// NeedsApproval returns true if a command needs user approval
+func (p *CommandPolicy) NeedsApproval(command string) bool {
+	return p.Evaluate(command) == PolicyRequireApproval
+}
+
+// IsAutoApproved returns true if a command can run without approval
+func (p *CommandPolicy) IsAutoApproved(command string) bool {
+	return p.Evaluate(command) == PolicyAllow
+}
diff --git a/internal/agentexec/server.go b/internal/agentexec/server.go
new file mode 100644
index 0000000..57fd554
--- /dev/null
+++ b/internal/agentexec/server.go
@@ -0,0 +1,444 @@
+package agentexec
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/rs/zerolog/log"
+)
+
+var upgrader = websocket.Upgrader{
+	ReadBufferSize:  1024,
+	WriteBufferSize: 1024,
+	CheckOrigin: func(r *http.Request) bool {
+		return true // Agents can connect from anywhere
+	},
+}
+
+// Server manages WebSocket connections from agents
+type Server struct {
+	mu            sync.RWMutex
+	agents        map[string]*agentConn // agentID -> connection
+	pendingReqs   map[string]chan CommandResultPayload // requestID -> response channel
+	validateToken func(token string) bool
+}
+
+type agentConn struct {
+	conn      *websocket.Conn
+	agent     ConnectedAgent
+	writeMu   sync.Mutex
+	done      chan struct{}
+}
+
+// NewServer creates a new agent execution server
+func NewServer(validateToken func(token string) bool) *Server {
+	return &Server{
+		agents:        make(map[string]*agentConn),
+		pendingReqs:   make(map[string]chan CommandResultPayload),
+		validateToken: validateToken,
+	}
+}
+
+// HandleWebSocket handles incoming WebSocket connections from agents
+func (s *Server) HandleWebSocket(w http.ResponseWriter, r *http.Request) {
+	// CRITICAL: Clear http.Server deadlines BEFORE WebSocket upgrade.
+	// The http.Server.ReadTimeout sets a deadline on the underlying connection when
+	// the request starts. We must clear it before the upgrade or the connection will
+	// be closed when that deadline fires (typically ~15 seconds after connection).
+	// Use http.ResponseController (Go 1.20+) to clear the deadline.
+	rc := http.NewResponseController(w)
+	if err := rc.SetReadDeadline(time.Time{}); err != nil {
+		log.Debug().Err(err).Msg("Failed to clear read deadline via ResponseController")
+	}
+	if err := rc.SetWriteDeadline(time.Time{}); err != nil {
+		log.Debug().Err(err).Msg("Failed to clear write deadline via ResponseController")
+	}
+
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to upgrade WebSocket connection")
+		return
+	}
+
+	// Also clear on the WebSocket's underlying connection as a safety net
+	if netConn := conn.NetConn(); netConn != nil {
+		netConn.SetReadDeadline(time.Time{})
+		netConn.SetWriteDeadline(time.Time{})
+	}
+
+	// Read first message (must be agent_register)
+	conn.SetReadDeadline(time.Now().Add(30 * time.Second))
+	_, msgBytes, err := conn.ReadMessage()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to read registration message")
+		conn.Close()
+		return
+	}
+
+	var msg Message
+	if err := json.Unmarshal(msgBytes, &msg); err != nil {
+		log.Error().Err(err).Msg("Failed to parse registration message")
+		conn.Close()
+		return
+	}
+
+	if msg.Type != MsgTypeAgentRegister {
+		log.Error().Str("type", string(msg.Type)).Msg("First message must be agent_register")
+		conn.Close()
+		return
+	}
+
+	// Parse registration payload
+	payloadBytes, err := json.Marshal(msg.Payload)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to marshal registration payload")
+		conn.Close()
+		return
+	}
+
+	var reg AgentRegisterPayload
+	if err := json.Unmarshal(payloadBytes, &reg); err != nil {
+		log.Error().Err(err).Msg("Failed to parse registration payload")
+		conn.Close()
+		return
+	}
+
+	// Validate token
+	if s.validateToken != nil && !s.validateToken(reg.Token) {
+		log.Warn().Str("agent_id", reg.AgentID).Msg("Agent registration rejected: invalid token")
+		s.sendMessage(conn, Message{
+			Type:      MsgTypeRegistered,
+			Timestamp: time.Now(),
+			Payload:   RegisteredPayload{Success: false, Message: "Invalid token"},
+		})
+		conn.Close()
+		return
+	}
+
+	// Create agent connection
+	ac := &agentConn{
+		conn: conn,
+		agent: ConnectedAgent{
+			AgentID:     reg.AgentID,
+			Hostname:    reg.Hostname,
+			Version:     reg.Version,
+			Platform:    reg.Platform,
+			Tags:        reg.Tags,
+			ConnectedAt: time.Now(),
+		},
+		done: make(chan struct{}),
+	}
+
+	// Register agent
+	s.mu.Lock()
+	// Close existing connection if any
+	if existing, ok := s.agents[reg.AgentID]; ok {
+		close(existing.done)
+		existing.conn.Close()
+	}
+	s.agents[reg.AgentID] = ac
+	s.mu.Unlock()
+
+	log.Info().
+		Str("agent_id", reg.AgentID).
+		Str("hostname", reg.Hostname).
+		Str("version", reg.Version).
+		Str("platform", reg.Platform).
+		Msg("Agent connected")
+
+	// Send registration success
+	s.sendMessage(conn, Message{
+		Type:      MsgTypeRegistered,
+		Timestamp: time.Now(),
+		Payload:   RegisteredPayload{Success: true, Message: "Registered"},
+	})
+
+	// Clear deadline for normal operation - both on the WebSocket and underlying connection
+	// This is critical because Go's http.Server.ReadTimeout may have set a deadline
+	// on the underlying connection before the WebSocket upgrade occurred.
+	conn.SetReadDeadline(time.Time{})
+	conn.SetWriteDeadline(time.Time{})
+	if netConn := conn.NetConn(); netConn != nil {
+		netConn.SetReadDeadline(time.Time{})
+		netConn.SetWriteDeadline(time.Time{})
+	}
+
+	// Set up ping/pong handlers to keep connection alive
+	conn.SetPongHandler(func(appData string) error {
+		// Reset read deadline on pong received
+		conn.SetReadDeadline(time.Time{})
+		return nil
+	})
+
+	// Start server-side ping loop to keep connection alive
+	pingDone := make(chan struct{})
+	go s.pingLoop(ac, pingDone)
+	defer close(pingDone)
+
+	// Run read loop (blocking) - don't use goroutine, or HTTP handler will close connection
+	s.readLoop(ac)
+}
+
+func (s *Server) readLoop(ac *agentConn) {
+	defer func() {
+		s.mu.Lock()
+		if existing, ok := s.agents[ac.agent.AgentID]; ok && existing == ac {
+			delete(s.agents, ac.agent.AgentID)
+		}
+		s.mu.Unlock()
+		ac.conn.Close()
+		log.Info().Str("agent_id", ac.agent.AgentID).Msg("Agent disconnected")
+	}()
+
+	log.Debug().Str("agent_id", ac.agent.AgentID).Msg("Starting read loop for agent")
+
+	for {
+		select {
+		case <-ac.done:
+			log.Debug().Str("agent_id", ac.agent.AgentID).Msg("Read loop exiting: done channel closed")
+			return
+		default:
+		}
+
+		_, msgBytes, err := ac.conn.ReadMessage()
+		if err != nil {
+			log.Debug().Err(err).Str("agent_id", ac.agent.AgentID).Msg("Read loop exiting: read error")
+			if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+				log.Error().Err(err).Str("agent_id", ac.agent.AgentID).Msg("WebSocket read error")
+			}
+			return
+		}
+
+		var msg Message
+		if err := json.Unmarshal(msgBytes, &msg); err != nil {
+			log.Error().Err(err).Str("agent_id", ac.agent.AgentID).Msg("Failed to parse message")
+			continue
+		}
+
+		switch msg.Type {
+		case MsgTypeAgentPing:
+			s.sendMessage(ac.conn, Message{
+				Type:      MsgTypePong,
+				Timestamp: time.Now(),
+			})
+
+		case MsgTypeCommandResult:
+			payloadBytes, _ := json.Marshal(msg.Payload)
+			var result CommandResultPayload
+			if err := json.Unmarshal(payloadBytes, &result); err != nil {
+				log.Error().Err(err).Msg("Failed to parse command result")
+				continue
+			}
+
+			s.mu.RLock()
+			ch, ok := s.pendingReqs[result.RequestID]
+			s.mu.RUnlock()
+
+			if ok {
+				select {
+				case ch <- result:
+				default:
+					log.Warn().Str("request_id", result.RequestID).Msg("Result channel full, dropping")
+				}
+			} else {
+				log.Warn().Str("request_id", result.RequestID).Msg("No pending request for result")
+			}
+		}
+	}
+}
+
+func (s *Server) pingLoop(ac *agentConn, done chan struct{}) {
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	// Track consecutive ping failures to detect dead connections faster
+	consecutiveFailures := 0
+	const maxConsecutiveFailures = 3
+
+	for {
+		select {
+		case <-done:
+			return
+		case <-ac.done:
+			return
+		case <-ticker.C:
+			ac.writeMu.Lock()
+			err := ac.conn.WriteControl(websocket.PingMessage, []byte{}, time.Now().Add(5*time.Second))
+			ac.writeMu.Unlock()
+			if err != nil {
+				consecutiveFailures++
+				log.Warn().
+					Err(err).
+					Str("agent_id", ac.agent.AgentID).
+					Str("hostname", ac.agent.Hostname).
+					Int("consecutive_failures", consecutiveFailures).
+					Msg("Failed to send ping to agent")
+				
+				if consecutiveFailures >= maxConsecutiveFailures {
+					log.Error().
+						Str("agent_id", ac.agent.AgentID).
+						Str("hostname", ac.agent.Hostname).
+						Int("failures", consecutiveFailures).
+						Msg("Agent connection appears dead after multiple ping failures, closing connection")
+					
+					// Close the connection - this will cause readLoop to exit and clean up
+					ac.conn.Close()
+					return
+				}
+			} else {
+				// Reset failure counter on successful ping
+				consecutiveFailures = 0
+			}
+		}
+	}
+}
+
+func (s *Server) sendMessage(conn *websocket.Conn, msg Message) error {
+	msgBytes, err := json.Marshal(msg)
+	if err != nil {
+		return err
+	}
+	return conn.WriteMessage(websocket.TextMessage, msgBytes)
+}
+
+// ExecuteCommand sends a command to an agent and waits for the result
+func (s *Server) ExecuteCommand(ctx context.Context, agentID string, cmd ExecuteCommandPayload) (*CommandResultPayload, error) {
+	s.mu.RLock()
+	ac, ok := s.agents[agentID]
+	s.mu.RUnlock()
+
+	if !ok {
+		return nil, fmt.Errorf("agent %s not connected", agentID)
+	}
+
+	// Create response channel
+	respCh := make(chan CommandResultPayload, 1)
+	s.mu.Lock()
+	s.pendingReqs[cmd.RequestID] = respCh
+	s.mu.Unlock()
+
+	defer func() {
+		s.mu.Lock()
+		delete(s.pendingReqs, cmd.RequestID)
+		s.mu.Unlock()
+	}()
+
+	// Send command
+	msg := Message{
+		Type:      MsgTypeExecuteCmd,
+		ID:        cmd.RequestID,
+		Timestamp: time.Now(),
+		Payload:   cmd,
+	}
+
+	ac.writeMu.Lock()
+	err := s.sendMessage(ac.conn, msg)
+	ac.writeMu.Unlock()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to send command: %w", err)
+	}
+
+	// Wait for result
+	timeout := time.Duration(cmd.Timeout) * time.Second
+	if timeout <= 0 {
+		timeout = 60 * time.Second
+	}
+
+	select {
+	case result := <-respCh:
+		return &result, nil
+	case <-time.After(timeout):
+		return nil, fmt.Errorf("command timed out after %v", timeout)
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// ReadFile reads a file from an agent
+func (s *Server) ReadFile(ctx context.Context, agentID string, req ReadFilePayload) (*CommandResultPayload, error) {
+	s.mu.RLock()
+	ac, ok := s.agents[agentID]
+	s.mu.RUnlock()
+
+	if !ok {
+		return nil, fmt.Errorf("agent %s not connected", agentID)
+	}
+
+	// Create response channel
+	respCh := make(chan CommandResultPayload, 1)
+	s.mu.Lock()
+	s.pendingReqs[req.RequestID] = respCh
+	s.mu.Unlock()
+
+	defer func() {
+		s.mu.Lock()
+		delete(s.pendingReqs, req.RequestID)
+		s.mu.Unlock()
+	}()
+
+	// Send request
+	msg := Message{
+		Type:      MsgTypeReadFile,
+		ID:        req.RequestID,
+		Timestamp: time.Now(),
+		Payload:   req,
+	}
+
+	ac.writeMu.Lock()
+	err := s.sendMessage(ac.conn, msg)
+	ac.writeMu.Unlock()
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to send read_file request: %w", err)
+	}
+
+	// Wait for result
+	timeout := 30 * time.Second
+	select {
+	case result := <-respCh:
+		return &result, nil
+	case <-time.After(timeout):
+		return nil, fmt.Errorf("read_file timed out after %v", timeout)
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+// GetConnectedAgents returns a list of currently connected agents
+func (s *Server) GetConnectedAgents() []ConnectedAgent {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	agents := make([]ConnectedAgent, 0, len(s.agents))
+	for _, ac := range s.agents {
+		agents = append(agents, ac.agent)
+	}
+	return agents
+}
+
+// IsAgentConnected checks if an agent is currently connected
+func (s *Server) IsAgentConnected(agentID string) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	_, ok := s.agents[agentID]
+	return ok
+}
+
+// GetAgentForHost finds the agent for a given hostname
+func (s *Server) GetAgentForHost(hostname string) (string, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	for _, ac := range s.agents {
+		if ac.agent.Hostname == hostname {
+			return ac.agent.AgentID, true
+		}
+	}
+	return "", false
+}
diff --git a/internal/agentexec/types.go b/internal/agentexec/types.go
new file mode 100644
index 0000000..0e79d5e
--- /dev/null
+++ b/internal/agentexec/types.go
@@ -0,0 +1,84 @@
+package agentexec
+
+import (
+	"time"
+)
+
+// MessageType identifies the type of WebSocket message
+type MessageType string
+
+const (
+	// Agent -> Server messages
+	MsgTypeAgentRegister MessageType = "agent_register"
+	MsgTypeAgentPing     MessageType = "agent_ping"
+	MsgTypeCommandResult MessageType = "command_result"
+
+	// Server -> Agent messages
+	MsgTypeRegistered    MessageType = "registered"
+	MsgTypePong          MessageType = "pong"
+	MsgTypeExecuteCmd    MessageType = "execute_command"
+	MsgTypeReadFile      MessageType = "read_file"
+)
+
+// Message is the envelope for all WebSocket messages
+type Message struct {
+	Type      MessageType `json:"type"`
+	ID        string      `json:"id,omitempty"`         // Unique message ID for request/response correlation
+	Timestamp time.Time   `json:"timestamp"`
+	Payload   interface{} `json:"payload,omitempty"`
+}
+
+// AgentRegisterPayload is sent by agent on connection
+type AgentRegisterPayload struct {
+	AgentID   string   `json:"agent_id"`
+	Hostname  string   `json:"hostname"`
+	Version   string   `json:"version"`
+	Platform  string   `json:"platform"`  // "linux", "windows", "darwin"
+	Tags      []string `json:"tags,omitempty"`
+	Token     string   `json:"token"`     // API token for authentication
+}
+
+// RegisteredPayload is sent by server after successful registration
+type RegisteredPayload struct {
+	Success bool   `json:"success"`
+	Message string `json:"message,omitempty"`
+}
+
+// ExecuteCommandPayload is sent by server to request command execution
+type ExecuteCommandPayload struct {
+	RequestID  string `json:"request_id"`
+	Command    string `json:"command"`
+	TargetType string `json:"target_type"` // "host", "container", "vm"
+	TargetID   string `json:"target_id,omitempty"` // VMID for container/VM
+	Timeout    int    `json:"timeout,omitempty"` // seconds, 0 = default
+}
+
+// ReadFilePayload is sent by server to request file content
+type ReadFilePayload struct {
+	RequestID  string `json:"request_id"`
+	Path       string `json:"path"`
+	TargetType string `json:"target_type"`
+	TargetID   string `json:"target_id,omitempty"`
+	MaxBytes   int64  `json:"max_bytes,omitempty"` // 0 = default (1MB)
+}
+
+// CommandResultPayload is sent by agent with command execution result
+type CommandResultPayload struct {
+	RequestID string `json:"request_id"`
+	Success   bool   `json:"success"`
+	Stdout    string `json:"stdout,omitempty"`
+	Stderr    string `json:"stderr,omitempty"`
+	ExitCode  int    `json:"exit_code"`
+	Error     string `json:"error,omitempty"`
+	Duration  int64  `json:"duration_ms"`
+}
+
+// ConnectedAgent represents an agent connected via WebSocket
+type ConnectedAgent struct {
+	AgentID   string
+	Hostname  string
+	Version   string
+	Platform  string
+	Tags      []string
+	ConnectedAt time.Time
+}
diff --git a/internal/agentupdate/update.go b/internal/agentupdate/update.go
index 37d5235..2808550 100644
--- a/internal/agentupdate/update.go
+++ b/internal/agentupdate/update.go
@@ -106,11 +106,11 @@ func (u *Updater) RunLoop(ctx context.Context) {
 		return
 	}
 
-	// Initial check after a short delay
+	// Initial check after a short delay (5s to quickly update outdated agents)
 	select {
 	case <-ctx.Done():
 		return
-	case <-time.After(30 * time.Second):
+	case <-time.After(5 * time.Second):
 		u.CheckAndUpdate(ctx)
 	}
 
@@ -156,13 +156,23 @@ func (u *Updater) CheckAndUpdate(ctx context.Context) {
 		return
 	}
 
-	// Normalize both versions by stripping "v" prefix for comparison.
-	// Server returns version without prefix (e.g., "4.33.1"), but agent's
-	// CurrentVersion may include it (e.g., "v4.33.1") depending on build.
-	if utils.NormalizeVersion(serverVersion) == utils.NormalizeVersion(u.cfg.CurrentVersion) {
+	// Compare versions using semver comparison to only update to newer versions.
+	// This prevents accidental downgrades if the server temporarily has an older version.
+	currentNorm := utils.NormalizeVersion(u.cfg.CurrentVersion)
+	serverNorm := utils.NormalizeVersion(serverVersion)
+
+	cmp := utils.CompareVersions(serverNorm, currentNorm)
+	if cmp == 0 {
 		u.logger.Debug().Str("version", u.cfg.CurrentVersion).Msg("Agent is up to date")
 		return
 	}
+	if cmp < 0 {
+		u.logger.Debug().
+			Str("currentVersion", currentNorm).
+			Str("serverVersion", serverNorm).
+			Msg("Server has older version, skipping downgrade")
+		return
+	}
 
 	u.logger.Info().
 		Str("currentVersion", u.cfg.CurrentVersion).
@@ -402,6 +412,10 @@ func (u *Updater) performUpdate(ctx context.Context) error {
 	// Remove backup on success
 	os.Remove(backupPath)
 
+	// Write previous version to a file so the agent can report "updated from X" on next start
+	updateInfoPath := filepath.Join(targetDir, ".pulse-update-info")
+	_ = os.WriteFile(updateInfoPath, []byte(u.cfg.CurrentVersion), 0644)
+
 	// On Unraid, also update the persistent copy on the flash drive
 	// This ensures the update survives reboots
 	if isUnraid() {
@@ -433,6 +447,32 @@ func (u *Updater) performUpdate(ctx context.Context) error {
 	return restartProcess(execPath)
 }
 
+// GetUpdatedFromVersion checks if the agent was recently updated and returns the previous version.
+// Returns empty string if no update info exists. Clears the info file after reading.
+func GetUpdatedFromVersion() string {
+	execPath, err := os.Executable()
+	if err != nil {
+		return ""
+	}
+
+	// Resolve symlinks to get the real path
+	realExecPath, err := filepath.EvalSymlinks(execPath)
+	if err != nil {
+		realExecPath = execPath
+	}
+
+	updateInfoPath := filepath.Join(filepath.Dir(realExecPath), ".pulse-update-info")
+	data, err := os.ReadFile(updateInfoPath)
+	if err != nil {
+		return ""
+	}
+
+	// Clear the file after reading (only report once)
+	os.Remove(updateInfoPath)
+
+	return strings.TrimSpace(string(data))
+}
+
 // determineArch returns the architecture string for download URLs (e.g., "linux-amd64", "darwin-arm64").
 func determineArch() string {
 	os := runtime.GOOS
diff --git a/internal/ai/alert_adapter.go b/internal/ai/alert_adapter.go
new file mode 100644
index 0000000..b1c8a39
--- /dev/null
+++ b/internal/ai/alert_adapter.go
@@ -0,0 +1,216 @@
+package ai
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/alerts"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+// AlertManagerAdapter adapts the alerts.Manager to the AI's AlertProvider interface
+type AlertManagerAdapter struct {
+	manager *alerts.Manager
+}
+
+// NewAlertManagerAdapter creates a new adapter for the alert manager
+func NewAlertManagerAdapter(manager *alerts.Manager) *AlertManagerAdapter {
+	return &AlertManagerAdapter{manager: manager}
+}
+
+// GetActiveAlerts returns all currently active alerts
+func (a *AlertManagerAdapter) GetActiveAlerts() []AlertInfo {
+	if a.manager == nil {
+		return nil
+	}
+
+	activeAlerts := a.manager.GetActiveAlerts()
+	result := make([]AlertInfo, 0, len(activeAlerts))
+
+	for _, alert := range activeAlerts {
+		result = append(result, convertAlertFromManager(&alert))
+	}
+
+	return result
+}
+
+// GetRecentlyResolved returns alerts resolved in the last N minutes
+func (a *AlertManagerAdapter) GetRecentlyResolved(minutes int) []ResolvedAlertInfo {
+	if a.manager == nil {
+		return nil
+	}
+
+	resolvedAlerts := a.manager.GetRecentlyResolved()
+	cutoff := time.Now().Add(-time.Duration(minutes) * time.Minute)
+	result := make([]ResolvedAlertInfo, 0)
+
+	for _, resolved := range resolvedAlerts {
+		if resolved.ResolvedTime.After(cutoff) {
+			info := ResolvedAlertInfo{
+				AlertInfo:    convertAlertFromModels(&resolved.Alert),
+				ResolvedTime: resolved.ResolvedTime,
+				Duration:     formatDuration(resolved.ResolvedTime.Sub(resolved.StartTime)),
+			}
+			result = append(result, info)
+		}
+	}
+
+	return result
+}
+
+// GetAlertsByResource returns active alerts for a specific resource
+func (a *AlertManagerAdapter) GetAlertsByResource(resourceID string) []AlertInfo {
+	if a.manager == nil {
+		return nil
+	}
+
+	activeAlerts := a.manager.GetActiveAlerts()
+	result := make([]AlertInfo, 0)
+
+	for _, alert := range activeAlerts {
+		if alert.ResourceID == resourceID {
+			result = append(result, convertAlertFromManager(&alert))
+		}
+	}
+
+	return result
+}
+
+// GetAlertHistory returns historical alerts for a resource
+func (a *AlertManagerAdapter) GetAlertHistory(resourceID string, limit int) []ResolvedAlertInfo {
+	if a.manager == nil {
+		return nil
+	}
+
+	// Get from recently resolved and filter by resource
+	resolvedAlerts := a.manager.GetRecentlyResolved()
+	result := make([]ResolvedAlertInfo, 0)
+
+	for _, resolved := range resolvedAlerts {
+		if resolved.ResourceID == resourceID {
+			info := ResolvedAlertInfo{
+				AlertInfo:    convertAlertFromModels(&resolved.Alert),
+				ResolvedTime: resolved.ResolvedTime,
+				Duration:     formatDuration(resolved.ResolvedTime.Sub(resolved.StartTime)),
+			}
+			result = append(result, info)
+			if len(result) >= limit {
+				break
+			}
+		}
+	}
+
+	return result
+}
+
+// convertAlertFromManager converts an alerts.Alert to AI's AlertInfo
+func convertAlertFromManager(alert *alerts.Alert) AlertInfo {
+	if alert == nil {
+		return AlertInfo{}
+	}
+
+	resourceType := inferResourceType(alert.Type, alert.Metadata)
+
+	return AlertInfo{
+		ID:           alert.ID,
+		Type:         alert.Type,
+		Level:        string(alert.Level),
+		ResourceID:   alert.ResourceID,
+		ResourceName: alert.ResourceName,
+		ResourceType: resourceType,
+		Node:         alert.Node,
+		Instance:     alert.Instance,
+		Message:      alert.Message,
+		Value:        alert.Value,
+		Threshold:    alert.Threshold,
+		StartTime:    alert.StartTime,
+		Duration:     formatDuration(time.Since(alert.StartTime)),
+		Acknowledged: alert.Acknowledged,
+	}
+}
+
+// convertAlertFromModels converts a models.Alert to AI's AlertInfo
+func convertAlertFromModels(alert *models.Alert) AlertInfo {
+	if alert == nil {
+		return AlertInfo{}
+	}
+
+	resourceType := inferResourceType(alert.Type, nil)
+
+	return AlertInfo{
+		ID:           alert.ID,
+		Type:         alert.Type,
+		Level:        alert.Level,
+		ResourceID:   alert.ResourceID,
+		ResourceName: alert.ResourceName,
+		ResourceType: resourceType,
+		Node:         alert.Node,
+		Instance:     alert.Instance,
+		Message:      alert.Message,
+		Value:        alert.Value,
+		Threshold:    alert.Threshold,
+		StartTime:    alert.StartTime,
+		Duration:     formatDuration(time.Since(alert.StartTime)),
+		Acknowledged: alert.Acknowledged,
+	}
+}
+
+// inferResourceType infers resource type from alert type
+func inferResourceType(alertType string, metadata map[string]interface{}) string {
+	if metadata != nil {
+		if rt, ok := metadata["resourceType"].(string); ok {
+			return rt
+		}
+	}
+
+	switch {
+	case alertType == "node_offline" || alertType == "node_cpu" || alertType == "node_memory" || alertType == "node_temperature":
+		return "node"
+	case alertType == "storage_usage" || alertType == "storage":
+		return "storage"
+	case alertType == "docker_cpu" || alertType == "docker_memory" || alertType == "docker_restart" || alertType == "docker_offline":
+		return "docker"
+	case alertType == "host_cpu" || alertType == "host_memory" || alertType == "host_offline" || alertType == "host_disk":
+		return "host"
+	case alertType == "pmg" || alertType == "pmg_queue" || alertType == "pmg_quarantine":
+		return "pmg"
+	case alertType == "backup" || alertType == "backup_missing":
+		return "backup"
+	case alertType == "snapshot" || alertType == "snapshot_age":
+		return "snapshot"
+	default:
+		return "guest"
+	}
+}
+
+// formatDuration returns a human-readable duration string
+func formatDuration(d time.Duration) string {
+	if d < time.Minute {
+		return "< 1 min"
+	} else if d < time.Hour {
+		mins := int(d.Minutes())
+		if mins == 1 {
+			return "1 min"
+		}
+		return fmt.Sprintf("%d mins", mins)
+	} else if d < 24*time.Hour {
+		hours := int(d.Hours())
+		mins := int(d.Minutes()) % 60
+		if mins > 0 {
+			return fmt.Sprintf("%dh %dm", hours, mins)
+		}
+		if hours == 1 {
+			return "1 hour"
+		}
+		return fmt.Sprintf("%d hours", hours)
+	}
+	days := int(d.Hours() / 24)
+	hours := int(d.Hours()) % 24
+	if hours > 0 {
+		return fmt.Sprintf("%dd %dh", days, hours)
+	}
+	if days == 1 {
+		return "1 day"
+	}
+	return fmt.Sprintf("%d days", days)
+}
diff --git a/internal/ai/alert_provider.go b/internal/ai/alert_provider.go
new file mode 100644
index 0000000..3034b7c
--- /dev/null
+++ b/internal/ai/alert_provider.go
@@ -0,0 +1,237 @@
+// Package ai provides AI-powered infrastructure investigation and remediation.
+package ai
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// AlertInfo contains information about an alert for AI context
+type AlertInfo struct {
+	ID           string    `json:"id"`
+	Type         string    `json:"type"`          // cpu, memory, disk, offline, etc.
+	Level        string    `json:"level"`         // warning, critical
+	ResourceID   string    `json:"resource_id"`   // unique resource identifier
+	ResourceName string    `json:"resource_name"` // human-readable name
+	ResourceType string    `json:"resource_type"` // guest, node, storage, docker, etc.
+	Node         string    `json:"node"`          // PVE node (if applicable)
+	Instance     string    `json:"instance"`      // Proxmox instance name
+	Message      string    `json:"message"`       // Alert description
+	Value        float64   `json:"value"`         // Current metric value
+	Threshold    float64   `json:"threshold"`     // Threshold that was exceeded
+	StartTime    time.Time `json:"start_time"`    // When alert started
+	Duration     string    `json:"duration"`      // Human-readable duration
+	Acknowledged bool      `json:"acknowledged"`  // Whether alert has been acked
+}
+
+// ResolvedAlertInfo contains information about a recently resolved alert
+type ResolvedAlertInfo struct {
+	AlertInfo
+	ResolvedTime time.Time `json:"resolved_time"`
+	Duration     string    `json:"total_duration"` // How long the alert lasted
+}
+
+// AlertProvider provides access to the current alert state
+type AlertProvider interface {
+	// GetActiveAlerts returns all currently active alerts
+	GetActiveAlerts() []AlertInfo
+
+	// GetRecentlyResolved returns alerts resolved in the last N minutes
+	GetRecentlyResolved(minutes int) []ResolvedAlertInfo
+
+	// GetAlertsByResource returns active alerts for a specific resource
+	GetAlertsByResource(resourceID string) []AlertInfo
+
+	// GetAlertHistory returns historical alerts for a resource
+	GetAlertHistory(resourceID string, limit int) []ResolvedAlertInfo
+}
+
+// SetAlertProvider sets the alert provider for AI context
+func (s *Service) SetAlertProvider(ap AlertProvider) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.alertProvider = ap
+}
+
+// buildAlertContext generates AI context from current alerts
+func (s *Service) buildAlertContext() string {
+	s.mu.RLock()
+	ap := s.alertProvider
+	s.mu.RUnlock()
+
+	if ap == nil {
+		return ""
+	}
+
+	activeAlerts := ap.GetActiveAlerts()
+	recentlyResolved := ap.GetRecentlyResolved(30) // Last 30 minutes
+
+	if len(activeAlerts) == 0 && len(recentlyResolved) == 0 {
+		return ""
+	}
+
+	var sections []string
+	sections = append(sections, "\n## Alert Status")
+
+	// Active alerts
+	if len(activeAlerts) > 0 {
+		sections = append(sections, "\n### Active Alerts")
+		sections = append(sections, fmt.Sprintf("There are **%d active alert(s)** that may need attention:\n", len(activeAlerts)))
+
+		// Group by severity
+		var critical, warning []AlertInfo
+		for _, a := range activeAlerts {
+			if a.Level == "critical" {
+				critical = append(critical, a)
+			} else {
+				warning = append(warning, a)
+			}
+		}
+
+		if len(critical) > 0 {
+			sections = append(sections, "**Critical:**")
+			for _, a := range critical {
+				sections = append(sections, formatAlertForAI(a))
+			}
+		}
+
+		if len(warning) > 0 {
+			sections = append(sections, "**Warning:**")
+			for _, a := range warning {
+				sections = append(sections, formatAlertForAI(a))
+			}
+		}
+	} else {
+		sections = append(sections, "\n### No Active Alerts")
+		sections = append(sections, "All systems are operating within normal thresholds.")
+	}
+
+	// Recently resolved
+	if len(recentlyResolved) > 0 {
+		sections = append(sections, fmt.Sprintf("\n### Recently Resolved (%d)", len(recentlyResolved)))
+		sections = append(sections, "These alerts were resolved in the last 30 minutes:")
+		// Show up to 5 most recent
+		limit := 5
+		if len(recentlyResolved) < limit {
+			limit = len(recentlyResolved)
+		}
+		for i := 0; i < limit; i++ {
+			a := recentlyResolved[i]
+			sections = append(sections, fmt.Sprintf("- **%s** on %s: %s (lasted %s, resolved %s ago)",
+				a.Type, a.ResourceName, a.Message, a.Duration,
+				formatTimeAgo(a.ResolvedTime)))
+		}
+		if len(recentlyResolved) > limit {
+			sections = append(sections, fmt.Sprintf("  ... and %d more", len(recentlyResolved)-limit))
+		}
+	}
+
+	return strings.Join(sections, "\n")
+}
+
+// buildTargetAlertContext builds alert context for a specific target
+func (s *Service) buildTargetAlertContext(resourceID string) string {
+	s.mu.RLock()
+	ap := s.alertProvider
+	s.mu.RUnlock()
+
+	if ap == nil || resourceID == "" {
+		return ""
+	}
+
+	alerts := ap.GetAlertsByResource(resourceID)
+	if len(alerts) == 0 {
+		return ""
+	}
+
+	var lines []string
+	lines = append(lines, "\n### Active Alerts for This Resource")
+	for _, a := range alerts {
+		lines = append(lines, formatAlertForAI(a))
+	}
+
+	return strings.Join(lines, "\n")
+}
+
+// formatAlertForAI formats an alert for inclusion in AI context
+func formatAlertForAI(a AlertInfo) string {
+	ackedNote := ""
+	if a.Acknowledged {
+		ackedNote = " [ACKNOWLEDGED]"
+	}
+
+	nodeInfo := ""
+	if a.Node != "" {
+		nodeInfo = fmt.Sprintf(" on node %s", a.Node)
+	}
+
+	return fmt.Sprintf("- **%s** %s: %s (current: %.1f%%, threshold: %.1f%%) - active for %s%s%s",
+		strings.ToUpper(a.Level), a.Type, a.ResourceName,
+		a.Value, a.Threshold, a.Duration, nodeInfo, ackedNote)
+}
+
+// formatTimeAgo returns a human-readable time-ago string
+func formatTimeAgo(t time.Time) string {
+	d := time.Since(t)
+	if d < time.Minute {
+		return "just now"
+	} else if d < time.Hour {
+		mins := int(d.Minutes())
+		if mins == 1 {
+			return "1 minute"
+		}
+		return fmt.Sprintf("%d minutes", mins)
+	} else if d < 24*time.Hour {
+		hours := int(d.Hours())
+		if hours == 1 {
+			return "1 hour"
+		}
+		return fmt.Sprintf("%d hours", hours)
+	}
+	days := int(d.Hours() / 24)
+	if days == 1 {
+		return "1 day"
+	}
+	return fmt.Sprintf("%d days", days)
+}
+
+// AlertInvestigationRequest represents a request to investigate an alert
+type AlertInvestigationRequest struct {
+	AlertID      string `json:"alert_id"`
+	ResourceID   string `json:"resource_id"`
+	ResourceName string `json:"resource_name"`
+	ResourceType string `json:"resource_type"` // guest, node, storage, docker
+	AlertType    string `json:"alert_type"`    // cpu, memory, disk, offline, etc.
+	Level        string `json:"level"`         // warning, critical
+	Value        float64 `json:"value"`
+	Threshold    float64 `json:"threshold"`
+	Message      string `json:"message"`
+	Duration     string `json:"duration"` // How long the alert has been active
+	Node         string `json:"node,omitempty"`
+	VMID         int    `json:"vmid,omitempty"`
+}
+
+// GenerateAlertInvestigationPrompt creates a focused prompt for alert investigation
+func GenerateAlertInvestigationPrompt(req AlertInvestigationRequest) string {
+	var prompt strings.Builder
+
+	prompt.WriteString(fmt.Sprintf("Investigate this %s alert:\n\n", strings.ToUpper(req.Level)))
+	prompt.WriteString(fmt.Sprintf("**Resource:** %s (%s)\n", req.ResourceName, req.ResourceType))
+	prompt.WriteString(fmt.Sprintf("**Alert Type:** %s\n", req.AlertType))
+	prompt.WriteString(fmt.Sprintf("**Current Value:** %.1f%%\n", req.Value))
+	prompt.WriteString(fmt.Sprintf("**Threshold:** %.1f%%\n", req.Threshold))
+	prompt.WriteString(fmt.Sprintf("**Duration:** %s\n", req.Duration))
+
+	if req.Node != "" {
+		prompt.WriteString(fmt.Sprintf("**Node:** %s\n", req.Node))
+	}
+
+	prompt.WriteString("\n**Action Required:**\n")
+	prompt.WriteString("1. Identify the root cause of this alert\n")
+	prompt.WriteString("2. Check related metrics and system state\n")
+	prompt.WriteString("3. Suggest specific remediation steps\n")
+	prompt.WriteString("4. If safe, execute diagnostic commands to gather more info\n")
+
+	return prompt.String()
+}
diff --git a/internal/ai/alert_threshold_adapter.go b/internal/ai/alert_threshold_adapter.go
new file mode 100644
index 0000000..64e81f4
--- /dev/null
+++ b/internal/ai/alert_threshold_adapter.go
@@ -0,0 +1,76 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/alerts"
+)
+
+// AlertThresholdAdapter adapts alerts.Manager to the ThresholdProvider interface
+// This allows the patrol service to use user-configured alert thresholds
+type AlertThresholdAdapter struct {
+	manager *alerts.Manager
+}
+
+// NewAlertThresholdAdapter creates a new adapter for the alerts manager
+func NewAlertThresholdAdapter(manager *alerts.Manager) *AlertThresholdAdapter {
+	return &AlertThresholdAdapter{manager: manager}
+}
+
+// GetNodeCPUThreshold returns the CPU alert trigger threshold for nodes (0-100%)
+func (a *AlertThresholdAdapter) GetNodeCPUThreshold() float64 {
+	if a.manager == nil {
+		return 80 // default
+	}
+	cfg := a.manager.GetConfig()
+	if cfg.NodeDefaults.CPU != nil && cfg.NodeDefaults.CPU.Trigger > 0 {
+		return cfg.NodeDefaults.CPU.Trigger
+	}
+	return 80 // default
+}
+
+// GetNodeMemoryThreshold returns the memory alert trigger threshold for nodes (0-100%)
+func (a *AlertThresholdAdapter) GetNodeMemoryThreshold() float64 {
+	if a.manager == nil {
+		return 85 // default
+	}
+	cfg := a.manager.GetConfig()
+	if cfg.NodeDefaults.Memory != nil && cfg.NodeDefaults.Memory.Trigger > 0 {
+		return cfg.NodeDefaults.Memory.Trigger
+	}
+	return 85 // default
+}
+
+// GetGuestMemoryThreshold returns the memory alert trigger threshold for guests (0-100%)
+func (a *AlertThresholdAdapter) GetGuestMemoryThreshold() float64 {
+	if a.manager == nil {
+		return 85 // default
+	}
+	cfg := a.manager.GetConfig()
+	if cfg.GuestDefaults.Memory != nil && cfg.GuestDefaults.Memory.Trigger > 0 {
+		return cfg.GuestDefaults.Memory.Trigger
+	}
+	return 85 // default
+}
+
+// GetGuestDiskThreshold returns the disk alert trigger threshold for guests (0-100%)
+func (a *AlertThresholdAdapter) GetGuestDiskThreshold() float64 {
+	if a.manager == nil {
+		return 90 // default
+	}
+	cfg := a.manager.GetConfig()
+	if cfg.GuestDefaults.Disk != nil && cfg.GuestDefaults.Disk.Trigger > 0 {
+		return cfg.GuestDefaults.Disk.Trigger
+	}
+	return 90 // default
+}
+
+// GetStorageThreshold returns the usage alert trigger threshold for storage (0-100%)
+func (a *AlertThresholdAdapter) GetStorageThreshold() float64 {
+	if a.manager == nil {
+		return 85 // default
+	}
+	cfg := a.manager.GetConfig()
+	if cfg.StorageDefault.Trigger > 0 {
+		return cfg.StorageDefault.Trigger
+	}
+	return 85 // default
+}
diff --git a/internal/ai/alert_triggered.go b/internal/ai/alert_triggered.go
new file mode 100644
index 0000000..35588ee
--- /dev/null
+++ b/internal/ai/alert_triggered.go
@@ -0,0 +1,382 @@
+package ai
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/alerts"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rs/zerolog/log"
+)
+
+// AlertTriggeredAnalyzer handles AI analysis triggered by firing alerts
+// This provides token-efficient, real-time AI insights on specific resources
+type AlertTriggeredAnalyzer struct {
+	mu sync.RWMutex
+
+	patrolService *PatrolService
+	stateProvider StateProvider
+	enabled       bool
+
+	// Cooldown to prevent analyzing the same resource repeatedly
+	lastAnalyzed map[string]time.Time
+	cooldown     time.Duration
+
+	// Track pending analyses to deduplicate concurrent alerts
+	pending map[string]bool
+}
+
+// NewAlertTriggeredAnalyzer creates a new alert-triggered analyzer
+func NewAlertTriggeredAnalyzer(patrolService *PatrolService, stateProvider StateProvider) *AlertTriggeredAnalyzer {
+	return &AlertTriggeredAnalyzer{
+		patrolService: patrolService,
+		stateProvider: stateProvider,
+		enabled:       false,
+		lastAnalyzed:  make(map[string]time.Time),
+		cooldown:      5 * time.Minute, // Don't re-analyze the same resource within 5 minutes
+		pending:       make(map[string]bool),
+	}
+}
+
+// SetEnabled enables or disables alert-triggered analysis
+func (a *AlertTriggeredAnalyzer) SetEnabled(enabled bool) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.enabled = enabled
+	log.Info().Bool("enabled", enabled).Msg("Alert-triggered AI analysis setting updated")
+}
+
+// IsEnabled returns whether alert-triggered analysis is enabled
+func (a *AlertTriggeredAnalyzer) IsEnabled() bool {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+	return a.enabled
+}
+
+// OnAlertFired is called when an alert fires - triggers AI analysis of the affected resource
+func (a *AlertTriggeredAnalyzer) OnAlertFired(alert *alerts.Alert) {
+	if alert == nil {
+		return
+	}
+
+	a.mu.Lock()
+	if !a.enabled {
+		a.mu.Unlock()
+		return
+	}
+
+	// Create a resource key for deduplication
+	resourceKey := a.resourceKeyFromAlert(alert)
+	if resourceKey == "" {
+		a.mu.Unlock()
+		log.Debug().
+			Str("alertID", alert.ID).
+			Str("type", alert.Type).
+			Msg("Cannot determine resource key for alert, skipping AI analysis")
+		return
+	}
+
+	// Check cooldown
+	if lastTime, exists := a.lastAnalyzed[resourceKey]; exists {
+		if time.Since(lastTime) < a.cooldown {
+			a.mu.Unlock()
+			log.Debug().
+				Str("resourceKey", resourceKey).
+				Str("alertID", alert.ID).
+				Dur("cooldownRemaining", a.cooldown-time.Since(lastTime)).
+				Msg("Resource recently analyzed, skipping due to cooldown")
+			return
+		}
+	}
+
+	// Check for pending analysis
+	if a.pending[resourceKey] {
+		a.mu.Unlock()
+		log.Debug().
+			Str("resourceKey", resourceKey).
+			Str("alertID", alert.ID).
+			Msg("Analysis already pending for resource, skipping duplicate")
+		return
+	}
+
+	// Mark as pending
+	a.pending[resourceKey] = true
+	a.mu.Unlock()
+
+	// Run analysis in background
+	go a.analyzeResource(alert, resourceKey)
+}
+
+// analyzeResource performs AI analysis on the resource associated with an alert
+func (a *AlertTriggeredAnalyzer) analyzeResource(alert *alerts.Alert, resourceKey string) {
+	defer func() {
+		a.mu.Lock()
+		delete(a.pending, resourceKey)
+		a.lastAnalyzed[resourceKey] = time.Now()
+		a.mu.Unlock()
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	log.Info().
+		Str("alertID", alert.ID).
+		Str("type", alert.Type).
+		Str("resource", alert.ResourceName).
+		Str("resourceKey", resourceKey).
+		Float64("value", alert.Value).
+		Float64("threshold", alert.Threshold).
+		Msg("Starting AI analysis triggered by alert")
+
+	startTime := time.Now()
+
+	// Determine what type of resource this is and analyze it
+	findings := a.analyzeResourceByAlert(ctx, alert)
+
+	duration := time.Since(startTime)
+
+	if len(findings) > 0 {
+		log.Info().
+			Str("alertID", alert.ID).
+			Str("resourceKey", resourceKey).
+			Int("findingsCount", len(findings)).
+			Dur("duration", duration).
+			Msg("Alert-triggered AI analysis completed with findings")
+
+		// Add findings to the patrol service's findings store
+		if a.patrolService != nil && a.patrolService.findings != nil {
+			for _, finding := range findings {
+				// Link finding to the triggering alert
+				finding.AlertID = alert.ID
+				a.patrolService.findings.Add(finding)
+			}
+		}
+	} else {
+		log.Debug().
+			Str("alertID", alert.ID).
+			Str("resourceKey", resourceKey).
+			Dur("duration", duration).
+			Msg("Alert-triggered AI analysis completed with no additional findings")
+	}
+}
+
+// analyzeResourceByAlert determines the resource type from the alert and analyzes it
+func (a *AlertTriggeredAnalyzer) analyzeResourceByAlert(ctx context.Context, alert *alerts.Alert) []*Finding {
+	if a.patrolService == nil {
+		return nil
+	}
+
+	// Parse alert type to determine what kind of resource this is
+	alertType := strings.ToLower(alert.Type)
+
+	switch {
+	// Node alerts
+	case strings.HasPrefix(alertType, "node") ||
+		alertType == "cpu" && strings.Contains(alert.ResourceID, "/node/") ||
+		alertType == "memory" && strings.Contains(alert.ResourceID, "/node/"):
+		return a.analyzeNodeFromAlert(ctx, alert)
+
+	// Guest (VM/Container) alerts
+	case strings.Contains(alertType, "container") ||
+		strings.Contains(alertType, "vm") ||
+		strings.HasPrefix(alertType, "qemu") ||
+		strings.HasPrefix(alertType, "lxc") ||
+		strings.Contains(alert.ResourceID, "/qemu/") ||
+		strings.Contains(alert.ResourceID, "/lxc/"):
+		return a.analyzeGuestFromAlert(ctx, alert)
+
+	// Docker alerts
+	case strings.Contains(alertType, "docker"):
+		return a.analyzeDockerFromAlert(ctx, alert)
+
+	// Storage alerts
+	case strings.Contains(alertType, "storage") ||
+		strings.HasSuffix(alertType, "-usage"):
+		return a.analyzeStorageFromAlert(ctx, alert)
+
+	// Generic CPU/Memory/Disk alerts - try to determine from resource ID
+	case alertType == "cpu" || alertType == "memory" || alertType == "disk":
+		return a.analyzeGenericResourceFromAlert(ctx, alert)
+
+	default:
+		log.Debug().
+			Str("alertType", alertType).
+			Str("resourceID", alert.ResourceID).
+			Msg("Unknown alert type for targeted AI analysis, skipping")
+		return nil
+	}
+}
+
+// analyzeNodeFromAlert analyzes a Proxmox node triggered by an alert
+func (a *AlertTriggeredAnalyzer) analyzeNodeFromAlert(_ context.Context, alert *alerts.Alert) []*Finding {
+	if a.stateProvider == nil {
+		return nil
+	}
+
+	state := a.stateProvider.GetState()
+
+	// Find the node - first try ResourceID, then ResourceName
+	var targetNode *models.Node
+	for i := range state.Nodes {
+		node := &state.Nodes[i]
+		if node.ID == alert.ResourceID || node.Name == alert.ResourceName || node.Name == alert.Node {
+			targetNode = node
+			break
+		}
+	}
+
+	if targetNode == nil {
+		log.Warn().
+			Str("alertID", alert.ID).
+			Str("resourceID", alert.ResourceID).
+			Str("resourceName", alert.ResourceName).
+			Msg("Could not find node for alert-triggered analysis")
+		return nil
+	}
+
+	// Use patrol service's node analysis
+	return a.patrolService.analyzeNode(*targetNode)
+}
+
+// analyzeGuestFromAlert analyzes a VM/Container triggered by an alert
+func (a *AlertTriggeredAnalyzer) analyzeGuestFromAlert(_ context.Context, alert *alerts.Alert) []*Finding {
+	if a.stateProvider == nil {
+		return nil
+	}
+
+	state := a.stateProvider.GetState()
+
+	// Check VMs
+	for _, vm := range state.VMs {
+		if vm.ID == alert.ResourceID || vm.Name == alert.ResourceName {
+			return a.patrolService.analyzeGuest(
+				vm.ID, vm.Name, "vm", vm.Node, vm.Status,
+				vm.CPU, vm.Memory.Usage, vm.Disk.Usage,
+				nil, vm.Template,
+			)
+		}
+	}
+
+	// Check containers
+	for _, ct := range state.Containers {
+		if ct.ID == alert.ResourceID || ct.Name == alert.ResourceName {
+			return a.patrolService.analyzeGuest(
+				ct.ID, ct.Name, "container", ct.Node, ct.Status,
+				ct.CPU, ct.Memory.Usage, ct.Disk.Usage,
+				nil, ct.Template,
+			)
+		}
+	}
+
+	log.Warn().
+		Str("alertID", alert.ID).
+		Str("resourceID", alert.ResourceID).
+		Msg("Could not find guest for alert-triggered analysis")
+	return nil
+}
+
+// analyzeDockerFromAlert analyzes a Docker container/host triggered by an alert
+func (a *AlertTriggeredAnalyzer) analyzeDockerFromAlert(_ context.Context, alert *alerts.Alert) []*Finding {
+	if a.stateProvider == nil {
+		return nil
+	}
+
+	state := a.stateProvider.GetState()
+
+	// Try to find the Docker host or container
+	// Containers are nested inside DockerHosts
+	for _, dh := range state.DockerHosts {
+		// Check if this is a host alert
+		if dh.ID == alert.ResourceID || dh.Hostname == alert.ResourceName {
+			return a.patrolService.analyzeDockerHost(dh)
+		}
+
+		// Check containers within this host
+		for _, container := range dh.Containers {
+			if container.ID == alert.ResourceID || container.Name == alert.ResourceName {
+				return a.patrolService.analyzeDockerHost(dh)
+			}
+		}
+	}
+
+	log.Warn().
+		Str("alertID", alert.ID).
+		Str("resourceID", alert.ResourceID).
+		Msg("Could not find Docker resource for alert-triggered analysis")
+	return nil
+}
+
+// analyzeStorageFromAlert analyzes a storage resource triggered by an alert
+func (a *AlertTriggeredAnalyzer) analyzeStorageFromAlert(_ context.Context, alert *alerts.Alert) []*Finding {
+	if a.stateProvider == nil {
+		return nil
+	}
+
+	state := a.stateProvider.GetState()
+
+	// Storage is at the top level of StateSnapshot
+	for _, storage := range state.Storage {
+		if storage.ID == alert.ResourceID || storage.Name == alert.ResourceName {
+			return a.patrolService.analyzeStorage(storage)
+		}
+	}
+
+	log.Warn().
+		Str("alertID", alert.ID).
+		Str("resourceID", alert.ResourceID).
+		Msg("Could not find storage for alert-triggered analysis")
+	return nil
+}
+
+// analyzeGenericResourceFromAlert tries to determine resource type and analyze
+func (a *AlertTriggeredAnalyzer) analyzeGenericResourceFromAlert(ctx context.Context, alert *alerts.Alert) []*Finding {
+	// Try each resource type in order of likelihood
+	resourceID := alert.ResourceID
+
+	switch {
+	case strings.Contains(resourceID, "/node/"):
+		return a.analyzeNodeFromAlert(ctx, alert)
+	case strings.Contains(resourceID, "/qemu/") || strings.Contains(resourceID, "/lxc/"):
+		return a.analyzeGuestFromAlert(ctx, alert)
+	case strings.Contains(resourceID, "docker"):
+		return a.analyzeDockerFromAlert(ctx, alert)
+	default:
+		// Try guest first (most common), then node
+		findings := a.analyzeGuestFromAlert(ctx, alert)
+		if len(findings) > 0 {
+			return findings
+		}
+		return a.analyzeNodeFromAlert(ctx, alert)
+	}
+}
+
+// resourceKeyFromAlert creates a unique key for the resource in an alert
+func (a *AlertTriggeredAnalyzer) resourceKeyFromAlert(alert *alerts.Alert) string {
+	if alert.ResourceID != "" {
+		return alert.ResourceID
+	}
+	if alert.ResourceName != "" && alert.Instance != "" {
+		return fmt.Sprintf("%s/%s", alert.Instance, alert.ResourceName)
+	}
+	if alert.ResourceName != "" {
+		return alert.ResourceName
+	}
+	return ""
+}
+
+// CleanupOldCooldowns removes expired cooldown entries to prevent memory growth
+func (a *AlertTriggeredAnalyzer) CleanupOldCooldowns() {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	now := time.Now()
+	for key, lastTime := range a.lastAnalyzed {
+		// Remove entries older than 1 hour
+		if now.Sub(lastTime) > time.Hour {
+			delete(a.lastAnalyzed, key)
+		}
+	}
+}
diff --git a/internal/ai/baseline/store.go b/internal/ai/baseline/store.go
new file mode 100644
index 0000000..9b96e10
--- /dev/null
+++ b/internal/ai/baseline/store.go
@@ -0,0 +1,439 @@
+// Package baseline provides learned baseline metrics for anomaly detection.
+// It learns what "normal" looks like for each resource by analyzing historical
+// metrics and can then flag current values that deviate significantly from the baseline.
+package baseline
+
+import (
+	"encoding/json"
+	"math"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// MetricBaseline represents learned "normal" behavior for a single metric
+type MetricBaseline struct {
+	Mean        float64            `json:"mean"`         // Average value
+	StdDev      float64            `json:"stddev"`       // Standard deviation
+	Percentiles map[int]float64    `json:"percentiles"`  // 5, 25, 50, 75, 95
+	SampleCount int                `json:"sample_count"` // Number of samples used
+	
+	// Time-of-day patterns (future enhancement)
+	HourlyMeans [24]float64 `json:"hourly_means,omitempty"`
+}
+
+// ResourceBaseline contains baselines for all metrics of a resource
+type ResourceBaseline struct {
+	ResourceID   string                     `json:"resource_id"`
+	ResourceType string                     `json:"resource_type"` // node, vm, container, storage
+	LastUpdated  time.Time                  `json:"last_updated"`
+	Metrics      map[string]*MetricBaseline `json:"metrics"` // cpu, memory, disk
+}
+
+// Store manages baseline storage and learning
+type Store struct {
+	mu        sync.RWMutex
+	baselines map[string]*ResourceBaseline // resourceID -> baseline
+	
+	// Configuration
+	learningWindow  time.Duration // How far back to learn from (default: 7 days)
+	minSamples      int           // Minimum samples needed (default: 50)
+	updateInterval  time.Duration // How often to recompute (default: 1 hour)
+	
+	// Persistence
+	dataDir     string
+	persistence Persistence
+}
+
+// Persistence interface for saving/loading baselines
+type Persistence interface {
+	Save(baselines map[string]*ResourceBaseline) error
+	Load() (map[string]*ResourceBaseline, error)
+}
+
+// StoreConfig configures the baseline store
+type StoreConfig struct {
+	LearningWindow  time.Duration
+	MinSamples      int
+	UpdateInterval  time.Duration
+	DataDir         string
+}
+
+// DefaultConfig returns sensible defaults
+func DefaultConfig() StoreConfig {
+	return StoreConfig{
+		LearningWindow:  7 * 24 * time.Hour, // 7 days
+		MinSamples:      50,
+		UpdateInterval:  1 * time.Hour,
+	}
+}
+
+// NewStore creates a new baseline store
+func NewStore(cfg StoreConfig) *Store {
+	if cfg.LearningWindow == 0 {
+		cfg.LearningWindow = 7 * 24 * time.Hour
+	}
+	if cfg.MinSamples == 0 {
+		cfg.MinSamples = 50
+	}
+	if cfg.UpdateInterval == 0 {
+		cfg.UpdateInterval = 1 * time.Hour
+	}
+	
+	s := &Store{
+		baselines:      make(map[string]*ResourceBaseline),
+		learningWindow: cfg.LearningWindow,
+		minSamples:     cfg.MinSamples,
+		updateInterval: cfg.UpdateInterval,
+		dataDir:        cfg.DataDir,
+	}
+	
+	// Try to load existing baselines from disk
+	if cfg.DataDir != "" {
+		if err := s.loadFromDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to load baselines from disk, starting fresh")
+		} else {
+			log.Info().Int("count", len(s.baselines)).Msg("Loaded baselines from disk")
+		}
+	}
+	
+	return s
+}
+
+// MetricPoint represents a single metric value at a point in time
+type MetricPoint struct {
+	Value     float64
+	Timestamp time.Time
+}
+
+// Learn computes baseline from historical data points
+func (s *Store) Learn(resourceID, resourceType, metric string, points []MetricPoint) error {
+	if len(points) < s.minSamples {
+		log.Debug().
+			Str("resource", resourceID).
+			Str("metric", metric).
+			Int("samples", len(points)).
+			Int("required", s.minSamples).
+			Msg("Insufficient data for baseline learning")
+		return nil // Not an error, just not enough data yet
+	}
+	
+	// Extract values
+	values := make([]float64, len(points))
+	for i, p := range points {
+		values[i] = p.Value
+	}
+	
+	// Compute statistics
+	baseline := &MetricBaseline{
+		Mean:        computeMean(values),
+		StdDev:      computeStdDev(values),
+		Percentiles: computePercentiles(values),
+		SampleCount: len(values),
+	}
+	
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	
+	// Get or create resource baseline
+	rb, exists := s.baselines[resourceID]
+	if !exists {
+		rb = &ResourceBaseline{
+			ResourceID:   resourceID,
+			ResourceType: resourceType,
+			Metrics:      make(map[string]*MetricBaseline),
+		}
+		s.baselines[resourceID] = rb
+	}
+	
+	rb.Metrics[metric] = baseline
+	rb.LastUpdated = time.Now()
+	
+	log.Debug().
+		Str("resource", resourceID).
+		Str("metric", metric).
+		Float64("mean", baseline.Mean).
+		Float64("stddev", baseline.StdDev).
+		Int("samples", baseline.SampleCount).
+		Msg("Baseline learned")
+	
+	return nil
+}
+
+// GetBaseline returns the baseline for a resource/metric
+func (s *Store) GetBaseline(resourceID, metric string) (*MetricBaseline, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	rb, exists := s.baselines[resourceID]
+	if !exists {
+		return nil, false
+	}
+	
+	mb, exists := rb.Metrics[metric]
+	return mb, exists
+}
+
+// GetResourceBaseline returns all baselines for a resource
+func (s *Store) GetResourceBaseline(resourceID string) (*ResourceBaseline, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	rb, exists := s.baselines[resourceID]
+	if !exists {
+		return nil, false
+	}
+	
+	// Return a copy to prevent mutation
+	copy := &ResourceBaseline{
+		ResourceID:   rb.ResourceID,
+		ResourceType: rb.ResourceType,
+		LastUpdated:  rb.LastUpdated,
+		Metrics:      make(map[string]*MetricBaseline),
+	}
+	for k, v := range rb.Metrics {
+		copy.Metrics[k] = v
+	}
+	return copy, true
+}
+
+// IsAnomaly checks if a value is anomalous for the given resource/metric
+// Returns: isAnomaly, zScore (number of standard deviations from mean)
+func (s *Store) IsAnomaly(resourceID, metric string, value float64) (bool, float64) {
+	baseline, ok := s.GetBaseline(resourceID, metric)
+	if !ok || baseline.SampleCount < s.minSamples {
+		return false, 0 // Not enough data to determine
+	}
+	
+	if baseline.StdDev == 0 {
+		// No variance - any different value is anomalous
+		if value != baseline.Mean {
+			return true, math.Inf(1)
+		}
+		return false, 0
+	}
+	
+	zScore := (value - baseline.Mean) / baseline.StdDev
+	
+	// Consider anything > 2 standard deviations as anomalous
+	// (covers ~95% of normal distribution)
+	isAnomaly := math.Abs(zScore) > 2.0
+	
+	return isAnomaly, zScore
+}
+
+// AnomalySeverity categorizes how severe an anomaly is
+type AnomalySeverity string
+
+const (
+	AnomalyNone     AnomalySeverity = ""
+	AnomalyLow      AnomalySeverity = "low"      // 2-2.5 std devs
+	AnomalyMedium   AnomalySeverity = "medium"   // 2.5-3 std devs
+	AnomalyHigh     AnomalySeverity = "high"     // 3-4 std devs
+	AnomalyCritical AnomalySeverity = "critical" // > 4 std devs
+)
+
+// CheckAnomaly performs a detailed anomaly check with severity classification
+func (s *Store) CheckAnomaly(resourceID, metric string, value float64) (AnomalySeverity, float64, *MetricBaseline) {
+	baseline, ok := s.GetBaseline(resourceID, metric)
+	if !ok || baseline.SampleCount < s.minSamples {
+		return AnomalyNone, 0, nil
+	}
+	
+	if baseline.StdDev == 0 {
+		if value != baseline.Mean {
+			return AnomalyCritical, math.Inf(1), baseline
+		}
+		return AnomalyNone, 0, baseline
+	}
+	
+	zScore := (value - baseline.Mean) / baseline.StdDev
+	absZ := math.Abs(zScore)
+	
+	var severity AnomalySeverity
+	switch {
+	case absZ < 2.0:
+		severity = AnomalyNone
+	case absZ < 2.5:
+		severity = AnomalyLow
+	case absZ < 3.0:
+		severity = AnomalyMedium
+	case absZ < 4.0:
+		severity = AnomalyHigh
+	default:
+		severity = AnomalyCritical
+	}
+	
+	return severity, zScore, baseline
+}
+
+// ResourceCount returns the number of resources with baselines
+func (s *Store) ResourceCount() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return len(s.baselines)
+}
+
+// FlatBaseline is a flattened representation of a single metric baseline for API responses
+type FlatBaseline struct {
+	ResourceID string    `json:"resource_id"`
+	Metric     string    `json:"metric"`
+	Mean       float64   `json:"mean"`
+	StdDev     float64   `json:"std_dev"`
+	Min        float64   `json:"min"`
+	Max        float64   `json:"max"`
+	Samples    int       `json:"samples"`
+	LastUpdate time.Time `json:"last_update"`
+}
+
+// GetAllBaselines returns all baselines as a flat map for API access
+func (s *Store) GetAllBaselines() map[string]*FlatBaseline {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	result := make(map[string]*FlatBaseline)
+	for resourceID, rb := range s.baselines {
+		for metric, mb := range rb.Metrics {
+			key := resourceID + ":" + metric
+			fb := &FlatBaseline{
+				ResourceID: resourceID,
+				Metric:     metric,
+				Mean:       mb.Mean,
+				StdDev:     mb.StdDev,
+				Samples:    mb.SampleCount,
+				LastUpdate: rb.LastUpdated,
+			}
+			// Set min/max from percentiles if available
+			if mb.Percentiles != nil {
+				if p5, ok := mb.Percentiles[5]; ok {
+					fb.Min = p5
+				}
+				if p95, ok := mb.Percentiles[95]; ok {
+					fb.Max = p95
+				}
+			}
+			result[key] = fb
+		}
+	}
+	return result
+}
+
+// Save persists baselines to disk
+func (s *Store) Save() error {
+	if s.dataDir == "" {
+		return nil
+	}
+	
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	return s.saveToDisk()
+}
+
+// saveToDisk writes baselines to JSON file
+func (s *Store) saveToDisk() error {
+	if s.dataDir == "" {
+		return nil
+	}
+	
+	path := filepath.Join(s.dataDir, "baselines.json")
+	
+	data, err := json.MarshalIndent(s.baselines, "", "  ")
+	if err != nil {
+		return err
+	}
+	
+	// Write to temp file first, then rename for atomicity
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
+		return err
+	}
+	
+	return os.Rename(tmpPath, path)
+}
+
+// loadFromDisk reads baselines from JSON file
+func (s *Store) loadFromDisk() error {
+	path := filepath.Join(s.dataDir, "baselines.json")
+	
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil // No saved baselines yet
+		}
+		return err
+	}
+	
+	return json.Unmarshal(data, &s.baselines)
+}
+
+// Helper functions for statistics
+
+func computeMean(values []float64) float64 {
+	if len(values) == 0 {
+		return 0
+	}
+	sum := 0.0
+	for _, v := range values {
+		sum += v
+	}
+	return sum / float64(len(values))
+}
+
+func computeStdDev(values []float64) float64 {
+	if len(values) < 2 {
+		return 0
+	}
+	mean := computeMean(values)
+	sumSqDiff := 0.0
+	for _, v := range values {
+		diff := v - mean
+		sumSqDiff += diff * diff
+	}
+	variance := sumSqDiff / float64(len(values)-1) // Sample standard deviation
+	return math.Sqrt(variance)
+}
+
+func computePercentiles(values []float64) map[int]float64 {
+	if len(values) == 0 {
+		return nil
+	}
+	
+	// Sort a copy
+	sorted := make([]float64, len(values))
+	copy(sorted, values)
+	sort.Float64s(sorted)
+	
+	percentiles := map[int]float64{
+		5:  percentile(sorted, 5),
+		25: percentile(sorted, 25),
+		50: percentile(sorted, 50),
+		75: percentile(sorted, 75),
+		95: percentile(sorted, 95),
+	}
+	
+	return percentiles
+}
+
+func percentile(sorted []float64, p int) float64 {
+	if len(sorted) == 0 {
+		return 0
+	}
+	
+	// Use linear interpolation
+	rank := float64(p) / 100.0 * float64(len(sorted)-1)
+	lower := int(rank)
+	upper := lower + 1
+	
+	if upper >= len(sorted) {
+		return sorted[len(sorted)-1]
+	}
+	
+	// Interpolate
+	weight := rank - float64(lower)
+	return sorted[lower]*(1-weight) + sorted[upper]*weight
+}
diff --git a/internal/ai/baseline/store_test.go b/internal/ai/baseline/store_test.go
new file mode 100644
index 0000000..37f44ea
--- /dev/null
+++ b/internal/ai/baseline/store_test.go
@@ -0,0 +1,209 @@
+package baseline
+
+import (
+	"math"
+	"testing"
+	"time"
+)
+
+func TestLearn_Basic(t *testing.T) {
+	store := NewStore(StoreConfig{MinSamples: 10})
+	
+	// Create 50 data points with mean ~50 and some variance
+	points := make([]MetricPoint, 50)
+	now := time.Now()
+	for i := 0; i < 50; i++ {
+		points[i] = MetricPoint{
+			Value:     50 + float64(i%10) - 5, // Values from 45-54
+			Timestamp: now.Add(-time.Duration(50-i) * time.Minute),
+		}
+	}
+	
+	err := store.Learn("test-vm", "vm", "cpu", points)
+	if err != nil {
+		t.Fatalf("Learn failed: %v", err)
+	}
+	
+	baseline, ok := store.GetBaseline("test-vm", "cpu")
+	if !ok {
+		t.Fatal("Baseline not found after learning")
+	}
+	
+	// Check mean is around 50
+	if math.Abs(baseline.Mean-50) > 1 {
+		t.Errorf("Expected mean ~50, got %f", baseline.Mean)
+	}
+	
+	// Check stddev is reasonable (should be ~3 for our data)
+	if baseline.StdDev < 1 || baseline.StdDev > 5 {
+		t.Errorf("Expected stddev ~3, got %f", baseline.StdDev)
+	}
+	
+	if baseline.SampleCount != 50 {
+		t.Errorf("Expected 50 samples, got %d", baseline.SampleCount)
+	}
+}
+
+func TestLearn_InsufficientData(t *testing.T) {
+	store := NewStore(StoreConfig{MinSamples: 50})
+	
+	// Only 10 points, not enough
+	points := make([]MetricPoint, 10)
+	for i := 0; i < 10; i++ {
+		points[i] = MetricPoint{Value: float64(i)}
+	}
+	
+	err := store.Learn("test-vm", "vm", "cpu", points)
+	if err != nil {
+		t.Fatalf("Learn should not error on insufficient data: %v", err)
+	}
+	
+	_, ok := store.GetBaseline("test-vm", "cpu")
+	if ok {
+		t.Error("Should not have baseline with insufficient data")
+	}
+}
+
+func TestIsAnomaly(t *testing.T) {
+	store := NewStore(StoreConfig{MinSamples: 10})
+	
+	// Create stable data around 50 with low variance
+	points := make([]MetricPoint, 100)
+	for i := 0; i < 100; i++ {
+		points[i] = MetricPoint{
+			Value: 50 + float64(i%3) - 1, // Values 49, 50, 51
+		}
+	}
+	
+	store.Learn("test-vm", "vm", "cpu", points)
+	
+	// Test normal value
+	isAnomaly, zScore := store.IsAnomaly("test-vm", "cpu", 50)
+	if isAnomaly {
+		t.Errorf("50 should not be anomaly, zScore=%f", zScore)
+	}
+	
+	// Test slightly high - with stddev ~0.82, 51 is within 2 std devs
+	isAnomaly, zScore = store.IsAnomaly("test-vm", "cpu", 51)
+	if isAnomaly {
+		t.Errorf("51 should not be anomaly with this variance, zScore=%f", zScore)
+	}
+	
+	// Test very high (should be anomaly)
+	isAnomaly, zScore = store.IsAnomaly("test-vm", "cpu", 60)
+	if !isAnomaly {
+		t.Errorf("60 should be anomaly, zScore=%f", zScore)
+	}
+	
+	// Test very low (should be anomaly)
+	isAnomaly, zScore = store.IsAnomaly("test-vm", "cpu", 40)
+	if !isAnomaly {
+		t.Errorf("40 should be anomaly, zScore=%f", zScore)
+	}
+}
+
+func TestCheckAnomaly_Severity(t *testing.T) {
+	store := NewStore(StoreConfig{MinSamples: 10})
+	
+	// Create very stable data with known statistics
+	// Mean = 50, StdDev = 1
+	points := make([]MetricPoint, 100)
+	for i := 0; i < 100; i++ {
+		// Alternate between 49, 50, 51 for stddev ~1
+		points[i] = MetricPoint{Value: 50 + float64(i%3) - 1}
+	}
+	
+	store.Learn("test-vm", "vm", "cpu", points)
+	baseline, _ := store.GetBaseline("test-vm", "cpu")
+	
+	testCases := []struct {
+		value            float64
+		expectedSeverity AnomalySeverity
+	}{
+		{50, AnomalyNone},                     // Mean
+		{50 + baseline.StdDev*1.5, AnomalyNone}, // 1.5 std devs - normal
+		{50 + baseline.StdDev*2.2, AnomalyLow},  // 2.2 std devs
+		{50 + baseline.StdDev*2.7, AnomalyMedium}, // 2.7 std devs
+		{50 + baseline.StdDev*3.5, AnomalyHigh},   // 3.5 std devs
+		{50 + baseline.StdDev*4.5, AnomalyCritical}, // 4.5 std devs
+	}
+	
+	for _, tc := range testCases {
+		severity, _, _ := store.CheckAnomaly("test-vm", "cpu", tc.value)
+		if severity != tc.expectedSeverity {
+			t.Errorf("Value %f: expected severity %s, got %s", tc.value, tc.expectedSeverity, severity)
+		}
+	}
+}
+
+func TestGetResourceBaseline(t *testing.T) {
+	store := NewStore(StoreConfig{MinSamples: 10})
+	
+	// Learn multiple metrics
+	cpuPoints := make([]MetricPoint, 50)
+	memPoints := make([]MetricPoint, 50)
+	for i := 0; i < 50; i++ {
+		cpuPoints[i] = MetricPoint{Value: 30}
+		memPoints[i] = MetricPoint{Value: 70}
+	}
+	
+	store.Learn("test-vm", "vm", "cpu", cpuPoints)
+	store.Learn("test-vm", "vm", "memory", memPoints)
+	
+	rb, ok := store.GetResourceBaseline("test-vm")
+	if !ok {
+		t.Fatal("Resource baseline not found")
+	}
+	
+	if rb.ResourceType != "vm" {
+		t.Errorf("Expected resource type 'vm', got '%s'", rb.ResourceType)
+	}
+	
+	if len(rb.Metrics) != 2 {
+		t.Errorf("Expected 2 metrics, got %d", len(rb.Metrics))
+	}
+	
+	if rb.Metrics["cpu"] == nil {
+		t.Error("CPU metric baseline missing")
+	}
+	
+	if rb.Metrics["memory"] == nil {
+		t.Error("Memory metric baseline missing")
+	}
+}
+
+func TestPercentiles(t *testing.T) {
+	values := []float64{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}
+	percentiles := computePercentiles(values)
+	
+	// P50 should be ~5.5 for 1-10
+	if percentiles[50] < 5 || percentiles[50] > 6 {
+		t.Errorf("P50 should be ~5.5, got %f", percentiles[50])
+	}
+	
+	// P5 should be close to 1
+	if percentiles[5] < 1 || percentiles[5] > 2 {
+		t.Errorf("P5 should be ~1, got %f", percentiles[5])
+	}
+	
+	// P95 should be close to 10
+	if percentiles[95] < 9 || percentiles[95] > 10 {
+		t.Errorf("P95 should be ~10, got %f", percentiles[95])
+	}
+}
+
+func TestComputeStats(t *testing.T) {
+	// Test mean and stddev with known values
+	values := []float64{2, 4, 4, 4, 5, 5, 7, 9} // Mean = 5, Stddev = 2 (sample)
+	
+	mean := computeMean(values)
+	if mean != 5 {
+		t.Errorf("Expected mean 5, got %f", mean)
+	}
+	
+	stddev := computeStdDev(values)
+	// Sample stddev of [2,4,4,4,5,5,7,9] is approximately 2.14, not exactly 2
+	if math.Abs(stddev-2.14) > 0.1 {
+		t.Errorf("Expected stddev ~2.14, got %f", stddev)
+	}
+}
diff --git a/internal/ai/baseline_adapter.go b/internal/ai/baseline_adapter.go
new file mode 100644
index 0000000..d129ae1
--- /dev/null
+++ b/internal/ai/baseline_adapter.go
@@ -0,0 +1,46 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/baseline"
+)
+
+// BaselineStoreAdapter adapts baseline.Store to the context.BaselineProvider interface
+type BaselineStoreAdapter struct {
+	store *baseline.Store
+}
+
+// NewBaselineStoreAdapter creates an adapter for baseline.Store
+func NewBaselineStoreAdapter(store *baseline.Store) *BaselineStoreAdapter {
+	if store == nil {
+		return nil
+	}
+	return &BaselineStoreAdapter{store: store}
+}
+
+// CheckAnomaly implements context.BaselineProvider
+func (a *BaselineStoreAdapter) CheckAnomaly(resourceID, metric string, value float64) (severity string, zScore float64, mean float64, stddev float64, ok bool) {
+	if a.store == nil {
+		return "", 0, 0, 0, false
+	}
+	
+	s, z, b := a.store.CheckAnomaly(resourceID, metric, value)
+	if b == nil {
+		return "", 0, 0, 0, false
+	}
+	
+	return string(s), z, b.Mean, b.StdDev, true
+}
+
+// GetBaseline implements context.BaselineProvider
+func (a *BaselineStoreAdapter) GetBaseline(resourceID, metric string) (mean float64, stddev float64, sampleCount int, ok bool) {
+	if a.store == nil {
+		return 0, 0, 0, false
+	}
+	
+	b, exists := a.store.GetBaseline(resourceID, metric)
+	if !exists || b == nil {
+		return 0, 0, 0, false
+	}
+	
+	return b.Mean, b.StdDev, b.SampleCount, true
+}
diff --git a/internal/ai/baseline_exports.go b/internal/ai/baseline_exports.go
new file mode 100644
index 0000000..5b5f009
--- /dev/null
+++ b/internal/ai/baseline_exports.go
@@ -0,0 +1,24 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/baseline"
+)
+
+// BaselineConfig is an alias for the baseline package config
+type BaselineConfig = baseline.StoreConfig
+
+// BaselineStore is an alias for the baseline.Store type
+type BaselineStore = baseline.Store
+
+// BaselineMetricPoint is an alias for the baseline.MetricPoint type
+type BaselineMetricPoint = baseline.MetricPoint
+
+// DefaultBaselineConfig returns the default baseline configuration
+func DefaultBaselineConfig() BaselineConfig {
+	return baseline.DefaultConfig()
+}
+
+// NewBaselineStore creates a new baseline store
+func NewBaselineStore(cfg BaselineConfig) *BaselineStore {
+	return baseline.NewStore(cfg)
+}
diff --git a/internal/ai/config.go b/internal/ai/config.go
new file mode 100644
index 0000000..f5d898e
--- /dev/null
+++ b/internal/ai/config.go
@@ -0,0 +1,20 @@
+// Package ai provides AI-powered infrastructure investigation and remediation.
+package ai
+
+import "github.com/rcourtman/pulse-go-rewrite/internal/config"
+
+// Re-export config types for convenience
+type Config = config.AIConfig
+
+// Provider constants (re-exported for convenience)
+const (
+	ProviderAnthropic = config.AIProviderAnthropic
+	ProviderOpenAI    = config.AIProviderOpenAI
+	ProviderOllama    = config.AIProviderOllama
+	ProviderDeepSeek  = config.AIProviderDeepSeek
+)
+
+// NewDefaultConfig returns a new AI config with sensible defaults
+func NewDefaultConfig() *Config {
+	return config.NewDefaultAIConfig()
+}
diff --git a/internal/ai/context/builder.go b/internal/ai/context/builder.go
new file mode 100644
index 0000000..345b019
--- /dev/null
+++ b/internal/ai/context/builder.go
@@ -0,0 +1,504 @@
+package context
+
+import (
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rs/zerolog/log"
+)
+
+// MetricsHistoryProvider is the interface for accessing historical metrics
+// This avoids importing the monitoring package directly
+type MetricsHistoryProvider interface {
+	GetNodeMetrics(nodeID string, metricType string, duration time.Duration) []MetricPoint
+	GetGuestMetrics(guestID string, metricType string, duration time.Duration) []MetricPoint
+	GetAllGuestMetrics(guestID string, duration time.Duration) map[string][]MetricPoint
+	GetAllStorageMetrics(storageID string, duration time.Duration) map[string][]MetricPoint
+}
+
+// KnowledgeProvider provides user annotations and notes
+type KnowledgeProvider interface {
+	GetNotes(guestID string) []string
+	FormatAllForContext() string
+}
+
+// FindingsProvider provides past findings for operational memory
+type FindingsProvider interface {
+	GetDismissedForContext() string
+	GetPastFindingsForResource(resourceID string) []string
+}
+
+// BaselineProvider provides learned baselines for anomaly detection
+type BaselineProvider interface {
+	// CheckAnomaly returns severity, z-score, and baseline data
+	// Severity is "", "low", "medium", "high", or "critical"
+	CheckAnomaly(resourceID, metric string, value float64) (severity string, zScore float64, mean float64, stddev float64, ok bool)
+	// GetBaseline returns the baseline for a resource/metric
+	GetBaseline(resourceID, metric string) (mean float64, stddev float64, sampleCount int, ok bool)
+}
+
+// Builder constructs enriched AI context from multiple data sources
+type Builder struct {
+	// Data sources
+	metricsHistory MetricsHistoryProvider
+	knowledge      KnowledgeProvider
+	findings       FindingsProvider
+	baseline       BaselineProvider
+
+	// Configuration
+	trendWindow24h  time.Duration
+	trendWindow7d   time.Duration
+	includeHistory  bool
+	includeTrends   bool
+	includeBaseline bool
+}
+
+// NewBuilder creates a new context builder
+func NewBuilder() *Builder {
+	return &Builder{
+		trendWindow24h:  24 * time.Hour,
+		trendWindow7d:   7 * 24 * time.Hour,
+		includeHistory:  true,
+		includeTrends:   true,
+		includeBaseline: true, // Enable when baseline provider is set
+	}
+}
+
+// WithMetricsHistory sets the metrics history provider
+func (b *Builder) WithMetricsHistory(mh MetricsHistoryProvider) *Builder {
+	b.metricsHistory = mh
+	return b
+}
+
+// WithKnowledge sets the knowledge provider for user notes
+func (b *Builder) WithKnowledge(k KnowledgeProvider) *Builder {
+	b.knowledge = k
+	return b
+}
+
+// WithFindings sets the findings provider for operational memory
+func (b *Builder) WithFindings(f FindingsProvider) *Builder {
+	b.findings = f
+	return b
+}
+
+// WithBaseline sets the baseline provider for anomaly detection
+func (b *Builder) WithBaseline(bp BaselineProvider) *Builder {
+	b.baseline = bp
+	return b
+}
+
+// BuildForInfrastructure creates comprehensive context for the entire infrastructure
+func (b *Builder) BuildForInfrastructure(state models.StateSnapshot) *InfrastructureContext {
+	ctx := &InfrastructureContext{
+		GeneratedAt: time.Now(),
+	}
+
+	// Process nodes
+	for _, node := range state.Nodes {
+		trends := b.computeNodeTrends(node.ID)
+		resourceCtx := FormatNodeForContext(node, trends)
+		b.enrichWithNotes(&resourceCtx)
+		b.enrichWithAnomalies(&resourceCtx)
+		ctx.Nodes = append(ctx.Nodes, resourceCtx)
+	}
+
+	// Process VMs
+	for _, vm := range state.VMs {
+		if vm.Template {
+			continue
+		}
+		trends := b.computeGuestTrends(vm.ID)
+		resourceCtx := FormatGuestForContext(
+			vm.ID, vm.Name, vm.Node, "vm", vm.Status,
+			vm.CPU, vm.Memory.Usage, vm.Disk.Usage,
+			vm.Uptime, vm.LastBackup, trends,
+		)
+		b.enrichWithNotes(&resourceCtx)
+		b.enrichWithAnomalies(&resourceCtx)
+		ctx.VMs = append(ctx.VMs, resourceCtx)
+	}
+
+	// Process containers (LXC and OCI)
+	for _, ct := range state.Containers {
+		if ct.Template {
+			continue
+		}
+		trends := b.computeGuestTrends(ct.ID)
+		
+		// Determine container type - OCI containers are treated specially
+		containerType := "container"
+		if ct.IsOCI {
+			containerType = "oci_container"
+		}
+		
+		resourceCtx := FormatGuestForContext(
+			ct.ID, ct.Name, ct.Node, containerType, ct.Status,
+			ct.CPU, ct.Memory.Usage, ct.Disk.Usage,
+			ct.Uptime, ct.LastBackup, trends,
+		)
+		
+		// Add OCI image info for AI context
+		if ct.IsOCI && ct.OSTemplate != "" {
+			if resourceCtx.Metadata == nil {
+				resourceCtx.Metadata = make(map[string]interface{})
+			}
+			resourceCtx.Metadata["oci_image"] = ct.OSTemplate
+		}
+		
+		b.enrichWithNotes(&resourceCtx)
+		b.enrichWithAnomalies(&resourceCtx)
+		ctx.Containers = append(ctx.Containers, resourceCtx)
+	}
+
+	// Process storage
+	for _, storage := range state.Storage {
+		trends := b.computeStorageTrends(storage.ID)
+		resourceCtx := FormatStorageForContext(storage, trends)
+		
+		// Add capacity predictions for storage
+		if predictions := b.computeStoragePredictions(storage, trends); len(predictions) > 0 {
+			resourceCtx.Predictions = predictions
+			ctx.Predictions = append(ctx.Predictions, predictions...)
+		}
+		
+		ctx.Storage = append(ctx.Storage, resourceCtx)
+	}
+
+	// Process Docker hosts
+	for _, dh := range state.DockerHosts {
+		resourceCtx := b.buildDockerHostContext(dh)
+		ctx.DockerHosts = append(ctx.DockerHosts, resourceCtx)
+	}
+
+	// Process agent hosts
+	for _, host := range state.Hosts {
+		resourceCtx := b.buildHostContext(host)
+		ctx.Hosts = append(ctx.Hosts, resourceCtx)
+	}
+
+	// Calculate totals
+	ctx.TotalResources = len(ctx.Nodes) + len(ctx.VMs) + len(ctx.Containers) +
+		len(ctx.Storage) + len(ctx.DockerHosts) + len(ctx.Hosts)
+
+	log.Debug().
+		Int("nodes", len(ctx.Nodes)).
+		Int("vms", len(ctx.VMs)).
+		Int("containers", len(ctx.Containers)).
+		Int("storage", len(ctx.Storage)).
+		Int("predictions", len(ctx.Predictions)).
+		Msg("Built enriched infrastructure context")
+
+	return ctx
+}
+
+// computeNodeTrends computes trends for a node's metrics
+func (b *Builder) computeNodeTrends(nodeID string) map[string]Trend {
+	trends := make(map[string]Trend)
+	
+	if b.metricsHistory == nil || !b.includeTrends {
+		return trends
+	}
+
+	// Compute 24h trends for key metrics
+	for _, metric := range []string{"cpu", "memory"} {
+		points := b.metricsHistory.GetNodeMetrics(nodeID, metric, b.trendWindow24h)
+		if len(points) >= 3 {
+			trend := ComputeTrend(points, metric, b.trendWindow24h)
+			trends[metric+"_24h"] = trend
+		}
+	}
+
+	// Also compute 7d trends for capacity planning
+	for _, metric := range []string{"cpu", "memory"} {
+		points := b.metricsHistory.GetNodeMetrics(nodeID, metric, b.trendWindow7d)
+		if len(points) >= 10 {
+			trend := ComputeTrend(points, metric, b.trendWindow7d)
+			trends[metric+"_7d"] = trend
+		}
+	}
+
+	return trends
+}
+
+// computeGuestTrends computes trends for a guest's metrics
+func (b *Builder) computeGuestTrends(guestID string) map[string]Trend {
+	trends := make(map[string]Trend)
+	
+	if b.metricsHistory == nil || !b.includeTrends {
+		return trends
+	}
+
+	// Get all metrics at once for efficiency
+	allMetrics := b.metricsHistory.GetAllGuestMetrics(guestID, b.trendWindow7d)
+	
+	for metric, points := range allMetrics {
+		if len(points) < 3 {
+			continue
+		}
+		
+		// Compute 24h trend
+		recent := filterRecentPoints(points, b.trendWindow24h)
+		if len(recent) >= 3 {
+			trend := ComputeTrend(recent, metric, b.trendWindow24h)
+			trends[metric+"_24h"] = trend
+		}
+		
+		// Compute 7d trend if enough data
+		if len(points) >= 10 {
+			trend := ComputeTrend(points, metric, b.trendWindow7d)
+			trends[metric+"_7d"] = trend
+		}
+	}
+
+	return trends
+}
+
+// computeStorageTrends computes trends for storage
+func (b *Builder) computeStorageTrends(storageID string) map[string]Trend {
+	trends := make(map[string]Trend)
+	
+	if b.metricsHistory == nil || !b.includeTrends {
+		return trends
+	}
+
+	allMetrics := b.metricsHistory.GetAllStorageMetrics(storageID, b.trendWindow7d)
+	
+	// Focus on usage metric for storage
+	if points, ok := allMetrics["usage"]; ok && len(points) >= 3 {
+		recent := filterRecentPoints(points, b.trendWindow24h)
+		if len(recent) >= 3 {
+			trends["usage_24h"] = ComputeTrend(recent, "usage", b.trendWindow24h)
+		}
+		if len(points) >= 10 {
+			trends["usage_7d"] = ComputeTrend(points, "usage", b.trendWindow7d)
+		}
+	}
+
+	return trends
+}
+
+// computeStoragePredictions generates capacity predictions for storage
+func (b *Builder) computeStoragePredictions(storage models.Storage, trends map[string]Trend) []Prediction {
+	var predictions []Prediction
+
+	// Use 7d trend for more stable prediction
+	trend, ok := trends["usage_7d"]
+	if !ok || trend.DataPoints < 10 {
+		return predictions
+	}
+
+	// Only predict if growing
+	if trend.Direction != TrendGrowing || trend.RatePerDay <= 0 {
+		return predictions
+	}
+
+	// Current usage
+	currentPct := storage.Usage
+	if currentPct == 0 && storage.Total > 0 {
+		currentPct = float64(storage.Used) / float64(storage.Total) * 100
+	}
+
+	// Calculate days until 90% (warning) and 100% (critical)
+	for _, threshold := range []struct {
+		pct   float64
+		event string
+	}{
+		{90, "storage_warning_90pct"},
+		{100, "storage_full"},
+	} {
+		if currentPct >= threshold.pct {
+			continue // Already past this threshold
+		}
+
+		remaining := threshold.pct - currentPct
+		daysUntil := remaining / trend.RatePerDay
+
+		if daysUntil > 0 && daysUntil <= 30 { // Only predict within 30 days
+			predictions = append(predictions, Prediction{
+				ResourceID:  storage.ID,
+				Metric:      "usage",
+				Event:       threshold.event,
+				ETA:         time.Now().Add(time.Duration(daysUntil*24) * time.Hour),
+				DaysUntil:   daysUntil,
+				Confidence:  trend.Confidence,
+				Basis:       formatPredictionBasis(trend),
+				GrowthRate:  trend.RatePerDay,
+				CurrentPct:  currentPct,
+			})
+		}
+	}
+
+	return predictions
+}
+
+// formatPredictionBasis creates explanation for a prediction
+func formatPredictionBasis(trend Trend) string {
+	return "Growing " + formatRate(trend.RatePerDay) + " based on " + 
+		formatDuration(trend.Period) + " of data"
+}
+
+// buildDockerHostContext creates context for a Docker host
+func (b *Builder) buildDockerHostContext(host models.DockerHost) ResourceContext {
+	displayName := host.Hostname
+	if host.DisplayName != "" {
+		displayName = host.DisplayName
+	}
+
+	ctx := ResourceContext{
+		ResourceID:   host.ID,
+		ResourceType: "docker_host",
+		ResourceName: displayName,
+		Status:       host.Status,
+		Uptime:       time.Duration(host.UptimeSeconds) * time.Second,
+	}
+
+	// Note: Docker hosts don't have the same trend data as Proxmox resources
+	// We could add container-level trends in the future
+
+	return ctx
+}
+
+// buildHostContext creates context for an agent host
+func (b *Builder) buildHostContext(host models.Host) ResourceContext {
+	displayName := host.Hostname
+	if host.DisplayName != "" {
+		displayName = host.DisplayName
+	}
+
+	// Calculate CPU and memory from host data
+	cpuPct := 0.0
+	if len(host.LoadAverage) > 0 && host.CPUCount > 0 {
+		cpuPct = host.LoadAverage[0] / float64(host.CPUCount) * 100
+	}
+
+	memPct := 0.0
+	if host.Memory.Total > 0 {
+		memPct = float64(host.Memory.Used) / float64(host.Memory.Total) * 100
+	}
+
+	ctx := ResourceContext{
+		ResourceID:    host.ID,
+		ResourceType:  "host",
+		ResourceName:  displayName,
+		CurrentCPU:    cpuPct,
+		CurrentMemory: memPct,
+		Status:        host.Status,
+		Uptime:        time.Duration(host.UptimeSeconds) * time.Second,
+	}
+
+	return ctx
+}
+
+// enrichWithNotes adds user annotations to context
+func (b *Builder) enrichWithNotes(ctx *ResourceContext) {
+	if b.knowledge == nil {
+		return
+	}
+
+	notes := b.knowledge.GetNotes(ctx.ResourceID)
+	if len(notes) > 0 {
+		ctx.UserNotes = notes
+	}
+}
+
+// enrichWithAnomalies checks current values against baselines and adds anomalies
+func (b *Builder) enrichWithAnomalies(ctx *ResourceContext) {
+	if b.baseline == nil || !b.includeBaseline {
+		return
+	}
+
+	// Check each metric type for anomalies
+	metrics := map[string]float64{
+		"cpu":    ctx.CurrentCPU,
+		"memory": ctx.CurrentMemory,
+		"disk":   ctx.CurrentDisk,
+	}
+
+	for metric, value := range metrics {
+		if value == 0 {
+			continue // Skip zeroes (usually means not reported)
+		}
+
+		severity, zScore, mean, stddev, ok := b.baseline.CheckAnomaly(ctx.ResourceID, metric, value)
+		if !ok || severity == "" {
+			continue // No anomaly or no baseline
+		}
+
+		direction := "above"
+		if zScore < 0 {
+			direction = "below"
+		}
+
+		anomaly := Anomaly{
+			Metric:    metric,
+			Current:   value,
+			Expected:  mean,
+			Deviation: zScore,
+			Severity:  severity,
+			Since:     time.Now(), // We don't track onset time yet
+			Description: formatAnomalyDescription(metric, value, mean, stddev, severity, direction),
+		}
+		ctx.Anomalies = append(ctx.Anomalies, anomaly)
+	}
+}
+
+// formatAnomalyDescription creates human-readable anomaly description
+func formatAnomalyDescription(metric string, current, mean, stddev float64, severity, direction string) string {
+	var sb strings.Builder
+	sb.WriteString(strings.Title(metric))
+	sb.WriteString(" is ")
+	sb.WriteString(severity)
+	sb.WriteString(" ")
+	sb.WriteString(direction)
+	sb.WriteString(" normal (")
+	sb.WriteString(formatFloat(current, 1))
+	sb.WriteString("% vs typical ")
+	sb.WriteString(formatFloat(mean, 1))
+	sb.WriteString("% ± ")
+	sb.WriteString(formatFloat(stddev, 1))
+	sb.WriteString("%)")
+	return sb.String()
+}
+
+// filterRecentPoints filters points to only include those within duration
+func filterRecentPoints(points []MetricPoint, duration time.Duration) []MetricPoint {
+	cutoff := time.Now().Add(-duration)
+	result := make([]MetricPoint, 0, len(points))
+	for _, p := range points {
+		if p.Timestamp.After(cutoff) {
+			result = append(result, p)
+		}
+	}
+	return result
+}
+
+// MergeContexts combines context for targeted analysis with relevant infrastructure context
+func (b *Builder) MergeContexts(target *ResourceContext, infrastructure *InfrastructureContext) string {
+	// For targeted requests, highlight the target first, then add relevant related context
+	var result strings.Builder
+	
+	result.WriteString("# Target Resource\n")
+	result.WriteString(FormatResourceContext(*target))
+	result.WriteString("\n")
+	
+	// Add related resources (same node, dependencies, etc.)
+	// This could be expanded with dependency mapping in the future
+	if target.Node != "" {
+		result.WriteString("\n## Related Resources\n")
+		// Find other resources on the same node
+		for _, vm := range infrastructure.VMs {
+			if vm.Node == target.Node && vm.ResourceID != target.ResourceID {
+				result.WriteString(FormatResourceContext(vm))
+			}
+		}
+		for _, ct := range infrastructure.Containers {
+			if ct.Node == target.Node && ct.ResourceID != target.ResourceID {
+				result.WriteString(FormatResourceContext(ct))
+			}
+		}
+	}
+	
+	return result.String()
+}
diff --git a/internal/ai/context/formatter.go b/internal/ai/context/formatter.go
new file mode 100644
index 0000000..d2da8ca
--- /dev/null
+++ b/internal/ai/context/formatter.go
@@ -0,0 +1,432 @@
+package context
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+// FormatResourceContext formats a single resource's context for AI consumption
+func FormatResourceContext(ctx ResourceContext) string {
+	var sb strings.Builder
+
+	// Header with resource identity
+	typeLabel := formatResourceType(ctx.ResourceType)
+	sb.WriteString(fmt.Sprintf("### %s: %s", typeLabel, ctx.ResourceName))
+	if ctx.Node != "" && ctx.ResourceType != "node" {
+		sb.WriteString(fmt.Sprintf(" (on %s)", ctx.Node))
+	}
+	sb.WriteString("\n")
+
+	// Current state
+	sb.WriteString(fmt.Sprintf("**Status**: %s", ctx.Status))
+	if ctx.Uptime > 0 {
+		sb.WriteString(fmt.Sprintf(" | **Uptime**: %s", formatDuration(ctx.Uptime)))
+	}
+	sb.WriteString("\n")
+
+	// Current metrics
+	var metrics []string
+	if ctx.CurrentCPU >= 0 {
+		metrics = append(metrics, fmt.Sprintf("CPU: %.1f%%", ctx.CurrentCPU))
+	}
+	if ctx.CurrentMemory >= 0 {
+		metrics = append(metrics, fmt.Sprintf("Memory: %.1f%%", ctx.CurrentMemory))
+	}
+	if ctx.CurrentDisk >= 0 {
+		metrics = append(metrics, fmt.Sprintf("Disk: %.1f%%", ctx.CurrentDisk))
+	}
+	if len(metrics) > 0 {
+		sb.WriteString("**Current**: " + strings.Join(metrics, " | ") + "\n")
+	}
+
+	// Trends section (the differentiating context)
+	if len(ctx.Trends) > 0 {
+		var trendLines []string
+		for metric, trend := range ctx.Trends {
+			if trend.DataPoints < 3 {
+				continue // Skip if not enough data
+			}
+			line := formatTrendLine(metric, trend)
+			if line != "" {
+				trendLines = append(trendLines, line)
+			}
+		}
+		if len(trendLines) > 0 {
+			sb.WriteString("**Trends**: ")
+			sb.WriteString(strings.Join(trendLines, " | "))
+			sb.WriteString("\n")
+		}
+	}
+
+	// Anomalies (high value - what's unusual)
+	if len(ctx.Anomalies) > 0 {
+		sb.WriteString("**⚠️ Anomalies**: ")
+		var anomalyDescs []string
+		for _, a := range ctx.Anomalies {
+			anomalyDescs = append(anomalyDescs, a.Description)
+		}
+		sb.WriteString(strings.Join(anomalyDescs, "; "))
+		sb.WriteString("\n")
+	}
+
+	// Predictions (proactive value)
+	if len(ctx.Predictions) > 0 {
+		sb.WriteString("**⏰ Predictions**: ")
+		var predDescs []string
+		for _, p := range ctx.Predictions {
+			predDescs = append(predDescs, fmt.Sprintf("%s in ~%.0f days", p.Event, p.DaysUntil))
+		}
+		sb.WriteString(strings.Join(predDescs, "; "))
+		sb.WriteString("\n")
+	}
+
+	// User notes (context that only Pulse knows)
+	if len(ctx.UserNotes) > 0 {
+		sb.WriteString("**User Notes**: ")
+		sb.WriteString(strings.Join(ctx.UserNotes, "; "))
+		sb.WriteString("\n")
+	}
+
+	// Past issues (operational memory)
+	if len(ctx.PastIssues) > 0 || ctx.LastRemediation != "" {
+		sb.WriteString("**History**: ")
+		if ctx.LastRemediation != "" {
+			sb.WriteString(ctx.LastRemediation)
+		}
+		if len(ctx.PastIssues) > 0 {
+			sb.WriteString(" Past issues: " + strings.Join(ctx.PastIssues, "; "))
+		}
+		sb.WriteString("\n")
+	}
+
+	return sb.String()
+}
+
+// formatTrendLine creates a compact trend description
+func formatTrendLine(metric string, trend Trend) string {
+	if trend.DataPoints < 3 {
+		return ""
+	}
+
+	metricLabel := strings.Title(metric)
+	
+	// Direction with rate
+	var directionStr string
+	switch trend.Direction {
+	case TrendGrowing:
+		rate := formatRate(trend.RatePerDay)
+		directionStr = fmt.Sprintf("↑ %s", rate)
+	case TrendDeclining:
+		rate := formatRate(-trend.RatePerDay) // Make positive for display
+		directionStr = fmt.Sprintf("↓ %s", rate)
+	case TrendVolatile:
+		directionStr = "⚡ volatile"
+	case TrendStable:
+		directionStr = "→ stable"
+	default:
+		return ""
+	}
+
+	// Include range if interesting
+	rangeStr := ""
+	if trend.Max-trend.Min > 5 { // Only show range if variation is significant
+		rangeStr = fmt.Sprintf(" (%.0f-%.0f%%)", trend.Min, trend.Max)
+	}
+
+	return fmt.Sprintf("%s: %s%s", metricLabel, directionStr, rangeStr)
+}
+
+// formatRate formats a rate value appropriately
+func formatRate(ratePerDay float64) string {
+	absRate := ratePerDay
+	if absRate < 0 {
+		absRate = -absRate
+	}
+
+	if absRate >= 1 {
+		return fmt.Sprintf("%.1f/day", absRate)
+	}
+	// Convert to per hour if < 1/day
+	ratePerHour := absRate / 24
+	if ratePerHour >= 0.1 {
+		return fmt.Sprintf("%.1f/hr", ratePerHour)
+	}
+	return "slow"
+}
+
+// FormatInfrastructureContext formats full infrastructure context for AI
+func FormatInfrastructureContext(ctx *InfrastructureContext) string {
+	var sb strings.Builder
+
+	sb.WriteString("# Infrastructure State with Historical Context\n\n")
+	sb.WriteString(fmt.Sprintf("*Generated at %s | Monitoring %d resources*\n\n",
+		ctx.GeneratedAt.Format("2006-01-02 15:04"),
+		ctx.TotalResources))
+
+	// Global anomalies first (high priority)
+	if len(ctx.Anomalies) > 0 {
+		sb.WriteString("## ⚠️ Current Anomalies\n")
+		for _, a := range ctx.Anomalies {
+			sb.WriteString(fmt.Sprintf("- **%s**: %s\n", a.Metric, a.Description))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Predictions (proactive insights)
+	if len(ctx.Predictions) > 0 {
+		sb.WriteString("## ⏰ Predictions\n")
+		for _, p := range ctx.Predictions {
+			sb.WriteString(fmt.Sprintf("- **%s** on %s: %s (%.0f days, %.0f%% confidence)\n",
+				p.Event, p.ResourceID, p.Basis, p.DaysUntil, p.Confidence*100))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Recent changes (what's different)
+	if len(ctx.Changes) > 0 {
+		sb.WriteString("## 🔄 Recent Changes\n")
+		for _, c := range ctx.Changes {
+			sb.WriteString(fmt.Sprintf("- %s: %s\n", c.ResourceName, c.Description))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Resources by type
+	if len(ctx.Nodes) > 0 {
+		sb.WriteString("## Proxmox Nodes\n")
+		for _, r := range ctx.Nodes {
+			sb.WriteString(FormatResourceContext(r))
+			sb.WriteString("\n")
+		}
+	}
+
+	if len(ctx.VMs) > 0 {
+		sb.WriteString("## Virtual Machines\n")
+		for _, r := range ctx.VMs {
+			sb.WriteString(FormatResourceContext(r))
+		}
+		sb.WriteString("\n")
+	}
+
+	if len(ctx.Containers) > 0 {
+		sb.WriteString("## LXC/OCI Containers\n")
+		for _, r := range ctx.Containers {
+			sb.WriteString(FormatResourceContext(r))
+		}
+		sb.WriteString("\n")
+	}
+
+	if len(ctx.Storage) > 0 {
+		sb.WriteString("## Storage\n")
+		for _, r := range ctx.Storage {
+			sb.WriteString(FormatResourceContext(r))
+		}
+		sb.WriteString("\n")
+	}
+
+	if len(ctx.DockerHosts) > 0 {
+		sb.WriteString("## Docker Hosts\n")
+		for _, r := range ctx.DockerHosts {
+			sb.WriteString(FormatResourceContext(r))
+		}
+		sb.WriteString("\n")
+	}
+
+	if len(ctx.Hosts) > 0 {
+		sb.WriteString("## Agent Hosts\n")
+		for _, r := range ctx.Hosts {
+			sb.WriteString(FormatResourceContext(r))
+		}
+		sb.WriteString("\n")
+	}
+
+	return sb.String()
+}
+
+// FormatCompactSummary creates a brief overview suitable for context-limited prompts
+func FormatCompactSummary(ctx *InfrastructureContext) string {
+	var sb strings.Builder
+
+	sb.WriteString(fmt.Sprintf("Infrastructure: %d resources\n", ctx.TotalResources))
+
+	// Count by status
+	var healthy, warning, critical int
+	countResource := func(resources []ResourceContext) {
+		for _, r := range resources {
+			switch {
+			case len(r.Anomalies) > 0:
+				critical++
+			case hasGrowingTrend(r):
+				warning++
+			default:
+				healthy++
+			}
+		}
+	}
+	countResource(ctx.Nodes)
+	countResource(ctx.VMs)
+	countResource(ctx.Containers)
+	countResource(ctx.Storage)
+	countResource(ctx.DockerHosts)
+	countResource(ctx.Hosts)
+
+	sb.WriteString(fmt.Sprintf("Health: %d healthy, %d warning, %d critical\n", healthy, warning, critical))
+
+	if len(ctx.Anomalies) > 0 {
+		sb.WriteString(fmt.Sprintf("Anomalies: %d active\n", len(ctx.Anomalies)))
+	}
+
+	if len(ctx.Predictions) > 0 {
+		// Show most urgent prediction
+		earliest := ctx.Predictions[0]
+		for _, p := range ctx.Predictions[1:] {
+			if p.DaysUntil < earliest.DaysUntil {
+				earliest = p
+			}
+		}
+		sb.WriteString(fmt.Sprintf("⏰ Nearest: %s in %.0f days\n", earliest.Event, earliest.DaysUntil))
+	}
+
+	return sb.String()
+}
+
+// hasGrowingTrend checks if any metric trend is concerning
+func hasGrowingTrend(r ResourceContext) bool {
+	for _, t := range r.Trends {
+		if t.Direction == TrendGrowing && t.RatePerDay > 1 {
+			return true
+		}
+	}
+	return false
+}
+
+// formatResourceType converts internal type to display label
+func formatResourceType(t string) string {
+	switch t {
+	case "node":
+		return "Node"
+	case "vm":
+		return "VM"
+	case "container":
+		return "Container"
+	case "oci_container":
+		return "OCI Container"
+	case "storage":
+		return "Storage"
+	case "docker_host":
+		return "Docker Host"
+	case "docker_container":
+		return "Docker Container"
+	case "host":
+		return "Host"
+	default:
+		return strings.Title(t)
+	}
+}
+
+// formatDuration formats a duration in human-readable form
+func formatDuration(d time.Duration) string {
+	if d < time.Minute {
+		return fmt.Sprintf("%ds", int(d.Seconds()))
+	}
+	if d < time.Hour {
+		return fmt.Sprintf("%dm", int(d.Minutes()))
+	}
+	if d < 24*time.Hour {
+		hours := int(d.Hours())
+		mins := int(d.Minutes()) % 60
+		if mins > 0 {
+			return fmt.Sprintf("%dh%dm", hours, mins)
+		}
+		return fmt.Sprintf("%dh", hours)
+	}
+	days := int(d.Hours() / 24)
+	hours := int(d.Hours()) % 24
+	if hours > 0 {
+		return fmt.Sprintf("%dd%dh", days, hours)
+	}
+	return fmt.Sprintf("%dd", days)
+}
+
+// FormatBackupStatus creates a human-readable backup status
+func FormatBackupStatus(lastBackup time.Time) string {
+	if lastBackup.IsZero() {
+		return "never"
+	}
+	age := time.Since(lastBackup)
+	if age < 24*time.Hour {
+		return fmt.Sprintf("%.0fh ago", age.Hours())
+	}
+	days := age.Hours() / 24
+	return fmt.Sprintf("%.0fd ago", days)
+}
+
+// FormatNodeForContext creates context for a Proxmox node
+func FormatNodeForContext(node models.Node, trends map[string]Trend) ResourceContext {
+	// Calculate memory percentage
+	memPct := 0.0
+	if node.Memory.Total > 0 {
+		memPct = float64(node.Memory.Used) / float64(node.Memory.Total) * 100
+	}
+
+	ctx := ResourceContext{
+		ResourceID:    node.ID,
+		ResourceType:  "node",
+		ResourceName:  node.Name,
+		CurrentCPU:    node.CPU * 100, // Convert from 0-1 to percentage
+		CurrentMemory: memPct,
+		Status:        node.Status,
+		Uptime:        time.Duration(node.Uptime) * time.Second,
+		Trends:        trends,
+	}
+
+	return ctx
+}
+
+// FormatGuestForContext creates context for a VM or container
+// Note: cpu is 0-1 ratio from Proxmox API, memUsage and diskUsage are already 0-100 percentages
+func FormatGuestForContext(
+	id, name, node, guestType, status string,
+	cpu, memUsage, diskUsage float64,
+	uptime int64,
+	lastBackup time.Time,
+	trends map[string]Trend,
+) ResourceContext {
+	ctx := ResourceContext{
+		ResourceID:    id,
+		ResourceType:  guestType,
+		ResourceName:  name,
+		Node:          node,
+		CurrentCPU:    cpu * 100,  // Convert from 0-1 to percentage
+		CurrentMemory: memUsage,   // Already 0-100 percentage from Memory.Usage
+		CurrentDisk:   diskUsage,  // Already 0-100 percentage from Disk.Usage
+		Status:        status,
+		Uptime:        time.Duration(uptime) * time.Second,
+		Trends:        trends,
+	}
+
+	return ctx
+}
+
+// FormatStorageForContext creates context for storage
+func FormatStorageForContext(storage models.Storage, trends map[string]Trend) ResourceContext {
+	usagePct := storage.Usage
+	if usagePct == 0 && storage.Total > 0 {
+		usagePct = float64(storage.Used) / float64(storage.Total) * 100
+	}
+
+	ctx := ResourceContext{
+		ResourceID:   storage.ID,
+		ResourceType: "storage",
+		ResourceName: storage.Name,
+		Node:         storage.Node,
+		CurrentDisk:  usagePct,
+		Status:       storage.Status,
+		Trends:       trends,
+	}
+
+	return ctx
+}
diff --git a/internal/ai/context/trends.go b/internal/ai/context/trends.go
new file mode 100644
index 0000000..c0131c5
--- /dev/null
+++ b/internal/ai/context/trends.go
@@ -0,0 +1,327 @@
+package context
+
+import (
+	"math"
+	"sort"
+	"time"
+)
+
+// ComputeTrend calculates trend from historical data points.
+// This is the core function that transforms raw metrics into meaningful insights.
+func ComputeTrend(points []MetricPoint, metricName string, period time.Duration) Trend {
+	trend := Trend{
+		Metric:     metricName,
+		Direction:  TrendStable,
+		Period:     period,
+		DataPoints: len(points),
+	}
+
+	if len(points) < 2 {
+		trend.Confidence = 0
+		return trend
+	}
+
+	// Sort by timestamp to ensure correct order
+	sorted := make([]MetricPoint, len(points))
+	copy(sorted, points)
+	sort.Slice(sorted, func(i, j int) bool {
+		return sorted[i].Timestamp.Before(sorted[j].Timestamp)
+	})
+
+	// Calculate basic statistics
+	stats := computeStats(sorted)
+	trend.Average = stats.Mean
+	trend.Min = stats.Min
+	trend.Max = stats.Max
+	trend.StdDev = stats.StdDev
+	trend.Current = sorted[len(sorted)-1].Value
+
+	// Perform linear regression to get slope and fit quality
+	regression := linearRegression(sorted)
+	trend.Confidence = regression.R2
+
+	// Convert slope from "per second" to "per hour" and "per day"
+	// Slope is in units/second
+	trend.RatePerHour = regression.Slope * 3600
+	trend.RatePerDay = regression.Slope * 86400
+
+	// Classify the trend direction
+	trend.Direction = classifyTrend(regression.Slope, stats.Mean, stats.StdDev)
+
+	return trend
+}
+
+// computeStats calculates basic statistics for a set of metric points
+func computeStats(points []MetricPoint) Stats {
+	if len(points) == 0 {
+		return Stats{}
+	}
+
+	stats := Stats{
+		Count: len(points),
+		Min:   points[0].Value,
+		Max:   points[0].Value,
+	}
+
+	for _, p := range points {
+		stats.Sum += p.Value
+		if p.Value < stats.Min {
+			stats.Min = p.Value
+		}
+		if p.Value > stats.Max {
+			stats.Max = p.Value
+		}
+	}
+
+	stats.Mean = stats.Sum / float64(stats.Count)
+
+	// Calculate standard deviation
+	var sumSquares float64
+	for _, p := range points {
+		diff := p.Value - stats.Mean
+		sumSquares += diff * diff
+	}
+	stats.StdDev = math.Sqrt(sumSquares / float64(stats.Count))
+
+	return stats
+}
+
+// linearRegression performs simple linear regression on time-series data.
+// Returns slope (change per second), intercept, and R² (goodness of fit).
+func linearRegression(points []MetricPoint) LinearRegressionResult {
+	if len(points) < 2 {
+		return LinearRegressionResult{}
+	}
+
+	n := float64(len(points))
+	
+	// Use time relative to first point for numerical stability
+	baseTime := points[0].Timestamp
+
+	var sumX, sumY, sumXY, sumX2, sumY2 float64
+	for _, p := range points {
+		x := p.Timestamp.Sub(baseTime).Seconds() // seconds since start
+		y := p.Value
+
+		sumX += x
+		sumY += y
+		sumXY += x * y
+		sumX2 += x * x
+		sumY2 += y * y
+	}
+
+	// Calculate slope and intercept using least squares
+	denominator := n*sumX2 - sumX*sumX
+	if math.Abs(denominator) < 1e-10 {
+		// All x values are the same (no time span)
+		return LinearRegressionResult{R2: 0}
+	}
+
+	slope := (n*sumXY - sumX*sumY) / denominator
+	intercept := (sumY - slope*sumX) / n
+
+	// Calculate R² (coefficient of determination)
+	meanY := sumY / n
+	var ssRes, ssTot float64 // Sum of squares residual and total
+	for _, p := range points {
+		x := p.Timestamp.Sub(baseTime).Seconds()
+		yPred := slope*x + intercept
+		ssRes += (p.Value - yPred) * (p.Value - yPred)
+		ssTot += (p.Value - meanY) * (p.Value - meanY)
+	}
+
+	r2 := 0.0
+	if ssTot > 0 {
+		r2 = 1 - (ssRes / ssTot)
+	}
+	// Clamp R² to [0, 1] (can be negative for very bad fits)
+	if r2 < 0 {
+		r2 = 0
+	}
+
+	return LinearRegressionResult{
+		Slope:     slope,
+		Intercept: intercept,
+		R2:        r2,
+	}
+}
+
+// classifyTrend determines the trend direction based on slope and statistics.
+// We normalize the slope relative to the metric's magnitude to avoid
+// false positives on high-value metrics.
+func classifyTrend(slopePerSecond, mean, stdDev float64) TrendDirection {
+	// If there's no significant variation, it's stable
+	if stdDev < 0.01 && math.Abs(slopePerSecond) < 1e-10 {
+		return TrendStable
+	}
+
+	// If standard deviation is high relative to mean, it's volatile
+	if mean > 0 && stdDev/mean > 0.3 {
+		return TrendVolatile
+	}
+
+	// Convert slope to hourly rate for easier reasoning
+	hourlyRate := slopePerSecond * 3600
+
+	// Determine significance threshold based on the metric's scale
+	// For percentage metrics (0-100), we care about ~0.1% per hour (~2.4% per day)
+	// This catches slow-growing issues before they become critical
+	// For absolute metrics, we care about ~0.5% of mean per hour
+	threshold := 0.1 // Default threshold for percentage metrics
+	if mean > 100 {
+		// For larger absolute values, use relative threshold
+		threshold = mean * 0.005
+	}
+
+	// Check if the hourly change is significant
+	if hourlyRate > threshold {
+		return TrendGrowing
+	}
+	if hourlyRate < -threshold {
+		return TrendDeclining
+	}
+
+	return TrendStable
+}
+
+// ComputePercentiles calculates percentile values from a sorted slice of points
+func ComputePercentiles(points []MetricPoint, percentiles ...int) map[int]float64 {
+	result := make(map[int]float64)
+	if len(points) == 0 {
+		return result
+	}
+
+	// Extract values and sort
+	values := make([]float64, len(points))
+	for i, p := range points {
+		values[i] = p.Value
+	}
+	sort.Float64s(values)
+
+	for _, p := range percentiles {
+		if p < 0 || p > 100 {
+			continue
+		}
+		
+		// Calculate index for percentile
+		idx := float64(p) / 100.0 * float64(len(values)-1)
+		lower := int(math.Floor(idx))
+		upper := int(math.Ceil(idx))
+		
+		if lower >= len(values) {
+			lower = len(values) - 1
+		}
+		if upper >= len(values) {
+			upper = len(values) - 1
+		}
+		
+		if lower == upper {
+			result[p] = values[lower]
+		} else {
+			// Linear interpolation between adjacent values
+			frac := idx - float64(lower)
+			result[p] = values[lower]*(1-frac) + values[upper]*frac
+		}
+	}
+
+	return result
+}
+
+// TrendSummary generates a human-readable summary of a trend
+func TrendSummary(t Trend) string {
+	if t.DataPoints < 2 {
+		return "insufficient data"
+	}
+
+	directionStr := ""
+	switch t.Direction {
+	case TrendGrowing:
+		directionStr = "growing"
+	case TrendDeclining:
+		directionStr = "declining"
+	case TrendVolatile:
+		directionStr = "volatile"
+	case TrendStable:
+		directionStr = "stable"
+	}
+
+	// Format rate based on magnitude
+	rateStr := ""
+	if t.Direction == TrendGrowing || t.Direction == TrendDeclining {
+		absRate := math.Abs(t.RatePerDay)
+		if absRate > 1 {
+			rateStr = formatFloat(absRate, 1) + "/day"
+		} else {
+			rateStr = formatFloat(math.Abs(t.RatePerHour), 2) + "/hr"
+		}
+	}
+
+	if rateStr != "" {
+		return directionStr + " " + rateStr
+	}
+	return directionStr
+}
+
+// formatFloat formats a float with the given precision, trimming trailing zeros
+func formatFloat(v float64, precision int) string {
+	return trimTrailingZeros(floatToString(v, precision))
+}
+
+func floatToString(v float64, precision int) string {
+	switch precision {
+	case 0:
+		return intToString(int(math.Round(v)))
+	case 1:
+		return intToString(int(v)) + "." + intToString(int(math.Round((v-float64(int(v)))*10)))
+	case 2:
+		return intToString(int(v)) + "." + padLeft(intToString(int(math.Round((v-float64(int(v)))*100))), 2, '0')
+	default:
+		mult := math.Pow(10, float64(precision))
+		return intToString(int(v)) + "." + padLeft(intToString(int(math.Round((v-float64(int(v)))*mult))), precision, '0')
+	}
+}
+
+func intToString(i int) string {
+	if i < 0 {
+		return "-" + intToString(-i)
+	}
+	if i < 10 {
+		return string(rune('0' + i))
+	}
+	return intToString(i/10) + string(rune('0'+i%10))
+}
+
+func padLeft(s string, length int, pad rune) string {
+	for len(s) < length {
+		s = string(pad) + s
+	}
+	return s
+}
+
+func trimTrailingZeros(s string) string {
+	if s == "" {
+		return s
+	}
+	// Find decimal point
+	dotIdx := -1
+	for i, c := range s {
+		if c == '.' {
+			dotIdx = i
+			break
+		}
+	}
+	if dotIdx == -1 {
+		return s // No decimal point
+	}
+	
+	// Trim trailing zeros after decimal
+	end := len(s)
+	for end > dotIdx+1 && s[end-1] == '0' {
+		end--
+	}
+	// Also trim decimal if nothing after it
+	if end == dotIdx+1 {
+		end = dotIdx
+	}
+	return s[:end]
+}
diff --git a/internal/ai/context/trends_test.go b/internal/ai/context/trends_test.go
new file mode 100644
index 0000000..c6e94aa
--- /dev/null
+++ b/internal/ai/context/trends_test.go
@@ -0,0 +1,250 @@
+package context
+
+import (
+	"testing"
+	"time"
+)
+
+func TestComputeTrend_Growing(t *testing.T) {
+	// Create growing data (10% per day)
+	now := time.Now()
+	points := make([]MetricPoint, 24)
+	for i := 0; i < 24; i++ {
+		// 10% per day = ~0.417% per hour
+		points[i] = MetricPoint{
+			Value:     50 + float64(i)*0.417,
+			Timestamp: now.Add(time.Duration(-24+i) * time.Hour),
+		}
+	}
+
+	trend := ComputeTrend(points, "memory", 24*time.Hour)
+
+	if trend.Direction != TrendGrowing {
+		t.Errorf("Expected TrendGrowing, got %s", trend.Direction)
+	}
+
+	// Rate should be ~10% per day
+	if trend.RatePerDay < 8 || trend.RatePerDay > 12 {
+		t.Errorf("Expected rate ~10/day, got %.2f", trend.RatePerDay)
+	}
+
+	if trend.DataPoints != 24 {
+		t.Errorf("Expected 24 data points, got %d", trend.DataPoints)
+	}
+}
+
+func TestComputeTrend_Stable(t *testing.T) {
+	// Create stable data with small fluctuations
+	now := time.Now()
+	points := make([]MetricPoint, 24)
+	for i := 0; i < 24; i++ {
+		// Small random-looking variation around 50%, but no trend
+		offset := float64(i%3 - 1) * 0.2
+		points[i] = MetricPoint{
+			Value:     50 + offset,
+			Timestamp: now.Add(time.Duration(-24+i) * time.Hour),
+		}
+	}
+
+	trend := ComputeTrend(points, "cpu", 24*time.Hour)
+
+	if trend.Direction != TrendStable {
+		t.Errorf("Expected TrendStable, got %s (rate: %.4f/hr)", trend.Direction, trend.RatePerHour)
+	}
+}
+
+func TestComputeTrend_Declining(t *testing.T) {
+	// Create declining data
+	now := time.Now()
+	points := make([]MetricPoint, 24)
+	for i := 0; i < 24; i++ {
+		points[i] = MetricPoint{
+			Value:     80 - float64(i)*0.5, // -12% per day
+			Timestamp: now.Add(time.Duration(-24+i) * time.Hour),
+		}
+	}
+
+	trend := ComputeTrend(points, "disk", 24*time.Hour)
+
+	if trend.Direction != TrendDeclining {
+		t.Errorf("Expected TrendDeclining, got %s", trend.Direction)
+	}
+}
+
+func TestComputeTrend_Volatile(t *testing.T) {
+	// Create volatile data with high variance
+	now := time.Now()
+	points := make([]MetricPoint, 24)
+	for i := 0; i < 24; i++ {
+		// Alternating high/low values
+		value := 50.0
+		if i%2 == 0 {
+			value = 80.0
+		} else {
+			value = 20.0
+		}
+		points[i] = MetricPoint{
+			Value:     value,
+			Timestamp: now.Add(time.Duration(-24+i) * time.Hour),
+		}
+	}
+
+	trend := ComputeTrend(points, "cpu", 24*time.Hour)
+
+	if trend.Direction != TrendVolatile {
+		t.Errorf("Expected TrendVolatile, got %s (stddev: %.2f, mean: %.2f)", 
+			trend.Direction, trend.StdDev, trend.Average)
+	}
+}
+
+func TestComputeTrend_InsufficientData(t *testing.T) {
+	// Only one data point
+	points := []MetricPoint{
+		{Value: 50, Timestamp: time.Now()},
+	}
+
+	trend := ComputeTrend(points, "memory", 24*time.Hour)
+
+	if trend.Confidence != 0 {
+		t.Errorf("Expected 0 confidence with insufficient data, got %.2f", trend.Confidence)
+	}
+}
+
+func TestLinearRegression_Perfect(t *testing.T) {
+	// Perfect linear data: y = 2x + 10
+	now := time.Now()
+	points := make([]MetricPoint, 10)
+	for i := 0; i < 10; i++ {
+		points[i] = MetricPoint{
+			Value:     10 + float64(i)*2,
+			Timestamp: now.Add(time.Duration(i) * time.Second),
+		}
+	}
+
+	result := linearRegression(points)
+
+	// Slope should be 2 per second
+	if result.Slope < 1.9 || result.Slope > 2.1 {
+		t.Errorf("Expected slope ~2, got %.4f", result.Slope)
+	}
+
+	// R² should be 1 (perfect fit)
+	if result.R2 < 0.99 {
+		t.Errorf("Expected R² ~1, got %.4f", result.R2)
+	}
+}
+
+func TestComputePercentiles(t *testing.T) {
+	now := time.Now()
+	// Create 100 points with values 1-100
+	points := make([]MetricPoint, 100)
+	for i := 0; i < 100; i++ {
+		points[i] = MetricPoint{
+			Value:     float64(i + 1),
+			Timestamp: now.Add(time.Duration(i) * time.Second),
+		}
+	}
+
+	percentiles := ComputePercentiles(points, 5, 50, 95)
+
+	// P5 should be ~5
+	if percentiles[5] < 4 || percentiles[5] > 6 {
+		t.Errorf("Expected P5 ~5, got %.2f", percentiles[5])
+	}
+
+	// P50 should be ~50
+	if percentiles[50] < 49 || percentiles[50] > 51 {
+		t.Errorf("Expected P50 ~50, got %.2f", percentiles[50])
+	}
+
+	// P95 should be ~95
+	if percentiles[95] < 94 || percentiles[95] > 96 {
+		t.Errorf("Expected P95 ~95, got %.2f", percentiles[95])
+	}
+}
+
+func TestTrendSummary(t *testing.T) {
+	tests := []struct {
+		name     string
+		trend    Trend
+		expected string
+	}{
+		{
+			name: "growing fast",
+			trend: Trend{
+				Direction:   TrendGrowing,
+				RatePerDay:  5.5,
+				RatePerHour: 0.23,
+				DataPoints:  24,
+			},
+			expected: "growing 5.5/day",
+		},
+		{
+			name: "growing slow",
+			trend: Trend{
+				Direction:   TrendGrowing,
+				RatePerDay:  0.5,
+				RatePerHour: 0.02,
+				DataPoints:  24,
+			},
+			expected: "growing 0.02/hr",
+		},
+		{
+			name: "stable",
+			trend: Trend{
+				Direction:  TrendStable,
+				DataPoints: 24,
+			},
+			expected: "stable",
+		},
+		{
+			name: "volatile",
+			trend: Trend{
+				Direction:  TrendVolatile,
+				DataPoints: 24,
+			},
+			expected: "volatile",
+		},
+		{
+			name: "insufficient data",
+			trend: Trend{
+				DataPoints: 1,
+			},
+			expected: "insufficient data",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := TrendSummary(tt.trend)
+			if result != tt.expected {
+				t.Errorf("Expected %q, got %q", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestComputeStats(t *testing.T) {
+	points := []MetricPoint{
+		{Value: 10},
+		{Value: 20},
+		{Value: 30},
+		{Value: 40},
+		{Value: 50},
+	}
+
+	stats := computeStats(points)
+
+	if stats.Count != 5 {
+		t.Errorf("Expected count 5, got %d", stats.Count)
+	}
+	if stats.Min != 10 {
+		t.Errorf("Expected min 10, got %.2f", stats.Min)
+	}
+	if stats.Max != 50 {
+		t.Errorf("Expected max 50, got %.2f", stats.Max)
+	}
+	if stats.Mean != 30 {
+		t.Errorf("Expected mean 30, got %.2f", stats.Mean)
+	}
+}
diff --git a/internal/ai/context/types.go b/internal/ai/context/types.go
new file mode 100644
index 0000000..d980108
--- /dev/null
+++ b/internal/ai/context/types.go
@@ -0,0 +1,183 @@
+// Package context provides AI context building with historical data integration.
+// This package transforms raw metrics and state into meaningful, time-aware context
+// that differentiates Pulse AI from stateless AI assistants.
+package context
+
+import (
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/types"
+)
+
+// MetricPoint is an alias for the shared type
+type MetricPoint = types.MetricPoint
+
+// TrendDirection indicates whether a metric is growing, stable, or declining
+type TrendDirection string
+
+const (
+	TrendStable    TrendDirection = "stable"    // No significant change
+	TrendGrowing   TrendDirection = "growing"   // Increasing over time
+	TrendDeclining TrendDirection = "declining" // Decreasing over time
+	TrendVolatile  TrendDirection = "volatile"  // Fluctuating significantly
+)
+
+// Trend represents the direction and rate of change for a metric
+type Trend struct {
+	Metric      string         // Name of the metric (cpu, memory, disk)
+	Direction   TrendDirection // Overall direction
+	RatePerHour float64        // Change per hour (in metric units, e.g., percentage points)
+	RatePerDay  float64        // Change per day
+	Current     float64        // Most recent value
+	Average     float64        // Average over the period
+	Min         float64        // Minimum value
+	Max         float64        // Maximum value
+	StdDev      float64        // Standard deviation
+	DataPoints  int            // Number of data points used
+	Period      time.Duration  // Time period analyzed
+	Confidence  float64        // 0-1 confidence based on data quality (R² for linear fit)
+}
+
+// Baseline represents learned "normal" behavior for a metric
+type Baseline struct {
+	Metric      string    // Name of the metric
+	Mean        float64   // Average value
+	StdDev      float64   // Standard deviation
+	P5          float64   // 5th percentile (low boundary)
+	P50         float64   // Median
+	P95         float64   // 95th percentile (high boundary)
+	Min         float64   // Observed minimum
+	Max         float64   // Observed maximum
+	SampleCount int       // Number of samples used
+	LearnedAt   time.Time // When baseline was computed
+}
+
+// Anomaly represents a detected deviation from normal behavior
+type Anomaly struct {
+	Metric      string    // Which metric is anomalous
+	Current     float64   // Current value
+	Expected    float64   // Expected value (baseline mean)
+	Deviation   float64   // Number of standard deviations from mean
+	Severity    string    // "low", "medium", "high", "critical"
+	Since       time.Time // When the anomaly started (if known)
+	Description string    // Human-readable description
+}
+
+// Prediction represents a forecasted future event
+type Prediction struct {
+	ResourceID  string        // Which resource this prediction is for
+	Metric      string        // Which metric
+	Event       string        // Type of predicted event (capacity_full, oom, etc.)
+	ETA         time.Time     // When the event is predicted to occur
+	DaysUntil   float64       // Days until event
+	Confidence  float64       // 0-1 confidence level
+	Basis       string        // Explanation of how prediction was made
+	GrowthRate  float64       // Rate of change used for projection
+	CurrentPct  float64       // Current usage percentage
+}
+
+// Change represents a detected configuration or state change
+type Change struct {
+	ResourceID   string      // Which resource changed
+	ResourceName string      // Display name
+	ChangeType   ChangeType  // Type of change
+	Before       interface{} // Previous value (nil for creation)
+	After        interface{} // New value (nil for deletion)
+	DetectedAt   time.Time   // When change was detected
+	Description  string      // Human-readable description
+}
+
+// ChangeType categorizes types of changes
+type ChangeType string
+
+const (
+	ChangeCreated    ChangeType = "created"    // New resource appeared
+	ChangeDeleted    ChangeType = "deleted"    // Resource disappeared
+	ChangeConfig     ChangeType = "config"     // Configuration change (RAM, CPU)
+	ChangeStatus     ChangeType = "status"     // Status change (started, stopped)
+	ChangeMigrated   ChangeType = "migrated"   // Moved to different node
+	ChangePerformance ChangeType = "performance" // Significant performance shift
+)
+
+// ResourceTrends contains all trend data for a single resource
+type ResourceTrends struct {
+	ResourceID   string           // Unique identifier
+	ResourceType string           // node, vm, container, storage, docker_host
+	ResourceName string           // Display name
+	Trends       map[string]Trend // Metric name -> trend data
+	DataAvailable bool            // Whether we have historical data for this resource
+	OldestData   time.Time        // Timestamp of oldest data point
+	NewestData   time.Time        // Timestamp of newest data point
+}
+
+// ResourceContext contains all context for a single resource
+type ResourceContext struct {
+	ResourceID   string
+	ResourceType string // "node", "vm", "container", "oci_container", "storage", "docker_host"
+	ResourceName string
+	Node         string // Parent node (for guests)
+
+	// Current state (point-in-time)
+	CurrentCPU     float64
+	CurrentMemory  float64
+	CurrentDisk    float64
+	Status         string
+	Uptime         time.Duration
+
+	// Historical analysis
+	Trends    map[string]Trend    // metric -> trend (24h and 7d)
+	Baselines map[string]Baseline // metric -> baseline
+	Anomalies []Anomaly           // Current anomalies
+
+	// Predictions
+	Predictions []Prediction
+
+	// Operational memory
+	UserNotes       []string  // User-provided annotations
+	PastIssues      []string  // Summary of past findings
+	LastRemediation string    // What was done last time
+	RecentChanges   []Change  // Recent configuration changes
+
+	// Additional metadata (e.g., OCI image for OCI containers)
+	Metadata map[string]interface{}
+}
+
+// InfrastructureContext contains summarized context for the entire infrastructure
+type InfrastructureContext struct {
+	// Timestamp of this context snapshot
+	GeneratedAt time.Time
+	
+	// Summary statistics
+	TotalResources     int
+	ResourcesWithData  int // Resources with historical data available
+	
+	// Categorized resources with their context
+	Nodes       []ResourceContext
+	VMs         []ResourceContext
+	Containers  []ResourceContext
+	Storage     []ResourceContext
+	DockerHosts []ResourceContext
+	Hosts       []ResourceContext
+	
+	// Global insights
+	Anomalies   []Anomaly    // Cross-infrastructure anomalies
+	Predictions []Prediction // Capacity and failure predictions
+	Changes     []Change     // Recent changes across infrastructure
+}
+
+// Stats contains summary statistics for a metric
+type Stats struct {
+	Count   int
+	Min     float64
+	Max     float64
+	Sum     float64
+	Mean    float64
+	StdDev  float64
+}
+
+// LinearRegressionResult contains the results of linear regression
+type LinearRegressionResult struct {
+	Slope     float64 // Rate of change per second
+	Intercept float64 // Y-intercept
+	R2        float64 // Coefficient of determination (0-1)
+}
diff --git a/internal/ai/correlation/detector.go b/internal/ai/correlation/detector.go
new file mode 100644
index 0000000..f722b20
--- /dev/null
+++ b/internal/ai/correlation/detector.go
@@ -0,0 +1,529 @@
+// Package correlation detects relationships between resources.
+// It tracks when events on one resource are followed by events on another,
+// enabling the AI to understand dependencies and predict cascade failures.
+package correlation
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// EventType represents the type of event being correlated
+type EventType string
+
+const (
+	EventAlert     EventType = "alert"     // Alert triggered
+	EventRestart   EventType = "restart"   // Resource restarted
+	EventHighCPU   EventType = "high_cpu"  // CPU spike
+	EventHighMem   EventType = "high_mem"  // Memory spike
+	EventDiskFull  EventType = "disk_full" // Disk space critical
+	EventOffline   EventType = "offline"   // Resource went offline
+	EventMigration EventType = "migration" // Resource migrated
+)
+
+// Event represents a tracked event for correlation analysis
+type Event struct {
+	ID           string    `json:"id"`
+	ResourceID   string    `json:"resource_id"`
+	ResourceName string    `json:"resource_name,omitempty"`
+	ResourceType string    `json:"resource_type,omitempty"` // node, vm, container, storage
+	EventType    EventType `json:"event_type"`
+	Timestamp    time.Time `json:"timestamp"`
+	Value        float64   `json:"value,omitempty"` // Metric value if applicable
+}
+
+// Correlation represents a detected relationship between two resources
+type Correlation struct {
+	SourceID     string        `json:"source_id"` // Resource that triggers
+	SourceName   string        `json:"source_name"`
+	SourceType   string        `json:"source_type"`
+	TargetID     string        `json:"target_id"` // Resource that follows
+	TargetName   string        `json:"target_name"`
+	TargetType   string        `json:"target_type"`
+	EventPattern string        `json:"event_pattern"` // e.g., "high_mem -> restart"
+	Occurrences  int           `json:"occurrences"`   // Number of times observed
+	AvgDelay     time.Duration `json:"avg_delay"`     // Average time between events
+	Confidence   float64       `json:"confidence"`    // 0-1 confidence level
+	LastSeen     time.Time     `json:"last_seen"`
+	Description  string        `json:"description"`
+}
+
+// Detector tracks events and detects correlations between resources
+type Detector struct {
+	mu           sync.RWMutex
+	events       []Event
+	correlations map[string]*Correlation // key: sourceID:targetID:pattern
+
+	// Configuration
+	maxEvents         int
+	correlationWindow time.Duration // How long after source event to look for target
+	minOccurrences    int           // Minimum co-occurrences to form correlation
+	retentionWindow   time.Duration // How long to keep events
+
+	// Persistence
+	dataDir string
+}
+
+// Config configures the correlation detector
+type Config struct {
+	MaxEvents         int
+	CorrelationWindow time.Duration // Default: 10 minutes
+	MinOccurrences    int           // Default: 3
+	RetentionWindow   time.Duration // Default: 30 days
+	DataDir           string
+}
+
+// DefaultConfig returns default configuration
+func DefaultConfig() Config {
+	return Config{
+		MaxEvents:         10000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    3,
+		RetentionWindow:   30 * 24 * time.Hour,
+	}
+}
+
+// NewDetector creates a new correlation detector
+func NewDetector(cfg Config) *Detector {
+	if cfg.MaxEvents <= 0 {
+		cfg.MaxEvents = 10000
+	}
+	if cfg.CorrelationWindow <= 0 {
+		cfg.CorrelationWindow = 10 * time.Minute
+	}
+	if cfg.MinOccurrences <= 0 {
+		cfg.MinOccurrences = 3
+	}
+	if cfg.RetentionWindow <= 0 {
+		cfg.RetentionWindow = 30 * 24 * time.Hour
+	}
+
+	d := &Detector{
+		events:            make([]Event, 0),
+		correlations:      make(map[string]*Correlation),
+		maxEvents:         cfg.MaxEvents,
+		correlationWindow: cfg.CorrelationWindow,
+		minOccurrences:    cfg.MinOccurrences,
+		retentionWindow:   cfg.RetentionWindow,
+		dataDir:           cfg.DataDir,
+	}
+
+	// Load existing data
+	if cfg.DataDir != "" {
+		if err := d.loadFromDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to load correlation data from disk")
+		} else if len(d.events) > 0 {
+			log.Info().Int("events", len(d.events)).Int("correlations", len(d.correlations)).
+				Msg("Loaded correlation data from disk")
+		}
+	}
+
+	return d
+}
+
+// RecordEvent records a new event for correlation analysis
+func (d *Detector) RecordEvent(event Event) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if event.ID == "" {
+		event.ID = generateEventID()
+	}
+	if event.Timestamp.IsZero() {
+		event.Timestamp = time.Now()
+	}
+
+	d.events = append(d.events, event)
+	d.trimEvents()
+
+	// Check for correlations with recent events on OTHER resources
+	d.detectCorrelations(event)
+
+	// Persist asynchronously
+	go func() {
+		if err := d.saveToDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to save correlation data")
+		}
+	}()
+}
+
+// detectCorrelations looks for patterns where this event follows a recent event on another resource
+func (d *Detector) detectCorrelations(newEvent Event) {
+	cutoff := newEvent.Timestamp.Add(-d.correlationWindow)
+
+	for _, oldEvent := range d.events {
+		// Skip same resource
+		if oldEvent.ResourceID == newEvent.ResourceID {
+			continue
+		}
+		// Skip events outside the correlation window
+		if oldEvent.Timestamp.Before(cutoff) || oldEvent.Timestamp.After(newEvent.Timestamp) {
+			continue
+		}
+
+		// Found a potential correlation: oldEvent -> newEvent
+		key := correlationKey(oldEvent.ResourceID, newEvent.ResourceID, oldEvent.EventType, newEvent.EventType)
+		pattern := string(oldEvent.EventType) + " -> " + string(newEvent.EventType)
+		delay := newEvent.Timestamp.Sub(oldEvent.Timestamp)
+
+		if existing, ok := d.correlations[key]; ok {
+			// Update existing correlation
+			existing.Occurrences++
+			existing.AvgDelay = (existing.AvgDelay*time.Duration(existing.Occurrences-1) + delay) / time.Duration(existing.Occurrences)
+			existing.LastSeen = newEvent.Timestamp
+			existing.Confidence = d.calculateConfidence(existing.Occurrences)
+			existing.Description = d.formatCorrelationDescription(existing)
+		} else {
+			// Create new correlation
+			d.correlations[key] = &Correlation{
+				SourceID:     oldEvent.ResourceID,
+				SourceName:   oldEvent.ResourceName,
+				SourceType:   oldEvent.ResourceType,
+				TargetID:     newEvent.ResourceID,
+				TargetName:   newEvent.ResourceName,
+				TargetType:   newEvent.ResourceType,
+				EventPattern: pattern,
+				Occurrences:  1,
+				AvgDelay:     delay,
+				Confidence:   0.1, // Low initial confidence
+				LastSeen:     newEvent.Timestamp,
+			}
+		}
+	}
+}
+
+// calculateConfidence returns confidence based on occurrence count
+func (d *Detector) calculateConfidence(occurrences int) float64 {
+	// Confidence grows with occurrences, capped at 0.95
+	if occurrences < d.minOccurrences {
+		return float64(occurrences) * 0.1
+	}
+	// Logarithmic growth after threshold
+	confidence := 0.3 + 0.1*float64(occurrences-d.minOccurrences)
+	if confidence > 0.95 {
+		confidence = 0.95
+	}
+	return confidence
+}
+
+// formatCorrelationDescription creates a human-readable description
+func (d *Detector) formatCorrelationDescription(c *Correlation) string {
+	sourceName := c.SourceName
+	if sourceName == "" {
+		sourceName = c.SourceID
+	}
+	targetName := c.TargetName
+	if targetName == "" {
+		targetName = c.TargetID
+	}
+
+	delayStr := formatDuration(c.AvgDelay)
+	sourceEvent := c.EventPattern
+	if parts := strings.Split(c.EventPattern, " -> "); len(parts) == 2 {
+		sourceEvent = parts[0]
+	}
+
+	return "When " + sourceName + " experiences " + sourceEvent +
+		", " + targetName + " often follows within " + delayStr
+}
+
+// GetCorrelations returns all detected correlations above minimum confidence
+func (d *Detector) GetCorrelations() []*Correlation {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var result []*Correlation
+	for _, c := range d.correlations {
+		if c.Occurrences >= d.minOccurrences && c.Confidence >= 0.3 {
+			result = append(result, c)
+		}
+	}
+
+	// Sort by confidence descending
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Confidence > result[j].Confidence
+	})
+
+	return result
+}
+
+// GetCorrelationsForResource returns correlations involving a specific resource
+func (d *Detector) GetCorrelationsForResource(resourceID string) []*Correlation {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var result []*Correlation
+	for _, c := range d.correlations {
+		if (c.SourceID == resourceID || c.TargetID == resourceID) && c.Occurrences >= d.minOccurrences {
+			result = append(result, c)
+		}
+	}
+
+	return result
+}
+
+// GetDependencies returns resources that depend on the given resource
+// (resources that experience events after this resource has an event)
+func (d *Detector) GetDependencies(resourceID string) []string {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	deps := make(map[string]bool)
+	for _, c := range d.correlations {
+		if c.SourceID == resourceID && c.Occurrences >= d.minOccurrences {
+			deps[c.TargetID] = true
+		}
+	}
+
+	result := make([]string, 0, len(deps))
+	for dep := range deps {
+		result = append(result, dep)
+	}
+	return result
+}
+
+// GetDependsOn returns resources that the given resource depends on
+// (resources whose events precede events on this resource)
+func (d *Detector) GetDependsOn(resourceID string) []string {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	deps := make(map[string]bool)
+	for _, c := range d.correlations {
+		if c.TargetID == resourceID && c.Occurrences >= d.minOccurrences {
+			deps[c.SourceID] = true
+		}
+	}
+
+	result := make([]string, 0, len(deps))
+	for dep := range deps {
+		result = append(result, dep)
+	}
+	return result
+}
+
+// PredictCascade predicts what resources might be affected if the given resource has an issue
+func (d *Detector) PredictCascade(resourceID string, eventType EventType) []CascadePrediction {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var predictions []CascadePrediction
+
+	for _, c := range d.correlations {
+		if c.SourceID == resourceID && c.Occurrences >= d.minOccurrences {
+			// Check if the correlation's source event matches the given event type.
+			sourceEvent := c.EventPattern
+			if parts := strings.Split(c.EventPattern, " -> "); len(parts) == 2 {
+				sourceEvent = parts[0]
+			}
+			if EventType(sourceEvent) == eventType {
+				predictions = append(predictions, CascadePrediction{
+					ResourceID:   c.TargetID,
+					ResourceName: c.TargetName,
+					EventPattern: c.EventPattern,
+					ExpectedIn:   c.AvgDelay,
+					Confidence:   c.Confidence,
+				})
+			}
+		}
+	}
+
+	// Sort by confidence
+	sort.Slice(predictions, func(i, j int) bool {
+		return predictions[i].Confidence > predictions[j].Confidence
+	})
+
+	return predictions
+}
+
+// CascadePrediction represents a predicted downstream effect
+type CascadePrediction struct {
+	ResourceID   string        `json:"resource_id"`
+	ResourceName string        `json:"resource_name"`
+	EventPattern string        `json:"event_pattern"`
+	ExpectedIn   time.Duration `json:"expected_in"`
+	Confidence   float64       `json:"confidence"`
+}
+
+// FormatForContext formats correlations for AI consumption
+func (d *Detector) FormatForContext(resourceID string) string {
+	var correlations []*Correlation
+	if resourceID != "" {
+		correlations = d.GetCorrelationsForResource(resourceID)
+	} else {
+		correlations = d.GetCorrelations()
+	}
+
+	if len(correlations) == 0 {
+		return ""
+	}
+
+	var result string
+	result = "\n## 🔗 Resource Correlations\n"
+	result += "Observed relationships between resources:\n"
+
+	for i, c := range correlations {
+		if i >= 10 { // Limit to 10 correlations
+			result += "\n... and more\n"
+			break
+		}
+		if c.Description != "" {
+			result += "- " + c.Description + "\n"
+		} else {
+			result += "- " + c.EventPattern + " (" + formatConfidence(c.Confidence) + " confidence)\n"
+		}
+	}
+
+	return result
+}
+
+// trimEvents removes old events
+func (d *Detector) trimEvents() {
+	// Remove events beyond maxEvents
+	if len(d.events) > d.maxEvents {
+		d.events = d.events[len(d.events)-d.maxEvents:]
+	}
+
+	// Remove events older than retention window
+	cutoff := time.Now().Add(-d.retentionWindow)
+	kept := make([]Event, 0, len(d.events))
+	for _, e := range d.events {
+		if e.Timestamp.After(cutoff) {
+			kept = append(kept, e)
+		}
+	}
+	d.events = kept
+}
+
+// saveToDisk persists data
+func (d *Detector) saveToDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	d.mu.RLock()
+	data := struct {
+		Events       []Event                 `json:"events"`
+		Correlations map[string]*Correlation `json:"correlations"`
+	}{
+		Events:       d.events,
+		Correlations: d.correlations,
+	}
+	d.mu.RUnlock()
+
+	jsonData, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	path := filepath.Join(d.dataDir, "ai_correlations.json")
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, jsonData, 0600); err != nil {
+		return err
+	}
+
+	return os.Rename(tmpPath, path)
+}
+
+// loadFromDisk loads data
+func (d *Detector) loadFromDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	path := filepath.Join(d.dataDir, "ai_correlations.json")
+	if st, err := os.Stat(path); err == nil {
+		const maxOnDiskBytes = 10 << 20 // 10 MiB safety cap
+		if st.Size() > maxOnDiskBytes {
+			return fmt.Errorf("correlation history file too large (%d bytes)", st.Size())
+		}
+	}
+	jsonData, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	var data struct {
+		Events       []Event                 `json:"events"`
+		Correlations map[string]*Correlation `json:"correlations"`
+	}
+
+	if err := json.Unmarshal(jsonData, &data); err != nil {
+		return err
+	}
+
+	d.events = data.Events
+	d.correlations = data.Correlations
+	if d.correlations == nil {
+		d.correlations = make(map[string]*Correlation)
+	}
+
+	d.trimEvents()
+	cutoff := time.Now().Add(-d.retentionWindow)
+	for k, v := range d.correlations {
+		if v == nil || v.LastSeen.Before(cutoff) {
+			delete(d.correlations, k)
+		}
+	}
+
+	return nil
+}
+
+// Helper functions
+
+var eventCounter int64
+
+func generateEventID() string {
+	eventCounter++
+	return time.Now().Format("20060102150405") + "-" + intToStr(int(eventCounter%1000))
+}
+
+func intToStr(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var result string
+	for n > 0 {
+		result = string(rune('0'+n%10)) + result
+		n /= 10
+	}
+	return result
+}
+
+func correlationKey(sourceID, targetID string, sourceType, targetType EventType) string {
+	return sourceID + ":" + targetID + ":" + string(sourceType) + ":" + string(targetType)
+}
+
+func formatDuration(d time.Duration) string {
+	if d < time.Minute {
+		return "seconds"
+	}
+	if d < time.Hour {
+		mins := int(d.Minutes())
+		if mins == 1 {
+			return "1 minute"
+		}
+		return intToStr(mins) + " minutes"
+	}
+	hours := int(d.Hours())
+	if hours == 1 {
+		return "1 hour"
+	}
+	return intToStr(hours) + " hours"
+}
+
+func formatConfidence(c float64) string {
+	pct := int(c * 100)
+	return intToStr(pct) + "%"
+}
diff --git a/internal/ai/correlation/detector_test.go b/internal/ai/correlation/detector_test.go
new file mode 100644
index 0000000..f99f2ca
--- /dev/null
+++ b/internal/ai/correlation/detector_test.go
@@ -0,0 +1,246 @@
+package correlation
+
+import (
+	"testing"
+	"time"
+)
+
+func TestDetector_RecordEvent(t *testing.T) {
+	d := NewDetector(DefaultConfig())
+
+	d.RecordEvent(Event{
+		ResourceID:   "vm-100",
+		ResourceName: "web-server",
+		EventType:    EventHighMem,
+		Timestamp:    time.Now(),
+	})
+
+	if len(d.events) != 1 {
+		t.Errorf("Expected 1 event, got %d", len(d.events))
+	}
+}
+
+func TestDetector_CorrelationDetection(t *testing.T) {
+	d := NewDetector(Config{
+		MaxEvents:         1000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    2, // Lower threshold for testing
+		RetentionWindow:   30 * 24 * time.Hour,
+	})
+
+	now := time.Now()
+
+	// Simulate pattern: when storage has high usage, database VM restarts
+	// Occurrence 1
+	d.RecordEvent(Event{
+		ResourceID:   "storage-1",
+		ResourceName: "local-zfs",
+		ResourceType: "storage",
+		EventType:    EventDiskFull,
+		Timestamp:    now.Add(-2 * time.Hour),
+	})
+	d.RecordEvent(Event{
+		ResourceID:   "vm-100",
+		ResourceName: "database",
+		ResourceType: "vm",
+		EventType:    EventRestart,
+		Timestamp:    now.Add(-2*time.Hour + 5*time.Minute),
+	})
+
+	// Occurrence 2
+	d.RecordEvent(Event{
+		ResourceID:   "storage-1",
+		ResourceName: "local-zfs",
+		ResourceType: "storage",
+		EventType:    EventDiskFull,
+		Timestamp:    now.Add(-1 * time.Hour),
+	})
+	d.RecordEvent(Event{
+		ResourceID:   "vm-100",
+		ResourceName: "database",
+		ResourceType: "vm",
+		EventType:    EventRestart,
+		Timestamp:    now.Add(-1*time.Hour + 5*time.Minute),
+	})
+
+	// Occurrence 3
+	d.RecordEvent(Event{
+		ResourceID:   "storage-1",
+		ResourceName: "local-zfs",
+		ResourceType: "storage",
+		EventType:    EventDiskFull,
+		Timestamp:    now,
+	})
+	d.RecordEvent(Event{
+		ResourceID:   "vm-100",
+		ResourceName: "database",
+		ResourceType: "vm",
+		EventType:    EventRestart,
+		Timestamp:    now.Add(5 * time.Minute),
+	})
+
+	// Check correlations
+	correlations := d.GetCorrelations()
+	
+	found := false
+	for _, c := range correlations {
+		if c.SourceID == "storage-1" && c.TargetID == "vm-100" {
+			found = true
+			if c.Occurrences < 2 {
+				t.Errorf("Expected at least 2 occurrences, got %d", c.Occurrences)
+			}
+			break
+		}
+	}
+	
+	if !found {
+		t.Error("Expected correlation between storage-1 and vm-100")
+	}
+}
+
+func TestDetector_GetCorrelationsForResource(t *testing.T) {
+	d := NewDetector(Config{
+		MaxEvents:         1000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    2,
+		RetentionWindow:   30 * 24 * time.Hour,
+	})
+
+	now := time.Now()
+
+	// Create correlation pattern
+	for i := 0; i < 3; i++ {
+		offset := time.Duration(-i) * time.Hour
+		d.RecordEvent(Event{
+			ResourceID: "node-1",
+			EventType:  EventHighCPU,
+			Timestamp:  now.Add(offset),
+		})
+		d.RecordEvent(Event{
+			ResourceID: "vm-100",
+			EventType:  EventHighMem,
+			Timestamp:  now.Add(offset + 2*time.Minute),
+		})
+	}
+
+	// Get correlations for node-1
+	correlations := d.GetCorrelationsForResource("node-1")
+	if len(correlations) == 0 {
+		t.Error("Expected correlations for node-1")
+	}
+}
+
+func TestDetector_GetDependencies(t *testing.T) {
+	d := NewDetector(Config{
+		MaxEvents:         1000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    3,
+		RetentionWindow:   30 * 24 * time.Hour,
+	})
+
+	now := time.Now()
+
+	// When storage is full, both VM and container have issues
+	for i := 0; i < 4; i++ {
+		offset := time.Duration(-i) * time.Hour
+		d.RecordEvent(Event{
+			ResourceID: "storage-1",
+			EventType:  EventDiskFull,
+			Timestamp:  now.Add(offset),
+		})
+		d.RecordEvent(Event{
+			ResourceID: "vm-100",
+			EventType:  EventRestart,
+			Timestamp:  now.Add(offset + 3*time.Minute),
+		})
+		d.RecordEvent(Event{
+			ResourceID: "ct-200",
+			EventType:  EventRestart,
+			Timestamp:  now.Add(offset + 5*time.Minute),
+		})
+	}
+
+	deps := d.GetDependencies("storage-1")
+	if len(deps) < 2 {
+		t.Errorf("Expected at least 2 dependencies, got %d", len(deps))
+	}
+}
+
+func TestDetector_PredictCascade(t *testing.T) {
+	d := NewDetector(Config{
+		MaxEvents:         1000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    3,
+		RetentionWindow:   30 * 24 * time.Hour,
+	})
+
+	now := time.Now()
+
+	// Create strong correlation
+	for i := 0; i < 5; i++ {
+		offset := time.Duration(-i) * time.Hour
+		d.RecordEvent(Event{
+			ResourceID:   "node-1",
+			ResourceName: "pve-main",
+			EventType:    EventHighMem,
+			Timestamp:    now.Add(offset),
+		})
+		d.RecordEvent(Event{
+			ResourceID:   "vm-100",
+			ResourceName: "database",
+			EventType:    EventRestart,
+			Timestamp:    now.Add(offset + 5*time.Minute),
+		})
+	}
+
+	predictions := d.PredictCascade("node-1", EventHighMem)
+	if len(predictions) == 0 {
+		t.Error("Expected cascade predictions")
+	}
+}
+
+func TestDetector_FormatForContext(t *testing.T) {
+	d := NewDetector(Config{
+		MaxEvents:         1000,
+		CorrelationWindow: 10 * time.Minute,
+		MinOccurrences:    2,
+		RetentionWindow:   30 * 24 * time.Hour,
+	})
+
+	now := time.Now()
+
+	// Create correlations
+	for i := 0; i < 3; i++ {
+		offset := time.Duration(-i) * time.Hour
+		d.RecordEvent(Event{
+			ResourceID:   "storage-1",
+			ResourceName: "local-zfs",
+			EventType:    EventDiskFull,
+			Timestamp:    now.Add(offset),
+		})
+		d.RecordEvent(Event{
+			ResourceID:   "vm-100",
+			ResourceName: "database",
+			EventType:    EventRestart,
+			Timestamp:    now.Add(offset + 5*time.Minute),
+		})
+	}
+
+	context := d.FormatForContext("")
+	if context == "" {
+		t.Error("Expected non-empty context")
+	}
+	
+	if !contains(context, "Correlation") {
+		t.Errorf("Expected context to mention correlations: %s", context)
+	}
+}
+
+func contains(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/ai/correlation_exports.go b/internal/ai/correlation_exports.go
new file mode 100644
index 0000000..96fcdc4
--- /dev/null
+++ b/internal/ai/correlation_exports.go
@@ -0,0 +1,44 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/correlation"
+)
+
+// CorrelationDetector is an alias for correlation.Detector
+type CorrelationDetector = correlation.Detector
+
+// CorrelationConfig is an alias for correlation.Config
+type CorrelationConfig = correlation.Config
+
+// CorrelationEvent is an alias for correlation.Event
+type CorrelationEvent = correlation.Event
+
+// Correlation is an alias for correlation.Correlation
+type Correlation = correlation.Correlation
+
+// CascadePrediction is an alias for correlation.CascadePrediction
+type CascadePrediction = correlation.CascadePrediction
+
+// CorrelationEventType is an alias for correlation.EventType
+type CorrelationEventType = correlation.EventType
+
+// Event type constants
+const (
+	CorrelationEventAlert     = correlation.EventAlert
+	CorrelationEventRestart   = correlation.EventRestart
+	CorrelationEventHighCPU   = correlation.EventHighCPU
+	CorrelationEventHighMem   = correlation.EventHighMem
+	CorrelationEventDiskFull  = correlation.EventDiskFull
+	CorrelationEventOffline   = correlation.EventOffline
+	CorrelationEventMigration = correlation.EventMigration
+)
+
+// NewCorrelationDetector creates a new correlation detector
+func NewCorrelationDetector(cfg CorrelationConfig) *CorrelationDetector {
+	return correlation.NewDetector(cfg)
+}
+
+// DefaultCorrelationConfig returns default correlation detector configuration
+func DefaultCorrelationConfig() CorrelationConfig {
+	return correlation.DefaultConfig()
+}
diff --git a/internal/ai/cost/pricing.go b/internal/ai/cost/pricing.go
new file mode 100644
index 0000000..de2585c
--- /dev/null
+++ b/internal/ai/cost/pricing.go
@@ -0,0 +1,92 @@
+package cost
+
+import "strings"
+
+// TokenPrice represents a price per million tokens for a model.
+// Prices are estimates intended for cross-provider budgeting, not billing reconciliation.
+type TokenPrice struct {
+	InputUSDPerMTok  float64
+	OutputUSDPerMTok float64
+	AsOf             string
+}
+
+// EstimateUSD returns an estimated USD cost for the given provider/model and token counts.
+// If the model pricing is unknown, ok is false and usd is 0.
+func EstimateUSD(provider, model string, inputTokens, outputTokens int64) (usd float64, ok bool, price TokenPrice) {
+	price, ok = lookupPrice(provider, model)
+	if !ok {
+		return 0, false, TokenPrice{}
+	}
+
+	usd = (float64(inputTokens)/1_000_000.0)*price.InputUSDPerMTok +
+		(float64(outputTokens)/1_000_000.0)*price.OutputUSDPerMTok
+	return usd, true, price
+}
+
+type modelPrice struct {
+	Pattern          string
+	InputUSDPerMTok  float64
+	OutputUSDPerMTok float64
+}
+
+const pricingAsOf = "2025-12"
+
+// PricingAsOf indicates the effective date of the pricing table used for estimation.
+func PricingAsOf() string {
+	return pricingAsOf
+}
+
+// NOTE: Keep this table small and conservative.
+// The goal is quick estimation and relative comparisons, not exact billing.
+var providerPrices = map[string][]modelPrice{
+	"openai": {
+		{Pattern: "gpt-4o*", InputUSDPerMTok: 5.00, OutputUSDPerMTok: 15.00},
+		{Pattern: "gpt-4o-mini*", InputUSDPerMTok: 0.15, OutputUSDPerMTok: 0.60},
+	},
+	"anthropic": {
+		{Pattern: "claude-opus*", InputUSDPerMTok: 15.00, OutputUSDPerMTok: 75.00},
+		{Pattern: "claude-sonnet*", InputUSDPerMTok: 3.00, OutputUSDPerMTok: 15.00},
+		{Pattern: "claude-haiku*", InputUSDPerMTok: 0.25, OutputUSDPerMTok: 1.25},
+	},
+	"deepseek": {
+		// DeepSeek docs include an "input cache hit" discount; this uses cache-miss rates for conservative estimates.
+		{Pattern: "deepseek-*", InputUSDPerMTok: 0.28, OutputUSDPerMTok: 0.42},
+	},
+	"ollama": {
+		{Pattern: "*", InputUSDPerMTok: 0, OutputUSDPerMTok: 0},
+	},
+}
+
+func lookupPrice(provider, model string) (TokenPrice, bool) {
+	provider = strings.ToLower(strings.TrimSpace(provider))
+	model = strings.ToLower(strings.TrimSpace(model))
+	if provider == "" || model == "" {
+		return TokenPrice{}, false
+	}
+
+	prices, ok := providerPrices[provider]
+	if !ok {
+		return TokenPrice{}, false
+	}
+
+	for _, p := range prices {
+		if matchPattern(model, strings.ToLower(p.Pattern)) {
+			return TokenPrice{
+				InputUSDPerMTok:  p.InputUSDPerMTok,
+				OutputUSDPerMTok: p.OutputUSDPerMTok,
+				AsOf:             pricingAsOf,
+			}, true
+		}
+	}
+	return TokenPrice{}, false
+}
+
+func matchPattern(model, pattern string) bool {
+	if pattern == "*" {
+		return true
+	}
+	if strings.HasSuffix(pattern, "*") {
+		return strings.HasPrefix(model, strings.TrimSuffix(pattern, "*"))
+	}
+	return model == pattern
+}
diff --git a/internal/ai/cost/resolve.go b/internal/ai/cost/resolve.go
new file mode 100644
index 0000000..9ec7fcf
--- /dev/null
+++ b/internal/ai/cost/resolve.go
@@ -0,0 +1,53 @@
+package cost
+
+import "strings"
+
+// ResolveProviderAndModel normalizes an AI usage event into a provider and model pair for reporting/pricing.
+// It intentionally applies compatibility heuristics so OpenAI-compatible APIs (like DeepSeek) still price correctly.
+func ResolveProviderAndModel(eventProvider, requestModel, responseModel string) (provider, model string) {
+	provider = strings.ToLower(strings.TrimSpace(eventProvider))
+
+	model = normalizeModelForProvider(provider, requestModel, responseModel)
+	if provider == "" && requestModel != "" {
+		parts := strings.SplitN(strings.TrimSpace(requestModel), ":", 2)
+		if len(parts) == 2 && strings.TrimSpace(parts[0]) != "" {
+			provider = strings.ToLower(strings.TrimSpace(parts[0]))
+		}
+	}
+
+	provider, model = inferProviderAndModel(provider, model)
+	return provider, model
+}
+
+func normalizeModelForProvider(provider, requestModel, responseModel string) string {
+	if strings.TrimSpace(requestModel) != "" {
+		parts := strings.SplitN(requestModel, ":", 2)
+		if len(parts) == 2 && strings.ToLower(strings.TrimSpace(parts[0])) == provider {
+			return strings.TrimSpace(parts[1])
+		}
+		return strings.TrimSpace(requestModel)
+	}
+	if strings.TrimSpace(responseModel) != "" {
+		parts := strings.SplitN(responseModel, ":", 2)
+		if len(parts) == 2 && strings.ToLower(strings.TrimSpace(parts[0])) == provider {
+			return strings.TrimSpace(parts[1])
+		}
+		return strings.TrimSpace(responseModel)
+	}
+	return ""
+}
+
+func inferProviderAndModel(provider, model string) (string, string) {
+	switch provider {
+	case "openai":
+		trimmed := strings.ToLower(strings.TrimSpace(model))
+		parts := strings.SplitN(trimmed, ":", 2)
+		if len(parts) == 2 && strings.TrimSpace(parts[0]) == "deepseek" {
+			return "deepseek", strings.TrimSpace(parts[1])
+		}
+		if strings.HasPrefix(trimmed, "deepseek") {
+			return "deepseek", strings.TrimSpace(model)
+		}
+	}
+	return provider, strings.TrimSpace(model)
+}
diff --git a/internal/ai/cost/store.go b/internal/ai/cost/store.go
new file mode 100644
index 0000000..c7c81ce
--- /dev/null
+++ b/internal/ai/cost/store.go
@@ -0,0 +1,501 @@
+package cost
+
+import (
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// UsageEvent represents a single AI provider call for cost/token tracking.
+// It intentionally excludes prompt/response content for privacy.
+type UsageEvent struct {
+	Timestamp     time.Time `json:"timestamp"`
+	Provider      string    `json:"provider"`
+	RequestModel  string    `json:"request_model"`
+	ResponseModel string    `json:"response_model,omitempty"`
+	UseCase       string    `json:"use_case,omitempty"` // "chat" or "patrol"
+	InputTokens   int       `json:"input_tokens,omitempty"`
+	OutputTokens  int       `json:"output_tokens,omitempty"`
+	TargetType    string    `json:"target_type,omitempty"`
+	TargetID      string    `json:"target_id,omitempty"`
+	FindingID     string    `json:"finding_id,omitempty"`
+}
+
+// Persistence defines the storage contract for usage history.
+type Persistence interface {
+	SaveUsageHistory(events []UsageEvent) error
+	LoadUsageHistory() ([]UsageEvent, error)
+}
+
+// DefaultMaxDays is the default retention window for raw usage events.
+const DefaultMaxDays = 365
+
+// Store provides thread-safe usage tracking with optional persistence.
+type Store struct {
+	mu          sync.RWMutex
+	events      []UsageEvent
+	maxDays     int
+	persistence Persistence
+
+	// Debounced persistence to avoid frequent disk writes.
+	saveTimer    *time.Timer
+	savePending  bool
+	saveDebounce time.Duration
+}
+
+// NewStore creates a new usage store.
+func NewStore(maxDays int) *Store {
+	if maxDays <= 0 {
+		maxDays = DefaultMaxDays
+	}
+	return &Store{
+		events:       make([]UsageEvent, 0),
+		maxDays:      maxDays,
+		saveDebounce: 5 * time.Second,
+	}
+}
+
+// SetPersistence sets persistence and loads any existing history.
+func (s *Store) SetPersistence(p Persistence) error {
+	s.mu.Lock()
+	s.persistence = p
+	s.mu.Unlock()
+
+	if p == nil {
+		return nil
+	}
+
+	events, err := p.LoadUsageHistory()
+	if err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	s.events = events
+	s.trimLocked(time.Now())
+	s.mu.Unlock()
+	return nil
+}
+
+// Record appends a usage event and schedules persistence.
+func (s *Store) Record(event UsageEvent) {
+	if event.Timestamp.IsZero() {
+		event.Timestamp = time.Now()
+	}
+
+	s.mu.Lock()
+	s.events = append(s.events, event)
+	s.trimLocked(time.Now())
+	s.scheduleSaveLocked()
+	s.mu.Unlock()
+}
+
+// Clear removes all retained usage events and persists the empty history.
+func (s *Store) Clear() error {
+	s.mu.Lock()
+	s.events = s.events[:0]
+	s.trimLocked(time.Now())
+	s.scheduleSaveLocked()
+	s.mu.Unlock()
+	return s.Flush()
+}
+
+// ListEvents returns a copy of usage events within the requested time window, applying retention.
+func (s *Store) ListEvents(days int) []UsageEvent {
+	if days <= 0 {
+		days = 30
+	}
+	now := time.Now()
+	effectiveDays := days
+	if s.maxDays > 0 && effectiveDays > s.maxDays {
+		effectiveDays = s.maxDays
+	}
+	cutoff := now.AddDate(0, 0, -effectiveDays)
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	out := make([]UsageEvent, 0, len(s.events))
+	for _, e := range s.events {
+		if !e.Timestamp.Before(cutoff) {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
+// GetSummary returns a rollup of usage over the last N days.
+func (s *Store) GetSummary(days int) Summary {
+	if days <= 0 {
+		days = 30
+	}
+
+	now := time.Now()
+	retentionDays := s.maxDays
+	effectiveDays := days
+	truncated := false
+	if retentionDays > 0 && effectiveDays > retentionDays {
+		effectiveDays = retentionDays
+		truncated = true
+	}
+
+	cutoff := now.AddDate(0, 0, -effectiveDays)
+
+	s.mu.RLock()
+	events := make([]UsageEvent, 0, len(s.events))
+	for _, e := range s.events {
+		if !e.Timestamp.Before(cutoff) {
+			events = append(events, e)
+		}
+	}
+	s.mu.RUnlock()
+
+	type pmKey struct {
+		provider string
+		model    string
+	}
+
+	pmTotals := make(map[pmKey]*ProviderModelSummary)
+	dailyTotals := make(map[string]*DailySummary)
+
+	var totalInput, totalOutput int64
+
+	for _, e := range events {
+		provider, model := ResolveProviderAndModel(e.Provider, e.RequestModel, e.ResponseModel)
+
+		k := pmKey{provider: provider, model: model}
+		pm := pmTotals[k]
+		if pm == nil {
+			pm = &ProviderModelSummary{Provider: provider, Model: model}
+			pmTotals[k] = pm
+		}
+		pm.InputTokens += int64(e.InputTokens)
+		pm.OutputTokens += int64(e.OutputTokens)
+
+		totalInput += int64(e.InputTokens)
+		totalOutput += int64(e.OutputTokens)
+
+		usd, known, _ := EstimateUSD(provider, model, int64(e.InputTokens), int64(e.OutputTokens))
+		if known {
+			pm.EstimatedUSD += usd
+			pm.PricingKnown = true
+		}
+
+		date := e.Timestamp.Format("2006-01-02")
+		ds := dailyTotals[date]
+		if ds == nil {
+			ds = &DailySummary{Date: date}
+			dailyTotals[date] = ds
+		}
+		ds.InputTokens += int64(e.InputTokens)
+		ds.OutputTokens += int64(e.OutputTokens)
+		if known {
+			ds.EstimatedUSD += usd
+		}
+	}
+
+	providerModels := make([]ProviderModelSummary, 0, len(pmTotals))
+	for _, pm := range pmTotals {
+		pm.TotalTokens = pm.InputTokens + pm.OutputTokens
+		providerModels = append(providerModels, *pm)
+	}
+	sort.Slice(providerModels, func(i, j int) bool {
+		if providerModels[i].Provider == providerModels[j].Provider {
+			return providerModels[i].Model < providerModels[j].Model
+		}
+		return providerModels[i].Provider < providerModels[j].Provider
+	})
+
+	daily := make([]DailySummary, 0, len(dailyTotals))
+	for _, ds := range dailyTotals {
+		ds.TotalTokens = ds.InputTokens + ds.OutputTokens
+		daily = append(daily, *ds)
+	}
+	sort.Slice(daily, func(i, j int) bool {
+		return daily[i].Date < daily[j].Date
+	})
+
+	totals := ProviderModelSummary{
+		Provider:     "all",
+		InputTokens:  totalInput,
+		OutputTokens: totalOutput,
+		TotalTokens:  totalInput + totalOutput,
+	}
+
+	for _, pm := range providerModels {
+		if pm.PricingKnown {
+			totals.EstimatedUSD += pm.EstimatedUSD
+			totals.PricingKnown = true
+		}
+	}
+
+	return Summary{
+		Days:           days,
+		RetentionDays:  retentionDays,
+		EffectiveDays:  effectiveDays,
+		Truncated:      truncated,
+		PricingAsOf:    PricingAsOf(),
+		ProviderModels: providerModels,
+		UseCases:       summarizeUseCases(events),
+		Targets:        summarizeTargets(events),
+		DailyTotals:    daily,
+		Totals:         totals,
+	}
+}
+
+// Flush immediately writes any pending changes to persistence.
+func (s *Store) Flush() error {
+	s.mu.Lock()
+	if s.saveTimer != nil {
+		s.saveTimer.Stop()
+	}
+	s.savePending = false
+	events := make([]UsageEvent, len(s.events))
+	copy(events, s.events)
+	p := s.persistence
+	s.mu.Unlock()
+
+	if p != nil {
+		return p.SaveUsageHistory(events)
+	}
+	return nil
+}
+
+func (s *Store) trimLocked(now time.Time) {
+	if s.maxDays <= 0 {
+		return
+	}
+	cutoff := now.AddDate(0, 0, -s.maxDays)
+	filtered := s.events[:0]
+	for _, e := range s.events {
+		if !e.Timestamp.Before(cutoff) {
+			filtered = append(filtered, e)
+		}
+	}
+	s.events = filtered
+}
+
+func (s *Store) scheduleSaveLocked() {
+	if s.persistence == nil {
+		return
+	}
+
+	if s.saveTimer != nil {
+		s.saveTimer.Stop()
+	}
+
+	s.savePending = true
+	s.saveTimer = time.AfterFunc(s.saveDebounce, func() {
+		s.mu.Lock()
+		if !s.savePending {
+			s.mu.Unlock()
+			return
+		}
+		s.savePending = false
+		events := make([]UsageEvent, len(s.events))
+		copy(events, s.events)
+		p := s.persistence
+		s.mu.Unlock()
+
+		if p != nil {
+			if err := p.SaveUsageHistory(events); err != nil {
+				log.Error().Err(err).Msg("Failed to save AI usage history")
+			}
+		}
+	})
+}
+
+// ProviderModelSummary is a rollup for a provider/model pair.
+type ProviderModelSummary struct {
+	Provider     string  `json:"provider"`
+	Model        string  `json:"model"`
+	InputTokens  int64   `json:"input_tokens"`
+	OutputTokens int64   `json:"output_tokens"`
+	TotalTokens  int64   `json:"total_tokens"`
+	EstimatedUSD float64 `json:"estimated_usd,omitempty"`
+	PricingKnown bool    `json:"pricing_known"`
+}
+
+// DailySummary is a rollup for a single day across all providers.
+type DailySummary struct {
+	Date         string  `json:"date"`
+	InputTokens  int64   `json:"input_tokens"`
+	OutputTokens int64   `json:"output_tokens"`
+	TotalTokens  int64   `json:"total_tokens"`
+	EstimatedUSD float64 `json:"estimated_usd,omitempty"`
+}
+
+// UseCaseSummary is a rollup for a use-case (e.g. "chat", "patrol").
+type UseCaseSummary struct {
+	UseCase      string  `json:"use_case"`
+	InputTokens  int64   `json:"input_tokens"`
+	OutputTokens int64   `json:"output_tokens"`
+	TotalTokens  int64   `json:"total_tokens"`
+	EstimatedUSD float64 `json:"estimated_usd,omitempty"`
+	PricingKnown bool    `json:"pricing_known"`
+}
+
+// TargetSummary is a rollup for a Pulse target (e.g. vm/container/node).
+type TargetSummary struct {
+	TargetType   string  `json:"target_type"`
+	TargetID     string  `json:"target_id"`
+	Calls        int64   `json:"calls"`
+	InputTokens  int64   `json:"input_tokens"`
+	OutputTokens int64   `json:"output_tokens"`
+	TotalTokens  int64   `json:"total_tokens"`
+	EstimatedUSD float64 `json:"estimated_usd,omitempty"`
+	PricingKnown bool    `json:"pricing_known"`
+}
+
+// Summary is returned by the cost summary API.
+type Summary struct {
+	Days          int  `json:"days"`
+	RetentionDays int  `json:"retention_days"`
+	EffectiveDays int  `json:"effective_days"`
+	Truncated     bool `json:"truncated"`
+
+	PricingAsOf string `json:"pricing_as_of,omitempty"`
+
+	ProviderModels []ProviderModelSummary `json:"provider_models"`
+	UseCases       []UseCaseSummary       `json:"use_cases"`
+	Targets        []TargetSummary        `json:"targets"`
+	DailyTotals    []DailySummary         `json:"daily_totals"`
+	Totals         ProviderModelSummary   `json:"totals"`
+}
+
+func summarizeUseCases(events []UsageEvent) []UseCaseSummary {
+	type totals struct {
+		input  int64
+		output int64
+		usd    float64
+		known  bool
+	}
+
+	perUseCase := make(map[string]*totals)
+	for _, e := range events {
+		useCase := strings.TrimSpace(strings.ToLower(e.UseCase))
+		if useCase == "" {
+			useCase = "unknown"
+		}
+		t := perUseCase[useCase]
+		if t == nil {
+			t = &totals{}
+			perUseCase[useCase] = t
+		}
+
+		t.input += int64(e.InputTokens)
+		t.output += int64(e.OutputTokens)
+
+		provider, model := ResolveProviderAndModel(e.Provider, e.RequestModel, e.ResponseModel)
+
+		usd, known, _ := EstimateUSD(provider, model, int64(e.InputTokens), int64(e.OutputTokens))
+		if known {
+			t.usd += usd
+			t.known = true
+		}
+	}
+
+	out := make([]UseCaseSummary, 0, len(perUseCase))
+	for useCase, t := range perUseCase {
+		out = append(out, UseCaseSummary{
+			UseCase:      useCase,
+			InputTokens:  t.input,
+			OutputTokens: t.output,
+			TotalTokens:  t.input + t.output,
+			EstimatedUSD: t.usd,
+			PricingKnown: t.known,
+		})
+	}
+
+	order := map[string]int{
+		"chat":    0,
+		"patrol":  1,
+		"unknown": 2,
+	}
+	sort.Slice(out, func(i, j int) bool {
+		oi, okI := order[out[i].UseCase]
+		oj, okJ := order[out[j].UseCase]
+		if okI && okJ && oi != oj {
+			return oi < oj
+		}
+		if okI != okJ {
+			return okI
+		}
+		return out[i].UseCase < out[j].UseCase
+	})
+	return out
+}
+
+func summarizeTargets(events []UsageEvent) []TargetSummary {
+	type key struct {
+		targetType string
+		targetID   string
+	}
+	type totals struct {
+		calls  int64
+		input  int64
+		output int64
+		usd    float64
+		known  bool
+	}
+
+	perTarget := make(map[key]*totals)
+	for _, e := range events {
+		targetType := strings.TrimSpace(strings.ToLower(e.TargetType))
+		targetID := strings.TrimSpace(e.TargetID)
+		if targetType == "" || targetID == "" {
+			continue
+		}
+		k := key{targetType: targetType, targetID: targetID}
+		t := perTarget[k]
+		if t == nil {
+			t = &totals{}
+			perTarget[k] = t
+		}
+		t.calls++
+		t.input += int64(e.InputTokens)
+		t.output += int64(e.OutputTokens)
+
+		provider, model := ResolveProviderAndModel(e.Provider, e.RequestModel, e.ResponseModel)
+		usd, known, _ := EstimateUSD(provider, model, int64(e.InputTokens), int64(e.OutputTokens))
+		if known {
+			t.usd += usd
+			t.known = true
+		}
+	}
+
+	out := make([]TargetSummary, 0, len(perTarget))
+	for k, t := range perTarget {
+		out = append(out, TargetSummary{
+			TargetType:   k.targetType,
+			TargetID:     k.targetID,
+			Calls:        t.calls,
+			InputTokens:  t.input,
+			OutputTokens: t.output,
+			TotalTokens:  t.input + t.output,
+			EstimatedUSD: t.usd,
+			PricingKnown: t.known,
+		})
+	}
+
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].EstimatedUSD != out[j].EstimatedUSD {
+			return out[i].EstimatedUSD > out[j].EstimatedUSD
+		}
+		if out[i].TotalTokens != out[j].TotalTokens {
+			return out[i].TotalTokens > out[j].TotalTokens
+		}
+		if out[i].TargetType != out[j].TargetType {
+			return out[i].TargetType < out[j].TargetType
+		}
+		return out[i].TargetID < out[j].TargetID
+	})
+
+	if len(out) > 20 {
+		out = out[:20]
+	}
+	return out
+}
diff --git a/internal/ai/cost/store_test.go b/internal/ai/cost/store_test.go
new file mode 100644
index 0000000..867a4bf
--- /dev/null
+++ b/internal/ai/cost/store_test.go
@@ -0,0 +1,241 @@
+package cost
+
+import (
+	"math"
+	"testing"
+	"time"
+)
+
+func TestSummaryGroupsByProviderModelAndDailyTotals(t *testing.T) {
+	store := NewStore(90)
+	now := time.Now()
+
+	day1 := now.Add(-24 * time.Hour)
+	day2 := now.Add(-48 * time.Hour)
+
+	store.Record(UsageEvent{
+		Timestamp:    day1,
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o",
+		InputTokens:  100,
+		OutputTokens: 50,
+		UseCase:      "chat",
+	})
+	store.Record(UsageEvent{
+		Timestamp:    day1,
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o",
+		InputTokens:  10,
+		OutputTokens: 5,
+		UseCase:      "chat",
+	})
+	store.Record(UsageEvent{
+		Timestamp:    day2,
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o-mini",
+		InputTokens:  20,
+		OutputTokens: 10,
+		UseCase:      "patrol",
+	})
+	store.Record(UsageEvent{
+		Timestamp:    now,
+		Provider:     "anthropic",
+		RequestModel: "anthropic:claude-opus-4-5-20251101",
+		InputTokens:  200,
+		OutputTokens: 100,
+		UseCase:      "chat",
+	})
+
+	summary := store.GetSummary(3)
+
+	if len(summary.ProviderModels) != 3 {
+		t.Fatalf("expected 3 provider models, got %d", len(summary.ProviderModels))
+	}
+
+	type key struct{ provider, model string }
+	got := make(map[key]ProviderModelSummary)
+	for _, pm := range summary.ProviderModels {
+		got[key{pm.Provider, pm.Model}] = pm
+	}
+
+	openaiGpt4o := got[key{"openai", "gpt-4o"}]
+	if openaiGpt4o.InputTokens != 110 || openaiGpt4o.OutputTokens != 55 {
+		t.Fatalf("openai gpt-4o tokens wrong: %+v", openaiGpt4o)
+	}
+	if !openaiGpt4o.PricingKnown || openaiGpt4o.EstimatedUSD <= 0 {
+		t.Fatalf("expected openai gpt-4o pricing to be known with positive USD, got %+v", openaiGpt4o)
+	}
+
+	openaiMini := got[key{"openai", "gpt-4o-mini"}]
+	if openaiMini.InputTokens != 20 || openaiMini.OutputTokens != 10 {
+		t.Fatalf("openai gpt-4o-mini tokens wrong: %+v", openaiMini)
+	}
+
+	anthropicOpus := got[key{"anthropic", "claude-opus-4-5-20251101"}]
+	if anthropicOpus.InputTokens != 200 || anthropicOpus.OutputTokens != 100 {
+		t.Fatalf("anthropic opus tokens wrong: %+v", anthropicOpus)
+	}
+	if !anthropicOpus.PricingKnown || anthropicOpus.EstimatedUSD <= 0 {
+		t.Fatalf("expected anthropic opus pricing to be known with positive USD, got %+v", anthropicOpus)
+	}
+
+	// Daily totals across all providers.
+	dailyGot := make(map[string]DailySummary)
+	for _, d := range summary.DailyTotals {
+		dailyGot[d.Date] = d
+	}
+
+	d1Key := day1.Format("2006-01-02")
+	if dailyGot[d1Key].InputTokens != 110 || dailyGot[d1Key].OutputTokens != 55 {
+		t.Fatalf("daily totals for %s wrong: %+v", d1Key, dailyGot[d1Key])
+	}
+
+	d2Key := day2.Format("2006-01-02")
+	if dailyGot[d2Key].InputTokens != 20 || dailyGot[d2Key].OutputTokens != 10 {
+		t.Fatalf("daily totals for %s wrong: %+v", d2Key, dailyGot[d2Key])
+	}
+
+	todayKey := now.Format("2006-01-02")
+	if dailyGot[todayKey].InputTokens != 200 || dailyGot[todayKey].OutputTokens != 100 {
+		t.Fatalf("daily totals for %s wrong: %+v", todayKey, dailyGot[todayKey])
+	}
+
+	// Use-case rollups.
+	useCases := make(map[string]UseCaseSummary)
+	for _, uc := range summary.UseCases {
+		useCases[uc.UseCase] = uc
+	}
+	if useCases["chat"].TotalTokens != (110 + 55 + 200 + 100) {
+		t.Fatalf("chat use-case totals wrong: %+v", useCases["chat"])
+	}
+	if useCases["patrol"].TotalTokens != (20 + 10) {
+		t.Fatalf("patrol use-case totals wrong: %+v", useCases["patrol"])
+	}
+
+	// Target rollups should be empty for these events (no targets set).
+	if len(summary.Targets) != 0 {
+		t.Fatalf("expected no target rollups, got %+v", summary.Targets)
+	}
+}
+
+func TestRetentionTrimsOldEvents(t *testing.T) {
+	store := NewStore(1)
+	old := time.Now().Add(-48 * time.Hour)
+
+	store.Record(UsageEvent{
+		Timestamp:    old,
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o",
+		InputTokens:  10,
+		OutputTokens: 10,
+	})
+
+	summary := store.GetSummary(7)
+	if len(summary.ProviderModels) != 0 {
+		t.Fatalf("expected old event to be trimmed, got %+v", summary.ProviderModels)
+	}
+}
+
+func TestSummaryTruncationReflectsRetentionWindow(t *testing.T) {
+	store := NewStore(30)
+	now := time.Now()
+
+	store.Record(UsageEvent{
+		Timestamp:    now.Add(-10 * 24 * time.Hour),
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o",
+		InputTokens:  10,
+		OutputTokens: 10,
+		UseCase:      "chat",
+	})
+
+	summary := store.GetSummary(365)
+	if !summary.Truncated {
+		t.Fatalf("expected summary to be truncated when requesting beyond retention")
+	}
+	if summary.RetentionDays != 30 || summary.EffectiveDays != 30 {
+		t.Fatalf("unexpected retention/effective days: %+v", summary)
+	}
+}
+
+func TestClearEmptiesUsageHistory(t *testing.T) {
+	store := NewStore(30)
+	store.Record(UsageEvent{
+		Timestamp:    time.Now(),
+		Provider:     "openai",
+		RequestModel: "openai:gpt-4o",
+		InputTokens:  10,
+		OutputTokens: 10,
+		UseCase:      "chat",
+	})
+	if len(store.GetSummary(30).ProviderModels) == 0 {
+		t.Fatalf("expected usage to be recorded before clear")
+	}
+	if err := store.Clear(); err != nil {
+		t.Fatalf("clear failed: %v", err)
+	}
+	if got := store.GetSummary(30); len(got.ProviderModels) != 0 || got.Totals.TotalTokens != 0 {
+		t.Fatalf("expected empty summary after clear, got %+v", got)
+	}
+}
+
+func TestEstimateUSDKnownAndUnknownModels(t *testing.T) {
+	usd, ok, _ := EstimateUSD("openai", "gpt-4o", 1_000_000, 2_000_000)
+	if !ok {
+		t.Fatalf("expected pricing to be known for gpt-4o")
+	}
+	expected := 35.0 // 1M input * $5 + 2M output * $15
+	if math.Abs(usd-expected) > 0.0001 {
+		t.Fatalf("expected usd %.4f, got %.4f", expected, usd)
+	}
+
+	usd, ok, _ = EstimateUSD("deepseek", "deepseek-reasoner", 1_000_000, 1_000_000)
+	if !ok {
+		t.Fatalf("expected deepseek pricing to be known for deepseek-reasoner")
+	}
+	expected = 0.70 // 1M input * $0.28 + 1M output * $0.42
+	if math.Abs(usd-expected) > 0.0001 {
+		t.Fatalf("expected usd %.4f, got %.4f", expected, usd)
+	}
+}
+
+func TestSummaryTargetsRollup(t *testing.T) {
+	store := NewStore(30)
+	now := time.Now()
+
+	store.Record(UsageEvent{
+		Timestamp:    now,
+		Provider:     "deepseek",
+		RequestModel: "deepseek:deepseek-chat",
+		InputTokens:  1000,
+		OutputTokens: 100,
+		UseCase:      "chat",
+		TargetType:   "vm",
+		TargetID:     "101",
+	})
+	store.Record(UsageEvent{
+		Timestamp:    now,
+		Provider:     "deepseek",
+		RequestModel: "deepseek:deepseek-chat",
+		InputTokens:  2000,
+		OutputTokens: 200,
+		UseCase:      "chat",
+		TargetType:   "vm",
+		TargetID:     "101",
+	})
+
+	summary := store.GetSummary(7)
+	if len(summary.Targets) != 1 {
+		t.Fatalf("expected 1 target summary, got %d", len(summary.Targets))
+	}
+	got := summary.Targets[0]
+	if got.TargetType != "vm" || got.TargetID != "101" || got.Calls != 2 {
+		t.Fatalf("unexpected target summary: %+v", got)
+	}
+	if got.TotalTokens != 3300 {
+		t.Fatalf("unexpected target token totals: %+v", got)
+	}
+	if !got.PricingKnown || got.EstimatedUSD <= 0 {
+		t.Fatalf("expected pricing known with positive USD: %+v", got)
+	}
+}
diff --git a/internal/ai/cost_persistence.go b/internal/ai/cost_persistence.go
new file mode 100644
index 0000000..ff36b95
--- /dev/null
+++ b/internal/ai/cost_persistence.go
@@ -0,0 +1,61 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/cost"
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+)
+
+// CostPersistenceAdapter bridges ConfigPersistence to cost.Persistence.
+type CostPersistenceAdapter struct {
+	config *config.ConfigPersistence
+}
+
+// NewCostPersistenceAdapter creates a new adapter.
+func NewCostPersistenceAdapter(cfg *config.ConfigPersistence) *CostPersistenceAdapter {
+	return &CostPersistenceAdapter{config: cfg}
+}
+
+// SaveUsageHistory saves usage events to disk via ConfigPersistence.
+func (a *CostPersistenceAdapter) SaveUsageHistory(events []cost.UsageEvent) error {
+	records := make([]config.AIUsageEventRecord, len(events))
+	for i, e := range events {
+		records[i] = config.AIUsageEventRecord{
+			Timestamp:     e.Timestamp,
+			Provider:      e.Provider,
+			RequestModel:  e.RequestModel,
+			ResponseModel: e.ResponseModel,
+			UseCase:       e.UseCase,
+			InputTokens:   e.InputTokens,
+			OutputTokens:  e.OutputTokens,
+			TargetType:    e.TargetType,
+			TargetID:      e.TargetID,
+			FindingID:     e.FindingID,
+		}
+	}
+	return a.config.SaveAIUsageHistory(records)
+}
+
+// LoadUsageHistory loads usage events from disk via ConfigPersistence.
+func (a *CostPersistenceAdapter) LoadUsageHistory() ([]cost.UsageEvent, error) {
+	data, err := a.config.LoadAIUsageHistory()
+	if err != nil {
+		return nil, err
+	}
+
+	events := make([]cost.UsageEvent, len(data.Events))
+	for i, r := range data.Events {
+		events[i] = cost.UsageEvent{
+			Timestamp:     r.Timestamp,
+			Provider:      r.Provider,
+			RequestModel:  r.RequestModel,
+			ResponseModel: r.ResponseModel,
+			UseCase:       r.UseCase,
+			InputTokens:   r.InputTokens,
+			OutputTokens:  r.OutputTokens,
+			TargetType:    r.TargetType,
+			TargetID:      r.TargetID,
+			FindingID:     r.FindingID,
+		}
+	}
+	return events, nil
+}
diff --git a/internal/ai/findings.go b/internal/ai/findings.go
new file mode 100644
index 0000000..7c95767
--- /dev/null
+++ b/internal/ai/findings.go
@@ -0,0 +1,807 @@
+// Package ai provides AI-powered infrastructure monitoring and investigation.
+package ai
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+)
+
+// FindingSeverity represents how urgent a finding is
+type FindingSeverity string
+
+const (
+	// FindingSeverityInfo is informational - user may want to know
+	FindingSeverityInfo FindingSeverity = "info"
+	// FindingSeverityWatch means something to keep an eye on
+	FindingSeverityWatch FindingSeverity = "watch"
+	// FindingSeverityWarning means action should be taken soon
+	FindingSeverityWarning FindingSeverity = "warning"
+	// FindingSeverityCritical means immediate action needed
+	FindingSeverityCritical FindingSeverity = "critical"
+)
+
+// FindingCategory groups findings by type
+type FindingCategory string
+
+const (
+	FindingCategoryPerformance FindingCategory = "performance"
+	FindingCategoryCapacity    FindingCategory = "capacity"
+	FindingCategoryReliability FindingCategory = "reliability"
+	FindingCategoryBackup      FindingCategory = "backup"
+	FindingCategorySecurity    FindingCategory = "security"
+	FindingCategoryGeneral     FindingCategory = "general"
+)
+
+// Finding represents an AI-discovered insight about infrastructure
+type Finding struct {
+	ID             string          `json:"id"`
+	Severity       FindingSeverity `json:"severity"`
+	Category       FindingCategory `json:"category"`
+	ResourceID     string          `json:"resource_id"`
+	ResourceName   string          `json:"resource_name"`
+	ResourceType   string          `json:"resource_type"` // node, vm, container, docker, storage, host, pbs, host_raid
+	Node           string          `json:"node,omitempty"`
+	Title          string          `json:"title"`
+	Description    string          `json:"description"`
+	Recommendation string          `json:"recommendation,omitempty"`
+	Evidence       string          `json:"evidence,omitempty"` // data/commands that led to this finding
+	Source         string          `json:"source,omitempty"`   // "ai-analysis" for LLM findings, empty for rule-based
+	DetectedAt     time.Time       `json:"detected_at"`
+	LastSeenAt     time.Time       `json:"last_seen_at"`
+	ResolvedAt     *time.Time      `json:"resolved_at,omitempty"`
+	AutoResolved   bool            `json:"auto_resolved"`
+	AcknowledgedAt *time.Time      `json:"acknowledged_at,omitempty"`
+	SnoozedUntil   *time.Time      `json:"snoozed_until,omitempty"` // Finding hidden until this time
+	// Link to alert if this finding was triggered by or attached to an alert
+	AlertID string `json:"alert_id,omitempty"`
+
+	// User feedback fields - enables LLM "memory" by tracking how users respond
+	// This helps prevent the LLM from repeatedly raising the same dismissed issues
+	DismissedReason string `json:"dismissed_reason,omitempty"` // "not_an_issue", "expected_behavior", "will_fix_later"
+	UserNote        string `json:"user_note,omitempty"`        // Freeform user explanation, included in LLM context
+	TimesRaised     int    `json:"times_raised"`               // How many times this finding has been detected
+	Suppressed      bool   `json:"suppressed"`                 // Permanently suppress similar findings for this resource
+}
+
+// IsActive returns true if the finding is still active (not resolved, not snoozed, not suppressed)
+func (f *Finding) IsActive() bool {
+	return f.ResolvedAt == nil && !f.IsSnoozed() && !f.Suppressed
+}
+
+// IsDismissed returns true if the user has dismissed this finding with a reason
+func (f *Finding) IsDismissed() bool {
+	return f.DismissedReason != ""
+}
+
+// IsSnoozed returns true if the finding is currently snoozed
+func (f *Finding) IsSnoozed() bool {
+	return f.SnoozedUntil != nil && time.Now().Before(*f.SnoozedUntil)
+}
+
+// IsResolved returns true if the finding has been resolved (ignores snooze)
+func (f *Finding) IsResolved() bool {
+	return f.ResolvedAt != nil
+}
+
+// SuppressionRule represents a user-defined rule to suppress certain AI findings
+// Users can create these manually to prevent alerts before they happen
+type SuppressionRule struct {
+	ID           string          `json:"id"`
+	ResourceID   string          `json:"resource_id,omitempty"`   // Empty means "any resource"
+	ResourceName string          `json:"resource_name,omitempty"` // Human-readable name for display
+	Category     FindingCategory `json:"category,omitempty"`      // Empty means "any category"
+	Description  string          `json:"description"`             // User's reason, e.g., "dev VM runs hot"
+	CreatedAt    time.Time       `json:"created_at"`
+	CreatedFrom  string          `json:"created_from,omitempty"` // "finding" if created from a dismissed finding, "manual" if user-created
+	FindingID    string          `json:"finding_id,omitempty"`   // Original finding ID if created from dismissal
+}
+
+// FindingsPersistence interface for saving/loading findings (avoids circular imports)
+type FindingsPersistence interface {
+	SaveFindings(findings map[string]*Finding) error
+	LoadFindings() (map[string]*Finding, error)
+}
+
+// FindingsStore provides thread-safe storage for AI findings with optional persistence
+type FindingsStore struct {
+	mu       sync.RWMutex
+	findings map[string]*Finding // keyed by ID
+	// Index by resource for quick lookups
+	byResource map[string][]string // resource_id -> []finding_id
+	// Keep track of active findings count by severity (cached, but GetSummary calculates dynamically)
+	activeCounts map[FindingSeverity]int
+	// User-defined suppression rules (separate from dismissed findings)
+	suppressionRules map[string]*SuppressionRule
+	// Persistence layer (optional)
+	persistence FindingsPersistence
+	// Debounce save operations
+	saveTimer    *time.Timer
+	savePending  bool
+	saveDebounce time.Duration
+}
+
+// NewFindingsStore creates a new findings store
+func NewFindingsStore() *FindingsStore {
+	return &FindingsStore{
+		findings:         make(map[string]*Finding),
+		byResource:       make(map[string][]string),
+		activeCounts:     make(map[FindingSeverity]int),
+		suppressionRules: make(map[string]*SuppressionRule),
+		saveDebounce:     5 * time.Second, // Debounce saves by 5 seconds
+	}
+}
+
+// SetPersistence sets the persistence layer and loads existing findings
+func (s *FindingsStore) SetPersistence(p FindingsPersistence) error {
+	s.mu.Lock()
+	s.persistence = p
+	s.mu.Unlock()
+
+	// Load existing findings from disk
+	if p != nil {
+		findings, err := p.LoadFindings()
+		if err != nil {
+			return err
+		}
+		if len(findings) > 0 {
+			s.mu.Lock()
+			for id, f := range findings {
+				s.findings[id] = f
+				s.byResource[f.ResourceID] = append(s.byResource[f.ResourceID], id)
+				if f.IsActive() {
+					s.activeCounts[f.Severity]++
+				}
+			}
+			s.mu.Unlock()
+		}
+	}
+	return nil
+}
+
+// scheduleSave schedules a debounced save operation
+func (s *FindingsStore) scheduleSave() {
+	if s.persistence == nil {
+		return
+	}
+
+	// Already have a save pending
+	if s.savePending {
+		return
+	}
+
+	s.savePending = true
+	s.saveTimer = time.AfterFunc(s.saveDebounce, func() {
+		s.mu.Lock()
+		s.savePending = false
+		// Make a copy for saving
+		findingsCopy := make(map[string]*Finding, len(s.findings))
+		for id, f := range s.findings {
+			copy := *f
+			findingsCopy[id] = &copy
+		}
+		persistence := s.persistence
+		s.mu.Unlock()
+
+		if persistence != nil {
+			if err := persistence.SaveFindings(findingsCopy); err != nil {
+				// Log error but don't fail - persistence is best-effort
+				// (log import would create circular dep, so we silently fail)
+			}
+		}
+	})
+}
+
+// ForceSave immediately saves findings (useful for shutdown)
+func (s *FindingsStore) ForceSave() error {
+	s.mu.Lock()
+	if s.saveTimer != nil {
+		s.saveTimer.Stop()
+	}
+	s.savePending = false
+	
+	findingsCopy := make(map[string]*Finding, len(s.findings))
+	for id, f := range s.findings {
+		copy := *f
+		findingsCopy[id] = &copy
+	}
+	persistence := s.persistence
+	s.mu.Unlock()
+
+	if persistence != nil {
+		return persistence.SaveFindings(findingsCopy)
+	}
+	return nil
+}
+
+// Add adds or updates a finding
+// If a finding with the same ID exists, it updates LastSeenAt and increments TimesRaised
+// If the finding is suppressed or dismissed, it may be skipped
+// Returns true if this is a new finding
+func (s *FindingsStore) Add(f *Finding) bool {
+	s.mu.Lock()
+
+	existing, exists := s.findings[f.ID]
+	if exists {
+		// Check if it's permanently suppressed - don't update at all
+		if existing.Suppressed {
+			s.mu.Unlock()
+			return false
+		}
+		
+		// Check if dismissed - only update if severity has escalated
+		if existing.DismissedReason != "" {
+			severityOrder := map[FindingSeverity]int{
+				FindingSeverityInfo:     0,
+				FindingSeverityWatch:    1,
+				FindingSeverityWarning:  2,
+				FindingSeverityCritical: 3,
+			}
+			// If new severity is same or lower, don't reactivate
+			if severityOrder[f.Severity] <= severityOrder[existing.Severity] {
+				existing.LastSeenAt = time.Now()
+				existing.TimesRaised++
+				s.mu.Unlock()
+				s.scheduleSave()
+				return false
+			}
+			// Severity escalated - clear dismissal and reactivate
+			existing.DismissedReason = ""
+			existing.UserNote = "" // Clear note since situation changed
+			existing.AcknowledgedAt = nil
+		}
+		
+		// Update existing finding
+		existing.LastSeenAt = time.Now()
+		existing.Description = f.Description
+		existing.Recommendation = f.Recommendation
+		existing.Evidence = f.Evidence
+		existing.Title = f.Title // Update title in case LLM phrased it better
+		existing.Severity = f.Severity
+		existing.TimesRaised++ // Track recurrence
+		s.mu.Unlock()
+		s.scheduleSave()
+		return false
+	}
+
+	// New finding - check if resource+category is suppressed
+	if s.isSuppressedInternal(f.ResourceID, f.Category) {
+		s.mu.Unlock()
+		return false
+	}
+
+	// New finding
+	if f.DetectedAt.IsZero() {
+		f.DetectedAt = time.Now()
+	}
+	f.LastSeenAt = time.Now()
+
+	s.findings[f.ID] = f
+	s.byResource[f.ResourceID] = append(s.byResource[f.ResourceID], f.ID)
+	if f.IsActive() {
+		s.activeCounts[f.Severity]++
+	}
+	s.mu.Unlock()
+	s.scheduleSave()
+
+	return true
+}
+
+// Resolve marks a finding as resolved
+func (s *FindingsStore) Resolve(id string, auto bool) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists || !f.IsActive() {
+		s.mu.Unlock()
+		return false
+	}
+
+	now := time.Now()
+	f.ResolvedAt = &now
+	f.AutoResolved = auto
+	s.activeCounts[f.Severity]--
+	s.mu.Unlock()
+	s.scheduleSave()
+
+	return true
+}
+
+// Acknowledge marks a finding as acknowledged
+func (s *FindingsStore) Acknowledge(id string) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists {
+		s.mu.Unlock()
+		return false
+	}
+
+	now := time.Now()
+	f.AcknowledgedAt = &now
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// Snooze hides a finding for the specified duration
+// Common durations: 1h, 24h, 7d (168h)
+func (s *FindingsStore) Snooze(id string, duration time.Duration) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists || f.IsResolved() {
+		s.mu.Unlock()
+		return false
+	}
+
+	// If was previously active (not snoozed), decrement count
+	if f.SnoozedUntil == nil || time.Now().After(*f.SnoozedUntil) {
+		s.activeCounts[f.Severity]--
+	}
+
+	until := time.Now().Add(duration)
+	f.SnoozedUntil = &until
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// Unsnooze removes the snooze from a finding, making it active again
+func (s *FindingsStore) Unsnooze(id string) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists || f.IsResolved() {
+		s.mu.Unlock()
+		return false
+	}
+
+	if f.SnoozedUntil != nil {
+		f.SnoozedUntil = nil
+		s.activeCounts[f.Severity]++
+	}
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// Dismiss marks a finding as dismissed with a reason and optional note
+// Reasons: "not_an_issue", "expected_behavior", "will_fix_later"
+func (s *FindingsStore) Dismiss(id, reason, note string) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists {
+		s.mu.Unlock()
+		return false
+	}
+
+	f.DismissedReason = reason
+	if note != "" {
+		f.UserNote = note
+	}
+	// Also mark as acknowledged
+	now := time.Now()
+	f.AcknowledgedAt = &now
+
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// SetUserNote updates the user note on a finding
+func (s *FindingsStore) SetUserNote(id, note string) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists {
+		s.mu.Unlock()
+		return false
+	}
+
+	f.UserNote = note
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// Suppress marks a finding type as permanently suppressed for a resource
+// Future findings with the same resource+category will be auto-dismissed
+func (s *FindingsStore) Suppress(id string) bool {
+	s.mu.Lock()
+
+	f, exists := s.findings[id]
+	if !exists {
+		s.mu.Unlock()
+		return false
+	}
+
+	f.Suppressed = true
+	f.DismissedReason = "suppressed"
+	now := time.Now()
+	f.AcknowledgedAt = &now
+
+	s.mu.Unlock()
+	s.scheduleSave()
+	return true
+}
+
+// IsSuppressed checks if findings of this type for this resource are suppressed
+// Checks by resource+category only (not title, since LLM titles vary)
+func (s *FindingsStore) IsSuppressed(resourceID string, category FindingCategory) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.isSuppressedInternal(resourceID, category)
+}
+
+// isSuppressedInternal checks suppression without locking (caller must hold lock)
+func (s *FindingsStore) isSuppressedInternal(resourceID string, category FindingCategory) bool {
+	// Check if any finding for this resource+category is suppressed
+	ids := s.byResource[resourceID]
+	for _, id := range ids {
+		if f, exists := s.findings[id]; exists {
+			// Match by resource+category only
+			if f.Suppressed && f.Category == category {
+				return true
+			}
+		}
+	}
+	
+	// Also check manual suppression rules
+	for _, rule := range s.suppressionRules {
+		resourceMatches := rule.ResourceID == "" || rule.ResourceID == resourceID
+		categoryMatches := rule.Category == "" || rule.Category == category
+		if resourceMatches && categoryMatches {
+			return true
+		}
+	}
+	
+	return false
+}
+
+// Get returns a finding by ID
+func (s *FindingsStore) Get(id string) *Finding {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if f, exists := s.findings[id]; exists {
+		// Return a copy to prevent mutations
+		copy := *f
+		return &copy
+	}
+	return nil
+}
+
+// GetByResource returns all active findings for a resource
+func (s *FindingsStore) GetByResource(resourceID string) []*Finding {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	ids := s.byResource[resourceID]
+	result := make([]*Finding, 0, len(ids))
+	for _, id := range ids {
+		if f, exists := s.findings[id]; exists && f.IsActive() {
+			copy := *f
+			result = append(result, &copy)
+		}
+	}
+	return result
+}
+
+// GetActive returns all active findings, optionally filtered by severity
+func (s *FindingsStore) GetActive(minSeverity FindingSeverity) []*Finding {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	severityOrder := map[FindingSeverity]int{
+		FindingSeverityInfo:     0,
+		FindingSeverityWatch:    1,
+		FindingSeverityWarning:  2,
+		FindingSeverityCritical: 3,
+	}
+	minOrder := severityOrder[minSeverity]
+
+	result := make([]*Finding, 0)
+	for _, f := range s.findings {
+		if f.IsActive() && severityOrder[f.Severity] >= minOrder {
+			copy := *f
+			result = append(result, &copy)
+		}
+	}
+	return result
+}
+
+// GetSummary returns a summary of active findings
+// Note: This calculates counts dynamically to handle time-based snooze expiration
+func (s *FindingsStore) GetSummary() FindingsSummary {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	summary := FindingsSummary{
+		Total: len(s.findings),
+	}
+
+	// Calculate active counts dynamically since IsActive() checks time-based snooze
+	for _, f := range s.findings {
+		if f.IsActive() {
+			switch f.Severity {
+			case FindingSeverityCritical:
+				summary.Critical++
+			case FindingSeverityWarning:
+				summary.Warning++
+			case FindingSeverityWatch:
+				summary.Watch++
+			case FindingSeverityInfo:
+				summary.Info++
+			}
+		}
+	}
+
+	return summary
+}
+
+// GetAll returns all findings including resolved ones (for history)
+// Results can be filtered by time range using startTime parameter
+func (s *FindingsStore) GetAll(startTime *time.Time) []*Finding {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	result := make([]*Finding, 0, len(s.findings))
+	for _, f := range s.findings {
+		// If startTime specified, only include findings detected after it
+		if startTime != nil && f.DetectedAt.Before(*startTime) {
+			continue
+		}
+		copy := *f
+		result = append(result, &copy)
+	}
+	return result
+}
+
+// Cleanup removes old resolved findings
+func (s *FindingsStore) Cleanup(maxAge time.Duration) int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	cutoff := time.Now().Add(-maxAge)
+	removed := 0
+
+	for id, f := range s.findings {
+		if f.ResolvedAt != nil && f.ResolvedAt.Before(cutoff) {
+			delete(s.findings, id)
+			// Clean up resource index
+			ids := s.byResource[f.ResourceID]
+			for i, fid := range ids {
+				if fid == id {
+					s.byResource[f.ResourceID] = append(ids[:i], ids[i+1:]...)
+					break
+				}
+			}
+			removed++
+		}
+	}
+
+	return removed
+}
+
+// GetDismissedForContext returns findings that the user has dismissed/acknowledged, 
+// formatted for injection into LLM prompts. This is the core of the "memory" system -
+// it tells the LLM what not to re-raise.
+func (s *FindingsStore) GetDismissedForContext() string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var suppressed, dismissed, snoozed []string
+	
+	for _, f := range s.findings {
+		// Skip very old findings (more than 30 days)
+		if time.Since(f.LastSeenAt) > 30*24*time.Hour {
+			continue
+		}
+		
+		// Collect suppressed findings
+		if f.Suppressed {
+			note := ""
+			if f.UserNote != "" {
+				note = " - User note: " + f.UserNote
+			}
+			suppressed = append(suppressed, 
+				fmt.Sprintf("- %s on %s: %s%s", f.Title, f.ResourceName, f.DismissedReason, note))
+			continue
+		}
+		
+		// Collect dismissed/acknowledged findings
+		if f.DismissedReason != "" {
+			note := ""
+			if f.UserNote != "" {
+				note = " - User note: " + f.UserNote
+			}
+			dismissed = append(dismissed, 
+				fmt.Sprintf("- %s on %s (%s)%s", f.Title, f.ResourceName, f.DismissedReason, note))
+			continue
+		}
+		
+		// Collect snoozed findings  
+		if f.IsSnoozed() {
+			snoozed = append(snoozed, 
+				fmt.Sprintf("- %s on %s (snoozed until %s)", 
+					f.Title, f.ResourceName, f.SnoozedUntil.Format("Jan 2")))
+		}
+	}
+	
+	if len(suppressed) == 0 && len(dismissed) == 0 && len(snoozed) == 0 {
+		return ""
+	}
+	
+	var result strings.Builder
+	result.WriteString("\n## Previous Findings - User Feedback\n")
+	result.WriteString("The following findings have been addressed by the user. Do NOT re-raise these unless the situation has significantly worsened:\n\n")
+	
+	if len(suppressed) > 0 {
+		result.WriteString("### Permanently Suppressed (never re-raise):\n")
+		for _, s := range suppressed {
+			result.WriteString(s + "\n")
+		}
+		result.WriteString("\n")
+	}
+	
+	if len(dismissed) > 0 {
+		result.WriteString("### Dismissed by User:\n")
+		for _, d := range dismissed {
+			result.WriteString(d + "\n")
+		}
+		result.WriteString("\n")
+	}
+	
+	if len(snoozed) > 0 {
+		result.WriteString("### Temporarily Snoozed:\n")
+		for _, s := range snoozed {
+			result.WriteString(s + "\n")
+		}
+	}
+	
+	return result.String()
+}
+
+// FindingsSummary provides a quick count of findings by severity
+type FindingsSummary struct {
+	Critical int `json:"critical"`
+	Warning  int `json:"warning"`
+	Watch    int `json:"watch"`
+	Info     int `json:"info"`
+	Total    int `json:"total"`
+}
+
+// HasIssues returns true if there are any warning or critical findings
+func (s FindingsSummary) HasIssues() bool {
+	return s.Critical > 0 || s.Warning > 0
+}
+
+// IsHealthy returns true if there are no watch, warning, or critical findings
+func (s FindingsSummary) IsHealthy() bool {
+	return s.Critical == 0 && s.Warning == 0 && s.Watch == 0
+}
+
+// --- Suppression Rule Management ---
+
+// AddSuppressionRule creates a new user-defined suppression rule
+func (s *FindingsStore) AddSuppressionRule(resourceID, resourceName string, category FindingCategory, description string) *SuppressionRule {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Generate ID based on resource+category
+	ruleID := fmt.Sprintf("rule_%s_%s_%d", resourceID, category, time.Now().UnixNano())
+	if resourceID == "" {
+		ruleID = fmt.Sprintf("rule_any_%s_%d", category, time.Now().UnixNano())
+	}
+	if category == "" {
+		ruleID = fmt.Sprintf("rule_%s_any_%d", resourceID, time.Now().UnixNano())
+	}
+
+	rule := &SuppressionRule{
+		ID:           ruleID,
+		ResourceID:   resourceID,
+		ResourceName: resourceName,
+		Category:     category,
+		Description:  description,
+		CreatedAt:    time.Now(),
+		CreatedFrom:  "manual",
+	}
+
+	s.suppressionRules[ruleID] = rule
+	s.scheduleSave()
+	return rule
+}
+
+// GetSuppressionRules returns all suppression rules (both manual and from dismissed findings)
+func (s *FindingsStore) GetSuppressionRules() []*SuppressionRule {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var rules []*SuppressionRule
+
+	// Add explicit suppression rules
+	for _, rule := range s.suppressionRules {
+		rules = append(rules, rule)
+	}
+
+	// Also include suppressed findings as rules (for visibility)
+	for _, f := range s.findings {
+		if f.Suppressed {
+			rules = append(rules, &SuppressionRule{
+				ID:           "finding_" + f.ID,
+				ResourceID:   f.ResourceID,
+				ResourceName: f.ResourceName,
+				Category:     f.Category,
+				Description:  f.UserNote,
+				CreatedAt:    *f.AcknowledgedAt,
+				CreatedFrom:  "finding",
+				FindingID:    f.ID,
+			})
+		}
+	}
+
+	return rules
+}
+
+// DeleteSuppressionRule removes a suppression rule
+func (s *FindingsStore) DeleteSuppressionRule(ruleID string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Check if it's an explicit rule
+	if _, exists := s.suppressionRules[ruleID]; exists {
+		delete(s.suppressionRules, ruleID)
+		s.scheduleSave()
+		return true
+	}
+
+	// Check if it's a finding-based rule (e.g., "finding_abc123")
+	if strings.HasPrefix(ruleID, "finding_") {
+		findingID := strings.TrimPrefix(ruleID, "finding_")
+		if f, exists := s.findings[findingID]; exists && f.Suppressed {
+			// Un-suppress the finding
+			f.Suppressed = false
+			f.DismissedReason = ""
+			s.scheduleSave()
+			return true
+		}
+	}
+
+	return false
+}
+
+// GetDismissedFindings returns all findings that have been dismissed or suppressed
+func (s *FindingsStore) GetDismissedFindings() []*Finding {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var dismissed []*Finding
+	for _, f := range s.findings {
+		if f.DismissedReason != "" || f.Suppressed {
+			copy := *f
+			dismissed = append(dismissed, &copy)
+		}
+	}
+	return dismissed
+}
+
+// MatchesSuppressionRule checks if a finding matches any suppression rule
+func (s *FindingsStore) MatchesSuppressionRule(resourceID string, category FindingCategory) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	for _, rule := range s.suppressionRules {
+		// Check if resource matches (or rule is for "any resource")
+		resourceMatches := rule.ResourceID == "" || rule.ResourceID == resourceID
+		// Check if category matches (or rule is for "any category")
+		categoryMatches := rule.Category == "" || rule.Category == category
+
+		if resourceMatches && categoryMatches {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/ai/findings_persistence.go b/internal/ai/findings_persistence.go
new file mode 100644
index 0000000..92f9712
--- /dev/null
+++ b/internal/ai/findings_persistence.go
@@ -0,0 +1,79 @@
+// Package ai provides AI-powered infrastructure monitoring and investigation.
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+)
+
+// FindingsPersistenceAdapter bridges ConfigPersistence to FindingsPersistence interface
+type FindingsPersistenceAdapter struct {
+	config *config.ConfigPersistence
+}
+
+// NewFindingsPersistenceAdapter creates a new adapter
+func NewFindingsPersistenceAdapter(cfg *config.ConfigPersistence) *FindingsPersistenceAdapter {
+	return &FindingsPersistenceAdapter{config: cfg}
+}
+
+// SaveFindings saves findings to disk via ConfigPersistence
+func (a *FindingsPersistenceAdapter) SaveFindings(findings map[string]*Finding) error {
+	// Convert from Finding to AIFindingRecord
+	records := make(map[string]*config.AIFindingRecord, len(findings))
+	for id, f := range findings {
+		records[id] = &config.AIFindingRecord{
+			ID:             f.ID,
+			Severity:       string(f.Severity),
+			Category:       string(f.Category),
+			ResourceID:     f.ResourceID,
+			ResourceName:   f.ResourceName,
+			ResourceType:   f.ResourceType,
+			Node:           f.Node,
+			Title:          f.Title,
+			Description:    f.Description,
+			Recommendation: f.Recommendation,
+			Evidence:       f.Evidence,
+			DetectedAt:     f.DetectedAt,
+			LastSeenAt:     f.LastSeenAt,
+			ResolvedAt:     f.ResolvedAt,
+			AutoResolved:   f.AutoResolved,
+			AcknowledgedAt: f.AcknowledgedAt,
+			SnoozedUntil:   f.SnoozedUntil,
+			AlertID:        f.AlertID,
+		}
+	}
+	return a.config.SaveAIFindings(records)
+}
+
+// LoadFindings loads findings from disk via ConfigPersistence
+func (a *FindingsPersistenceAdapter) LoadFindings() (map[string]*Finding, error) {
+	data, err := a.config.LoadAIFindings()
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert from AIFindingRecord to Finding
+	findings := make(map[string]*Finding, len(data.Findings))
+	for id, r := range data.Findings {
+		findings[id] = &Finding{
+			ID:             r.ID,
+			Severity:       FindingSeverity(r.Severity),
+			Category:       FindingCategory(r.Category),
+			ResourceID:     r.ResourceID,
+			ResourceName:   r.ResourceName,
+			ResourceType:   r.ResourceType,
+			Node:           r.Node,
+			Title:          r.Title,
+			Description:    r.Description,
+			Recommendation: r.Recommendation,
+			Evidence:       r.Evidence,
+			DetectedAt:     r.DetectedAt,
+			LastSeenAt:     r.LastSeenAt,
+			ResolvedAt:     r.ResolvedAt,
+			AutoResolved:   r.AutoResolved,
+			AcknowledgedAt: r.AcknowledgedAt,
+			SnoozedUntil:   r.SnoozedUntil,
+			AlertID:        r.AlertID,
+		}
+	}
+	return findings, nil
+}
diff --git a/internal/ai/findings_test.go b/internal/ai/findings_test.go
new file mode 100644
index 0000000..c82b480
--- /dev/null
+++ b/internal/ai/findings_test.go
@@ -0,0 +1,252 @@
+package ai
+
+import (
+	"testing"
+	"time"
+)
+
+func TestFinding_IsActive(t *testing.T) {
+	tests := []struct {
+		name     string
+		finding  Finding
+		expected bool
+	}{
+		{
+			name:     "active finding",
+			finding:  Finding{ID: "test-1"},
+			expected: true,
+		},
+		{
+			name: "resolved finding",
+			finding: Finding{
+				ID:         "test-2",
+				ResolvedAt: timePtr(time.Now()),
+			},
+			expected: false,
+		},
+		{
+			name: "snoozed finding",
+			finding: Finding{
+				ID:           "test-3",
+				SnoozedUntil: timePtr(time.Now().Add(1 * time.Hour)),
+			},
+			expected: false,
+		},
+		{
+			name: "expired snooze finding",
+			finding: Finding{
+				ID:           "test-4",
+				SnoozedUntil: timePtr(time.Now().Add(-1 * time.Hour)),
+			},
+			expected: true, // Snooze expired, should be active again
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.finding.IsActive(); got != tt.expected {
+				t.Errorf("IsActive() = %v, want %v", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestFinding_IsSnoozed(t *testing.T) {
+	tests := []struct {
+		name     string
+		finding  Finding
+		expected bool
+	}{
+		{
+			name:     "not snoozed",
+			finding:  Finding{ID: "test-1"},
+			expected: false,
+		},
+		{
+			name: "actively snoozed",
+			finding: Finding{
+				ID:           "test-2",
+				SnoozedUntil: timePtr(time.Now().Add(1 * time.Hour)),
+			},
+			expected: true,
+		},
+		{
+			name: "snooze expired",
+			finding: Finding{
+				ID:           "test-3",
+				SnoozedUntil: timePtr(time.Now().Add(-1 * time.Hour)),
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.finding.IsSnoozed(); got != tt.expected {
+				t.Errorf("IsSnoozed() = %v, want %v", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestFindingsStore_Snooze(t *testing.T) {
+	store := NewFindingsStore()
+
+	// Add a finding
+	finding := &Finding{
+		ID:           "finding-1",
+		Severity:     FindingSeverityWarning,
+		ResourceID:   "res-1",
+		ResourceName: "test-resource",
+		Title:        "Test Finding",
+	}
+	store.Add(finding)
+
+	// Verify it's active
+	activeFindings := store.GetActive(FindingSeverityInfo)
+	if len(activeFindings) != 1 {
+		t.Fatalf("Expected 1 active finding, got %d", len(activeFindings))
+	}
+
+	// Snooze the finding for 1 hour
+	if !store.Snooze("finding-1", 1*time.Hour) {
+		t.Fatal("Snooze should return true for existing finding")
+	}
+
+	// Verify it's no longer in active list
+	activeFindings = store.GetActive(FindingSeverityInfo)
+	if len(activeFindings) != 0 {
+		t.Fatalf("Expected 0 active findings after snooze, got %d", len(activeFindings))
+	}
+
+	// Verify summary counts decreased
+	summary := store.GetSummary()
+	if summary.Warning != 0 {
+		t.Errorf("Expected 0 warning count, got %d", summary.Warning)
+	}
+
+	// Snooze non-existent finding
+	if store.Snooze("non-existent", 1*time.Hour) {
+		t.Error("Snooze should return false for non-existent finding")
+	}
+}
+
+func TestFindingsStore_Unsnooze(t *testing.T) {
+	store := NewFindingsStore()
+
+	// Add and snooze a finding
+	finding := &Finding{
+		ID:           "finding-1",
+		Severity:     FindingSeverityCritical,
+		ResourceID:   "res-1",
+		ResourceName: "test-resource",
+		Title:        "Test Finding",
+	}
+	store.Add(finding)
+	store.Snooze("finding-1", 1*time.Hour)
+
+	// Verify it's snoozed
+	activeFindings := store.GetActive(FindingSeverityInfo)
+	if len(activeFindings) != 0 {
+		t.Fatalf("Expected 0 active findings when snoozed, got %d", len(activeFindings))
+	}
+
+	// Unsnooze
+	if !store.Unsnooze("finding-1") {
+		t.Fatal("Unsnooze should return true for snoozed finding")
+	}
+
+	// Verify it's active again
+	activeFindings = store.GetActive(FindingSeverityInfo)
+	if len(activeFindings) != 1 {
+		t.Fatalf("Expected 1 active finding after unsnooze, got %d", len(activeFindings))
+	}
+
+	// Verify summary counts increased
+	summary := store.GetSummary()
+	if summary.Critical != 1 {
+		t.Errorf("Expected 1 critical count, got %d", summary.Critical)
+	}
+
+	// Unsnooze non-existent finding
+	if store.Unsnooze("non-existent") {
+		t.Error("Unsnooze should return false for non-existent finding")
+	}
+}
+
+func TestFindingsStore_SnoozeResolvedFinding(t *testing.T) {
+	store := NewFindingsStore()
+
+	// Add a finding
+	finding := &Finding{
+		ID:           "finding-1",
+		Severity:     FindingSeverityWarning,
+		ResourceID:   "res-1",
+		ResourceName: "test-resource",
+		Title:        "Test Finding",
+	}
+	store.Add(finding)
+
+	// Resolve it
+	store.Resolve("finding-1", false)
+
+	// Try to snooze a resolved finding - should fail
+	if store.Snooze("finding-1", 1*time.Hour) {
+		t.Error("Should not be able to snooze a resolved finding")
+	}
+}
+
+func TestFindingsStore_SummaryConsistentWithActive(t *testing.T) {
+	store := NewFindingsStore()
+
+	// Add mixed severity findings
+	store.Add(&Finding{ID: "f1", Severity: FindingSeverityCritical, ResourceID: "r1", ResourceName: "res1", Title: "Critical"})
+	store.Add(&Finding{ID: "f2", Severity: FindingSeverityWarning, ResourceID: "r2", ResourceName: "res2", Title: "Warning"})
+	store.Add(&Finding{ID: "f3", Severity: FindingSeverityWatch, ResourceID: "r3", ResourceName: "res3", Title: "Watch"})
+
+	// Verify initial consistency
+	active := store.GetActive(FindingSeverityInfo)
+	summary := store.GetSummary()
+
+	if len(active) != summary.Critical+summary.Warning+summary.Watch+summary.Info {
+		t.Errorf("Mismatch: %d active findings, summary totals %d", len(active), summary.Critical+summary.Warning+summary.Watch+summary.Info)
+	}
+
+	// Resolve the warning finding
+	store.Resolve("f2", false)
+
+	// Verify consistency after resolution
+	active = store.GetActive(FindingSeverityInfo)
+	summary = store.GetSummary()
+
+	if len(active) != 2 {
+		t.Fatalf("Expected 2 active findings after resolution, got %d", len(active))
+	}
+
+	if summary.Warning != 0 {
+		t.Errorf("Summary shows %d warnings but should be 0 after resolution", summary.Warning)
+	}
+
+	if summary.Critical != 1 {
+		t.Errorf("Summary shows %d critical but should be 1", summary.Critical)
+	}
+
+	// Snooze the critical finding
+	store.Snooze("f1", 1*time.Hour)
+
+	// Verify consistency after snooze
+	active = store.GetActive(FindingSeverityInfo)
+	summary = store.GetSummary()
+
+	if len(active) != 1 {
+		t.Errorf("Expected 1 active finding after snooze, got %d", len(active))
+	}
+
+	if summary.Critical != 0 {
+		t.Errorf("Summary shows %d critical but should be 0 after snooze", summary.Critical)
+	}
+}
+
+func timePtr(t time.Time) *time.Time {
+	return &t
+}
diff --git a/internal/ai/knowledge/store.go b/internal/ai/knowledge/store.go
new file mode 100644
index 0000000..d422456
--- /dev/null
+++ b/internal/ai/knowledge/store.go
@@ -0,0 +1,489 @@
+// Package knowledge provides persistent storage for AI-learned information about guests
+package knowledge
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/crypto"
+	"github.com/rs/zerolog/log"
+)
+
+// Note represents a single piece of learned information
+type Note struct {
+	ID        string    `json:"id"`
+	Category  string    `json:"category"` // "service", "path", "credential", "config", "learning", "history"
+	Title     string    `json:"title"`
+	Content   string    `json:"content"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// GuestKnowledge represents all knowledge about a specific guest
+type GuestKnowledge struct {
+	GuestID   string    `json:"guest_id"`
+	GuestName string    `json:"guest_name"`
+	GuestType string    `json:"guest_type"` // "vm", "container", "node", "host"
+	Notes     []Note    `json:"notes"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// Store manages persistent knowledge storage with encryption
+type Store struct {
+	dataDir string
+	mu      sync.RWMutex
+	cache   map[string]*GuestKnowledge
+	crypto  *crypto.CryptoManager
+}
+
+// NewStore creates a new knowledge store with encryption
+func NewStore(dataDir string) (*Store, error) {
+	knowledgeDir := filepath.Join(dataDir, "knowledge")
+	if err := os.MkdirAll(knowledgeDir, 0700); err != nil {
+		return nil, fmt.Errorf("failed to create knowledge directory: %w", err)
+	}
+
+	// Initialize crypto manager for encryption (uses same key as other Pulse secrets)
+	cryptoMgr, err := crypto.NewCryptoManagerAt(dataDir)
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to initialize crypto for knowledge store, data will be unencrypted")
+	}
+
+	return &Store{
+		dataDir: knowledgeDir,
+		cache:   make(map[string]*GuestKnowledge),
+		crypto:  cryptoMgr,
+	}, nil
+}
+
+// guestFilePath returns the file path for a guest's knowledge
+func (s *Store) guestFilePath(guestID string) string {
+	// Sanitize guest ID for filesystem
+	safeID := filepath.Base(guestID) // Prevent path traversal
+	// Use .enc extension for encrypted files
+	if s.crypto != nil {
+		return filepath.Join(s.dataDir, safeID+".enc")
+	}
+	return filepath.Join(s.dataDir, safeID+".json")
+}
+
+// GetKnowledge retrieves knowledge for a guest
+func (s *Store) GetKnowledge(guestID string) (*GuestKnowledge, error) {
+	s.mu.RLock()
+	if cached, ok := s.cache[guestID]; ok {
+		s.mu.RUnlock()
+		return cached, nil
+	}
+	s.mu.RUnlock()
+
+	// Load from disk
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Double-check after acquiring write lock
+	if cached, ok := s.cache[guestID]; ok {
+		return cached, nil
+	}
+
+	filePath := s.guestFilePath(guestID)
+	data, err := os.ReadFile(filePath)
+	if os.IsNotExist(err) {
+		// Try legacy unencrypted file
+		legacyPath := filepath.Join(s.dataDir, filepath.Base(guestID)+".json")
+		data, err = os.ReadFile(legacyPath)
+		if os.IsNotExist(err) {
+			// No knowledge yet, return empty
+			knowledge := &GuestKnowledge{
+				GuestID: guestID,
+				Notes:   []Note{},
+			}
+			s.cache[guestID] = knowledge
+			return knowledge, nil
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to read knowledge file: %w", err)
+		}
+		// Legacy file found - will be encrypted on next save
+		log.Info().Str("guest_id", guestID).Msg("Found unencrypted knowledge file, will encrypt on next save")
+	} else if err != nil {
+		return nil, fmt.Errorf("failed to read knowledge file: %w", err)
+	}
+
+	// Decrypt if crypto is available and file is encrypted
+	if s.crypto != nil && filepath.Ext(filePath) == ".enc" {
+		decrypted, err := s.crypto.Decrypt(data)
+		if err != nil {
+			// Try as plain JSON (migration case)
+			var knowledge GuestKnowledge
+			if jsonErr := json.Unmarshal(data, &knowledge); jsonErr == nil {
+				log.Info().Str("guest_id", guestID).Msg("Loaded unencrypted knowledge (will encrypt on next save)")
+				s.cache[guestID] = &knowledge
+				return &knowledge, nil
+			}
+			return nil, fmt.Errorf("failed to decrypt knowledge: %w", err)
+		}
+		data = decrypted
+	}
+
+	var knowledge GuestKnowledge
+	if err := json.Unmarshal(data, &knowledge); err != nil {
+		return nil, fmt.Errorf("failed to parse knowledge file: %w", err)
+	}
+
+	s.cache[guestID] = &knowledge
+	return &knowledge, nil
+}
+
+// SaveNote adds or updates a note for a guest
+func (s *Store) SaveNote(guestID, guestName, guestType, category, title, content string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Get or create knowledge
+	knowledge, ok := s.cache[guestID]
+	if !ok {
+		// Try to load from disk first
+		knowledge = &GuestKnowledge{
+			GuestID:   guestID,
+			GuestName: guestName,
+			GuestType: guestType,
+			Notes:     []Note{},
+		}
+		
+		// Check for existing file
+		filePath := s.guestFilePath(guestID)
+		if data, err := os.ReadFile(filePath); err == nil {
+			// Decrypt if needed
+			if s.crypto != nil && filepath.Ext(filePath) == ".enc" {
+				if decrypted, err := s.crypto.Decrypt(data); err == nil {
+					data = decrypted
+				}
+			}
+			if err := json.Unmarshal(data, &knowledge); err != nil {
+				log.Warn().Err(err).Str("guest_id", guestID).Msg("Failed to parse existing knowledge, starting fresh")
+			}
+		}
+		s.cache[guestID] = knowledge
+	}
+
+	// Update guest info if provided
+	if guestName != "" {
+		knowledge.GuestName = guestName
+	}
+	if guestType != "" {
+		knowledge.GuestType = guestType
+	}
+
+	now := time.Now()
+
+	// Check if note with same title exists in category
+	found := false
+	for i, note := range knowledge.Notes {
+		if note.Category == category && note.Title == title {
+			// Update existing note
+			knowledge.Notes[i].Content = content
+			knowledge.Notes[i].UpdatedAt = now
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		// Add new note
+		note := Note{
+			ID:        fmt.Sprintf("%s-%d", category, len(knowledge.Notes)+1),
+			Category:  category,
+			Title:     title,
+			Content:   content,
+			CreatedAt: now,
+			UpdatedAt: now,
+		}
+		knowledge.Notes = append(knowledge.Notes, note)
+	}
+
+	knowledge.UpdatedAt = now
+
+	// Save to disk (encrypted)
+	return s.saveToFile(guestID, knowledge)
+}
+
+// DeleteNote removes a note
+func (s *Store) DeleteNote(guestID, noteID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	knowledge, ok := s.cache[guestID]
+	if !ok {
+		return fmt.Errorf("guest not found: %s", guestID)
+	}
+
+	// Find and remove note
+	for i, note := range knowledge.Notes {
+		if note.ID == noteID {
+			knowledge.Notes = append(knowledge.Notes[:i], knowledge.Notes[i+1:]...)
+			knowledge.UpdatedAt = time.Now()
+			return s.saveToFile(guestID, knowledge)
+		}
+	}
+
+	return fmt.Errorf("note not found: %s", noteID)
+}
+
+// GetNotesByCategory returns notes filtered by category
+func (s *Store) GetNotesByCategory(guestID, category string) ([]Note, error) {
+	knowledge, err := s.GetKnowledge(guestID)
+	if err != nil {
+		return nil, err
+	}
+
+	var notes []Note
+	for _, note := range knowledge.Notes {
+		if category == "" || note.Category == category {
+			notes = append(notes, note)
+		}
+	}
+	return notes, nil
+}
+
+// FormatForContext formats knowledge for injection into AI context
+func (s *Store) FormatForContext(guestID string) string {
+	knowledge, err := s.GetKnowledge(guestID)
+	if err != nil {
+		log.Warn().Err(err).Str("guest_id", guestID).Msg("Failed to load guest knowledge")
+		return ""
+	}
+
+	if len(knowledge.Notes) == 0 {
+		return ""
+	}
+
+	// Group notes by category
+	byCategory := make(map[string][]Note)
+	for _, note := range knowledge.Notes {
+		byCategory[note.Category] = append(byCategory[note.Category], note)
+	}
+
+	// Build formatted output with guidance on using this knowledge
+	var result string
+	result = fmt.Sprintf("\n## Previously Learned Information about %s\n", knowledge.GuestName)
+	result += "**If relevant to the current task, use this saved information directly instead of rediscovering it.**\n"
+
+	categoryOrder := []string{"credential", "service", "path", "config", "learning", "history"}
+	categoryNames := map[string]string{
+		"credential": "Credentials",
+		"service":    "Services",
+		"path":       "Important Paths",
+		"config":     "Configuration",
+		"learning":   "Learnings",
+		"history":    "Session History",
+	}
+
+	for _, cat := range categoryOrder {
+		notes, ok := byCategory[cat]
+		if !ok || len(notes) == 0 {
+			continue
+		}
+
+		result += fmt.Sprintf("\n### %s\n", categoryNames[cat])
+		for _, note := range notes {
+			result += fmt.Sprintf("- **%s**: %s\n", note.Title, note.Content)
+		}
+	}
+
+	return result
+}
+
+// saveToFile persists knowledge to disk with encryption
+func (s *Store) saveToFile(guestID string, knowledge *GuestKnowledge) error {
+	data, err := json.MarshalIndent(knowledge, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal knowledge: %w", err)
+	}
+
+	// Encrypt if crypto manager is available
+	if s.crypto != nil {
+		encrypted, err := s.crypto.Encrypt(data)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt knowledge: %w", err)
+		}
+		data = encrypted
+	}
+
+	filePath := s.guestFilePath(guestID)
+	if err := os.WriteFile(filePath, data, 0600); err != nil {
+		return fmt.Errorf("failed to write knowledge file: %w", err)
+	}
+
+	// Remove legacy unencrypted file if it exists
+	if s.crypto != nil {
+		legacyPath := filepath.Join(s.dataDir, filepath.Base(guestID)+".json")
+		if _, err := os.Stat(legacyPath); err == nil {
+			os.Remove(legacyPath)
+			log.Info().Str("guest_id", guestID).Msg("Removed legacy unencrypted knowledge file")
+		}
+	}
+
+	log.Debug().
+		Str("guest_id", guestID).
+		Int("notes", len(knowledge.Notes)).
+		Bool("encrypted", s.crypto != nil).
+		Msg("Saved guest knowledge")
+
+	return nil
+}
+
+// ListGuests returns all guests that have knowledge stored
+func (s *Store) ListGuests() ([]string, error) {
+	files, err := os.ReadDir(s.dataDir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read knowledge directory: %w", err)
+	}
+
+	var guests []string
+	for _, file := range files {
+		ext := filepath.Ext(file.Name())
+		if ext == ".json" || ext == ".enc" {
+			guestID := file.Name()[:len(file.Name())-len(ext)]
+			guests = append(guests, guestID)
+		}
+	}
+	return guests, nil
+}
+
+// FormatAllForContext returns a summary of all saved knowledge across all guests
+// This is used when no specific target is selected to give the AI full context
+// To prevent context bloat, it limits output to maxGuests and maxBytes
+func (s *Store) FormatAllForContext() string {
+	const maxGuests = 10   // Only include the 10 most recently updated guests
+	const maxBytes = 8000  // Cap total output at ~8KB to leave room for other context
+
+	guests, err := s.ListGuests()
+	if err != nil || len(guests) == 0 {
+		return ""
+	}
+
+	// Load all guests with notes and sort by most recently updated
+	type guestWithTime struct {
+		id        string
+		knowledge *GuestKnowledge
+	}
+	var guestsWithNotes []guestWithTime
+
+	for _, guestID := range guests {
+		knowledge, err := s.GetKnowledge(guestID)
+		if err != nil || len(knowledge.Notes) == 0 {
+			continue
+		}
+		guestsWithNotes = append(guestsWithNotes, guestWithTime{id: guestID, knowledge: knowledge})
+	}
+
+	if len(guestsWithNotes) == 0 {
+		return ""
+	}
+
+	// Sort by UpdatedAt descending (most recent first)
+	for i := 0; i < len(guestsWithNotes)-1; i++ {
+		for j := i + 1; j < len(guestsWithNotes); j++ {
+			if guestsWithNotes[j].knowledge.UpdatedAt.After(guestsWithNotes[i].knowledge.UpdatedAt) {
+				guestsWithNotes[i], guestsWithNotes[j] = guestsWithNotes[j], guestsWithNotes[i]
+			}
+		}
+	}
+
+	// Track how many guests and notes we're including vs total
+	totalGuests := len(guestsWithNotes)
+	totalNotes := 0
+	for _, g := range guestsWithNotes {
+		totalNotes += len(g.knowledge.Notes)
+	}
+
+	// Limit to maxGuests
+	truncatedGuests := false
+	if len(guestsWithNotes) > maxGuests {
+		guestsWithNotes = guestsWithNotes[:maxGuests]
+		truncatedGuests = true
+	}
+
+	var sections []string
+	includedNotes := 0
+	currentBytes := 0
+
+	for _, g := range guestsWithNotes {
+		knowledge := g.knowledge
+
+		// Build a summary for this guest
+		guestName := knowledge.GuestName
+		if guestName == "" {
+			guestName = g.id
+		}
+
+		// Group notes by category
+		byCategory := make(map[string][]Note)
+		for _, note := range knowledge.Notes {
+			byCategory[note.Category] = append(byCategory[note.Category], note)
+		}
+
+		var guestSection string
+		guestSection = fmt.Sprintf("\n### %s (%s)", guestName, knowledge.GuestType)
+
+		categoryOrder := []string{"credential", "service", "path", "config", "learning"}
+		for _, cat := range categoryOrder {
+			notes, ok := byCategory[cat]
+			if !ok || len(notes) == 0 {
+				continue
+			}
+			for _, note := range notes {
+				// Mask credentials in the summary
+				content := note.Content
+				if cat == "credential" && len(content) > 6 {
+					content = content[:2] + "****" + content[len(content)-2:]
+				}
+				noteLine := fmt.Sprintf("\n- **%s**: %s", note.Title, content)
+				
+				// Check if adding this note would exceed our byte limit
+				if currentBytes+len(guestSection)+len(noteLine) > maxBytes {
+					// Stop adding notes, we've hit the limit
+					if includedNotes > 0 {
+						log.Warn().
+							Int("total_notes", totalNotes).
+							Int("included_notes", includedNotes).
+							Int("total_guests", totalGuests).
+							Int("max_bytes", maxBytes).
+							Msg("Knowledge context truncated to prevent bloat - consider cleaning up old notes")
+					}
+					goto finalize
+				}
+				guestSection += noteLine
+				includedNotes++
+			}
+		}
+
+		currentBytes += len(guestSection)
+		sections = append(sections, guestSection)
+	}
+
+finalize:
+	if len(sections) == 0 {
+		return ""
+	}
+
+	// Build result with info about truncation if applicable
+	var header string
+	if truncatedGuests || includedNotes < totalNotes {
+		header = fmt.Sprintf("\n\n## Saved Knowledge (%d/%d notes from %d/%d guests, most recent)\n",
+			includedNotes, totalNotes, len(sections), totalGuests)
+	} else {
+		header = fmt.Sprintf("\n\n## Saved Knowledge (%d notes across %d guests)\n", totalNotes, len(sections))
+	}
+	result := header
+	result += "This is information learned from previous sessions. Use it to avoid rediscovery.\n"
+	result += strings.Join(sections, "\n")
+
+	return result
+}
+
diff --git a/internal/ai/knowledge/store_test.go b/internal/ai/knowledge/store_test.go
new file mode 100644
index 0000000..86ba101
--- /dev/null
+++ b/internal/ai/knowledge/store_test.go
@@ -0,0 +1,155 @@
+package knowledge
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestFormatAllForContext_LimitsOutput(t *testing.T) {
+	// Create a temp directory for the test
+	tmpDir, err := os.MkdirTemp("", "knowledge-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Create store without encryption for simplicity
+	store, err := NewStore(tmpDir)
+	if err != nil {
+		t.Fatalf("Failed to create store: %v", err)
+	}
+
+	// Add more than maxGuests (10) guests with notes
+	for i := 0; i < 15; i++ {
+		guestID := filepath.Base(tmpDir) + "-guest-" + string(rune('A'+i))
+		err := store.SaveNote(guestID, "Guest-"+string(rune('A'+i)), "vm", "service", "Web Server", "http://example.com:8080")
+		if err != nil {
+			t.Fatalf("Failed to save note: %v", err)
+		}
+		// Small delay to ensure different UpdatedAt times
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	// Get the formatted context
+	result := store.FormatAllForContext()
+
+	if result == "" {
+		t.Fatal("Expected non-empty result")
+	}
+
+	// Should mention it's truncated (15 guests but only 10 included)
+	if !contains(result, "/") {
+		t.Error("Expected truncation indicator (e.g., '10/15 notes') in output")
+	}
+
+	// Count how many guest sections we have (look for "### Guest-")
+	guestCount := countOccurrences(result, "### Guest-")
+	if guestCount > 10 {
+		t.Errorf("Expected at most 10 guests, got %d", guestCount)
+	}
+
+	// Should be under 8KB
+	if len(result) > 8500 {
+		t.Errorf("Result too large: %d bytes (expected < 8500)", len(result))
+	}
+}
+
+func TestFormatAllForContext_PrioritizesRecent(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "knowledge-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	store, err := NewStore(tmpDir)
+	if err != nil {
+		t.Fatalf("Failed to create store: %v", err)
+	}
+
+	// Create an old guest first
+	err = store.SaveNote("old-guest", "OldGuest", "vm", "config", "Setting", "old value")
+	if err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(50 * time.Millisecond)
+
+	// Create a newer guest
+	err = store.SaveNote("new-guest", "NewGuest", "vm", "config", "Setting", "new value")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	result := store.FormatAllForContext()
+
+	// NewGuest should appear before OldGuest (more recently updated)
+	newIdx := indexOf(result, "NewGuest")
+	oldIdx := indexOf(result, "OldGuest")
+
+	if newIdx == -1 || oldIdx == -1 {
+		t.Fatalf("Both guests should be in result. newIdx=%d, oldIdx=%d", newIdx, oldIdx)
+	}
+
+	if newIdx > oldIdx {
+		t.Error("Expected NewGuest to appear before OldGuest (more recent)")
+	}
+}
+
+func TestFormatAllForContext_ByteLimit(t *testing.T) {
+	tmpDir, err := os.MkdirTemp("", "knowledge-test")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	store, err := NewStore(tmpDir)
+	if err != nil {
+		t.Fatalf("Failed to create store: %v", err)
+	}
+
+	// Create notes with very large content to trigger byte limit
+	largeContent := make([]byte, 2000)
+	for i := range largeContent {
+		largeContent[i] = 'x'
+	}
+
+	for i := 0; i < 10; i++ {
+		guestID := "large-guest-" + string(rune('A'+i))
+		err := store.SaveNote(guestID, "LargeGuest-"+string(rune('A'+i)), "vm", "learning", "Big Note", string(largeContent))
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	result := store.FormatAllForContext()
+
+	// Should be capped at ~8KB (with some tolerance for headers)
+	if len(result) > 9000 {
+		t.Errorf("Result should be capped at ~8KB, got %d bytes", len(result))
+	}
+}
+
+// Helper functions
+func contains(s, substr string) bool {
+	return indexOf(s, substr) != -1
+}
+
+func indexOf(s, substr string) int {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return i
+		}
+	}
+	return -1
+}
+
+func countOccurrences(s, substr string) int {
+	count := 0
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			count++
+		}
+	}
+	return count
+}
diff --git a/internal/ai/memory/changes.go b/internal/ai/memory/changes.go
new file mode 100644
index 0000000..6cc1197
--- /dev/null
+++ b/internal/ai/memory/changes.go
@@ -0,0 +1,479 @@
+// Package memory provides operational memory for AI context.
+// It tracks changes to infrastructure, remediation actions, and their outcomes
+// to enable the AI to provide more informed, experience-based recommendations.
+package memory
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// ChangeType represents the type of infrastructure change detected
+type ChangeType string
+
+const (
+	ChangeCreated   ChangeType = "created"   // New resource appeared
+	ChangeDeleted   ChangeType = "deleted"   // Resource removed
+	ChangeConfig    ChangeType = "config"    // Configuration changed (RAM, CPU, etc)
+	ChangeStatus    ChangeType = "status"    // Status changed (started, stopped, paused)
+	ChangeMigrated  ChangeType = "migrated"  // Moved to different node
+	ChangeRestarted ChangeType = "restarted" // Resource was restarted
+	ChangeBackedUp  ChangeType = "backed_up" // Backup completed
+)
+
+// Change represents a detected change to infrastructure
+type Change struct {
+	ID           string      `json:"id"`
+	ResourceID   string      `json:"resource_id"`
+	ResourceType string      `json:"resource_type"` // vm, container, node, storage
+	ResourceName string      `json:"resource_name"`
+	ChangeType   ChangeType  `json:"change_type"`
+	Before       interface{} `json:"before,omitempty"`
+	After        interface{} `json:"after,omitempty"`
+	DetectedAt   time.Time   `json:"detected_at"`
+	Description  string      `json:"description"`
+}
+
+// ResourceSnapshot captures key attributes for change detection
+type ResourceSnapshot struct {
+	ID           string    `json:"id"`
+	Name         string    `json:"name"`
+	Type         string    `json:"type"`
+	Status       string    `json:"status"`
+	Node         string    `json:"node,omitempty"`
+	CPUCores     int       `json:"cpu_cores,omitempty"`
+	MemoryBytes  int64     `json:"memory_bytes,omitempty"`
+	DiskBytes    int64     `json:"disk_bytes,omitempty"`
+	LastBackup   time.Time `json:"last_backup,omitempty"`
+	SnapshotTime time.Time `json:"snapshot_time"`
+}
+
+// ChangeDetector tracks infrastructure changes over time
+type ChangeDetector struct {
+	mu            sync.RWMutex
+	previousState map[string]ResourceSnapshot // resourceID -> snapshot
+	changes       []Change
+	maxChanges    int
+
+	// Persistence
+	dataDir string
+}
+
+// ChangeDetectorConfig configures the change detector
+type ChangeDetectorConfig struct {
+	MaxChanges int    // Maximum changes to retain (default: 1000)
+	DataDir    string // Directory for persistence
+}
+
+// NewChangeDetector creates a new change detector
+func NewChangeDetector(cfg ChangeDetectorConfig) *ChangeDetector {
+	if cfg.MaxChanges <= 0 {
+		cfg.MaxChanges = 1000
+	}
+
+	d := &ChangeDetector{
+		previousState: make(map[string]ResourceSnapshot),
+		changes:       make([]Change, 0),
+		maxChanges:    cfg.MaxChanges,
+		dataDir:       cfg.DataDir,
+	}
+
+	// Load existing changes from disk
+	if cfg.DataDir != "" {
+		if err := d.loadFromDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to load change history from disk")
+		} else if len(d.changes) > 0 {
+			log.Info().Int("count", len(d.changes)).Msg("Loaded change history from disk")
+		}
+	}
+
+	return d
+}
+
+// DetectChanges compares current snapshots to previous state and detects changes
+func (d *ChangeDetector) DetectChanges(currentSnapshots []ResourceSnapshot) []Change {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	now := time.Now()
+	var newChanges []Change
+
+	// Track which resources we've seen in current snapshot
+	currentIDs := make(map[string]bool)
+
+	for _, current := range currentSnapshots {
+		currentIDs[current.ID] = true
+
+		prev, exists := d.previousState[current.ID]
+		if !exists {
+			// New resource
+			change := Change{
+				ID:           generateChangeID(),
+				ResourceID:   current.ID,
+				ResourceType: current.Type,
+				ResourceName: current.Name,
+				ChangeType:   ChangeCreated,
+				After:        current,
+				DetectedAt:   now,
+				Description:  formatCreateDescription(current),
+			}
+			newChanges = append(newChanges, change)
+		} else {
+			// Check for changes
+			changes := d.detectResourceChanges(prev, current, now)
+			newChanges = append(newChanges, changes...)
+		}
+
+		// Update previous state
+		d.previousState[current.ID] = current
+	}
+
+	// Check for deleted resources
+	for id, prev := range d.previousState {
+		if !currentIDs[id] {
+			change := Change{
+				ID:           generateChangeID(),
+				ResourceID:   id,
+				ResourceType: prev.Type,
+				ResourceName: prev.Name,
+				ChangeType:   ChangeDeleted,
+				Before:       prev,
+				DetectedAt:   now,
+				Description:  formatDeleteDescription(prev),
+			}
+			newChanges = append(newChanges, change)
+			delete(d.previousState, id)
+		}
+	}
+
+	// Store new changes
+	if len(newChanges) > 0 {
+		d.changes = append(d.changes, newChanges...)
+		d.trimChanges()
+
+		// Persist asynchronously
+		go func() {
+			if err := d.saveToDisk(); err != nil {
+				log.Warn().Err(err).Msg("Failed to save change history")
+			}
+		}()
+	}
+
+	return newChanges
+}
+
+// detectResourceChanges checks for changes between two snapshots of the same resource
+func (d *ChangeDetector) detectResourceChanges(prev, current ResourceSnapshot, now time.Time) []Change {
+	var changes []Change
+
+	// Status change
+	if prev.Status != current.Status {
+		change := Change{
+			ID:           generateChangeID(),
+			ResourceID:   current.ID,
+			ResourceType: current.Type,
+			ResourceName: current.Name,
+			ChangeType:   ChangeStatus,
+			Before:       prev.Status,
+			After:        current.Status,
+			DetectedAt:   now,
+			Description:  formatStatusDescription(current.Name, prev.Status, current.Status),
+		}
+		changes = append(changes, change)
+	}
+
+	// Node change (migration)
+	if prev.Node != "" && current.Node != "" && prev.Node != current.Node {
+		change := Change{
+			ID:           generateChangeID(),
+			ResourceID:   current.ID,
+			ResourceType: current.Type,
+			ResourceName: current.Name,
+			ChangeType:   ChangeMigrated,
+			Before:       prev.Node,
+			After:        current.Node,
+			DetectedAt:   now,
+			Description:  formatMigrationDescription(current.Name, prev.Node, current.Node),
+		}
+		changes = append(changes, change)
+	}
+
+	// CPU change
+	if prev.CPUCores > 0 && current.CPUCores > 0 && prev.CPUCores != current.CPUCores {
+		change := Change{
+			ID:           generateChangeID(),
+			ResourceID:   current.ID,
+			ResourceType: current.Type,
+			ResourceName: current.Name,
+			ChangeType:   ChangeConfig,
+			Before:       map[string]int{"cpu_cores": prev.CPUCores},
+			After:        map[string]int{"cpu_cores": current.CPUCores},
+			DetectedAt:   now,
+			Description:  formatCPUChangeDescription(current.Name, prev.CPUCores, current.CPUCores),
+		}
+		changes = append(changes, change)
+	}
+
+	// Memory change (significant change > 5%)
+	if prev.MemoryBytes > 0 && current.MemoryBytes > 0 {
+		pctChange := float64(current.MemoryBytes-prev.MemoryBytes) / float64(prev.MemoryBytes)
+		if pctChange > 0.05 || pctChange < -0.05 {
+			change := Change{
+				ID:           generateChangeID(),
+				ResourceID:   current.ID,
+				ResourceType: current.Type,
+				ResourceName: current.Name,
+				ChangeType:   ChangeConfig,
+				Before:       map[string]int64{"memory_bytes": prev.MemoryBytes},
+				After:        map[string]int64{"memory_bytes": current.MemoryBytes},
+				DetectedAt:   now,
+				Description:  formatMemoryChangeDescription(current.Name, prev.MemoryBytes, current.MemoryBytes),
+			}
+			changes = append(changes, change)
+		}
+	}
+
+	// Backup completed
+	if !prev.LastBackup.IsZero() && !current.LastBackup.IsZero() &&
+		current.LastBackup.After(prev.LastBackup) {
+		change := Change{
+			ID:           generateChangeID(),
+			ResourceID:   current.ID,
+			ResourceType: current.Type,
+			ResourceName: current.Name,
+			ChangeType:   ChangeBackedUp,
+			Before:       prev.LastBackup,
+			After:        current.LastBackup,
+			DetectedAt:   now,
+			Description:  formatBackupDescription(current.Name, current.LastBackup),
+		}
+		changes = append(changes, change)
+	}
+
+	return changes
+}
+
+// GetChangesForResource returns recent changes for a specific resource
+func (d *ChangeDetector) GetChangesForResource(resourceID string, limit int) []Change {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var result []Change
+	// Iterate in reverse to get most recent first
+	for i := len(d.changes) - 1; i >= 0 && len(result) < limit; i-- {
+		if d.changes[i].ResourceID == resourceID {
+			result = append(result, d.changes[i])
+		}
+	}
+	return result
+}
+
+// GetRecentChanges returns the most recent changes across all resources
+func (d *ChangeDetector) GetRecentChanges(limit int, since time.Time) []Change {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var result []Change
+	for i := len(d.changes) - 1; i >= 0 && len(result) < limit; i-- {
+		if d.changes[i].DetectedAt.After(since) {
+			result = append(result, d.changes[i])
+		}
+	}
+	return result
+}
+
+// GetChangesSummary returns a formatted summary of recent changes for AI context
+func (d *ChangeDetector) GetChangesSummary(since time.Time, maxChanges int) string {
+	changes := d.GetRecentChanges(maxChanges, since)
+	if len(changes) == 0 {
+		return ""
+	}
+
+	var result string
+	for _, c := range changes {
+		ago := time.Since(c.DetectedAt)
+		result += "- " + c.Description + " (" + formatDuration(ago) + " ago)\n"
+	}
+	return result
+}
+
+// trimChanges removes old changes beyond maxChanges
+func (d *ChangeDetector) trimChanges() {
+	if len(d.changes) > d.maxChanges {
+		// Keep most recent
+		d.changes = d.changes[len(d.changes)-d.maxChanges:]
+	}
+}
+
+// saveToDisk persists changes to JSON file
+func (d *ChangeDetector) saveToDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	d.mu.RLock()
+	changes := make([]Change, len(d.changes))
+	copy(changes, d.changes)
+	d.mu.RUnlock()
+
+	path := filepath.Join(d.dataDir, "ai_changes.json")
+	data, err := json.MarshalIndent(changes, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
+		return err
+	}
+
+	return os.Rename(tmpPath, path)
+}
+
+// loadFromDisk loads changes from JSON file
+func (d *ChangeDetector) loadFromDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	path := filepath.Join(d.dataDir, "ai_changes.json")
+	if st, err := os.Stat(path); err == nil {
+		const maxOnDiskBytes = 10 << 20 // 10 MiB safety cap
+		if st.Size() > maxOnDiskBytes {
+			return fmt.Errorf("change history file too large (%d bytes)", st.Size())
+		}
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	var changes []Change
+	if err := json.Unmarshal(data, &changes); err != nil {
+		return err
+	}
+
+	// Sort by time
+	sort.Slice(changes, func(i, j int) bool {
+		return changes[i].DetectedAt.Before(changes[j].DetectedAt)
+	})
+
+	d.changes = changes
+	d.trimChanges()
+	return nil
+}
+
+// Helper functions
+
+var changeCounter int64
+
+func generateChangeID() string {
+	changeCounter++
+	return time.Now().Format("20060102150405") + "-" + intToString(int(changeCounter%1000))
+}
+
+func formatDuration(d time.Duration) string {
+	if d < time.Minute {
+		return "just now"
+	}
+	if d < time.Hour {
+		return formatUnit(int(d.Minutes()), "minute")
+	}
+	if d < 24*time.Hour {
+		return formatUnit(int(d.Hours()), "hour")
+	}
+	return formatUnit(int(d.Hours()/24), "day")
+}
+
+func formatUnit(n int, unit string) string {
+	if n == 1 {
+		return "1 " + unit
+	}
+	return intToString(n) + " " + unit + "s"
+}
+
+func formatBytes(bytes int64) string {
+	const (
+		KB = 1024
+		MB = KB * 1024
+		GB = MB * 1024
+	)
+	switch {
+	case bytes >= GB:
+		return formatFloat(float64(bytes)/GB) + " GB"
+	case bytes >= MB:
+		return formatFloat(float64(bytes)/MB) + " MB"
+	case bytes >= KB:
+		return formatFloat(float64(bytes)/KB) + " KB"
+	default:
+		return intToString(int(bytes)) + " B"
+	}
+}
+
+func formatFloat(v float64) string {
+	// Simple formatting without fmt dependency
+	whole := int(v)
+	frac := int((v - float64(whole)) * 10)
+	if frac == 0 {
+		return intToString(whole)
+	}
+	return intToString(whole) + "." + string(rune('0'+frac))
+}
+
+func intToString(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var result string
+	for n > 0 {
+		result = string(rune('0'+n%10)) + result
+		n /= 10
+	}
+	return result
+}
+
+func formatCreateDescription(r ResourceSnapshot) string {
+	return r.Type + " '" + r.Name + "' created"
+}
+
+func formatDeleteDescription(r ResourceSnapshot) string {
+	return r.Type + " '" + r.Name + "' deleted"
+}
+
+func formatStatusDescription(name, before, after string) string {
+	return "'" + name + "' status changed: " + before + " → " + after
+}
+
+func formatMigrationDescription(name, fromNode, toNode string) string {
+	return "'" + name + "' migrated from " + fromNode + " to " + toNode
+}
+
+func formatCPUChangeDescription(name string, before, after int) string {
+	direction := "increased"
+	if after < before {
+		direction = "decreased"
+	}
+	return "'" + name + "' CPU " + direction + ": " + intToString(before) + " → " + intToString(after) + " cores"
+}
+
+func formatMemoryChangeDescription(name string, before, after int64) string {
+	direction := "increased"
+	if after < before {
+		direction = "decreased"
+	}
+	return "'" + name + "' memory " + direction + ": " + formatBytes(before) + " → " + formatBytes(after)
+}
+
+func formatBackupDescription(name string, backupTime time.Time) string {
+	return "'" + name + "' backup completed at " + backupTime.Format("2006-01-02 15:04")
+}
diff --git a/internal/ai/memory/memory_test.go b/internal/ai/memory/memory_test.go
new file mode 100644
index 0000000..368b583
--- /dev/null
+++ b/internal/ai/memory/memory_test.go
@@ -0,0 +1,232 @@
+package memory
+
+import (
+	"testing"
+	"time"
+)
+
+func TestChangeDetector_DetectNew(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// First detection - should see new resource
+	snapshots := []ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node1"},
+	}
+
+	changes := d.DetectChanges(snapshots)
+	if len(changes) != 1 {
+		t.Errorf("Expected 1 change (creation), got %d", len(changes))
+	}
+	if changes[0].ChangeType != ChangeCreated {
+		t.Errorf("Expected ChangeCreated, got %s", changes[0].ChangeType)
+	}
+}
+
+func TestChangeDetector_DetectStatusChange(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// Initial state
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node1"},
+	})
+
+	// Status change
+	changes := d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "stopped", Node: "node1"},
+	})
+
+	if len(changes) != 1 {
+		t.Errorf("Expected 1 status change, got %d", len(changes))
+	}
+	if changes[0].ChangeType != ChangeStatus {
+		t.Errorf("Expected ChangeStatus, got %s", changes[0].ChangeType)
+	}
+	if changes[0].Before != "running" || changes[0].After != "stopped" {
+		t.Errorf("Expected running->stopped, got %v->%v", changes[0].Before, changes[0].After)
+	}
+}
+
+func TestChangeDetector_DetectMigration(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// Initial state
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node1"},
+	})
+
+	// Migration
+	changes := d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node2"},
+	})
+
+	if len(changes) != 1 {
+		t.Errorf("Expected 1 migration change, got %d", len(changes))
+	}
+	if changes[0].ChangeType != ChangeMigrated {
+		t.Errorf("Expected ChangeMigrated, got %s", changes[0].ChangeType)
+	}
+}
+
+func TestChangeDetector_DetectDeleted(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// Initial state
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node1"},
+	})
+
+	// Delete (empty snapshot)
+	changes := d.DetectChanges([]ResourceSnapshot{})
+
+	if len(changes) != 1 {
+		t.Errorf("Expected 1 deletion change, got %d", len(changes))
+	}
+	if changes[0].ChangeType != ChangeDeleted {
+		t.Errorf("Expected ChangeDeleted, got %s", changes[0].ChangeType)
+	}
+}
+
+func TestChangeDetector_NoChanges(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	snapshot := []ResourceSnapshot{
+		{ID: "vm-100", Name: "web-server", Type: "vm", Status: "running", Node: "node1"},
+	}
+
+	// First time - creates
+	d.DetectChanges(snapshot)
+
+	// Second time - no changes
+	changes := d.DetectChanges(snapshot)
+	if len(changes) != 0 {
+		t.Errorf("Expected 0 changes, got %d", len(changes))
+	}
+}
+
+func TestChangeDetector_GetChangesForResource(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// Create and change a few times
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web", Type: "vm", Status: "stopped", Node: "node1"},
+		{ID: "vm-200", Name: "db", Type: "vm", Status: "running", Node: "node1"},
+	})
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web", Type: "vm", Status: "running", Node: "node1"},
+		{ID: "vm-200", Name: "db", Type: "vm", Status: "running", Node: "node1"},
+	})
+
+	// Get changes for vm-100 only
+	changes := d.GetChangesForResource("vm-100", 10)
+	for _, c := range changes {
+		if c.ResourceID != "vm-100" {
+			t.Errorf("Got change for wrong resource: %s", c.ResourceID)
+		}
+	}
+}
+
+func TestRemediationLog_LogAndRetrieve(t *testing.T) {
+	r := NewRemediationLog(RemediationLogConfig{MaxRecords: 100})
+
+	r.Log(RemediationRecord{
+		ResourceID: "vm-100",
+		Problem:    "High memory usage",
+		Action:     "systemctl restart nginx",
+		Outcome:    OutcomeResolved,
+	})
+
+	records := r.GetForResource("vm-100", 10)
+	if len(records) != 1 {
+		t.Errorf("Expected 1 record, got %d", len(records))
+	}
+	if records[0].Action != "systemctl restart nginx" {
+		t.Errorf("Wrong action: %s", records[0].Action)
+	}
+}
+
+func TestRemediationLog_GetSimilar(t *testing.T) {
+	r := NewRemediationLog(RemediationLogConfig{MaxRecords: 100})
+
+	// Log some remediations
+	r.Log(RemediationRecord{
+		ResourceID: "vm-100",
+		Problem:    "High memory usage causing OOM",
+		Action:     "Restart service",
+		Outcome:    OutcomeResolved,
+	})
+	r.Log(RemediationRecord{
+		ResourceID: "vm-200",
+		Problem:    "Memory leak detected",
+		Action:     "Cleared cache",
+		Outcome:    OutcomePartial,
+	})
+	r.Log(RemediationRecord{
+		ResourceID: "vm-300",
+		Problem:    "CPU spike from backup",
+		Action:     "Rescheduled backup",
+		Outcome:    OutcomeResolved,
+	})
+
+	// Search for similar memory issues
+	similar := r.GetSimilar("High memory usage causing slowdown", 5)
+	if len(similar) < 1 {
+		t.Errorf("Expected at least 1 similar record")
+	}
+}
+
+func TestRemediationLog_GetSuccessfulRemediations(t *testing.T) {
+	r := NewRemediationLog(RemediationLogConfig{MaxRecords: 100})
+
+	r.Log(RemediationRecord{
+		Problem: "Memory usage high",
+		Action:  "Restart service",
+		Outcome: OutcomeResolved,
+	})
+	r.Log(RemediationRecord{
+		Problem: "Memory usage high",
+		Action:  "Kill process",
+		Outcome: OutcomeFailed,
+	})
+
+	successful := r.GetSuccessfulRemediations("Memory usage issue", 5)
+	for _, rec := range successful {
+		if rec.Outcome != OutcomeResolved && rec.Outcome != OutcomePartial {
+			t.Errorf("Got unsuccessful remediation in successful list: %s", rec.Outcome)
+		}
+	}
+}
+
+func TestRemediationLog_Stats(t *testing.T) {
+	r := NewRemediationLog(RemediationLogConfig{MaxRecords: 100})
+
+	r.Log(RemediationRecord{Problem: "p1", Action: "a1", Outcome: OutcomeResolved})
+	r.Log(RemediationRecord{Problem: "p2", Action: "a2", Outcome: OutcomeResolved})
+	r.Log(RemediationRecord{Problem: "p3", Action: "a3", Outcome: OutcomeFailed})
+
+	stats := r.GetRemediationStats()
+	if stats["total"] != 3 {
+		t.Errorf("Expected 3 total, got %d", stats["total"])
+	}
+	if stats["resolved"] != 2 {
+		t.Errorf("Expected 2 resolved, got %d", stats["resolved"])
+	}
+	if stats["failed"] != 1 {
+		t.Errorf("Expected 1 failed, got %d", stats["failed"])
+	}
+}
+
+func TestChangeDetector_GetRecentChanges(t *testing.T) {
+	d := NewChangeDetector(ChangeDetectorConfig{MaxChanges: 100})
+
+	// Create some changes
+	d.DetectChanges([]ResourceSnapshot{
+		{ID: "vm-100", Name: "web", Type: "vm", Status: "running", Node: "node1"},
+	})
+
+	// Get recent changes
+	since := time.Now().Add(-1 * time.Hour)
+	changes := d.GetRecentChanges(10, since)
+	if len(changes) == 0 {
+		t.Error("Expected at least 1 recent change")
+	}
+}
diff --git a/internal/ai/memory/remediation.go b/internal/ai/memory/remediation.go
new file mode 100644
index 0000000..ebf9ecc
--- /dev/null
+++ b/internal/ai/memory/remediation.go
@@ -0,0 +1,393 @@
+package memory
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// Outcome represents the result of a remediation action
+type Outcome string
+
+const (
+	OutcomeResolved Outcome = "resolved" // Problem was fixed
+	OutcomePartial  Outcome = "partial"  // Partially fixed
+	OutcomeFailed   Outcome = "failed"   // Action failed
+	OutcomeUnknown  Outcome = "unknown"  // Outcome not determined
+)
+
+// RemediationRecord represents a logged remediation action
+type RemediationRecord struct {
+	ID           string        `json:"id"`
+	Timestamp    time.Time     `json:"timestamp"`
+	ResourceID   string        `json:"resource_id"`
+	ResourceType string        `json:"resource_type,omitempty"`
+	ResourceName string        `json:"resource_name,omitempty"`
+	FindingID    string        `json:"finding_id,omitempty"` // Linked AI finding if any
+	Problem      string        `json:"problem"`              // What was wrong
+	Action       string        `json:"action"`               // What was done (command or action)
+	Output       string        `json:"output,omitempty"`     // Command output if any
+	Outcome      Outcome       `json:"outcome"`              // Did it work?
+	Duration     time.Duration `json:"duration,omitempty"`   // How long until resolved
+	Note         string        `json:"note,omitempty"`       // Optional user/AI note
+	Automatic    bool          `json:"automatic"`            // Was this triggered automatically by AI
+}
+
+// RemediationLog stores remediation history
+type RemediationLog struct {
+	mu         sync.RWMutex
+	records    []RemediationRecord
+	maxRecords int
+
+	// Persistence
+	dataDir string
+}
+
+// RemediationLogConfig configures the remediation log
+type RemediationLogConfig struct {
+	MaxRecords int
+	DataDir    string
+}
+
+// NewRemediationLog creates a new remediation log
+func NewRemediationLog(cfg RemediationLogConfig) *RemediationLog {
+	if cfg.MaxRecords <= 0 {
+		cfg.MaxRecords = 500
+	}
+
+	r := &RemediationLog{
+		records:    make([]RemediationRecord, 0),
+		maxRecords: cfg.MaxRecords,
+		dataDir:    cfg.DataDir,
+	}
+
+	// Load existing records from disk
+	if cfg.DataDir != "" {
+		if err := r.loadFromDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to load remediation log from disk")
+		} else if len(r.records) > 0 {
+			log.Info().Int("count", len(r.records)).Msg("Loaded remediation log from disk")
+		}
+	}
+
+	return r
+}
+
+// Log records a remediation action
+func (r *RemediationLog) Log(record RemediationRecord) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if record.ID == "" {
+		record.ID = generateRecordID()
+	}
+	if record.Timestamp.IsZero() {
+		record.Timestamp = time.Now()
+	}
+
+	r.records = append(r.records, record)
+	r.trimRecords()
+
+	// Persist asynchronously
+	go func() {
+		if err := r.saveToDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to save remediation log")
+		}
+	}()
+
+	return nil
+}
+
+// LogCommand is a convenience method for logging a command execution
+func (r *RemediationLog) LogCommand(resourceID, resourceType, resourceName, findingID, problem, command, output string, success bool, automatic bool) {
+	outcome := OutcomeUnknown
+	if success {
+		outcome = OutcomeResolved
+	} else {
+		outcome = OutcomeFailed
+	}
+
+	r.Log(RemediationRecord{
+		ResourceID:   resourceID,
+		ResourceType: resourceType,
+		ResourceName: resourceName,
+		FindingID:    findingID,
+		Problem:      problem,
+		Action:       command,
+		Output:       truncateOutput(output, 1000),
+		Outcome:      outcome,
+		Automatic:    automatic,
+	})
+}
+
+// GetForResource returns remediation history for a specific resource
+func (r *RemediationLog) GetForResource(resourceID string, limit int) []RemediationRecord {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	var result []RemediationRecord
+	// Iterate in reverse to get most recent first
+	for i := len(r.records) - 1; i >= 0 && len(result) < limit; i-- {
+		if r.records[i].ResourceID == resourceID {
+			result = append(result, r.records[i])
+		}
+	}
+	return result
+}
+
+// GetForFinding returns remediation history linked to a specific finding
+func (r *RemediationLog) GetForFinding(findingID string, limit int) []RemediationRecord {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	var result []RemediationRecord
+	for i := len(r.records) - 1; i >= 0 && len(result) < limit; i-- {
+		if r.records[i].FindingID == findingID {
+			result = append(result, r.records[i])
+		}
+	}
+	return result
+}
+
+// GetSimilar finds remediation records with similar problems
+func (r *RemediationLog) GetSimilar(problem string, limit int) []RemediationRecord {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	// Simple keyword-based matching
+	keywords := extractKeywords(problem)
+	if len(keywords) == 0 {
+		return nil
+	}
+
+	type scored struct {
+		record RemediationRecord
+		score  int
+	}
+
+	var matches []scored
+	for _, record := range r.records {
+		recordKeywords := extractKeywords(record.Problem)
+		score := countMatches(keywords, recordKeywords)
+		if score > 0 {
+			matches = append(matches, scored{record: record, score: score})
+		}
+	}
+
+	// Sort by score descending
+	sort.Slice(matches, func(i, j int) bool {
+		return matches[i].score > matches[j].score
+	})
+
+	var result []RemediationRecord
+	for i := 0; i < len(matches) && len(result) < limit; i++ {
+		result = append(result, matches[i].record)
+	}
+	return result
+}
+
+// GetSuccessfulRemediations returns successful remediations for similar problems
+func (r *RemediationLog) GetSuccessfulRemediations(problem string, limit int) []RemediationRecord {
+	similar := r.GetSimilar(problem, limit*3) // Get more to filter
+	var result []RemediationRecord
+	for _, rec := range similar {
+		if rec.Outcome == OutcomeResolved || rec.Outcome == OutcomePartial {
+			result = append(result, rec)
+			if len(result) >= limit {
+				break
+			}
+		}
+	}
+	return result
+}
+
+// GetRecentRemediations returns the most recent remediations
+func (r *RemediationLog) GetRecentRemediations(limit int, since time.Time) []RemediationRecord {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	var result []RemediationRecord
+	for i := len(r.records) - 1; i >= 0 && len(result) < limit; i-- {
+		if r.records[i].Timestamp.After(since) {
+			result = append(result, r.records[i])
+		}
+	}
+	return result
+}
+
+// FormatForContext creates AI-consumable summary of remediation history
+func (r *RemediationLog) FormatForContext(resourceID string, limit int) string {
+	records := r.GetForResource(resourceID, limit)
+	if len(records) == 0 {
+		return ""
+	}
+
+	var result string
+	for _, rec := range records {
+		ago := time.Since(rec.Timestamp)
+		outcomeStr := string(rec.Outcome)
+		result += "- " + formatDuration(ago) + " ago: " + rec.Problem + "\n"
+		result += "  Action: " + rec.Action + " (" + outcomeStr + ")\n"
+		if rec.Note != "" {
+			result += "  Note: " + rec.Note + "\n"
+		}
+	}
+	return result
+}
+
+// GetRemediationStats returns statistics about remediation effectiveness
+func (r *RemediationLog) GetRemediationStats() map[string]int {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	stats := map[string]int{
+		"total":    len(r.records),
+		"resolved": 0,
+		"partial":  0,
+		"failed":   0,
+		"unknown":  0,
+	}
+
+	for _, rec := range r.records {
+		switch rec.Outcome {
+		case OutcomeResolved:
+			stats["resolved"]++
+		case OutcomePartial:
+			stats["partial"]++
+		case OutcomeFailed:
+			stats["failed"]++
+		default:
+			stats["unknown"]++
+		}
+	}
+
+	return stats
+}
+
+// trimRecords removes old records beyond maxRecords
+func (r *RemediationLog) trimRecords() {
+	if len(r.records) > r.maxRecords {
+		r.records = r.records[len(r.records)-r.maxRecords:]
+	}
+}
+
+// saveToDisk persists records to JSON file
+func (r *RemediationLog) saveToDisk() error {
+	if r.dataDir == "" {
+		return nil
+	}
+
+	r.mu.RLock()
+	records := make([]RemediationRecord, len(r.records))
+	copy(records, r.records)
+	r.mu.RUnlock()
+
+	path := filepath.Join(r.dataDir, "ai_remediations.json")
+	data, err := json.MarshalIndent(records, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, data, 0600); err != nil {
+		return err
+	}
+
+	return os.Rename(tmpPath, path)
+}
+
+// loadFromDisk loads records from JSON file
+func (r *RemediationLog) loadFromDisk() error {
+	if r.dataDir == "" {
+		return nil
+	}
+
+	path := filepath.Join(r.dataDir, "ai_remediations.json")
+	if st, err := os.Stat(path); err == nil {
+		const maxOnDiskBytes = 10 << 20 // 10 MiB safety cap
+		if st.Size() > maxOnDiskBytes {
+			return fmt.Errorf("remediation history file too large (%d bytes)", st.Size())
+		}
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	var records []RemediationRecord
+	if err := json.Unmarshal(data, &records); err != nil {
+		return err
+	}
+
+	// Sort by timestamp
+	sort.Slice(records, func(i, j int) bool {
+		return records[i].Timestamp.Before(records[j].Timestamp)
+	})
+
+	r.records = records
+	r.trimRecords()
+	return nil
+}
+
+// Helper functions
+
+var recordCounter int64
+
+func generateRecordID() string {
+	recordCounter++
+	return "rem-" + time.Now().Format("20060102150405") + "-" + intToString(int(recordCounter%1000))
+}
+
+func truncateOutput(output string, maxLen int) string {
+	if len(output) <= maxLen {
+		return output
+	}
+	return output[:maxLen-3] + "..."
+}
+
+func extractKeywords(text string) []string {
+	// Simple keyword extraction - split by common delimiters
+	// In production, this could use NLP or embeddings
+	var keywords []string
+	var current string
+
+	for _, c := range text {
+		if c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' {
+			current += string(c)
+		} else {
+			if len(current) > 3 { // Only keep words > 3 chars
+				keywords = append(keywords, current)
+			}
+			current = ""
+		}
+	}
+	if len(current) > 3 {
+		keywords = append(keywords, current)
+	}
+
+	return keywords
+}
+
+func countMatches(a, b []string) int {
+	bSet := make(map[string]bool)
+	for _, s := range b {
+		bSet[s] = true
+	}
+
+	count := 0
+	for _, s := range a {
+		if bSet[s] {
+			count++
+		}
+	}
+	return count
+}
diff --git a/internal/ai/memory_exports.go b/internal/ai/memory_exports.go
new file mode 100644
index 0000000..ebd0113
--- /dev/null
+++ b/internal/ai/memory_exports.go
@@ -0,0 +1,61 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/memory"
+)
+
+// ChangeDetector is an alias for memory.ChangeDetector
+type ChangeDetector = memory.ChangeDetector
+
+// ChangeDetectorConfig is an alias for memory.ChangeDetectorConfig
+type ChangeDetectorConfig = memory.ChangeDetectorConfig
+
+// Change is an alias for memory.Change
+type Change = memory.Change
+
+// ResourceSnapshot is an alias for memory.ResourceSnapshot
+type ResourceSnapshot = memory.ResourceSnapshot
+
+// ChangeType is an alias for memory.ChangeType
+type ChangeType = memory.ChangeType
+
+// RemediationLog is an alias for memory.RemediationLog
+type RemediationLog = memory.RemediationLog
+
+// RemediationLogConfig is an alias for memory.RemediationLogConfig
+type RemediationLogConfig = memory.RemediationLogConfig
+
+// RemediationRecord is an alias for memory.RemediationRecord
+type RemediationRecord = memory.RemediationRecord
+
+// Outcome is an alias for memory.Outcome
+type Outcome = memory.Outcome
+
+// Change type constants
+const (
+	ChangeCreated   = memory.ChangeCreated
+	ChangeDeleted   = memory.ChangeDeleted
+	ChangeConfig    = memory.ChangeConfig
+	ChangeStatus    = memory.ChangeStatus
+	ChangeMigrated  = memory.ChangeMigrated
+	ChangeRestarted = memory.ChangeRestarted
+	ChangeBackedUp  = memory.ChangeBackedUp
+)
+
+// Outcome constants
+const (
+	OutcomeResolved = memory.OutcomeResolved
+	OutcomePartial  = memory.OutcomePartial
+	OutcomeFailed   = memory.OutcomeFailed
+	OutcomeUnknown  = memory.OutcomeUnknown
+)
+
+// NewChangeDetector creates a new change detector
+func NewChangeDetector(cfg ChangeDetectorConfig) *ChangeDetector {
+	return memory.NewChangeDetector(cfg)
+}
+
+// NewRemediationLog creates a new remediation log
+func NewRemediationLog(cfg RemediationLogConfig) *RemediationLog {
+	return memory.NewRemediationLog(cfg)
+}
diff --git a/internal/ai/metadata_provider.go b/internal/ai/metadata_provider.go
new file mode 100644
index 0000000..1aeb355
--- /dev/null
+++ b/internal/ai/metadata_provider.go
@@ -0,0 +1,109 @@
+package ai
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+)
+
+// MetadataProvider provides access to resource metadata stores
+// This allows the AI to update resource URLs when it discovers web services
+type MetadataProvider interface {
+	// SetGuestURL sets the custom URL for a Proxmox guest (VM/container)
+	SetGuestURL(guestID, customURL string) error
+
+	// SetDockerURL sets the custom URL for a Docker container/service
+	SetDockerURL(resourceID, customURL string) error
+
+	// SetHostURL sets the custom URL for a host
+	SetHostURL(hostID, customURL string) error
+}
+
+// SetMetadataProvider sets the metadata provider for URL updates
+func (s *Service) SetMetadataProvider(mp MetadataProvider) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.metadataProvider = mp
+	log.Info().Msg("AI service: metadata provider configured for URL discovery")
+}
+
+// SetResourceURL updates the URL for a resource in Pulse
+// This is called by the AI when it discovers a web service
+func (s *Service) SetResourceURL(resourceType, resourceID, customURL string) error {
+	s.mu.RLock()
+	mp := s.metadataProvider
+	s.mu.RUnlock()
+
+	if mp == nil {
+		return fmt.Errorf("metadata provider not configured")
+	}
+
+	// Validate and normalize the URL
+	if customURL != "" {
+		// Try to parse the URL
+		parsedURL, err := url.Parse(customURL)
+		if err != nil {
+			return fmt.Errorf("invalid URL format: %w", err)
+		}
+
+		// Ensure scheme is present
+		if parsedURL.Scheme == "" {
+			// Default to http if no scheme provided
+			customURL = "http://" + customURL
+			parsedURL, err = url.Parse(customURL)
+			if err != nil {
+				return fmt.Errorf("invalid URL format: %w", err)
+			}
+		}
+
+		// Validate scheme
+		if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
+			return fmt.Errorf("URL must use http:// or https:// scheme")
+		}
+
+		// Ensure host is present
+		if parsedURL.Host == "" {
+			return fmt.Errorf("URL must include a host")
+		}
+	}
+
+	// Route to the appropriate metadata store based on resource type
+	switch strings.ToLower(resourceType) {
+	case "guest", "vm", "container", "lxc", "qemu":
+		if err := mp.SetGuestURL(resourceID, customURL); err != nil {
+			return fmt.Errorf("failed to set guest URL: %w", err)
+		}
+		log.Info().
+			Str("resourceType", resourceType).
+			Str("resourceID", resourceID).
+			Str("url", customURL).
+			Msg("AI set guest URL")
+
+	case "docker", "docker_container", "docker_service":
+		if err := mp.SetDockerURL(resourceID, customURL); err != nil {
+			return fmt.Errorf("failed to set Docker URL: %w", err)
+		}
+		log.Info().
+			Str("resourceType", resourceType).
+			Str("resourceID", resourceID).
+			Str("url", customURL).
+			Msg("AI set Docker URL")
+
+	case "host":
+		if err := mp.SetHostURL(resourceID, customURL); err != nil {
+			return fmt.Errorf("failed to set host URL: %w", err)
+		}
+		log.Info().
+			Str("resourceType", resourceType).
+			Str("resourceID", resourceID).
+			Str("url", customURL).
+			Msg("AI set host URL")
+
+	default:
+		return fmt.Errorf("unknown resource type: %s (use 'guest', 'docker', or 'host')", resourceType)
+	}
+
+	return nil
+}
diff --git a/internal/ai/metrics_history_adapter.go b/internal/ai/metrics_history_adapter.go
new file mode 100644
index 0000000..32cc228
--- /dev/null
+++ b/internal/ai/metrics_history_adapter.go
@@ -0,0 +1,85 @@
+package ai
+
+import (
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/monitoring"
+)
+
+// MetricsHistoryAdapter adapts monitoring.MetricsHistory to the MetricsHistoryProvider interface
+// This allows the patrol service to use the monitoring package's metrics history
+// without creating a direct package dependency
+type MetricsHistoryAdapter struct {
+	history *monitoring.MetricsHistory
+}
+
+// NewMetricsHistoryAdapter creates an adapter for the monitoring.MetricsHistory
+func NewMetricsHistoryAdapter(history *monitoring.MetricsHistory) *MetricsHistoryAdapter {
+	if history == nil {
+		return nil
+	}
+	return &MetricsHistoryAdapter{history: history}
+}
+
+// GetNodeMetrics returns historical metrics for a node
+func (a *MetricsHistoryAdapter) GetNodeMetrics(nodeID string, metricType string, duration time.Duration) []MetricPoint {
+	if a.history == nil {
+		return nil
+	}
+	points := a.history.GetNodeMetrics(nodeID, metricType, duration)
+	return convertMetricPoints(points)
+}
+
+// GetGuestMetrics returns historical metrics for a guest
+func (a *MetricsHistoryAdapter) GetGuestMetrics(guestID string, metricType string, duration time.Duration) []MetricPoint {
+	if a.history == nil {
+		return nil
+	}
+	points := a.history.GetGuestMetrics(guestID, metricType, duration)
+	return convertMetricPoints(points)
+}
+
+// GetAllGuestMetrics returns all metrics for a guest
+func (a *MetricsHistoryAdapter) GetAllGuestMetrics(guestID string, duration time.Duration) map[string][]MetricPoint {
+	if a.history == nil {
+		return nil
+	}
+	metricsMap := a.history.GetAllGuestMetrics(guestID, duration)
+	return convertMetricsMap(metricsMap)
+}
+
+// GetAllStorageMetrics returns all metrics for storage
+func (a *MetricsHistoryAdapter) GetAllStorageMetrics(storageID string, duration time.Duration) map[string][]MetricPoint {
+	if a.history == nil {
+		return nil
+	}
+	metricsMap := a.history.GetAllStorageMetrics(storageID, duration)
+	return convertMetricsMap(metricsMap)
+}
+
+// convertMetricPoints converts from monitoring.MetricPoint to ai.MetricPoint
+func convertMetricPoints(points []monitoring.MetricPoint) []MetricPoint {
+	if points == nil {
+		return nil
+	}
+	result := make([]MetricPoint, len(points))
+	for i, p := range points {
+		result[i] = MetricPoint{
+			Value:     p.Value,
+			Timestamp: p.Timestamp,
+		}
+	}
+	return result
+}
+
+// convertMetricsMap converts a map of metric types to their points
+func convertMetricsMap(metricsMap map[string][]monitoring.MetricPoint) map[string][]MetricPoint {
+	if metricsMap == nil {
+		return nil
+	}
+	result := make(map[string][]MetricPoint, len(metricsMap))
+	for key, points := range metricsMap {
+		result[key] = convertMetricPoints(points)
+	}
+	return result
+}
diff --git a/internal/ai/patrol.go b/internal/ai/patrol.go
new file mode 100644
index 0000000..309c6aa
--- /dev/null
+++ b/internal/ai/patrol.go
@@ -0,0 +1,2230 @@
+package ai
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/baseline"
+	aicontext "github.com/rcourtman/pulse-go-rewrite/internal/ai/context"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/knowledge"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rs/zerolog/log"
+)
+
+// ThresholdProvider provides user-configured alert thresholds for patrol to use
+type ThresholdProvider interface {
+	// GetNodeCPUThreshold returns the CPU alert trigger threshold for nodes (0-100%)
+	GetNodeCPUThreshold() float64
+	// GetNodeMemoryThreshold returns the memory alert trigger threshold for nodes (0-100%)
+	GetNodeMemoryThreshold() float64
+	// GetGuestMemoryThreshold returns the memory alert trigger threshold for guests (0-100%)
+	GetGuestMemoryThreshold() float64
+	// GetGuestDiskThreshold returns the disk alert trigger threshold for guests (0-100%)
+	GetGuestDiskThreshold() float64
+	// GetStorageThreshold returns the usage alert trigger threshold for storage (0-100%)
+	GetStorageThreshold() float64
+}
+
+// PatrolThresholds holds calculated thresholds for patrol (derived from alert thresholds)
+type PatrolThresholds struct {
+	// Node thresholds
+	NodeCPUWatch    float64 // CPU % to flag as "watch" (typically alertThreshold - 15)
+	NodeCPUWarning  float64 // CPU % to flag as "warning" (typically alertThreshold - 5)
+	NodeMemWatch    float64
+	NodeMemWarning  float64
+	// Guest thresholds (VMs/containers)
+	GuestMemWatch   float64
+	GuestMemWarning float64
+	GuestDiskWatch  float64
+	GuestDiskWarn   float64
+	GuestDiskCrit   float64
+	// Storage thresholds
+	StorageWatch    float64
+	StorageWarning  float64
+	StorageCritical float64
+}
+
+// DefaultPatrolThresholds returns fallback thresholds when no provider is set
+func DefaultPatrolThresholds() PatrolThresholds {
+	return PatrolThresholds{
+		NodeCPUWatch:    75, NodeCPUWarning: 85,
+		NodeMemWatch:    75, NodeMemWarning: 85,
+		GuestMemWatch:   80, GuestMemWarning: 88,
+		GuestDiskWatch:  75, GuestDiskWarn: 85, GuestDiskCrit: 92,
+		StorageWatch:    70, StorageWarning: 80, StorageCritical: 90,
+	}
+}
+
+// CalculatePatrolThresholds derives patrol thresholds from alert thresholds
+// Patrol warns ~10% BEFORE the alert fires so users can take action early
+func CalculatePatrolThresholds(provider ThresholdProvider) PatrolThresholds {
+	if provider == nil {
+		return DefaultPatrolThresholds()
+	}
+
+	// Get user's alert thresholds
+	nodeCPU := provider.GetNodeCPUThreshold()
+	nodeMem := provider.GetNodeMemoryThreshold()
+	guestMem := provider.GetGuestMemoryThreshold()
+	guestDisk := provider.GetGuestDiskThreshold()
+	storage := provider.GetStorageThreshold()
+
+	// Calculate patrol thresholds (watch = alert-15%, warning = alert-5%)
+	return PatrolThresholds{
+		NodeCPUWatch:    clampThreshold(nodeCPU - 15),
+		NodeCPUWarning:  clampThreshold(nodeCPU - 5),
+		NodeMemWatch:    clampThreshold(nodeMem - 15),
+		NodeMemWarning:  clampThreshold(nodeMem - 5),
+		GuestMemWatch:   clampThreshold(guestMem - 12),
+		GuestMemWarning: clampThreshold(guestMem - 5),
+		GuestDiskWatch:  clampThreshold(guestDisk - 15),
+		GuestDiskWarn:   clampThreshold(guestDisk - 8),
+		GuestDiskCrit:   clampThreshold(guestDisk - 3),
+		StorageWatch:    clampThreshold(storage - 15),
+		StorageWarning:  clampThreshold(storage - 8),
+		StorageCritical: clampThreshold(storage - 3),
+	}
+}
+
+// clampThreshold ensures a threshold is within valid range
+func clampThreshold(v float64) float64 {
+	if v < 10 {
+		return 10 // Never go below 10%
+	}
+	if v > 99 {
+		return 99
+	}
+	return v
+}
+
+// PatrolConfig holds configuration for the AI patrol service
+type PatrolConfig struct {
+	// Enabled controls whether background patrol runs
+	Enabled bool `json:"enabled"`
+	// Interval is how often to run AI patrol analysis
+	Interval time.Duration `json:"interval"`
+	// QuickCheckInterval is deprecated, kept for backwards compat with old configs
+	QuickCheckInterval time.Duration `json:"quick_check_interval,omitempty"`
+	// DeepAnalysisInterval is deprecated, kept for backwards compat with old configs
+	DeepAnalysisInterval time.Duration `json:"deep_analysis_interval,omitempty"`
+	// AnalyzeNodes controls whether to analyze Proxmox nodes
+	AnalyzeNodes bool `json:"analyze_nodes"`
+	// AnalyzeGuests controls whether to analyze VMs/containers
+	AnalyzeGuests bool `json:"analyze_guests"`
+	// AnalyzeDocker controls whether to analyze Docker hosts
+	AnalyzeDocker bool `json:"analyze_docker"`
+	// AnalyzeStorage controls whether to analyze storage
+	AnalyzeStorage bool `json:"analyze_storage"`
+	// AnalyzePBS controls whether to analyze PBS backup servers
+	AnalyzePBS bool `json:"analyze_pbs"`
+	// AnalyzeHosts controls whether to analyze agent hosts (RAID, sensors)
+	AnalyzeHosts bool `json:"analyze_hosts"`
+}
+
+// GetInterval returns the effective patrol interval, handling migration from old config
+func (c PatrolConfig) GetInterval() time.Duration {
+	if c.Interval > 0 {
+		return c.Interval
+	}
+	// Migrate from old config: use QuickCheckInterval if set
+	if c.QuickCheckInterval > 0 {
+		return c.QuickCheckInterval
+	}
+	// Default to 15 minutes
+	return 15 * time.Minute
+}
+
+// DefaultPatrolConfig returns sensible defaults
+func DefaultPatrolConfig() PatrolConfig {
+	return PatrolConfig{
+		Enabled:       true,
+		Interval:      15 * time.Minute,
+		AnalyzeNodes:  true,
+		AnalyzeGuests: true,
+		AnalyzeDocker: true,
+		AnalyzeStorage: true,
+		AnalyzePBS:    true,
+		AnalyzeHosts:  true,
+	}
+}
+
+// PatrolStatus represents the current state of the patrol service
+type PatrolStatus struct {
+	Running          bool          `json:"running"`
+	Enabled          bool          `json:"enabled"`
+	LastPatrolAt     *time.Time    `json:"last_patrol_at,omitempty"`
+	NextPatrolAt     *time.Time    `json:"next_patrol_at,omitempty"`
+	LastDuration     time.Duration `json:"last_duration_ms"`
+	ResourcesChecked int           `json:"resources_checked"`
+	FindingsCount    int           `json:"findings_count"`
+	ErrorCount       int           `json:"error_count"`
+	Healthy          bool          `json:"healthy"`
+	IntervalMs       int64         `json:"interval_ms"` // Patrol interval in milliseconds
+}
+
+// PatrolRunRecord represents a single patrol check run
+type PatrolRunRecord struct {
+	ID               string        `json:"id"`
+	StartedAt        time.Time     `json:"started_at"`
+	CompletedAt      time.Time     `json:"completed_at"`
+	Duration         time.Duration `json:"duration_ms"`
+	Type             string        `json:"type"` // Always "patrol" now (kept for backwards compat)
+	ResourcesChecked int           `json:"resources_checked"`
+	// Breakdown by resource type
+	NodesChecked     int `json:"nodes_checked"`
+	GuestsChecked    int `json:"guests_checked"`
+	DockerChecked    int `json:"docker_checked"`
+	StorageChecked   int `json:"storage_checked"`
+	HostsChecked     int `json:"hosts_checked"`
+	PBSChecked       int `json:"pbs_checked"`
+	// Findings from this run
+	NewFindings      int      `json:"new_findings"`
+	ExistingFindings int      `json:"existing_findings"`
+	ResolvedFindings int      `json:"resolved_findings"`
+	FindingsSummary  string   `json:"findings_summary"`   // e.g., "All healthy" or "2 warnings, 1 critical"
+	FindingIDs       []string `json:"finding_ids"`        // IDs of findings from this run
+	ErrorCount       int      `json:"error_count"`
+	Status           string   `json:"status"` // "healthy", "issues_found", "error"
+	// AI Analysis details
+	AIAnalysis   string `json:"ai_analysis,omitempty"`   // The AI's raw response/analysis
+	InputTokens  int    `json:"input_tokens,omitempty"`  // Tokens sent to AI
+	OutputTokens int    `json:"output_tokens,omitempty"` // Tokens received from AI
+}
+
+// MaxPatrolRunHistory is the maximum number of patrol runs to keep in history
+const MaxPatrolRunHistory = 100
+
+// PatrolService runs background AI analysis of infrastructure
+type PatrolService struct {
+	mu sync.RWMutex
+
+	aiService           *Service
+	stateProvider       StateProvider
+	thresholdProvider   ThresholdProvider
+	config              PatrolConfig
+	findings            *FindingsStore
+	knowledgeStore      *knowledge.Store // For per-resource notes in patrol context
+	metricsHistory      MetricsHistoryProvider // For trend analysis and predictions
+	baselineStore       *baseline.Store  // For anomaly detection via learned baselines
+	changeDetector      *ChangeDetector  // For tracking infrastructure changes
+	remediationLog      *RemediationLog  // For tracking remediation actions
+	patternDetector     *PatternDetector // For failure prediction from historical patterns
+	correlationDetector *CorrelationDetector // For multi-resource correlation
+
+	// Cached thresholds (recalculated when thresholdProvider changes)
+	thresholds PatrolThresholds
+
+	// Runtime state
+	running          bool
+	stopCh           chan struct{}
+	configChanged    chan struct{} // Signal when config changes to reset ticker
+	lastPatrol       time.Time
+	lastDuration     time.Duration
+	resourcesChecked int
+	errorCount       int
+
+	// Patrol run history with persistence support
+	runHistoryStore *PatrolRunHistoryStore
+
+	// Live streaming support
+	streamMu          sync.RWMutex
+	streamSubscribers map[chan PatrolStreamEvent]struct{}
+	currentOutput     strings.Builder // Buffer for current streaming output
+	streamPhase       string          // "idle", "analyzing", "complete"
+}
+
+// PatrolStreamEvent represents a streaming update from the patrol
+type PatrolStreamEvent struct {
+	Type    string `json:"type"`    // "start", "content", "phase", "complete", "error"
+	Content string `json:"content,omitempty"`
+	Phase   string `json:"phase,omitempty"`   // Current phase description
+	Tokens  int    `json:"tokens,omitempty"`  // Token count so far
+}
+
+// NewPatrolService creates a new patrol service
+func NewPatrolService(aiService *Service, stateProvider StateProvider) *PatrolService {
+	return &PatrolService{
+		aiService:         aiService,
+		stateProvider:     stateProvider,
+		config:            DefaultPatrolConfig(),
+		findings:          NewFindingsStore(),
+		thresholds:        DefaultPatrolThresholds(),
+		stopCh:            make(chan struct{}),
+		runHistoryStore:   NewPatrolRunHistoryStore(MaxPatrolRunHistory),
+		streamSubscribers: make(map[chan PatrolStreamEvent]struct{}),
+		streamPhase:       "idle",
+	}
+}
+
+// SetConfig updates the patrol configuration
+func (p *PatrolService) SetConfig(cfg PatrolConfig) {
+	p.mu.Lock()
+	oldInterval := p.config.QuickCheckInterval
+	p.config = cfg
+	configCh := p.configChanged
+	p.mu.Unlock()
+
+	// Signal config change if patrol is running and interval changed
+	if configCh != nil && cfg.QuickCheckInterval != oldInterval {
+		select {
+		case configCh <- struct{}{}:
+			log.Info().
+				Dur("old_interval", oldInterval).
+				Dur("new_interval", cfg.QuickCheckInterval).
+				Msg("Patrol interval updated, resetting ticker")
+		default:
+			// Channel full or not ready, config will be picked up on next cycle
+		}
+	}
+}
+
+// SetThresholdProvider sets the provider for user-configured alert thresholds
+// This allows patrol to warn BEFORE alerts fire
+func (p *PatrolService) SetThresholdProvider(provider ThresholdProvider) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.thresholdProvider = provider
+	p.thresholds = CalculatePatrolThresholds(provider)
+	log.Debug().
+		Float64("storageWatch", p.thresholds.StorageWatch).
+		Float64("storageWarning", p.thresholds.StorageWarning).
+		Float64("storageCritical", p.thresholds.StorageCritical).
+		Msg("Patrol thresholds updated from alert config")
+}
+
+// SetFindingsPersistence enables findings persistence (load from and save to disk)
+// This should be called before Start() to load any existing findings
+func (p *PatrolService) SetFindingsPersistence(persistence FindingsPersistence) error {
+	p.mu.Lock()
+	findings := p.findings
+	p.mu.Unlock()
+
+	if findings != nil && persistence != nil {
+		if err := findings.SetPersistence(persistence); err != nil {
+			return err
+		}
+		log.Info().Msg("AI Patrol findings persistence enabled")
+	}
+	return nil
+}
+
+// SetRunHistoryPersistence enables patrol run history persistence (load from and save to disk)
+// This should be called before Start() to load any existing history
+func (p *PatrolService) SetRunHistoryPersistence(persistence PatrolHistoryPersistence) error {
+	p.mu.Lock()
+	store := p.runHistoryStore
+	p.mu.Unlock()
+
+	if store != nil && persistence != nil {
+		if err := store.SetPersistence(persistence); err != nil {
+			return err
+		}
+		log.Info().Msg("AI Patrol run history persistence enabled")
+	}
+	return nil
+}
+
+// SetKnowledgeStore sets the knowledge store for including per-resource notes in patrol context
+func (p *PatrolService) SetKnowledgeStore(store *knowledge.Store) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.knowledgeStore = store
+}
+
+// SetMetricsHistoryProvider sets the metrics history provider for enriched context
+// This enables the patrol service to compute trends and predictions based on historical data
+func (p *PatrolService) SetMetricsHistoryProvider(provider MetricsHistoryProvider) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.metricsHistory = provider
+	log.Info().Msg("AI Patrol: Metrics history provider set for enriched context")
+}
+
+// SetBaselineStore sets the baseline store for anomaly detection
+// This enables the patrol service to detect anomalies based on learned normal behavior
+func (p *PatrolService) SetBaselineStore(store *baseline.Store) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.baselineStore = store
+	log.Info().Msg("AI Patrol: Baseline store set for anomaly detection")
+}
+
+// GetBaselineStore returns the baseline store (for external baseline learning)
+func (p *PatrolService) GetBaselineStore() *baseline.Store {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.baselineStore
+}
+
+// SetChangeDetector sets the change detector for tracking infrastructure changes
+func (p *PatrolService) SetChangeDetector(detector *ChangeDetector) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.changeDetector = detector
+	log.Info().Msg("AI Patrol: Change detector set for operational memory")
+}
+
+// SetRemediationLog sets the remediation log for tracking fix attempts
+func (p *PatrolService) SetRemediationLog(remLog *RemediationLog) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.remediationLog = remLog
+	log.Info().Msg("AI Patrol: Remediation log set for operational memory")
+}
+
+// GetRemediationLog returns the remediation log (for logging actions)
+func (p *PatrolService) GetRemediationLog() *RemediationLog {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.remediationLog
+}
+
+// SetPatternDetector sets the pattern detector for failure prediction
+func (p *PatrolService) SetPatternDetector(detector *PatternDetector) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.patternDetector = detector
+	log.Info().Msg("AI Patrol: Pattern detector set for failure prediction")
+}
+
+// GetPatternDetector returns the pattern detector
+func (p *PatrolService) GetPatternDetector() *PatternDetector {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.patternDetector
+}
+
+// SetCorrelationDetector sets the correlation detector for multi-resource correlation
+func (p *PatrolService) SetCorrelationDetector(detector *CorrelationDetector) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.correlationDetector = detector
+	log.Info().Msg("AI Patrol: Correlation detector set for multi-resource analysis")
+}
+
+// GetCorrelationDetector returns the correlation detector
+func (p *PatrolService) GetCorrelationDetector() *CorrelationDetector {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.correlationDetector
+}
+
+// GetChangeDetector returns the change detector
+func (p *PatrolService) GetChangeDetector() *ChangeDetector {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.changeDetector
+}
+
+// GetConfig returns the current patrol configuration
+func (p *PatrolService) GetConfig() PatrolConfig {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	return p.config
+}
+
+// GetFindings returns the findings store
+func (p *PatrolService) GetFindings() *FindingsStore {
+	return p.findings
+}
+
+// GetStatus returns the current patrol status
+func (p *PatrolService) GetStatus() PatrolStatus {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	interval := p.config.GetInterval()
+	intervalMs := int64(interval / time.Millisecond)
+
+	// "Running" means an analysis is currently in progress, not just the service loop
+	// Check streamPhase to determine if we're actively analyzing
+	p.streamMu.RLock()
+	analysisInProgress := p.streamPhase == "analyzing"
+	p.streamMu.RUnlock()
+
+	status := PatrolStatus{
+		Running:          analysisInProgress,
+		Enabled:          p.config.Enabled,
+		LastDuration:     p.lastDuration,
+		ResourcesChecked: p.resourcesChecked,
+		FindingsCount:    len(p.findings.GetActive(FindingSeverityInfo)),
+		ErrorCount:       p.errorCount,
+		IntervalMs:       intervalMs,
+	}
+
+	if !p.lastPatrol.IsZero() {
+		status.LastPatrolAt = &p.lastPatrol
+	}
+
+	// Calculate next patrol time if we have interval and last patrol time
+	if interval > 0 && !p.lastPatrol.IsZero() {
+		next := p.lastPatrol.Add(interval)
+		status.NextPatrolAt = &next
+	}
+
+	summary := p.findings.GetSummary()
+	status.Healthy = summary.IsHealthy()
+
+	return status
+}
+
+// SubscribeToStream returns a channel that will receive streaming patrol events
+func (p *PatrolService) SubscribeToStream() chan PatrolStreamEvent {
+	ch := make(chan PatrolStreamEvent, 100) // Buffered to prevent blocking
+
+	p.streamMu.Lock()
+	p.streamSubscribers[ch] = struct{}{}
+	// Send current state to new subscriber
+	if p.streamPhase != "idle" {
+		ch <- PatrolStreamEvent{
+			Type:    "content",
+			Content: p.currentOutput.String(),
+			Phase:   p.streamPhase,
+		}
+	}
+	p.streamMu.Unlock()
+
+	return ch
+}
+
+// UnsubscribeFromStream removes a subscriber
+func (p *PatrolService) UnsubscribeFromStream(ch chan PatrolStreamEvent) {
+	p.streamMu.Lock()
+	delete(p.streamSubscribers, ch)
+	p.streamMu.Unlock()
+	close(ch)
+}
+
+// broadcast sends an event to all subscribers
+func (p *PatrolService) broadcast(event PatrolStreamEvent) {
+	p.streamMu.RLock()
+	defer p.streamMu.RUnlock()
+
+	for ch := range p.streamSubscribers {
+		select {
+		case ch <- event:
+		default:
+			// Channel full, skip (don't block on slow consumers)
+		}
+	}
+}
+
+// appendStreamContent adds content to the current output and broadcasts it
+func (p *PatrolService) appendStreamContent(content string) {
+	p.streamMu.Lock()
+	p.currentOutput.WriteString(content)
+	p.streamMu.Unlock()
+
+	p.broadcast(PatrolStreamEvent{
+		Type:    "content",
+		Content: content,
+	})
+}
+
+// setStreamPhase updates the current phase (internal state tracking only)
+// Does not broadcast phase changes - those are explicit via broadcast()
+func (p *PatrolService) setStreamPhase(phase string) {
+	p.streamMu.Lock()
+	p.streamPhase = phase
+	if phase == "idle" {
+		p.currentOutput.Reset()
+	}
+	p.streamMu.Unlock()
+	// Note: We don't broadcast phase changes automatically
+	// The patrol explicitly broadcasts "start" and "complete" events
+}
+
+// GetCurrentStreamOutput returns the current buffered output (for late joiners)
+func (p *PatrolService) GetCurrentStreamOutput() (string, string) {
+	p.streamMu.RLock()
+	defer p.streamMu.RUnlock()
+	return p.currentOutput.String(), p.streamPhase
+}
+
+// Start begins the background patrol loop
+func (p *PatrolService) Start(ctx context.Context) {
+	p.mu.Lock()
+	if p.running {
+		p.mu.Unlock()
+		return
+	}
+	p.running = true
+	p.stopCh = make(chan struct{})
+	p.configChanged = make(chan struct{}, 1) // Buffered to allow non-blocking send
+	p.mu.Unlock()
+
+	log.Info().
+		Dur("interval", p.config.GetInterval()).
+		Msg("Starting AI Patrol Service")
+
+	go p.patrolLoop(ctx)
+}
+
+// Stop stops the patrol service
+func (p *PatrolService) Stop() {
+	p.mu.Lock()
+	if !p.running {
+		p.mu.Unlock()
+		return
+	}
+	p.running = false
+	close(p.stopCh)
+	p.mu.Unlock()
+
+	log.Info().Msg("Stopping AI Patrol Service")
+}
+
+// patrolLoop is the main background loop
+func (p *PatrolService) patrolLoop(ctx context.Context) {
+	// Run initial quick patrol shortly after startup
+	initialDelay := 30 * time.Second
+	select {
+	case <-time.After(initialDelay):
+		p.runPatrol(ctx)
+	case <-p.stopCh:
+		return
+	case <-ctx.Done():
+		return
+	}
+
+	p.mu.RLock()
+	interval := p.config.GetInterval()
+	configCh := p.configChanged
+	p.mu.RUnlock()
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			p.runPatrol(ctx)
+
+		case <-configCh:
+			// Config changed - reset ticker with new interval
+			p.mu.RLock()
+			newInterval := p.config.GetInterval()
+			p.mu.RUnlock()
+
+			if newInterval != interval {
+				interval = newInterval
+				ticker.Reset(interval)
+				log.Info().
+					Dur("interval", interval).
+					Msg("Patrol ticker reset to new interval")
+			}
+
+		case <-p.stopCh:
+			return
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+// runPatrol executes a patrol run
+func (p *PatrolService) runPatrol(ctx context.Context) {
+	p.mu.RLock()
+	cfg := p.config
+	p.mu.RUnlock()
+
+	if !cfg.Enabled {
+		return
+	}
+
+	// Check if AI service is enabled
+	if p.aiService == nil || !p.aiService.IsEnabled() {
+		log.Debug().Msg("AI Patrol: AI service not enabled, skipping patrol")
+		return
+	}
+
+	start := time.Now()
+	patrolType := "patrol" // Simplified - no longer distinguishing quick/deep
+
+	log.Debug().Msg("AI Patrol: Starting patrol run")
+
+	// Track run statistics
+	var runStats struct {
+		resourceCount    int
+		nodesChecked     int
+		guestsChecked    int
+		dockerChecked    int
+		storageChecked   int
+		hostsChecked     int
+		pbsChecked       int
+		newFindings      int
+		existingFindings int
+		findingIDs       []string
+		errors           int
+		aiAnalysis       *AIAnalysisResult // Stores the AI's analysis for the run record
+	}
+
+	// Get current state
+	if p.stateProvider == nil {
+		log.Warn().Msg("AI Patrol: No state provider available")
+		return
+	}
+
+	state := p.stateProvider.GetState()
+
+	// Helper to track findings
+	trackFinding := func(f *Finding) bool {
+		isNew := p.findings.Add(f)
+		if isNew {
+			runStats.newFindings++
+			log.Info().
+				Str("finding_id", f.ID).
+				Str("severity", string(f.Severity)).
+				Str("resource", f.ResourceName).
+				Str("title", f.Title).
+				Msg("AI Patrol: New finding")
+		} else {
+			runStats.existingFindings++
+		}
+		runStats.findingIDs = append(runStats.findingIDs, f.ID)
+		return isNew
+	}
+
+	// Count resources for statistics (but analysis is done by LLM only)
+	runStats.nodesChecked = len(state.Nodes)
+	runStats.guestsChecked = len(state.VMs) + len(state.Containers)
+	runStats.dockerChecked = len(state.DockerHosts)
+	runStats.storageChecked = len(state.Storage)
+	runStats.pbsChecked = len(state.PBSInstances)
+	runStats.hostsChecked = len(state.Hosts)
+	runStats.resourceCount = runStats.nodesChecked + runStats.guestsChecked + 
+		runStats.dockerChecked + runStats.storageChecked + runStats.pbsChecked + runStats.hostsChecked
+
+	// Run AI analysis using the LLM - this is the ONLY analysis method
+	// The LLM analyzes the infrastructure and identifies issues
+	aiResult, aiErr := p.runAIAnalysis(ctx, state)
+	if aiErr != nil {
+		log.Warn().Err(aiErr).Msg("AI Patrol: LLM analysis failed")
+		runStats.errors++
+	} else if aiResult != nil {
+		runStats.aiAnalysis = aiResult
+		for _, f := range aiResult.Findings {
+			trackFinding(f)
+		}
+	}
+
+	// Auto-resolve findings that weren't seen in this patrol run
+	resolvedCount := p.autoResolveStaleFindings(start)
+
+	// Cleanup old resolved findings
+	cleaned := p.findings.Cleanup(24 * time.Hour)
+	if cleaned > 0 {
+		log.Debug().Int("cleaned", cleaned).Msg("AI Patrol: Cleaned up old findings")
+	}
+
+	duration := time.Since(start)
+	completedAt := time.Now()
+
+	// Build findings summary string
+	summary := p.findings.GetSummary()
+	var findingsSummaryStr string
+	var status string
+	totalActive := summary.Critical + summary.Warning + summary.Watch
+	if totalActive == 0 {
+		findingsSummaryStr = "All healthy"
+		status = "healthy"
+	} else {
+		parts := []string{}
+		if summary.Critical > 0 {
+			parts = append(parts, fmt.Sprintf("%d critical", summary.Critical))
+		}
+		if summary.Warning > 0 {
+			parts = append(parts, fmt.Sprintf("%d warning", summary.Warning))
+		}
+		if summary.Watch > 0 {
+			parts = append(parts, fmt.Sprintf("%d watch", summary.Watch))
+		}
+		findingsSummaryStr = fmt.Sprintf("%s", joinParts(parts))
+		if summary.Critical > 0 {
+			status = "critical"
+		} else {
+			status = "issues_found"
+		}
+	}
+	if runStats.errors > 0 {
+		status = "error"
+	}
+
+	// Create run record
+	runRecord := PatrolRunRecord{
+		ID:               fmt.Sprintf("%d", start.UnixNano()),
+		StartedAt:        start,
+		CompletedAt:      completedAt,
+		Duration:         duration,
+		Type:             patrolType,
+		ResourcesChecked: runStats.resourceCount,
+		NodesChecked:     runStats.nodesChecked,
+		GuestsChecked:    runStats.guestsChecked,
+		DockerChecked:    runStats.dockerChecked,
+		StorageChecked:   runStats.storageChecked,
+		HostsChecked:     runStats.hostsChecked,
+		PBSChecked:       runStats.pbsChecked,
+		NewFindings:      runStats.newFindings,
+		ExistingFindings: runStats.existingFindings,
+		ResolvedFindings: resolvedCount,
+		FindingsSummary:  findingsSummaryStr,
+		FindingIDs:       runStats.findingIDs,
+		ErrorCount:       runStats.errors,
+		Status:           status,
+	}
+
+	// Add AI analysis details if available
+	if runStats.aiAnalysis != nil {
+		runRecord.AIAnalysis = runStats.aiAnalysis.Response
+		runRecord.InputTokens = runStats.aiAnalysis.InputTokens
+		runRecord.OutputTokens = runStats.aiAnalysis.OutputTokens
+		log.Debug().
+			Int("response_length", len(runStats.aiAnalysis.Response)).
+			Int("input_tokens", runStats.aiAnalysis.InputTokens).
+			Int("output_tokens", runStats.aiAnalysis.OutputTokens).
+			Msg("AI Patrol: Storing AI analysis in run record")
+	} else {
+		log.Debug().Msg("AI Patrol: No AI analysis to store (aiAnalysis is nil)")
+	}
+
+	p.mu.Lock()
+	p.lastPatrol = completedAt
+	p.lastDuration = duration
+	p.resourcesChecked = runStats.resourceCount
+	p.errorCount = runStats.errors
+	p.mu.Unlock()
+
+	// Add to history store (handles persistence automatically)
+	p.runHistoryStore.Add(runRecord)
+
+	log.Info().
+		Str("type", patrolType).
+		Dur("duration", duration).
+		Int("resources", runStats.resourceCount).
+		Int("new_findings", runStats.newFindings).
+		Int("resolved", resolvedCount).
+		Int("critical", summary.Critical).
+		Int("warning", summary.Warning).
+		Int("watch", summary.Watch).
+		Msg("AI Patrol: Completed patrol run")
+}
+
+// joinParts joins string parts with commas and "and" for the last element
+func joinParts(parts []string) string {
+	if len(parts) == 0 {
+		return ""
+	}
+	if len(parts) == 1 {
+		return parts[0]
+	}
+	if len(parts) == 2 {
+		return parts[0] + " and " + parts[1]
+	}
+	return fmt.Sprintf("%s, and %s", 
+		fmt.Sprintf("%s", parts[0:len(parts)-1]),
+		parts[len(parts)-1])
+}
+
+// generateFindingID creates a stable ID for a finding based on resource and issue
+func generateFindingID(resourceID, category, issue string) string {
+	hash := sha256.Sum256([]byte(fmt.Sprintf("%s:%s:%s", resourceID, category, issue)))
+	return fmt.Sprintf("%x", hash[:8])
+}
+
+// analyzeNode checks a Proxmox node for issues
+func (p *PatrolService) analyzeNode(node models.Node) []*Finding {
+	var findings []*Finding
+
+	// Calculate memory usage from Memory struct (as percentage 0-100)
+	var memUsagePct float64
+	if node.Memory.Total > 0 {
+		memUsagePct = float64(node.Memory.Used) / float64(node.Memory.Total) * 100
+	}
+
+	// CPU as percentage (node.CPU is 0-1 ratio from Proxmox)
+	cpuPct := node.CPU * 100
+
+	// Check for offline nodes
+	if node.Status == "offline" || node.Status == "unknown" {
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(node.ID, "reliability", "offline"),
+			Severity:       FindingSeverityCritical,
+			Category:       FindingCategoryReliability,
+			ResourceID:     node.ID,
+			ResourceName:   node.Name,
+			ResourceType:   "node",
+			Title:          "Node offline",
+			Description:    fmt.Sprintf("Node '%s' is not responding", node.Name),
+			Recommendation: "Check network connectivity, SSH access, and Proxmox services on the node",
+		})
+	}
+
+	// High CPU - use dynamic thresholds from user's alert config
+	if cpuPct > p.thresholds.NodeCPUWatch {
+		severity := FindingSeverityWatch
+		if cpuPct > p.thresholds.NodeCPUWarning {
+			severity = FindingSeverityWarning
+		}
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(node.ID, "performance", "high-cpu"),
+			Severity:       severity,
+			Category:       FindingCategoryPerformance,
+			ResourceID:     node.ID,
+			ResourceName:   node.Name,
+			ResourceType:   "node",
+			Title:          "High CPU usage",
+			Description:    fmt.Sprintf("Node '%s' CPU at %.0f%%", node.Name, cpuPct),
+			Recommendation: "Check which VMs/containers are consuming CPU. Consider load balancing.",
+			Evidence:       fmt.Sprintf("CPU: %.1f%%", cpuPct),
+		})
+	}
+
+	// High memory - use dynamic thresholds
+	if memUsagePct > p.thresholds.NodeMemWatch {
+		severity := FindingSeverityWatch
+		if memUsagePct > p.thresholds.NodeMemWarning {
+			severity = FindingSeverityWarning
+		}
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(node.ID, "performance", "high-memory"),
+			Severity:       severity,
+			Category:       FindingCategoryPerformance,
+			ResourceID:     node.ID,
+			ResourceName:   node.Name,
+			ResourceType:   "node",
+			Title:          "High memory usage",
+			Description:    fmt.Sprintf("Node '%s' memory at %.0f%%", node.Name, memUsagePct),
+			Recommendation: "Consider migrating some VMs to other nodes or increasing node RAM",
+			Evidence:       fmt.Sprintf("Memory: %.1f%%", memUsagePct),
+		})
+	}
+
+	return findings
+}
+
+// analyzeGuest checks a VM or container for issues
+// Note: cpu is 0-1 ratio, memUsage and diskUsage are already 0-100 percentages from Memory.Usage/Disk.Usage
+func (p *PatrolService) analyzeGuest(id, name, guestType, node, status string,
+	cpu, memUsage, diskUsage float64, lastBackup *time.Time, template bool) []*Finding {
+	var findings []*Finding
+
+	// Skip templates
+	if template {
+		return findings
+	}
+
+	// memUsage and diskUsage are already percentages (0-100)
+	memPct := memUsage
+	diskPct := diskUsage
+
+	// High memory (sustained) - use dynamic thresholds
+	if memPct > p.thresholds.GuestMemWatch {
+		severity := FindingSeverityWatch
+		if memPct > p.thresholds.GuestMemWarning {
+			severity = FindingSeverityWarning
+		}
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(id, "performance", "high-memory"),
+			Severity:       severity,
+			Category:       FindingCategoryPerformance,
+			ResourceID:     id,
+			ResourceName:   name,
+			ResourceType:   guestType,
+			Node:           node,
+			Title:          "High memory usage",
+			Description:    fmt.Sprintf("'%s' memory at %.0f%% - risk of OOM", name, memPct),
+			Recommendation: "Consider increasing allocated RAM or investigating memory-hungry processes",
+			Evidence:       fmt.Sprintf("Memory: %.1f%%", memPct),
+		})
+	}
+
+	// High disk usage - use dynamic thresholds
+	if diskPct > p.thresholds.GuestDiskWatch {
+		severity := FindingSeverityWatch
+		if diskPct > p.thresholds.GuestDiskWarn {
+			severity = FindingSeverityWarning
+		}
+		if diskPct > p.thresholds.GuestDiskCrit {
+			severity = FindingSeverityCritical
+		}
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(id, "capacity", "high-disk"),
+			Severity:       severity,
+			Category:       FindingCategoryCapacity,
+			ResourceID:     id,
+			ResourceName:   name,
+			ResourceType:   guestType,
+			Node:           node,
+			Title:          "High disk usage",
+			Description:    fmt.Sprintf("'%s' disk at %.0f%%", name, diskPct),
+			Recommendation: "Clean up old files, logs, or docker images. Consider expanding disk.",
+			Evidence:       fmt.Sprintf("Disk: %.1f%%", diskPct),
+		})
+	}
+
+	// Backup check (only for running guests)
+	if status == "running" && lastBackup != nil {
+		daysSinceBackup := time.Since(*lastBackup).Hours() / 24
+		if daysSinceBackup > 14 {
+			severity := FindingSeverityWatch
+			if daysSinceBackup > 30 {
+				severity = FindingSeverityWarning
+			}
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(id, "backup", "stale"),
+				Severity:       severity,
+				Category:       FindingCategoryBackup,
+				ResourceID:     id,
+				ResourceName:   name,
+				ResourceType:   guestType,
+				Node:           node,
+				Title:          "Backup overdue",
+				Description:    fmt.Sprintf("'%s' hasn't been backed up in %.0f days", name, daysSinceBackup),
+				Recommendation: "Check backup job configuration or run a manual backup",
+				Evidence:       fmt.Sprintf("Last backup: %s", lastBackup.Format("2006-01-02")),
+			})
+		}
+	} else if status == "running" && lastBackup == nil {
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(id, "backup", "never"),
+			Severity:       FindingSeverityWarning,
+			Category:       FindingCategoryBackup,
+			ResourceID:     id,
+			ResourceName:   name,
+			ResourceType:   guestType,
+			Node:           node,
+			Title:          "Never backed up",
+			Description:    fmt.Sprintf("'%s' has no backup history", name),
+			Recommendation: "Configure backup job for this guest",
+		})
+	}
+
+	return findings
+}
+
+// analyzeDockerHost checks a Docker host for issues
+func (p *PatrolService) analyzeDockerHost(host models.DockerHost) []*Finding {
+	var findings []*Finding
+
+	hostName := host.Hostname
+	if host.DisplayName != "" {
+		hostName = host.DisplayName
+	}
+
+	// Host offline
+	if host.Status != "online" && host.Status != "connected" {
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(host.ID, "reliability", "offline"),
+			Severity:       FindingSeverityCritical,
+			Category:       FindingCategoryReliability,
+			ResourceID:     host.ID,
+			ResourceName:   hostName,
+			ResourceType:   "docker_host",
+			Title:          "Docker host offline",
+			Description:    fmt.Sprintf("Docker host '%s' is not responding", hostName),
+			Recommendation: "Check network connectivity and docker-agent service",
+		})
+	}
+
+	// Check individual containers
+	for _, c := range host.Containers {
+		// Restarting containers
+		if c.State == "restarting" || c.RestartCount > 3 {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(c.ID, "reliability", "restart-loop"),
+				Severity:       FindingSeverityWarning,
+				Category:       FindingCategoryReliability,
+				ResourceID:     c.ID,
+				ResourceName:   c.Name,
+				ResourceType:   "docker_container",
+				Node:           hostName,
+				Title:          "Container restart loop",
+				Description:    fmt.Sprintf("Container '%s' has restarted %d times", c.Name, c.RestartCount),
+				Recommendation: "Check container logs: docker logs " + c.Name,
+				Evidence:       fmt.Sprintf("State: %s, Restarts: %d", c.State, c.RestartCount),
+			})
+		}
+
+		// High memory containers
+		if c.MemoryPercent > 90 {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(c.ID, "performance", "high-memory"),
+				Severity:       FindingSeverityWatch,
+				Category:       FindingCategoryPerformance,
+				ResourceID:     c.ID,
+				ResourceName:   c.Name,
+				ResourceType:   "docker_container",
+				Node:           hostName,
+				Title:          "High memory usage",
+				Description:    fmt.Sprintf("Container '%s' using %.0f%% of allocated memory", c.Name, c.MemoryPercent),
+				Recommendation: "Consider increasing container memory limit",
+				Evidence:       fmt.Sprintf("Memory: %.1f%%", c.MemoryPercent),
+			})
+		}
+	}
+
+	return findings
+}
+
+// analyzeStorage checks storage for issues
+func (p *PatrolService) analyzeStorage(storage models.Storage) []*Finding {
+	var findings []*Finding
+
+	// Note: storage.Usage is already a percentage (0-100, e.g. 85.5 means 85.5%)
+	// If Usage is 0 but we have bytes data, calculate it as percentage
+	usage := storage.Usage
+	if usage == 0 && storage.Total > 0 {
+		usage = float64(storage.Used) / float64(storage.Total) * 100
+	}
+
+	// High storage usage - use dynamic thresholds from user's alert config
+	if usage > p.thresholds.StorageWatch {
+		severity := FindingSeverityWatch
+		if usage > p.thresholds.StorageWarning {
+			severity = FindingSeverityWarning
+		}
+		if usage > p.thresholds.StorageCritical {
+			severity = FindingSeverityCritical
+		}
+
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(storage.ID, "capacity", "high-usage"),
+			Severity:       severity,
+			Category:       FindingCategoryCapacity,
+			ResourceID:     storage.ID,
+			ResourceName:   storage.Name,
+			ResourceType:   "storage",
+			Title:          "Storage filling up",
+			Description:    fmt.Sprintf("Storage '%s' at %.0f%% capacity", storage.Name, usage),
+			Recommendation: "Clean up old backups, snapshots, or unused disk images",
+			Evidence:       fmt.Sprintf("Usage: %.1f%%", usage),
+		})
+	}
+
+	return findings
+}
+
+// autoResolveHealthyResources marks findings as resolved when they weren't seen in the current patrol
+// patrolStartTime is used to determine which findings are stale (LastSeenAt < patrolStartTime)
+// Returns the count of findings that were resolved
+func (p *PatrolService) autoResolveStaleFindings(patrolStartTime time.Time) int {
+	// Get all active findings and check if they're stale
+	activeFindings := p.findings.GetActive(FindingSeverityInfo)
+	resolvedCount := 0
+	
+	for _, f := range activeFindings {
+		// If the finding wasn't updated during this patrol (LastSeenAt is before patrol started),
+		// it means the condition that caused it has been resolved
+		if f.LastSeenAt.Before(patrolStartTime) {
+			if p.findings.Resolve(f.ID, true) {
+				resolvedCount++
+				log.Info().
+					Str("finding_id", f.ID).
+					Str("resource", f.ResourceName).
+					Str("title", f.Title).
+					Msg("AI Patrol: Auto-resolved finding")
+			}
+		}
+	}
+	return resolvedCount
+}
+
+// GetFindingsForResource returns active findings for a specific resource
+func (p *PatrolService) GetFindingsForResource(resourceID string) []*Finding {
+	return p.findings.GetByResource(resourceID)
+}
+
+// GetFindingsSummary returns a summary of all findings
+func (p *PatrolService) GetFindingsSummary() FindingsSummary {
+	return p.findings.GetSummary()
+}
+
+// ResolveFinding marks a finding as resolved with a resolution note
+// This is called when the AI successfully fixes an issue
+func (p *PatrolService) ResolveFinding(findingID string, resolutionNote string) error {
+	if findingID == "" {
+		return fmt.Errorf("finding ID is required")
+	}
+
+	// Get the finding first to update its resolution note
+	finding := p.findings.Get(findingID)
+	if finding == nil {
+		return fmt.Errorf("finding not found: %s", findingID)
+	}
+
+	// Update the user note with the resolution
+	finding.UserNote = resolutionNote
+
+	// Mark as resolved (not auto-resolved since user/AI initiated it)
+	if !p.findings.Resolve(findingID, false) {
+		return fmt.Errorf("failed to resolve finding: %s", findingID)
+	}
+
+	log.Info().
+		Str("finding_id", findingID).
+		Str("resolution_note", resolutionNote).
+		Msg("AI resolved finding")
+
+	return nil
+}
+
+// GetRunHistory returns the history of patrol runs
+// If limit is > 0, returns at most that many records
+func (p *PatrolService) GetRunHistory(limit int) []PatrolRunRecord {
+	if limit <= 0 {
+		return p.runHistoryStore.GetAll()
+	}
+	return p.runHistoryStore.GetRecent(limit)
+}
+
+// GetAllFindings returns all active findings sorted by severity
+func (p *PatrolService) GetAllFindings() []*Finding {
+	findings := p.findings.GetActive(FindingSeverityInfo)
+	
+	// Sort by severity (critical first) then by time
+	severityOrder := map[FindingSeverity]int{
+		FindingSeverityCritical: 0,
+		FindingSeverityWarning:  1,
+		FindingSeverityWatch:    2,
+		FindingSeverityInfo:     3,
+	}
+	
+	sort.Slice(findings, func(i, j int) bool {
+		if severityOrder[findings[i].Severity] != severityOrder[findings[j].Severity] {
+			return severityOrder[findings[i].Severity] < severityOrder[findings[j].Severity]
+		}
+		return findings[i].DetectedAt.After(findings[j].DetectedAt)
+	})
+	
+	return findings
+}
+
+// GetFindingsHistory returns all findings including resolved ones for history display
+// Optionally filter by startTime
+func (p *PatrolService) GetFindingsHistory(startTime *time.Time) []*Finding {
+	findings := p.findings.GetAll(startTime)
+	
+	// Sort by detected time (newest first)
+	sort.Slice(findings, func(i, j int) bool {
+		return findings[i].DetectedAt.After(findings[j].DetectedAt)
+	})
+	
+	return findings
+}
+
+// ForcePatrol triggers an immediate patrol run
+// The deep parameter is kept for API backwards compatibility but is ignored
+// Uses context.Background() since this runs async after the HTTP response
+func (p *PatrolService) ForcePatrol(ctx context.Context, deep bool) {
+	go p.runPatrol(context.Background())
+}
+
+// analyzePBSInstance checks a PBS backup server for issues
+func (p *PatrolService) analyzePBSInstance(pbs models.PBSInstance, allBackups []models.PBSBackup) []*Finding {
+	var findings []*Finding
+
+	pbsName := pbs.Name
+	if pbsName == "" {
+		pbsName = pbs.Host
+	}
+
+	// Check PBS connectivity
+	if pbs.Status != "online" && pbs.Status != "connected" && pbs.Status != "" {
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(pbs.ID, "reliability", "offline"),
+			Severity:       FindingSeverityCritical,
+			Category:       FindingCategoryReliability,
+			ResourceID:     pbs.ID,
+			ResourceName:   pbsName,
+			ResourceType:   "pbs",
+			Title:          "PBS server offline",
+			Description:    fmt.Sprintf("Proxmox Backup Server '%s' is not responding", pbsName),
+			Recommendation: "Check network connectivity and PBS service status",
+		})
+	}
+
+	// Check each datastore capacity
+	for _, ds := range pbs.Datastores {
+		usage := ds.Usage
+		if usage == 0 && ds.Total > 0 {
+			usage = float64(ds.Used) / float64(ds.Total) * 100
+		}
+
+		// PBS datastores should trigger earlier than regular storage
+		// since running out of backup space is critical
+		if usage > p.thresholds.StorageWatch {
+			severity := FindingSeverityWatch
+			if usage > p.thresholds.StorageWarning {
+				severity = FindingSeverityWarning
+			}
+			if usage > p.thresholds.StorageCritical {
+				severity = FindingSeverityCritical
+			}
+
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(pbs.ID+":"+ds.Name, "capacity", "high-usage"),
+				Severity:       severity,
+				Category:       FindingCategoryCapacity,
+				ResourceID:     pbs.ID + ":" + ds.Name,
+				ResourceName:   fmt.Sprintf("%s/%s", pbsName, ds.Name),
+				ResourceType:   "pbs_datastore",
+				Title:          "PBS datastore filling up",
+				Description:    fmt.Sprintf("Datastore '%s' on PBS '%s' at %.0f%% capacity", ds.Name, pbsName, usage),
+				Recommendation: "Run garbage collection, prune old backups, or expand storage",
+				Evidence:       fmt.Sprintf("Usage: %.1f%%", usage),
+			})
+		}
+
+		// Check for datastore errors
+		if ds.Error != "" {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(pbs.ID+":"+ds.Name, "reliability", "error"),
+				Severity:       FindingSeverityCritical,
+				Category:       FindingCategoryReliability,
+				ResourceID:     pbs.ID + ":" + ds.Name,
+				ResourceName:   fmt.Sprintf("%s/%s", pbsName, ds.Name),
+				ResourceType:   "pbs_datastore",
+				Title:          "PBS datastore error",
+				Description:    fmt.Sprintf("Datastore '%s' has an error: %s", ds.Name, ds.Error),
+				Recommendation: "Check PBS server logs and datastore configuration",
+				Evidence:       ds.Error,
+			})
+		}
+	}
+
+	// Check for backup staleness per datastore
+	// Build a map of latest backup time per datastore
+	datastoreLastBackup := make(map[string]time.Time)
+	for _, backup := range allBackups {
+		if backup.Instance != pbs.ID && backup.Instance != pbs.Name {
+			continue
+		}
+		dsKey := backup.Datastore
+		if backup.BackupTime.After(datastoreLastBackup[dsKey]) {
+			datastoreLastBackup[dsKey] = backup.BackupTime
+		}
+	}
+
+	for _, ds := range pbs.Datastores {
+		lastBackup, hasBackups := datastoreLastBackup[ds.Name]
+		
+		if !hasBackups {
+			// No backups found for this datastore - might be intentional (empty datastore)
+			// Only warn if datastore has actual content
+			if ds.Used > 0 {
+				findings = append(findings, &Finding{
+					ID:             generateFindingID(pbs.ID+":"+ds.Name, "backup", "no-recent"),
+					Severity:       FindingSeverityWatch,
+					Category:       FindingCategoryBackup,
+					ResourceID:     pbs.ID + ":" + ds.Name,
+					ResourceName:   fmt.Sprintf("%s/%s", pbsName, ds.Name),
+					ResourceType:   "pbs_datastore",
+					Title:          "No recent backup metadata",
+					Description:    fmt.Sprintf("Datastore '%s' has content but no recent backup entries visible", ds.Name),
+					Recommendation: "Verify backup jobs are configured and running",
+				})
+			}
+			continue
+		}
+
+		hoursSinceBackup := time.Since(lastBackup).Hours()
+		if hoursSinceBackup > 48 {
+			severity := FindingSeverityWatch
+			if hoursSinceBackup > 72 {
+				severity = FindingSeverityWarning
+			}
+			if hoursSinceBackup > 168 { // 7 days
+				severity = FindingSeverityCritical
+			}
+
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(pbs.ID+":"+ds.Name, "backup", "stale"),
+				Severity:       severity,
+				Category:       FindingCategoryBackup,
+				ResourceID:     pbs.ID + ":" + ds.Name,
+				ResourceName:   fmt.Sprintf("%s/%s", pbsName, ds.Name),
+				ResourceType:   "pbs_datastore",
+				Title:          "Stale backups",
+				Description:    fmt.Sprintf("No backups to '%s/%s' in %.0f hours", pbsName, ds.Name, hoursSinceBackup),
+				Recommendation: "Check backup job schedule and logs for failures",
+				Evidence:       fmt.Sprintf("Last backup: %s", lastBackup.Format("2006-01-02 15:04")),
+			})
+		}
+	}
+
+	// Check backup jobs for failures
+	for _, job := range pbs.BackupJobs {
+		if job.Status == "error" || job.Error != "" {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(pbs.ID+":job:"+job.ID, "backup", "job-failed"),
+				Severity:       FindingSeverityWarning,
+				Category:       FindingCategoryBackup,
+				ResourceID:     pbs.ID + ":job:" + job.ID,
+				ResourceName:   fmt.Sprintf("%s/job/%s", pbsName, job.ID),
+				ResourceType:   "pbs_job",
+				Title:          "Backup job failed",
+				Description:    fmt.Sprintf("Backup job '%s' on PBS '%s' is failing", job.ID, pbsName),
+				Recommendation: "Check PBS task logs for error details",
+				Evidence:       job.Error,
+			})
+		}
+	}
+
+	for _, job := range pbs.VerifyJobs {
+		if job.Status == "error" || job.Error != "" {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(pbs.ID+":verify:"+job.ID, "backup", "verify-failed"),
+				Severity:       FindingSeverityWarning,
+				Category:       FindingCategoryBackup,
+				ResourceID:     pbs.ID + ":verify:" + job.ID,
+				ResourceName:   fmt.Sprintf("%s/verify/%s", pbsName, job.ID),
+				ResourceType:   "pbs_job",
+				Title:          "Verify job failed",
+				Description:    fmt.Sprintf("Verify job '%s' on PBS '%s' is failing", job.ID, pbsName),
+				Recommendation: "Check PBS task logs - verify failures may indicate backup corruption",
+				Evidence:       job.Error,
+			})
+		}
+	}
+
+	return findings
+}
+
+// analyzeHost checks an agent host for issues (RAID, sensors, connectivity)
+func (p *PatrolService) analyzeHost(host models.Host) []*Finding {
+	var findings []*Finding
+
+	hostName := host.DisplayName
+	if hostName == "" {
+		hostName = host.Hostname
+	}
+
+	// Check host connectivity
+	if host.Status != "online" && host.Status != "connected" && host.Status != "" {
+		findings = append(findings, &Finding{
+			ID:             generateFindingID(host.ID, "reliability", "offline"),
+			Severity:       FindingSeverityCritical,
+			Category:       FindingCategoryReliability,
+			ResourceID:     host.ID,
+			ResourceName:   hostName,
+			ResourceType:   "host",
+			Title:          "Host agent offline",
+			Description:    fmt.Sprintf("Host '%s' agent is not reporting", hostName),
+			Recommendation: "Check network connectivity and pulse-agent service status",
+		})
+	}
+
+	// Check RAID arrays
+	for _, raid := range host.RAID {
+		raidName := raid.Device
+		if raid.Name != "" {
+			raidName = raid.Name
+		}
+
+		// Check for degraded/failed state
+		switch raid.State {
+		case "degraded", "DEGRADED":
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(host.ID+":"+raid.Device, "reliability", "raid-degraded"),
+				Severity:       FindingSeverityCritical,
+				Category:       FindingCategoryReliability,
+				ResourceID:     host.ID + ":" + raid.Device,
+				ResourceName:   fmt.Sprintf("%s/%s", hostName, raidName),
+				ResourceType:   "host_raid",
+				Title:          "RAID array degraded",
+				Description:    fmt.Sprintf("RAID array '%s' on '%s' is degraded (%d/%d devices active)", raidName, hostName, raid.ActiveDevices, raid.TotalDevices),
+				Recommendation: "Replace failed drive and initiate rebuild. Check dmesg for drive errors.",
+				Evidence:       fmt.Sprintf("State: %s, Active: %d/%d, Failed: %d", raid.State, raid.ActiveDevices, raid.TotalDevices, raid.FailedDevices),
+			})
+
+		case "recovering", "rebuilding", "resyncing", "RECOVERING":
+			severity := FindingSeverityWarning
+			if raid.RebuildPercent < 50 {
+				severity = FindingSeverityWatch // Early in rebuild, less urgent
+			}
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(host.ID+":"+raid.Device, "reliability", "raid-rebuilding"),
+				Severity:       severity,
+				Category:       FindingCategoryReliability,
+				ResourceID:     host.ID + ":" + raid.Device,
+				ResourceName:   fmt.Sprintf("%s/%s", hostName, raidName),
+				ResourceType:   "host_raid",
+				Title:          "RAID array rebuilding",
+				Description:    fmt.Sprintf("RAID array '%s' on '%s' is rebuilding (%.1f%% complete)", raidName, hostName, raid.RebuildPercent),
+				Recommendation: "Monitor rebuild progress. Avoid heavy I/O if possible. Array is vulnerable until rebuild completes.",
+				Evidence:       fmt.Sprintf("State: %s, Progress: %.1f%%, Speed: %s", raid.State, raid.RebuildPercent, raid.RebuildSpeed),
+			})
+
+		case "inactive", "INACTIVE":
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(host.ID+":"+raid.Device, "reliability", "raid-inactive"),
+				Severity:       FindingSeverityCritical,
+				Category:       FindingCategoryReliability,
+				ResourceID:     host.ID + ":" + raid.Device,
+				ResourceName:   fmt.Sprintf("%s/%s", hostName, raidName),
+				ResourceType:   "host_raid",
+				Title:          "RAID array inactive",
+				Description:    fmt.Sprintf("RAID array '%s' on '%s' is inactive", raidName, hostName),
+				Recommendation: "RAID array is not running. Check mdadm status and system logs.",
+				Evidence:       fmt.Sprintf("State: %s", raid.State),
+			})
+		}
+
+		// Check for failed devices even if array state is "clean"
+		if raid.FailedDevices > 0 && raid.State != "degraded" {
+			findings = append(findings, &Finding{
+				ID:             generateFindingID(host.ID+":"+raid.Device, "reliability", "raid-failed-devices"),
+				Severity:       FindingSeverityWarning,
+				Category:       FindingCategoryReliability,
+				ResourceID:     host.ID + ":" + raid.Device,
+				ResourceName:   fmt.Sprintf("%s/%s", hostName, raidName),
+				ResourceType:   "host_raid",
+				Title:          "RAID has failed devices",
+				Description:    fmt.Sprintf("RAID array '%s' on '%s' has %d failed device(s)", raidName, hostName, raid.FailedDevices),
+				Recommendation: "Replace failed drives. Array may still be operational due to spares.",
+				Evidence:       fmt.Sprintf("Failed: %d, Spare: %d", raid.FailedDevices, raid.SpareDevices),
+			})
+		}
+	}
+
+	// Check high temperature
+	if len(host.Sensors.TemperatureCelsius) > 0 {
+		for sensorName, temp := range host.Sensors.TemperatureCelsius {
+			if temp > 85 {
+				severity := FindingSeverityWarning
+				if temp > 95 {
+					severity = FindingSeverityCritical
+				}
+				findings = append(findings, &Finding{
+					ID:             generateFindingID(host.ID+":temp:"+sensorName, "reliability", "high-temp"),
+					Severity:       severity,
+					Category:       FindingCategoryReliability,
+					ResourceID:     host.ID + ":temp:" + sensorName,
+					ResourceName:   fmt.Sprintf("%s/%s", hostName, sensorName),
+					ResourceType:   "host_sensor",
+					Title:          "High temperature",
+					Description:    fmt.Sprintf("Sensor '%s' on '%s' reading %.0f°C", sensorName, hostName, temp),
+					Recommendation: "Check cooling, fans, and airflow. High temps can cause hardware damage.",
+					Evidence:       fmt.Sprintf("Temperature: %.1f°C", temp),
+				})
+			}
+		}
+	}
+
+	return findings
+}
+
+// AIAnalysisResult contains the results of an AI analysis
+type AIAnalysisResult struct {
+	Response     string     // The AI's raw response text
+	Findings     []*Finding // Parsed findings from the response
+	InputTokens  int
+	OutputTokens int
+}
+
+// runAIAnalysis uses the LLM to analyze infrastructure and identify issues
+func (p *PatrolService) runAIAnalysis(ctx context.Context, state models.StateSnapshot) (*AIAnalysisResult, error) {
+	if p.aiService == nil {
+		return nil, fmt.Errorf("AI service not available")
+	}
+
+	// Build enriched infrastructure context with trends and predictions
+	// Falls back to basic summary if metrics history is not available
+	summary := p.buildEnrichedContext(state)
+	if summary == "" {
+		return nil, nil // Nothing to analyze
+	}
+
+	prompt := p.buildPatrolPrompt(summary)
+
+	log.Debug().Msg("AI Patrol: Sending infrastructure to LLM for analysis")
+
+	// Start streaming phase
+	p.setStreamPhase("analyzing")
+	p.broadcast(PatrolStreamEvent{Type: "start"})
+
+	// Use streaming to broadcast updates in real-time
+	var contentBuffer strings.Builder
+	var inputTokens, outputTokens int
+
+	resp, err := p.aiService.ExecuteStream(ctx, ExecuteRequest{
+		Prompt:       prompt,
+		SystemPrompt: p.getPatrolSystemPrompt(),
+		UseCase:      "patrol", // Use patrol model for background analysis
+	}, func(event StreamEvent) {
+		switch event.Type {
+		case "content":
+			if content, ok := event.Data.(string); ok {
+				contentBuffer.WriteString(content)
+				p.appendStreamContent(content)
+			}
+		case "thinking":
+			// Thinking chunks become separate blocks (like AI chat)
+			if thinking, ok := event.Data.(string); ok && thinking != "" {
+				contentBuffer.WriteString(thinking)
+				// Send as a "thinking" event type so frontend can style it differently
+				p.broadcast(PatrolStreamEvent{
+					Type:    "thinking",
+					Content: thinking,
+				})
+			}
+		}
+	})
+	
+	if err != nil {
+		p.setStreamPhase("idle")
+		p.broadcast(PatrolStreamEvent{Type: "error", Content: err.Error()})
+		return nil, fmt.Errorf("LLM analysis failed: %w", err)
+	}
+
+	// Use response content (streaming may have captured it already)
+	finalContent := resp.Content
+	if finalContent == "" {
+		finalContent = contentBuffer.String()
+	}
+	inputTokens = resp.InputTokens
+	outputTokens = resp.OutputTokens
+
+	log.Debug().
+		Int("input_tokens", inputTokens).
+		Int("output_tokens", outputTokens).
+		Int("content_length", len(finalContent)).
+		Msg("AI Patrol: LLM analysis complete")
+
+	// Broadcast completion
+	p.broadcast(PatrolStreamEvent{
+		Type:   "complete",
+		Tokens: outputTokens,
+	})
+	p.setStreamPhase("idle")
+
+	// Parse findings from AI response
+	findings := p.parseAIFindings(finalContent)
+
+	return &AIAnalysisResult{
+		Response:     finalContent,
+		Findings:     findings,
+		InputTokens:  inputTokens,
+		OutputTokens: outputTokens,
+	}, nil
+}
+
+// getPatrolSystemPrompt returns the system prompt for AI patrol analysis
+// The prompt varies based on whether auto-fix mode is enabled
+func (p *PatrolService) getPatrolSystemPrompt() string {
+	autoFix := false
+	if cfg := p.aiService.GetAIConfig(); cfg != nil {
+		autoFix = cfg.PatrolAutoFix
+	}
+
+	basePrompt := `You are an infrastructure analyst for Pulse, a Proxmox monitoring system. Your job is to analyze infrastructure state and identify issues, potential problems, and optimization opportunities.
+
+IMPORTANT: You must respond in a specific structured format so findings can be parsed.
+
+For each issue you identify, output a finding block like this:
+
+[FINDING]
+SEVERITY: critical|warning|watch|info
+CATEGORY: performance|reliability|security|capacity|configuration
+RESOURCE: <resource name or ID>
+RESOURCE_TYPE: node|vm|container|docker_container|storage|host
+TITLE: <brief issue title>
+DESCRIPTION: <detailed description of the issue>
+RECOMMENDATION: <specific actionable recommendation>
+EVIDENCE: <specific data that supports this finding>
+[/FINDING]
+
+Guidelines:
+- CRITICAL: Immediate action required (data loss risk, service down)
+- WARNING: Should be addressed soon (degraded performance, nearing limits)  
+- WATCH: Worth monitoring (trends, minor inefficiencies)
+- INFO: Informational observations
+
+Focus on:
+1. Resource utilization patterns and anomalies
+2. Potential capacity issues before they become problems
+3. Configuration issues or inefficiencies
+4. Correlation between resources (e.g., multiple VMs on an overloaded node)
+5. Missing best practices (no backups, no HA, etc.)
+
+If everything looks healthy, you can say so briefly without any FINDING blocks.`
+
+	if autoFix {
+		return basePrompt + `
+
+AUTO-FIX MODE ENABLED: You may use the run_command tool to attempt automatic remediation of issues you find.
+
+Safe operations you can perform autonomously:
+- Restart services (systemctl restart)
+- Clear caches and temp files
+- Rotate/compress logs
+- Trigger garbage collection
+
+Operations requiring extra caution:
+- Deleting files (prefer moving to /tmp first)
+- Installing packages
+- Modifying configurations
+
+Always:
+1. Run a verification command after any fix to confirm success
+2. Log what action was taken and the outcome
+3. Stop and report if the fix doesn't resolve the issue`
+	}
+
+	return basePrompt + `
+
+OBSERVE ONLY MODE: You are in observation mode. You may use read-only commands to gather diagnostic information (checking status, memory usage, disk space, logs, etc.) but DO NOT modify anything. Present your findings with clear recommendations for the user to review and action manually.`
+}
+
+// buildInfrastructureSummary creates a text summary of infrastructure state for the AI
+func (p *PatrolService) buildInfrastructureSummary(state models.StateSnapshot) string {
+	var sb strings.Builder
+
+	sb.WriteString("# Infrastructure State Summary\n\n")
+
+	// Nodes
+	if len(state.Nodes) > 0 {
+		sb.WriteString("## Proxmox Nodes\n")
+		for _, n := range state.Nodes {
+			memPct := 0.0
+			if n.Memory.Total > 0 {
+				memPct = float64(n.Memory.Used) / float64(n.Memory.Total) * 100
+			}
+			sb.WriteString(fmt.Sprintf("- **%s**: Status=%s, CPU=%.1f%%, Memory=%.1f%%, Uptime=%s\n",
+				n.Name, n.Status, n.CPU*100, memPct, formatDurationPatrol(time.Duration(n.Uptime)*time.Second)))
+		}
+		sb.WriteString("\n")
+	}
+
+	// VMs
+	if len(state.VMs) > 0 {
+		sb.WriteString("## Virtual Machines\n")
+		for _, vm := range state.VMs {
+			if vm.Template {
+				continue // Skip templates
+			}
+			memPct := 0.0
+			if vm.Memory.Total > 0 {
+				memPct = float64(vm.Memory.Used) / float64(vm.Memory.Total) * 100
+			}
+			backupStatus := "never"
+			if !vm.LastBackup.IsZero() {
+				backupStatus = fmt.Sprintf("%s ago", time.Since(vm.LastBackup).Round(time.Hour))
+			}
+			sb.WriteString(fmt.Sprintf("- **%s** (ID:%s, Node:%s): Status=%s, CPU=%.1f%%, Memory=%.1f%%, LastBackup=%s\n",
+				vm.Name, vm.ID, vm.Node, vm.Status, vm.CPU*100, memPct, backupStatus))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Containers
+	if len(state.Containers) > 0 {
+		sb.WriteString("## LXC Containers\n")
+		for _, ct := range state.Containers {
+			if ct.Template {
+				continue
+			}
+			memPct := 0.0
+			if ct.Memory.Total > 0 {
+				memPct = float64(ct.Memory.Used) / float64(ct.Memory.Total) * 100
+			}
+			backupStatus := "never"
+			if !ct.LastBackup.IsZero() {
+				backupStatus = fmt.Sprintf("%s ago", time.Since(ct.LastBackup).Round(time.Hour))
+			}
+			sb.WriteString(fmt.Sprintf("- **%s** (ID:%s, Node:%s): Status=%s, CPU=%.1f%%, Memory=%.1f%%, LastBackup=%s\n",
+				ct.Name, ct.ID, ct.Node, ct.Status, ct.CPU*100, memPct, backupStatus))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Storage
+	if len(state.Storage) > 0 {
+		sb.WriteString("## Storage\n")
+		for _, st := range state.Storage {
+			usedPct := 0.0
+			if st.Total > 0 {
+				usedPct = float64(st.Used) / float64(st.Total) * 100
+			}
+			sb.WriteString(fmt.Sprintf("- **%s** (Node:%s, Type:%s): %.1f%% used (%s / %s)\n",
+				st.Name, st.Node, st.Type, usedPct, formatBytesInt64(st.Used), formatBytesInt64(st.Total)))
+		}
+		sb.WriteString("\n")
+	}
+
+	// Docker hosts
+	if len(state.DockerHosts) > 0 {
+		sb.WriteString("## Docker Hosts\n")
+		for _, dh := range state.DockerHosts {
+			sb.WriteString(fmt.Sprintf("- **%s**: Status=%s, Containers=%d\n",
+				dh.Hostname, dh.Status, len(dh.Containers)))
+			for _, c := range dh.Containers {
+				sb.WriteString(fmt.Sprintf("  - %s: State=%s, CPU=%.1f%%, Memory=%.1f%%, Restarts=%d\n",
+				c.Name, c.State, c.CPUPercent, c.MemoryPercent, c.RestartCount))
+			}
+		}
+		sb.WriteString("\n")
+	}
+
+	return sb.String()
+}
+
+// buildEnrichedContext creates context with historical trends and predictions
+// Falls back to basic summary if metrics history is not available
+func (p *PatrolService) buildEnrichedContext(state models.StateSnapshot) string {
+	p.mu.RLock()
+	metricsHistory := p.metricsHistory
+	knowledgeStore := p.knowledgeStore
+	baselineStore := p.baselineStore
+	changeDetector := p.changeDetector
+	p.mu.RUnlock()
+
+	// If no metrics history, fall back to basic summary
+	if metricsHistory == nil {
+		log.Debug().Msg("AI Patrol: No metrics history available, using basic summary")
+		return p.buildInfrastructureSummary(state)
+	}
+
+	// Build enriched context using the context package
+	builder := aicontext.NewBuilder().
+		WithMetricsHistory(&metricsHistoryShim{provider: metricsHistory})
+
+	// Add knowledge store if available
+	if knowledgeStore != nil {
+		builder = builder.WithKnowledge(&knowledgeShim{store: knowledgeStore})
+	}
+	
+	// Add baseline provider for anomaly detection if available
+	if baselineStore != nil {
+		adapter := NewBaselineStoreAdapter(baselineStore)
+		if adapter != nil {
+			builder = builder.WithBaseline(&baselineShim{adapter: adapter})
+		}
+	}
+
+	// Build full infrastructure context with trends
+	infraCtx := builder.BuildForInfrastructure(state)
+	if infraCtx == nil {
+		log.Warn().Msg("AI Patrol: Failed to build enriched context, falling back")
+		return p.buildInfrastructureSummary(state)
+	}
+
+	// Format for AI consumption
+	formatted := aicontext.FormatInfrastructureContext(infraCtx)
+	
+	// Append recent changes if change detector is available
+	if changeDetector != nil {
+		// Detect any new changes from current state
+		snapshots := stateToSnapshots(state)
+		newChanges := changeDetector.DetectChanges(snapshots)
+		
+		// Get summary of recent changes (last 24 hours)
+		since := time.Now().Add(-24 * time.Hour)
+		changesSummary := changeDetector.GetChangesSummary(since, 20)
+		
+		if changesSummary != "" {
+			formatted += "\n## Recent Infrastructure Changes (24h)\n\n" + changesSummary
+		}
+		
+		if len(newChanges) > 0 {
+			log.Debug().Int("new_changes", len(newChanges)).Msg("AI Patrol: Detected infrastructure changes")
+		}
+	}
+	
+	// Append failure predictions if pattern detector is available
+	p.mu.RLock()
+	patternDetector := p.patternDetector
+	correlationDetector := p.correlationDetector
+	p.mu.RUnlock()
+	
+	if patternDetector != nil {
+		predictionsContext := patternDetector.FormatForContext("")
+		if predictionsContext != "" {
+			formatted += predictionsContext
+		}
+	}
+	
+	// Append resource correlations if correlation detector is available
+	if correlationDetector != nil {
+		correlationsContext := correlationDetector.FormatForContext("")
+		if correlationsContext != "" {
+			formatted += correlationsContext
+		}
+	}
+
+	log.Debug().
+		Int("resources", infraCtx.TotalResources).
+		Int("predictions", len(infraCtx.Predictions)).
+		Int("anomalies", len(infraCtx.Anomalies)).
+		Msg("AI Patrol: Built enriched context with trends")
+
+	return formatted
+}
+
+// stateToSnapshots converts state to resource snapshots for change detection
+func stateToSnapshots(state models.StateSnapshot) []ResourceSnapshot {
+	var snapshots []ResourceSnapshot
+	
+	for _, node := range state.Nodes {
+		snapshots = append(snapshots, ResourceSnapshot{
+			ID:          node.ID,
+			Name:        node.Name,
+			Type:        "node",
+			Status:      node.Status,
+			CPUCores:    node.CPUInfo.Cores,
+			MemoryBytes: node.Memory.Total,
+		})
+	}
+	
+	for _, vm := range state.VMs {
+		if vm.Template {
+			continue
+		}
+		snapshots = append(snapshots, ResourceSnapshot{
+			ID:          vm.ID,
+			Name:        vm.Name,
+			Type:        "vm",
+			Status:      vm.Status,
+			Node:        vm.Node,
+			CPUCores:    vm.CPUs,
+			MemoryBytes: vm.Memory.Total,
+			DiskBytes:   vm.Disk.Total,
+			LastBackup:  vm.LastBackup,
+		})
+	}
+	
+	for _, ct := range state.Containers {
+		if ct.Template {
+			continue
+		}
+		snapshots = append(snapshots, ResourceSnapshot{
+			ID:          ct.ID,
+			Name:        ct.Name,
+			Type:        "container",
+			Status:      ct.Status,
+			Node:        ct.Node,
+			CPUCores:    ct.CPUs,
+			MemoryBytes: ct.Memory.Total,
+			DiskBytes:   ct.Disk.Total,
+			LastBackup:  ct.LastBackup,
+		})
+	}
+	
+	return snapshots
+}
+
+// metricsHistoryShim adapts ai.MetricsHistoryProvider to aicontext.MetricsHistoryProvider
+type metricsHistoryShim struct {
+	provider MetricsHistoryProvider
+}
+
+func (s *metricsHistoryShim) GetNodeMetrics(nodeID string, metricType string, duration time.Duration) []aicontext.MetricPoint {
+	if s.provider == nil {
+		return nil
+	}
+	points := s.provider.GetNodeMetrics(nodeID, metricType, duration)
+	return convertToContextPoints(points)
+}
+
+func (s *metricsHistoryShim) GetGuestMetrics(guestID string, metricType string, duration time.Duration) []aicontext.MetricPoint {
+	if s.provider == nil {
+		return nil
+	}
+	points := s.provider.GetGuestMetrics(guestID, metricType, duration)
+	return convertToContextPoints(points)
+}
+
+func (s *metricsHistoryShim) GetAllGuestMetrics(guestID string, duration time.Duration) map[string][]aicontext.MetricPoint {
+	if s.provider == nil {
+		return nil
+	}
+	metricsMap := s.provider.GetAllGuestMetrics(guestID, duration)
+	return convertToContextMetricsMap(metricsMap)
+}
+
+func (s *metricsHistoryShim) GetAllStorageMetrics(storageID string, duration time.Duration) map[string][]aicontext.MetricPoint {
+	if s.provider == nil {
+		return nil
+	}
+	metricsMap := s.provider.GetAllStorageMetrics(storageID, duration)
+	return convertToContextMetricsMap(metricsMap)
+}
+
+// knowledgeShim adapts knowledge.Store to aicontext.KnowledgeProvider
+type knowledgeShim struct {
+	store *knowledge.Store
+}
+
+func (k *knowledgeShim) GetNotes(guestID string) []string {
+	if k.store == nil {
+		return nil
+	}
+	knowledge, err := k.store.GetKnowledge(guestID)
+	if err != nil || knowledge == nil {
+		return nil
+	}
+	// Extract note contents
+	var notes []string
+	for _, note := range knowledge.Notes {
+		notes = append(notes, note.Content)
+	}
+	return notes
+}
+
+func (k *knowledgeShim) FormatAllForContext() string {
+	if k.store == nil {
+		return ""
+	}
+	return k.store.FormatAllForContext()
+}
+
+// baselineShim adapts BaselineStoreAdapter to aicontext.BaselineProvider
+type baselineShim struct {
+	adapter *BaselineStoreAdapter
+}
+
+func (b *baselineShim) CheckAnomaly(resourceID, metric string, value float64) (severity string, zScore float64, mean float64, stddev float64, ok bool) {
+	if b.adapter == nil {
+		return "", 0, 0, 0, false
+	}
+	return b.adapter.CheckAnomaly(resourceID, metric, value)
+}
+
+func (b *baselineShim) GetBaseline(resourceID, metric string) (mean float64, stddev float64, sampleCount int, ok bool) {
+	if b.adapter == nil {
+		return 0, 0, 0, false
+	}
+	return b.adapter.GetBaseline(resourceID, metric)
+}
+
+// convertToContextPoints converts ai.MetricPoint to aicontext.MetricPoint
+// Since both are aliases for types.MetricPoint, this is just a type assertion
+func convertToContextPoints(points []MetricPoint) []aicontext.MetricPoint {
+	if points == nil {
+		return nil
+	}
+	// Both types are aliases for types.MetricPoint, so they're compatible
+	result := make([]aicontext.MetricPoint, len(points))
+	for i, p := range points {
+		result[i] = aicontext.MetricPoint{
+			Value:     p.Value,
+			Timestamp: p.Timestamp,
+		}
+	}
+	return result
+}
+
+// convertToContextMetricsMap converts a map of metric points
+func convertToContextMetricsMap(metricsMap map[string][]MetricPoint) map[string][]aicontext.MetricPoint {
+	if metricsMap == nil {
+		return nil
+	}
+	result := make(map[string][]aicontext.MetricPoint, len(metricsMap))
+	for key, points := range metricsMap {
+		result[key] = convertToContextPoints(points)
+	}
+	return result
+}
+
+// buildPatrolPrompt creates the prompt for AI analysis
+// Includes user feedback context to prevent re-raising dismissed findings
+func (p *PatrolService) buildPatrolPrompt(summary string) string {
+	// Get user feedback context (dismissed/snoozed findings)
+	feedbackContext := p.findings.GetDismissedForContext()
+	
+	// Get resource notes from knowledge store (per-resource user notes)
+	var knowledgeContext string
+	p.mu.RLock()
+	knowledgeStore := p.knowledgeStore
+	p.mu.RUnlock()
+	if knowledgeStore != nil {
+		knowledgeContext = knowledgeStore.FormatAllForContext()
+	}
+	
+	basePrompt := fmt.Sprintf(`Please perform a comprehensive analysis of the following infrastructure and identify any issues, potential problems, or optimization opportunities.
+
+%s
+
+Analyze the above and report any findings using the structured format. Focus on:
+- Resources showing high utilization or concerning trends (look for ↑ growing indicators)
+- Predictions showing resources approaching capacity (look for ⏰ predictions)
+- Anomalies flagged as unusual (look for ⚠️ anomalies)
+- Patterns that might indicate problems over time (compare 24h vs 7d trends)
+- Missing backups or stale backup schedules  
+- Unbalanced resource distribution
+
+IMPORTANT: The context includes historical trends (24h and 7d) where available. Use this to provide actionable insights:
+- A resource that's "growing 5%%/day" needs proactive attention
+- A resource that's "stable" with high usage may just need monitoring
+- A "volatile" resource may indicate workload issues
+
+If predictions show a resource will be full within 7 days, flag it as high priority.
+If everything looks healthy with stable trends, say so briefly.`, summary)
+
+	var contextAdditions strings.Builder
+	
+	// Append knowledge context (user notes about resources)
+	if knowledgeContext != "" {
+		contextAdditions.WriteString("\n\n")
+		contextAdditions.WriteString(knowledgeContext)
+		contextAdditions.WriteString("\nIMPORTANT: Consider the user's saved notes above when analyzing. If a user has noted that a resource behaves a certain way (e.g., 'runs hot for transcoding'), do not flag it as an issue.\n")
+	}
+	
+	// Append user feedback context (dismissed/snoozed findings)
+	if feedbackContext != "" {
+		contextAdditions.WriteString("\n\n")
+		contextAdditions.WriteString(feedbackContext)
+		contextAdditions.WriteString(`
+
+IMPORTANT: Respect the user's feedback above. Do NOT re-raise findings that are:
+- Permanently suppressed - the user has explicitly said to never mention these again
+- Dismissed as "not_an_issue" or "expected_behavior" - the user knows about these
+- Currently snoozed - only re-raise if the severity has significantly worsened
+
+Only report NEW issues or issues where the severity has clearly escalated.`)
+	}
+	
+	if contextAdditions.Len() > 0 {
+		return basePrompt + contextAdditions.String()
+	}
+	
+	return basePrompt
+}
+
+// parseAIFindings extracts structured findings from AI response
+func (p *PatrolService) parseAIFindings(response string) []*Finding {
+	var findings []*Finding
+
+	// Find all [FINDING]...[/FINDING] blocks
+	findingPattern := regexp.MustCompile(`(?s)\[FINDING\](.*?)\[/FINDING\]`)
+	matches := findingPattern.FindAllStringSubmatch(response, -1)
+
+	for _, match := range matches {
+		if len(match) < 2 {
+			continue
+		}
+
+		block := match[1]
+		finding := p.parseFindingBlock(block)
+		if finding != nil {
+			findings = append(findings, finding)
+		}
+	}
+
+	return findings
+}
+
+// parseFindingBlock extracts a single finding from a block
+func (p *PatrolService) parseFindingBlock(block string) *Finding {
+	extract := func(key string) string {
+		pattern := regexp.MustCompile(`(?i)` + key + `:\s*(.+?)(?:\n|$)`)
+		match := pattern.FindStringSubmatch(block)
+		if len(match) >= 2 {
+			return strings.TrimSpace(match[1])
+		}
+		return ""
+	}
+
+	severity := extract("SEVERITY")
+	category := extract("CATEGORY")
+	resource := extract("RESOURCE")
+	resourceType := extract("RESOURCE_TYPE")
+	title := extract("TITLE")
+	description := extract("DESCRIPTION")
+	recommendation := extract("RECOMMENDATION")
+	evidence := extract("EVIDENCE")
+
+	// Validate required fields
+	if title == "" || description == "" {
+		return nil
+	}
+
+	// Map severity
+	var sev FindingSeverity
+	switch strings.ToLower(severity) {
+	case "critical":
+		sev = FindingSeverityCritical
+	case "warning":
+		sev = FindingSeverityWarning
+	case "watch":
+		sev = FindingSeverityWatch
+	default:
+		sev = FindingSeverityInfo
+	}
+
+	// Map category
+	var cat FindingCategory
+	switch strings.ToLower(category) {
+	case "performance":
+		cat = FindingCategoryPerformance
+	case "reliability":
+		cat = FindingCategoryReliability
+	case "security":
+		cat = FindingCategorySecurity
+	case "capacity":
+		cat = FindingCategoryCapacity
+	case "configuration":
+		cat = FindingCategoryGeneral // Configuration maps to General
+	default:
+		cat = FindingCategoryPerformance
+	}
+
+	// Generate stable ID from resource and category ONLY (not title)
+	// This ensures the same issue on the same resource gets the same ID even if
+	// the LLM phrases it differently each time
+	id := generateFindingID(resource, string(cat), "llm-finding")
+
+	return &Finding{
+		ID:             id,
+		Severity:       sev,
+		Category:       cat,
+		ResourceID:     resource,
+		ResourceName:   resource,
+		ResourceType:   resourceType,
+		Title:          title,
+		Description:    description,
+		Recommendation: recommendation,
+		Evidence:       evidence,
+		Source:         "ai-analysis", // Mark as coming from AI
+	}
+}
+
+// formatDurationPatrol formats a duration as a human-readable string for patrol
+func formatDurationPatrol(d time.Duration) string {
+	if d < time.Hour {
+		return fmt.Sprintf("%dm", int(d.Minutes()))
+	}
+	if d < 24*time.Hour {
+		return fmt.Sprintf("%dh", int(d.Hours()))
+	}
+	return fmt.Sprintf("%dd", int(d.Hours()/24))
+}
+
+// formatBytes formats bytes as a human-readable string
+func formatBytes(b uint64) string {
+	const unit = 1024
+	if b < unit {
+		return fmt.Sprintf("%d B", b)
+	}
+	div, exp := uint64(unit), 0
+	for n := b / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %cB", float64(b)/float64(div), "KMGTPE"[exp])
+}
+
+// formatBytesInt64 formats int64 bytes as a human-readable string
+func formatBytesInt64(b int64) string {
+	if b < 0 {
+		return "0 B"
+	}
+	return formatBytes(uint64(b))
+}
diff --git a/internal/ai/patrol_history_persistence.go b/internal/ai/patrol_history_persistence.go
new file mode 100644
index 0000000..82d438f
--- /dev/null
+++ b/internal/ai/patrol_history_persistence.go
@@ -0,0 +1,247 @@
+// Package ai provides AI-powered infrastructure monitoring and investigation.
+package ai
+
+import (
+	"sync"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rs/zerolog/log"
+)
+
+// PatrolHistoryPersistence interface for saving/loading patrol run history
+type PatrolHistoryPersistence interface {
+	SavePatrolRunHistory(runs []PatrolRunRecord) error
+	LoadPatrolRunHistory() ([]PatrolRunRecord, error)
+}
+
+// PatrolHistoryPersistenceAdapter bridges ConfigPersistence to PatrolHistoryPersistence interface
+type PatrolHistoryPersistenceAdapter struct {
+	config *config.ConfigPersistence
+}
+
+// NewPatrolHistoryPersistenceAdapter creates a new adapter
+func NewPatrolHistoryPersistenceAdapter(cfg *config.ConfigPersistence) *PatrolHistoryPersistenceAdapter {
+	return &PatrolHistoryPersistenceAdapter{config: cfg}
+}
+
+// SavePatrolRunHistory saves patrol run history to disk via ConfigPersistence
+func (a *PatrolHistoryPersistenceAdapter) SavePatrolRunHistory(runs []PatrolRunRecord) error {
+	// Convert from ai.PatrolRunRecord to config.PatrolRunRecord
+	records := make([]config.PatrolRunRecord, len(runs))
+	for i, r := range runs {
+		records[i] = config.PatrolRunRecord{
+			ID:               r.ID,
+			StartedAt:        r.StartedAt,
+			CompletedAt:      r.CompletedAt,
+			DurationMs:       int64(r.Duration),
+			Type:             r.Type,
+			ResourcesChecked: r.ResourcesChecked,
+			NodesChecked:     r.NodesChecked,
+			GuestsChecked:    r.GuestsChecked,
+			DockerChecked:    r.DockerChecked,
+			StorageChecked:   r.StorageChecked,
+			HostsChecked:     r.HostsChecked,
+			PBSChecked:       r.PBSChecked,
+			NewFindings:      r.NewFindings,
+			ExistingFindings: r.ExistingFindings,
+			ResolvedFindings: r.ResolvedFindings,
+			FindingsSummary:  r.FindingsSummary,
+			FindingIDs:       r.FindingIDs,
+			ErrorCount:       r.ErrorCount,
+			Status:           r.Status,
+			AIAnalysis:       r.AIAnalysis,
+			InputTokens:      r.InputTokens,
+			OutputTokens:     r.OutputTokens,
+		}
+	}
+	return a.config.SavePatrolRunHistory(records)
+}
+
+// LoadPatrolRunHistory loads patrol run history from disk via ConfigPersistence
+func (a *PatrolHistoryPersistenceAdapter) LoadPatrolRunHistory() ([]PatrolRunRecord, error) {
+	data, err := a.config.LoadPatrolRunHistory()
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert from config.PatrolRunRecord to ai.PatrolRunRecord
+	runs := make([]PatrolRunRecord, len(data.Runs))
+	for i, r := range data.Runs {
+		runs[i] = PatrolRunRecord{
+			ID:               r.ID,
+			StartedAt:        r.StartedAt,
+			CompletedAt:      r.CompletedAt,
+			Duration:         time.Duration(r.DurationMs),
+			Type:             r.Type,
+			ResourcesChecked: r.ResourcesChecked,
+			NodesChecked:     r.NodesChecked,
+			GuestsChecked:    r.GuestsChecked,
+			DockerChecked:    r.DockerChecked,
+			StorageChecked:   r.StorageChecked,
+			HostsChecked:     r.HostsChecked,
+			PBSChecked:       r.PBSChecked,
+			NewFindings:      r.NewFindings,
+			ExistingFindings: r.ExistingFindings,
+			ResolvedFindings: r.ResolvedFindings,
+			FindingsSummary:  r.FindingsSummary,
+			FindingIDs:       r.FindingIDs,
+			ErrorCount:       r.ErrorCount,
+			Status:           r.Status,
+			AIAnalysis:       r.AIAnalysis,
+			InputTokens:      r.InputTokens,
+			OutputTokens:     r.OutputTokens,
+		}
+	}
+	return runs, nil
+}
+
+// PatrolRunHistoryStore provides thread-safe storage for patrol run history with optional persistence
+type PatrolRunHistoryStore struct {
+	mu          sync.RWMutex
+	runs        []PatrolRunRecord
+	maxRuns     int
+	persistence PatrolHistoryPersistence
+	// Debounce save operations
+	saveTimer    *time.Timer
+	savePending  bool
+	saveDebounce time.Duration
+}
+
+// NewPatrolRunHistoryStore creates a new patrol run history store
+func NewPatrolRunHistoryStore(maxRuns int) *PatrolRunHistoryStore {
+	if maxRuns <= 0 {
+		maxRuns = MaxPatrolRunHistory
+	}
+	return &PatrolRunHistoryStore{
+		runs:         make([]PatrolRunRecord, 0, maxRuns),
+		maxRuns:      maxRuns,
+		saveDebounce: 5 * time.Second,
+	}
+}
+
+// SetPersistence sets the persistence layer and loads existing history
+func (s *PatrolRunHistoryStore) SetPersistence(p PatrolHistoryPersistence) error {
+	s.mu.Lock()
+	s.persistence = p
+	s.mu.Unlock()
+
+	// Load existing history from disk
+	if p != nil {
+		runs, err := p.LoadPatrolRunHistory()
+		if err != nil {
+			return err
+		}
+		if len(runs) > 0 {
+			s.mu.Lock()
+			s.runs = runs
+			// Trim to max if loaded more than maxRuns
+			if len(s.runs) > s.maxRuns {
+				s.runs = s.runs[:s.maxRuns]
+			}
+			s.mu.Unlock()
+			log.Info().Int("count", len(runs)).Msg("Loaded patrol run history from disk")
+		}
+	}
+	return nil
+}
+
+// Add adds a new patrol run to the history
+func (s *PatrolRunHistoryStore) Add(run PatrolRunRecord) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Prepend (newest first)
+	s.runs = append([]PatrolRunRecord{run}, s.runs...)
+	
+	// Trim to max
+	if len(s.runs) > s.maxRuns {
+		s.runs = s.runs[:s.maxRuns]
+	}
+
+	// Schedule save
+	s.scheduleSave()
+}
+
+// GetAll returns all runs (newest first)
+func (s *PatrolRunHistoryStore) GetAll() []PatrolRunRecord {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	result := make([]PatrolRunRecord, len(s.runs))
+	copy(result, s.runs)
+	return result
+}
+
+// GetRecent returns at most n recent runs
+func (s *PatrolRunHistoryStore) GetRecent(n int) []PatrolRunRecord {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	
+	if n <= 0 || n > len(s.runs) {
+		n = len(s.runs)
+	}
+	
+	result := make([]PatrolRunRecord, n)
+	copy(result, s.runs[:n])
+	return result
+}
+
+// Count returns the number of runs in history
+func (s *PatrolRunHistoryStore) Count() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return len(s.runs)
+}
+
+// scheduleSave schedules a debounced save operation
+func (s *PatrolRunHistoryStore) scheduleSave() {
+	if s.persistence == nil {
+		return
+	}
+
+	// Cancel existing timer if pending
+	if s.saveTimer != nil {
+		s.saveTimer.Stop()
+	}
+
+	s.savePending = true
+	s.saveTimer = time.AfterFunc(s.saveDebounce, func() {
+		s.mu.Lock()
+		if !s.savePending {
+			s.mu.Unlock()
+			return
+		}
+		s.savePending = false
+		// Copy runs while locked
+		runs := make([]PatrolRunRecord, len(s.runs))
+		copy(runs, s.runs)
+		persistence := s.persistence
+		s.mu.Unlock()
+
+		// Save outside lock
+		if persistence != nil {
+			if err := persistence.SavePatrolRunHistory(runs); err != nil {
+				log.Error().Err(err).Msg("Failed to save patrol run history")
+			}
+		}
+	})
+}
+
+// FlushPersistence immediately saves any pending changes
+func (s *PatrolRunHistoryStore) FlushPersistence() error {
+	s.mu.Lock()
+	if s.saveTimer != nil {
+		s.saveTimer.Stop()
+	}
+	s.savePending = false
+	runs := make([]PatrolRunRecord, len(s.runs))
+	copy(runs, s.runs)
+	persistence := s.persistence
+	s.mu.Unlock()
+
+	if persistence != nil {
+		return persistence.SavePatrolRunHistory(runs)
+	}
+	return nil
+}
diff --git a/internal/ai/pattern_exports.go b/internal/ai/pattern_exports.go
new file mode 100644
index 0000000..a75492d
--- /dev/null
+++ b/internal/ai/pattern_exports.go
@@ -0,0 +1,44 @@
+package ai
+
+import (
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/patterns"
+)
+
+// PatternDetector is an alias for patterns.Detector
+type PatternDetector = patterns.Detector
+
+// PatternDetectorConfig is an alias for patterns.DetectorConfig
+type PatternDetectorConfig = patterns.DetectorConfig
+
+// HistoricalEvent is an alias for patterns.HistoricalEvent
+type HistoricalEvent = patterns.HistoricalEvent
+
+// FailurePrediction is an alias for patterns.FailurePrediction
+type FailurePrediction = patterns.FailurePrediction
+
+// EventType is an alias for patterns.EventType
+type EventType = patterns.EventType
+
+// Pattern is an alias for patterns.Pattern
+type Pattern = patterns.Pattern
+
+// Event type constants
+const (
+	EventHighMemory   = patterns.EventHighMemory
+	EventHighCPU      = patterns.EventHighCPU
+	EventDiskFull     = patterns.EventDiskFull
+	EventOOM          = patterns.EventOOM
+	EventRestart      = patterns.EventRestart
+	EventUnresponsive = patterns.EventUnresponsive
+	EventBackupFailed = patterns.EventBackupFailed
+)
+
+// NewPatternDetector creates a new pattern detector
+func NewPatternDetector(cfg PatternDetectorConfig) *PatternDetector {
+	return patterns.NewDetector(cfg)
+}
+
+// DefaultPatternConfig returns default pattern detector configuration
+func DefaultPatternConfig() PatternDetectorConfig {
+	return patterns.DefaultConfig()
+}
diff --git a/internal/ai/patterns/detector.go b/internal/ai/patterns/detector.go
new file mode 100644
index 0000000..ec5027b
--- /dev/null
+++ b/internal/ai/patterns/detector.go
@@ -0,0 +1,576 @@
+// Package patterns provides failure pattern detection for predictive intelligence.
+// It analyzes historical data to identify recurring issues and predict future failures.
+package patterns
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"os"
+	"path/filepath"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// EventType represents the type of event being tracked
+type EventType string
+
+const (
+	EventHighMemory   EventType = "high_memory"   // Memory exceeded threshold
+	EventHighCPU      EventType = "high_cpu"      // CPU exceeded threshold
+	EventDiskFull     EventType = "disk_full"     // Disk space critical
+	EventOOM          EventType = "oom"           // Out of memory kill
+	EventRestart      EventType = "restart"       // Resource restarted
+	EventUnresponsive EventType = "unresponsive"  // Resource became unresponsive
+	EventBackupFailed EventType = "backup_failed" // Backup job failed
+)
+
+// HistoricalEvent represents a recorded event
+type HistoricalEvent struct {
+	ID          string        `json:"id"`
+	ResourceID  string        `json:"resource_id"`
+	EventType   EventType     `json:"event_type"`
+	Timestamp   time.Time     `json:"timestamp"`
+	Description string        `json:"description,omitempty"`
+	Resolved    bool          `json:"resolved"`
+	ResolvedAt  time.Time     `json:"resolved_at,omitempty"`
+	Duration    time.Duration `json:"duration,omitempty"` // How long it lasted
+}
+
+// Pattern represents a detected recurring pattern
+type Pattern struct {
+	ResourceID      string        `json:"resource_id"`
+	EventType       EventType     `json:"event_type"`
+	Occurrences     int           `json:"occurrences"`      // Number of times event occurred
+	AverageInterval time.Duration `json:"average_interval"` // Average time between occurrences
+	StdDevInterval  time.Duration `json:"stddev_interval"`  // Standard deviation
+	LastOccurrence  time.Time     `json:"last_occurrence"`
+	NextPredicted   time.Time     `json:"next_predicted"`             // When we expect it to happen again
+	Confidence      float64       `json:"confidence"`                 // 0-1, based on consistency
+	AverageDuration time.Duration `json:"average_duration,omitempty"` // How long events typically last
+}
+
+// FailurePrediction represents a predicted future failure
+type FailurePrediction struct {
+	ResourceID  string    `json:"resource_id"`
+	EventType   EventType `json:"event_type"`
+	PredictedAt time.Time `json:"predicted_at"`
+	DaysUntil   float64   `json:"days_until"`
+	Confidence  float64   `json:"confidence"`
+	Basis       string    `json:"basis"` // Human-readable explanation
+	Pattern     *Pattern  `json:"pattern,omitempty"`
+}
+
+// Detector tracks historical events and detects patterns
+type Detector struct {
+	mu       sync.RWMutex
+	events   []HistoricalEvent
+	patterns map[string]*Pattern // resourceID:eventType -> pattern
+
+	// Configuration
+	maxEvents       int
+	minOccurrences  int           // Minimum occurrences to form a pattern
+	patternWindow   time.Duration // How far back to look for patterns
+	predictionLimit time.Duration // How far ahead to predict
+
+	// Persistence
+	dataDir string
+}
+
+// DetectorConfig configures the pattern detector
+type DetectorConfig struct {
+	MaxEvents       int
+	MinOccurrences  int           // Default: 3
+	PatternWindow   time.Duration // Default: 90 days
+	PredictionLimit time.Duration // Default: 30 days
+	DataDir         string
+}
+
+// DefaultConfig returns default detector configuration
+func DefaultConfig() DetectorConfig {
+	return DetectorConfig{
+		MaxEvents:       5000,
+		MinOccurrences:  3,
+		PatternWindow:   90 * 24 * time.Hour,
+		PredictionLimit: 30 * 24 * time.Hour,
+	}
+}
+
+// NewDetector creates a new pattern detector
+func NewDetector(cfg DetectorConfig) *Detector {
+	if cfg.MaxEvents <= 0 {
+		cfg.MaxEvents = 5000
+	}
+	if cfg.MinOccurrences <= 0 {
+		cfg.MinOccurrences = 3
+	}
+	if cfg.PatternWindow <= 0 {
+		cfg.PatternWindow = 90 * 24 * time.Hour
+	}
+	if cfg.PredictionLimit <= 0 {
+		cfg.PredictionLimit = 30 * 24 * time.Hour
+	}
+
+	d := &Detector{
+		events:          make([]HistoricalEvent, 0),
+		patterns:        make(map[string]*Pattern),
+		maxEvents:       cfg.MaxEvents,
+		minOccurrences:  cfg.MinOccurrences,
+		patternWindow:   cfg.PatternWindow,
+		predictionLimit: cfg.PredictionLimit,
+		dataDir:         cfg.DataDir,
+	}
+
+	// Load existing data
+	if cfg.DataDir != "" {
+		if err := d.loadFromDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to load pattern history from disk")
+		} else if len(d.events) > 0 {
+			log.Info().Int("events", len(d.events)).Int("patterns", len(d.patterns)).
+				Msg("Loaded pattern history from disk")
+		}
+	}
+
+	return d
+}
+
+// RecordEvent records a new event for pattern analysis
+func (d *Detector) RecordEvent(event HistoricalEvent) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	if event.ID == "" {
+		event.ID = generateEventID()
+	}
+	if event.Timestamp.IsZero() {
+		event.Timestamp = time.Now()
+	}
+
+	d.events = append(d.events, event)
+	d.trimEvents()
+
+	// Recompute pattern for this resource/event type
+	key := patternKey(event.ResourceID, event.EventType)
+	pattern := d.computePattern(event.ResourceID, event.EventType)
+	if pattern == nil {
+		delete(d.patterns, key)
+	} else {
+		d.patterns[key] = pattern
+	}
+
+	// Persist asynchronously
+	go func() {
+		if err := d.saveToDisk(); err != nil {
+			log.Warn().Err(err).Msg("Failed to save pattern history")
+		}
+	}()
+}
+
+// RecordFromAlert records an event from an alert
+func (d *Detector) RecordFromAlert(resourceID string, alertType string, timestamp time.Time) {
+	eventType := mapAlertToEventType(alertType)
+	if eventType == "" {
+		return // Not a trackable event type
+	}
+
+	d.RecordEvent(HistoricalEvent{
+		ResourceID:  resourceID,
+		EventType:   eventType,
+		Timestamp:   timestamp,
+		Description: alertType,
+	})
+}
+
+// GetPredictions returns failure predictions for all tracked resources
+func (d *Detector) GetPredictions() []FailurePrediction {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	var predictions []FailurePrediction
+	now := time.Now()
+
+	for _, pattern := range d.patterns {
+		if pattern == nil {
+			continue
+		}
+		// Only predict if pattern has sufficient confidence
+		if pattern.Confidence < 0.3 || pattern.Occurrences < d.minOccurrences {
+			continue
+		}
+
+		// Check if prediction is within our limit
+		if pattern.NextPredicted.Before(now) || pattern.NextPredicted.After(now.Add(d.predictionLimit)) {
+			continue
+		}
+
+		daysUntil := pattern.NextPredicted.Sub(now).Hours() / 24
+
+		predictions = append(predictions, FailurePrediction{
+			ResourceID:  pattern.ResourceID,
+			EventType:   pattern.EventType,
+			PredictedAt: pattern.NextPredicted,
+			DaysUntil:   daysUntil,
+			Confidence:  pattern.Confidence,
+			Basis:       formatPatternBasis(pattern),
+			Pattern:     pattern,
+		})
+	}
+
+	// Sort by days until (soonest first)
+	sort.Slice(predictions, func(i, j int) bool {
+		return predictions[i].DaysUntil < predictions[j].DaysUntil
+	})
+
+	return predictions
+}
+
+// GetPredictionsForResource returns failure predictions for a specific resource
+func (d *Detector) GetPredictionsForResource(resourceID string) []FailurePrediction {
+	all := d.GetPredictions()
+	var result []FailurePrediction
+	for _, p := range all {
+		if p.ResourceID == resourceID {
+			result = append(result, p)
+		}
+	}
+	return result
+}
+
+// GetPatterns returns all detected patterns
+func (d *Detector) GetPatterns() map[string]*Pattern {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+
+	result := make(map[string]*Pattern)
+	for k, v := range d.patterns {
+		if v == nil {
+			continue
+		}
+		result[k] = v
+	}
+	return result
+}
+
+// computePattern analyzes events to find patterns for a resource/event type
+func (d *Detector) computePattern(resourceID string, eventType EventType) *Pattern {
+	cutoff := time.Now().Add(-d.patternWindow)
+
+	// Get all events for this resource/type within the window
+	var events []HistoricalEvent
+	for _, e := range d.events {
+		if e.ResourceID == resourceID && e.EventType == eventType && e.Timestamp.After(cutoff) {
+			events = append(events, e)
+		}
+	}
+
+	if len(events) < d.minOccurrences {
+		return nil
+	}
+
+	// Sort by timestamp
+	sort.Slice(events, func(i, j int) bool {
+		return events[i].Timestamp.Before(events[j].Timestamp)
+	})
+
+	// Calculate intervals between events
+	var intervals []time.Duration
+	var durations []time.Duration
+
+	for i := 1; i < len(events); i++ {
+		interval := events[i].Timestamp.Sub(events[i-1].Timestamp)
+		intervals = append(intervals, interval)
+
+		if events[i-1].Duration > 0 {
+			durations = append(durations, events[i-1].Duration)
+		}
+	}
+
+	if len(intervals) == 0 {
+		return nil
+	}
+
+	// Calculate average and stddev of intervals
+	avgInterval := averageDuration(intervals)
+	stddevInterval := stddevDuration(intervals, avgInterval)
+
+	// Calculate confidence based on consistency
+	// If stddev is low relative to mean, pattern is more reliable
+	consistency := 1.0
+	if avgInterval > 0 {
+		cv := float64(stddevInterval) / float64(avgInterval) // Coefficient of variation
+		consistency = 1.0 - math.Min(cv, 1.0)                // Higher consistency = lower CV
+	}
+
+	// Adjust confidence based on number of occurrences
+	occurrenceBonus := math.Min(float64(len(events))/10.0, 0.3)
+	confidence := consistency*0.7 + occurrenceBonus
+
+	// Predict next occurrence
+	lastEvent := events[len(events)-1]
+	nextPredicted := lastEvent.Timestamp.Add(avgInterval)
+
+	// Calculate average duration if available
+	var avgDuration time.Duration
+	if len(durations) > 0 {
+		avgDuration = averageDuration(durations)
+	}
+
+	return &Pattern{
+		ResourceID:      resourceID,
+		EventType:       eventType,
+		Occurrences:     len(events),
+		AverageInterval: avgInterval,
+		StdDevInterval:  stddevInterval,
+		LastOccurrence:  lastEvent.Timestamp,
+		NextPredicted:   nextPredicted,
+		Confidence:      confidence,
+		AverageDuration: avgDuration,
+	}
+}
+
+// trimEvents removes old events beyond maxEvents
+func (d *Detector) trimEvents() {
+	cutoff := time.Now().Add(-d.patternWindow)
+	kept := d.events[:0]
+	for _, e := range d.events {
+		if e.Timestamp.After(cutoff) {
+			kept = append(kept, e)
+		}
+	}
+	d.events = kept
+
+	if len(d.events) > d.maxEvents {
+		d.events = d.events[len(d.events)-d.maxEvents:]
+	}
+}
+
+// saveToDisk persists events and patterns
+func (d *Detector) saveToDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	d.mu.RLock()
+	data := struct {
+		Events   []HistoricalEvent   `json:"events"`
+		Patterns map[string]*Pattern `json:"patterns"`
+	}{
+		Events:   d.events,
+		Patterns: d.patterns,
+	}
+	d.mu.RUnlock()
+
+	jsonData, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	path := filepath.Join(d.dataDir, "ai_patterns.json")
+	tmpPath := path + ".tmp"
+	if err := os.WriteFile(tmpPath, jsonData, 0600); err != nil {
+		return err
+	}
+
+	return os.Rename(tmpPath, path)
+}
+
+// loadFromDisk loads events and patterns
+func (d *Detector) loadFromDisk() error {
+	if d.dataDir == "" {
+		return nil
+	}
+
+	path := filepath.Join(d.dataDir, "ai_patterns.json")
+	if st, err := os.Stat(path); err == nil {
+		const maxOnDiskBytes = 10 << 20 // 10 MiB safety cap
+		if st.Size() > maxOnDiskBytes {
+			return fmt.Errorf("pattern history file too large (%d bytes)", st.Size())
+		}
+	}
+	jsonData, err := os.ReadFile(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+
+	var data struct {
+		Events   []HistoricalEvent   `json:"events"`
+		Patterns map[string]*Pattern `json:"patterns"`
+	}
+
+	if err := json.Unmarshal(jsonData, &data); err != nil {
+		return err
+	}
+
+	d.events = data.Events
+	d.patterns = make(map[string]*Pattern, len(data.Patterns))
+	for k, v := range data.Patterns {
+		if v == nil {
+			continue
+		}
+		d.patterns[k] = v
+	}
+
+	d.trimEvents()
+	cutoff := time.Now().Add(-d.patternWindow)
+	for k, v := range d.patterns {
+		if v == nil {
+			delete(d.patterns, k)
+			continue
+		}
+		if v.Occurrences < d.minOccurrences || v.LastOccurrence.Before(cutoff) {
+			delete(d.patterns, k)
+		}
+	}
+
+	return nil
+}
+
+// FormatForContext formats predictions for AI consumption
+func (d *Detector) FormatForContext(resourceID string) string {
+	var predictions []FailurePrediction
+	if resourceID != "" {
+		predictions = d.GetPredictionsForResource(resourceID)
+	} else {
+		predictions = d.GetPredictions()
+	}
+
+	if len(predictions) == 0 {
+		return ""
+	}
+
+	var result string
+	result = "\n## ⏰ Failure Predictions\n"
+	result += "Based on historical patterns:\n"
+
+	for _, p := range predictions {
+		if len(result) > 2000 { // Limit context size
+			result += "\n... and more\n"
+			break
+		}
+		result += "- " + p.Basis + "\n"
+	}
+
+	return result
+}
+
+// Helper functions
+
+var eventCounter int64
+
+func generateEventID() string {
+	eventCounter++
+	return time.Now().Format("20060102150405") + "-" + intToStr(int(eventCounter%1000))
+}
+
+func intToStr(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var result string
+	for n > 0 {
+		result = string(rune('0'+n%10)) + result
+		n /= 10
+	}
+	return result
+}
+
+func patternKey(resourceID string, eventType EventType) string {
+	return resourceID + ":" + string(eventType)
+}
+
+func mapAlertToEventType(alertType string) EventType {
+	switch alertType {
+	case "memory_warning", "memory_critical":
+		return EventHighMemory
+	case "cpu_warning", "cpu_critical":
+		return EventHighCPU
+	case "disk_warning", "disk_critical":
+		return EventDiskFull
+	case "oom", "out_of_memory":
+		return EventOOM
+	case "restart", "restarted":
+		return EventRestart
+	case "unresponsive", "unreachable":
+		return EventUnresponsive
+	case "backup_failed":
+		return EventBackupFailed
+	default:
+		return ""
+	}
+}
+
+func averageDuration(durations []time.Duration) time.Duration {
+	if len(durations) == 0 {
+		return 0
+	}
+	var sum int64
+	for _, d := range durations {
+		sum += int64(d)
+	}
+	return time.Duration(sum / int64(len(durations)))
+}
+
+func stddevDuration(durations []time.Duration, mean time.Duration) time.Duration {
+	if len(durations) < 2 {
+		return 0
+	}
+	var sumSquares float64
+	for _, d := range durations {
+		diff := float64(d - mean)
+		sumSquares += diff * diff
+	}
+	variance := sumSquares / float64(len(durations)-1)
+	return time.Duration(math.Sqrt(variance))
+}
+
+func formatPatternBasis(p *Pattern) string {
+	daysInterval := p.AverageInterval.Hours() / 24
+	daysSinceLast := time.Since(p.LastOccurrence).Hours() / 24
+	daysUntilNext := p.NextPredicted.Sub(time.Now()).Hours() / 24
+
+	eventName := string(p.EventType)
+	switch p.EventType {
+	case EventHighMemory:
+		eventName = "high memory usage"
+	case EventHighCPU:
+		eventName = "high CPU usage"
+	case EventDiskFull:
+		eventName = "disk space critical"
+	case EventOOM:
+		eventName = "OOM events"
+	case EventRestart:
+		eventName = "restarts"
+	case EventUnresponsive:
+		eventName = "unresponsive periods"
+	case EventBackupFailed:
+		eventName = "backup failures"
+	}
+
+	if daysUntilNext < 0 {
+		return eventName + " typically occurs every ~" + formatDays(daysInterval) +
+			" (last: " + formatDays(daysSinceLast) + " ago, overdue)"
+	}
+
+	return eventName + " typically occurs every ~" + formatDays(daysInterval) +
+		" (next expected in ~" + formatDays(daysUntilNext) + ")"
+}
+
+func formatDays(days float64) string {
+	if days < 1 {
+		hours := days * 24
+		if hours < 1 {
+			return "less than an hour"
+		}
+		return intToStr(int(hours)) + " hours"
+	}
+	if days < 2 {
+		return "1 day"
+	}
+	return intToStr(int(days)) + " days"
+}
diff --git a/internal/ai/patterns/detector_test.go b/internal/ai/patterns/detector_test.go
new file mode 100644
index 0000000..89bbcd2
--- /dev/null
+++ b/internal/ai/patterns/detector_test.go
@@ -0,0 +1,206 @@
+package patterns
+
+import (
+	"testing"
+	"time"
+)
+
+func TestDetector_RecordEvent(t *testing.T) {
+	d := NewDetector(DetectorConfig{MinOccurrences: 2})
+
+	// Record first event
+	d.RecordEvent(HistoricalEvent{
+		ResourceID: "vm-100",
+		EventType:  EventHighMemory,
+		Timestamp:  time.Now().Add(-10 * 24 * time.Hour),
+	})
+
+	if len(d.events) != 1 {
+		t.Errorf("Expected 1 event, got %d", len(d.events))
+	}
+}
+
+func TestDetector_PatternDetection(t *testing.T) {
+	d := NewDetector(DetectorConfig{MinOccurrences: 3, PatternWindow: 365 * 24 * time.Hour})
+
+	// Record events with 10-day interval
+	now := time.Now()
+	for i := 5; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "vm-100",
+			EventType:  EventHighMemory,
+			Timestamp:  now.Add(-time.Duration(i*10) * 24 * time.Hour),
+		})
+	}
+
+	// Check that pattern was detected
+	patterns := d.GetPatterns()
+	key := patternKey("vm-100", EventHighMemory)
+	pattern, ok := patterns[key]
+	if !ok {
+		t.Fatal("Expected pattern to be detected")
+	}
+
+	if pattern.Occurrences != 6 {
+		t.Errorf("Expected 6 occurrences, got %d", pattern.Occurrences)
+	}
+
+	// Average interval should be ~10 days
+	avgDays := pattern.AverageInterval.Hours() / 24
+	if avgDays < 9 || avgDays > 11 {
+		t.Errorf("Expected ~10 day interval, got %.1f days", avgDays)
+	}
+}
+
+func TestDetector_GetPredictions(t *testing.T) {
+	d := NewDetector(DetectorConfig{
+		MinOccurrences:  3,
+		PatternWindow:   365 * 24 * time.Hour,
+		PredictionLimit: 30 * 24 * time.Hour,
+	})
+
+	// Record events with regular interval
+	now := time.Now()
+	for i := 3; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "vm-100",
+			EventType:  EventOOM,
+			Timestamp:  now.Add(-time.Duration(i*7) * 24 * time.Hour), // 7-day interval
+		})
+	}
+
+	predictions := d.GetPredictions()
+	
+	// Should have a prediction for OOM
+	found := false
+	for _, p := range predictions {
+		if p.ResourceID == "vm-100" && p.EventType == EventOOM {
+			found = true
+			// Should predict in ~7 days
+			if p.DaysUntil < 5 || p.DaysUntil > 9 {
+				t.Errorf("Expected prediction in ~7 days, got %.1f days", p.DaysUntil)
+			}
+			break
+		}
+	}
+	
+	if !found {
+		t.Error("Expected OOM prediction for vm-100")
+	}
+}
+
+func TestDetector_GetPredictionsForResource(t *testing.T) {
+	d := NewDetector(DetectorConfig{MinOccurrences: 3, PatternWindow: 365 * 24 * time.Hour})
+
+	now := time.Now()
+	// Add pattern for vm-100
+	for i := 3; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "vm-100",
+			EventType:  EventRestart,
+			Timestamp:  now.Add(-time.Duration(i*14) * 24 * time.Hour),
+		})
+	}
+	// Add pattern for vm-200
+	for i := 3; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "vm-200",
+			EventType:  EventHighCPU,
+			Timestamp:  now.Add(-time.Duration(i*5) * 24 * time.Hour),
+		})
+	}
+
+	// Get predictions for vm-100 only
+	predictions := d.GetPredictionsForResource("vm-100")
+	for _, p := range predictions {
+		if p.ResourceID != "vm-100" {
+			t.Errorf("Got prediction for wrong resource: %s", p.ResourceID)
+		}
+	}
+}
+
+func TestDetector_Confidence(t *testing.T) {
+	d := NewDetector(DetectorConfig{MinOccurrences: 3, PatternWindow: 365 * 24 * time.Hour})
+
+	now := time.Now()
+	// Add very consistent pattern (every 7 days exactly)
+	for i := 5; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "consistent-vm",
+			EventType:  EventHighMemory,
+			Timestamp:  now.Add(-time.Duration(i*7*24) * time.Hour),
+		})
+	}
+
+	patterns := d.GetPatterns()
+	pattern := patterns[patternKey("consistent-vm", EventHighMemory)]
+	if pattern == nil {
+		t.Fatal("Expected pattern")
+	}
+
+	// Consistent pattern should have high confidence
+	if pattern.Confidence < 0.5 {
+		t.Errorf("Expected high confidence for consistent pattern, got %.2f", pattern.Confidence)
+	}
+}
+
+func TestDetector_FormatForContext(t *testing.T) {
+	d := NewDetector(DetectorConfig{MinOccurrences: 3, PatternWindow: 365 * 24 * time.Hour})
+
+	now := time.Now()
+	for i := 3; i >= 0; i-- {
+		d.RecordEvent(HistoricalEvent{
+			ResourceID: "vm-100",
+			EventType:  EventOOM,
+			Timestamp:  now.Add(-time.Duration(i*10) * 24 * time.Hour),
+		})
+	}
+
+	context := d.FormatForContext("vm-100")
+	if context == "" {
+		t.Error("Expected non-empty context")
+	}
+	
+	if !contains(context, "OOM") && !contains(context, "oom") {
+		t.Errorf("Expected context to mention OOM: %s", context)
+	}
+}
+
+func TestMapAlertToEventType(t *testing.T) {
+	tests := []struct {
+		alertType string
+		expected  EventType
+	}{
+		{"memory_warning", EventHighMemory},
+		{"memory_critical", EventHighMemory},
+		{"cpu_warning", EventHighCPU},
+		{"cpu_critical", EventHighCPU},
+		{"disk_warning", EventDiskFull},
+		{"disk_critical", EventDiskFull},
+		{"oom", EventOOM},
+		{"restart", EventRestart},
+		{"unresponsive", EventUnresponsive},
+		{"backup_failed", EventBackupFailed},
+		{"unknown_alert", ""},
+	}
+
+	for _, tc := range tests {
+		result := mapAlertToEventType(tc.alertType)
+		if result != tc.expected {
+			t.Errorf("mapAlertToEventType(%q) = %q, want %q", tc.alertType, result, tc.expected)
+		}
+	}
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsHelper(s, substr))
+}
+
+func containsHelper(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/ai/providers/anthropic.go b/internal/ai/providers/anthropic.go
new file mode 100644
index 0000000..cf4acf9
--- /dev/null
+++ b/internal/ai/providers/anthropic.go
@@ -0,0 +1,392 @@
+package providers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	anthropicAPIURL     = "https://api.anthropic.com/v1/messages"
+	anthropicAPIVersion = "2023-06-01"
+	maxRetries          = 3
+	initialBackoff      = 2 * time.Second
+)
+
+// AnthropicClient implements the Provider interface for Anthropic's Claude API
+type AnthropicClient struct {
+	apiKey string
+	model  string
+	client *http.Client
+}
+
+// NewAnthropicClient creates a new Anthropic API client
+func NewAnthropicClient(apiKey, model string) *AnthropicClient {
+	return &AnthropicClient{
+		apiKey: apiKey,
+		model:  model,
+		client: &http.Client{
+			// 5 minutes - Opus and other large models can take a very long time
+			Timeout: 300 * time.Second,
+		},
+	}
+}
+
+// Name returns the provider name
+func (c *AnthropicClient) Name() string {
+	return "anthropic"
+}
+
+// anthropicRequest is the request body for the Anthropic API
+type anthropicRequest struct {
+	Model       string             `json:"model"`
+	Messages    []anthropicMessage `json:"messages"`
+	MaxTokens   int                `json:"max_tokens"`
+	System      string             `json:"system,omitempty"`
+	Temperature float64            `json:"temperature,omitempty"`
+	Tools       []anthropicTool    `json:"tools,omitempty"`
+}
+
+type anthropicMessage struct {
+	Role    string        `json:"role"`
+	Content interface{}   `json:"content"` // Can be string or []anthropicContent
+}
+
+// anthropicTool represents a regular function tool
+type anthropicTool struct {
+	Type        string                 `json:"type,omitempty"`        // "web_search_20250305" for web search, omit for regular tools
+	Name        string                 `json:"name"`
+	Description string                 `json:"description,omitempty"` // Not used for web search
+	InputSchema map[string]interface{} `json:"input_schema,omitempty"` // Not used for web search
+	MaxUses     int                    `json:"max_uses,omitempty"`    // For web search: limit searches per request
+}
+
+// anthropicResponse is the response from the Anthropic API
+type anthropicResponse struct {
+	ID           string `json:"id"`
+	Type         string `json:"type"`
+	Role         string `json:"role"`
+	Content      []anthropicContent `json:"content"`
+	Model        string `json:"model"`
+	StopReason   string `json:"stop_reason"`
+	StopSequence string `json:"stop_sequence,omitempty"`
+	Usage        anthropicUsage `json:"usage"`
+}
+
+type anthropicContent struct {
+	Type      string                 `json:"type"`                  // "text", "tool_use", "tool_result", "server_tool_use", "web_search_tool_result"
+	Text      string                 `json:"text,omitempty"`
+	ID        string                 `json:"id,omitempty"`          // For tool_use
+	Name      string                 `json:"name,omitempty"`        // For tool_use
+	Input     map[string]interface{} `json:"input,omitempty"`       // For tool_use
+	ToolUseID string                 `json:"tool_use_id,omitempty"` // For tool_result
+	Content   json.RawMessage        `json:"content,omitempty"`     // Can be string or array (for web_search_tool_result)
+	IsError   bool                   `json:"is_error,omitempty"`    // For tool_result
+}
+
+type anthropicUsage struct {
+	InputTokens  int `json:"input_tokens"`
+	OutputTokens int `json:"output_tokens"`
+}
+
+type anthropicError struct {
+	Type    string `json:"type"`
+	Error   anthropicErrorDetail `json:"error"`
+}
+
+type anthropicErrorDetail struct {
+	Type    string `json:"type"`
+	Message string `json:"message"`
+}
+
+// Chat sends a chat request to the Anthropic API
+func (c *AnthropicClient) Chat(ctx context.Context, req ChatRequest) (*ChatResponse, error) {
+	// Convert messages to Anthropic format
+	messages := make([]anthropicMessage, 0, len(req.Messages))
+	for _, m := range req.Messages {
+		// Anthropic doesn't use "system" role in messages array
+		if m.Role == "system" {
+			continue
+		}
+
+		// Handle tool results specially
+		if m.ToolResult != nil {
+			// Tool result message - Content needs to be JSON-encoded string
+			contentJSON, _ := json.Marshal(m.ToolResult.Content)
+			messages = append(messages, anthropicMessage{
+				Role: "user",
+				Content: []anthropicContent{
+					{
+						Type:      "tool_result",
+						ToolUseID: m.ToolResult.ToolUseID,
+						Content:   contentJSON,
+						IsError:   m.ToolResult.IsError,
+					},
+				},
+			})
+			continue
+		}
+
+		// Handle assistant messages with tool calls
+		if m.Role == "assistant" && len(m.ToolCalls) > 0 {
+			contentBlocks := make([]anthropicContent, 0)
+			if m.Content != "" {
+				contentBlocks = append(contentBlocks, anthropicContent{
+					Type: "text",
+					Text: m.Content,
+				})
+			}
+			for _, tc := range m.ToolCalls {
+				contentBlocks = append(contentBlocks, anthropicContent{
+					Type:  "tool_use",
+					ID:    tc.ID,
+					Name:  tc.Name,
+					Input: tc.Input,
+				})
+			}
+			messages = append(messages, anthropicMessage{
+				Role:    "assistant",
+				Content: contentBlocks,
+			})
+			continue
+		}
+
+		// Simple text message
+		messages = append(messages, anthropicMessage{
+			Role:    m.Role,
+			Content: m.Content,
+		})
+	}
+
+	// Use provided model or fall back to client default
+	model := req.Model
+	if model == "" {
+		model = c.model
+	}
+
+	// Set max tokens (Anthropic requires this)
+	maxTokens := req.MaxTokens
+	if maxTokens == 0 {
+		maxTokens = 4096
+	}
+
+	anthropicReq := anthropicRequest{
+		Model:     model,
+		Messages:  messages,
+		MaxTokens: maxTokens,
+		System:    req.System,
+	}
+
+	if req.Temperature > 0 {
+		anthropicReq.Temperature = req.Temperature
+	}
+
+	// Add tools if provided
+	if len(req.Tools) > 0 {
+		anthropicReq.Tools = make([]anthropicTool, len(req.Tools))
+		for i, t := range req.Tools {
+			if t.Type == "web_search_20250305" {
+				// Web search tool has a special format
+				anthropicReq.Tools[i] = anthropicTool{
+					Type:    t.Type,
+					Name:    t.Name,
+					MaxUses: t.MaxUses,
+				}
+			} else {
+				// Regular function tool
+				anthropicReq.Tools[i] = anthropicTool{
+					Name:        t.Name,
+					Description: t.Description,
+					InputSchema: t.InputSchema,
+				}
+			}
+		}
+	}
+
+	body, err := json.Marshal(anthropicReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	// Retry loop for transient errors (429, 529, 5xx)
+	var respBody []byte
+	var lastErr error
+
+	for attempt := 0; attempt <= maxRetries; attempt++ {
+		if attempt > 0 {
+			// Exponential backoff: 2s, 4s, 8s
+			backoff := initialBackoff * time.Duration(1<<(attempt-1))
+			log.Warn().
+				Int("attempt", attempt).
+				Dur("backoff", backoff).
+				Str("last_error", lastErr.Error()).
+				Msg("Retrying Anthropic API request after transient error")
+
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(backoff):
+			}
+		}
+
+		httpReq, err := http.NewRequestWithContext(ctx, "POST", anthropicAPIURL, bytes.NewReader(body))
+		if err != nil {
+			return nil, fmt.Errorf("failed to create request: %w", err)
+		}
+
+		httpReq.Header.Set("Content-Type", "application/json")
+		httpReq.Header.Set("x-api-key", c.apiKey)
+		httpReq.Header.Set("anthropic-version", anthropicAPIVersion)
+
+		resp, err := c.client.Do(httpReq)
+		if err != nil {
+			lastErr = fmt.Errorf("request failed: %w", err)
+			continue
+		}
+
+		respBody, err = io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			lastErr = fmt.Errorf("failed to read response: %w", err)
+			continue
+		}
+
+		// Check if this is a retryable error
+		if resp.StatusCode == 429 || resp.StatusCode == 529 || resp.StatusCode >= 500 {
+			var errResp anthropicError
+			errMsg := string(respBody)
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				errMsg = errResp.Error.Message
+			}
+			lastErr = fmt.Errorf("API error (%d): %s", resp.StatusCode, errMsg)
+			continue
+		}
+
+		// Non-retryable error
+		if resp.StatusCode != http.StatusOK {
+			var errResp anthropicError
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, errResp.Error.Message)
+			}
+			return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
+		}
+
+		// Success - break out of retry loop
+		lastErr = nil
+		break
+	}
+
+	if lastErr != nil {
+		return nil, fmt.Errorf("failed after %d retries: %w", maxRetries, lastErr)
+	}
+
+	var anthropicResp anthropicResponse
+	if err := json.Unmarshal(respBody, &anthropicResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	// Extract content and tool calls from response
+	var textContent string
+	var toolCalls []ToolCall
+	for _, c := range anthropicResp.Content {
+		switch c.Type {
+		case "text":
+			textContent += c.Text
+		case "tool_use":
+			// Regular tool use - we need to execute these
+			toolCalls = append(toolCalls, ToolCall{
+				ID:    c.ID,
+				Name:  c.Name,
+				Input: c.Input,
+			})
+		case "server_tool_use":
+			// Server-side tool (like web_search) - Anthropic handles these automatically
+			// We just log it for debugging, no action needed
+			log.Debug().
+				Str("tool_name", c.Name).
+				Msg("Server tool use detected (handled by Anthropic)")
+		case "web_search_tool_result":
+			// Results from web search - already incorporated into Claude's response
+			log.Debug().Msg("Web search results received")
+		}
+	}
+
+	// Log content summary for debugging
+	log.Debug().
+		Int("content_blocks", len(anthropicResp.Content)).
+		Int("text_length", len(textContent)).
+		Int("tool_calls", len(toolCalls)).
+		Str("stop_reason", anthropicResp.StopReason).
+		Msg("Anthropic response parsed")
+
+	return &ChatResponse{
+		Content:      textContent,
+		Model:        anthropicResp.Model,
+		StopReason:   anthropicResp.StopReason,
+		ToolCalls:    toolCalls,
+		InputTokens:  anthropicResp.Usage.InputTokens,
+		OutputTokens: anthropicResp.Usage.OutputTokens,
+	}, nil
+}
+
+// TestConnection validates the API key by making a minimal request
+func (c *AnthropicClient) TestConnection(ctx context.Context) error {
+	// Make a minimal request to validate the API key
+	_, err := c.Chat(ctx, ChatRequest{
+		Messages: []Message{
+			{Role: "user", Content: "Hi"},
+		},
+		MaxTokens: 10, // Minimal tokens to save cost
+	})
+	return err
+}
+
+// ListModels fetches available models from the Anthropic API
+func (c *AnthropicClient) ListModels(ctx context.Context) ([]ModelInfo, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://api.anthropic.com/v1/models", nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("x-api-key", c.apiKey)
+	req.Header.Set("anthropic-version", anthropicAPIVersion)
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Data []struct {
+			ID          string `json:"id"`
+			DisplayName string `json:"display_name"`
+			CreatedAt   string `json:"created_at"`
+		} `json:"data"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	models := make([]ModelInfo, 0, len(result.Data))
+	for _, m := range result.Data {
+		models = append(models, ModelInfo{
+			ID:   m.ID,
+			Name: m.DisplayName,
+		})
+	}
+
+	return models, nil
+}
diff --git a/internal/ai/providers/anthropic_oauth.go b/internal/ai/providers/anthropic_oauth.go
new file mode 100644
index 0000000..9a6e344
--- /dev/null
+++ b/internal/ai/providers/anthropic_oauth.go
@@ -0,0 +1,660 @@
+package providers
+
+// anthropic_oauth.go - OAuth client for Claude Pro/Max subscription authentication
+//
+// STATUS: DISABLED IN UI - Anthropic restricts OAuth to Claude Code only
+//
+// This implementation follows Claude Code's OAuth flow exactly:
+// 1. Get authorization code from claude.ai/oauth/authorize
+// 2. Exchange code for tokens at console.anthropic.com/v1/oauth/token
+// 3. Try to create API key (works for Team/Enterprise users)
+// 4. Use OAuth tokens directly (for Pro/Max users)
+//
+// However, Anthropic has locked down their OAuth system:
+// - OAuth tokens are server-side validated to only work within Claude Code
+// - The error "This credential is only authorized for use with Claude Code" is returned
+// - Pro/Max users don't have org:create_api_key permission to create API keys
+//
+// This code is kept intact in case Anthropic opens up OAuth for third-party apps in the future.
+// To re-enable, update the frontend AISettings.tsx to un-disable the OAuth button.
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	// OAuth endpoints - these are the same endpoints Claude Code uses
+	// Authorization happens at claude.ai, token exchange at console.anthropic.com
+	anthropicAuthorizeURL = "https://claude.ai/oauth/authorize"
+	anthropicTokenURL     = "https://console.anthropic.com/v1/oauth/token"
+	// API key creation endpoint - OAuth tokens create an API key for actual use
+	anthropicAPIKeyURL = "https://api.anthropic.com/api/oauth/claude_cli/create_api_key"
+	// Claude Code's client ID - this is what enables subscription-based auth
+	claudeCodeClientID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
+	// Scopes needed for inference with subscription (matching Claude Code's Oo0 array)
+	// org:create_api_key, user:profile, user:inference, user:sessions:claude_code
+	oauthScopes = "org:create_api_key user:profile user:inference user:sessions:claude_code"
+)
+
+// OAuthTokens represents the tokens obtained from OAuth flow
+type OAuthTokens struct {
+	AccessToken  string    `json:"access_token"`
+	RefreshToken string    `json:"refresh_token"`
+	TokenType    string    `json:"token_type"`
+	ExpiresIn    int       `json:"expires_in"`
+	Scope        string    `json:"scope"`
+	ExpiresAt    time.Time `json:"-"`
+	// APIKey is created from the access token and used for actual API calls
+	APIKey string `json:"api_key,omitempty"`
+}
+
+// OAuthSession stores the state for an in-progress OAuth flow
+type OAuthSession struct {
+	State        string
+	CodeVerifier string
+	RedirectURI  string
+	CreatedAt    time.Time
+}
+
+// GenerateOAuthSession creates a new OAuth session with PKCE parameters
+func GenerateOAuthSession(redirectURI string) (*OAuthSession, error) {
+	// Generate state (for CSRF protection)
+	stateBytes := make([]byte, 32)
+	if _, err := rand.Read(stateBytes); err != nil {
+		return nil, fmt.Errorf("failed to generate state: %w", err)
+	}
+	state := base64.RawURLEncoding.EncodeToString(stateBytes)
+
+	// Generate code verifier (PKCE)
+	verifierBytes := make([]byte, 32)
+	if _, err := rand.Read(verifierBytes); err != nil {
+		return nil, fmt.Errorf("failed to generate code verifier: %w", err)
+	}
+	codeVerifier := base64.RawURLEncoding.EncodeToString(verifierBytes)
+
+	return &OAuthSession{
+		State:        state,
+		CodeVerifier: codeVerifier,
+		RedirectURI:  redirectURI,
+		CreatedAt:    time.Now(),
+	}, nil
+}
+
+// GetAuthorizationURL returns the URL to redirect the user to for OAuth authorization
+// The user will visit this URL, log in, and get an authorization code to paste back
+func GetAuthorizationURL(session *OAuthSession) string {
+	// Generate code challenge from code verifier (S256)
+	h := sha256.Sum256([]byte(session.CodeVerifier))
+	codeChallenge := base64.RawURLEncoding.EncodeToString(h[:])
+
+	params := url.Values{}
+	// Match Claude Code's exact parameter order and values
+	params.Set("code", "true") // Claude Code adds this
+	params.Set("client_id", claudeCodeClientID)
+	params.Set("response_type", "code")
+	// Use Anthropic's official callback which displays the code for the user to copy
+	params.Set("redirect_uri", "https://console.anthropic.com/oauth/code/callback")
+	params.Set("scope", oauthScopes)
+	params.Set("code_challenge", codeChallenge)
+	params.Set("code_challenge_method", "S256")
+	params.Set("state", session.State)
+
+	return anthropicAuthorizeURL + "?" + params.Encode()
+}
+
+// ExchangeCodeForTokens exchanges an authorization code for access tokens
+func ExchangeCodeForTokens(ctx context.Context, code string, session *OAuthSession) (*OAuthTokens, error) {
+	// Build JSON body (matching Claude Code's exact implementation)
+	// Claude Code uses Content-Type: application/json, NOT form-urlencoded
+	payload := map[string]interface{}{
+		"grant_type":    "authorization_code",
+		"code":          code,
+		"redirect_uri":  "https://console.anthropic.com/oauth/code/callback",
+		"client_id":     claudeCodeClientID,
+		"code_verifier": session.CodeVerifier,
+		"state":         session.State,
+	}
+
+	jsonBody, err := json.Marshal(payload)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal token request: %w", err)
+	}
+
+	log.Debug().
+		Str("grant_type", "authorization_code").
+		Str("client_id", claudeCodeClientID).
+		Str("code_len", fmt.Sprintf("%d", len(code))).
+		Str("verifier_len", fmt.Sprintf("%d", len(session.CodeVerifier))).
+		Str("state_prefix", session.State[:min(8, len(session.State))]).
+		Str("redirect_uri", "https://console.anthropic.com/oauth/code/callback").
+		Msg("Sending OAuth token exchange request (JSON)")
+
+	req, err := http.NewRequestWithContext(ctx, "POST", anthropicTokenURL, bytes.NewReader(jsonBody))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create token request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("token request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read token response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		log.Error().
+			Int("status", resp.StatusCode).
+			Str("body", string(body)).
+			Msg("OAuth token exchange failed")
+		return nil, fmt.Errorf("token exchange failed with status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var tokens OAuthTokens
+	if err := json.Unmarshal(body, &tokens); err != nil {
+		return nil, fmt.Errorf("failed to parse token response: %w", err)
+	}
+
+	// Calculate expiration time
+	if tokens.ExpiresIn > 0 {
+		tokens.ExpiresAt = time.Now().Add(time.Duration(tokens.ExpiresIn) * time.Second)
+	}
+
+	log.Info().
+		Str("token_type", tokens.TokenType).
+		Int("expires_in", tokens.ExpiresIn).
+		Str("scope", tokens.Scope).
+		Msg("Successfully exchanged OAuth code for tokens")
+
+	return &tokens, nil
+}
+
+// CreateAPIKeyFromOAuth uses an OAuth access token to create a real API key
+// This is how Claude Code uses the OAuth flow - the OAuth token creates an API key
+func CreateAPIKeyFromOAuth(ctx context.Context, accessToken string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, "POST", anthropicAPIKeyURL, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to create API key request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "Bearer "+accessToken)
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("API key request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("failed to read API key response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		log.Error().
+			Int("status", resp.StatusCode).
+			Str("body", string(body)).
+			Msg("Failed to create API key from OAuth token")
+		return "", fmt.Errorf("API key creation failed with status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		RawKey string `json:"raw_key"`
+	}
+	if err := json.Unmarshal(body, &result); err != nil {
+		return "", fmt.Errorf("failed to parse API key response: %w", err)
+	}
+
+	if result.RawKey == "" {
+		return "", fmt.Errorf("no API key returned from OAuth")
+	}
+
+	log.Info().Msg("Successfully created API key from OAuth token")
+	return result.RawKey, nil
+}
+
+// RefreshAccessToken uses a refresh token to get a new access token
+func RefreshAccessToken(ctx context.Context, refreshToken string) (*OAuthTokens, error) {
+	// Build JSON body (matching Claude Code's implementation)
+	payload := map[string]interface{}{
+		"grant_type":    "refresh_token",
+		"refresh_token": refreshToken,
+		"client_id":     claudeCodeClientID,
+		"scope":         oauthScopes,
+	}
+
+	jsonBody, err := json.Marshal(payload)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal refresh request: %w", err)
+	}
+
+	log.Debug().
+		Str("grant_type", "refresh_token").
+		Str("client_id", claudeCodeClientID).
+		Msg("Sending OAuth token refresh request")
+
+	req, err := http.NewRequestWithContext(ctx, "POST", anthropicTokenURL, bytes.NewReader(jsonBody))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create refresh request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("refresh request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read refresh response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		log.Warn().
+			Int("status", resp.StatusCode).
+			Str("body", string(body)).
+			Msg("OAuth token refresh failed")
+		return nil, fmt.Errorf("token refresh failed with status %d: %s", resp.StatusCode, string(body))
+	}
+
+	var tokens OAuthTokens
+	if err := json.Unmarshal(body, &tokens); err != nil {
+		return nil, fmt.Errorf("failed to parse refresh response: %w", err)
+	}
+
+	// Keep the original refresh token if a new one wasn't returned
+	if tokens.RefreshToken == "" {
+		tokens.RefreshToken = refreshToken
+	}
+
+	// Calculate expiration time
+	if tokens.ExpiresIn > 0 {
+		tokens.ExpiresAt = time.Now().Add(time.Duration(tokens.ExpiresIn) * time.Second)
+	}
+
+	log.Info().
+		Int("expires_in", tokens.ExpiresIn).
+		Msg("Successfully refreshed OAuth access token")
+
+	return &tokens, nil
+}
+
+// AnthropicOAuthClient is a client that uses OAuth tokens instead of API keys
+type AnthropicOAuthClient struct {
+	accessToken  string
+	refreshToken string
+	expiresAt    time.Time
+	model        string
+	client       *http.Client
+	onTokenRefresh func(tokens *OAuthTokens) // Callback when tokens are refreshed
+}
+
+// NewAnthropicOAuthClient creates a new Anthropic client using OAuth tokens
+func NewAnthropicOAuthClient(accessToken, refreshToken string, expiresAt time.Time, model string) *AnthropicOAuthClient {
+	return &AnthropicOAuthClient{
+		accessToken:  accessToken,
+		refreshToken: refreshToken,
+		expiresAt:    expiresAt,
+		model:        model,
+		client: &http.Client{
+			Timeout: 300 * time.Second,
+		},
+	}
+}
+
+// SetTokenRefreshCallback sets a callback that will be called when tokens are refreshed
+func (c *AnthropicOAuthClient) SetTokenRefreshCallback(callback func(tokens *OAuthTokens)) {
+	c.onTokenRefresh = callback
+}
+
+// Name returns the provider name
+func (c *AnthropicOAuthClient) Name() string {
+	return "anthropic-oauth"
+}
+
+// ensureValidToken checks if the token is expired and refreshes if needed
+func (c *AnthropicOAuthClient) ensureValidToken(ctx context.Context) error {
+	// Add some buffer (5 minutes) before expiration
+	if time.Now().Add(5 * time.Minute).Before(c.expiresAt) {
+		return nil // Token is still valid
+	}
+
+	return c.forceRefreshToken(ctx)
+}
+
+// forceRefreshToken forces a token refresh (used on 401 errors)
+func (c *AnthropicOAuthClient) forceRefreshToken(ctx context.Context) error {
+	if c.refreshToken == "" {
+		return fmt.Errorf("access token expired and no refresh token available")
+	}
+
+	log.Info().Msg("OAuth access token expired, refreshing...")
+
+	tokens, err := RefreshAccessToken(ctx, c.refreshToken)
+	if err != nil {
+		return fmt.Errorf("failed to refresh token: %w", err)
+	}
+
+	c.accessToken = tokens.AccessToken
+	if tokens.RefreshToken != "" {
+		c.refreshToken = tokens.RefreshToken
+	}
+	c.expiresAt = tokens.ExpiresAt
+
+	// Notify callback of new tokens
+	if c.onTokenRefresh != nil {
+		c.onTokenRefresh(tokens)
+	}
+
+	return nil
+}
+
+// Chat sends a chat request to the Anthropic API using OAuth bearer token
+func (c *AnthropicOAuthClient) Chat(ctx context.Context, req ChatRequest) (*ChatResponse, error) {
+	// Ensure we have a valid token
+	if err := c.ensureValidToken(ctx); err != nil {
+		return nil, err
+	}
+
+	// Convert messages to Anthropic format (same as regular client)
+	messages := make([]anthropicMessage, 0, len(req.Messages))
+	for _, m := range req.Messages {
+		if m.Role == "system" {
+			continue
+		}
+
+		if m.ToolResult != nil {
+			contentJSON, _ := json.Marshal(m.ToolResult.Content)
+			messages = append(messages, anthropicMessage{
+				Role: "user",
+				Content: []anthropicContent{
+					{
+						Type:      "tool_result",
+						ToolUseID: m.ToolResult.ToolUseID,
+						Content:   contentJSON,
+						IsError:   m.ToolResult.IsError,
+					},
+				},
+			})
+			continue
+		}
+
+		if m.Role == "assistant" && len(m.ToolCalls) > 0 {
+			contentBlocks := make([]anthropicContent, 0)
+			if m.Content != "" {
+				contentBlocks = append(contentBlocks, anthropicContent{
+					Type: "text",
+					Text: m.Content,
+				})
+			}
+			for _, tc := range m.ToolCalls {
+				contentBlocks = append(contentBlocks, anthropicContent{
+					Type:  "tool_use",
+					ID:    tc.ID,
+					Name:  tc.Name,
+					Input: tc.Input,
+				})
+			}
+			messages = append(messages, anthropicMessage{
+				Role:    "assistant",
+				Content: contentBlocks,
+			})
+			continue
+		}
+
+		messages = append(messages, anthropicMessage{
+			Role:    m.Role,
+			Content: m.Content,
+		})
+	}
+
+	model := req.Model
+	if model == "" {
+		model = c.model
+	}
+
+	maxTokens := req.MaxTokens
+	if maxTokens == 0 {
+		maxTokens = 4096
+	}
+
+	anthropicReq := anthropicRequest{
+		Model:     model,
+		Messages:  messages,
+		MaxTokens: maxTokens,
+		System:    req.System,
+	}
+
+	if req.Temperature > 0 {
+		anthropicReq.Temperature = req.Temperature
+	}
+
+	if len(req.Tools) > 0 {
+		anthropicReq.Tools = make([]anthropicTool, len(req.Tools))
+		for i, t := range req.Tools {
+			if t.Type == "web_search_20250305" {
+				anthropicReq.Tools[i] = anthropicTool{
+					Type:    t.Type,
+					Name:    t.Name,
+					MaxUses: t.MaxUses,
+				}
+			} else {
+				anthropicReq.Tools[i] = anthropicTool{
+					Name:        t.Name,
+					Description: t.Description,
+					InputSchema: t.InputSchema,
+				}
+			}
+		}
+	}
+
+	body, err := json.Marshal(anthropicReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	// Use the beta endpoint for subscription-based access
+	apiURL := "https://api.anthropic.com/v1/messages?beta=true"
+
+	var respBody []byte
+	var lastErr error
+
+	for attempt := 0; attempt <= maxRetries; attempt++ {
+		if attempt > 0 {
+			backoff := initialBackoff * time.Duration(1<<(attempt-1))
+			log.Warn().
+				Int("attempt", attempt).
+				Dur("backoff", backoff).
+				Str("last_error", lastErr.Error()).
+				Msg("Retrying Anthropic OAuth API request after transient error")
+
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(backoff):
+			}
+		}
+
+		httpReq, err := http.NewRequestWithContext(ctx, "POST", apiURL, bytes.NewReader(body))
+		if err != nil {
+			return nil, fmt.Errorf("failed to create request: %w", err)
+		}
+
+		httpReq.Header.Set("Content-Type", "application/json")
+		// OAuth uses Authorization: Bearer instead of x-api-key
+		httpReq.Header.Set("Authorization", "Bearer "+c.accessToken)
+		httpReq.Header.Set("anthropic-version", anthropicAPIVersion)
+		// Required for OAuth authentication - enables subscription-based access
+		httpReq.Header.Set("anthropic-beta", "oauth-2025-04-20")
+		// Claude Code identification headers
+		httpReq.Header.Set("x-app", "cli")
+		httpReq.Header.Set("User-Agent", "claude-code/2.0.60")
+
+		resp, err := c.client.Do(httpReq)
+		if err != nil {
+			lastErr = fmt.Errorf("request failed: %w", err)
+			continue
+		}
+
+		respBody, err = io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			lastErr = fmt.Errorf("failed to read response: %w", err)
+			continue
+		}
+
+		// Check for token expiry error (401) - force refresh
+		if resp.StatusCode == 401 && c.refreshToken != "" {
+			log.Info().Msg("Got 401, forcing token refresh...")
+			if err := c.forceRefreshToken(ctx); err == nil {
+				// Token refreshed, retry immediately
+				lastErr = fmt.Errorf("token expired, retried with refreshed token")
+				continue
+			} else {
+				log.Error().Err(err).Msg("Failed to refresh token after 401")
+			}
+		}
+
+		if resp.StatusCode == 429 || resp.StatusCode == 529 || resp.StatusCode >= 500 {
+			var errResp anthropicError
+			errMsg := string(respBody)
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				errMsg = errResp.Error.Message
+			}
+			lastErr = fmt.Errorf("API error (%d): %s", resp.StatusCode, errMsg)
+			continue
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			var errResp anthropicError
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, errResp.Error.Message)
+			}
+			return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
+		}
+
+		lastErr = nil
+		break
+	}
+
+	if lastErr != nil {
+		return nil, fmt.Errorf("failed after %d retries: %w", maxRetries, lastErr)
+	}
+
+	var anthropicResp anthropicResponse
+	if err := json.Unmarshal(respBody, &anthropicResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	var textContent string
+	var toolCalls []ToolCall
+	for _, c := range anthropicResp.Content {
+		switch c.Type {
+		case "text":
+			textContent += c.Text
+		case "tool_use":
+			toolCalls = append(toolCalls, ToolCall{
+				ID:    c.ID,
+				Name:  c.Name,
+				Input: c.Input,
+			})
+		case "server_tool_use":
+			log.Debug().
+				Str("tool_name", c.Name).
+				Msg("Server tool use detected (handled by Anthropic)")
+		case "web_search_tool_result":
+			log.Debug().Msg("Web search results received")
+		}
+	}
+
+	return &ChatResponse{
+		Content:      textContent,
+		Model:        anthropicResp.Model,
+		StopReason:   anthropicResp.StopReason,
+		ToolCalls:    toolCalls,
+		InputTokens:  anthropicResp.Usage.InputTokens,
+		OutputTokens: anthropicResp.Usage.OutputTokens,
+	}, nil
+}
+
+// TestConnection validates the OAuth token by making a minimal request
+func (c *AnthropicOAuthClient) TestConnection(ctx context.Context) error {
+	_, err := c.Chat(ctx, ChatRequest{
+		Messages: []Message{
+			{Role: "user", Content: "Hi"},
+		},
+		MaxTokens: 10,
+	})
+	return err
+}
+
+// ListModels fetches available models from the Anthropic API using OAuth
+func (c *AnthropicOAuthClient) ListModels(ctx context.Context) ([]ModelInfo, error) {
+	// Ensure we have a valid token
+	if err := c.ensureValidToken(ctx); err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", "https://api.anthropic.com/v1/models", nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "Bearer "+c.accessToken)
+	req.Header.Set("anthropic-version", anthropicAPIVersion)
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Data []struct {
+			ID          string `json:"id"`
+			DisplayName string `json:"display_name"`
+			CreatedAt   string `json:"created_at"`
+		} `json:"data"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	models := make([]ModelInfo, 0, len(result.Data))
+	for _, m := range result.Data {
+		models = append(models, ModelInfo{
+			ID:   m.ID,
+			Name: m.DisplayName,
+		})
+	}
+
+	return models, nil
+}
diff --git a/internal/ai/providers/factory.go b/internal/ai/providers/factory.go
new file mode 100644
index 0000000..9953b61
--- /dev/null
+++ b/internal/ai/providers/factory.go
@@ -0,0 +1,119 @@
+package providers
+
+import (
+	"fmt"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+)
+
+// NewFromConfig creates a Provider based on the AIConfig settings
+// DEPRECATED: Use NewForModel or NewForProvider for multi-provider support
+func NewFromConfig(cfg *config.AIConfig) (Provider, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("AI config is nil")
+	}
+
+	if !cfg.Enabled {
+		return nil, fmt.Errorf("AI is not enabled")
+	}
+
+	// Try multi-provider format first (uses per-provider API keys)
+	provider, model := config.ParseModelString(cfg.Model)
+	if providerClient, err := NewForProvider(cfg, provider, model); err == nil {
+		return providerClient, nil
+	}
+
+	// Fall back to legacy single-provider format
+	switch cfg.Provider {
+	case config.AIProviderAnthropic:
+		// If we have an API key (from direct entry or OAuth-created), use regular client
+		if cfg.APIKey != "" {
+			return NewAnthropicClient(cfg.APIKey, cfg.GetModel()), nil
+		}
+		// Pro/Max users without org:create_api_key will use OAuth tokens directly
+		if cfg.IsUsingOAuth() && cfg.OAuthAccessToken != "" {
+			client := NewAnthropicOAuthClient(
+				cfg.OAuthAccessToken,
+				cfg.OAuthRefreshToken,
+				cfg.OAuthExpiresAt,
+				cfg.GetModel(),
+			)
+			return client, nil
+		}
+		return nil, fmt.Errorf("Anthropic API key is required (or use OAuth login for Pro/Max subscription)")
+
+	case config.AIProviderOpenAI:
+		if cfg.APIKey == "" {
+			return nil, fmt.Errorf("OpenAI API key is required")
+		}
+		return NewOpenAIClient(cfg.APIKey, cfg.GetModel(), cfg.GetBaseURL()), nil
+
+	case config.AIProviderOllama:
+		return NewOllamaClient(cfg.GetModel(), cfg.GetBaseURL()), nil
+
+	case config.AIProviderDeepSeek:
+		if cfg.APIKey == "" {
+			return nil, fmt.Errorf("DeepSeek API key is required")
+		}
+		// DeepSeek uses OpenAI-compatible API
+		return NewOpenAIClient(cfg.APIKey, cfg.GetModel(), cfg.GetBaseURL()), nil
+
+	default:
+		return nil, fmt.Errorf("unknown provider: %s", cfg.Provider)
+	}
+}
+
+// NewForProvider creates a Provider for a specific provider using multi-provider credentials
+func NewForProvider(cfg *config.AIConfig, provider, model string) (Provider, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("AI config is nil")
+	}
+
+	switch provider {
+	case config.AIProviderAnthropic:
+		// Check for OAuth first
+		if cfg.IsUsingOAuth() && cfg.OAuthAccessToken != "" {
+			return NewAnthropicOAuthClient(
+				cfg.OAuthAccessToken,
+				cfg.OAuthRefreshToken,
+				cfg.OAuthExpiresAt,
+				model,
+			), nil
+		}
+		// Then check for per-provider API key
+		apiKey := cfg.GetAPIKeyForProvider(config.AIProviderAnthropic)
+		if apiKey == "" {
+			return nil, fmt.Errorf("Anthropic API key not configured")
+		}
+		return NewAnthropicClient(apiKey, model), nil
+
+	case config.AIProviderOpenAI:
+		apiKey := cfg.GetAPIKeyForProvider(config.AIProviderOpenAI)
+		if apiKey == "" {
+			return nil, fmt.Errorf("OpenAI API key not configured")
+		}
+		baseURL := cfg.GetBaseURLForProvider(config.AIProviderOpenAI)
+		return NewOpenAIClient(apiKey, model, baseURL), nil
+
+	case config.AIProviderDeepSeek:
+		apiKey := cfg.GetAPIKeyForProvider(config.AIProviderDeepSeek)
+		if apiKey == "" {
+			return nil, fmt.Errorf("DeepSeek API key not configured")
+		}
+		baseURL := cfg.GetBaseURLForProvider(config.AIProviderDeepSeek)
+		return NewOpenAIClient(apiKey, model, baseURL), nil
+
+	case config.AIProviderOllama:
+		baseURL := cfg.GetBaseURLForProvider(config.AIProviderOllama)
+		return NewOllamaClient(model, baseURL), nil
+
+	default:
+		return nil, fmt.Errorf("unknown provider: %s", provider)
+	}
+}
+
+// NewForModel creates a Provider for a specific model, automatically detecting the provider
+func NewForModel(cfg *config.AIConfig, modelString string) (Provider, error) {
+	provider, model := config.ParseModelString(modelString)
+	return NewForProvider(cfg, provider, model)
+}
diff --git a/internal/ai/providers/ollama.go b/internal/ai/providers/ollama.go
new file mode 100644
index 0000000..645486d
--- /dev/null
+++ b/internal/ai/providers/ollama.go
@@ -0,0 +1,215 @@
+package providers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+// OllamaClient implements the Provider interface for Ollama's local API
+type OllamaClient struct {
+	model   string
+	baseURL string
+	client  *http.Client
+}
+
+// NewOllamaClient creates a new Ollama API client
+func NewOllamaClient(model, baseURL string) *OllamaClient {
+	if baseURL == "" {
+		baseURL = "http://localhost:11434"
+	}
+	return &OllamaClient{
+		model:   model,
+		baseURL: baseURL,
+		client: &http.Client{
+			Timeout: 300 * time.Second, // Local models can be slow
+		},
+	}
+}
+
+// Name returns the provider name
+func (c *OllamaClient) Name() string {
+	return "ollama"
+}
+
+// ollamaRequest is the request body for the Ollama API
+type ollamaRequest struct {
+	Model    string          `json:"model"`
+	Messages []ollamaMessage `json:"messages"`
+	Stream   bool            `json:"stream"`
+	Options  *ollamaOptions  `json:"options,omitempty"`
+}
+
+type ollamaMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+type ollamaOptions struct {
+	NumPredict  int     `json:"num_predict,omitempty"`
+	Temperature float64 `json:"temperature,omitempty"`
+}
+
+// ollamaResponse is the response from the Ollama API
+type ollamaResponse struct {
+	Model     string        `json:"model"`
+	CreatedAt string        `json:"created_at"`
+	Message   ollamaMessage `json:"message"`
+	Done      bool          `json:"done"`
+	DoneReason string       `json:"done_reason,omitempty"`
+	TotalDuration   int64  `json:"total_duration,omitempty"`
+	LoadDuration    int64  `json:"load_duration,omitempty"`
+	PromptEvalCount int    `json:"prompt_eval_count,omitempty"`
+	EvalCount       int    `json:"eval_count,omitempty"`
+}
+
+// Chat sends a chat request to the Ollama API
+func (c *OllamaClient) Chat(ctx context.Context, req ChatRequest) (*ChatResponse, error) {
+	// Convert messages to Ollama format
+	messages := make([]ollamaMessage, 0, len(req.Messages)+1)
+
+	// Add system message if provided
+	if req.System != "" {
+		messages = append(messages, ollamaMessage{
+			Role:    "system",
+			Content: req.System,
+		})
+	}
+
+	for _, m := range req.Messages {
+		messages = append(messages, ollamaMessage{
+			Role:    m.Role,
+			Content: m.Content,
+		})
+	}
+
+	// Use provided model or fall back to client default
+	model := req.Model
+	if model == "" {
+		model = c.model
+	}
+
+	ollamaReq := ollamaRequest{
+		Model:    model,
+		Messages: messages,
+		Stream:   false, // Non-streaming for now
+	}
+
+	if req.MaxTokens > 0 || req.Temperature > 0 {
+		ollamaReq.Options = &ollamaOptions{}
+		if req.MaxTokens > 0 {
+			ollamaReq.Options.NumPredict = req.MaxTokens
+		}
+		if req.Temperature > 0 {
+			ollamaReq.Options.Temperature = req.Temperature
+		}
+	}
+
+	body, err := json.Marshal(ollamaReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	url := c.baseURL + "/api/chat"
+	httpReq, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
+	}
+
+	var ollamaResp ollamaResponse
+	if err := json.Unmarshal(respBody, &ollamaResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &ChatResponse{
+		Content:      ollamaResp.Message.Content,
+		Model:        ollamaResp.Model,
+		StopReason:   ollamaResp.DoneReason,
+		InputTokens:  ollamaResp.PromptEvalCount,
+		OutputTokens: ollamaResp.EvalCount,
+	}, nil
+}
+
+// TestConnection validates connectivity by checking the Ollama version endpoint
+func (c *OllamaClient) TestConnection(ctx context.Context) error {
+	url := c.baseURL + "/api/version"
+	httpReq, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.client.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("failed to connect to Ollama at %s: %w", c.baseURL, err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("Ollama returned status %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// ListModels fetches available models from the local Ollama instance
+func (c *OllamaClient) ListModels(ctx context.Context) ([]ModelInfo, error) {
+	url := c.baseURL + "/api/tags"
+	httpReq, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.client.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Models []struct {
+			Name       string `json:"name"`
+			ModifiedAt string `json:"modified_at"`
+			Size       int64  `json:"size"`
+		} `json:"models"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	models := make([]ModelInfo, 0, len(result.Models))
+	for _, m := range result.Models {
+		models = append(models, ModelInfo{
+			ID:   m.Name,
+			Name: m.Name,
+		})
+	}
+
+	return models, nil
+}
diff --git a/internal/ai/providers/openai.go b/internal/ai/providers/openai.go
new file mode 100644
index 0000000..cdf29e0
--- /dev/null
+++ b/internal/ai/providers/openai.go
@@ -0,0 +1,443 @@
+package providers
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	openaiAPIURL        = "https://api.openai.com/v1/chat/completions"
+	openaiMaxRetries    = 3
+	openaiInitialBackoff = 2 * time.Second
+)
+
+// OpenAIClient implements the Provider interface for OpenAI's API
+// Also works with OpenAI-compatible APIs like DeepSeek
+type OpenAIClient struct {
+	apiKey  string
+	model   string
+	baseURL string
+	client  *http.Client
+}
+
+// NewOpenAIClient creates a new OpenAI API client
+func NewOpenAIClient(apiKey, model, baseURL string) *OpenAIClient {
+	if baseURL == "" {
+		baseURL = openaiAPIURL
+	}
+	return &OpenAIClient{
+		apiKey:  apiKey,
+		model:   model,
+		baseURL: baseURL,
+		client: &http.Client{
+			// 5 minutes timeout - DeepSeek reasoning models can take a long time
+			Timeout: 300 * time.Second,
+		},
+	}
+}
+
+// Name returns the provider name
+func (c *OpenAIClient) Name() string {
+	return "openai"
+}
+
+// openaiRequest is the request body for the OpenAI API
+type openaiRequest struct {
+	Model       string              `json:"model"`
+	Messages    []openaiMessage     `json:"messages"`
+	MaxTokens   int                 `json:"max_tokens,omitempty"`
+	Temperature float64             `json:"temperature,omitempty"`
+	Tools       []openaiTool        `json:"tools,omitempty"`
+	ToolChoice  interface{}         `json:"tool_choice,omitempty"` // "auto", "none", or specific tool
+}
+
+// deepseekRequest extends openaiRequest with DeepSeek-specific fields
+type deepseekRequest struct {
+	Model       string              `json:"model"`
+	Messages    []openaiMessage     `json:"messages"`
+	MaxTokens   int                 `json:"max_tokens,omitempty"`
+	Tools       []openaiTool        `json:"tools,omitempty"`
+	ToolChoice  interface{}         `json:"tool_choice,omitempty"`
+}
+
+// openaiTool represents a function tool in OpenAI format
+type openaiTool struct {
+	Type     string         `json:"type"` // always "function"
+	Function openaiFunction `json:"function"`
+}
+
+type openaiFunction struct {
+	Name        string                 `json:"name"`
+	Description string                 `json:"description,omitempty"`
+	Parameters  map[string]interface{} `json:"parameters,omitempty"`
+}
+
+type openaiMessage struct {
+	Role             string           `json:"role"`
+	Content          interface{}      `json:"content,omitempty"`            // string or null for tool calls
+	ReasoningContent string           `json:"reasoning_content,omitempty"`  // DeepSeek thinking mode
+	ToolCalls        []openaiToolCall `json:"tool_calls,omitempty"`         // For assistant messages with tool calls
+	ToolCallID       string           `json:"tool_call_id,omitempty"`       // For tool response messages
+}
+
+type openaiToolCall struct {
+	ID       string             `json:"id"`
+	Type     string             `json:"type"` // always "function"
+	Function openaiToolFunction `json:"function"`
+}
+
+type openaiToolFunction struct {
+	Name      string `json:"name"`
+	Arguments string `json:"arguments"` // JSON string of arguments
+}
+
+// openaiResponse is the response from the OpenAI API
+type openaiResponse struct {
+	ID      string         `json:"id"`
+	Object  string         `json:"object"`
+	Created int64          `json:"created"`
+	Model   string         `json:"model"`
+	Choices []openaiChoice `json:"choices"`
+	Usage   openaiUsage    `json:"usage"`
+}
+
+type openaiChoice struct {
+	Index        int           `json:"index"`
+	Message      openaiRespMsg `json:"message"`
+	FinishReason string        `json:"finish_reason"` // "stop", "tool_calls", etc.
+}
+
+type openaiRespMsg struct {
+	Role             string           `json:"role"`
+	Content          string           `json:"content,omitempty"`
+	ReasoningContent string           `json:"reasoning_content,omitempty"` // DeepSeek thinking mode
+	ToolCalls        []openaiToolCall `json:"tool_calls,omitempty"`
+}
+
+type openaiUsage struct {
+	PromptTokens     int `json:"prompt_tokens"`
+	CompletionTokens int `json:"completion_tokens"`
+	TotalTokens      int `json:"total_tokens"`
+}
+
+type openaiError struct {
+	Error openaiErrorDetail `json:"error"`
+}
+
+type openaiErrorDetail struct {
+	Message string `json:"message"`
+	Type    string `json:"type"`
+	Code    string `json:"code"`
+}
+
+// isDeepSeek returns true if this client is configured for DeepSeek
+func (c *OpenAIClient) isDeepSeek() bool {
+	return strings.Contains(c.baseURL, "deepseek.com")
+}
+
+// isDeepSeekReasoner returns true if using DeepSeek's reasoning model
+func (c *OpenAIClient) isDeepSeekReasoner() bool {
+	return c.isDeepSeek() && strings.Contains(c.model, "reasoner")
+}
+
+// Chat sends a chat request to the OpenAI API
+func (c *OpenAIClient) Chat(ctx context.Context, req ChatRequest) (*ChatResponse, error) {
+	// Convert messages to OpenAI format
+	messages := make([]openaiMessage, 0, len(req.Messages)+1)
+
+	// Add system message if provided
+	if req.System != "" {
+		messages = append(messages, openaiMessage{
+			Role:    "system",
+			Content: req.System,
+		})
+	}
+
+	for _, m := range req.Messages {
+		msg := openaiMessage{
+			Role: m.Role,
+		}
+
+		// Handle tool calls in assistant messages
+		if len(m.ToolCalls) > 0 {
+			msg.Content = nil // Content is null when there are tool calls
+			if m.Content != "" {
+				msg.Content = m.Content
+			}
+			// For DeepSeek reasoner, include reasoning_content if present
+			if c.isDeepSeekReasoner() && m.ReasoningContent != "" {
+				msg.ReasoningContent = m.ReasoningContent
+			}
+			for _, tc := range m.ToolCalls {
+				argsJSON, _ := json.Marshal(tc.Input)
+				msg.ToolCalls = append(msg.ToolCalls, openaiToolCall{
+					ID:   tc.ID,
+					Type: "function",
+					Function: openaiToolFunction{
+						Name:      tc.Name,
+						Arguments: string(argsJSON),
+					},
+				})
+			}
+		} else if m.ToolResult != nil {
+			// This is a tool result message
+			msg.Role = "tool"
+			msg.Content = m.ToolResult.Content
+			msg.ToolCallID = m.ToolResult.ToolUseID
+		} else {
+			msg.Content = m.Content
+			// For assistant messages with reasoning content (DeepSeek)
+			if c.isDeepSeekReasoner() && m.ReasoningContent != "" {
+				msg.ReasoningContent = m.ReasoningContent
+			}
+		}
+
+		messages = append(messages, msg)
+	}
+
+	// Use provided model or fall back to client default
+	model := req.Model
+	if model == "" {
+		model = c.model
+	}
+
+	// Build request
+	openaiReq := openaiRequest{
+		Model:    model,
+		Messages: messages,
+	}
+
+	if req.MaxTokens > 0 {
+		openaiReq.MaxTokens = req.MaxTokens
+	}
+
+	// DeepSeek reasoner doesn't support temperature
+	if req.Temperature > 0 && !c.isDeepSeekReasoner() {
+		openaiReq.Temperature = req.Temperature
+	}
+
+	// Convert tools to OpenAI format
+	if len(req.Tools) > 0 {
+		for _, t := range req.Tools {
+			// Skip non-function tools (like web_search)
+			if t.Type != "" && t.Type != "function" {
+				continue
+			}
+			openaiReq.Tools = append(openaiReq.Tools, openaiTool{
+				Type: "function",
+				Function: openaiFunction{
+					Name:        t.Name,
+					Description: t.Description,
+					Parameters:  t.InputSchema,
+				},
+			})
+		}
+		if len(openaiReq.Tools) > 0 {
+			openaiReq.ToolChoice = "auto"
+		}
+	}
+
+	body, err := json.Marshal(openaiReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	// Retry loop for transient errors (connection resets, 429, 5xx)
+	var respBody []byte
+	var lastErr error
+
+	for attempt := 0; attempt <= openaiMaxRetries; attempt++ {
+		if attempt > 0 {
+			// Exponential backoff: 2s, 4s, 8s
+			backoff := openaiInitialBackoff * time.Duration(1<<(attempt-1))
+			log.Warn().
+				Int("attempt", attempt).
+				Dur("backoff", backoff).
+				Str("last_error", lastErr.Error()).
+				Msg("Retrying OpenAI/DeepSeek API request after transient error")
+
+			select {
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			case <-time.After(backoff):
+			}
+		}
+
+		httpReq, err := http.NewRequestWithContext(ctx, "POST", c.baseURL, bytes.NewReader(body))
+		if err != nil {
+			return nil, fmt.Errorf("failed to create request: %w", err)
+		}
+
+		httpReq.Header.Set("Content-Type", "application/json")
+		httpReq.Header.Set("Authorization", "Bearer "+c.apiKey)
+
+		resp, err := c.client.Do(httpReq)
+		if err != nil {
+			// Check if this is a retryable connection error
+			errStr := err.Error()
+			if strings.Contains(errStr, "connection reset") ||
+				strings.Contains(errStr, "connection refused") ||
+				strings.Contains(errStr, "EOF") ||
+				strings.Contains(errStr, "timeout") {
+				lastErr = fmt.Errorf("connection error: %w", err)
+				continue
+			}
+			return nil, fmt.Errorf("request failed: %w", err)
+		}
+
+		respBody, err = io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			lastErr = fmt.Errorf("failed to read response: %w", err)
+			continue
+		}
+
+		// Check for retryable HTTP errors
+		if resp.StatusCode == 429 || resp.StatusCode == 502 || resp.StatusCode == 503 || resp.StatusCode == 504 {
+			var errResp openaiError
+			errMsg := string(respBody)
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				errMsg = errResp.Error.Message
+			}
+			lastErr = fmt.Errorf("API error (%d): %s", resp.StatusCode, errMsg)
+			continue
+		}
+
+		// Non-retryable error
+		if resp.StatusCode != http.StatusOK {
+			var errResp openaiError
+			if err := json.Unmarshal(respBody, &errResp); err == nil && errResp.Error.Message != "" {
+				return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, errResp.Error.Message)
+			}
+			return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(respBody))
+		}
+
+		// Success - break out of retry loop
+		lastErr = nil
+		break
+	}
+
+	if lastErr != nil {
+		return nil, fmt.Errorf("request failed after %d retries: %w", openaiMaxRetries, lastErr)
+	}
+
+	var openaiResp openaiResponse
+	if err := json.Unmarshal(respBody, &openaiResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	if len(openaiResp.Choices) == 0 {
+		return nil, fmt.Errorf("no response choices returned")
+	}
+
+	choice := openaiResp.Choices[0]
+
+	// For DeepSeek reasoner, the actual content may be in reasoning_content
+	// when content is empty (it shows the "thinking" but that's the full response)
+	contentToUse := choice.Message.Content
+	if contentToUse == "" && choice.Message.ReasoningContent != "" {
+		// DeepSeek reasoner puts output in reasoning_content
+		contentToUse = choice.Message.ReasoningContent
+	}
+
+	result := &ChatResponse{
+		Content:          contentToUse,
+		ReasoningContent: choice.Message.ReasoningContent, // DeepSeek thinking mode
+		Model:            openaiResp.Model,
+		StopReason:       choice.FinishReason,
+		InputTokens:      openaiResp.Usage.PromptTokens,
+		OutputTokens:     openaiResp.Usage.CompletionTokens,
+	}
+
+	// Convert tool calls from OpenAI format to our format
+	if len(choice.Message.ToolCalls) > 0 {
+		result.StopReason = "tool_use" // Normalize to match Anthropic's format
+		for _, tc := range choice.Message.ToolCalls {
+			var input map[string]interface{}
+			if err := json.Unmarshal([]byte(tc.Function.Arguments), &input); err != nil {
+				input = map[string]interface{}{"raw": tc.Function.Arguments}
+			}
+			result.ToolCalls = append(result.ToolCalls, ToolCall{
+				ID:    tc.ID,
+				Name:  tc.Function.Name,
+				Input: input,
+			})
+		}
+	}
+
+	return result, nil
+}
+
+// TestConnection validates the API key by making a minimal request
+func (c *OpenAIClient) TestConnection(ctx context.Context) error {
+	_, err := c.Chat(ctx, ChatRequest{
+		Messages: []Message{
+			{Role: "user", Content: "Hi"},
+		},
+		MaxTokens: 10,
+	})
+	return err
+}
+
+// ListModels fetches available models from the OpenAI API
+func (c *OpenAIClient) ListModels(ctx context.Context) ([]ModelInfo, error) {
+	// Determine the models endpoint based on the base URL
+	modelsURL := "https://api.openai.com/v1/models"
+	if c.isDeepSeek() {
+		modelsURL = "https://api.deepseek.com/models"
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "GET", modelsURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "Bearer "+c.apiKey)
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error (%d): %s", resp.StatusCode, string(body))
+	}
+
+	var result struct {
+		Data []struct {
+			ID      string `json:"id"`
+			Object  string `json:"object"`
+			Created int64  `json:"created"`
+			OwnedBy string `json:"owned_by"`
+		} `json:"data"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	models := make([]ModelInfo, 0, len(result.Data))
+	for _, m := range result.Data {
+		// Filter to only chat-capable models
+		if strings.Contains(m.ID, "gpt") || strings.Contains(m.ID, "o1") ||
+			strings.Contains(m.ID, "o3") || strings.Contains(m.ID, "deepseek") {
+			models = append(models, ModelInfo{
+				ID:        m.ID,
+				Name:      m.ID, // OpenAI uses ID as name
+				CreatedAt: m.Created,
+			})
+		}
+	}
+
+	return models, nil
+}
diff --git a/internal/ai/providers/provider.go b/internal/ai/providers/provider.go
new file mode 100644
index 0000000..8b48e4c
--- /dev/null
+++ b/internal/ai/providers/provider.go
@@ -0,0 +1,83 @@
+// Package providers contains AI provider client implementations
+package providers
+
+import (
+	"context"
+)
+
+// Message represents a chat message
+type Message struct {
+	Role             string        `json:"role"`    // "user", "assistant", "system"
+	Content          string        `json:"content"` // Text content (simple case)
+	ReasoningContent string        `json:"reasoning_content,omitempty"` // DeepSeek thinking mode
+	ToolCalls        []ToolCall    `json:"tool_calls,omitempty"` // For assistant messages with tool calls
+	ToolResult       *ToolResult   `json:"tool_result,omitempty"` // For user messages with tool results
+}
+
+// ToolCall represents a tool invocation from the AI
+type ToolCall struct {
+	ID    string                 `json:"id"`
+	Name  string                 `json:"name"`
+	Input map[string]interface{} `json:"input"`
+}
+
+// ToolResult represents the result of a tool execution
+type ToolResult struct {
+	ToolUseID string `json:"tool_use_id"`
+	Content   string `json:"content"`
+	IsError   bool   `json:"is_error,omitempty"`
+}
+
+// Tool represents an AI tool definition
+type Tool struct {
+	Type        string                 `json:"type,omitempty"`        // "web_search_20250305" for web search, empty for regular tools
+	Name        string                 `json:"name"`
+	Description string                 `json:"description,omitempty"`
+	InputSchema map[string]interface{} `json:"input_schema,omitempty"`
+	MaxUses     int                    `json:"max_uses,omitempty"`    // For web search: limit searches per request
+}
+
+// ChatRequest represents a request to the AI provider
+type ChatRequest struct {
+	Messages    []Message `json:"messages"`
+	Model       string    `json:"model"`
+	MaxTokens   int       `json:"max_tokens,omitempty"`
+	Temperature float64   `json:"temperature,omitempty"`
+	System      string    `json:"system,omitempty"` // System prompt (Anthropic style)
+	Tools       []Tool    `json:"tools,omitempty"`  // Available tools
+}
+
+// ChatResponse represents a response from the AI provider
+type ChatResponse struct {
+	Content          string      `json:"content"`
+	ReasoningContent string      `json:"reasoning_content,omitempty"` // DeepSeek thinking mode
+	Model            string      `json:"model"`
+	StopReason       string      `json:"stop_reason,omitempty"` // "end_turn", "tool_use"
+	ToolCalls        []ToolCall  `json:"tool_calls,omitempty"` // Tool invocations
+	InputTokens      int         `json:"input_tokens,omitempty"`
+	OutputTokens     int         `json:"output_tokens,omitempty"`
+}
+
+// ModelInfo represents information about an available model
+type ModelInfo struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
+	CreatedAt   int64  `json:"created_at,omitempty"`
+}
+
+// Provider defines the interface for AI providers
+type Provider interface {
+	// Chat sends a chat request and returns the response
+	Chat(ctx context.Context, req ChatRequest) (*ChatResponse, error)
+
+	// TestConnection validates the API key and connectivity
+	TestConnection(ctx context.Context) error
+
+	// Name returns the provider name
+	Name() string
+
+	// ListModels returns available models from the provider's API
+	// Returns nil if the provider doesn't support listing models
+	ListModels(ctx context.Context) ([]ModelInfo, error)
+}
diff --git a/internal/ai/resource_context.go b/internal/ai/resource_context.go
new file mode 100644
index 0000000..9e415c0
--- /dev/null
+++ b/internal/ai/resource_context.go
@@ -0,0 +1,313 @@
+package ai
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/resources"
+	"github.com/rs/zerolog/log"
+)
+
+// ResourceProvider provides access to the unified resource store.
+type ResourceProvider interface {
+	GetAll() []resources.Resource
+	GetInfrastructure() []resources.Resource
+	GetWorkloads() []resources.Resource
+	GetByType(t resources.ResourceType) []resources.Resource
+	GetStats() resources.StoreStats
+	
+	// Cross-platform query methods
+	GetTopByCPU(limit int, types []resources.ResourceType) []resources.Resource
+	GetTopByMemory(limit int, types []resources.ResourceType) []resources.Resource
+	GetTopByDisk(limit int, types []resources.ResourceType) []resources.Resource
+	GetRelated(resourceID string) map[string][]resources.Resource
+	GetResourceSummary() resources.ResourceSummary
+	
+	// AI Routing support
+	FindContainerHost(containerNameOrID string) string
+}
+
+// SetResourceProvider sets the resource provider for unified infrastructure context.
+func (s *Service) SetResourceProvider(rp ResourceProvider) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.resourceProvider = rp
+}
+
+// buildUnifiedResourceContext creates AI context from the unified resource model.
+// This provides a cleaner, deduplicated view of infrastructure.
+func (s *Service) buildUnifiedResourceContext() string {
+	s.mu.RLock()
+	rp := s.resourceProvider
+	s.mu.RUnlock()
+
+	if rp == nil {
+		return ""
+	}
+
+	var sections []string
+	stats := rp.GetStats()
+
+	// Header with summary
+	sections = append(sections, "## Unified Infrastructure View")
+	sections = append(sections, fmt.Sprintf("Total resources: %d (Infrastructure: %d, Workloads: %d)",
+		stats.TotalResources, stats.ByType[resources.ResourceTypeNode]+stats.ByType[resources.ResourceTypeHost]+stats.ByType[resources.ResourceTypeDockerHost],
+		stats.ByType[resources.ResourceTypeVM]+stats.ByType[resources.ResourceTypeContainer]+stats.ByType[resources.ResourceTypeDockerContainer]))
+
+	// Build agent lookup
+	agentsByHostname := make(map[string]bool)
+	if s.agentServer != nil {
+		for _, agent := range s.agentServer.GetConnectedAgents() {
+			agentsByHostname[strings.ToLower(agent.Hostname)] = true
+		}
+	}
+
+	// Infrastructure resources (nodes, hosts, docker hosts)
+	infrastructure := rp.GetInfrastructure()
+	if len(infrastructure) > 0 {
+		sections = append(sections, "\n### Infrastructure (Nodes & Hosts)")
+		sections = append(sections, "These are the physical/virtual machines that host workloads.")
+
+		// Group by platform
+		byPlatform := make(map[resources.PlatformType][]resources.Resource)
+		for _, r := range infrastructure {
+			byPlatform[r.PlatformType] = append(byPlatform[r.PlatformType], r)
+		}
+
+		// Proxmox nodes
+		if nodes, ok := byPlatform[resources.PlatformProxmoxPVE]; ok && len(nodes) > 0 {
+			sections = append(sections, "\n**Proxmox VE Nodes:**")
+			for _, node := range nodes {
+				hasAgent := agentsByHostname[strings.ToLower(node.Name)]
+				agentStatus := "NO AGENT"
+				if hasAgent {
+					agentStatus = "HAS AGENT ✓"
+				}
+
+				// Build cluster info
+				clusterInfo := ""
+				if node.ClusterID != "" {
+					clusterInfo = fmt.Sprintf(" [cluster: %s]", node.ClusterID)
+				}
+
+				// Get CPU/Memory metrics
+				metrics := ""
+				if node.CPU != nil && node.Memory != nil {
+					metrics = fmt.Sprintf(" - CPU: %.1f%%, Mem: %.1f%%", node.CPUPercent(), node.MemoryPercent())
+				}
+
+				sections = append(sections, fmt.Sprintf("- **%s** (%s)%s%s [%s]",
+					node.EffectiveDisplayName(), agentStatus, clusterInfo, metrics, node.Status))
+			}
+		}
+
+		// Standalone hosts
+		if hosts, ok := byPlatform[resources.PlatformHostAgent]; ok && len(hosts) > 0 {
+			sections = append(sections, "\n**Standalone Hosts (via Host Agent):**")
+			for _, host := range hosts {
+				// Get IPs from identity
+				ips := ""
+				if host.Identity != nil && len(host.Identity.IPs) > 0 {
+					ips = " - " + strings.Join(host.Identity.IPs, ", ")
+				}
+
+				// Get metrics
+				metrics := ""
+				if host.CPU != nil && host.Memory != nil {
+					metrics = fmt.Sprintf(", CPU: %.1f%%, Mem: %.1f%%", host.CPUPercent(), host.MemoryPercent())
+				}
+
+				sections = append(sections, fmt.Sprintf("- **%s**%s%s [%s]",
+					host.EffectiveDisplayName(), ips, metrics, host.Status))
+			}
+		}
+
+		// Docker hosts
+		if dhosts, ok := byPlatform[resources.PlatformDocker]; ok && len(dhosts) > 0 {
+			sections = append(sections, "\n**Docker/Podman Hosts:**")
+			for _, dh := range dhosts {
+				if dh.Type != resources.ResourceTypeDockerHost {
+					continue
+				}
+
+				// Count containers for this host
+				allWorkloads := rp.GetWorkloads()
+				containerCount := 0
+				runningCount := 0
+				for _, w := range allWorkloads {
+					if w.ParentID == dh.ID {
+						containerCount++
+						if w.Status == resources.StatusRunning {
+							runningCount++
+						}
+					}
+				}
+
+				sections = append(sections, fmt.Sprintf("- **%s** (%d/%d containers running) [%s]",
+					dh.EffectiveDisplayName(), runningCount, containerCount, dh.Status))
+			}
+		}
+	}
+
+	// Workloads (VMs, containers)
+	workloads := rp.GetWorkloads()
+	if len(workloads) > 0 {
+		sections = append(sections, "\n### Workloads (VMs & Containers)")
+
+		// Group by parent for better organization
+		byParent := make(map[string][]resources.Resource)
+		noParent := []resources.Resource{}
+		for _, w := range workloads {
+			if w.ParentID != "" {
+				byParent[w.ParentID] = append(byParent[w.ParentID], w)
+			} else {
+				noParent = append(noParent, w)
+			}
+		}
+
+		// Get all infrastructure to map parent IDs to names
+		infraMap := make(map[string]resources.Resource)
+		for _, r := range infrastructure {
+			infraMap[r.ID] = r
+		}
+
+		// Show workloads grouped by parent
+		for parentID, children := range byParent {
+			parentName := parentID
+			if parent, ok := infraMap[parentID]; ok {
+				parentName = parent.EffectiveDisplayName()
+			}
+
+			sections = append(sections, fmt.Sprintf("\n**On %s:**", parentName))
+			for _, w := range children {
+				typeLabel := string(w.Type)
+				if w.Type == resources.ResourceTypeVM {
+					typeLabel = "VM"
+				} else if w.Type == resources.ResourceTypeContainer {
+					typeLabel = "LXC"
+				} else if w.Type == resources.ResourceTypeDockerContainer {
+					typeLabel = "Docker"
+				}
+
+				// Get VMID from platform data if available
+				vmidInfo := ""
+				if w.PlatformID != "" && w.Type != resources.ResourceTypeDockerContainer {
+					vmidInfo = fmt.Sprintf(" %s", w.PlatformID)
+				}
+
+				// Get IPs
+				ips := ""
+				if w.Identity != nil && len(w.Identity.IPs) > 0 {
+					ips = " - " + strings.Join(w.Identity.IPs[:min(2, len(w.Identity.IPs))], ", ")
+				}
+
+				sections = append(sections, fmt.Sprintf("  - **%s** (%s%s)%s [%s]",
+					w.EffectiveDisplayName(), typeLabel, vmidInfo, ips, w.Status))
+			}
+		}
+
+		// Show orphaned workloads
+		if len(noParent) > 0 {
+			sections = append(sections, "\n**Other workloads:**")
+			for _, w := range noParent {
+				sections = append(sections, fmt.Sprintf("  - **%s** (%s) [%s]",
+					w.EffectiveDisplayName(), w.Type, w.Status))
+			}
+		}
+	}
+
+	// Resources with alerts
+	allResources := rp.GetAll()
+	var alertResources []resources.Resource
+	for _, r := range allResources {
+		if len(r.Alerts) > 0 {
+			alertResources = append(alertResources, r)
+		}
+	}
+	if len(alertResources) > 0 {
+		sections = append(sections, "\n### Resources with Active Alerts")
+		for _, r := range alertResources {
+			for _, alert := range r.Alerts {
+				sections = append(sections, fmt.Sprintf("- **%s**: %s (%s)",
+					r.EffectiveDisplayName(), alert.Message, alert.Level))
+			}
+		}
+	}
+
+	// Add resource summary for cross-platform analysis
+	summary := rp.GetResourceSummary()
+	if summary.TotalResources > 0 {
+		sections = append(sections, "\n### Infrastructure Summary")
+		sections = append(sections, fmt.Sprintf("- Status: %d healthy, %d degraded, %d offline",
+			summary.Healthy, summary.Degraded, summary.Offline))
+		if summary.WithAlerts > 0 {
+			sections = append(sections, fmt.Sprintf("- Resources with alerts: %d", summary.WithAlerts))
+		}
+		
+		// Show average resource usage by type
+		if len(summary.ByType) > 0 {
+			sections = append(sections, "- Average utilization by type:")
+			for t, ts := range summary.ByType {
+				if ts.Count > 0 && (ts.AvgCPUPercent > 0 || ts.AvgMemoryPercent > 0) {
+					sections = append(sections, fmt.Sprintf("  - %s (%d): CPU %.1f%%, Memory %.1f%%",
+						t, ts.Count, ts.AvgCPUPercent, ts.AvgMemoryPercent))
+				}
+			}
+		}
+	}
+
+	// Top resource consumers (helps answer "what's using the most CPU/memory")
+	topCPU := rp.GetTopByCPU(3, nil)
+	if len(topCPU) > 0 {
+		sections = append(sections, "\n### Top CPU Consumers")
+		for i, r := range topCPU {
+			sections = append(sections, fmt.Sprintf("%d. **%s** (%s): %.1f%%",
+				i+1, r.EffectiveDisplayName(), r.Type, r.CPUPercent()))
+		}
+	}
+
+	topMem := rp.GetTopByMemory(3, nil)
+	if len(topMem) > 0 {
+		sections = append(sections, "\n### Top Memory Consumers")
+		for i, r := range topMem {
+			sections = append(sections, fmt.Sprintf("%d. **%s** (%s): %.1f%%",
+				i+1, r.EffectiveDisplayName(), r.Type, r.MemoryPercent()))
+		}
+	}
+
+	topDisk := rp.GetTopByDisk(3, nil)
+	if len(topDisk) > 0 {
+		sections = append(sections, "\n### Top Disk Usage")
+		for i, r := range topDisk {
+			sections = append(sections, fmt.Sprintf("%d. **%s** (%s): %.1f%%",
+				i+1, r.EffectiveDisplayName(), r.Type, r.DiskPercent()))
+		}
+	}
+
+	if len(sections) == 0 {
+		return ""
+	}
+
+	result := "\n\n" + strings.Join(sections, "\n")
+
+	// Limit context size
+	const maxContextSize = 50000
+	if len(result) > maxContextSize {
+		log.Warn().
+			Int("original_size", len(result)).
+			Int("max_size", maxContextSize).
+			Msg("Unified resource context truncated")
+		result = result[:maxContextSize] + "\n\n[... Context truncated ...]"
+	}
+
+	log.Debug().Int("unified_resource_context_size", len(result)).Msg("Built unified resource context")
+	return result
+}
+
+// min returns the smaller of two integers
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/internal/ai/routing.go b/internal/ai/routing.go
new file mode 100644
index 0000000..3907d46
--- /dev/null
+++ b/internal/ai/routing.go
@@ -0,0 +1,383 @@
+// Package ai provides AI-powered diagnostic and command execution capabilities.
+// This file contains the robust agent routing logic for executing commands on the correct host.
+package ai
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rs/zerolog/log"
+)
+
+// RoutingResult contains the result of agent routing
+type RoutingResult struct {
+	AgentID       string   // ID of the selected agent
+	AgentHostname string   // Hostname of the selected agent
+	TargetNode    string   // The node we're trying to reach
+	TargetVMID    string   // The VMID (for container/VM targets)
+	RoutingMethod string   // How we determined the route (for debugging)
+	ClusterPeer   bool     // True if routing via a cluster peer
+	Warnings      []string // Any warnings encountered during routing
+}
+
+// RoutingError represents a routing failure with actionable information
+type RoutingError struct {
+	TargetNode          string
+	TargetVMID          int
+	AvailableAgents     []string
+	Reason              string
+	Suggestion          string
+	AskForClarification bool // If true, AI should ask the user which host to use
+}
+
+func (e *RoutingError) Error() string {
+	if e.Suggestion != "" {
+		return fmt.Sprintf("%s. %s", e.Reason, e.Suggestion)
+	}
+	return e.Reason
+}
+
+// ForAI returns a message suitable for returning to the AI as a tool result
+// This encourages the AI to ask the user for clarification rather than just failing
+func (e *RoutingError) ForAI() string {
+	if e.AskForClarification && len(e.AvailableAgents) > 0 {
+		return fmt.Sprintf(
+			"ROUTING_CLARIFICATION_NEEDED: %s\n\n"+
+				"Available hosts: %s\n\n"+
+				"Please ask the user which host they want to run this command on. "+
+				"Do NOT try the command again until the user specifies which host. "+
+				"Present the available hosts in a friendly way and ask them to clarify.",
+			e.Reason, strings.Join(e.AvailableAgents, ", "))
+	}
+	return e.Error()
+}
+
+// routeToAgent determines which agent should execute a command.
+// This is the authoritative routing function that should be used for all command execution.
+//
+// Routing priority:
+// 1. VMID lookup from command (for pct/qm commands)
+// 2. Unified ResourceProvider lookup (PRIMARY - uses the new infrastructure model)
+// 3. Explicit context fields (FALLBACK - for backwards compatibility)
+// 4. VMID extracted from target ID
+//
+// Agent matching is EXACT only - no substring matching to prevent false positives.
+// If no direct match, cluster peer routing is attempted.
+// If all else fails, returns an explicit error rather than silently using wrong agent.
+func (s *Service) routeToAgent(req ExecuteRequest, command string, agents []agentexec.ConnectedAgent) (*RoutingResult, error) {
+	result := &RoutingResult{}
+
+	if len(agents) == 0 {
+		return nil, &RoutingError{
+			Reason:     "No agents are connected to Pulse",
+			Suggestion: "Install pulse-agent on at least one host",
+		}
+	}
+
+	// Build a map of available agents for quick lookup and error messages
+	agentMap := make(map[string]agentexec.ConnectedAgent) // lowercase hostname -> agent
+	var agentHostnames []string
+	for _, agent := range agents {
+		hostname := strings.TrimSpace(strings.ToLower(agent.Hostname))
+		agentMap[hostname] = agent
+		agentHostnames = append(agentHostnames, agent.Hostname)
+	}
+
+	// Step 1: Try VMID-based routing (most authoritative for pct/qm commands)
+	if vmid, requiresOwnerNode, found := extractVMIDFromCommand(command); found && requiresOwnerNode {
+		targetInstance := ""
+		if inst, ok := req.Context["instance"].(string); ok {
+			targetInstance = inst
+		}
+
+		guests := s.lookupGuestsByVMID(vmid, targetInstance)
+
+		if len(guests) == 0 {
+			result.Warnings = append(result.Warnings,
+				fmt.Sprintf("VMID %d not found in Pulse state - routing based on context", vmid))
+		} else if len(guests) == 1 {
+			result.TargetNode = strings.ToLower(guests[0].Node)
+			result.RoutingMethod = "vmid_lookup"
+			log.Info().
+				Int("vmid", vmid).
+				Str("node", guests[0].Node).
+				Str("guest_name", guests[0].Name).
+				Msg("Routed command via VMID state lookup")
+		} else {
+			// Multiple matches - try to disambiguate
+			if targetInstance != "" {
+				for _, g := range guests {
+					if strings.EqualFold(g.Instance, targetInstance) {
+						result.TargetNode = strings.ToLower(g.Node)
+						result.RoutingMethod = "vmid_lookup_with_instance"
+						log.Info().
+							Int("vmid", vmid).
+							Str("node", g.Node).
+							Str("instance", g.Instance).
+							Msg("Resolved VMID collision using instance")
+						break
+					}
+				}
+			}
+			if result.TargetNode == "" {
+				// Return explicit error for VMID collision
+				var locations []string
+				for _, g := range guests {
+					locations = append(locations, fmt.Sprintf("%s on %s (%s)", g.Name, g.Node, g.Instance))
+				}
+				return nil, &RoutingError{
+					TargetVMID:      vmid,
+					AvailableAgents: agentHostnames,
+					Reason: fmt.Sprintf("VMID %d exists on multiple nodes: %s",
+						vmid, strings.Join(locations, ", ")),
+					Suggestion: "Specify the instance/cluster in your query to disambiguate",
+				}
+			}
+		}
+	}
+
+	// Step 2: Try unified ResourceProvider lookup (PRIMARY method for workloads)
+	// This uses the new redesigned infrastructure model which knows the relationships
+	// between all resources (containers → hosts, VMs → nodes, etc.)
+	if result.TargetNode == "" {
+		s.mu.RLock()
+		rp := s.resourceProvider
+		s.mu.RUnlock()
+		
+		if rp != nil {
+			// Try to find the host for this workload
+			resourceName := ""
+			if name, ok := req.Context["containerName"].(string); ok && name != "" {
+				resourceName = name
+			} else if name, ok := req.Context["name"].(string); ok && name != "" {
+				resourceName = name
+			} else if name, ok := req.Context["guestName"].(string); ok && name != "" {
+				resourceName = name
+			}
+			
+			if resourceName != "" {
+				if host := rp.FindContainerHost(resourceName); host != "" {
+					result.TargetNode = strings.ToLower(host)
+					result.RoutingMethod = "resource_provider_lookup"
+					log.Info().
+						Str("resource_name", resourceName).
+						Str("host", host).
+						Str("target_type", req.TargetType).
+						Str("command", command).
+						Msg("Routing via unified ResourceProvider")
+				}
+			}
+		}
+	}
+
+	// Step 3: Fallback to explicit context fields (backwards compatibility)
+	// These are checked in order of specificity
+	if result.TargetNode == "" {
+		// Try the most specific fields first
+		hostFields := []string{"node", "host", "guest_node", "hostname", "host_name", "target_host"}
+		for _, field := range hostFields {
+			if value, ok := req.Context[field].(string); ok && value != "" {
+				result.TargetNode = strings.ToLower(value)
+				result.RoutingMethod = "context_" + field
+				log.Debug().
+					Str("field", field).
+					Str("value", value).
+					Str("command", command).
+					Msg("Routing via context field (fallback)")
+				break
+			}
+		}
+	}
+
+	// Step 3: Extract VMID from target ID and look up in state
+	if result.TargetNode == "" && req.TargetID != "" {
+		if vmid := extractVMIDFromTargetID(req.TargetID); vmid > 0 {
+			result.TargetVMID = strconv.Itoa(vmid)
+
+			// Try instance from context
+			targetInstance := ""
+			if inst, ok := req.Context["instance"].(string); ok {
+				targetInstance = inst
+			}
+
+			guests := s.lookupGuestsByVMID(vmid, targetInstance)
+			if len(guests) == 1 {
+				result.TargetNode = strings.ToLower(guests[0].Node)
+				result.RoutingMethod = "target_id_vmid_lookup"
+				log.Debug().
+					Int("vmid", vmid).
+					Str("node", guests[0].Node).
+					Str("target_id", req.TargetID).
+					Msg("Resolved node from target ID VMID lookup")
+			}
+		}
+	}
+
+	// Step 4: Try to find exact matching agent
+	if result.TargetNode != "" {
+		targetNodeClean := strings.TrimSpace(strings.ToLower(result.TargetNode))
+
+		// EXACT match only - no substring matching
+		if agent, exists := agentMap[targetNodeClean]; exists {
+			result.AgentID = agent.AgentID
+			result.AgentHostname = agent.Hostname
+			log.Debug().
+				Str("target_node", result.TargetNode).
+				Str("agent", agent.Hostname).
+				Str("method", result.RoutingMethod).
+				Msg("Exact agent match found")
+			return result, nil
+		}
+
+		// Try cluster peer routing
+		if peerAgentID := s.findClusterPeerAgent(targetNodeClean, agents); peerAgentID != "" {
+			for _, agent := range agents {
+				if agent.AgentID == peerAgentID {
+					result.AgentID = peerAgentID
+					result.AgentHostname = agent.Hostname
+					result.ClusterPeer = true
+					log.Info().
+						Str("target_node", result.TargetNode).
+						Str("peer_agent", agent.Hostname).
+						Msg("Routing via cluster peer agent")
+					return result, nil
+				}
+			}
+		}
+
+		// No agent available for this node
+		return nil, &RoutingError{
+			TargetNode:      result.TargetNode,
+			AvailableAgents: agentHostnames,
+			Reason: fmt.Sprintf("No agent connected to node %q", result.TargetNode),
+			Suggestion: fmt.Sprintf("Install pulse-agent on %q, or ensure it's in a cluster with %s",
+				result.TargetNode, strings.Join(agentHostnames, ", ")),
+		}
+	}
+
+	// Step 5: No target node determined - for host commands with no context, use first agent
+	if req.TargetType == "host" && len(agents) == 1 {
+		result.AgentID = agents[0].AgentID
+		result.AgentHostname = agents[0].Hostname
+		result.RoutingMethod = "single_agent_fallback"
+		result.Warnings = append(result.Warnings,
+			fmt.Sprintf("No target node specified, using the only connected agent (%s). For multi-agent setups, specify target_host.", agents[0].Hostname))
+		log.Info().
+			Str("agent", agents[0].Hostname).
+			Str("target_type", req.TargetType).
+			Msg("Routing via single-agent fallback")
+		return result, nil
+	}
+
+	// Cannot determine where to route
+	// Provide actionable error with available agents listed
+	log.Error().
+		Str("target_type", req.TargetType).
+		Str("target_id", req.TargetID).
+		Strs("available_agents", agentHostnames).
+		Msg("Routing failed - cannot determine target agent")
+
+	return nil, &RoutingError{
+		AvailableAgents:     agentHostnames,
+		Reason:              "Cannot determine which host should execute this command",
+		Suggestion:          fmt.Sprintf("Please specify which host: %s", strings.Join(agentHostnames, ", ")),
+		AskForClarification: true,
+	}
+
+}
+
+// extractVMIDFromTargetID extracts a numeric VMID from various target ID formats.
+// Handles formats like:
+// - "delly-minipc-106" -> 106
+// - "minipc-106" -> 106
+// - "106" -> 106
+// - "lxc-106" -> 106
+// - "vm-106" -> 106
+func extractVMIDFromTargetID(targetID string) int {
+	if targetID == "" {
+		return 0
+	}
+
+	// Try parsing the whole thing as a number first
+	if vmid, err := strconv.Atoi(targetID); err == nil && vmid > 0 {
+		return vmid
+	}
+
+	// Split by hyphen and take the last numeric part
+	parts := strings.Split(targetID, "-")
+	for i := len(parts) - 1; i >= 0; i-- {
+		if vmid, err := strconv.Atoi(parts[i]); err == nil && vmid > 0 {
+			return vmid
+		}
+	}
+
+	return 0
+}
+
+// findClusterPeerAgent finds an agent that can execute commands for a node in the same cluster.
+// For PVE clusters, any node can execute pvesh/vzdump commands, but pct exec/qm guest exec
+// require the agent to be on the specific node.
+func (s *Service) findClusterPeerAgent(targetNode string, agents []agentexec.ConnectedAgent) string {
+	// Check for nil persistence
+	if s.persistence == nil {
+		return ""
+	}
+	
+	// Load nodes config to check cluster membership
+	nodesConfig, err := s.persistence.LoadNodesConfig()
+	if err != nil || nodesConfig == nil {
+		return ""
+	}
+
+	// Find which cluster the target node belongs to
+	var targetCluster string
+	var clusterEndpoints []config.ClusterEndpoint
+
+	for _, pve := range nodesConfig.PVEInstances {
+		if strings.EqualFold(pve.Name, targetNode) {
+			if pve.IsCluster && pve.ClusterName != "" {
+				targetCluster = pve.ClusterName
+				clusterEndpoints = pve.ClusterEndpoints
+			}
+			break
+		}
+		// Also check cluster endpoints
+		for _, ep := range pve.ClusterEndpoints {
+			if strings.EqualFold(ep.NodeName, targetNode) {
+				if pve.IsCluster && pve.ClusterName != "" {
+					targetCluster = pve.ClusterName
+					clusterEndpoints = pve.ClusterEndpoints
+				}
+				break
+			}
+		}
+	}
+
+	if targetCluster == "" {
+		return ""
+	}
+
+	// Build list of cluster member nodes
+	clusterNodes := make(map[string]bool)
+	for _, ep := range clusterEndpoints {
+		clusterNodes[strings.ToLower(ep.NodeName)] = true
+	}
+
+	// Find an agent on any cluster member
+	for _, agent := range agents {
+		agentHostname := strings.ToLower(agent.Hostname)
+		if clusterNodes[agentHostname] {
+			log.Debug().
+				Str("target_node", targetNode).
+				Str("cluster", targetCluster).
+				Str("peer_agent", agent.Hostname).
+				Msg("Found cluster peer agent")
+			return agent.AgentID
+		}
+	}
+
+	return ""
+}
diff --git a/internal/ai/routing_test.go b/internal/ai/routing_test.go
new file mode 100644
index 0000000..1882387
--- /dev/null
+++ b/internal/ai/routing_test.go
@@ -0,0 +1,276 @@
+package ai
+
+import (
+	"testing"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+)
+
+func TestExtractVMIDFromTargetID(t *testing.T) {
+	tests := []struct {
+		name     string
+		targetID string
+		want     int
+	}{
+		// Standard formats
+		{"plain vmid", "106", 106},
+		{"node-vmid", "minipc-106", 106},
+		{"instance-node-vmid", "delly-minipc-106", 106},
+		
+		// Edge cases with hyphenated names
+		{"hyphenated-node-vmid", "pve-node-01-106", 106},
+		{"hyphenated-instance-node-vmid", "my-cluster-pve-node-01-106", 106},
+		
+		// Type prefixes
+		{"lxc prefix", "lxc-106", 106},
+		{"vm prefix", "vm-106", 106},
+		{"ct prefix", "ct-106", 106},
+		
+		// Non-numeric - should return 0
+		{"non-numeric", "mycontainer", 0},
+		{"no-vmid", "node-name", 0},
+		{"empty", "", 0},
+		
+		// Large VMIDs (Proxmox uses up to 999999999)
+		{"large vmid", "node-999999", 999999},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := extractVMIDFromTargetID(tt.targetID)
+			if got != tt.want {
+				t.Errorf("extractVMIDFromTargetID(%q) = %d, want %d", tt.targetID, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRoutingError(t *testing.T) {
+	t.Run("with suggestion", func(t *testing.T) {
+		err := &RoutingError{
+			TargetNode:      "minipc",
+			AvailableAgents: []string{"delly", "pimox"},
+			Reason:          "No agent connected to node \"minipc\"",
+			Suggestion:      "Install pulse-agent on minipc",
+		}
+		
+		want := "No agent connected to node \"minipc\". Install pulse-agent on minipc"
+		if err.Error() != want {
+			t.Errorf("Error() = %q, want %q", err.Error(), want)
+		}
+	})
+	
+	t.Run("without suggestion", func(t *testing.T) {
+		err := &RoutingError{
+			Reason: "No agents connected",
+		}
+		
+		want := "No agents connected"
+		if err.Error() != want {
+			t.Errorf("Error() = %q, want %q", err.Error(), want)
+		}
+	})
+}
+
+func TestRouteToAgent_NoAgents(t *testing.T) {
+	s := &Service{}
+	
+	req := ExecuteRequest{
+		TargetType: "container",
+		TargetID:   "minipc-106",
+	}
+	
+	_, err := s.routeToAgent(req, "pct exec 106 -- hostname", nil)
+	if err == nil {
+		t.Error("expected error for no agents, got nil")
+	}
+	
+	routingErr, ok := err.(*RoutingError)
+	if !ok {
+		t.Fatalf("expected RoutingError, got %T", err)
+	}
+	
+	if routingErr.Suggestion == "" {
+		t.Error("expected suggestion in error")
+	}
+}
+
+func TestRouteToAgent_ExactMatch(t *testing.T) {
+	s := &Service{}
+	
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+		{AgentID: "agent-2", Hostname: "minipc"},
+		{AgentID: "agent-3", Hostname: "pimox"},
+	}
+	
+	tests := []struct {
+		name            string
+		req             ExecuteRequest
+		command         string
+		wantAgentID     string
+		wantHostname    string
+	}{
+		{
+			name: "route by context node",
+			req: ExecuteRequest{
+				TargetType: "container",
+				TargetID:   "delly-minipc-106",
+				Context:    map[string]interface{}{"node": "minipc"},
+			},
+			command:      "hostname",
+			wantAgentID:  "agent-2",
+			wantHostname: "minipc",
+		},
+		{
+			name: "route by context hostname for host target",
+			req: ExecuteRequest{
+				TargetType: "host",
+				Context:    map[string]interface{}{"hostname": "delly"},
+			},
+			command:      "uptime",
+			wantAgentID:  "agent-1",
+			wantHostname: "delly",
+		},
+		{
+			name: "route by guest_node context",
+			req: ExecuteRequest{
+				TargetType: "vm",
+				TargetID:   "100",
+				Context:    map[string]interface{}{"guest_node": "pimox"},
+			},
+			command:      "hostname",
+			wantAgentID:  "agent-3",
+			wantHostname: "pimox",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := s.routeToAgent(tt.req, tt.command, agents)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			
+			if result.AgentID != tt.wantAgentID {
+				t.Errorf("AgentID = %q, want %q", result.AgentID, tt.wantAgentID)
+			}
+			
+			if result.AgentHostname != tt.wantHostname {
+				t.Errorf("AgentHostname = %q, want %q", result.AgentHostname, tt.wantHostname)
+			}
+		})
+	}
+}
+
+func TestRouteToAgent_NoSubstringMatching(t *testing.T) {
+	s := &Service{}
+	
+	// Agent "mini" should NOT match node "minipc"
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "mini"},
+		{AgentID: "agent-2", Hostname: "pc"},
+	}
+	
+	req := ExecuteRequest{
+		TargetType: "container",
+		Context:    map[string]interface{}{"node": "minipc"},
+	}
+	
+	_, err := s.routeToAgent(req, "hostname", agents)
+	if err == nil {
+		t.Error("expected error when no exact match, got nil (substring matching may be occurring)")
+	}
+	
+	routingErr, ok := err.(*RoutingError)
+	if !ok {
+		t.Fatalf("expected RoutingError, got %T", err)
+	}
+	
+	if routingErr.TargetNode != "minipc" {
+		t.Errorf("TargetNode = %q, want %q", routingErr.TargetNode, "minipc")
+	}
+}
+
+func TestRouteToAgent_CaseInsensitive(t *testing.T) {
+	s := &Service{}
+	
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "MiniPC"},
+	}
+	
+	req := ExecuteRequest{
+		TargetType: "container",
+		Context:    map[string]interface{}{"node": "minipc"}, // lowercase
+	}
+	
+	result, err := s.routeToAgent(req, "hostname", agents)
+	if err != nil {
+		t.Fatalf("expected case-insensitive match, got error: %v", err)
+	}
+	
+	if result.AgentID != "agent-1" {
+		t.Errorf("AgentID = %q, want %q", result.AgentID, "agent-1")
+	}
+}
+
+func TestRouteToAgent_HyphenatedNodeNames(t *testing.T) {
+	s := &Service{}
+	
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "pve-node-01"},
+		{AgentID: "agent-2", Hostname: "pve-node-02"},
+	}
+	
+	req := ExecuteRequest{
+		TargetType: "container",
+		Context:    map[string]interface{}{"node": "pve-node-02"},
+	}
+	
+	result, err := s.routeToAgent(req, "hostname", agents)
+	if err != nil {
+		t.Fatalf("unexpected error for hyphenated node names: %v", err)
+	}
+	
+	if result.AgentID != "agent-2" {
+		t.Errorf("AgentID = %q, want %q", result.AgentID, "agent-2")
+	}
+}
+
+func TestRouteToAgent_ActionableErrorMessages(t *testing.T) {
+	s := &Service{}
+	
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+	}
+	
+	req := ExecuteRequest{
+		TargetType: "container",
+		Context:    map[string]interface{}{"node": "minipc"},
+	}
+	
+	_, err := s.routeToAgent(req, "hostname", agents)
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	
+	routingErr, ok := err.(*RoutingError)
+	if !ok {
+		t.Fatalf("expected RoutingError, got %T", err)
+	}
+	
+	// Error should mention the target node
+	if routingErr.TargetNode != "minipc" {
+		t.Errorf("TargetNode = %q, want %q", routingErr.TargetNode, "minipc")
+	}
+	
+	// Error should list available agents
+	if len(routingErr.AvailableAgents) == 0 {
+		t.Error("expected available agents in error")
+	}
+	
+	// Error should have actionable suggestion
+	if routingErr.Suggestion == "" {
+		t.Error("expected suggestion in error message")
+	}
+}
diff --git a/internal/ai/sanitize_test.go b/internal/ai/sanitize_test.go
new file mode 100644
index 0000000..bcb8a28
--- /dev/null
+++ b/internal/ai/sanitize_test.go
@@ -0,0 +1,70 @@
+package ai
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestSanitizeError(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    error
+		expected string
+	}{
+		{
+			name:     "nil error",
+			input:    nil,
+			expected: "",
+		},
+		{
+			name:     "i/o timeout with TCP details",
+			input:    errors.New("failed to send command: write tcp 192.168.0.123:7655->192.168.0.134:58004: i/o timeout"),
+			expected: "connection to agent timed out - the agent may be disconnected or unreachable",
+		},
+		{
+			name:     "read tcp i/o timeout",
+			input:    errors.New("read tcp 192.168.1.100:8006: i/o timeout"),
+			expected: "network timeout - the target may be unreachable",
+		},
+		{
+			name:     "connection refused with TCP details",
+			input:    errors.New("dial tcp 192.168.1.50:9090: connection refused"),
+			expected: "connection refused - the agent may not be running on the target host",
+		},
+		{
+			name:     "no such host",
+			input:    errors.New("dial tcp: lookup unknown-host: no such host"),
+			expected: "host not found - verify the hostname is correct and DNS is working",
+		},
+		{
+			name:     "context deadline exceeded",
+			input:    errors.New("context deadline exceeded"),
+			expected: "operation timed out - the command may have taken too long",
+		},
+		{
+			name:     "regular error passes through",
+			input:    errors.New("invalid command"),
+			expected: "invalid command",
+		},
+		{
+			name:     "agent not connected error passes through",
+			input:    errors.New("agent delly not connected"),
+			expected: "agent delly not connected",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := sanitizeError(tt.input)
+			if tt.input == nil {
+				if result != nil {
+					t.Errorf("expected nil, got %v", result)
+				}
+				return
+			}
+			if result.Error() != tt.expected {
+				t.Errorf("expected %q, got %q", tt.expected, result.Error())
+			}
+		})
+	}
+}
diff --git a/internal/ai/service.go b/internal/ai/service.go
new file mode 100644
index 0000000..6eba297
--- /dev/null
+++ b/internal/ai/service.go
@@ -0,0 +1,2881 @@
+package ai
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/cost"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/knowledge"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/providers"
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rcourtman/pulse-go-rewrite/internal/types"
+	"github.com/rs/zerolog/log"
+)
+
+// StateProvider provides access to the current infrastructure state
+type StateProvider interface {
+	GetState() models.StateSnapshot
+}
+
+// Service orchestrates AI interactions
+type Service struct {
+	mu               sync.RWMutex
+	persistence      *config.ConfigPersistence
+	provider         providers.Provider
+	cfg              *config.AIConfig
+	agentServer      *agentexec.Server
+	policy           *agentexec.CommandPolicy
+	stateProvider    StateProvider
+	alertProvider    AlertProvider
+	knowledgeStore   *knowledge.Store
+	costStore        *cost.Store
+	resourceProvider ResourceProvider // Unified resource model provider (Phase 2)
+	patrolService    *PatrolService   // Background AI monitoring service
+	metadataProvider MetadataProvider // Enables AI to update resource URLs
+
+	// Alert-triggered analysis - token-efficient real-time AI insights
+	alertTriggeredAnalyzer *AlertTriggeredAnalyzer
+
+	limits executionLimits
+
+	modelsCache modelsCache
+}
+
+type executionLimits struct {
+	chatSlots   chan struct{}
+	patrolSlots chan struct{}
+}
+
+type modelsCache struct {
+	mu     sync.RWMutex
+	at     time.Time
+	key    string
+	models []providers.ModelInfo
+	ttl    time.Duration
+}
+
+// NewService creates a new AI service
+func NewService(persistence *config.ConfigPersistence, agentServer *agentexec.Server) *Service {
+	// Initialize knowledge store
+	var knowledgeStore *knowledge.Store
+	costStore := cost.NewStore(cost.DefaultMaxDays)
+	if persistence != nil {
+		var err error
+		knowledgeStore, err = knowledge.NewStore(persistence.DataDir())
+		if err != nil {
+			log.Warn().Err(err).Msg("Failed to initialize knowledge store")
+		}
+		if err := costStore.SetPersistence(NewCostPersistenceAdapter(persistence)); err != nil {
+			log.Warn().Err(err).Msg("Failed to initialize AI usage cost store")
+		}
+	}
+
+	return &Service{
+		persistence:    persistence,
+		agentServer:    agentServer,
+		policy:         agentexec.DefaultPolicy(),
+		knowledgeStore: knowledgeStore,
+		costStore:      costStore,
+		limits: executionLimits{
+			chatSlots:   make(chan struct{}, 4),
+			patrolSlots: make(chan struct{}, 1),
+		},
+		modelsCache: modelsCache{
+			ttl: 5 * time.Minute,
+		},
+	}
+}
+
+func (s *Service) acquireExecutionSlot(ctx context.Context, useCase string) (func(), error) {
+	normalized := strings.TrimSpace(strings.ToLower(useCase))
+	if normalized == "" {
+		normalized = "chat"
+	}
+
+	var slots chan struct{}
+	if normalized == "patrol" {
+		slots = s.limits.patrolSlots
+	} else {
+		slots = s.limits.chatSlots
+	}
+
+	select {
+	case slots <- struct{}{}:
+		return func() { <-slots }, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-time.After(5 * time.Second):
+		return nil, fmt.Errorf("AI is busy - too many concurrent requests")
+	}
+}
+
+func (s *Service) enforceBudget(useCase string) error {
+	s.mu.RLock()
+	cfg := s.cfg
+	store := s.costStore
+	s.mu.RUnlock()
+
+	if cfg == nil || cfg.CostBudgetUSD30d <= 0 || store == nil {
+		return nil
+	}
+
+	summary := store.GetSummary(30)
+	if !summary.Totals.PricingKnown {
+		// We can't reliably enforce without pricing. Keep tracking and allow.
+		return nil
+	}
+
+	if summary.Totals.EstimatedUSD >= cfg.CostBudgetUSD30d {
+		normalized := strings.TrimSpace(strings.ToLower(useCase))
+		if normalized == "" {
+			normalized = "chat"
+		}
+		return fmt.Errorf("AI cost budget exceeded (%.2f/%.2f USD over %d days) - disable AI or raise budget to continue",
+			summary.Totals.EstimatedUSD, cfg.CostBudgetUSD30d, summary.EffectiveDays)
+	}
+
+	return nil
+}
+
+// SetStateProvider sets the state provider for infrastructure context
+func (s *Service) SetStateProvider(sp StateProvider) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.stateProvider = sp
+
+	// Initialize patrol service if not already done
+	if s.patrolService == nil && sp != nil {
+		s.patrolService = NewPatrolService(s, sp)
+		// Connect knowledge store to patrol for per-resource notes in context
+		if s.knowledgeStore != nil {
+			s.patrolService.SetKnowledgeStore(s.knowledgeStore)
+		}
+	}
+
+	// Initialize alert-triggered analyzer if not already done
+	if s.alertTriggeredAnalyzer == nil && sp != nil && s.patrolService != nil {
+		s.alertTriggeredAnalyzer = NewAlertTriggeredAnalyzer(s.patrolService, sp)
+	}
+}
+
+// GetPatrolService returns the patrol service for background monitoring
+func (s *Service) GetPatrolService() *PatrolService {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.patrolService
+}
+
+// GetAlertTriggeredAnalyzer returns the alert-triggered analyzer for token-efficient real-time analysis
+func (s *Service) GetAlertTriggeredAnalyzer() *AlertTriggeredAnalyzer {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.alertTriggeredAnalyzer
+}
+
+// GetAIConfig returns the current AI configuration
+func (s *Service) GetAIConfig() *config.AIConfig {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.cfg
+}
+
+// GetCostSummary returns usage rollups for the last N days.
+func (s *Service) GetCostSummary(days int) cost.Summary {
+	s.mu.RLock()
+	store := s.costStore
+	s.mu.RUnlock()
+
+	if store == nil {
+		if days <= 0 {
+			days = 30
+		}
+		effectiveDays := days
+		truncated := false
+		if cost.DefaultMaxDays > 0 && days > cost.DefaultMaxDays {
+			effectiveDays = cost.DefaultMaxDays
+			truncated = true
+		}
+		return cost.Summary{
+			Days:           days,
+			RetentionDays:  cost.DefaultMaxDays,
+			EffectiveDays:  effectiveDays,
+			Truncated:      truncated,
+			PricingAsOf:    cost.PricingAsOf(),
+			ProviderModels: []cost.ProviderModelSummary{},
+			UseCases:       []cost.UseCaseSummary{},
+			DailyTotals:    []cost.DailySummary{},
+			Totals: cost.ProviderModelSummary{
+				Provider: "all",
+			},
+		}
+	}
+	return store.GetSummary(days)
+}
+
+// ListCostEvents returns retained AI usage events within the requested time window.
+func (s *Service) ListCostEvents(days int) []cost.UsageEvent {
+	s.mu.RLock()
+	store := s.costStore
+	s.mu.RUnlock()
+	if store == nil {
+		return nil
+	}
+	return store.ListEvents(days)
+}
+
+// ClearCostHistory deletes retained AI usage events (admin operation).
+func (s *Service) ClearCostHistory() error {
+	s.mu.RLock()
+	store := s.costStore
+	s.mu.RUnlock()
+	if store == nil {
+		return nil
+	}
+	return store.Clear()
+}
+
+// SetPatrolThresholdProvider sets the threshold provider for patrol
+// This should be called with an AlertThresholdAdapter to connect patrol to user-configured thresholds
+func (s *Service) SetPatrolThresholdProvider(provider ThresholdProvider) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetThresholdProvider(provider)
+	}
+}
+
+// MetricsHistoryProvider provides access to historical metrics for trend analysis
+// This interface matches the monitoring.MetricsHistory methods we need
+type MetricsHistoryProvider interface {
+	GetNodeMetrics(nodeID string, metricType string, duration time.Duration) []MetricPoint
+	GetGuestMetrics(guestID string, metricType string, duration time.Duration) []MetricPoint
+	GetAllGuestMetrics(guestID string, duration time.Duration) map[string][]MetricPoint
+	GetAllStorageMetrics(storageID string, duration time.Duration) map[string][]MetricPoint
+}
+
+// MetricPoint is an alias for the shared metric point type
+type MetricPoint = types.MetricPoint
+
+// SetMetricsHistoryProvider sets the metrics history provider for enriched AI context
+// This enables the AI to see trends, anomalies, and predictions based on historical data
+func (s *Service) SetMetricsHistoryProvider(provider MetricsHistoryProvider) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetMetricsHistoryProvider(provider)
+	}
+}
+
+// SetBaselineStore sets the baseline store for anomaly detection
+func (s *Service) SetBaselineStore(store *BaselineStore) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetBaselineStore(store)
+	}
+}
+
+// SetChangeDetector sets the change detector for operational memory
+func (s *Service) SetChangeDetector(detector *ChangeDetector) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetChangeDetector(detector)
+	}
+}
+
+// SetRemediationLog sets the remediation log for tracking fix attempts
+func (s *Service) SetRemediationLog(remLog *RemediationLog) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetRemediationLog(remLog)
+	}
+}
+
+// SetPatternDetector sets the pattern detector for failure prediction
+func (s *Service) SetPatternDetector(detector *PatternDetector) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetPatternDetector(detector)
+	}
+}
+
+// SetCorrelationDetector sets the correlation detector for multi-resource correlation
+func (s *Service) SetCorrelationDetector(detector *CorrelationDetector) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.SetCorrelationDetector(detector)
+	}
+}
+
+// StartPatrol starts the background patrol service
+func (s *Service) StartPatrol(ctx context.Context) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	alertAnalyzer := s.alertTriggeredAnalyzer
+	cfg := s.cfg
+	s.mu.RUnlock()
+
+	if patrol == nil {
+		log.Debug().Msg("Patrol service not initialized, cannot start")
+		return
+	}
+
+	if cfg == nil || !cfg.IsPatrolEnabled() {
+		log.Debug().Msg("AI Patrol not enabled")
+		return
+	}
+
+	// Configure patrol from AI config
+	patrolCfg := PatrolConfig{
+		Enabled:              true,
+		QuickCheckInterval:   cfg.GetPatrolInterval(),
+		DeepAnalysisInterval: 6 * time.Hour,
+		AnalyzeNodes:         cfg.PatrolAnalyzeNodes,
+		AnalyzeGuests:        cfg.PatrolAnalyzeGuests,
+		AnalyzeDocker:        cfg.PatrolAnalyzeDocker,
+		AnalyzeStorage:       cfg.PatrolAnalyzeStorage,
+	}
+	patrol.SetConfig(patrolCfg)
+	patrol.Start(ctx)
+
+	// Configure alert-triggered analyzer
+	if alertAnalyzer != nil {
+		alertAnalyzer.SetEnabled(cfg.IsAlertTriggeredAnalysisEnabled())
+		log.Info().
+			Bool("enabled", cfg.IsAlertTriggeredAnalysisEnabled()).
+			Msg("Alert-triggered AI analysis configured")
+	}
+}
+
+// StopPatrol stops the background patrol service
+func (s *Service) StopPatrol() {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol != nil {
+		patrol.Stop()
+	}
+}
+
+// ReconfigurePatrol updates the patrol configuration without restarting
+// Call this after changing patrol settings to apply them immediately
+func (s *Service) ReconfigurePatrol() {
+	s.mu.RLock()
+	patrol := s.patrolService
+	alertAnalyzer := s.alertTriggeredAnalyzer
+	cfg := s.cfg
+	s.mu.RUnlock()
+
+	if patrol == nil || cfg == nil {
+		return
+	}
+
+	// Update patrol configuration
+	patrolCfg := PatrolConfig{
+		Enabled:              cfg.IsPatrolEnabled(),
+		QuickCheckInterval:   cfg.GetPatrolInterval(),
+		DeepAnalysisInterval: 6 * time.Hour,
+		AnalyzeNodes:         cfg.PatrolAnalyzeNodes,
+		AnalyzeGuests:        cfg.PatrolAnalyzeGuests,
+		AnalyzeDocker:        cfg.PatrolAnalyzeDocker,
+		AnalyzeStorage:       cfg.PatrolAnalyzeStorage,
+	}
+	patrol.SetConfig(patrolCfg)
+
+	log.Info().
+		Bool("enabled", patrolCfg.Enabled).
+		Dur("interval", patrolCfg.QuickCheckInterval).
+		Msg("Patrol configuration updated")
+
+	// Update alert-triggered analyzer
+	if alertAnalyzer != nil {
+		alertAnalyzer.SetEnabled(cfg.IsAlertTriggeredAnalysisEnabled())
+	}
+}
+
+// GuestInfo contains information about a guest (VM or container) found by VMID lookup
+type GuestInfo struct {
+	Node     string
+	Name     string
+	Type     string // "lxc" or "qemu"
+	Instance string // PVE instance ID (for multi-cluster disambiguation)
+}
+
+// lookupNodeForVMID looks up which node owns a given VMID using the state provider
+// Returns the node name and guest name if found, empty strings otherwise
+// If targetInstance is provided, only matches guests from that instance (for multi-cluster setups)
+func (s *Service) lookupNodeForVMID(vmid int) (node string, guestName string, guestType string) {
+	guests := s.lookupGuestsByVMID(vmid, "")
+	if len(guests) == 1 {
+		return guests[0].Node, guests[0].Name, guests[0].Type
+	}
+	if len(guests) > 1 {
+		// Multiple matches - VMID collision across instances
+		// Log warning and return first match (caller should use lookupGuestsByVMID with instance filter)
+		log.Warn().
+			Int("vmid", vmid).
+			Int("matches", len(guests)).
+			Msg("VMID collision detected - multiple guests with same VMID across instances")
+		return guests[0].Node, guests[0].Name, guests[0].Type
+	}
+	return "", "", ""
+}
+
+// lookupGuestsByVMID finds all guests with the given VMID
+// If targetInstance is non-empty, only returns guests from that instance
+func (s *Service) lookupGuestsByVMID(vmid int, targetInstance string) []GuestInfo {
+	s.mu.RLock()
+	sp := s.stateProvider
+	s.mu.RUnlock()
+
+	if sp == nil {
+		return nil
+	}
+
+	state := sp.GetState()
+	var results []GuestInfo
+
+	// Check containers
+	for _, ct := range state.Containers {
+		if ct.VMID == vmid {
+			if targetInstance == "" || ct.Instance == targetInstance {
+				results = append(results, GuestInfo{
+					Node:     ct.Node,
+					Name:     ct.Name,
+					Type:     "lxc",
+					Instance: ct.Instance,
+				})
+			}
+		}
+	}
+
+	// Check VMs
+	for _, vm := range state.VMs {
+		if vm.VMID == vmid {
+			if targetInstance == "" || vm.Instance == targetInstance {
+				results = append(results, GuestInfo{
+					Node:     vm.Node,
+					Name:     vm.Name,
+					Type:     "qemu",
+					Instance: vm.Instance,
+				})
+			}
+		}
+	}
+
+	return results
+}
+
+// extractVMIDFromCommand parses pct/qm/vzdump commands to extract the VMID being targeted
+// Returns the VMID, whether it requires node-specific routing, and whether found
+// Some commands (like vzdump) can run from any cluster node, others (like pct exec) must run on the owning node
+func extractVMIDFromCommand(command string) (vmid int, requiresOwnerNode bool, found bool) {
+	// Commands that MUST run on the node that owns the guest
+	// These interact directly with the container/VM runtime
+	nodeSpecificPatterns := []string{
+		// pct commands - match any pct subcommand followed by VMID
+		// Covers: exec, enter, start, stop, shutdown, reboot, status, push, pull, mount, unmount, etc.
+		`(?:^|\s)pct\s+\w+\s+(\d+)`,
+		// qm commands - match any qm subcommand followed by VMID
+		// Covers: start, stop, shutdown, reset, status, guest exec, monitor, etc.
+		`(?:^|\s)qm\s+(?:guest\s+)?\w+\s+(\d+)`,
+	}
+
+	// Commands that can run from any cluster node (cluster-aware)
+	// vzdump uses the cluster to route to the right node automatically
+	clusterAwarePatterns := []string{
+		`(?:^|\s)vzdump\s+(\d+)`,
+		// pvesh commands can specify node in path, so we don't force routing
+	}
+
+	// Check node-specific commands first (higher priority)
+	for _, pattern := range nodeSpecificPatterns {
+		re := regexp.MustCompile(pattern)
+		if matches := re.FindStringSubmatch(command); len(matches) > 1 {
+			if v, err := strconv.Atoi(matches[1]); err == nil {
+				return v, true, true
+			}
+		}
+	}
+
+	// Check cluster-aware commands (don't force node routing)
+	for _, pattern := range clusterAwarePatterns {
+		re := regexp.MustCompile(pattern)
+		if matches := re.FindStringSubmatch(command); len(matches) > 1 {
+			if v, err := strconv.Atoi(matches[1]); err == nil {
+				return v, false, true
+			}
+		}
+	}
+
+	return 0, false, false
+}
+
+// formatApprovalNeededToolResult returns a structured tool result for commands that require approval.
+// It is encoded as a marker + JSON so the LLM can reliably detect it.
+func formatApprovalNeededToolResult(command, toolID, reason string) string {
+	payload := map[string]interface{}{
+		"type":           "approval_required",
+		"command":        command,
+		"tool_id":        toolID,
+		"reason":         reason,
+		"how_to_approve": "Ask the user to click the approval button shown in the UI.",
+		"do_not_retry":   true,
+	}
+	b, err := json.Marshal(payload)
+	if err != nil {
+		// Fallback to a safe plain-text marker.
+		return fmt.Sprintf("APPROVAL_REQUIRED: %s", command)
+	}
+	return "APPROVAL_REQUIRED: " + string(b)
+}
+
+// formatPolicyBlockedToolResult returns a structured tool result for commands blocked by policy.
+func formatPolicyBlockedToolResult(command, reason string) string {
+	payload := map[string]interface{}{
+		"type":         "policy_blocked",
+		"command":      command,
+		"reason":       reason,
+		"do_not_retry": true,
+	}
+	b, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Sprintf("POLICY_BLOCKED: %s", reason)
+	}
+	return "POLICY_BLOCKED: " + string(b)
+}
+
+func parseApprovalNeededMarker(content string) (ApprovalNeededData, bool) {
+	const prefix = "APPROVAL_REQUIRED:"
+	if !strings.HasPrefix(content, prefix) {
+		return ApprovalNeededData{}, false
+	}
+	trimmed := strings.TrimSpace(strings.TrimPrefix(content, prefix))
+	if trimmed == "" {
+		return ApprovalNeededData{}, false
+	}
+
+	var payload struct {
+		Type    string `json:"type"`
+		Command string `json:"command"`
+		ToolID  string `json:"tool_id"`
+		Reason  string `json:"reason"`
+	}
+	if err := json.Unmarshal([]byte(trimmed), &payload); err != nil {
+		return ApprovalNeededData{}, false
+	}
+	if payload.Type != "approval_required" || payload.Command == "" {
+		return ApprovalNeededData{}, false
+	}
+
+	return ApprovalNeededData{
+		Command: payload.Command,
+		ToolID:  payload.ToolID,
+	}, true
+}
+
+func approvalNeededFromToolCall(req ExecuteRequest, tc providers.ToolCall, result string) (ApprovalNeededData, bool) {
+	if !strings.HasPrefix(result, "APPROVAL_REQUIRED:") {
+		return ApprovalNeededData{}, false
+	}
+	if tc.Name != "run_command" {
+		return ApprovalNeededData{}, false
+	}
+
+	cmd, _ := tc.Input["command"].(string)
+	runOnHost, _ := tc.Input["run_on_host"].(bool)
+	targetHost, _ := tc.Input["target_host"].(string)
+
+	if targetHost == "" {
+		if node, ok := req.Context["node"].(string); ok && node != "" {
+			targetHost = node
+		} else if node, ok := req.Context["hostname"].(string); ok && node != "" {
+			targetHost = node
+		} else if node, ok := req.Context["host_name"].(string); ok && node != "" {
+			targetHost = node
+		}
+	}
+
+	return ApprovalNeededData{
+		Command:    cmd,
+		ToolID:     tc.ID,
+		ToolName:   tc.Name,
+		RunOnHost:  runOnHost,
+		TargetHost: targetHost,
+	}, true
+}
+
+// LoadConfig loads the AI configuration and initializes the provider
+func (s *Service) LoadConfig() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	cfg, err := s.persistence.LoadAIConfig()
+	if err != nil {
+		return fmt.Errorf("failed to load AI config: %w", err)
+	}
+
+	s.cfg = cfg
+
+	// Don't initialize provider if AI is not enabled or not configured
+	if cfg == nil || !cfg.Enabled || !cfg.IsConfigured() {
+		s.provider = nil
+		return nil
+	}
+
+	selectedModel := cfg.GetModel()
+	selectedProvider, _ := config.ParseModelString(selectedModel)
+
+	providerClient, err := providers.NewForModel(cfg, selectedModel)
+	if err != nil {
+		// Only fall back to legacy config if no multi-provider credentials are set.
+		if len(cfg.GetConfiguredProviders()) == 0 && (cfg.Provider != "" || cfg.APIKey != "") {
+			if legacyClient, legacyErr := providers.NewFromConfig(cfg); legacyErr == nil {
+				providerClient = legacyClient
+				selectedProvider = providerClient.Name()
+				log.Info().
+					Str("provider", selectedProvider).
+					Str("model", cfg.GetModel()).
+					Msg("AI service initialized via legacy config (migration path)")
+			} else {
+				log.Warn().Err(legacyErr).Msg("Failed to initialize legacy AI provider")
+				s.provider = nil
+				return nil
+			}
+		} else {
+			log.Warn().
+				Err(err).
+				Str("selected_model", selectedModel).
+				Str("selected_provider", selectedProvider).
+				Strs("configured_providers", cfg.GetConfiguredProviders()).
+				Msg("AI enabled but selected provider is not configured; check API keys or model selection")
+			s.provider = nil
+			return nil
+		}
+	}
+
+	s.provider = providerClient
+	log.Info().
+		Str("provider", selectedProvider).
+		Str("model", selectedModel).
+		Bool("autonomous_mode", cfg.AutonomousMode).
+		Msg("AI service initialized")
+
+	return nil
+}
+
+// IsEnabled returns true if AI is enabled and configured
+func (s *Service) IsEnabled() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.cfg != nil && s.cfg.Enabled && s.provider != nil
+}
+
+// GetConfig returns a copy of the current AI config
+func (s *Service) GetConfig() *config.AIConfig {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if s.cfg == nil {
+		return nil
+	}
+	cfg := *s.cfg
+	return &cfg
+}
+
+// GetDebugContext returns debug information about what context would be sent to the AI
+func (s *Service) GetDebugContext(req ExecuteRequest) map[string]interface{} {
+	s.mu.RLock()
+	stateProvider := s.stateProvider
+	agentServer := s.agentServer
+	cfg := s.cfg
+	s.mu.RUnlock()
+
+	result := make(map[string]interface{})
+
+	// State provider info
+	result["has_state_provider"] = stateProvider != nil
+	if stateProvider != nil {
+		state := stateProvider.GetState()
+		result["state_summary"] = map[string]interface{}{
+			"nodes":         len(state.Nodes),
+			"vms":           len(state.VMs),
+			"containers":    len(state.Containers),
+			"docker_hosts":  len(state.DockerHosts),
+			"hosts":         len(state.Hosts),
+			"pbs_instances": len(state.PBSInstances),
+		}
+
+		// List some VMs/containers for verification
+		var vmNames []string
+		for _, vm := range state.VMs {
+			vmNames = append(vmNames, fmt.Sprintf("%s (VMID:%d, node:%s)", vm.Name, vm.VMID, vm.Node))
+		}
+		if len(vmNames) > 10 {
+			vmNames = vmNames[:10]
+		}
+		result["sample_vms"] = vmNames
+
+		var ctNames []string
+		for _, ct := range state.Containers {
+			ctNames = append(ctNames, fmt.Sprintf("%s (VMID:%d, node:%s)", ct.Name, ct.VMID, ct.Node))
+		}
+		if len(ctNames) > 10 {
+			ctNames = ctNames[:10]
+		}
+		result["sample_containers"] = ctNames
+
+		var hostNames []string
+		for _, h := range state.Hosts {
+			hostNames = append(hostNames, h.Hostname)
+		}
+		result["host_names"] = hostNames
+
+		var dockerHostNames []string
+		for _, dh := range state.DockerHosts {
+			dockerHostNames = append(dockerHostNames, fmt.Sprintf("%s (%d containers)", dh.DisplayName, len(dh.Containers)))
+		}
+		result["docker_host_names"] = dockerHostNames
+	}
+
+	// Agent info
+	result["has_agent_server"] = agentServer != nil
+	if agentServer != nil {
+		agents := agentServer.GetConnectedAgents()
+		var agentNames []string
+		for _, a := range agents {
+			agentNames = append(agentNames, a.Hostname)
+		}
+		result["connected_agents"] = agentNames
+	}
+
+	// Config info
+	result["has_config"] = cfg != nil
+	if cfg != nil {
+		result["custom_context_length"] = len(cfg.CustomContext)
+		if len(cfg.CustomContext) > 200 {
+			result["custom_context_preview"] = cfg.CustomContext[:200] + "..."
+		} else {
+			result["custom_context_preview"] = cfg.CustomContext
+		}
+	}
+
+	// Build and include the system prompt
+	systemPrompt := s.buildSystemPrompt(req)
+	result["system_prompt_length"] = len(systemPrompt)
+	result["system_prompt"] = systemPrompt
+
+	return result
+}
+
+// IsAutonomous returns true if autonomous mode is enabled
+func (s *Service) IsAutonomous() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.cfg != nil && s.cfg.AutonomousMode
+}
+
+// ConversationMessage represents a message in conversation history
+type ConversationMessage struct {
+	Role    string `json:"role"` // "user" or "assistant"
+	Content string `json:"content"`
+}
+
+// ExecuteRequest represents a request to execute an AI prompt
+type ExecuteRequest struct {
+	Prompt       string                 `json:"prompt"`
+	TargetType   string                 `json:"target_type,omitempty"` // "host", "container", "vm", "node"
+	TargetID     string                 `json:"target_id,omitempty"`
+	Context      map[string]interface{} `json:"context,omitempty"`       // Current metrics, state, etc.
+	SystemPrompt string                 `json:"system_prompt,omitempty"` // Override system prompt
+	History      []ConversationMessage  `json:"history,omitempty"`       // Previous conversation messages
+	FindingID    string                 `json:"finding_id,omitempty"`    // If fixing a patrol finding, the ID to resolve
+	Model        string                 `json:"model,omitempty"`         // Override model for this request (for user selection in chat)
+	UseCase      string                 `json:"use_case,omitempty"`      // "chat" or "patrol" - determines which default model to use
+}
+
+// ExecuteResponse represents the AI's response
+type ExecuteResponse struct {
+	Content          string               `json:"content"`
+	Model            string               `json:"model"`
+	InputTokens      int                  `json:"input_tokens"`
+	OutputTokens     int                  `json:"output_tokens"`
+	ToolCalls        []ToolExecution      `json:"tool_calls,omitempty"`        // Commands that were executed
+	PendingApprovals []ApprovalNeededData `json:"pending_approvals,omitempty"` // Commands that require approval (non-streaming)
+}
+
+// ToolExecution represents a tool that was executed during the AI conversation
+type ToolExecution struct {
+	Name    string `json:"name"`
+	Input   string `json:"input"`  // Human-readable input (e.g., the command)
+	Output  string `json:"output"` // Result of execution
+	Success bool   `json:"success"`
+}
+
+// getModelForRequest determines which model to use for a request
+// Priority: explicit override > use case default > config default
+func (s *Service) getModelForRequest(req ExecuteRequest) string {
+	// If request has explicit model override, use it
+	if req.Model != "" {
+		return req.Model
+	}
+
+	s.mu.RLock()
+	cfg := s.cfg
+	s.mu.RUnlock()
+
+	if cfg == nil {
+		return ""
+	}
+
+	// Use case-specific model selection
+	switch req.UseCase {
+	case "patrol":
+		return cfg.GetPatrolModel()
+	case "chat":
+		return cfg.GetChatModel()
+	default:
+		// Default to chat model for interactive requests
+		return cfg.GetChatModel()
+	}
+}
+
+// StreamEvent represents an event during AI execution for streaming
+type StreamEvent struct {
+	Type string      `json:"type"` // "tool_start", "tool_end", "content", "done", "error", "approval_needed"
+	Data interface{} `json:"data,omitempty"`
+}
+
+// StreamCallback is called for each event during streaming execution
+type StreamCallback func(event StreamEvent)
+
+// ToolStartData is sent when a tool execution begins
+type ToolStartData struct {
+	Name  string `json:"name"`
+	Input string `json:"input"`
+}
+
+// ToolEndData is sent when a tool execution completes
+type ToolEndData struct {
+	Name    string `json:"name"`
+	Input   string `json:"input"`
+	Output  string `json:"output"`
+	Success bool   `json:"success"`
+}
+
+// ApprovalNeededData is sent when a command needs user approval
+type ApprovalNeededData struct {
+	Command    string `json:"command"`
+	ToolID     string `json:"tool_id"`   // ID to reference when approving
+	ToolName   string `json:"tool_name"` // "run_command"
+	RunOnHost  bool   `json:"run_on_host"`
+	TargetHost string `json:"target_host,omitempty"` // Explicit host to route to
+}
+
+// Execute sends a prompt to the AI and returns the response
+// If tools are available and the AI requests them, it executes them in a loop
+func (s *Service) Execute(ctx context.Context, req ExecuteRequest) (*ExecuteResponse, error) {
+	release, err := s.acquireExecutionSlot(ctx, req.UseCase)
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+
+	if err := s.enforceBudget(req.UseCase); err != nil {
+		return nil, err
+	}
+
+	s.mu.RLock()
+	defaultProvider := s.provider
+	agentServer := s.agentServer
+	cfg := s.cfg
+	costStore := s.costStore
+	s.mu.RUnlock()
+
+	// Determine the model to use for this request
+	modelString := s.getModelForRequest(req)
+
+	// Create a provider for this specific model (supports multi-provider switching)
+	provider, err := providers.NewForModel(cfg, modelString)
+	if err != nil {
+		// Fall back to default provider if model-specific provider can't be created
+		log.Debug().Err(err).Str("model", modelString).Msg("Could not create provider for model, using default")
+		provider = defaultProvider
+	}
+
+	if provider == nil {
+		return nil, fmt.Errorf("AI is not enabled or configured")
+	}
+
+	// Build the system prompt
+	systemPrompt := req.SystemPrompt
+	if systemPrompt == "" {
+		systemPrompt = s.buildSystemPrompt(req)
+	}
+
+	// Check if agent is available for this target
+	hasAgent := s.hasAgentForTarget(req)
+
+	// Build tools list if agent is available
+	var tools []providers.Tool
+	if hasAgent && agentServer != nil {
+		tools = s.getTools()
+		systemPrompt += `
+
+## Available Tools
+You have access to tools to execute commands on the target system. You should:
+1. Use run_command to investigate issues, gather information, and PERFORM actions
+2. Actually execute the commands - don't just explain what commands to run
+3. For Proxmox operations (resize disk, manage containers/VMs), run commands on the HOST (target_type=host)
+4. For operations inside a container, run commands on the container (target_type=container)
+
+Examples of actions you can perform:
+- Resize LXC disk: pct resize <vmid> rootfs +10G (run on host)
+- Check disk usage: df -h (run on container)
+- View processes: ps aux --sort=-%mem | head -20
+- Check logs: tail -100 /var/log/syslog
+
+Always execute the commands rather than telling the user how to do it.`
+	}
+
+	// Inject previously learned knowledge about this guest
+	if s.knowledgeStore != nil {
+		guestID := s.getGuestID(req)
+		if guestID != "" {
+			if knowledgeContext := s.knowledgeStore.FormatForContext(guestID); knowledgeContext != "" {
+				systemPrompt += knowledgeContext
+			}
+		}
+	}
+
+	// Build initial messages with conversation history
+	var messages []providers.Message
+	for _, histMsg := range req.History {
+		messages = append(messages, providers.Message{
+			Role:    histMsg.Role,
+			Content: histMsg.Content,
+		})
+	}
+	messages = append(messages, providers.Message{Role: "user", Content: req.Prompt})
+
+	var toolExecutions []ToolExecution
+	totalInputTokens := 0
+	totalOutputTokens := 0
+	var finalContent string
+	var model string
+
+	// Agentic loop - keep going while AI requests tools
+	maxIterations := 10 // Safety limit
+	for i := 0; i < maxIterations; i++ {
+		if err := s.enforceBudget(req.UseCase); err != nil {
+			return nil, err
+		}
+
+		resp, err := provider.Chat(ctx, providers.ChatRequest{
+			Messages:  messages,
+			Model:     s.getModelForRequest(req),
+			System:    systemPrompt,
+			MaxTokens: 4096,
+			Tools:     tools,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("AI request failed: %w", err)
+		}
+
+		if costStore != nil {
+			providerName, _ := config.ParseModelString(modelString)
+			if providerName == "" {
+				providerName = provider.Name()
+			}
+			costStore.Record(cost.UsageEvent{
+				Timestamp:     time.Now(),
+				Provider:      providerName,
+				RequestModel:  modelString,
+				ResponseModel: resp.Model,
+				UseCase:       req.UseCase,
+				InputTokens:   resp.InputTokens,
+				OutputTokens:  resp.OutputTokens,
+				TargetType:    req.TargetType,
+				TargetID:      req.TargetID,
+				FindingID:     req.FindingID,
+			})
+		}
+
+		totalInputTokens += resp.InputTokens
+		totalOutputTokens += resp.OutputTokens
+		model = resp.Model
+		finalContent = resp.Content
+
+		// If no tool calls, we're done
+		if len(resp.ToolCalls) == 0 || resp.StopReason != "tool_use" {
+			break
+		}
+
+		// Add assistant's response with tool calls to messages
+		messages = append(messages, providers.Message{
+			Role:             "assistant",
+			Content:          resp.Content,
+			ReasoningContent: resp.ReasoningContent, // DeepSeek thinking mode
+			ToolCalls:        resp.ToolCalls,
+		})
+
+		// Execute each tool call and add results
+		var pendingApprovals []ApprovalNeededData
+		for _, tc := range resp.ToolCalls {
+			result, execution := s.executeTool(ctx, req, tc)
+			toolExecutions = append(toolExecutions, execution)
+
+			if approval, ok := approvalNeededFromToolCall(req, tc, result); ok {
+				pendingApprovals = append(pendingApprovals, approval)
+				continue
+			}
+
+			// Add tool result to messages
+			messages = append(messages, providers.Message{
+				Role: "user",
+				ToolResult: &providers.ToolResult{
+					ToolUseID: tc.ID,
+					Content:   result,
+					IsError:   !execution.Success,
+				},
+			})
+
+		}
+
+		// Stop the agentic loop when approvals are required.
+		// The caller can execute approvals via /api/ai/run-command and continue.
+		if len(pendingApprovals) > 0 {
+			return &ExecuteResponse{
+				Content:          finalContent,
+				Model:            model,
+				InputTokens:      totalInputTokens,
+				OutputTokens:     totalOutputTokens,
+				ToolCalls:        toolExecutions,
+				PendingApprovals: pendingApprovals,
+			}, nil
+		}
+	}
+
+	return &ExecuteResponse{
+		Content:      finalContent,
+		Model:        model,
+		InputTokens:  totalInputTokens,
+		OutputTokens: totalOutputTokens,
+		ToolCalls:    toolExecutions,
+	}, nil
+}
+
+// ExecuteStream sends a prompt to the AI and streams events via callback
+// This allows the UI to show real-time progress during tool execution
+func (s *Service) ExecuteStream(ctx context.Context, req ExecuteRequest, callback StreamCallback) (*ExecuteResponse, error) {
+	release, err := s.acquireExecutionSlot(ctx, req.UseCase)
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+
+	if err := s.enforceBudget(req.UseCase); err != nil {
+		return nil, err
+	}
+
+	s.mu.RLock()
+	defaultProvider := s.provider
+	agentServer := s.agentServer
+	cfg := s.cfg
+	costStore := s.costStore
+	s.mu.RUnlock()
+
+	// Determine the model to use for this request
+	modelString := s.getModelForRequest(req)
+
+	// Create a provider for this specific model (supports multi-provider switching)
+	provider, err := providers.NewForModel(cfg, modelString)
+	if err != nil {
+		// Fall back to default provider if model-specific provider can't be created
+		log.Debug().Err(err).Str("model", modelString).Msg("Could not create provider for model, using default")
+		provider = defaultProvider
+	}
+
+	if provider == nil {
+		return nil, fmt.Errorf("AI is not enabled or configured")
+	}
+
+	// Build the system prompt
+	systemPrompt := req.SystemPrompt
+	if systemPrompt == "" {
+		systemPrompt = s.buildSystemPrompt(req)
+	}
+
+	// Debug log the system prompt length and key sections
+	log.Debug().
+		Int("prompt_length", len(systemPrompt)).
+		Bool("has_infrastructure_map", strings.Contains(systemPrompt, "## Infrastructure Map")).
+		Bool("has_docker_hosts", strings.Contains(systemPrompt, "### Docker Hosts")).
+		Bool("has_standalone_hosts", strings.Contains(systemPrompt, "### Standalone Hosts")).
+		Bool("has_guests", strings.Contains(systemPrompt, "### All Guests")).
+		Msg("AI system prompt built")
+
+	// Check if agent is available for this target
+	hasAgent := s.hasAgentForTarget(req)
+
+	// Build tools list if agent is available
+	var tools []providers.Tool
+	if hasAgent && agentServer != nil {
+		tools = s.getTools()
+		systemPrompt += `
+
+## Available Tools
+You have access to tools to execute commands on the target system. You should:
+1. Use run_command to investigate issues, gather information, and PERFORM actions
+2. Actually execute the commands - don't just explain what commands to run
+3. For Proxmox operations (resize disk, manage containers/VMs), run commands on the HOST (target_type=host)
+4. For operations inside a container, run commands on the container (target_type=container)
+
+Examples of actions you can perform:
+- Resize LXC disk: pct resize <vmid> rootfs +10G (run on host)
+- Check disk usage: df -h (run on container)
+- View processes: ps aux --sort=-%mem | head -20
+- Check logs: tail -100 /var/log/syslog
+
+Always execute the commands rather than telling the user how to do it.`
+	}
+
+	// Inject previously learned knowledge about this guest
+	if s.knowledgeStore != nil {
+		guestID := s.getGuestID(req)
+		if guestID != "" {
+			if knowledgeContext := s.knowledgeStore.FormatForContext(guestID); knowledgeContext != "" {
+				log.Debug().
+					Str("guest_id", guestID).
+					Int("context_length", len(knowledgeContext)).
+					Msg("Injecting saved knowledge into AI context")
+				systemPrompt += knowledgeContext
+			} else {
+				log.Debug().Str("guest_id", guestID).Msg("No saved knowledge for guest")
+			}
+		}
+	}
+
+	// Build initial messages with conversation history
+	var messages []providers.Message
+	for _, histMsg := range req.History {
+		messages = append(messages, providers.Message{
+			Role:    histMsg.Role,
+			Content: histMsg.Content,
+		})
+	}
+	messages = append(messages, providers.Message{Role: "user", Content: req.Prompt})
+
+	var toolExecutions []ToolExecution
+	totalInputTokens := 0
+	totalOutputTokens := 0
+	var finalContent string
+	var model string
+
+	// Agentic loop - keep going while AI requests tools
+	// No artificial iteration limit - the context timeout (5 minutes) provides the safety net
+	iteration := 0
+	for {
+		iteration++
+		log.Debug().
+			Int("iteration", iteration).
+			Int("message_count", len(messages)).
+			Int("system_prompt_length", len(systemPrompt)).
+			Int("tools_count", len(tools)).
+			Msg("Calling AI provider...")
+
+		// Send a processing event so the frontend knows we're making an AI call
+		// This is especially important after tool execution when the next AI call can take a while
+		if iteration > 1 {
+			callback(StreamEvent{Type: "processing", Data: fmt.Sprintf("Analyzing results (iteration %d)...", iteration)})
+		}
+
+		if err := s.enforceBudget(req.UseCase); err != nil {
+			callback(StreamEvent{Type: "error", Data: err.Error()})
+			return nil, err
+		}
+
+		resp, err := provider.Chat(ctx, providers.ChatRequest{
+			Messages:  messages,
+			Model:     s.getModelForRequest(req),
+			System:    systemPrompt,
+			MaxTokens: 4096,
+			Tools:     tools,
+		})
+		if err != nil {
+			log.Error().Err(err).Int("iteration", iteration).Msg("AI provider call failed")
+			callback(StreamEvent{Type: "error", Data: err.Error()})
+			return nil, fmt.Errorf("AI request failed: %w", err)
+		}
+
+		if costStore != nil {
+			providerName, _ := config.ParseModelString(modelString)
+			if providerName == "" {
+				providerName = provider.Name()
+			}
+			costStore.Record(cost.UsageEvent{
+				Timestamp:     time.Now(),
+				Provider:      providerName,
+				RequestModel:  modelString,
+				ResponseModel: resp.Model,
+				UseCase:       req.UseCase,
+				InputTokens:   resp.InputTokens,
+				OutputTokens:  resp.OutputTokens,
+				TargetType:    req.TargetType,
+				TargetID:      req.TargetID,
+				FindingID:     req.FindingID,
+			})
+		}
+
+		log.Debug().Int("iteration", iteration).Msg("AI provider returned successfully")
+
+		totalInputTokens += resp.InputTokens
+		totalOutputTokens += resp.OutputTokens
+		model = resp.Model
+		finalContent = resp.Content
+
+		// Stream thinking/reasoning content if present (DeepSeek reasoner)
+		if resp.ReasoningContent != "" {
+			callback(StreamEvent{Type: "thinking", Data: resp.ReasoningContent})
+		}
+
+		// Stream intermediate content so users see the AI's explanations between tool calls
+		// This gives users visibility into the AI's reasoning as it works, not just at the end
+		if resp.Content != "" {
+			callback(StreamEvent{Type: "content", Data: resp.Content})
+		}
+
+		log.Debug().
+			Int("tool_calls", len(resp.ToolCalls)).
+			Str("stop_reason", resp.StopReason).
+			Int("iteration", iteration).
+			Int("total_input_tokens", totalInputTokens).
+			Int("total_output_tokens", totalOutputTokens).
+			Int("content_length", len(resp.Content)).
+			Bool("has_content", resp.Content != "").
+			Msg("AI streaming iteration complete")
+
+		// If no tool calls, we're done
+		if len(resp.ToolCalls) == 0 || resp.StopReason != "tool_use" {
+			log.Info().
+				Int("tool_calls", len(resp.ToolCalls)).
+				Str("stop_reason", resp.StopReason).
+				Int("iteration", iteration).
+				Msg("AI streaming loop ending - no more tool calls or stop_reason != tool_use")
+			break
+		}
+
+		// Add assistant's response with tool calls to messages
+		messages = append(messages, providers.Message{
+			Role:             "assistant",
+			Content:          resp.Content,
+			ReasoningContent: resp.ReasoningContent, // DeepSeek thinking mode
+			ToolCalls:        resp.ToolCalls,
+		})
+
+		// Execute each tool call and add results
+		// Track if any command needs approval - if so, we'll stop the loop after processing
+		anyNeedsApproval := false
+		for _, tc := range resp.ToolCalls {
+			toolInput := s.getToolInputDisplay(tc)
+
+			// Check if this command needs approval
+			needsApproval := false
+			if tc.Name == "run_command" {
+				cmd, _ := tc.Input["command"].(string)
+				runOnHost, _ := tc.Input["run_on_host"].(bool)
+				targetHost, _ := tc.Input["target_host"].(string)
+
+				// If AI didn't specify target_host, try to get it from request context
+				// This is crucial for proper routing when the command is approved
+				if targetHost == "" {
+					if node, ok := req.Context["node"].(string); ok && node != "" {
+						targetHost = node
+					} else if node, ok := req.Context["hostname"].(string); ok && node != "" {
+						targetHost = node
+					} else if node, ok := req.Context["host_name"].(string); ok && node != "" {
+						targetHost = node
+					}
+				}
+
+				isAuto := s.IsAutonomous()
+				policyDecision := s.policy.Evaluate(cmd)
+				log.Debug().
+					Bool("autonomous", isAuto).
+					Str("policy_decision", string(policyDecision)).
+					Str("command", cmd).
+					Str("target_host", targetHost).
+					Msg("Checking command policy/approval")
+
+				// Always block commands blocked by policy (even in autonomous mode).
+				if policyDecision == agentexec.PolicyBlock {
+					result := formatPolicyBlockedToolResult(cmd, "This command is blocked by security policy")
+					execution := ToolExecution{
+						Name:    tc.Name,
+						Input:   toolInput,
+						Output:  result,
+						Success: false,
+					}
+					toolExecutions = append(toolExecutions, execution)
+
+					callback(StreamEvent{
+						Type: "tool_start",
+						Data: ToolStartData{Name: tc.Name, Input: toolInput},
+					})
+					callback(StreamEvent{
+						Type: "tool_end",
+						Data: ToolEndData{Name: tc.Name, Input: toolInput, Output: result, Success: false},
+					})
+
+					messages = append(messages, providers.Message{
+						Role: "user",
+						ToolResult: &providers.ToolResult{
+							ToolUseID: tc.ID,
+							Content:   result,
+							IsError:   true,
+						},
+					})
+					continue
+				}
+
+				// If policy requires approval and we're not in autonomous mode, request approval.
+				if !isAuto && policyDecision == agentexec.PolicyRequireApproval {
+					needsApproval = true
+					anyNeedsApproval = true
+					callback(StreamEvent{
+						Type: "approval_needed",
+						Data: ApprovalNeededData{
+							Command:    cmd,
+							ToolID:     tc.ID,
+							ToolName:   tc.Name,
+							RunOnHost:  runOnHost,
+							TargetHost: targetHost,
+						},
+					})
+				}
+			}
+
+			var result string
+			var execution ToolExecution
+
+			if needsApproval {
+				// Don't execute - command needs user approval
+				// We'll break out of the loop after processing all tool calls
+				// Note: We don't add to toolExecutions here because the approval_needed event
+				// already tells the frontend to show the approval UI
+				cmd, _ := tc.Input["command"].(string)
+				result = formatApprovalNeededToolResult(cmd, tc.ID, "Command requires user approval")
+				execution = ToolExecution{
+					Name:    tc.Name,
+					Input:   toolInput,
+					Output:  result,
+					Success: true, // Not an error; awaiting approval
+				}
+			} else {
+				// Stream tool start event
+				callback(StreamEvent{
+					Type: "tool_start",
+					Data: ToolStartData{Name: tc.Name, Input: toolInput},
+				})
+
+				result, execution = s.executeTool(ctx, req, tc)
+				toolExecutions = append(toolExecutions, execution)
+
+				// Stream tool end event
+				callback(StreamEvent{
+					Type: "tool_end",
+					Data: ToolEndData{Name: tc.Name, Input: toolInput, Output: result, Success: execution.Success},
+				})
+
+				// Log to remediation log for operational memory
+				// Only log run_command since that's the main remediation action
+				if tc.Name == "run_command" {
+					s.logRemediation(req, toolInput, result, execution.Success)
+				}
+			}
+
+			// Truncate large results to prevent context bloat
+			// Keep first and last parts for context
+			resultForContext := result
+			const maxResultSize = 8000 // ~8KB per tool result
+			if len(result) > maxResultSize {
+				halfSize := maxResultSize / 2
+				resultForContext = result[:halfSize] + "\n\n[... output truncated (" +
+					fmt.Sprintf("%d", len(result)-maxResultSize) + " bytes omitted) ...]\n\n" +
+					result[len(result)-halfSize:]
+				log.Debug().
+					Int("original_size", len(result)).
+					Int("truncated_size", len(resultForContext)).
+					Msg("Truncated large tool result")
+			}
+
+			// Add tool result to messages
+			messages = append(messages, providers.Message{
+				Role: "user",
+				ToolResult: &providers.ToolResult{
+					ToolUseID: tc.ID,
+					Content:   resultForContext,
+					IsError:   !execution.Success,
+				},
+			})
+		}
+
+		// If any command needed approval, stop the agentic loop here.
+		// Don't call the AI again with "COMMAND_BLOCKED" results - this causes duplicate
+		// approval requests and confusing "click the button" messages.
+		// The frontend will show approval buttons, and user action will continue the conversation.
+		if anyNeedsApproval {
+			log.Info().
+				Int("pending_approvals", len(resp.ToolCalls)).
+				Int("iteration", iteration).
+				Msg("Stopping AI loop - commands need user approval")
+			// Use the AI's current response as final content (if any)
+			// This preserves any explanation the AI provided before requesting the command
+			break
+		}
+	}
+
+	// Stream the final content
+	callback(StreamEvent{Type: "content", Data: finalContent})
+	callback(StreamEvent{Type: "done"})
+
+	return &ExecuteResponse{
+		Content:      finalContent,
+		Model:        model,
+		InputTokens:  totalInputTokens,
+		OutputTokens: totalOutputTokens,
+		ToolCalls:    toolExecutions,
+	}, nil
+}
+
+// getToolInputDisplay returns a human-readable display of tool input
+func (s *Service) getToolInputDisplay(tc providers.ToolCall) string {
+	switch tc.Name {
+	case "run_command":
+		cmd, _ := tc.Input["command"].(string)
+		if runOnHost, ok := tc.Input["run_on_host"].(bool); ok && runOnHost {
+			return fmt.Sprintf("[host] %s", cmd)
+		}
+		return cmd
+	case "fetch_url":
+		url, _ := tc.Input["url"].(string)
+		return url
+	case "set_resource_url":
+		resourceType, _ := tc.Input["resource_type"].(string)
+		url, _ := tc.Input["url"].(string)
+		return fmt.Sprintf("Set %s URL: %s", resourceType, url)
+	default:
+		return fmt.Sprintf("%v", tc.Input)
+	}
+}
+
+// logRemediation logs a tool execution to the remediation log for operational memory
+// This enables learning from past fix attempts
+func (s *Service) logRemediation(req ExecuteRequest, command, output string, success bool) {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol == nil {
+		return
+	}
+
+	remLog := patrol.GetRemediationLog()
+	if remLog == nil {
+		return
+	}
+
+	// Determine outcome
+	outcome := OutcomeUnknown
+	if success {
+		outcome = OutcomeResolved
+	} else {
+		outcome = OutcomeFailed
+	}
+
+	// Extract problem from the original prompt (first 200 chars as summary)
+	problem := req.Prompt
+	if len(problem) > 200 {
+		problem = problem[:200] + "..."
+	}
+
+	// Get resource name from context if available
+	resourceName := ""
+	if req.Context != nil {
+		if name, ok := req.Context["name"].(string); ok {
+			resourceName = name
+		}
+	}
+
+	// Truncate output for storage
+	truncatedOutput := output
+	const maxOutputLen = 1000
+	if len(truncatedOutput) > maxOutputLen {
+		truncatedOutput = truncatedOutput[:maxOutputLen] + "..."
+	}
+
+	remLog.Log(RemediationRecord{
+		ResourceID:   req.TargetID,
+		ResourceType: req.TargetType,
+		ResourceName: resourceName,
+		FindingID:    req.FindingID,
+		Problem:      problem,
+		Action:       command,
+		Output:       truncatedOutput,
+		Outcome:      outcome,
+		Automatic:    req.UseCase == "patrol", // Patrol runs are automatic
+	})
+
+	log.Debug().
+		Str("resource_id", req.TargetID).
+		Str("command", command).
+		Bool("success", success).
+		Msg("Logged remediation action to operational memory")
+}
+
+// hasAgentForTarget checks if we have an agent connection for the given target.
+// This uses the same routing logic as command execution to determine if the target
+// can be reached, including cluster peer routing for Proxmox clusters.
+func (s *Service) hasAgentForTarget(req ExecuteRequest) bool {
+	if s.agentServer == nil {
+		return false
+	}
+
+	agents := s.agentServer.GetConnectedAgents()
+	if len(agents) == 0 {
+		return false
+	}
+
+	// For host targets with no specific context, any agent will do
+	if req.TargetType == "host" && len(req.Context) == 0 {
+		return true
+	}
+
+	// Try to determine the target node from the request context
+	// This mirrors the logic in routeToAgent
+	targetNode := ""
+
+	// Check context fields for the target node
+	hostFields := []string{"node", "host", "guest_node", "hostname", "host_name", "target_host"}
+	for _, field := range hostFields {
+		if value, ok := req.Context[field].(string); ok && value != "" {
+			targetNode = strings.ToLower(value)
+			break
+		}
+	}
+
+	// If no target node found in context, try the ResourceProvider
+	if targetNode == "" {
+		s.mu.RLock()
+		rp := s.resourceProvider
+		s.mu.RUnlock()
+
+		if rp != nil {
+			resourceName := ""
+			if name, ok := req.Context["containerName"].(string); ok && name != "" {
+				resourceName = name
+			} else if name, ok := req.Context["name"].(string); ok && name != "" {
+				resourceName = name
+			} else if name, ok := req.Context["guestName"].(string); ok && name != "" {
+				resourceName = name
+			}
+
+			if resourceName != "" {
+				if host := rp.FindContainerHost(resourceName); host != "" {
+					targetNode = strings.ToLower(host)
+				}
+			}
+		}
+	}
+
+	// If we still don't have a target node, check for single agent scenario
+	if targetNode == "" {
+		// For unknown targets, we need at least one agent
+		// The actual routing will determine which one to use
+		return len(agents) >= 1
+	}
+
+	// Check if we have a direct agent match or a cluster peer
+	for _, agent := range agents {
+		if strings.EqualFold(agent.Hostname, targetNode) {
+			return true
+		}
+	}
+
+	// Try cluster peer routing (for Proxmox clusters)
+	if peerAgentID := s.findClusterPeerAgent(targetNode, agents); peerAgentID != "" {
+		return true
+	}
+
+	return false
+}
+
+// getTools returns the available tools for AI
+func (s *Service) getTools() []providers.Tool {
+	tools := []providers.Tool{
+		{
+			Name:        "run_command",
+			Description: "Execute a shell command. By default runs on the current target (container/VM), but set run_on_host=true for Proxmox host commands. IMPORTANT: For targets on different nodes, specify target_host to route to the correct PVE node.",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"command": map[string]interface{}{
+						"type":        "string",
+						"description": "The shell command to execute (e.g., 'ps aux --sort=-%mem | head -20')",
+					},
+					"run_on_host": map[string]interface{}{
+						"type":        "boolean",
+						"description": "If true, run on the Proxmox/Docker host instead of inside the container/VM. Use for pct/qm commands like 'pct resize 101 rootfs +10G'. When true, you should also set target_host.",
+					},
+					"target_host": map[string]interface{}{
+						"type":        "string",
+						"description": "Optional hostname of the specific host/node to run the command on. Use this to explicitly route pct/qm/docker commands to the correct Proxmox node or Docker host. Check the 'node' or 'PVE Node' field in the target's context.",
+					},
+				},
+				"required": []string{"command"},
+			},
+		},
+		{
+			Name:        "fetch_url",
+			Description: "Fetch content from a URL. Use this to check if web services are responding, read API endpoints, or fetch documentation. Works with local network URLs and public sites.",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"url": map[string]interface{}{
+						"type":        "string",
+						"description": "The URL to fetch (e.g., 'http://192.168.1.50:8080/api/health' or 'https://example.com/docs')",
+					},
+				},
+				"required": []string{"url"},
+			},
+		},
+		{
+			Name:        "set_resource_url",
+			Description: "Set the web URL for a resource in Pulse after discovering a web service. Use this when you've found a web server running on a guest/container/host and want to save it for quick access. The URL will appear as a clickable link in the Pulse dashboard.",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"resource_type": map[string]interface{}{
+						"type":        "string",
+						"description": "Type of resource: 'guest' for VMs/LXC containers, 'docker' for Docker containers/services, or 'host' for standalone hosts",
+						"enum":        []string{"guest", "docker", "host"},
+					},
+					"resource_id": map[string]interface{}{
+						"type":        "string",
+						"description": "The resource ID from the context. For Proxmox guests, use format 'instance-VMID' (e.g., 'delly-150' where 'delly' is the PVE instance name and '150' is the VMID). For Docker, use format 'hostid:container:containerid'. Use the ID shown in the current context.",
+					},
+					"url": map[string]interface{}{
+						"type":        "string",
+						"description": "The discovered URL (e.g., 'http://192.168.1.50:8096' for Jellyfin). Use the IP/hostname and port you discovered.",
+					},
+				},
+				"required": []string{"resource_type", "resource_id", "url"},
+			},
+		},
+		{
+			Name:        "resolve_finding",
+			Description: "Mark an AI patrol finding as resolved after you have successfully fixed the underlying issue. Only use this after confirming the fix worked (e.g., by running a verification command). The finding ID is provided in your context when helping with a patrol finding.",
+			InputSchema: map[string]interface{}{
+				"type": "object",
+				"properties": map[string]interface{}{
+					"finding_id": map[string]interface{}{
+						"type":        "string",
+						"description": "The ID of the finding to resolve. Use the finding_id from the request context.",
+					},
+					"resolution_note": map[string]interface{}{
+						"type":        "string",
+						"description": "Brief description of how the issue was resolved (e.g., 'Restarted nginx service', 'Cleaned up disk space').",
+					},
+				},
+				"required": []string{"finding_id", "resolution_note"},
+			},
+		},
+	}
+
+	// Add web search tool for Anthropic provider
+	if s.provider != nil && s.provider.Name() == "anthropic" {
+		tools = append(tools, providers.Tool{
+			Type:    "web_search_20250305",
+			Name:    "web_search",
+			MaxUses: 3, // Limit searches per request to control costs
+		})
+	}
+
+	return tools
+}
+
+// executeTool executes a tool call and returns the result
+func (s *Service) executeTool(ctx context.Context, req ExecuteRequest, tc providers.ToolCall) (string, ToolExecution) {
+	execution := ToolExecution{
+		Name:    tc.Name,
+		Success: false,
+	}
+
+	switch tc.Name {
+	case "run_command":
+		command, _ := tc.Input["command"].(string)
+		runOnHost, _ := tc.Input["run_on_host"].(bool)
+		targetHost, _ := tc.Input["target_host"].(string)
+		execution.Input = command
+		if runOnHost && targetHost != "" {
+			execution.Input = fmt.Sprintf("[%s] %s", targetHost, command)
+		} else if runOnHost {
+			execution.Input = fmt.Sprintf("[host] %s", command)
+		}
+
+		if command == "" {
+			execution.Output = "Error: command is required"
+			return execution.Output, execution
+		}
+
+		// Enforce security policy.
+		// - Blocked commands are ALWAYS blocked (even in autonomous mode).
+		// - Approval-required commands only require approval when not in autonomous mode.
+		decision := s.policy.Evaluate(command)
+		if decision == agentexec.PolicyBlock {
+			execution.Output = formatPolicyBlockedToolResult(command, "This command is blocked by security policy")
+			return execution.Output, execution
+		}
+		if decision == agentexec.PolicyRequireApproval && !s.IsAutonomous() {
+			execution.Output = formatApprovalNeededToolResult(command, tc.ID, "Security policy requires approval")
+			execution.Success = true // Not an error, just needs approval
+			return execution.Output, execution
+		}
+
+		// Build execution request with proper targeting
+		execReq := req
+
+		// If target_host is explicitly specified by AI, use it for routing
+		if targetHost != "" {
+			// Ensure Context map exists
+			if execReq.Context == nil {
+				execReq.Context = make(map[string]interface{})
+			} else {
+				// Make a copy to avoid modifying the original
+				newContext := make(map[string]interface{})
+				for k, v := range req.Context {
+					newContext[k] = v
+				}
+				execReq.Context = newContext
+			}
+			// Set the node explicitly - this takes priority in routing
+			execReq.Context["node"] = targetHost
+			log.Debug().
+				Str("target_host", targetHost).
+				Str("command", command).
+				Msg("AI explicitly specified target_host for command routing")
+		}
+
+		// If run_on_host is true, override the target type to run on host
+		if runOnHost {
+			log.Debug().
+				Str("command", command).
+				Str("target_host", targetHost).
+				Str("original_target_type", req.TargetType).
+				Str("original_target_id", req.TargetID).
+				Msg("run_on_host=true - overriding target type to 'host'")
+			execReq.TargetType = "host"
+			execReq.TargetID = ""
+		} else {
+			log.Debug().
+				Str("command", command).
+				Str("target_type", req.TargetType).
+				Str("target_id", req.TargetID).
+				Bool("run_on_host", runOnHost).
+				Msg("Executing command with current target type")
+		}
+
+		// Execute via agent
+		result, err := s.executeOnAgent(ctx, execReq, command)
+		if err != nil {
+			execution.Output = fmt.Sprintf("Error executing command: %s", err)
+			return execution.Output, execution
+		}
+
+		execution.Output = result
+		execution.Success = true
+		return result, execution
+
+	case "fetch_url":
+		urlStr, _ := tc.Input["url"].(string)
+		execution.Input = urlStr
+
+		if urlStr == "" {
+			execution.Output = "Error: url is required"
+			return execution.Output, execution
+		}
+
+		// Fetch the URL
+		result, err := s.fetchURL(ctx, urlStr)
+		if err != nil {
+			execution.Output = fmt.Sprintf("Error fetching URL: %s", err)
+			return execution.Output, execution
+		}
+
+		execution.Output = result
+		execution.Success = true
+		return result, execution
+
+	case "set_resource_url":
+		resourceType, _ := tc.Input["resource_type"].(string)
+		resourceID, _ := tc.Input["resource_id"].(string)
+		url, _ := tc.Input["url"].(string)
+		execution.Input = fmt.Sprintf("%s %s -> %s", resourceType, resourceID, url)
+
+		if resourceType == "" {
+			execution.Output = "Error: resource_type is required (use 'guest', 'docker', or 'host')"
+			return execution.Output, execution
+		}
+		if resourceID == "" {
+			// Try to get the resource ID from the request context
+			if req.TargetID != "" {
+				resourceID = req.TargetID
+			} else {
+				execution.Output = "Error: resource_id is required"
+				return execution.Output, execution
+			}
+		}
+		if url == "" {
+			execution.Output = "Error: url is required"
+			return execution.Output, execution
+		}
+
+		// Update the metadata
+		if err := s.SetResourceURL(resourceType, resourceID, url); err != nil {
+			execution.Output = fmt.Sprintf("Error setting URL: %s", err)
+			return execution.Output, execution
+		}
+
+		execution.Output = fmt.Sprintf("✅ Successfully set URL for %s '%s' to: %s\nThe URL is now visible in the Pulse dashboard as a clickable link.", resourceType, resourceID, url)
+		execution.Success = true
+		return execution.Output, execution
+
+	case "resolve_finding":
+		findingID, _ := tc.Input["finding_id"].(string)
+		resolutionNote, _ := tc.Input["resolution_note"].(string)
+		execution.Input = fmt.Sprintf("finding: %s, note: %s", findingID, resolutionNote)
+
+		// If no finding ID provided by AI, check the request context
+		if findingID == "" {
+			findingID = req.FindingID
+		}
+
+		if findingID == "" {
+			execution.Output = "Error: finding_id is required. The finding ID should be provided in the request context when helping fix a patrol finding."
+			return execution.Output, execution
+		}
+
+		if resolutionNote == "" {
+			execution.Output = "Error: resolution_note is required. Please describe how the issue was resolved."
+			return execution.Output, execution
+		}
+
+		// Get the patrol service to resolve the finding
+		s.mu.RLock()
+		patrolService := s.patrolService
+		s.mu.RUnlock()
+
+		if patrolService == nil {
+			execution.Output = "Error: Patrol service not available"
+			return execution.Output, execution
+		}
+
+		// Resolve the finding
+		err := patrolService.ResolveFinding(findingID, resolutionNote)
+		if err != nil {
+			execution.Output = fmt.Sprintf("Error resolving finding: %s", err)
+			return execution.Output, execution
+		}
+
+		execution.Output = fmt.Sprintf("✅ Finding resolved! The AI Insight has been marked as fixed.\nID: %s\nResolution: %s", findingID, resolutionNote)
+		execution.Success = true
+		return execution.Output, execution
+
+	default:
+		execution.Output = fmt.Sprintf("Unknown tool: %s", tc.Name)
+		return execution.Output, execution
+	}
+}
+
+// getGuestID returns a unique identifier for the guest based on the request
+func (s *Service) getGuestID(req ExecuteRequest) string {
+	// Build a consistent guest ID from the target information
+	if req.TargetType == "" || req.TargetID == "" {
+		return ""
+	}
+
+	// For Proxmox targets, include the node info
+	// Format: instance-node-type-vmid or instance-targetid
+	return fmt.Sprintf("%s-%s", req.TargetType, req.TargetID)
+}
+
+// GetGuestKnowledge returns all knowledge for a guest
+func (s *Service) GetGuestKnowledge(guestID string) (*knowledge.GuestKnowledge, error) {
+	if s.knowledgeStore == nil {
+		return nil, fmt.Errorf("knowledge store not available")
+	}
+	return s.knowledgeStore.GetKnowledge(guestID)
+}
+
+// SaveGuestNote saves a note for a guest
+func (s *Service) SaveGuestNote(guestID, guestName, guestType, category, title, content string) error {
+	if s.knowledgeStore == nil {
+		return fmt.Errorf("knowledge store not available")
+	}
+	return s.knowledgeStore.SaveNote(guestID, guestName, guestType, category, title, content)
+}
+
+// DeleteGuestNote deletes a note from a guest
+func (s *Service) DeleteGuestNote(guestID, noteID string) error {
+	if s.knowledgeStore == nil {
+		return fmt.Errorf("knowledge store not available")
+	}
+	return s.knowledgeStore.DeleteNote(guestID, noteID)
+}
+
+// fetchURL fetches content from a URL with size limits and timeout
+func (s *Service) fetchURL(ctx context.Context, urlStr string) (string, error) {
+	parsedURL, err := parseAndValidateFetchURL(ctx, urlStr)
+	if err != nil {
+		return "", err
+	}
+
+	// Create HTTP client with timeout
+	client := &http.Client{
+		Timeout: 30 * time.Second,
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= 3 {
+				return fmt.Errorf("too many redirects")
+			}
+			if _, err := parseAndValidateFetchURL(ctx, req.URL.String()); err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+
+	// Create request with context
+	req, err := http.NewRequestWithContext(ctx, "GET", parsedURL.String(), nil)
+	if err != nil {
+		return "", fmt.Errorf("invalid URL: %w", err)
+	}
+
+	// Set a reasonable user agent
+	req.Header.Set("User-Agent", "Pulse-AI/1.0")
+
+	// Make the request
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	// Read response with size limit (64KB)
+	const maxSize = 64 * 1024
+	limitedReader := io.LimitReader(resp.Body, maxSize)
+	body, err := io.ReadAll(limitedReader)
+	if err != nil {
+		return "", fmt.Errorf("failed to read response: %w", err)
+	}
+
+	// Build result with status info
+	result := fmt.Sprintf("HTTP %d %s\n", resp.StatusCode, resp.Status)
+	result += fmt.Sprintf("Content-Type: %s\n", resp.Header.Get("Content-Type"))
+	result += fmt.Sprintf("Content-Length: %d bytes\n\n", len(body))
+	result += string(body)
+
+	if len(body) == maxSize {
+		result += "\n\n[Response truncated at 64KB]"
+	}
+
+	return result, nil
+}
+
+func parseAndValidateFetchURL(ctx context.Context, urlStr string) (*url.URL, error) {
+	clean := strings.TrimSpace(urlStr)
+	if clean == "" {
+		return nil, fmt.Errorf("url is required")
+	}
+
+	parsed, err := url.ParseRequestURI(clean)
+	if err != nil {
+		return nil, fmt.Errorf("invalid URL: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, fmt.Errorf("only http/https URLs are allowed")
+	}
+	if parsed.User != nil {
+		return nil, fmt.Errorf("URLs with embedded credentials are not allowed")
+	}
+	if parsed.Fragment != "" {
+		return nil, fmt.Errorf("URL fragments are not allowed")
+	}
+
+	host := parsed.Hostname()
+	if host == "" {
+		return nil, fmt.Errorf("URL must include a host")
+	}
+
+	if isBlockedFetchHost(host) {
+		return nil, fmt.Errorf("URL host is blocked")
+	}
+
+	if ip := net.ParseIP(host); ip != nil {
+		if isBlockedFetchIP(ip) {
+			return nil, fmt.Errorf("URL IP is blocked")
+		}
+		return parsed, nil
+	}
+
+	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, host)
+	if err != nil {
+		// DNS failures are surfaced directly to the caller.
+		return nil, fmt.Errorf("failed to resolve host: %w", err)
+	}
+	for _, addr := range addrs {
+		if isBlockedFetchIP(addr.IP) {
+			return nil, fmt.Errorf("URL host resolves to a blocked address")
+		}
+	}
+
+	return parsed, nil
+}
+
+func isBlockedFetchHost(host string) bool {
+	h := strings.TrimSpace(strings.ToLower(host))
+	if h == "localhost" || h == "localhost." {
+		return true
+	}
+	return false
+}
+
+func isBlockedFetchIP(ip net.IP) bool {
+	if ip == nil {
+		return true
+	}
+	if ip.IsLoopback() || ip.IsUnspecified() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
+		return true
+	}
+	// Block multicast and other non-unicast targets.
+	if !ip.IsGlobalUnicast() && !ip.IsPrivate() {
+		return true
+	}
+	return false
+}
+
+// sanitizeError cleans up error messages to remove internal networking details
+// that are not helpful to users or AI models (IP addresses, port numbers, etc.)
+func sanitizeError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	errMsg := err.Error()
+
+	// Replace raw TCP connection details with generic message
+	// e.g., "write tcp 192.168.0.123:7655->192.168.0.134:58004: i/o timeout"
+	// becomes "connection to agent timed out"
+	if strings.Contains(errMsg, "i/o timeout") {
+		if strings.Contains(errMsg, "failed to send command") {
+			return fmt.Errorf("connection to agent timed out - the agent may be disconnected or unreachable")
+		}
+		return fmt.Errorf("network timeout - the target may be unreachable")
+	}
+
+	// Replace "write tcp ... connection refused" style errors
+	if strings.Contains(errMsg, "connection refused") {
+		return fmt.Errorf("connection refused - the agent may not be running on the target host")
+	}
+
+	// Replace "no such host" errors
+	if strings.Contains(errMsg, "no such host") {
+		return fmt.Errorf("host not found - verify the hostname is correct and DNS is working")
+	}
+
+	// Replace "context deadline exceeded" with friendlier message
+	if strings.Contains(errMsg, "context deadline exceeded") {
+		return fmt.Errorf("operation timed out - the command may have taken too long")
+	}
+
+	return err
+}
+
+// executeOnAgent executes a command via the agent WebSocket
+func (s *Service) executeOnAgent(ctx context.Context, req ExecuteRequest, command string) (string, error) {
+	if s.agentServer == nil {
+		return "", fmt.Errorf("agent server not available")
+	}
+
+	// Find the appropriate agent using robust routing
+	agents := s.agentServer.GetConnectedAgents()
+
+	// Use the new robust routing logic
+	routeResult, err := s.routeToAgent(req, command, agents)
+	if err != nil {
+		// Check if this is a routing error that should ask for clarification
+		if routingErr, ok := err.(*RoutingError); ok && routingErr.AskForClarification {
+			// Return a message that encourages the AI to ask the user for clarification
+			// instead of just failing with an error
+			return routingErr.ForAI(), nil
+		}
+		// Return actionable error message for other errors
+		return "", err
+	}
+
+	// Log any warnings from routing
+	for _, warning := range routeResult.Warnings {
+		log.Warn().Str("warning", warning).Msg("Routing warning")
+	}
+
+	agentID := routeResult.AgentID
+
+	log.Debug().
+		Str("agent_id", agentID).
+		Str("agent_hostname", routeResult.AgentHostname).
+		Str("target_node", routeResult.TargetNode).
+		Str("routing_method", routeResult.RoutingMethod).
+		Bool("cluster_peer", routeResult.ClusterPeer).
+		Msg("Command routed to agent")
+
+	// Extract numeric VMID from target ID (e.g., "delly-135" -> "135")
+	targetID := req.TargetID
+	if req.TargetType == "container" || req.TargetType == "vm" {
+		// Look for vmid in context first
+		if vmid, ok := req.Context["vmid"]; ok {
+			switch v := vmid.(type) {
+			case float64:
+				targetID = fmt.Sprintf("%.0f", v)
+			case int:
+				targetID = fmt.Sprintf("%d", v)
+			case string:
+				targetID = v
+			}
+		} else if req.TargetID != "" {
+			// Extract number from end of ID like "delly-135" or "instance-135"
+			parts := strings.Split(req.TargetID, "-")
+			if len(parts) > 0 {
+				lastPart := parts[len(parts)-1]
+				// Check if it's numeric
+				if _, err := fmt.Sscanf(lastPart, "%d", new(int)); err == nil {
+					targetID = lastPart
+				}
+			}
+		}
+	}
+
+	requestID := uuid.New().String()
+
+	// Automatically force non-interactive mode for package managers
+	// This prevents hanging when apt/dpkg asks for confirmation or configuration
+	if strings.Contains(command, "apt") || strings.Contains(command, "dpkg") {
+		if !strings.Contains(command, "DEBIAN_FRONTEND=") {
+			command = "export DEBIAN_FRONTEND=noninteractive; " + command
+		}
+	}
+
+	cmd := agentexec.ExecuteCommandPayload{
+		RequestID:  requestID,
+		Command:    command,
+		TargetType: req.TargetType,
+		TargetID:   targetID,
+		Timeout:    300, // 5 minutes - commands like du, backups, etc. can take a while
+	}
+
+	result, err := s.agentServer.ExecuteCommand(ctx, agentID, cmd)
+	if err != nil {
+		return "", sanitizeError(err)
+	}
+
+	if !result.Success {
+		if result.Error != "" {
+			return "", fmt.Errorf("%s", result.Error)
+		}
+		if result.Stderr != "" {
+			return result.Stderr, nil // Return stderr as output, not error
+		}
+	}
+
+	output := result.Stdout
+	if result.Stderr != "" && result.Stdout != "" {
+		output = fmt.Sprintf("%s\n\nSTDERR:\n%s", result.Stdout, result.Stderr)
+	} else if result.Stderr != "" {
+		output = result.Stderr
+	}
+
+	return output, nil
+}
+
+// RunCommandRequest represents a request to run a single command
+type RunCommandRequest struct {
+	Command    string `json:"command"`
+	TargetType string `json:"target_type"` // "host", "container", "vm"
+	TargetID   string `json:"target_id"`
+	RunOnHost  bool   `json:"run_on_host"` // If true, run on host instead of target
+	VMID       string `json:"vmid,omitempty"`
+	TargetHost string `json:"target_host,omitempty"` // Explicit host for routing
+}
+
+// RunCommandResponse represents the result of running a command
+type RunCommandResponse struct {
+	Output  string `json:"output"`
+	Success bool   `json:"success"`
+	Error   string `json:"error,omitempty"`
+}
+
+// RunCommand executes a single command via the agent (used for approved commands)
+func (s *Service) RunCommand(ctx context.Context, req RunCommandRequest) (*RunCommandResponse, error) {
+	if s.agentServer == nil {
+		return &RunCommandResponse{Success: false, Error: "Agent server not available"}, nil
+	}
+
+	// Build an ExecuteRequest from the RunCommandRequest
+	execReq := ExecuteRequest{
+		TargetType: req.TargetType,
+		TargetID:   req.TargetID,
+		Context:    make(map[string]interface{}),
+	}
+
+	// If running on host, override target type
+	if req.RunOnHost {
+		execReq.TargetType = "host"
+		// Keep the original target info for routing
+	}
+
+	// Add VMID to context if provided
+	if req.VMID != "" {
+		execReq.Context["vmid"] = req.VMID
+	}
+
+	// If target_host is specified, set it in context for routing
+	if req.TargetHost != "" {
+		execReq.Context["node"] = req.TargetHost
+		log.Debug().
+			Str("target_host", req.TargetHost).
+			Str("command", req.Command).
+			Msg("RunCommand using explicit target_host for routing")
+	}
+
+	output, err := s.executeOnAgent(ctx, execReq, req.Command)
+	if err != nil {
+		return &RunCommandResponse{
+			Success: false,
+			Error:   err.Error(),
+			Output:  output,
+		}, nil
+	}
+
+	return &RunCommandResponse{
+		Success: true,
+		Output:  output,
+	}, nil
+}
+
+// buildSystemPrompt creates the system prompt based on the request context
+func (s *Service) buildSystemPrompt(req ExecuteRequest) string {
+	prompt := `You are Pulse's diagnostic assistant - a built-in tool for investigating Proxmox and Docker homelab issues.
+
+## Response Style
+- Be DIRECT and CONCISE. No greetings, no "I'll help you", no "Let me check"
+- Report findings, not process. Don't narrate what you're doing
+- NO emojis, NO markdown tables, NO excessive formatting
+- Use simple lists only when showing multiple items
+- Final response should be 2-4 sentences summarizing findings and any actions taken
+- When you perform cleanup/fixes, report: what was done + the result (e.g., "Freed 6GB. Disk now at 81%.")
+
+## When Investigating
+- Execute commands silently in the background
+- Only show the conclusion, not every command run
+- If something fails, briefly state what and why
+
+## Command Approval System
+Pulse has a command approval policy that protects against accidental damage:
+- **Safe commands** (read-only: ls, df, cat, ps, etc.) execute immediately
+- **Potentially destructive commands** (rm, service restart, apt install, etc.) require approval unless autonomous mode is enabled
+- **Blocked commands** are never executed
+- When approval is required, the user will see the command and can approve or reject it
+
+When you need to run a potentially destructive command:
+1. Execute it normally - Pulse will handle the approval flow
+2. If a command is blocked or needs approval, you'll get feedback
+3. Continue with other work while waiting for approval, or explain what the command will do
+
+Do NOT say things like:
+- "I need your permission to..."
+- "Would you like me to run...?"
+- "This is destructive, are you sure?"
+
+Instead, just execute the command. Pulse's approval system will handle user confirmation for risky operations.
+
+## Response Format
+BAD: "I'll check that for you. Let me run some commands..."
+GOOD: State findings directly.
+
+BAD: "Would you like me to run rm -rf...?"
+GOOD: Execute the command. User will approve/reject via Pulse.
+
+BAD: Tables, headers, bullet-heavy summaries
+GOOD: Plain prose, 2-4 sentences.
+
+## ACTION BIAS - AVOID INVESTIGATION LOOPS
+When the user asks you to DO something (install, fix, update, configure), ACT IMMEDIATELY:
+- Don't extensively investigate before acting. Run 1-2 diagnostic commands max, then DO the thing.
+- Don't explain what you're about to do - just do it.
+- If the command needs approval, Pulse will queue it. You don't need to ask separately.
+- If the first approach fails, try the next most obvious approach. Don't stop to report.
+- Complete the task END TO END. If asked to "install and run X", you're not done until X is running.
+
+INVESTIGATION ANTI-PATTERNS TO AVOID:
+- Running 10+ diagnostic commands before taking action
+- Explaining each step before doing it
+- Stopping to report partial progress
+- Asking "would you like me to proceed?" (Pulse handles approval automatically)
+- Checking version, checking config, checking service, checking ports, checking this, checking that... JUST ACT.
+
+GOOD PATTERN for "install X and make sure it's running":
+1. Download/install X (1 command)
+2. Start X (1 command)  
+3. Verify X is running (1 command)
+4. Report: "Installed X vN.N. Service is running on port NNNN."
+
+BAD PATTERN:
+1. Check current version... 2. Check if installed... 3. Check service status... 4. Check config file... 
+5. Check another config... 6. Try to enable something... 7. Check if it worked... 8. Read a script...
+9. Check yet another file... [user: "do it"] 10. Still investigating... [user: "DO IT"]
+
+
+## Using Context Data
+Pulse provides real metrics in "Current Metrics and State". Use this data directly - don't ask users to check things you already know.
+
+## Command Execution
+- run_on_host=true: Run on PVE/Docker host (pct, qm, vzdump, docker commands)
+- run_on_host=false: Run inside the container/VM
+- target_host: ALWAYS set this when using run_on_host=true! Use the node/hostname from target context
+- Execute commands to investigate, don't just explain what commands to run
+
+## CRITICAL: Command Routing with target_host
+When running commands that require a specific host (pct, qm, docker, vzdump), you MUST specify target_host to route correctly.
+
+Example for LXC 106 on node 'minipc':
+- To run 'df -h' inside the container: run_command(command="df -h", run_on_host=false)
+- To run 'pct exec 106 -- df -h' on the host: run_command(command="pct exec 106 -- df -h", run_on_host=true, target_host="minipc")
+
+Always check the target's context for the 'node' or 'PVE Node' field and pass it as target_host.
+If you don't specify target_host when run_on_host=true, the command may route to the wrong host!
+
+Rules:
+1. Look at the target context for 'node', 'guest_node', or 'PVE Node' field
+2. When running pct/qm commands: set run_on_host=true AND target_host=<node>
+3. When running commands inside the guest: just set run_on_host=false (no target_host needed)
+4. Error "Configuration file does not exist" means wrong host - check target_host
+
+## Infrastructure Architecture - LXC Management
+Pulse manages LXC containers agentlessly from the PVE host.
+- DO NOT check for a Pulse agent process or service inside an LXC. It does not exist.
+- Use run_command with run_on_host=false to execute commands inside the LXC. Pulse handles the routing.
+- For pct commands, always use run_on_host=true and set target_host to the container's node.
+
+## URL Discovery Feature
+When asked to find the web URL for a guest/container/host, or when you discover a web service:
+
+1. **Inspect for web servers**: Check for listening ports (ss -tlnp), running services (nginx, apache, node, etc.)
+2. **Get the IP address**: Use 'hostname -I' or 'ip addr' to find the IP
+3. **Test the URL**: Use fetch_url to verify the service is responding
+4. **Save the URL**: Use set_resource_url tool to save it to Pulse
+
+Common discovery commands:
+- Check listening ports: ss -tlnp | grep LISTEN
+- Check nginx: systemctl status nginx && grep -r 'listen' /etc/nginx/
+- Check running processes: ps aux | grep -E 'node|python|java|nginx|apache|httpd'
+- Get IP: hostname -I | awk '{print $1}'
+
+When you find a web service and are confident, use set_resource_url to save it. The resource_id should match the ID from the current context.
+
+## Installing/Updating Pulse Itself
+If asked to install or update Pulse itself, use the official install script. DO NOT investigate configs/services first.
+Quick install/update command (x86_64 Linux):
+` + "`" + `curl -sSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash` + "`" + `
+
+To install a specific version: 
+` + "`" + `curl -sSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version vX.Y.Z` + "`" + `
+
+After install, enable and start the service:
+` + "`" + `systemctl enable pulse && systemctl start pulse` + "`" + `
+
+The latest version can be found at: https://api.github.com/repos/rcourtman/Pulse/releases/latest
+This is a 3-command job. Don't over-investigate.`
+
+	// Add custom context from AI settings (user's infrastructure description)
+	s.mu.RLock()
+	cfg := s.cfg
+	s.mu.RUnlock()
+	if cfg != nil && cfg.CustomContext != "" {
+		prompt += "\n\n## User's Infrastructure Description\n"
+		prompt += "The user has provided this context about their infrastructure:\n\n"
+		prompt += cfg.CustomContext
+	}
+
+	// Add connected infrastructure info via unified resource model
+	s.mu.RLock()
+	hasResourceProvider := s.resourceProvider != nil
+	s.mu.RUnlock()
+
+	if hasResourceProvider {
+		prompt += s.buildUnifiedResourceContext()
+	} else {
+		log.Warn().Msg("AI context: resource provider not available, infrastructure context will be limited")
+	}
+
+	// Add user annotations from all resources (global context)
+	prompt += s.buildUserAnnotationsContext()
+
+	// Add current alert status - this gives AI awareness of active issues
+	prompt += s.buildAlertContext()
+
+	// Add all saved knowledge when no specific target is selected
+	// This gives the AI context about everything learned from previous sessions
+	if req.TargetType == "" && s.knowledgeStore != nil {
+		prompt += s.knowledgeStore.FormatAllForContext()
+	}
+
+	// Add target context if provided
+	if req.TargetType != "" {
+		guestName := ""
+		if name, ok := req.Context["guestName"].(string); ok {
+			guestName = name
+		} else if name, ok := req.Context["name"].(string); ok {
+			guestName = name
+		}
+
+		if guestName != "" {
+			// Include the node in the focus header so AI can't miss it for routing
+			nodeName := ""
+			if node, ok := req.Context["node"].(string); ok && node != "" {
+				nodeName = node
+			} else if node, ok := req.Context["guest_node"].(string); ok && node != "" {
+				nodeName = node
+			}
+			if nodeName != "" {
+				prompt += fmt.Sprintf("\n\n## Current Focus\nYou are analyzing **%s** (%s on node **%s**)\n**ROUTING: When using run_on_host=true, set target_host=\"%s\"**",
+					guestName, req.TargetType, nodeName, nodeName)
+			} else {
+				prompt += fmt.Sprintf("\n\n## Current Focus\nYou are analyzing **%s** (%s)", guestName, req.TargetType)
+			}
+		} else if req.TargetID != "" {
+			prompt += fmt.Sprintf("\n\n## Current Focus\nYou are analyzing %s '%s'", req.TargetType, req.TargetID)
+		}
+
+		// Add past remediation history for this resource
+		prompt += s.buildRemediationContext(req.TargetID, req.Prompt)
+	}
+
+	// Add any provided context in a structured way
+	if len(req.Context) > 0 {
+		prompt += "\n\n## Current Metrics and State"
+
+		// Group metrics by category for better readability
+		categories := map[string][]string{
+			"Identity":     {"name", "guestName", "type", "vmid", "node", "guest_node", "status", "uptime"},
+			"CPU":          {"cpu_usage", "cpu_cores"},
+			"Memory":       {"memory_used", "memory_total", "memory_usage", "memory_balloon", "swap_used", "swap_total"},
+			"Disk":         {"disk_used", "disk_total", "disk_usage"},
+			"I/O Rates":    {"disk_read_rate", "disk_write_rate", "network_in_rate", "network_out_rate"},
+			"Backup":       {"backup_status", "last_backup", "days_since_backup"},
+			"System Info":  {"os_name", "os_version", "guest_agent", "ip_addresses", "tags"},
+			"User Context": {"user_notes", "user_annotations"},
+		}
+
+		categoryOrder := []string{"Identity", "User Context", "Backup", "CPU", "Memory", "Disk", "I/O Rates", "System Info"}
+
+		for _, category := range categoryOrder {
+			keys := categories[category]
+			hasValues := false
+			categoryContent := ""
+
+			for _, k := range keys {
+				if v, ok := req.Context[k]; ok && v != nil && v != "" {
+					if !hasValues {
+						categoryContent = fmt.Sprintf("\n### %s", category)
+						hasValues = true
+					}
+					categoryContent += fmt.Sprintf("\n- %s: %v", formatContextKey(k), v)
+				}
+			}
+
+			if hasValues {
+				prompt += categoryContent
+			}
+		}
+
+		// Add any remaining context that wasn't categorized
+		for k, v := range req.Context {
+			found := false
+			for _, keys := range categories {
+				for _, key := range keys {
+					if k == key {
+						found = true
+						break
+					}
+				}
+				if found {
+					break
+				}
+			}
+			if !found && v != nil && v != "" {
+				prompt += fmt.Sprintf("\n- %s: %v", formatContextKey(k), v)
+			}
+		}
+	}
+
+	return prompt
+}
+
+// formatContextKey converts snake_case keys to readable labels
+func formatContextKey(key string) string {
+	replacements := map[string]string{
+		"guestName":         "Guest Name",
+		"name":              "Name",
+		"type":              "Type",
+		"vmid":              "VMID",
+		"node":              "PVE Node (host)",
+		"guest_node":        "PVE Node (host)",
+		"status":            "Status",
+		"uptime":            "Uptime",
+		"cpu_usage":         "CPU Usage",
+		"cpu_cores":         "CPU Cores",
+		"memory_used":       "Memory Used",
+		"memory_total":      "Memory Total",
+		"memory_usage":      "Memory Usage",
+		"memory_balloon":    "Memory Balloon",
+		"swap_used":         "Swap Used",
+		"swap_total":        "Swap Total",
+		"disk_used":         "Disk Used",
+		"disk_total":        "Disk Total",
+		"disk_usage":        "Disk Usage",
+		"disk_read_rate":    "Disk Read Rate",
+		"disk_write_rate":   "Disk Write Rate",
+		"network_in_rate":   "Network In Rate",
+		"network_out_rate":  "Network Out Rate",
+		"backup_status":     "Backup Status",
+		"last_backup":       "Last Backup",
+		"days_since_backup": "Days Since Backup",
+		"os_name":           "OS Name",
+		"os_version":        "OS Version",
+		"guest_agent":       "Guest Agent",
+		"ip_addresses":      "IP Addresses",
+		"tags":              "Tags",
+		"user_notes":        "User Notes",
+		"user_annotations":  "User Annotations",
+	}
+
+	if label, ok := replacements[key]; ok {
+		return label
+	}
+	return key
+}
+
+// buildUserAnnotationsContext gathers all user annotations from guests and docker containers
+// These provide infrastructure context that the AI should know about for any query
+func (s *Service) buildUserAnnotationsContext() string {
+	var annotations []string
+
+	// Load guest metadata
+	guestMeta, err := s.persistence.LoadGuestMetadata()
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to load guest metadata for AI context")
+	} else {
+		log.Debug().Int("count", len(guestMeta)).Msg("Loaded guest metadata for AI context")
+		for id, meta := range guestMeta {
+			if meta != nil && len(meta.Notes) > 0 {
+				// Use LastKnownName if available, otherwise use ID
+				name := meta.LastKnownName
+				if name == "" {
+					name = id
+				}
+				for _, note := range meta.Notes {
+					annotations = append(annotations, fmt.Sprintf("- Guest '%s': %s", name, note))
+				}
+			}
+		}
+	}
+
+	// Load docker metadata - include host info for context
+	dockerMeta, err := s.persistence.LoadDockerMetadata()
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to load docker metadata for AI context")
+	} else {
+		log.Debug().Int("count", len(dockerMeta)).Msg("Loaded docker metadata for AI context")
+		for id, meta := range dockerMeta {
+			if meta != nil && len(meta.Notes) > 0 {
+				// Extract host and container info from ID (format: hostid:container:containerid)
+				name := id
+				hostInfo := ""
+				parts := strings.Split(id, ":")
+				if len(parts) >= 3 {
+					hostInfo = parts[0] // First part is the host identifier
+					containerID := parts[2]
+					if len(containerID) > 12 {
+						containerID = containerID[:12]
+					}
+					name = fmt.Sprintf("Docker container %s", containerID)
+				}
+				log.Debug().Str("name", name).Str("host", hostInfo).Int("notes", len(meta.Notes)).Msg("Found docker container with annotations")
+				for _, note := range meta.Notes {
+					if hostInfo != "" {
+						annotations = append(annotations, fmt.Sprintf("- %s (on host '%s'): %s", name, hostInfo, note))
+					} else {
+						annotations = append(annotations, fmt.Sprintf("- %s: %s", name, note))
+					}
+				}
+			}
+		}
+	}
+
+	log.Debug().Int("total_annotations", len(annotations)).Msg("Built user annotations context")
+
+	if len(annotations) == 0 {
+		return ""
+	}
+
+	return "\n\n## User Infrastructure Notes\nThe user has added these annotations to describe their infrastructure. USE THESE to understand relationships between systems:\n" + strings.Join(annotations, "\n")
+}
+
+// TestConnection tests the AI provider connection
+// Tests the provider for the currently configured default model
+func (s *Service) TestConnection(ctx context.Context) error {
+	s.mu.RLock()
+	cfg := s.cfg
+	defaultProvider := s.provider
+	s.mu.RUnlock()
+
+	// Load config if not available
+	if cfg == nil {
+		var err error
+		cfg, err = s.persistence.LoadAIConfig()
+		if err != nil {
+			return fmt.Errorf("failed to load AI config: %w", err)
+		}
+	}
+
+	if cfg == nil || !cfg.IsConfigured() {
+		return fmt.Errorf("no AI provider configured")
+	}
+
+	// Try to create a provider for the current default model
+	provider, err := providers.NewForModel(cfg, cfg.GetModel())
+	if err != nil {
+		// Fall back to default provider or NewFromConfig
+		log.Debug().Err(err).Str("model", cfg.GetModel()).Msg("Could not create provider for model, using fallback")
+		if defaultProvider != nil {
+			provider = defaultProvider
+		} else {
+			provider, err = providers.NewFromConfig(cfg)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return provider.TestConnection(ctx)
+}
+
+// ListModels fetches available models from ALL configured AI providers
+// Returns a unified list with models prefixed by provider name
+func (s *Service) ListModels(ctx context.Context) ([]providers.ModelInfo, error) {
+	models, _, err := s.ListModelsWithCache(ctx)
+	return models, err
+}
+
+func (s *Service) ListModelsWithCache(ctx context.Context) ([]providers.ModelInfo, bool, error) {
+	cfg, err := s.persistence.LoadAIConfig()
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to load AI config: %w", err)
+	}
+	if cfg == nil {
+		return nil, false, fmt.Errorf("AI not configured")
+	}
+
+	cacheKey := buildModelsCacheKey(cfg)
+	s.modelsCache.mu.RLock()
+	if s.modelsCache.key == cacheKey && s.modelsCache.ttl > 0 && time.Since(s.modelsCache.at) < s.modelsCache.ttl && len(s.modelsCache.models) > 0 {
+		out := make([]providers.ModelInfo, len(s.modelsCache.models))
+		copy(out, s.modelsCache.models)
+		s.modelsCache.mu.RUnlock()
+		return out, true, nil
+	}
+	s.modelsCache.mu.RUnlock()
+
+	var allModels []providers.ModelInfo
+
+	// Query each configured provider
+	providersList := []string{config.AIProviderAnthropic, config.AIProviderOpenAI, config.AIProviderDeepSeek, config.AIProviderOllama}
+
+	for _, providerName := range providersList {
+		if !cfg.HasProvider(providerName) {
+			continue
+		}
+
+		// Create provider for this specific provider
+		provider, err := providers.NewForProvider(cfg, providerName, "")
+		if err != nil {
+			log.Debug().Err(err).Str("provider", providerName).Msg("Skipping provider - not configured")
+			continue
+		}
+
+		// Fetch models from this provider
+		models, err := provider.ListModels(ctx)
+		if err != nil {
+			log.Warn().Err(err).Str("provider", providerName).Msg("Failed to fetch models from provider")
+			continue
+		}
+
+		// Add provider prefix to each model
+		for _, m := range models {
+			allModels = append(allModels, providers.ModelInfo{
+				ID:          config.FormatModelString(providerName, m.ID),
+				Name:        m.Name,
+				Description: providerDisplayName(providerName) + ": " + m.ID,
+				CreatedAt:   m.CreatedAt,
+			})
+		}
+	}
+
+	s.modelsCache.mu.Lock()
+	s.modelsCache.key = cacheKey
+	s.modelsCache.at = time.Now()
+	s.modelsCache.models = make([]providers.ModelInfo, len(allModels))
+	copy(s.modelsCache.models, allModels)
+	s.modelsCache.mu.Unlock()
+
+	return allModels, false, nil
+}
+
+func buildModelsCacheKey(cfg *config.AIConfig) string {
+	if cfg == nil {
+		return "nil"
+	}
+
+	var b strings.Builder
+	b.WriteString("providers=")
+	b.WriteString(strings.Join(cfg.GetConfiguredProviders(), ","))
+	b.WriteString("|auth=")
+	b.WriteString(string(cfg.AuthMethod))
+
+	b.WriteString("|openai_base=")
+	b.WriteString(cfg.OpenAIBaseURL)
+	b.WriteString("|ollama_base=")
+	b.WriteString(cfg.OllamaBaseURL)
+
+	return b.String()
+}
+
+// providerDisplayName returns a user-friendly name for a provider
+func providerDisplayName(provider string) string {
+	switch provider {
+	case config.AIProviderAnthropic:
+		return "Anthropic"
+	case config.AIProviderOpenAI:
+		return "OpenAI"
+	case config.AIProviderDeepSeek:
+		return "DeepSeek"
+	case config.AIProviderOllama:
+		return "Ollama"
+	default:
+		return provider
+	}
+}
+
+// Reload reloads the AI configuration (call after settings change)
+func (s *Service) Reload() error {
+	return s.LoadConfig()
+}
+
+// buildRemediationContext adds past remediation history to help AI learn from previous fixes
+func (s *Service) buildRemediationContext(resourceID, currentProblem string) string {
+	s.mu.RLock()
+	patrol := s.patrolService
+	s.mu.RUnlock()
+
+	if patrol == nil {
+		return ""
+	}
+
+	remLog := patrol.GetRemediationLog()
+	if remLog == nil {
+		return ""
+	}
+
+	var context string
+
+	// Get similar past remediations based on the current problem
+	if currentProblem != "" {
+		successful := remLog.GetSuccessfulRemediations(currentProblem, 3)
+		if len(successful) > 0 {
+			context += "\n\n## Past Successful Fixes for Similar Issues\n"
+			context += "These actions worked for similar problems before:\n"
+			for _, rec := range successful {
+				context += fmt.Sprintf("- **%s**: `%s` (%s)\n",
+					truncateString(rec.Problem, 60),
+					truncateString(rec.Action, 80),
+					rec.Outcome)
+			}
+		}
+	}
+
+	// Get history for this specific resource
+	if resourceID != "" {
+		history := remLog.GetForResource(resourceID, 5)
+		if len(history) > 0 {
+			context += "\n\n## Remediation History for This Resource\n"
+			for _, rec := range history {
+				ago := time.Since(rec.Timestamp)
+				agoStr := formatDuration(ago)
+				context += fmt.Sprintf("- %s ago: %s → `%s` (%s)\n",
+					agoStr,
+					truncateString(rec.Problem, 50),
+					truncateString(rec.Action, 60),
+					rec.Outcome)
+			}
+		}
+	}
+
+	return context
+}
+
+// truncateString truncates a string to maxLen characters
+func truncateString(s string, maxLen int) string {
+	if len(s) <= maxLen {
+		return s
+	}
+	return s[:maxLen-3] + "..."
+}
diff --git a/internal/ai/target_host_test.go b/internal/ai/target_host_test.go
new file mode 100644
index 0000000..cd9ef11
--- /dev/null
+++ b/internal/ai/target_host_test.go
@@ -0,0 +1,187 @@
+package ai
+
+import (
+	"testing"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+)
+
+// TestRouteToAgent_TargetHostExplicit tests that explicit target_host in context
+// takes priority for routing decisions
+func TestRouteToAgent_TargetHostExplicit(t *testing.T) {
+	s := &Service{}
+
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+		{AgentID: "agent-2", Hostname: "minipc"},
+		{AgentID: "agent-3", Hostname: "pimox"},
+	}
+
+	tests := []struct {
+		name            string
+		req             ExecuteRequest
+		command         string
+		wantAgentID     string
+		wantHostname    string
+		wantMethod      string
+	}{
+		{
+			name: "explicit node in context routes correctly",
+			req: ExecuteRequest{
+				TargetType: "host", // run_on_host=true sets this
+				TargetID:   "",     // run_on_host clears this
+				Context:    map[string]interface{}{"node": "minipc"},
+			},
+			command:      "pct exec 106 -- hostname",
+			wantAgentID:  "agent-2",
+			wantHostname: "minipc",
+			wantMethod:   "context_node",
+		},
+		{
+			name: "guest_node also routes correctly for host commands",
+			req: ExecuteRequest{
+				TargetType: "host",
+				TargetID:   "",
+				Context:    map[string]interface{}{"guest_node": "pimox"},
+			},
+			command:      "qm guest exec 100 hostname",
+			wantAgentID:  "agent-3",
+			wantHostname: "pimox",
+			wantMethod:   "context_guest_node",
+		},
+		{
+			name: "node takes priority over guest_node",
+			req: ExecuteRequest{
+				TargetType: "host",
+				TargetID:   "",
+				Context: map[string]interface{}{
+					"node":       "delly",
+					"guest_node": "minipc", // Should be ignored when node is set
+				},
+			},
+			command:      "uptime",
+			wantAgentID:  "agent-1",
+			wantHostname: "delly",
+			wantMethod:   "context_node",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := s.routeToAgent(tt.req, tt.command, agents)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if result.AgentID != tt.wantAgentID {
+				t.Errorf("AgentID = %q, want %q", result.AgentID, tt.wantAgentID)
+			}
+
+			if result.AgentHostname != tt.wantHostname {
+				t.Errorf("AgentHostname = %q, want %q", result.AgentHostname, tt.wantHostname)
+			}
+
+			if result.RoutingMethod != tt.wantMethod {
+				t.Errorf("RoutingMethod = %q, want %q", result.RoutingMethod, tt.wantMethod)
+			}
+		})
+	}
+}
+
+// TestRouteToAgent_SingleAgentFallback tests that with only one agent,
+// we fall back to it with a warning
+func TestRouteToAgent_SingleAgentFallback(t *testing.T) {
+	s := &Service{}
+
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+	}
+
+	req := ExecuteRequest{
+		TargetType: "host",
+		TargetID:   "",
+		Context:    nil, // No context at all
+	}
+
+	result, err := s.routeToAgent(req, "uptime", agents)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if result.AgentID != "agent-1" {
+		t.Errorf("AgentID = %q, want %q", result.AgentID, "agent-1")
+	}
+
+	if result.RoutingMethod != "single_agent_fallback" {
+		t.Errorf("RoutingMethod = %q, want %q", result.RoutingMethod, "single_agent_fallback")
+	}
+
+	// Should have a warning about the fallback
+	if len(result.Warnings) == 0 {
+		t.Error("expected warning about fallback routing")
+	}
+}
+
+// TestRouteToAgent_MultiAgentNoContext tests that with multiple agents
+// and no context, we get a clear error
+func TestRouteToAgent_MultiAgentNoContext(t *testing.T) {
+	s := &Service{}
+
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+		{AgentID: "agent-2", Hostname: "minipc"},
+	}
+
+	req := ExecuteRequest{
+		TargetType: "host",
+		TargetID:   "",
+		Context:    nil, // No context
+	}
+
+	_, err := s.routeToAgent(req, "uptime", agents)
+	if err == nil {
+		t.Fatal("expected error when no context with multiple agents")
+	}
+
+	routingErr, ok := err.(*RoutingError)
+	if !ok {
+		t.Fatalf("expected RoutingError, got %T", err)
+	}
+
+	// Should mention target_host in the suggestion
+	if routingErr.Suggestion == "" {
+		t.Error("expected suggestion in error")
+	}
+
+	// Should list available agents
+	if len(routingErr.AvailableAgents) != 2 {
+		t.Errorf("expected 2 available agents, got %d", len(routingErr.AvailableAgents))
+	}
+}
+
+// TestRouteToAgent_VMIDRoutingWithContext tests that VMID-based routing
+// from context works correctly for pct/qm commands
+func TestRouteToAgent_VMIDInCommandWithContext(t *testing.T) {
+	s := &Service{}
+
+	agents := []agentexec.ConnectedAgent{
+		{AgentID: "agent-1", Hostname: "delly"},
+		{AgentID: "agent-2", Hostname: "minipc"},
+	}
+
+	// Even with a VMID in the command, if we have node context, use it
+	req := ExecuteRequest{
+		TargetType: "host",
+		TargetID:   "",
+		Context:    map[string]interface{}{"node": "minipc"},
+	}
+
+	result, err := s.routeToAgent(req, "pct exec 106 -- hostname", agents)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if result.AgentHostname != "minipc" {
+		t.Errorf("AgentHostname = %q, want %q", result.AgentHostname, "minipc")
+	}
+}
diff --git a/internal/alerts/alerts.go b/internal/alerts/alerts.go
index 91d2c6d..bcba8a2 100644
--- a/internal/alerts/alerts.go
+++ b/internal/alerts/alerts.go
@@ -516,6 +516,10 @@ type Manager struct {
 	flappingActive  map[string]bool        // Track which alerts are currently in flapping state
 	// Cleanup control
 	cleanupStop chan struct{} // Signal to stop cleanup goroutine
+	// Host agent deduplication: track hostnames of active host agents
+	// When a host agent is running on a Proxmox node, we prefer the host agent
+	// alerts and suppress the node alerts to avoid duplicate monitoring.
+	hostAgentHostnames map[string]struct{} // Normalized hostnames (lowercase)
 }
 
 type ackRecord struct {
@@ -555,6 +559,7 @@ func NewManager() *Manager {
 		flappingHistory:       make(map[string][]time.Time),
 		flappingActive:        make(map[string]bool),
 		cleanupStop:           make(chan struct{}),
+		hostAgentHostnames:    make(map[string]struct{}),
 		config: AlertConfig{
 			Enabled:                true,
 			ActivationState:        ActivationPending,
@@ -2345,22 +2350,77 @@ func (m *Manager) CheckNode(node models.Node) {
 
 	// Check each metric (only if node is online) - checkMetric will skip if threshold is nil or <= 0
 	if node.Status != "offline" {
-		m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "cpu", node.CPU*100, thresholds.CPU, nil)
-		m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "memory", node.Memory.Usage, thresholds.Memory, nil)
-		m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "disk", node.Disk.Usage, thresholds.Disk, nil)
+		// Check for host agent deduplication: if a host agent is running on this node,
+		// prefer the host agent alerts and skip node metric alerts to avoid duplicates.
+		if m.hasHostAgentForNode(node.Name) {
+			log.Debug().
+				Str("node", node.Name).
+				Msg("Skipping node metric alerts - host agent is monitoring this machine")
+		} else {
+			m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "cpu", node.CPU*100, thresholds.CPU, nil)
+			m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "memory", node.Memory.Usage, thresholds.Memory, nil)
+			m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "disk", node.Disk.Usage, thresholds.Disk, nil)
 
-		// Check temperature if available
-		if node.Temperature != nil && node.Temperature.Available && thresholds.Temperature != nil {
-			// Use CPU package temp if available, otherwise use max core temp
-			temp := node.Temperature.CPUPackage
-			if temp == 0 {
-				temp = node.Temperature.CPUMax
+			// Check temperature if available
+			if node.Temperature != nil && node.Temperature.Available && thresholds.Temperature != nil {
+				// Use CPU package temp if available, otherwise use max core temp
+				temp := node.Temperature.CPUPackage
+				if temp == 0 {
+					temp = node.Temperature.CPUMax
+				}
+				m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "temperature", temp, thresholds.Temperature, nil)
 			}
-			m.checkMetric(node.ID, node.Name, node.Name, node.Instance, "Node", "temperature", temp, thresholds.Temperature, nil)
 		}
 	}
 }
 
+// RegisterHostAgentHostname registers a host agent hostname for deduplication.
+// When a host agent is actively monitoring a machine, we prefer its alerts
+// over Proxmox node alerts to avoid duplicate monitoring of the same machine.
+func (m *Manager) RegisterHostAgentHostname(hostname string) {
+	normalized := strings.ToLower(strings.TrimSpace(hostname))
+	if normalized == "" {
+		return
+	}
+	m.mu.Lock()
+	m.hostAgentHostnames[normalized] = struct{}{}
+	m.mu.Unlock()
+
+	log.Debug().
+		Str("hostname", hostname).
+		Msg("Registered host agent hostname for deduplication")
+}
+
+// UnregisterHostAgentHostname removes a host agent hostname from deduplication tracking.
+func (m *Manager) UnregisterHostAgentHostname(hostname string) {
+	normalized := strings.ToLower(strings.TrimSpace(hostname))
+	if normalized == "" {
+		return
+	}
+	m.mu.Lock()
+	delete(m.hostAgentHostnames, normalized)
+	m.mu.Unlock()
+
+	log.Debug().
+		Str("hostname", hostname).
+		Msg("Unregistered host agent hostname from deduplication")
+}
+
+// hasHostAgentForNode checks if a host agent is monitoring a machine with the same
+// hostname as the given Proxmox node. If so, we should suppress node alerts to
+// avoid duplicate alerting.
+func (m *Manager) hasHostAgentForNode(nodeName string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(nodeName))
+	if normalized == "" {
+		return false
+	}
+	m.mu.RLock()
+	_, exists := m.hostAgentHostnames[normalized]
+	m.mu.RUnlock()
+	return exists
+}
+
+
 func hostResourceID(hostID string) string {
 	trimmed := strings.TrimSpace(hostID)
 	if trimmed == "" {
@@ -2449,6 +2509,12 @@ func (m *Manager) CheckHost(host models.Host) {
 		return
 	}
 
+	// Register this host agent hostname for deduplication with Proxmox nodes.
+	// This prevents duplicate alerts when both a Node and Host agent monitor the same machine.
+	if host.Hostname != "" {
+		m.RegisterHostAgentHostname(host.Hostname)
+	}
+
 	// Fresh telemetry marks the host as online and clears offline tracking.
 	m.HandleHostOnline(host)
 
@@ -2697,6 +2763,11 @@ func (m *Manager) HandleHostRemoved(host models.Host) {
 		return
 	}
 
+	// Unregister the host agent hostname since it's being removed.
+	if host.Hostname != "" {
+		m.UnregisterHostAgentHostname(host.Hostname)
+	}
+
 	m.HandleHostOnline(host)
 	m.clearHostMetricAlerts(host.ID)
 	m.clearHostDiskAlerts(host.ID)
@@ -2708,6 +2779,12 @@ func (m *Manager) HandleHostOffline(host models.Host) {
 		return
 	}
 
+	// Unregister the host agent hostname since it's no longer actively monitoring.
+	// This allows node alerts to resume if a Proxmox node with the same hostname exists.
+	if host.Hostname != "" {
+		m.UnregisterHostAgentHostname(host.Hostname)
+	}
+
 	m.mu.RLock()
 	if !m.config.Enabled {
 		m.mu.RUnlock()
@@ -5847,6 +5924,14 @@ func (m *Manager) ClearAlertHistory() error {
 	return m.historyManager.ClearAllHistory()
 }
 
+// OnAlertHistory registers a callback to be called when alerts are added to history.
+// This enables external systems like pattern detection to track alerts.
+func (m *Manager) OnAlertHistory(cb AlertCallback) {
+	if m.historyManager != nil {
+		m.historyManager.OnAlert(cb)
+	}
+}
+
 // checkNodeOffline creates an alert for offline nodes after confirmation
 func (m *Manager) checkNodeOffline(node models.Node) {
 	alertID := fmt.Sprintf("node-offline-%s", node.ID)
diff --git a/internal/alerts/history.go b/internal/alerts/history.go
index 91aed55..39f9ef9 100644
--- a/internal/alerts/history.go
+++ b/internal/alerts/history.go
@@ -27,6 +27,10 @@ type HistoryEntry struct {
 	Timestamp time.Time `json:"timestamp"`
 }
 
+// AlertCallback is called when an alert is added to history
+// This enables external systems to track alerts (e.g., pattern detection)
+type AlertCallback func(alert Alert)
+
 // HistoryManager manages persistent alert history
 type HistoryManager struct {
 	mu           sync.RWMutex
@@ -38,6 +42,7 @@ type HistoryManager struct {
 	saveInterval time.Duration
 	stopChan     chan struct{}
 	saveTicker   *time.Ticker
+	callbacks    []AlertCallback // Called when alerts are added
 }
 
 // NewHistoryManager creates a new history manager
@@ -74,10 +79,16 @@ func NewHistoryManager(dataDir string) *HistoryManager {
 	return hm
 }
 
+// OnAlert registers a callback to be called when alerts are added
+func (hm *HistoryManager) OnAlert(cb AlertCallback) {
+	hm.mu.Lock()
+	defer hm.mu.Unlock()
+	hm.callbacks = append(hm.callbacks, cb)
+}
+
 // AddAlert adds an alert to history
 func (hm *HistoryManager) AddAlert(alert Alert) {
 	hm.mu.Lock()
-	defer hm.mu.Unlock()
 
 	entry := HistoryEntry{
 		Alert:     *alert.Clone(),
@@ -85,7 +96,15 @@ func (hm *HistoryManager) AddAlert(alert Alert) {
 	}
 
 	hm.history = append(hm.history, entry)
+	callbacks := hm.callbacks
+	hm.mu.Unlock()
+	
 	log.Debug().Str("alertID", alert.ID).Msg("Added alert to history")
+	
+	// Call callbacks outside the lock
+	for _, cb := range callbacks {
+		cb(alert)
+	}
 }
 
 // GetHistory returns alert history within the specified time range
diff --git a/internal/alerts/host_dedup_test.go b/internal/alerts/host_dedup_test.go
new file mode 100644
index 0000000..bdc6e17
--- /dev/null
+++ b/internal/alerts/host_dedup_test.go
@@ -0,0 +1,172 @@
+package alerts
+
+import (
+	"testing"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+func TestHostAgentDeduplicatesNodeAlerts(t *testing.T) {
+	// Test 1: Without a host agent registered, node metrics ARE checked
+	t.Run("node_metrics_checked_without_host_agent", func(t *testing.T) {
+		m := NewManager()
+		m.config.Enabled = true
+		m.config.NodeDefaults.CPU = &HysteresisThreshold{Trigger: 80, Clear: 75}
+
+		// Verify no host agent is registered
+		if m.hasHostAgentForNode("pi") {
+			t.Error("Expected no host agent for 'pi' initially")
+		}
+
+		node := models.Node{
+			ID:     "node/pi",
+			Name:   "pi",
+			Status: "online",
+			CPU:    0.95, // 95% CPU
+		}
+
+		// This should attempt to check metrics (even if alert doesn't fire immediately due to time thresholds)
+		m.CheckNode(node)
+
+		// The key test: pendingAlerts should have an entry because metrics WERE checked
+		m.mu.RLock()
+		_, hasPending := m.pendingAlerts["node/pi-cpu"]
+		m.mu.RUnlock()
+
+		if !hasPending {
+			t.Error("Expected pending alert for node CPU when no host agent registered")
+		}
+	})
+
+	// Test 2: With host agent registered, node metrics are NOT checked
+	t.Run("node_metrics_skipped_with_host_agent", func(t *testing.T) {
+		m := NewManager()
+		m.config.Enabled = true
+		m.config.NodeDefaults.CPU = &HysteresisThreshold{Trigger: 80, Clear: 75}
+
+		// Register a host agent with the same hostname BEFORE checking the node
+		m.RegisterHostAgentHostname("pi")
+
+		// Verify host agent IS registered
+		if !m.hasHostAgentForNode("pi") {
+			t.Error("Expected host agent for 'pi' to be registered")
+		}
+
+		node := models.Node{
+			ID:     "node/pi",
+			Name:   "pi",
+			Status: "online",
+			CPU:    0.95, // 95% CPU
+		}
+
+		m.CheckNode(node)
+
+		// The key test: pendingAlerts should NOT have an entry because metrics were SKIPPED
+		m.mu.RLock()
+		_, hasPending := m.pendingAlerts["node/pi-cpu"]
+		m.mu.RUnlock()
+
+		if hasPending {
+			t.Error("Expected NO pending alert for node CPU when host agent is registered")
+		}
+	})
+
+	// Test 3: After unregistering host agent, node metrics ARE checked again
+	t.Run("node_metrics_resume_after_host_agent_unregistered", func(t *testing.T) {
+		m := NewManager()
+		m.config.Enabled = true
+		m.config.NodeDefaults.CPU = &HysteresisThreshold{Trigger: 80, Clear: 75}
+
+		// Register and then unregister
+		m.RegisterHostAgentHostname("pi")
+		m.UnregisterHostAgentHostname("pi")
+
+		// Verify host agent is NOT registered
+		if m.hasHostAgentForNode("pi") {
+			t.Error("Expected host agent for 'pi' to be unregistered")
+		}
+
+		node := models.Node{
+			ID:     "node/pi",
+			Name:   "pi",
+			Status: "online",
+			CPU:    0.95, // 95% CPU
+		}
+
+		m.CheckNode(node)
+
+		// The key test: pendingAlerts should have an entry because metrics WERE checked
+		m.mu.RLock()
+		_, hasPending := m.pendingAlerts["node/pi-cpu"]
+		m.mu.RUnlock()
+
+		if !hasPending {
+			t.Error("Expected pending alert for node CPU after host agent unregistration")
+		}
+	})
+}
+
+func TestHostAgentDeduplicationCaseInsensitive(t *testing.T) {
+	m := NewManager()
+
+	// Register with lowercase
+	m.RegisterHostAgentHostname("myhost")
+
+	// Check should match regardless of case
+	if !m.hasHostAgentForNode("MYHOST") {
+		t.Error("Expected hasHostAgentForNode to match uppercase hostname")
+	}
+	if !m.hasHostAgentForNode("MyHost") {
+		t.Error("Expected hasHostAgentForNode to match mixed-case hostname")
+	}
+	if !m.hasHostAgentForNode("myhost") {
+		t.Error("Expected hasHostAgentForNode to match lowercase hostname")
+	}
+}
+
+func TestCheckHostRegistersHostname(t *testing.T) {
+	m := NewManager()
+	m.config.Enabled = true
+
+	host := models.Host{
+		ID:       "host-test-123",
+		Hostname: "testhost",
+		CPUUsage: 50,
+	}
+
+	// Initially no hostname registered
+	if m.hasHostAgentForNode("testhost") {
+		t.Error("Expected no host agent registered initially")
+	}
+
+	// CheckHost should register the hostname
+	m.CheckHost(host)
+
+	if !m.hasHostAgentForNode("testhost") {
+		t.Error("Expected host agent hostname to be registered after CheckHost")
+	}
+}
+
+func TestHandleHostOfflineUnregistersHostname(t *testing.T) {
+	m := NewManager()
+	m.config.Enabled = true
+
+	host := models.Host{
+		ID:       "host-test-456",
+		Hostname: "offlinehost",
+	}
+
+	// Register the hostname
+	m.RegisterHostAgentHostname(host.Hostname)
+
+	if !m.hasHostAgentForNode("offlinehost") {
+		t.Error("Expected host agent registered")
+	}
+
+	// HandleHostOffline should unregister the hostname
+	m.HandleHostOffline(host)
+
+	if m.hasHostAgentForNode("offlinehost") {
+		t.Error("Expected host agent to be unregistered after HandleHostOffline")
+	}
+}
diff --git a/internal/api/ai_handlers.go b/internal/api/ai_handlers.go
new file mode 100644
index 0000000..aa8d85d
--- /dev/null
+++ b/internal/api/ai_handlers.go
@@ -0,0 +1,2852 @@
+package api
+
+import (
+	"context"
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/cost"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai/providers"
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rcourtman/pulse-go-rewrite/internal/utils"
+	"github.com/rs/zerolog/log"
+)
+
+// AISettingsHandler handles AI settings endpoints
+type AISettingsHandler struct {
+	config      *config.Config
+	persistence *config.ConfigPersistence
+	aiService   *ai.Service
+	agentServer *agentexec.Server
+}
+
+// NewAISettingsHandler creates a new AI settings handler
+func NewAISettingsHandler(cfg *config.Config, persistence *config.ConfigPersistence, agentServer *agentexec.Server) *AISettingsHandler {
+	aiService := ai.NewService(persistence, agentServer)
+	if err := aiService.LoadConfig(); err != nil {
+		log.Warn().Err(err).Msg("Failed to load AI config on startup")
+	}
+
+	return &AISettingsHandler{
+		config:      cfg,
+		persistence: persistence,
+		aiService:   aiService,
+		agentServer: agentServer,
+	}
+}
+
+// SetConfig updates the configuration reference used by the handler.
+func (h *AISettingsHandler) SetConfig(cfg *config.Config) {
+	if cfg == nil {
+		return
+	}
+	h.config = cfg
+}
+
+// SetStateProvider sets the state provider for infrastructure context
+func (h *AISettingsHandler) SetStateProvider(sp ai.StateProvider) {
+	h.aiService.SetStateProvider(sp)
+}
+
+// SetResourceProvider sets the resource provider for unified infrastructure context (Phase 2)
+func (h *AISettingsHandler) SetResourceProvider(rp ai.ResourceProvider) {
+	h.aiService.SetResourceProvider(rp)
+}
+
+// SetMetadataProvider sets the metadata provider for AI URL discovery
+func (h *AISettingsHandler) SetMetadataProvider(mp ai.MetadataProvider) {
+	h.aiService.SetMetadataProvider(mp)
+}
+
+// StartPatrol starts the background AI patrol service
+func (h *AISettingsHandler) StartPatrol(ctx context.Context) {
+	h.aiService.StartPatrol(ctx)
+}
+
+// SetPatrolThresholdProvider sets the threshold provider for the patrol service
+func (h *AISettingsHandler) SetPatrolThresholdProvider(provider ai.ThresholdProvider) {
+	h.aiService.SetPatrolThresholdProvider(provider)
+}
+
+// SetPatrolFindingsPersistence enables findings persistence for the patrol service
+func (h *AISettingsHandler) SetPatrolFindingsPersistence(persistence ai.FindingsPersistence) error {
+	if patrol := h.aiService.GetPatrolService(); patrol != nil {
+		return patrol.SetFindingsPersistence(persistence)
+	}
+	return nil
+}
+
+// SetPatrolRunHistoryPersistence enables patrol run history persistence for the patrol service
+func (h *AISettingsHandler) SetPatrolRunHistoryPersistence(persistence ai.PatrolHistoryPersistence) error {
+	if patrol := h.aiService.GetPatrolService(); patrol != nil {
+		return patrol.SetRunHistoryPersistence(persistence)
+	}
+	return nil
+}
+
+// SetMetricsHistoryProvider sets the metrics history provider for enriched AI context
+func (h *AISettingsHandler) SetMetricsHistoryProvider(provider ai.MetricsHistoryProvider) {
+	h.aiService.SetMetricsHistoryProvider(provider)
+}
+
+// SetBaselineStore sets the baseline store for anomaly detection
+func (h *AISettingsHandler) SetBaselineStore(store *ai.BaselineStore) {
+	h.aiService.SetBaselineStore(store)
+}
+
+// SetChangeDetector sets the change detector for operational memory
+func (h *AISettingsHandler) SetChangeDetector(detector *ai.ChangeDetector) {
+	h.aiService.SetChangeDetector(detector)
+}
+
+// SetRemediationLog sets the remediation log for tracking fix attempts
+func (h *AISettingsHandler) SetRemediationLog(remLog *ai.RemediationLog) {
+	h.aiService.SetRemediationLog(remLog)
+}
+
+// SetPatternDetector sets the pattern detector for failure prediction
+func (h *AISettingsHandler) SetPatternDetector(detector *ai.PatternDetector) {
+	h.aiService.SetPatternDetector(detector)
+}
+
+// SetCorrelationDetector sets the correlation detector for multi-resource correlation
+func (h *AISettingsHandler) SetCorrelationDetector(detector *ai.CorrelationDetector) {
+	h.aiService.SetCorrelationDetector(detector)
+}
+
+// StopPatrol stops the background AI patrol service
+func (h *AISettingsHandler) StopPatrol() {
+	h.aiService.StopPatrol()
+}
+
+// GetAlertTriggeredAnalyzer returns the alert-triggered analyzer for wiring into alert callbacks
+func (h *AISettingsHandler) GetAlertTriggeredAnalyzer() *ai.AlertTriggeredAnalyzer {
+	return h.aiService.GetAlertTriggeredAnalyzer()
+}
+
+// AISettingsResponse is returned by GET /api/settings/ai
+// API keys are masked for security
+type AISettingsResponse struct {
+	Enabled        bool   `json:"enabled"`
+	Provider       string `json:"provider"`    // DEPRECATED: legacy single provider
+	APIKeySet      bool   `json:"api_key_set"` // DEPRECATED: true if legacy API key is configured
+	Model          string `json:"model"`
+	ChatModel      string `json:"chat_model,omitempty"`     // Model for interactive chat (empty = use default)
+	PatrolModel    string `json:"patrol_model,omitempty"`   // Model for patrol (empty = use default)
+	AutoFixModel   string `json:"auto_fix_model,omitempty"` // Model for auto-fix (empty = use patrol model)
+	BaseURL        string `json:"base_url,omitempty"`       // DEPRECATED: legacy base URL
+	Configured     bool   `json:"configured"`               // true if AI is ready to use
+	AutonomousMode bool   `json:"autonomous_mode"`          // true if AI can execute without approval
+	CustomContext  string `json:"custom_context"`           // user-provided infrastructure context
+	// OAuth fields for Claude Pro/Max subscription authentication
+	AuthMethod     string `json:"auth_method"`     // "api_key" or "oauth"
+	OAuthConnected bool   `json:"oauth_connected"` // true if OAuth tokens are configured
+	// Patrol settings for token efficiency
+	PatrolSchedulePreset   string             `json:"patrol_schedule_preset"`   // DEPRECATED: legacy preset
+	PatrolIntervalMinutes  int                `json:"patrol_interval_minutes"`  // Patrol interval in minutes (0 = disabled)
+	PatrolAutoFix          bool               `json:"patrol_auto_fix"`          // true if patrol can auto-fix issues
+	AlertTriggeredAnalysis bool               `json:"alert_triggered_analysis"` // true if AI analyzes when alerts fire
+	AvailableModels        []config.ModelInfo `json:"available_models"`         // List of models for current provider
+	// Multi-provider credentials - shows which providers are configured
+	AnthropicConfigured bool     `json:"anthropic_configured"`      // true if Anthropic API key or OAuth is set
+	OpenAIConfigured    bool     `json:"openai_configured"`         // true if OpenAI API key is set
+	DeepSeekConfigured  bool     `json:"deepseek_configured"`       // true if DeepSeek API key is set
+	OllamaConfigured    bool     `json:"ollama_configured"`         // true (always available for attempt)
+	OllamaBaseURL       string   `json:"ollama_base_url"`           // Ollama server URL
+	OpenAIBaseURL       string   `json:"openai_base_url,omitempty"` // Custom OpenAI base URL
+	ConfiguredProviders []string `json:"configured_providers"`      // List of provider names with credentials
+	// Cost controls
+	CostBudgetUSD30d float64 `json:"cost_budget_usd_30d,omitempty"`
+}
+
+// AISettingsUpdateRequest is the request body for PUT /api/settings/ai
+type AISettingsUpdateRequest struct {
+	Enabled        *bool   `json:"enabled,omitempty"`
+	Provider       *string `json:"provider,omitempty"` // DEPRECATED: use model selection instead
+	APIKey         *string `json:"api_key,omitempty"`  // DEPRECATED: use per-provider keys
+	Model          *string `json:"model,omitempty"`
+	ChatModel      *string `json:"chat_model,omitempty"`     // Model for interactive chat
+	PatrolModel    *string `json:"patrol_model,omitempty"`   // Model for background patrol
+	AutoFixModel   *string `json:"auto_fix_model,omitempty"` // Model for auto-fix remediation
+	BaseURL        *string `json:"base_url,omitempty"`       // DEPRECATED: use per-provider URLs
+	AutonomousMode *bool   `json:"autonomous_mode,omitempty"`
+	CustomContext  *string `json:"custom_context,omitempty"` // user-provided infrastructure context
+	AuthMethod     *string `json:"auth_method,omitempty"`    // "api_key" or "oauth"
+	// Patrol settings for token efficiency
+	PatrolSchedulePreset   *string `json:"patrol_schedule_preset,omitempty"`   // DEPRECATED: use patrol_interval_minutes
+	PatrolIntervalMinutes  *int    `json:"patrol_interval_minutes,omitempty"`  // Custom interval in minutes (0 = disabled, minimum 10)
+	PatrolAutoFix          *bool   `json:"patrol_auto_fix,omitempty"`          // true if patrol can auto-fix issues
+	AlertTriggeredAnalysis *bool   `json:"alert_triggered_analysis,omitempty"` // true if AI analyzes when alerts fire
+	// Multi-provider credentials
+	AnthropicAPIKey *string `json:"anthropic_api_key,omitempty"` // Set Anthropic API key
+	OpenAIAPIKey    *string `json:"openai_api_key,omitempty"`    // Set OpenAI API key
+	DeepSeekAPIKey  *string `json:"deepseek_api_key,omitempty"`  // Set DeepSeek API key
+	OllamaBaseURL   *string `json:"ollama_base_url,omitempty"`   // Set Ollama server URL
+	OpenAIBaseURL   *string `json:"openai_base_url,omitempty"`   // Set custom OpenAI base URL
+	// Clear flags for removing credentials
+	ClearAnthropicKey *bool `json:"clear_anthropic_key,omitempty"` // Clear Anthropic API key
+	ClearOpenAIKey    *bool `json:"clear_openai_key,omitempty"`    // Clear OpenAI API key
+	ClearDeepSeekKey  *bool `json:"clear_deepseek_key,omitempty"`  // Clear DeepSeek API key
+	ClearOllamaURL    *bool `json:"clear_ollama_url,omitempty"`    // Clear Ollama URL
+	// Cost controls
+	CostBudgetUSD30d *float64 `json:"cost_budget_usd_30d,omitempty"`
+}
+
+// HandleGetAISettings returns the current AI settings (GET /api/settings/ai)
+func (h *AISettingsHandler) HandleGetAISettings(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	settings, err := h.persistence.LoadAIConfig()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to load AI settings")
+		http.Error(w, "Failed to load AI settings", http.StatusInternalServerError)
+		return
+	}
+
+	if settings == nil {
+		settings = config.NewDefaultAIConfig()
+	}
+
+	// Determine auth method string
+	authMethod := string(settings.AuthMethod)
+	if authMethod == "" {
+		authMethod = string(config.AuthMethodAPIKey)
+	}
+
+	response := AISettingsResponse{
+		Enabled:        settings.Enabled,
+		Provider:       settings.Provider,
+		APIKeySet:      settings.APIKey != "",
+		Model:          settings.GetModel(),
+		ChatModel:      settings.ChatModel,
+		PatrolModel:    settings.PatrolModel,
+		AutoFixModel:   settings.AutoFixModel,
+		BaseURL:        settings.BaseURL,
+		Configured:     settings.IsConfigured(),
+		AutonomousMode: settings.AutonomousMode,
+		CustomContext:  settings.CustomContext,
+		AuthMethod:     authMethod,
+		OAuthConnected: settings.OAuthAccessToken != "",
+		// Patrol settings
+		PatrolSchedulePreset:   settings.PatrolSchedulePreset,
+		PatrolIntervalMinutes:  settings.PatrolIntervalMinutes,
+		PatrolAutoFix:          settings.PatrolAutoFix,
+		AlertTriggeredAnalysis: settings.AlertTriggeredAnalysis,
+		AvailableModels:        nil, // Now populated via /api/ai/models endpoint
+		// Multi-provider configuration
+		AnthropicConfigured: settings.HasProvider(config.AIProviderAnthropic),
+		OpenAIConfigured:    settings.HasProvider(config.AIProviderOpenAI),
+		DeepSeekConfigured:  settings.HasProvider(config.AIProviderDeepSeek),
+		OllamaConfigured:    settings.HasProvider(config.AIProviderOllama),
+		OllamaBaseURL:       settings.GetBaseURLForProvider(config.AIProviderOllama),
+		OpenAIBaseURL:       settings.OpenAIBaseURL,
+		ConfiguredProviders: settings.GetConfiguredProviders(),
+		CostBudgetUSD30d:    settings.CostBudgetUSD30d,
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI settings response")
+	}
+}
+
+// HandleUpdateAISettings updates AI settings (PUT /api/settings/ai)
+func (h *AISettingsHandler) HandleUpdateAISettings(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut && r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require admin authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Check proxy auth admin status if applicable
+	if h.config.ProxyAuthSecret != "" {
+		if valid, username, isAdmin := CheckProxyAuth(h.config, r); valid && !isAdmin {
+			log.Warn().
+				Str("ip", r.RemoteAddr).
+				Str("path", r.URL.Path).
+				Str("method", r.Method).
+				Str("username", username).
+				Msg("Non-admin user attempted to update AI settings")
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusForbidden)
+			_ = json.NewEncoder(w).Encode(map[string]string{"error": "Admin privileges required"})
+			return
+		}
+	}
+
+	// Load existing settings
+	settings, err := h.persistence.LoadAIConfig()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to load existing AI settings")
+		settings = config.NewDefaultAIConfig()
+	}
+	if settings == nil {
+		settings = config.NewDefaultAIConfig()
+	}
+
+	// Parse request
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+	var req AISettingsUpdateRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	// Validate and apply updates
+	if req.Provider != nil {
+		provider := strings.ToLower(strings.TrimSpace(*req.Provider))
+		switch provider {
+		case config.AIProviderAnthropic, config.AIProviderOpenAI, config.AIProviderOllama, config.AIProviderDeepSeek:
+			settings.Provider = provider
+		default:
+			http.Error(w, "Invalid provider. Must be 'anthropic', 'openai', 'ollama', or 'deepseek'", http.StatusBadRequest)
+			return
+		}
+	}
+
+	if req.APIKey != nil {
+		// Empty string clears the API key
+		settings.APIKey = strings.TrimSpace(*req.APIKey)
+	}
+
+	if req.Model != nil {
+		settings.Model = strings.TrimSpace(*req.Model)
+	}
+
+	if req.ChatModel != nil {
+		settings.ChatModel = strings.TrimSpace(*req.ChatModel)
+	}
+
+	if req.PatrolModel != nil {
+		settings.PatrolModel = strings.TrimSpace(*req.PatrolModel)
+	}
+
+	if req.AutoFixModel != nil {
+		settings.AutoFixModel = strings.TrimSpace(*req.AutoFixModel)
+	}
+
+	if req.PatrolAutoFix != nil {
+		settings.PatrolAutoFix = *req.PatrolAutoFix
+	}
+
+	if req.BaseURL != nil {
+		settings.BaseURL = strings.TrimSpace(*req.BaseURL)
+	}
+
+	if req.AutonomousMode != nil {
+		settings.AutonomousMode = *req.AutonomousMode
+	}
+
+	if req.CustomContext != nil {
+		settings.CustomContext = strings.TrimSpace(*req.CustomContext)
+	}
+
+	if req.Enabled != nil {
+		// Only allow enabling if properly configured
+		if *req.Enabled {
+			switch settings.Provider {
+			case config.AIProviderAnthropic, config.AIProviderOpenAI, config.AIProviderDeepSeek:
+				if settings.APIKey == "" {
+					http.Error(w, "Cannot enable AI: API key is required for "+settings.Provider, http.StatusBadRequest)
+					return
+				}
+			case config.AIProviderOllama:
+				// Ollama doesn't need API key, but needs base URL (or will use default)
+				if settings.BaseURL == "" {
+					settings.BaseURL = config.DefaultOllamaBaseURL
+				}
+			}
+		}
+		settings.Enabled = *req.Enabled
+	}
+
+	// Handle patrol interval - prefer custom minutes over preset
+	if req.PatrolIntervalMinutes != nil {
+		minutes := *req.PatrolIntervalMinutes
+		if minutes < 0 {
+			http.Error(w, "patrol_interval_minutes cannot be negative", http.StatusBadRequest)
+			return
+		}
+		if minutes > 0 && minutes < 10 {
+			http.Error(w, "patrol_interval_minutes must be at least 10 minutes (or 0 to disable)", http.StatusBadRequest)
+			return
+		}
+		if minutes > 10080 { // 7 days max
+			http.Error(w, "patrol_interval_minutes cannot exceed 10080 (7 days)", http.StatusBadRequest)
+			return
+		}
+		settings.PatrolIntervalMinutes = minutes
+		settings.PatrolSchedulePreset = "" // Clear preset when using custom minutes
+	} else if req.PatrolSchedulePreset != nil {
+		// Legacy preset support
+		preset := strings.ToLower(strings.TrimSpace(*req.PatrolSchedulePreset))
+		switch preset {
+		case "15min", "1hr", "6hr", "12hr", "daily", "disabled":
+			settings.PatrolSchedulePreset = preset
+			settings.PatrolIntervalMinutes = config.PresetToMinutes(preset)
+		default:
+			http.Error(w, "Invalid patrol_schedule_preset. Must be '15min', '1hr', '6hr', '12hr', 'daily', or 'disabled'", http.StatusBadRequest)
+			return
+		}
+	}
+
+	if req.CostBudgetUSD30d != nil {
+		if *req.CostBudgetUSD30d < 0 {
+			http.Error(w, "cost_budget_usd_30d cannot be negative", http.StatusBadRequest)
+			return
+		}
+		settings.CostBudgetUSD30d = *req.CostBudgetUSD30d
+	}
+
+	// Handle alert-triggered analysis toggle
+	if req.AlertTriggeredAnalysis != nil {
+		settings.AlertTriggeredAnalysis = *req.AlertTriggeredAnalysis
+	}
+
+	// Handle multi-provider credentials
+	// Clear flags take priority over setting new values
+	if req.ClearAnthropicKey != nil && *req.ClearAnthropicKey {
+		settings.AnthropicAPIKey = ""
+	} else if req.AnthropicAPIKey != nil {
+		settings.AnthropicAPIKey = strings.TrimSpace(*req.AnthropicAPIKey)
+	}
+	if req.ClearOpenAIKey != nil && *req.ClearOpenAIKey {
+		settings.OpenAIAPIKey = ""
+	} else if req.OpenAIAPIKey != nil {
+		settings.OpenAIAPIKey = strings.TrimSpace(*req.OpenAIAPIKey)
+	}
+	if req.ClearDeepSeekKey != nil && *req.ClearDeepSeekKey {
+		settings.DeepSeekAPIKey = ""
+	} else if req.DeepSeekAPIKey != nil {
+		settings.DeepSeekAPIKey = strings.TrimSpace(*req.DeepSeekAPIKey)
+	}
+	if req.ClearOllamaURL != nil && *req.ClearOllamaURL {
+		settings.OllamaBaseURL = ""
+	} else if req.OllamaBaseURL != nil {
+		settings.OllamaBaseURL = strings.TrimSpace(*req.OllamaBaseURL)
+	}
+	if req.OpenAIBaseURL != nil {
+		settings.OpenAIBaseURL = strings.TrimSpace(*req.OpenAIBaseURL)
+	}
+
+	// Save settings
+	if err := h.persistence.SaveAIConfig(*settings); err != nil {
+		log.Error().Err(err).Msg("Failed to save AI settings")
+		http.Error(w, "Failed to save settings", http.StatusInternalServerError)
+		return
+	}
+
+	// Reload the AI service with new settings
+	if err := h.aiService.Reload(); err != nil {
+		log.Warn().Err(err).Msg("Failed to reload AI service after settings update")
+	}
+
+	// Reconfigure patrol service with new settings (applies interval changes immediately)
+	h.aiService.ReconfigurePatrol()
+
+	// Update alert-triggered analyzer if available
+	if analyzer := h.aiService.GetAlertTriggeredAnalyzer(); analyzer != nil {
+		analyzer.SetEnabled(settings.AlertTriggeredAnalysis)
+	}
+
+	log.Info().
+		Bool("enabled", settings.Enabled).
+		Str("provider", settings.Provider).
+		Str("model", settings.GetModel()).
+		Str("patrolPreset", settings.PatrolSchedulePreset).
+		Bool("alertTriggeredAnalysis", settings.AlertTriggeredAnalysis).
+		Msg("AI settings updated")
+
+	// Determine auth method for response
+	authMethod := string(settings.AuthMethod)
+	if authMethod == "" {
+		authMethod = string(config.AuthMethodAPIKey)
+	}
+
+	// Return updated settings
+	response := AISettingsResponse{
+		Enabled:                settings.Enabled,
+		Provider:               settings.Provider,
+		APIKeySet:              settings.APIKey != "",
+		Model:                  settings.GetModel(),
+		ChatModel:              settings.ChatModel,
+		PatrolModel:            settings.PatrolModel,
+		AutoFixModel:           settings.AutoFixModel,
+		BaseURL:                settings.BaseURL,
+		Configured:             settings.IsConfigured(),
+		AutonomousMode:         settings.AutonomousMode,
+		CustomContext:          settings.CustomContext,
+		AuthMethod:             authMethod,
+		OAuthConnected:         settings.OAuthAccessToken != "",
+		PatrolSchedulePreset:   settings.PatrolSchedulePreset,
+		PatrolIntervalMinutes:  settings.PatrolIntervalMinutes,
+		PatrolAutoFix:          settings.PatrolAutoFix,
+		AlertTriggeredAnalysis: settings.AlertTriggeredAnalysis,
+		AvailableModels:        nil, // Now populated via /api/ai/models endpoint
+		// Multi-provider configuration
+		AnthropicConfigured: settings.HasProvider(config.AIProviderAnthropic),
+		OpenAIConfigured:    settings.HasProvider(config.AIProviderOpenAI),
+		DeepSeekConfigured:  settings.HasProvider(config.AIProviderDeepSeek),
+		OllamaConfigured:    settings.HasProvider(config.AIProviderOllama),
+		OllamaBaseURL:       settings.GetBaseURLForProvider(config.AIProviderOllama),
+		OpenAIBaseURL:       settings.OpenAIBaseURL,
+		ConfiguredProviders: settings.GetConfiguredProviders(),
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI settings update response")
+	}
+}
+
+// HandleTestAIConnection tests the AI provider connection (POST /api/ai/test)
+func (h *AISettingsHandler) HandleTestAIConnection(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require admin authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+
+	var testResult struct {
+		Success bool   `json:"success"`
+		Message string `json:"message"`
+		Model   string `json:"model,omitempty"`
+	}
+
+	err := h.aiService.TestConnection(ctx)
+	if err != nil {
+		testResult.Success = false
+		testResult.Message = err.Error()
+	} else {
+		cfg := h.aiService.GetConfig()
+		testResult.Success = true
+		testResult.Message = "Connection successful"
+		if cfg != nil {
+			testResult.Model = cfg.GetModel()
+		}
+	}
+
+	if err := utils.WriteJSONResponse(w, testResult); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI test response")
+	}
+}
+
+// HandleTestProvider tests a specific AI provider connection (POST /api/ai/test/:provider)
+func (h *AISettingsHandler) HandleTestProvider(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require admin authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Get provider from URL path (e.g., /api/ai/test/anthropic -> anthropic)
+	provider := strings.TrimPrefix(r.URL.Path, "/api/ai/test/")
+	if provider == "" || provider == r.URL.Path {
+		http.Error(w, `{"error":"Provider is required"}`, http.StatusBadRequest)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+
+	var testResult struct {
+		Success  bool   `json:"success"`
+		Message  string `json:"message"`
+		Provider string `json:"provider"`
+	}
+	testResult.Provider = provider
+
+	// Load config and create provider for testing
+	cfg := h.aiService.GetConfig()
+	if cfg == nil {
+		testResult.Success = false
+		testResult.Message = "AI not configured"
+		utils.WriteJSONResponse(w, testResult)
+		return
+	}
+
+	// Check if provider is configured
+	if !cfg.HasProvider(provider) {
+		testResult.Success = false
+		testResult.Message = "Provider not configured"
+		utils.WriteJSONResponse(w, testResult)
+		return
+	}
+
+	// Create provider and test connection
+	testProvider, err := providers.NewForProvider(cfg, provider, cfg.GetModel())
+	if err != nil {
+		testResult.Success = false
+		testResult.Message = fmt.Sprintf("Failed to create provider: %v", err)
+		utils.WriteJSONResponse(w, testResult)
+		return
+	}
+
+	err = testProvider.TestConnection(ctx)
+	if err != nil {
+		testResult.Success = false
+		testResult.Message = err.Error()
+	} else {
+		testResult.Success = true
+		testResult.Message = "Connection successful"
+	}
+
+	if err := utils.WriteJSONResponse(w, testResult); err != nil {
+		log.Error().Err(err).Msg("Failed to write provider test response")
+	}
+}
+
+// HandleListModels fetches available models from the configured AI provider (GET /api/ai/models)
+func (h *AISettingsHandler) HandleListModels(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+
+	type ModelInfo struct {
+		ID          string `json:"id"`
+		Name        string `json:"name"`
+		Description string `json:"description,omitempty"`
+	}
+
+	type Response struct {
+		Models []ModelInfo `json:"models"`
+		Error  string      `json:"error,omitempty"`
+		Cached bool        `json:"cached"`
+	}
+
+	models, cached, err := h.aiService.ListModelsWithCache(ctx)
+	if err != nil {
+		// Return error but don't fail the request - frontend can show a fallback
+		resp := Response{
+			Models: []ModelInfo{},
+			Error:  err.Error(),
+		}
+		if jsonErr := utils.WriteJSONResponse(w, resp); jsonErr != nil {
+			log.Error().Err(jsonErr).Msg("Failed to write AI models response")
+		}
+		return
+	}
+
+	// Convert provider models to response format
+	responseModels := make([]ModelInfo, 0, len(models))
+	for _, m := range models {
+		responseModels = append(responseModels, ModelInfo{
+			ID:          m.ID,
+			Name:        m.Name,
+			Description: m.Description,
+		})
+	}
+
+	resp := Response{
+		Models: responseModels,
+		Cached: cached,
+	}
+
+	if err := utils.WriteJSONResponse(w, resp); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI models response")
+	}
+}
+
+// AIExecuteRequest is the request body for POST /api/ai/execute
+// AIConversationMessage represents a message in conversation history
+type AIConversationMessage struct {
+	Role    string `json:"role"` // "user" or "assistant"
+	Content string `json:"content"`
+}
+
+type AIExecuteRequest struct {
+	Prompt     string                  `json:"prompt"`
+	TargetType string                  `json:"target_type,omitempty"` // "host", "container", "vm", "node"
+	TargetID   string                  `json:"target_id,omitempty"`
+	Context    map[string]interface{}  `json:"context,omitempty"` // Current metrics, state, etc.
+	History    []AIConversationMessage `json:"history,omitempty"` // Previous conversation messages
+	FindingID  string                  `json:"finding_id,omitempty"`
+	Model      string                  `json:"model,omitempty"`
+	UseCase    string                  `json:"use_case,omitempty"` // "chat" or "patrol"
+}
+
+// AIExecuteResponse is the response from POST /api/ai/execute
+type AIExecuteResponse struct {
+	Content          string                  `json:"content"`
+	Model            string                  `json:"model"`
+	InputTokens      int                     `json:"input_tokens"`
+	OutputTokens     int                     `json:"output_tokens"`
+	ToolCalls        []ai.ToolExecution      `json:"tool_calls,omitempty"`        // Commands that were executed
+	PendingApprovals []ai.ApprovalNeededData `json:"pending_approvals,omitempty"` // Commands that require approval (non-streaming)
+}
+
+// HandleExecute executes an AI prompt (POST /api/ai/execute)
+func (h *AISettingsHandler) HandleExecute(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Check if AI is enabled
+	if !h.aiService.IsEnabled() {
+		http.Error(w, "AI is not enabled or configured", http.StatusBadRequest)
+		return
+	}
+
+	// Parse request
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024) // 64KB max
+	var req AIExecuteRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if strings.TrimSpace(req.Prompt) == "" {
+		http.Error(w, "Prompt is required", http.StatusBadRequest)
+		return
+	}
+
+	// Execute the prompt with a timeout
+	ctx, cancel := context.WithTimeout(r.Context(), 120*time.Second)
+	defer cancel()
+
+	// Convert history from API type to service type
+	var history []ai.ConversationMessage
+	for _, msg := range req.History {
+		history = append(history, ai.ConversationMessage{
+			Role:    msg.Role,
+			Content: msg.Content,
+		})
+	}
+
+	useCase := strings.TrimSpace(req.UseCase)
+	if useCase == "" {
+		useCase = "chat"
+	}
+
+	resp, err := h.aiService.Execute(ctx, ai.ExecuteRequest{
+		Prompt:     req.Prompt,
+		TargetType: req.TargetType,
+		TargetID:   req.TargetID,
+		Context:    req.Context,
+		History:    history,
+		FindingID:  req.FindingID,
+		Model:      req.Model,
+		UseCase:    useCase,
+	})
+	if err != nil {
+		log.Error().Err(err).Msg("AI execution failed")
+		http.Error(w, "AI request failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	response := AIExecuteResponse{
+		Content:          resp.Content,
+		Model:            resp.Model,
+		InputTokens:      resp.InputTokens,
+		OutputTokens:     resp.OutputTokens,
+		ToolCalls:        resp.ToolCalls,
+		PendingApprovals: resp.PendingApprovals,
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI execute response")
+	}
+}
+
+// HandleExecuteStream executes an AI prompt with SSE streaming (POST /api/ai/execute/stream)
+func (h *AISettingsHandler) HandleExecuteStream(w http.ResponseWriter, r *http.Request) {
+	// Handle CORS for dev mode (frontend on different port)
+	origin := r.Header.Get("Origin")
+	if origin != "" {
+		// Must use specific origin (not *) when credentials are included
+		w.Header().Set("Access-Control-Allow-Origin", origin)
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
+		w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Accept, Cookie")
+		w.Header().Set("Vary", "Origin")
+	}
+
+	// Handle preflight
+	if r.Method == http.MethodOptions {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Check if AI is enabled
+	if !h.aiService.IsEnabled() {
+		http.Error(w, "AI is not enabled or configured", http.StatusBadRequest)
+		return
+	}
+
+	// Parse request
+	r.Body = http.MaxBytesReader(w, r.Body, 64*1024) // 64KB max
+	var req AIExecuteRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if strings.TrimSpace(req.Prompt) == "" {
+		http.Error(w, "Prompt is required", http.StatusBadRequest)
+		return
+	}
+
+	log.Info().
+		Int("prompt_len", len(req.Prompt)).
+		Str("target_type", req.TargetType).
+		Str("target_id", req.TargetID).
+		Msg("AI streaming request started")
+
+	// Set up SSE headers
+	// IMPORTANT: Set headers BEFORE any writes to prevent Go from auto-adding Transfer-Encoding: chunked
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no") // Disable nginx buffering
+	// Prevent chunked encoding which causes "Invalid character in chunk size" errors in Vite proxy
+	w.Header().Set("Transfer-Encoding", "identity")
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "Streaming not supported", http.StatusInternalServerError)
+		return
+	}
+
+	// Disable the server's write deadline for this SSE connection
+	// This is critical for long-running AI requests that can take several minutes
+	rc := http.NewResponseController(w)
+	if err := rc.SetWriteDeadline(time.Time{}); err != nil {
+		log.Warn().Err(err).Msg("Failed to disable write deadline for SSE")
+	}
+	// Also disable read deadline
+	if err := rc.SetReadDeadline(time.Time{}); err != nil {
+		log.Warn().Err(err).Msg("Failed to disable read deadline for SSE")
+	}
+
+	// Flush headers immediately
+	flusher.Flush()
+
+	// Create context with timeout (15 minutes for complex analysis with multiple tool calls)
+	// Use background context to avoid browser disconnect canceling the request
+	// DeepSeek reasoning models + multiple tool executions can easily take 5+ minutes
+	ctx, cancel := context.WithTimeout(context.Background(), 900*time.Second)
+	defer cancel()
+
+	// Set up heartbeat to keep connection alive during long tool executions
+	// NOTE: We don't check r.Context().Done() because Vite proxy may close
+	// the request context prematurely. We detect real disconnection via write failures.
+	heartbeatDone := make(chan struct{})
+	var clientDisconnected atomic.Bool
+	go func() {
+		ticker := time.NewTicker(5 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ticker.C:
+				// Extend write deadline before heartbeat
+				_ = rc.SetWriteDeadline(time.Now().Add(10 * time.Second))
+				// Send SSE comment as heartbeat
+				_, err := w.Write([]byte(": heartbeat\n\n"))
+				if err != nil {
+					log.Debug().Err(err).Msg("Heartbeat write failed, stopping heartbeat (AI continues)")
+					clientDisconnected.Store(true)
+					// Don't cancel the AI request - let it complete with its own timeout
+					// The SSE connection may have issues but the AI work can still finish
+					return
+				}
+				flusher.Flush()
+				log.Debug().Msg("Sent SSE heartbeat")
+			case <-heartbeatDone:
+				return
+			}
+		}
+	}()
+	defer close(heartbeatDone)
+
+	// Helper to safely write SSE events, tracking if client disconnected
+	safeWrite := func(data []byte) bool {
+		if clientDisconnected.Load() {
+			return false
+		}
+		_ = rc.SetWriteDeadline(time.Now().Add(10 * time.Second))
+		_, err := w.Write(data)
+		if err != nil {
+			log.Debug().Err(err).Msg("Failed to write SSE event (client may have disconnected)")
+			clientDisconnected.Store(true)
+			return false
+		}
+		flusher.Flush()
+		return true
+	}
+
+	// Stream callback - write SSE events
+	callback := func(event ai.StreamEvent) {
+		// Skip the 'done' event from service - we'll send our own at the end
+		// This ensures 'complete' comes before 'done'
+		if event.Type == "done" {
+			log.Debug().Msg("Skipping service 'done' event - will send final 'done' after 'complete'")
+			return
+		}
+
+		data, err := json.Marshal(event)
+		if err != nil {
+			log.Error().Err(err).Msg("Failed to marshal stream event")
+			return
+		}
+
+		log.Debug().
+			Str("event_type", event.Type).
+			Msg("Streaming AI event")
+
+		// SSE format: data: <json>\n\n
+		safeWrite([]byte("data: " + string(data) + "\n\n"))
+	}
+
+	// Convert history from API type to service type
+	var history []ai.ConversationMessage
+	for _, msg := range req.History {
+		history = append(history, ai.ConversationMessage{
+			Role:    msg.Role,
+			Content: msg.Content,
+		})
+	}
+
+	useCase := strings.TrimSpace(req.UseCase)
+	if useCase == "" {
+		useCase = "chat"
+	}
+
+	// Ensure we always send a final 'done' event
+	defer func() {
+		if !clientDisconnected.Load() {
+			doneEvent := ai.StreamEvent{Type: "done"}
+			data, _ := json.Marshal(doneEvent)
+			safeWrite([]byte("data: " + string(data) + "\n\n"))
+			log.Debug().Msg("Sent final 'done' event")
+		}
+	}()
+
+	// Execute with streaming
+	resp, err := h.aiService.ExecuteStream(ctx, ai.ExecuteRequest{
+		Prompt:     req.Prompt,
+		TargetType: req.TargetType,
+		TargetID:   req.TargetID,
+		Context:    req.Context,
+		History:    history,
+		FindingID:  req.FindingID,
+		Model:      req.Model,
+		UseCase:    useCase,
+	}, callback)
+
+	if err != nil {
+		log.Error().Err(err).Msg("AI streaming execution failed")
+		// Send error event
+		errEvent := ai.StreamEvent{Type: "error", Data: err.Error()}
+		data, _ := json.Marshal(errEvent)
+		safeWrite([]byte("data: " + string(data) + "\n\n"))
+		return
+	}
+
+	log.Info().
+		Str("model", resp.Model).
+		Int("input_tokens", resp.InputTokens).
+		Int("output_tokens", resp.OutputTokens).
+		Int("tool_calls", len(resp.ToolCalls)).
+		Msg("AI streaming request completed")
+
+	// Send final response with metadata (before 'done')
+	finalEvent := struct {
+		Type         string             `json:"type"`
+		Model        string             `json:"model"`
+		InputTokens  int                `json:"input_tokens"`
+		OutputTokens int                `json:"output_tokens"`
+		ToolCalls    []ai.ToolExecution `json:"tool_calls,omitempty"`
+	}{
+		Type:         "complete",
+		Model:        resp.Model,
+		InputTokens:  resp.InputTokens,
+		OutputTokens: resp.OutputTokens,
+		ToolCalls:    resp.ToolCalls,
+	}
+	data, _ := json.Marshal(finalEvent)
+	safeWrite([]byte("data: " + string(data) + "\n\n"))
+	// 'done' event is sent by the defer above
+}
+
+// AIRunCommandRequest is the request body for POST /api/ai/run-command
+type AIRunCommandRequest struct {
+	Command    string `json:"command"`
+	TargetType string `json:"target_type"`
+	TargetID   string `json:"target_id"`
+	RunOnHost  bool   `json:"run_on_host"`
+	VMID       string `json:"vmid,omitempty"`
+	TargetHost string `json:"target_host,omitempty"` // Explicit host for routing
+}
+
+// HandleRunCommand executes a single approved command (POST /api/ai/run-command)
+func (h *AISettingsHandler) HandleRunCommand(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Parse request
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+	bodyBytes, readErr := io.ReadAll(r.Body)
+	if readErr != nil {
+		log.Error().Err(readErr).Msg("Failed to read request body")
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+	log.Debug().Int("body_len", len(bodyBytes)).Msg("run-command request received")
+
+	var req AIRunCommandRequest
+	if err := json.Unmarshal(bodyBytes, &req); err != nil {
+		log.Error().Err(err).Str("body", string(bodyBytes)).Msg("Failed to decode JSON body")
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if strings.TrimSpace(req.Command) == "" {
+		http.Error(w, "Command is required", http.StatusBadRequest)
+		return
+	}
+
+	log.Info().
+		Str("command", req.Command).
+		Str("target_type", req.TargetType).
+		Str("target_id", req.TargetID).
+		Bool("run_on_host", req.RunOnHost).
+		Str("target_host", req.TargetHost).
+		Msg("Executing approved command")
+
+	// Execute with timeout (5 minutes for long-running commands)
+	ctx, cancel := context.WithTimeout(r.Context(), 300*time.Second)
+	defer cancel()
+
+	resp, err := h.aiService.RunCommand(ctx, ai.RunCommandRequest{
+		Command:    req.Command,
+		TargetType: req.TargetType,
+		TargetID:   req.TargetID,
+		RunOnHost:  req.RunOnHost,
+		VMID:       req.VMID,
+		TargetHost: req.TargetHost,
+	})
+
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to execute command")
+		http.Error(w, "Failed to execute command: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	if err := utils.WriteJSONResponse(w, resp); err != nil {
+		log.Error().Err(err).Msg("Failed to write run command response")
+	}
+}
+
+// HandleGetGuestKnowledge returns all notes for a guest
+func (h *AISettingsHandler) HandleGetGuestKnowledge(w http.ResponseWriter, r *http.Request) {
+	guestID := r.URL.Query().Get("guest_id")
+	if guestID == "" {
+		http.Error(w, "guest_id is required", http.StatusBadRequest)
+		return
+	}
+
+	knowledge, err := h.aiService.GetGuestKnowledge(guestID)
+	if err != nil {
+		http.Error(w, "Failed to get knowledge: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	if err := utils.WriteJSONResponse(w, knowledge); err != nil {
+		log.Error().Err(err).Msg("Failed to write knowledge response")
+	}
+}
+
+// HandleSaveGuestNote saves a note for a guest
+func (h *AISettingsHandler) HandleSaveGuestNote(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		GuestID   string `json:"guest_id"`
+		GuestName string `json:"guest_name"`
+		GuestType string `json:"guest_type"`
+		Category  string `json:"category"`
+		Title     string `json:"title"`
+		Content   string `json:"content"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.GuestID == "" || req.Category == "" || req.Title == "" || req.Content == "" {
+		http.Error(w, "guest_id, category, title, and content are required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.aiService.SaveGuestNote(req.GuestID, req.GuestName, req.GuestType, req.Category, req.Title, req.Content); err != nil {
+		http.Error(w, "Failed to save note: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(`{"success": true}`))
+}
+
+// HandleDeleteGuestNote deletes a note from a guest
+func (h *AISettingsHandler) HandleDeleteGuestNote(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		GuestID string `json:"guest_id"`
+		NoteID  string `json:"note_id"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.GuestID == "" || req.NoteID == "" {
+		http.Error(w, "guest_id and note_id are required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.aiService.DeleteGuestNote(req.GuestID, req.NoteID); err != nil {
+		http.Error(w, "Failed to delete note: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(`{"success": true}`))
+}
+
+// HandleExportGuestKnowledge exports all knowledge for a guest as JSON
+func (h *AISettingsHandler) HandleExportGuestKnowledge(w http.ResponseWriter, r *http.Request) {
+	guestID := r.URL.Query().Get("guest_id")
+	if guestID == "" {
+		http.Error(w, "guest_id is required", http.StatusBadRequest)
+		return
+	}
+
+	knowledge, err := h.aiService.GetGuestKnowledge(guestID)
+	if err != nil {
+		http.Error(w, "Failed to get knowledge: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	// Set headers for file download
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Content-Disposition", "attachment; filename=\"pulse-notes-"+guestID+".json\"")
+
+	if err := json.NewEncoder(w).Encode(knowledge); err != nil {
+		log.Error().Err(err).Msg("Failed to encode knowledge export")
+	}
+}
+
+// HandleImportGuestKnowledge imports knowledge from a JSON export
+func (h *AISettingsHandler) HandleImportGuestKnowledge(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Limit request body size to 1MB
+	r.Body = http.MaxBytesReader(w, r.Body, 1024*1024)
+
+	var importData struct {
+		GuestID   string `json:"guest_id"`
+		GuestName string `json:"guest_name"`
+		GuestType string `json:"guest_type"`
+		Notes     []struct {
+			Category string `json:"category"`
+			Title    string `json:"title"`
+			Content  string `json:"content"`
+		} `json:"notes"`
+		Merge bool `json:"merge"` // If true, add to existing notes; if false, replace
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&importData); err != nil {
+		http.Error(w, "Invalid import data: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	if importData.GuestID == "" {
+		http.Error(w, "guest_id is required in import data", http.StatusBadRequest)
+		return
+	}
+
+	if len(importData.Notes) == 0 {
+		http.Error(w, "No notes to import", http.StatusBadRequest)
+		return
+	}
+
+	// If not merging, we need to delete existing notes first
+	if !importData.Merge {
+		existing, err := h.aiService.GetGuestKnowledge(importData.GuestID)
+		if err == nil && existing != nil {
+			for _, note := range existing.Notes {
+				_ = h.aiService.DeleteGuestNote(importData.GuestID, note.ID)
+			}
+		}
+	}
+
+	// Import each note
+	imported := 0
+	for _, note := range importData.Notes {
+		if note.Category == "" || note.Title == "" || note.Content == "" {
+			continue
+		}
+		if err := h.aiService.SaveGuestNote(
+			importData.GuestID,
+			importData.GuestName,
+			importData.GuestType,
+			note.Category,
+			note.Title,
+			note.Content,
+		); err != nil {
+			log.Warn().Err(err).Str("title", note.Title).Msg("Failed to import note")
+			continue
+		}
+		imported++
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"success":  true,
+		"imported": imported,
+		"total":    len(importData.Notes),
+	})
+}
+
+// HandleClearGuestKnowledge deletes all notes for a guest
+func (h *AISettingsHandler) HandleClearGuestKnowledge(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var req struct {
+		GuestID string `json:"guest_id"`
+		Confirm bool   `json:"confirm"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.GuestID == "" {
+		http.Error(w, "guest_id is required", http.StatusBadRequest)
+		return
+	}
+
+	if !req.Confirm {
+		http.Error(w, "confirm must be true to clear all notes", http.StatusBadRequest)
+		return
+	}
+
+	// Get existing knowledge and delete all notes
+	existing, err := h.aiService.GetGuestKnowledge(req.GuestID)
+	if err != nil {
+		http.Error(w, "Failed to get knowledge: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	deleted := 0
+	for _, note := range existing.Notes {
+		if err := h.aiService.DeleteGuestNote(req.GuestID, note.ID); err != nil {
+			log.Warn().Err(err).Str("note_id", note.ID).Msg("Failed to delete note")
+			continue
+		}
+		deleted++
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"success": true,
+		"deleted": deleted,
+	})
+}
+
+// HandleDebugContext returns the system prompt and context that would be sent to the AI
+// This is useful for debugging when the AI gives incorrect information
+func (h *AISettingsHandler) HandleDebugContext(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Build a sample request to see what context would be sent
+	req := ai.ExecuteRequest{
+		Prompt:     "Debug context request",
+		TargetType: r.URL.Query().Get("target_type"),
+		TargetID:   r.URL.Query().Get("target_id"),
+	}
+
+	// Get the debug context from the service
+	debugInfo := h.aiService.GetDebugContext(req)
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(debugInfo)
+}
+
+// HandleGetConnectedAgents returns the list of agents currently connected via WebSocket
+// This is useful for debugging when AI can't reach certain hosts
+func (h *AISettingsHandler) HandleGetConnectedAgents(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	type agentInfo struct {
+		AgentID     string `json:"agent_id"`
+		Hostname    string `json:"hostname"`
+		Version     string `json:"version"`
+		Platform    string `json:"platform"`
+		ConnectedAt string `json:"connected_at"`
+	}
+
+	var agents []agentInfo
+	if h.agentServer != nil {
+		for _, a := range h.agentServer.GetConnectedAgents() {
+			agents = append(agents, agentInfo{
+				AgentID:     a.AgentID,
+				Hostname:    a.Hostname,
+				Version:     a.Version,
+				Platform:    a.Platform,
+				ConnectedAt: a.ConnectedAt.Format(time.RFC3339),
+			})
+		}
+	}
+
+	response := map[string]interface{}{
+		"count":  len(agents),
+		"agents": agents,
+		"note":   "Agents connect via WebSocket to /api/agent/ws. If a host is missing, check that pulse-agent is installed and can reach the Pulse server.",
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(response)
+}
+
+// AIInvestigateAlertRequest is the request body for POST /api/ai/investigate-alert
+type AIInvestigateAlertRequest struct {
+	AlertID      string  `json:"alert_id"`
+	ResourceID   string  `json:"resource_id"`
+	ResourceName string  `json:"resource_name"`
+	ResourceType string  `json:"resource_type"` // guest, node, storage, docker
+	AlertType    string  `json:"alert_type"`    // cpu, memory, disk, offline, etc.
+	Level        string  `json:"level"`         // warning, critical
+	Value        float64 `json:"value"`
+	Threshold    float64 `json:"threshold"`
+	Message      string  `json:"message"`
+	Duration     string  `json:"duration"` // How long the alert has been active
+	Node         string  `json:"node,omitempty"`
+	VMID         int     `json:"vmid,omitempty"`
+}
+
+// HandleInvestigateAlert investigates an alert using AI (POST /api/ai/investigate-alert)
+// This is a dedicated endpoint for one-click alert investigation from the UI
+func (h *AISettingsHandler) HandleInvestigateAlert(w http.ResponseWriter, r *http.Request) {
+	// Handle CORS
+	origin := r.Header.Get("Origin")
+	if origin != "" {
+		w.Header().Set("Access-Control-Allow-Origin", origin)
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
+		w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Accept, Cookie")
+		w.Header().Set("Vary", "Origin")
+	}
+
+	if r.Method == http.MethodOptions {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Check if AI is enabled
+	if !h.aiService.IsEnabled() {
+		http.Error(w, "AI is not enabled or configured", http.StatusBadRequest)
+		return
+	}
+
+	// Parse request
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+	var req AIInvestigateAlertRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	// Build investigation prompt
+	investigationPrompt := ai.GenerateAlertInvestigationPrompt(ai.AlertInvestigationRequest{
+		AlertID:      req.AlertID,
+		ResourceID:   req.ResourceID,
+		ResourceName: req.ResourceName,
+		ResourceType: req.ResourceType,
+		AlertType:    req.AlertType,
+		Level:        req.Level,
+		Value:        req.Value,
+		Threshold:    req.Threshold,
+		Message:      req.Message,
+		Duration:     req.Duration,
+		Node:         req.Node,
+		VMID:         req.VMID,
+	})
+
+	log.Info().
+		Str("alert_id", req.AlertID).
+		Str("resource", req.ResourceName).
+		Str("type", req.AlertType).
+		Msg("AI alert investigation started")
+
+	// Set up SSE streaming
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	w.Header().Set("Transfer-Encoding", "identity")
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "Streaming not supported", http.StatusInternalServerError)
+		return
+	}
+
+	// Disable write/read deadlines for SSE
+	rc := http.NewResponseController(w)
+	_ = rc.SetWriteDeadline(time.Time{})
+	_ = rc.SetReadDeadline(time.Time{})
+
+	flusher.Flush()
+
+	// Create context with timeout
+	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Second)
+	defer cancel()
+
+	// Heartbeat routine
+	heartbeatDone := make(chan struct{})
+	var clientDisconnected atomic.Bool
+	go func() {
+		ticker := time.NewTicker(5 * time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ticker.C:
+				_ = rc.SetWriteDeadline(time.Now().Add(10 * time.Second))
+				_, err := w.Write([]byte(": heartbeat\n\n"))
+				if err != nil {
+					clientDisconnected.Store(true)
+					return
+				}
+				flusher.Flush()
+			case <-heartbeatDone:
+				return
+			}
+		}
+	}()
+	defer close(heartbeatDone)
+
+	safeWrite := func(data []byte) bool {
+		if clientDisconnected.Load() {
+			return false
+		}
+		_ = rc.SetWriteDeadline(time.Now().Add(10 * time.Second))
+		_, err := w.Write(data)
+		if err != nil {
+			clientDisconnected.Store(true)
+			return false
+		}
+		flusher.Flush()
+		return true
+	}
+
+	// Determine target type and ID from alert info
+	targetType := req.ResourceType
+	targetID := req.ResourceID
+
+	// Map resource type to expected target type format
+	switch req.ResourceType {
+	case "guest":
+		// Could be VM or container - try to determine from VMID
+		if req.VMID > 0 {
+			targetType = "container" // Default to container, AI will figure it out
+		}
+	case "docker":
+		targetType = "docker_container"
+	}
+
+	// Stream callback
+	callback := func(event ai.StreamEvent) {
+		if event.Type == "done" {
+			return
+		}
+		data, err := json.Marshal(event)
+		if err != nil {
+			return
+		}
+		safeWrite([]byte("data: " + string(data) + "\n\n"))
+	}
+
+	// Execute with streaming
+	defer func() {
+		if !clientDisconnected.Load() {
+			doneEvent := ai.StreamEvent{Type: "done"}
+			data, _ := json.Marshal(doneEvent)
+			safeWrite([]byte("data: " + string(data) + "\n\n"))
+		}
+	}()
+
+	resp, err := h.aiService.ExecuteStream(ctx, ai.ExecuteRequest{
+		Prompt:     investigationPrompt,
+		TargetType: targetType,
+		TargetID:   targetID,
+		Context: map[string]interface{}{
+			"alertId":      req.AlertID,
+			"alertType":    req.AlertType,
+			"alertLevel":   req.Level,
+			"alertMessage": req.Message,
+			"guestName":    req.ResourceName,
+			"node":         req.Node,
+		},
+	}, callback)
+
+	if err != nil {
+		log.Error().Err(err).Msg("AI alert investigation failed")
+		errEvent := ai.StreamEvent{Type: "error", Data: err.Error()}
+		data, _ := json.Marshal(errEvent)
+		safeWrite([]byte("data: " + string(data) + "\n\n"))
+		return
+	}
+
+	// Send completion event
+	finalEvent := struct {
+		Type         string             `json:"type"`
+		Model        string             `json:"model"`
+		InputTokens  int                `json:"input_tokens"`
+		OutputTokens int                `json:"output_tokens"`
+		ToolCalls    []ai.ToolExecution `json:"tool_calls,omitempty"`
+	}{
+		Type:         "complete",
+		Model:        resp.Model,
+		InputTokens:  resp.InputTokens,
+		OutputTokens: resp.OutputTokens,
+		ToolCalls:    resp.ToolCalls,
+	}
+	data, _ := json.Marshal(finalEvent)
+	safeWrite([]byte("data: " + string(data) + "\n\n"))
+
+	log.Info().
+		Str("alert_id", req.AlertID).
+		Str("model", resp.Model).
+		Int("tool_calls", len(resp.ToolCalls)).
+		Msg("AI alert investigation completed")
+}
+
+// SetAlertProvider sets the alert provider for AI context
+func (h *AISettingsHandler) SetAlertProvider(ap ai.AlertProvider) {
+	h.aiService.SetAlertProvider(ap)
+}
+
+// oauthSessions stores active OAuth sessions (state -> session)
+// In production, consider using a more robust session store with expiry
+var oauthSessions = make(map[string]*providers.OAuthSession)
+var oauthSessionsMu sync.Mutex
+
+// HandleOAuthStart initiates the OAuth flow for Claude Pro/Max subscription (POST /api/ai/oauth/start)
+// Returns an authorization URL for the user to visit manually
+func (h *AISettingsHandler) HandleOAuthStart(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Generate OAuth session (redirect URI is not used since we use Anthropic's callback)
+	session, err := providers.GenerateOAuthSession("")
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to generate OAuth session")
+		http.Error(w, "Failed to start OAuth flow", http.StatusInternalServerError)
+		return
+	}
+
+	// Store session (with cleanup of old sessions)
+	oauthSessionsMu.Lock()
+	// Clean up sessions older than 15 minutes
+	for state, s := range oauthSessions {
+		if time.Since(s.CreatedAt) > 15*time.Minute {
+			delete(oauthSessions, state)
+		}
+	}
+	oauthSessions[session.State] = session
+	oauthSessionsMu.Unlock()
+
+	// Get authorization URL
+	authURL := providers.GetAuthorizationURL(session)
+
+	log.Info().
+		Str("state", safePrefixForLog(session.State, 8)+"...").
+		Str("verifier_len", fmt.Sprintf("%d", len(session.CodeVerifier))).
+		Str("auth_url", authURL).
+		Msg("Starting Claude OAuth flow - user must visit URL and paste code back")
+
+	// Return the URL for the user to visit
+	response := map[string]string{
+		"auth_url": authURL,
+		"state":    session.State,
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write OAuth start response")
+	}
+}
+
+// HandleOAuthExchange exchanges a manually-pasted authorization code for tokens (POST /api/ai/oauth/exchange)
+func (h *AISettingsHandler) HandleOAuthExchange(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Parse request body
+	var req struct {
+		Code  string `json:"code"`
+		State string `json:"state"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.Code == "" || req.State == "" {
+		http.Error(w, "Missing code or state", http.StatusBadRequest)
+		return
+	}
+
+	// Trim any whitespace from the code (user might have copied extra spaces)
+	code := strings.TrimSpace(req.Code)
+
+	// Anthropic's callback page displays the code as "code#state"
+	// We need to extract just the code part before the #
+	if idx := strings.Index(code, "#"); idx > 0 {
+		code = code[:idx]
+	}
+
+	log.Debug().
+		Str("code_len", fmt.Sprintf("%d", len(code))).
+		Str("code_prefix", code[:min(20, len(code))]).
+		Str("state_prefix", req.State[:min(8, len(req.State))]).
+		Msg("Processing OAuth code exchange")
+
+	// Look up session
+	oauthSessionsMu.Lock()
+	session, ok := oauthSessions[req.State]
+	if ok {
+		delete(oauthSessions, req.State) // One-time use
+	}
+	oauthSessionsMu.Unlock()
+
+	if !ok {
+		log.Error().Str("state", req.State[:min(8, len(req.State))]+"...").Msg("OAuth exchange with unknown state")
+		http.Error(w, "Invalid or expired session. Please start the OAuth flow again.", http.StatusBadRequest)
+		return
+	}
+
+	// Exchange code for tokens
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+
+	tokens, err := providers.ExchangeCodeForTokens(ctx, code, session)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to exchange OAuth code for tokens")
+		http.Error(w, "Failed to exchange authorization code: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	// Try to create an API key from the OAuth access token
+	// Team/Enterprise users get org:create_api_key scope and can create API keys
+	// Pro/Max users don't have this scope and will use OAuth tokens directly
+	apiKey, err := providers.CreateAPIKeyFromOAuth(ctx, tokens.AccessToken)
+	if err != nil {
+		// Check if it's a permission error (Pro/Max users)
+		if strings.Contains(err.Error(), "org:create_api_key") || strings.Contains(err.Error(), "403") {
+			log.Info().Msg("User doesn't have org:create_api_key permission - will use OAuth tokens directly")
+			// This is fine for Pro/Max users - they'll use OAuth tokens
+		} else {
+			log.Error().Err(err).Msg("Failed to create API key from OAuth token")
+			http.Error(w, "Failed to create API key: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+	}
+
+	if apiKey != "" {
+		log.Info().Msg("Successfully created API key from OAuth - using subscription-based billing")
+	}
+
+	// Load existing settings
+	settings, err := h.persistence.LoadAIConfig()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to load AI settings for OAuth")
+		settings = config.NewDefaultAIConfig()
+	}
+	if settings == nil {
+		settings = config.NewDefaultAIConfig()
+	}
+
+	// Update settings
+	settings.Provider = config.AIProviderAnthropic
+	settings.AuthMethod = config.AuthMethodOAuth
+	settings.OAuthAccessToken = tokens.AccessToken
+	settings.OAuthRefreshToken = tokens.RefreshToken
+	settings.OAuthExpiresAt = tokens.ExpiresAt
+	settings.Enabled = true
+
+	// If we got an API key, use it; otherwise use OAuth tokens directly
+	if apiKey != "" {
+		settings.APIKey = apiKey
+	} else {
+		// Pro/Max users: clear any old API key, will use OAuth client
+		settings.ClearAPIKey()
+	}
+
+	// Save settings
+	if err := h.persistence.SaveAIConfig(*settings); err != nil {
+		log.Error().Err(err).Msg("Failed to save OAuth tokens")
+		http.Error(w, "Failed to save OAuth credentials", http.StatusInternalServerError)
+		return
+	}
+
+	// Reload the AI service with new settings
+	if err := h.aiService.Reload(); err != nil {
+		log.Warn().Err(err).Msg("Failed to reload AI service after OAuth setup")
+	}
+
+	log.Info().Msg("Claude OAuth authentication successful")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Successfully connected to Claude with your subscription",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write OAuth exchange response")
+	}
+}
+
+// HandleOAuthCallback handles the OAuth callback (GET /api/ai/oauth/callback)
+// This is kept for backwards compatibility but mainly serves as a fallback
+func (h *AISettingsHandler) HandleOAuthCallback(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Get code and state from query params
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	errParam := r.URL.Query().Get("error")
+	errDesc := r.URL.Query().Get("error_description")
+
+	// Check for OAuth error
+	if errParam != "" {
+		log.Error().
+			Str("error", errParam).
+			Str("description", errDesc).
+			Msg("OAuth authorization failed")
+		// Redirect to settings page with error
+		http.Redirect(w, r, "/settings?ai_oauth_error="+errParam, http.StatusTemporaryRedirect)
+		return
+	}
+
+	if code == "" || state == "" {
+		log.Error().Msg("OAuth callback missing code or state")
+		http.Redirect(w, r, "/settings?ai_oauth_error=missing_params", http.StatusTemporaryRedirect)
+		return
+	}
+
+	// Look up session
+	oauthSessionsMu.Lock()
+	session, ok := oauthSessions[state]
+	if ok {
+		delete(oauthSessions, state) // One-time use
+	}
+	oauthSessionsMu.Unlock()
+
+	if !ok {
+		log.Error().Str("state", state).Msg("OAuth callback with unknown state")
+		http.Redirect(w, r, "/settings?ai_oauth_error=invalid_state", http.StatusTemporaryRedirect)
+		return
+	}
+
+	// Exchange code for tokens
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+
+	tokens, err := providers.ExchangeCodeForTokens(ctx, code, session)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to exchange OAuth code for tokens")
+		http.Redirect(w, r, "/settings?ai_oauth_error=token_exchange_failed", http.StatusTemporaryRedirect)
+		return
+	}
+
+	// Load existing settings
+	settings, err := h.persistence.LoadAIConfig()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to load AI settings for OAuth")
+		settings = config.NewDefaultAIConfig()
+	}
+	if settings == nil {
+		settings = config.NewDefaultAIConfig()
+	}
+
+	// Update settings with OAuth tokens
+	settings.Provider = config.AIProviderAnthropic
+	settings.AuthMethod = config.AuthMethodOAuth
+	settings.OAuthAccessToken = tokens.AccessToken
+	settings.OAuthRefreshToken = tokens.RefreshToken
+	settings.OAuthExpiresAt = tokens.ExpiresAt
+	settings.Enabled = true
+	// Clear API key since we're using OAuth
+	settings.ClearAPIKey()
+
+	// Save settings
+	if err := h.persistence.SaveAIConfig(*settings); err != nil {
+		log.Error().Err(err).Msg("Failed to save OAuth tokens")
+		http.Redirect(w, r, "/settings?ai_oauth_error=save_failed", http.StatusTemporaryRedirect)
+		return
+	}
+
+	// Reload the AI service with new settings
+	if err := h.aiService.Reload(); err != nil {
+		log.Warn().Err(err).Msg("Failed to reload AI service after OAuth setup")
+	}
+
+	log.Info().Msg("Claude OAuth authentication successful")
+
+	// Redirect to settings page with success
+	http.Redirect(w, r, "/settings?ai_oauth_success=true", http.StatusTemporaryRedirect)
+}
+
+// HandleOAuthDisconnect disconnects OAuth and clears tokens (POST /api/ai/oauth/disconnect)
+func (h *AISettingsHandler) HandleOAuthDisconnect(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require admin authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	// Load existing settings
+	settings, err := h.persistence.LoadAIConfig()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to load AI settings for OAuth disconnect")
+		http.Error(w, "Failed to load settings", http.StatusInternalServerError)
+		return
+	}
+	if settings == nil {
+		settings = config.NewDefaultAIConfig()
+	}
+
+	// Clear OAuth tokens
+	settings.ClearOAuthTokens()
+	settings.AuthMethod = config.AuthMethodAPIKey
+
+	// Save settings
+	if err := h.persistence.SaveAIConfig(*settings); err != nil {
+		log.Error().Err(err).Msg("Failed to save settings after OAuth disconnect")
+		http.Error(w, "Failed to save settings", http.StatusInternalServerError)
+		return
+	}
+
+	// Reload the AI service
+	if err := h.aiService.Reload(); err != nil {
+		log.Warn().Err(err).Msg("Failed to reload AI service after OAuth disconnect")
+	}
+
+	log.Info().Msg("Claude OAuth disconnected")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "OAuth disconnected successfully",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write OAuth disconnect response")
+	}
+}
+
+// PatrolStatusResponse is the response for GET /api/ai/patrol/status
+type PatrolStatusResponse struct {
+	Running          bool       `json:"running"`
+	Enabled          bool       `json:"enabled"`
+	LastPatrolAt     *time.Time `json:"last_patrol_at,omitempty"`
+	LastDeepAnalysis *time.Time `json:"last_deep_analysis_at,omitempty"`
+	NextPatrolAt     *time.Time `json:"next_patrol_at,omitempty"`
+	LastDurationMs   int64      `json:"last_duration_ms"`
+	ResourcesChecked int        `json:"resources_checked"`
+	FindingsCount    int        `json:"findings_count"`
+	Healthy          bool       `json:"healthy"`
+	Summary          struct {
+		Critical int `json:"critical"`
+		Warning  int `json:"warning"`
+		Watch    int `json:"watch"`
+		Info     int `json:"info"`
+	} `json:"summary"`
+}
+
+// HandleGetPatrolStatus returns the current patrol status (GET /api/ai/patrol/status)
+func (h *AISettingsHandler) HandleGetPatrolStatus(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		// Patrol not initialized
+		response := PatrolStatusResponse{
+			Running: false,
+			Enabled: false,
+			Healthy: true,
+		}
+		if err := utils.WriteJSONResponse(w, response); err != nil {
+			log.Error().Err(err).Msg("Failed to write patrol status response")
+		}
+		return
+	}
+
+	status := patrol.GetStatus()
+	summary := patrol.GetFindingsSummary()
+
+	response := PatrolStatusResponse{
+		Running:          status.Running,
+		Enabled:          h.aiService.IsEnabled(),
+		LastPatrolAt:     status.LastPatrolAt,
+		NextPatrolAt:     status.NextPatrolAt,
+		LastDurationMs:   status.LastDuration.Milliseconds(),
+		ResourcesChecked: status.ResourcesChecked,
+		FindingsCount:    status.FindingsCount,
+		Healthy:          status.Healthy,
+	}
+	response.Summary.Critical = summary.Critical
+	response.Summary.Warning = summary.Warning
+	response.Summary.Watch = summary.Watch
+	response.Summary.Info = summary.Info
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write patrol status response")
+	}
+}
+
+// HandlePatrolStream streams real-time patrol analysis via SSE (GET /api/ai/patrol/stream)
+func (h *AISettingsHandler) HandlePatrolStream(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	// Set SSE headers
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "Streaming not supported", http.StatusInternalServerError)
+		return
+	}
+
+	// Subscribe to patrol stream
+	// Note: SubscribeToStream already sends the current buffered output to the channel
+	ch := patrol.SubscribeToStream()
+	defer patrol.UnsubscribeFromStream(ch)
+
+	// Stream events until client disconnects
+	ctx := r.Context()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case event, ok := <-ch:
+			if !ok {
+				return
+			}
+			data, err := json.Marshal(event)
+			if err != nil {
+				continue
+			}
+			fmt.Fprintf(w, "data: %s\n\n", data)
+			flusher.Flush()
+		}
+	}
+}
+
+// HandleGetPatrolFindings returns all active findings (GET /api/ai/patrol/findings)
+func (h *AISettingsHandler) HandleGetPatrolFindings(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		// Return empty findings
+		if err := utils.WriteJSONResponse(w, []interface{}{}); err != nil {
+			log.Error().Err(err).Msg("Failed to write patrol findings response")
+		}
+		return
+	}
+
+	// Check for resource_id query parameter
+	resourceID := r.URL.Query().Get("resource_id")
+	var findings []*ai.Finding
+	if resourceID != "" {
+		findings = patrol.GetFindingsForResource(resourceID)
+	} else {
+		findings = patrol.GetAllFindings()
+	}
+
+	if err := utils.WriteJSONResponse(w, findings); err != nil {
+		log.Error().Err(err).Msg("Failed to write patrol findings response")
+	}
+}
+
+// HandleForcePatrol triggers an immediate patrol run (POST /api/ai/patrol/run)
+func (h *AISettingsHandler) HandleForcePatrol(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require admin authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	// Check for deep=true query parameter
+	deep := r.URL.Query().Get("deep") == "true"
+
+	// Trigger patrol asynchronously
+	patrol.ForcePatrol(r.Context(), deep)
+
+	patrolType := "quick"
+	if deep {
+		patrolType = "deep"
+	}
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": fmt.Sprintf("Triggered %s patrol run", patrolType),
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write force patrol response")
+	}
+}
+
+// HandleAcknowledgeFinding acknowledges a finding (POST /api/ai/patrol/acknowledge)
+// This marks the finding as seen but keeps it visible (dimmed). Auto-resolve removes it when condition clears.
+// This matches alert acknowledgement behavior for UI consistency.
+func (h *AISettingsHandler) HandleAcknowledgeFinding(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		FindingID string `json:"finding_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.FindingID == "" {
+		http.Error(w, "finding_id is required", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+
+	// Just acknowledge - don't resolve. Finding stays visible but marked as seen.
+	// Auto-resolve will remove it when the underlying condition clears.
+	if !findings.Acknowledge(req.FindingID) {
+		http.Error(w, "Finding not found", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("finding_id", req.FindingID).
+		Msg("AI Patrol: Finding acknowledged by user")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Finding acknowledged",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write acknowledge response")
+	}
+}
+
+// HandleSnoozeFinding snoozes a finding for a specified duration (POST /api/ai/patrol/snooze)
+// Snoozed findings are hidden from the active list but will reappear if condition persists after snooze expires
+func (h *AISettingsHandler) HandleSnoozeFinding(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		FindingID     string `json:"finding_id"`
+		DurationHours int    `json:"duration_hours"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.FindingID == "" {
+		http.Error(w, "finding_id is required", http.StatusBadRequest)
+		return
+	}
+
+	if req.DurationHours <= 0 {
+		http.Error(w, "duration_hours must be positive", http.StatusBadRequest)
+		return
+	}
+
+	// Cap snooze duration at 7 days
+	if req.DurationHours > 168 {
+		req.DurationHours = 168
+	}
+
+	findings := patrol.GetFindings()
+	duration := time.Duration(req.DurationHours) * time.Hour
+
+	if !findings.Snooze(req.FindingID, duration) {
+		http.Error(w, "Finding not found or already resolved", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("finding_id", req.FindingID).
+		Int("hours", req.DurationHours).
+		Msg("AI Patrol: Finding snoozed by user")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": fmt.Sprintf("Finding snoozed for %d hours", req.DurationHours),
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write snooze response")
+	}
+}
+
+// HandleResolveFinding manually marks a finding as resolved (POST /api/ai/patrol/resolve)
+// Use this when the user has fixed the issue and wants to mark it as resolved
+func (h *AISettingsHandler) HandleResolveFinding(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		FindingID string `json:"finding_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.FindingID == "" {
+		http.Error(w, "finding_id is required", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+
+	// Mark as manually resolved (auto=false since user did it)
+	if !findings.Resolve(req.FindingID, false) {
+		http.Error(w, "Finding not found or already resolved", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("finding_id", req.FindingID).
+		Msg("AI Patrol: Finding manually resolved by user")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Finding marked as resolved",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write resolve response")
+	}
+}
+
+// HandleDismissFinding dismisses a finding with a reason and optional note (POST /api/ai/patrol/dismiss)
+// This is part of the LLM memory system - dismissed findings are included in context to prevent re-raising
+// Valid reasons: "not_an_issue", "expected_behavior", "will_fix_later"
+func (h *AISettingsHandler) HandleDismissFinding(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		FindingID string `json:"finding_id"`
+		Reason    string `json:"reason"` // "not_an_issue", "expected_behavior", "will_fix_later"
+		Note      string `json:"note"`   // Optional freeform note
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.FindingID == "" {
+		http.Error(w, "finding_id is required", http.StatusBadRequest)
+		return
+	}
+
+	// Validate reason
+	validReasons := map[string]bool{
+		"not_an_issue":      true,
+		"expected_behavior": true,
+		"will_fix_later":    true,
+	}
+	if req.Reason != "" && !validReasons[req.Reason] {
+		http.Error(w, "Invalid reason. Valid values: not_an_issue, expected_behavior, will_fix_later", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+
+	if !findings.Dismiss(req.FindingID, req.Reason, req.Note) {
+		http.Error(w, "Finding not found", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("finding_id", req.FindingID).
+		Str("reason", req.Reason).
+		Bool("has_note", req.Note != "").
+		Msg("AI Patrol: Finding dismissed by user with reason")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Finding dismissed",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write dismiss response")
+	}
+}
+
+// HandleSuppressFinding permanently suppresses similar findings for a resource (POST /api/ai/patrol/suppress)
+// The LLM will be told never to re-raise findings of this type for this resource
+func (h *AISettingsHandler) HandleSuppressFinding(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		FindingID string `json:"finding_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.FindingID == "" {
+		http.Error(w, "finding_id is required", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+
+	if !findings.Suppress(req.FindingID) {
+		http.Error(w, "Finding not found", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("finding_id", req.FindingID).
+		Msg("AI Patrol: Finding type permanently suppressed by user")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Finding type suppressed - similar issues will not be raised again",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write suppress response")
+	}
+}
+
+// HandleGetFindingsHistory returns all findings including resolved for history (GET /api/ai/patrol/history)
+func (h *AISettingsHandler) HandleGetFindingsHistory(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		// Return empty history
+		if err := utils.WriteJSONResponse(w, []interface{}{}); err != nil {
+			log.Error().Err(err).Msg("Failed to write findings history response")
+		}
+		return
+	}
+
+	// Parse optional startTime query parameter
+	var startTime *time.Time
+	if startTimeStr := r.URL.Query().Get("start_time"); startTimeStr != "" {
+		if t, err := time.Parse(time.RFC3339, startTimeStr); err == nil {
+			startTime = &t
+		}
+	}
+
+	findings := patrol.GetFindingsHistory(startTime)
+
+	if err := utils.WriteJSONResponse(w, findings); err != nil {
+		log.Error().Err(err).Msg("Failed to write findings history response")
+	}
+}
+
+// HandleGetPatrolRunHistory returns the history of patrol check runs (GET /api/ai/patrol/runs)
+func (h *AISettingsHandler) HandleGetPatrolRunHistory(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		// Return empty history
+		if err := utils.WriteJSONResponse(w, []interface{}{}); err != nil {
+			log.Error().Err(err).Msg("Failed to write patrol run history response")
+		}
+		return
+	}
+
+	// Parse optional limit query parameter (default: 50)
+	limit := 50
+	if limitStr := r.URL.Query().Get("limit"); limitStr != "" {
+		if l, err := fmt.Sscanf(limitStr, "%d", &limit); err == nil && l > 0 {
+			if limit > 100 {
+				limit = 100 // Cap at MaxPatrolRunHistory
+			}
+		}
+	}
+
+	runs := patrol.GetRunHistory(limit)
+
+	if err := utils.WriteJSONResponse(w, runs); err != nil {
+		log.Error().Err(err).Msg("Failed to write patrol run history response")
+	}
+}
+
+// HandleGetAICostSummary returns AI usage rollups (GET /api/ai/cost/summary?days=N).
+func (h *AISettingsHandler) HandleGetAICostSummary(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Parse optional days query parameter (default: 30, max: 365)
+	days := 30
+	if daysStr := r.URL.Query().Get("days"); daysStr != "" {
+		if _, err := fmt.Sscanf(daysStr, "%d", &days); err == nil && days > 0 {
+			if days > 365 {
+				days = 365
+			}
+		}
+	}
+
+	var summary cost.Summary
+	if h.aiService != nil {
+		summary = h.aiService.GetCostSummary(days)
+	} else {
+		summary = cost.Summary{
+			Days:           days,
+			PricingAsOf:    cost.PricingAsOf(),
+			ProviderModels: []cost.ProviderModelSummary{},
+			DailyTotals:    []cost.DailySummary{},
+			Totals:         cost.ProviderModelSummary{Provider: "all"},
+		}
+	}
+
+	if err := utils.WriteJSONResponse(w, summary); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI cost summary response")
+	}
+}
+
+// HandleResetAICostHistory deletes retained AI usage events (POST /api/ai/cost/reset).
+func (h *AISettingsHandler) HandleResetAICostHistory(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.aiService == nil {
+		http.Error(w, "AI service unavailable", http.StatusServiceUnavailable)
+		return
+	}
+
+	backupFile := ""
+	if h.persistence != nil {
+		configDir := h.persistence.DataDir()
+		if strings.TrimSpace(configDir) != "" {
+			usagePath := filepath.Join(configDir, "ai_usage_history.json")
+			if _, err := os.Stat(usagePath); err == nil {
+				ts := time.Now().UTC().Format("20060102-150405")
+				backupFile = fmt.Sprintf("ai_usage_history.json.bak-%s", ts)
+				backupPath := filepath.Join(configDir, backupFile)
+				if err := os.Rename(usagePath, backupPath); err != nil {
+					log.Error().Err(err).Str("path", usagePath).Msg("Failed to backup AI usage history before reset")
+					http.Error(w, "Failed to backup AI usage history", http.StatusInternalServerError)
+					return
+				}
+			}
+		}
+	}
+
+	if err := h.aiService.ClearCostHistory(); err != nil {
+		log.Error().Err(err).Msg("Failed to clear AI cost history")
+		http.Error(w, "Failed to clear AI cost history", http.StatusInternalServerError)
+		return
+	}
+
+	resp := map[string]any{"ok": true}
+	if backupFile != "" {
+		resp["backup_file"] = backupFile
+	}
+
+	if err := utils.WriteJSONResponse(w, resp); err != nil {
+		log.Error().Err(err).Msg("Failed to write clear cost history response")
+	}
+}
+
+// HandleExportAICostHistory exports recent AI usage history as JSON or CSV (GET /api/ai/cost/export?days=N&format=csv|json).
+func (h *AISettingsHandler) HandleExportAICostHistory(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	if h.aiService == nil {
+		http.Error(w, "AI service unavailable", http.StatusServiceUnavailable)
+		return
+	}
+
+	days := 30
+	if daysStr := r.URL.Query().Get("days"); daysStr != "" {
+		if v, err := strconv.Atoi(daysStr); err == nil && v > 0 {
+			if v > 365 {
+				v = 365
+			}
+			days = v
+		}
+	}
+
+	format := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("format")))
+	if format == "" {
+		format = "json"
+	}
+	if format != "json" && format != "csv" {
+		http.Error(w, "format must be 'json' or 'csv'", http.StatusBadRequest)
+		return
+	}
+
+	events := h.aiService.ListCostEvents(days)
+
+	filename := fmt.Sprintf("pulse-ai-usage-%s-%dd.%s", time.Now().UTC().Format("20060102"), days, format)
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
+
+	if format == "json" {
+		w.Header().Set("Content-Type", "application/json")
+		type exportEvent struct {
+			cost.UsageEvent
+			EstimatedUSD float64 `json:"estimated_usd,omitempty"`
+			PricingKnown bool    `json:"pricing_known"`
+		}
+		exported := make([]exportEvent, 0, len(events))
+		for _, e := range events {
+			provider, model := cost.ResolveProviderAndModel(e.Provider, e.RequestModel, e.ResponseModel)
+			usd, ok, _ := cost.EstimateUSD(provider, model, int64(e.InputTokens), int64(e.OutputTokens))
+			exported = append(exported, exportEvent{
+				UsageEvent:   e,
+				EstimatedUSD: usd,
+				PricingKnown: ok,
+			})
+		}
+		resp := map[string]any{
+			"days":   days,
+			"events": exported,
+		}
+		if err := json.NewEncoder(w).Encode(resp); err != nil {
+			log.Error().Err(err).Msg("Failed to write AI cost export JSON")
+		}
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/csv")
+	cw := csv.NewWriter(w)
+	_ = cw.Write([]string{
+		"timestamp",
+		"provider",
+		"request_model",
+		"response_model",
+		"use_case",
+		"input_tokens",
+		"output_tokens",
+		"estimated_usd",
+		"pricing_known",
+		"target_type",
+		"target_id",
+		"finding_id",
+	})
+	for _, e := range events {
+		provider, model := cost.ResolveProviderAndModel(e.Provider, e.RequestModel, e.ResponseModel)
+		usd, ok, _ := cost.EstimateUSD(provider, model, int64(e.InputTokens), int64(e.OutputTokens))
+
+		_ = cw.Write([]string{
+			e.Timestamp.UTC().Format(time.RFC3339Nano),
+			e.Provider,
+			e.RequestModel,
+			e.ResponseModel,
+			e.UseCase,
+			strconv.Itoa(e.InputTokens),
+			strconv.Itoa(e.OutputTokens),
+			strconv.FormatFloat(usd, 'f', 6, 64),
+			strconv.FormatBool(ok),
+			e.TargetType,
+			e.TargetID,
+			e.FindingID,
+		})
+	}
+	cw.Flush()
+	if err := cw.Error(); err != nil {
+		log.Error().Err(err).Msg("Failed to write AI cost export CSV")
+	}
+}
+
+// HandleGetSuppressionRules returns all suppression rules (GET /api/ai/patrol/suppressions)
+func (h *AISettingsHandler) HandleGetSuppressionRules(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, []interface{}{}); err != nil {
+			log.Error().Err(err).Msg("Failed to write suppression rules response")
+		}
+		return
+	}
+
+	findings := patrol.GetFindings()
+	rules := findings.GetSuppressionRules()
+
+	if err := utils.WriteJSONResponse(w, rules); err != nil {
+		log.Error().Err(err).Msg("Failed to write suppression rules response")
+	}
+}
+
+// HandleAddSuppressionRule creates a new suppression rule (POST /api/ai/patrol/suppressions)
+func (h *AISettingsHandler) HandleAddSuppressionRule(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	var req struct {
+		ResourceID   string `json:"resource_id"`   // Can be empty for "any resource"
+		ResourceName string `json:"resource_name"` // Human-readable name
+		Category     string `json:"category"`      // Can be empty for "any category"
+		Description  string `json:"description"`   // Required - user's reason
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.Description == "" {
+		http.Error(w, "description is required", http.StatusBadRequest)
+		return
+	}
+
+	// Convert category string to FindingCategory
+	var category ai.FindingCategory
+	switch req.Category {
+	case "performance":
+		category = ai.FindingCategoryPerformance
+	case "capacity":
+		category = ai.FindingCategoryCapacity
+	case "reliability":
+		category = ai.FindingCategoryReliability
+	case "backup":
+		category = ai.FindingCategoryBackup
+	case "security":
+		category = ai.FindingCategorySecurity
+	case "general":
+		category = ai.FindingCategoryGeneral
+	case "":
+		category = "" // Any category
+	default:
+		http.Error(w, "Invalid category", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+	rule := findings.AddSuppressionRule(req.ResourceID, req.ResourceName, category, req.Description)
+
+	log.Info().
+		Str("rule_id", rule.ID).
+		Str("resource_id", req.ResourceID).
+		Str("category", req.Category).
+		Str("description", req.Description).
+		Msg("AI Patrol: Manual suppression rule created")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Suppression rule created",
+		"rule":    rule,
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write add suppression rule response")
+	}
+}
+
+// HandleDeleteSuppressionRule removes a suppression rule (DELETE /api/ai/patrol/suppressions/:id)
+func (h *AISettingsHandler) HandleDeleteSuppressionRule(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		http.Error(w, "Patrol service not available", http.StatusServiceUnavailable)
+		return
+	}
+
+	// Get rule ID from URL path
+	ruleID := strings.TrimPrefix(r.URL.Path, "/api/ai/patrol/suppressions/")
+	if ruleID == "" {
+		http.Error(w, "rule_id is required", http.StatusBadRequest)
+		return
+	}
+
+	findings := patrol.GetFindings()
+
+	if !findings.DeleteSuppressionRule(ruleID) {
+		http.Error(w, "Rule not found", http.StatusNotFound)
+		return
+	}
+
+	log.Info().
+		Str("rule_id", ruleID).
+		Msg("AI Patrol: Suppression rule deleted")
+
+	response := map[string]interface{}{
+		"success": true,
+		"message": "Suppression rule deleted",
+	}
+
+	if err := utils.WriteJSONResponse(w, response); err != nil {
+		log.Error().Err(err).Msg("Failed to write delete suppression rule response")
+	}
+}
+
+// HandleGetDismissedFindings returns all dismissed/suppressed findings (GET /api/ai/patrol/dismissed)
+func (h *AISettingsHandler) HandleGetDismissedFindings(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Require authentication
+	if !CheckAuth(h.config, w, r) {
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, []interface{}{}); err != nil {
+			log.Error().Err(err).Msg("Failed to write dismissed findings response")
+		}
+		return
+	}
+
+	findings := patrol.GetFindings()
+	dismissed := findings.GetDismissedFindings()
+
+	if err := utils.WriteJSONResponse(w, dismissed); err != nil {
+		log.Error().Err(err).Msg("Failed to write dismissed findings response")
+	}
+}
diff --git a/internal/api/ai_intelligence_handlers.go b/internal/api/ai_intelligence_handlers.go
new file mode 100644
index 0000000..6058fa6
--- /dev/null
+++ b/internal/api/ai_intelligence_handlers.go
@@ -0,0 +1,321 @@
+package api
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai"
+	"github.com/rcourtman/pulse-go-rewrite/internal/utils"
+	"github.com/rs/zerolog/log"
+)
+
+// HandleGetPatterns returns detected failure patterns (GET /api/ai/intelligence/patterns)
+func (h *AISettingsHandler) HandleGetPatterns(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"patterns": []interface{}{},
+			"message":  "Patrol service not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write patterns response")
+		}
+		return
+	}
+
+	detector := patrol.GetPatternDetector()
+	if detector == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"patterns": []interface{}{},
+			"message":  "Pattern detector not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write patterns response")
+		}
+		return
+	}
+
+	// Get resource filter if provided
+	resourceID := r.URL.Query().Get("resource_id")
+	
+	patterns := detector.GetPatterns()
+	var result []map[string]interface{}
+	
+	for key, pattern := range patterns {
+		if resourceID != "" && pattern.ResourceID != resourceID {
+			continue
+		}
+		result = append(result, map[string]interface{}{
+			"key":              key,
+			"resource_id":      pattern.ResourceID,
+			"event_type":       pattern.EventType,
+			"occurrences":      pattern.Occurrences,
+			"average_interval": pattern.AverageInterval.String(),
+			"average_duration": pattern.AverageDuration.String(),
+			"last_occurrence":  pattern.LastOccurrence,
+			"confidence":       pattern.Confidence,
+		})
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]interface{}{
+		"patterns": result,
+		"count":    len(result),
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to write patterns response")
+	}
+}
+
+// HandleGetPredictions returns failure predictions (GET /api/ai/intelligence/predictions)
+func (h *AISettingsHandler) HandleGetPredictions(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"predictions": []interface{}{},
+			"message":     "Patrol service not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write predictions response")
+		}
+		return
+	}
+
+	detector := patrol.GetPatternDetector()
+	if detector == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"predictions": []interface{}{},
+			"message":     "Pattern detector not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write predictions response")
+		}
+		return
+	}
+
+	// Get resource filter if provided
+	resourceID := r.URL.Query().Get("resource_id")
+	
+	var predictions []ai.FailurePrediction
+	if resourceID != "" {
+		predictions = detector.GetPredictionsForResource(resourceID)
+	} else {
+		predictions = detector.GetPredictions()
+	}
+
+	var result []map[string]interface{}
+	for _, pred := range predictions {
+		isOverdue := pred.DaysUntil < 0
+		result = append(result, map[string]interface{}{
+			"resource_id":  pred.ResourceID,
+			"event_type":   pred.EventType,
+			"predicted_at": pred.PredictedAt,
+			"days_until":   pred.DaysUntil,
+			"confidence":   pred.Confidence,
+			"basis":        pred.Basis,
+			"is_overdue":   isOverdue,
+		})
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]interface{}{
+		"predictions": result,
+		"count":       len(result),
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to write predictions response")
+	}
+}
+
+// HandleGetCorrelations returns detected resource correlations (GET /api/ai/intelligence/correlations)
+func (h *AISettingsHandler) HandleGetCorrelations(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"correlations": []interface{}{},
+			"message":      "Patrol service not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write correlations response")
+		}
+		return
+	}
+
+	detector := patrol.GetCorrelationDetector()
+	if detector == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"correlations": []interface{}{},
+			"message":      "Correlation detector not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write correlations response")
+		}
+		return
+	}
+
+	// Get resource filter if provided
+	resourceID := r.URL.Query().Get("resource_id")
+	
+	var correlations []*ai.Correlation
+	if resourceID != "" {
+		correlations = detector.GetCorrelationsForResource(resourceID)
+	} else {
+		correlations = detector.GetCorrelations()
+	}
+
+	var result []map[string]interface{}
+	for _, corr := range correlations {
+		result = append(result, map[string]interface{}{
+			"source_id":     corr.SourceID,
+			"source_name":   corr.SourceName,
+			"source_type":   corr.SourceType,
+			"target_id":     corr.TargetID,
+			"target_name":   corr.TargetName,
+			"target_type":   corr.TargetType,
+			"event_pattern": corr.EventPattern,
+			"occurrences":   corr.Occurrences,
+			"avg_delay":     corr.AvgDelay.String(),
+			"confidence":    corr.Confidence,
+			"last_seen":     corr.LastSeen,
+			"description":   corr.Description,
+		})
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]interface{}{
+		"correlations": result,
+		"count":        len(result),
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to write correlations response")
+	}
+}
+
+// HandleGetRecentChanges returns recent infrastructure changes (GET /api/ai/intelligence/changes)
+func (h *AISettingsHandler) HandleGetRecentChanges(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"changes": []interface{}{},
+			"message": "Patrol service not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write changes response")
+		}
+		return
+	}
+
+	detector := patrol.GetChangeDetector()
+	if detector == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"changes": []interface{}{},
+			"message": "Change detector not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write changes response")
+		}
+		return
+	}
+
+	// Get time range - default to 24 hours
+	hoursStr := r.URL.Query().Get("hours")
+	hours := 24
+	if hoursStr != "" {
+		if h, err := strconv.Atoi(hoursStr); err == nil && h > 0 {
+			hours = h
+		}
+	}
+	
+	since := time.Now().Add(-time.Duration(hours) * time.Hour)
+	changes := detector.GetRecentChanges(100, since)
+
+	var result []map[string]interface{}
+	for _, change := range changes {
+		result = append(result, map[string]interface{}{
+			"id":            change.ID,
+			"resource_id":   change.ResourceID,
+			"resource_name": change.ResourceName,
+			"resource_type": change.ResourceType,
+			"change_type":   change.ChangeType,
+			"before":        change.Before,
+			"after":         change.After,
+			"detected_at":   change.DetectedAt,
+			"description":   change.Description,
+		})
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]interface{}{
+		"changes": result,
+		"count":   len(result),
+		"hours":   hours,
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to write changes response")
+	}
+}
+
+// HandleGetBaselines returns learned resource baselines (GET /api/ai/intelligence/baselines)
+func (h *AISettingsHandler) HandleGetBaselines(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	patrol := h.aiService.GetPatrolService()
+	if patrol == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"baselines": []interface{}{},
+			"message":   "Patrol service not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write baselines response")
+		}
+		return
+	}
+
+	store := patrol.GetBaselineStore()
+	if store == nil {
+		if err := utils.WriteJSONResponse(w, map[string]interface{}{
+			"baselines": []interface{}{},
+			"message":   "Baseline store not initialized",
+		}); err != nil {
+			log.Error().Err(err).Msg("Failed to write baselines response")
+		}
+		return
+	}
+
+	// Get resource filter if provided
+	resourceID := r.URL.Query().Get("resource_id")
+	
+	baselines := store.GetAllBaselines()
+	var result []map[string]interface{}
+	
+	for key, baseline := range baselines {
+		if resourceID != "" && baseline.ResourceID != resourceID {
+			continue
+		}
+		result = append(result, map[string]interface{}{
+			"key":         key,
+			"resource_id": baseline.ResourceID,
+			"metric":      baseline.Metric,
+			"mean":        baseline.Mean,
+			"std_dev":     baseline.StdDev,
+			"min":         baseline.Min,
+			"max":         baseline.Max,
+			"samples":     baseline.Samples,
+			"last_update": baseline.LastUpdate,
+		})
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]interface{}{
+		"baselines": result,
+		"count":     len(result),
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to write baselines response")
+	}
+}
diff --git a/internal/api/auth.go b/internal/api/auth.go
index aef1ee4..e773285 100644
--- a/internal/api/auth.go
+++ b/internal/api/auth.go
@@ -293,7 +293,7 @@ func CheckAuth(cfg *config.Config, w http.ResponseWriter, r *http.Request) bool
 		}
 		// Debug logging for failed session validation
 		log.Debug().
-			Str("session_token", cookie.Value[:8]+"...").
+			Str("session_token", safePrefixForLog(cookie.Value, 8)+"...").
 			Str("path", r.URL.Path).
 			Msg("Session validation failed - token not found or expired")
 	} else if err != nil {
@@ -419,7 +419,7 @@ func CheckAuth(cfg *config.Config, w http.ResponseWriter, r *http.Request) bool
 								log.Debug().
 									Bool("secure", isSecure).
 									Str("same_site", sameSiteName).
-									Str("token", token[:8]+"...").
+									Str("token", safePrefixForLog(token, 8)+"...").
 									Str("remote_addr", r.RemoteAddr).
 									Msg("Setting session cookie after successful login")
 
diff --git a/internal/api/charts_test.go b/internal/api/charts_test.go
new file mode 100644
index 0000000..465e236
--- /dev/null
+++ b/internal/api/charts_test.go
@@ -0,0 +1,439 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+// TestChartResponseTypes verifies the ChartResponse struct fields
+func TestChartResponseTypes(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now().Unix() * 1000
+
+	response := ChartResponse{
+		ChartData: map[string]VMChartData{
+			"pve1/qemu/100": {
+				"cpu":    []MetricPoint{{Timestamp: now, Value: 45.5}},
+				"memory": []MetricPoint{{Timestamp: now, Value: 60.0}},
+				"disk":   []MetricPoint{{Timestamp: now, Value: 30.0}},
+			},
+		},
+		NodeData: map[string]NodeChartData{
+			"pve1": {
+				"cpu":    []MetricPoint{{Timestamp: now, Value: 35.0}},
+				"memory": []MetricPoint{{Timestamp: now, Value: 50.0}},
+			},
+		},
+		StorageData: map[string]StorageChartData{
+			"local-zfs": {
+				"disk": []MetricPoint{{Timestamp: now, Value: 25.0}},
+			},
+		},
+		DockerData: map[string]VMChartData{
+			"abc123def456": {
+				"cpu":    []MetricPoint{{Timestamp: now, Value: 5.0}},
+				"memory": []MetricPoint{{Timestamp: now, Value: 15.0}},
+			},
+		},
+		DockerHostData: map[string]VMChartData{
+			"docker-host-1": {
+				"cpu":    []MetricPoint{{Timestamp: now, Value: 20.0}},
+				"memory": []MetricPoint{{Timestamp: now, Value: 40.0}},
+			},
+		},
+		GuestTypes: map[string]string{
+			"pve1/qemu/100": "vm",
+			"pve1/lxc/200":  "container",
+		},
+		Timestamp: now,
+		Stats: ChartStats{
+			OldestDataTimestamp: now - 3600000,
+		},
+	}
+
+	// Verify all fields are properly set
+	if len(response.ChartData) != 1 {
+		t.Errorf("Expected 1 chart data entry, got %d", len(response.ChartData))
+	}
+	if len(response.NodeData) != 1 {
+		t.Errorf("Expected 1 node data entry, got %d", len(response.NodeData))
+	}
+	if len(response.StorageData) != 1 {
+		t.Errorf("Expected 1 storage data entry, got %d", len(response.StorageData))
+	}
+	if len(response.DockerData) != 1 {
+		t.Errorf("Expected 1 docker data entry, got %d", len(response.DockerData))
+	}
+	if len(response.DockerHostData) != 1 {
+		t.Errorf("Expected 1 docker host data entry, got %d", len(response.DockerHostData))
+	}
+	if len(response.GuestTypes) != 2 {
+		t.Errorf("Expected 2 guest type entries, got %d", len(response.GuestTypes))
+	}
+
+	// Verify guest types mapping
+	if response.GuestTypes["pve1/qemu/100"] != "vm" {
+		t.Errorf("Expected guest type 'vm', got '%s'", response.GuestTypes["pve1/qemu/100"])
+	}
+	if response.GuestTypes["pve1/lxc/200"] != "container" {
+		t.Errorf("Expected guest type 'container', got '%s'", response.GuestTypes["pve1/lxc/200"])
+	}
+
+	// Verify docker data metric points
+	cpuPoints := response.DockerData["abc123def456"]["cpu"]
+	if len(cpuPoints) != 1 || cpuPoints[0].Value != 5.0 {
+		t.Errorf("Docker container CPU metric incorrect")
+	}
+}
+
+func TestChartResponseJSONSerialization(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now().Unix() * 1000
+
+	response := ChartResponse{
+		ChartData: map[string]VMChartData{
+			"vm-1": {"cpu": []MetricPoint{{Timestamp: now, Value: 50.0}}},
+		},
+		NodeData:    map[string]NodeChartData{},
+		StorageData: map[string]StorageChartData{},
+		DockerData: map[string]VMChartData{
+			"container-abc": {"cpu": []MetricPoint{{Timestamp: now, Value: 10.0}}},
+		},
+		DockerHostData: map[string]VMChartData{
+			"host-1": {"cpu": []MetricPoint{{Timestamp: now, Value: 25.0}}},
+		},
+		GuestTypes: map[string]string{"vm-1": "vm"},
+		Timestamp:  now,
+		Stats:      ChartStats{OldestDataTimestamp: now - 3600000},
+	}
+
+	// Serialize to JSON
+	data, err := json.Marshal(response)
+	if err != nil {
+		t.Fatalf("Failed to marshal ChartResponse: %v", err)
+	}
+
+	// Deserialize back
+	var decoded ChartResponse
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("Failed to unmarshal ChartResponse: %v", err)
+	}
+
+	// Verify dockerData field name in JSON
+	var rawMap map[string]interface{}
+	if err := json.Unmarshal(data, &rawMap); err != nil {
+		t.Fatalf("Failed to unmarshal to raw map: %v", err)
+	}
+
+	// Check that the JSON keys match expected names
+	expectedKeys := []string{"data", "nodeData", "storageData", "dockerData", "dockerHostData", "guestTypes", "timestamp", "stats"}
+	for _, key := range expectedKeys {
+		if _, ok := rawMap[key]; !ok {
+			t.Errorf("Expected JSON key '%s' not found", key)
+		}
+	}
+
+	// Verify dockerData content
+	if dockerData, ok := rawMap["dockerData"].(map[string]interface{}); ok {
+		if _, ok := dockerData["container-abc"]; !ok {
+			t.Errorf("Expected 'container-abc' in dockerData")
+		}
+	} else {
+		t.Errorf("dockerData not found or wrong type")
+	}
+
+	// Verify dockerHostData content
+	if dockerHostData, ok := rawMap["dockerHostData"].(map[string]interface{}); ok {
+		if _, ok := dockerHostData["host-1"]; !ok {
+			t.Errorf("Expected 'host-1' in dockerHostData")
+		}
+	} else {
+		t.Errorf("dockerHostData not found or wrong type")
+	}
+}
+
+func TestMetricPointStructure(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		point     MetricPoint
+		wantJSON  string
+	}{
+		{
+			name:     "positive values",
+			point:    MetricPoint{Timestamp: 1733700000000, Value: 45.5},
+			wantJSON: `{"timestamp":1733700000000,"value":45.5}`,
+		},
+		{
+			name:     "zero values",
+			point:    MetricPoint{Timestamp: 0, Value: 0},
+			wantJSON: `{"timestamp":0,"value":0}`,
+		},
+		{
+			name:     "high precision value",
+			point:    MetricPoint{Timestamp: 1733700000000, Value: 99.99999},
+			wantJSON: `{"timestamp":1733700000000,"value":99.99999}`,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			data, err := json.Marshal(tt.point)
+			if err != nil {
+				t.Fatalf("Failed to marshal MetricPoint: %v", err)
+			}
+			if string(data) != tt.wantJSON {
+				t.Errorf("JSON mismatch\ngot:  %s\nwant: %s", string(data), tt.wantJSON)
+			}
+		})
+	}
+}
+
+func TestTimeRangeConversion(t *testing.T) {
+	t.Parallel()
+
+	// Test the time range conversion logic used in handleCharts
+	tests := []struct {
+		rangeStr     string
+		expectedDur  time.Duration
+	}{
+		{"5m", 5 * time.Minute},
+		{"15m", 15 * time.Minute},
+		{"30m", 30 * time.Minute},
+		{"1h", time.Hour},
+		{"4h", 4 * time.Hour},
+		{"12h", 12 * time.Hour},
+		{"24h", 24 * time.Hour},
+		{"7d", 7 * 24 * time.Hour},
+		{"", time.Hour},        // default
+		{"invalid", time.Hour}, // fallback
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run("range_"+tt.rangeStr, func(t *testing.T) {
+			var duration time.Duration
+			switch tt.rangeStr {
+			case "5m":
+				duration = 5 * time.Minute
+			case "15m":
+				duration = 15 * time.Minute
+			case "30m":
+				duration = 30 * time.Minute
+			case "1h":
+				duration = time.Hour
+			case "4h":
+				duration = 4 * time.Hour
+			case "12h":
+				duration = 12 * time.Hour
+			case "24h":
+				duration = 24 * time.Hour
+			case "7d":
+				duration = 7 * 24 * time.Hour
+			default:
+				duration = time.Hour
+			}
+
+			if duration != tt.expectedDur {
+				t.Errorf("Time range %q: got %v, want %v", tt.rangeStr, duration, tt.expectedDur)
+			}
+		})
+	}
+}
+
+func TestDockerMetricKeyFormat(t *testing.T) {
+	t.Parallel()
+
+	// Test that Docker container metric keys follow the expected format
+	// This mirrors the logic in handleCharts: fmt.Sprintf("docker:%s", container.ID)
+	tests := []struct {
+		containerID string
+		expectedKey string
+	}{
+		{"abc123", "docker:abc123"},
+		{"abc123def456789", "docker:abc123def456789"},
+		{"sha256:abc123", "docker:sha256:abc123"},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.containerID, func(t *testing.T) {
+			key := "docker:" + tt.containerID
+			if key != tt.expectedKey {
+				t.Errorf("Docker metric key: got %q, want %q", key, tt.expectedKey)
+			}
+		})
+	}
+}
+
+func TestDockerHostMetricKeyFormat(t *testing.T) {
+	t.Parallel()
+
+	// Test that Docker host metric keys follow the expected format
+	// This mirrors the logic in handleCharts: fmt.Sprintf("dockerHost:%s", host.ID)
+	tests := []struct {
+		hostID      string
+		expectedKey string
+	}{
+		{"docker-host-1", "dockerHost:docker-host-1"},
+		{"my-server", "dockerHost:my-server"},
+		{"192.168.1.10", "dockerHost:192.168.1.10"},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.hostID, func(t *testing.T) {
+			key := "dockerHost:" + tt.hostID
+			if key != tt.expectedKey {
+				t.Errorf("Docker host metric key: got %q, want %q", key, tt.expectedKey)
+			}
+		})
+	}
+}
+
+func TestGuestTypesMapping(t *testing.T) {
+	t.Parallel()
+
+	// Simulate the guest types map building from state
+	vms := []models.VM{
+		{ID: "pve1/qemu/100"},
+		{ID: "pve1/qemu/200"},
+	}
+	containers := []models.Container{
+		{ID: "pve1/lxc/300"},
+		{ID: "pve1/lxc/400"},
+	}
+
+	guestTypes := make(map[string]string)
+	for _, vm := range vms {
+		guestTypes[vm.ID] = "vm"
+	}
+	for _, ct := range containers {
+		guestTypes[ct.ID] = "container"
+	}
+
+	if len(guestTypes) != 4 {
+		t.Errorf("Expected 4 guest types, got %d", len(guestTypes))
+	}
+
+	// Verify VM types
+	for _, vm := range vms {
+		if guestTypes[vm.ID] != "vm" {
+			t.Errorf("Expected 'vm' for %s, got '%s'", vm.ID, guestTypes[vm.ID])
+		}
+	}
+
+	// Verify container types
+	for _, ct := range containers {
+		if guestTypes[ct.ID] != "container" {
+			t.Errorf("Expected 'container' for %s, got '%s'", ct.ID, guestTypes[ct.ID])
+		}
+	}
+}
+
+func TestDockerContainerDiskPercentCalculation(t *testing.T) {
+	t.Parallel()
+
+	// Test disk percentage calculation for Docker containers
+	// Mirrors: float64(container.WritableLayerBytes) / float64(container.RootFilesystemBytes) * 100
+	tests := []struct {
+		name                  string
+		writableLayerBytes    uint64
+		rootFilesystemBytes   uint64
+		expectedDiskPercent   float64
+	}{
+		{"50% usage", 500, 1000, 50.0},
+		{"100% usage", 1000, 1000, 100.0},
+		{"0% usage", 0, 1000, 0.0},
+		{"zero root filesystem", 100, 0, 0.0}, // Should avoid division by zero
+		{"both zero", 0, 0, 0.0},
+		{"small values", 10, 100, 10.0},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			var diskPercent float64
+			if tt.rootFilesystemBytes > 0 && tt.writableLayerBytes > 0 {
+				diskPercent = float64(tt.writableLayerBytes) / float64(tt.rootFilesystemBytes) * 100
+				if diskPercent > 100 {
+					diskPercent = 100
+				}
+			}
+
+			if diskPercent != tt.expectedDiskPercent {
+				t.Errorf("Disk percent: got %f, want %f", diskPercent, tt.expectedDiskPercent)
+			}
+		})
+	}
+}
+
+func TestChartStatsOldestTimestamp(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now().Unix() * 1000
+	oneHourAgo := now - 3600000  // 1 hour in ms
+	fourHoursAgo := now - 14400000 // 4 hours in ms
+
+	// Simulate finding oldest timestamp
+	timestamps := []int64{now, oneHourAgo, fourHoursAgo, now - 1800000}
+	
+	oldestTimestamp := now
+	for _, ts := range timestamps {
+		if ts < oldestTimestamp {
+			oldestTimestamp = ts
+		}
+	}
+
+	if oldestTimestamp != fourHoursAgo {
+		t.Errorf("Oldest timestamp: got %d, want %d", oldestTimestamp, fourHoursAgo)
+	}
+
+	stats := ChartStats{OldestDataTimestamp: oldestTimestamp}
+	if stats.OldestDataTimestamp != fourHoursAgo {
+		t.Errorf("ChartStats.OldestDataTimestamp: got %d, want %d", 
+			stats.OldestDataTimestamp, fourHoursAgo)
+	}
+}
+
+func TestEmptyDockerData(t *testing.T) {
+	t.Parallel()
+
+	// Verify that empty DockerData is properly handled in JSON
+	response := ChartResponse{
+		ChartData:      map[string]VMChartData{},
+		NodeData:       map[string]NodeChartData{},
+		StorageData:    map[string]StorageChartData{},
+		DockerData:     map[string]VMChartData{},
+		DockerHostData: map[string]VMChartData{},
+		GuestTypes:     map[string]string{},
+		Timestamp:      time.Now().Unix() * 1000,
+		Stats:          ChartStats{OldestDataTimestamp: time.Now().Unix() * 1000},
+	}
+
+	data, err := json.Marshal(response)
+	if err != nil {
+		t.Fatalf("Failed to marshal empty ChartResponse: %v", err)
+	}
+
+	var rawMap map[string]interface{}
+	if err := json.Unmarshal(data, &rawMap); err != nil {
+		t.Fatalf("Failed to unmarshal: %v", err)
+	}
+
+	// Check dockerData is present but empty
+	if dockerData, ok := rawMap["dockerData"].(map[string]interface{}); ok {
+		if len(dockerData) != 0 {
+			t.Errorf("Expected empty dockerData, got %d entries", len(dockerData))
+		}
+	} else {
+		t.Errorf("dockerData should be an empty object, not missing")
+	}
+}
diff --git a/internal/api/config_handlers.go b/internal/api/config_handlers.go
index 4b0c6f3..e0c6534 100644
--- a/internal/api/config_handlers.go
+++ b/internal/api/config_handlers.go
@@ -430,6 +430,7 @@ type NodeResponse struct {
 	IsCluster                    bool                     `json:"isCluster,omitempty"`
 	ClusterName                  string                   `json:"clusterName,omitempty"`
 	ClusterEndpoints             []config.ClusterEndpoint `json:"clusterEndpoints,omitempty"`
+	Source                       string                   `json:"source,omitempty"` // "agent" or "script" - how this node was registered
 }
 
 func determineTemperatureTransport(enabled bool, proxyURL, proxyToken string, socketAvailable bool, containerSSHBlocked bool) string {
@@ -834,6 +835,7 @@ func (h *ConfigHandlers) GetAllNodesForAPI() []NodeResponse {
 			IsCluster:                    pve.IsCluster,
 			ClusterName:                  pve.ClusterName,
 			ClusterEndpoints:             pve.ClusterEndpoints,
+			Source:                       pve.Source,
 		}
 		nodes = append(nodes, node)
 	}
@@ -859,6 +861,7 @@ func (h *ConfigHandlers) GetAllNodesForAPI() []NodeResponse {
 			MonitorPruneJobs:             pbs.MonitorPruneJobs,
 			MonitorGarbageJobs:           pbs.MonitorGarbageJobs,
 			Status:                       h.getNodeStatus("pbs", pbs.Name),
+			Source:                       pbs.Source,
 		}
 		nodes = append(nodes, node)
 	}
@@ -2426,12 +2429,12 @@ func (h *ConfigHandlers) HandleRefreshClusterNodes(w http.ResponseWriter, r *htt
 
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]interface{}{
-		"status":        "success",
-		"clusterName":   pve.ClusterName,
-		"oldNodeCount":  oldEndpointCount,
-		"newNodeCount":  newEndpointCount,
-		"nodesAdded":    newEndpointCount - oldEndpointCount,
-		"clusterNodes":  clusterEndpoints,
+		"status":       "success",
+		"clusterName":  pve.ClusterName,
+		"oldNodeCount": oldEndpointCount,
+		"newNodeCount": newEndpointCount,
+		"nodesAdded":   newEndpointCount - oldEndpointCount,
+		"clusterNodes": clusterEndpoints,
 	})
 }
 
@@ -5371,7 +5374,7 @@ func (h *ConfigHandlers) HandleSetupScriptURL(w http.ResponseWriter, r *http.Req
 	h.codeMutex.Unlock()
 
 	log.Info().
-		Str("token_hash", tokenHash[:8]+"...").
+		Str("token_hash", safePrefixForLog(tokenHash, 8)+"...").
 		Time("expiry", expiry).
 		Str("type", req.Type).
 		Msg("Generated temporary auth token")
@@ -5539,7 +5542,7 @@ func (h *ConfigHandlers) HandleUpdateMockMode(w http.ResponseWriter, r *http.Req
 	}
 }
 
-// AutoRegisterRequest represents a request from the setup script to auto-register a node
+// AutoRegisterRequest represents a request from the setup script or agent to auto-register a node
 type AutoRegisterRequest struct {
 	Type       string `json:"type"`                 // "pve" or "pbs"
 	Host       string `json:"host"`                 // The host URL
@@ -5548,6 +5551,7 @@ type AutoRegisterRequest struct {
 	ServerName string `json:"serverName"`           // Hostname or IP
 	SetupCode  string `json:"setupCode,omitempty"`  // One-time setup code for authentication (deprecated)
 	AuthToken  string `json:"authToken,omitempty"`  // Direct auth token from URL (new approach)
+	Source     string `json:"source,omitempty"`     // "agent" or "script" - indicates how the node was registered
 	// New secure fields
 	RequestToken bool   `json:"requestToken,omitempty"` // If true, Pulse will generate and return a token
 	Username     string `json:"username,omitempty"`     // Username for creating token (e.g., "root@pam")
@@ -5610,7 +5614,7 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 			codeHash := internalauth.HashAPIToken(authCode)
 			log.Debug().
 				Bool("hasAuthCode", true).
-				Str("codeHash", codeHash[:8]+"...").
+				Str("codeHash", safePrefixForLog(codeHash, 8)+"...").
 				Msg("Checking auth token as setup code")
 			h.codeMutex.Lock()
 			setupCode, exists := h.setupCodes[codeHash]
@@ -5752,18 +5756,29 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 		MonitorGarbageJobs: &boolFalse,
 	}
 
-	// Check if a node with this host already exists
+	// Check if a node with this host or name already exists
+	// Match by host URL or by node name (to handle hostname vs IP differences)
 	existingIndex := -1
 	if req.Type == "pve" {
 		for i, node := range h.config.PVEInstances {
-			if node.Host == host { // Use normalized host for comparison
+			if node.Host == host {
+				existingIndex = i
+				break
+			}
+			// Also match by name if ServerName matches existing node name
+			if req.ServerName != "" && strings.EqualFold(node.Name, req.ServerName) {
 				existingIndex = i
 				break
 			}
 		}
 	} else {
 		for i, node := range h.config.PBSInstances {
-			if node.Host == host { // Use normalized host for comparison
+			if node.Host == host {
+				existingIndex = i
+				break
+			}
+			// Also match by name if ServerName matches existing node name
+			if req.ServerName != "" && strings.EqualFold(node.Name, req.ServerName) {
 				existingIndex = i
 				break
 			}
@@ -5780,6 +5795,10 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 			instance.Password = ""
 			instance.TokenName = nodeConfig.TokenName
 			instance.TokenValue = nodeConfig.TokenValue
+			// Update source if provided (allows upgrade from script to agent)
+			if req.Source != "" {
+				instance.Source = req.Source
+			}
 
 			// Check for cluster if not already detected
 			if !instance.IsCluster {
@@ -5809,6 +5828,10 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 			instance.Password = ""
 			instance.TokenName = nodeConfig.TokenName
 			instance.TokenValue = nodeConfig.TokenValue
+			// Update source if provided (allows upgrade from script to agent)
+			if req.Source != "" {
+				instance.Source = req.Source
+			}
 			// Keep other settings as they were
 		}
 		log.Info().
@@ -5864,6 +5887,7 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 				IsCluster:         isCluster,
 				ClusterName:       clusterName,
 				ClusterEndpoints:  clusterEndpoints,
+				Source:            req.Source, // Track how this node was registered
 			}
 			h.config.PVEInstances = append(h.config.PVEInstances, newInstance)
 
@@ -5911,6 +5935,7 @@ func (h *ConfigHandlers) HandleAutoRegister(w http.ResponseWriter, r *http.Reque
 				MonitorVerifyJobs:  monitorVerifyJobs,
 				MonitorPruneJobs:   monitorPruneJobs,
 				MonitorGarbageJobs: monitorGarbageJobs,
+				Source:             req.Source, // Track how this node was registered
 			}
 			h.config.PBSInstances = append(h.config.PBSInstances, newInstance)
 		}
@@ -6272,3 +6297,111 @@ func (h *ConfigHandlers) generateOrLoadSSHKey(sshDir, privateKeyPath, publicKeyP
 
 	return publicKeyString
 }
+
+// AgentInstallCommandRequest represents a request for an agent install command
+type AgentInstallCommandRequest struct {
+	Type string `json:"type"` // "pve" or "pbs"
+}
+
+// AgentInstallCommandResponse contains the generated install command
+type AgentInstallCommandResponse struct {
+	Command string `json:"command"`
+	Token   string `json:"token"`
+}
+
+// HandleAgentInstallCommand generates an API token and install command for agent-based Proxmox setup
+func (h *ConfigHandlers) HandleAgentInstallCommand(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var req AgentInstallCommandRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	// Validate type
+	if req.Type != "pve" && req.Type != "pbs" {
+		http.Error(w, "Type must be 'pve' or 'pbs'", http.StatusBadRequest)
+		return
+	}
+
+	// Generate a new API token with host report and host manage scopes
+	rawToken, err := internalauth.GenerateAPIToken()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to generate API token for agent install")
+		http.Error(w, "Failed to generate API token", http.StatusInternalServerError)
+		return
+	}
+
+	tokenName := fmt.Sprintf("proxmox-agent-%s-%d", req.Type, time.Now().Unix())
+	scopes := []string{
+		config.ScopeHostReport,
+		config.ScopeHostManage,
+	}
+
+	record, err := config.NewAPITokenRecord(rawToken, tokenName, scopes)
+	if err != nil {
+		log.Error().Err(err).Str("token_name", tokenName).Msg("Failed to construct API token record")
+		http.Error(w, "Failed to generate token", http.StatusInternalServerError)
+		return
+	}
+
+	// Persist the token
+	config.Mu.Lock()
+	h.config.APITokens = append(h.config.APITokens, *record)
+	h.config.SortAPITokens()
+	h.config.APITokenEnabled = true
+
+	if h.persistence != nil {
+		if err := h.persistence.SaveAPITokens(h.config.APITokens); err != nil {
+			// Rollback the in-memory addition
+			h.config.APITokens = h.config.APITokens[:len(h.config.APITokens)-1]
+			config.Mu.Unlock()
+			log.Error().Err(err).Msg("Failed to persist API tokens after creation")
+			http.Error(w, "Failed to save token to disk: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}
+	config.Mu.Unlock()
+
+	// Derive Pulse URL from the request
+	host := r.Host
+	if parsedHost, parsedPort, err := net.SplitHostPort(host); err == nil {
+		if (parsedHost == "127.0.0.1" || parsedHost == "localhost") && parsedPort == strconv.Itoa(h.config.FrontendPort) {
+			// Prefer a user-configured public URL when we're running on loopback
+			if publicURL := strings.TrimSpace(h.config.PublicURL); publicURL != "" {
+				if parsedURL, err := url.Parse(publicURL); err == nil && parsedURL.Host != "" {
+					host = parsedURL.Host
+				}
+			}
+		}
+	}
+
+	// Detect protocol - check both TLS and proxy headers
+	scheme := "http"
+	if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
+		scheme = "https"
+	}
+	pulseURL := fmt.Sprintf("%s://%s", scheme, host)
+
+	// Generate the install command
+	command := fmt.Sprintf(`curl -fsSL %s/install.sh | bash -s -- \
+  --url %s \
+  --token %s \
+  --enable-proxmox`,
+		pulseURL, pulseURL, rawToken)
+
+	log.Info().
+		Str("token_name", tokenName).
+		Str("type", req.Type).
+		Msg("Generated agent install command with API token")
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(AgentInstallCommandResponse{
+		Command: command,
+		Token:   rawToken,
+	})
+}
diff --git a/internal/api/csrf_store.go b/internal/api/csrf_store.go
index 082dd0b..15a74fa 100644
--- a/internal/api/csrf_store.go
+++ b/internal/api/csrf_store.go
@@ -158,7 +158,7 @@ func (c *CSRFTokenStore) cleanup() {
 	for sessionKey, token := range c.tokens {
 		if now.After(token.Expires) {
 			delete(c.tokens, sessionKey)
-			log.Debug().Str("sessionKey", sessionKey[:8]+"...").Msg("Cleaned up expired CSRF token")
+			log.Debug().Str("sessionKey", safePrefixForLog(sessionKey, 8)+"...").Msg("Cleaned up expired CSRF token")
 		}
 	}
 }
diff --git a/internal/api/docker_metadata.go b/internal/api/docker_metadata.go
index 7ebe590..5e75bd9 100644
--- a/internal/api/docker_metadata.go
+++ b/internal/api/docker_metadata.go
@@ -22,6 +22,11 @@ func NewDockerMetadataHandler(dataPath string) *DockerMetadataHandler {
 	}
 }
 
+// Store returns the underlying metadata store
+func (h *DockerMetadataHandler) Store() *config.DockerMetadataStore {
+	return h.store
+}
+
 // HandleGetMetadata retrieves metadata for a specific Docker resource or all resources
 func (h *DockerMetadataHandler) HandleGetMetadata(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
diff --git a/internal/api/guest_metadata.go b/internal/api/guest_metadata.go
index 3a56722..848d19f 100644
--- a/internal/api/guest_metadata.go
+++ b/internal/api/guest_metadata.go
@@ -27,6 +27,11 @@ func (h *GuestMetadataHandler) Reload() error {
 	return h.store.Load()
 }
 
+// Store returns the underlying metadata store
+func (h *GuestMetadataHandler) Store() *config.GuestMetadataStore {
+	return h.store
+}
+
 // HandleGetMetadata retrieves metadata for a specific guest or all guests
 func (h *GuestMetadataHandler) HandleGetMetadata(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
diff --git a/internal/api/host_metadata.go b/internal/api/host_metadata.go
new file mode 100644
index 0000000..0d3d517
--- /dev/null
+++ b/internal/api/host_metadata.go
@@ -0,0 +1,164 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rs/zerolog/log"
+)
+
+// HostMetadataHandler handles host metadata operations
+type HostMetadataHandler struct {
+	store *config.HostMetadataStore
+}
+
+// NewHostMetadataHandler creates a new host metadata handler
+func NewHostMetadataHandler(dataPath string) *HostMetadataHandler {
+	return &HostMetadataHandler{
+		store: config.NewHostMetadataStore(dataPath),
+	}
+}
+
+// Store returns the underlying metadata store
+func (h *HostMetadataHandler) Store() *config.HostMetadataStore {
+	return h.store
+}
+
+// HandleGetMetadata retrieves metadata for a specific host or all hosts
+func (h *HostMetadataHandler) HandleGetMetadata(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Check if requesting specific host
+	path := r.URL.Path
+	// Handle both /api/hosts/metadata and /api/hosts/metadata/
+	if path == "/api/hosts/metadata" || path == "/api/hosts/metadata/" {
+		// Get all metadata
+		w.Header().Set("Content-Type", "application/json")
+		allMeta := h.store.GetAll()
+		if allMeta == nil {
+			// Return empty object instead of null
+			json.NewEncoder(w).Encode(make(map[string]*config.HostMetadata))
+		} else {
+			json.NewEncoder(w).Encode(allMeta)
+		}
+		return
+	}
+
+	// Get specific host ID from path
+	hostID := strings.TrimPrefix(path, "/api/hosts/metadata/")
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if hostID != "" {
+		// Get specific host metadata
+		meta := h.store.Get(hostID)
+		if meta == nil {
+			// Return empty metadata instead of 404
+			json.NewEncoder(w).Encode(&config.HostMetadata{ID: hostID})
+		} else {
+			json.NewEncoder(w).Encode(meta)
+		}
+	} else {
+		// This shouldn't happen with current routing, but handle it anyway
+		http.Error(w, "Invalid request path", http.StatusBadRequest)
+	}
+}
+
+// HandleUpdateMetadata updates metadata for a host
+func (h *HostMetadataHandler) HandleUpdateMetadata(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut && r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	hostID := strings.TrimPrefix(r.URL.Path, "/api/hosts/metadata/")
+	if hostID == "" || hostID == "metadata" {
+		http.Error(w, "Host ID required", http.StatusBadRequest)
+		return
+	}
+
+	// Limit request body to 16KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 16*1024)
+
+	var meta config.HostMetadata
+	if err := json.NewDecoder(r.Body).Decode(&meta); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	// Validate URL if provided
+	if meta.CustomURL != "" {
+		// Parse and validate the URL
+		parsedURL, err := url.Parse(meta.CustomURL)
+		if err != nil {
+			http.Error(w, "Invalid URL format: "+err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		// Check scheme
+		if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
+			http.Error(w, "URL must use http:// or https:// scheme", http.StatusBadRequest)
+			return
+		}
+
+		// Check host is present and valid
+		if parsedURL.Host == "" {
+			http.Error(w, "Invalid URL: missing host/domain (e.g., use https://192.168.1.100:8006 or https://myhost.local)", http.StatusBadRequest)
+			return
+		}
+
+		// Check for incomplete URLs like "https://host."
+		if strings.HasSuffix(parsedURL.Host, ".") && !strings.Contains(parsedURL.Host, "..") {
+			http.Error(w, "Incomplete URL: '"+meta.CustomURL+"' - please enter a complete domain or IP address", http.StatusBadRequest)
+			return
+		}
+	}
+
+	if err := h.store.Set(hostID, &meta); err != nil {
+		log.Error().Err(err).Str("hostID", hostID).Msg("Failed to save host metadata")
+		// Provide more specific error message
+		errMsg := "Failed to save metadata"
+		if strings.Contains(err.Error(), "permission") {
+			errMsg = "Permission denied - check file permissions"
+		} else if strings.Contains(err.Error(), "no space") {
+			errMsg = "Disk full - cannot save metadata"
+		}
+		http.Error(w, errMsg, http.StatusInternalServerError)
+		return
+	}
+
+	log.Info().Str("hostID", hostID).Str("url", meta.CustomURL).Msg("Updated host metadata")
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(&meta)
+}
+
+// HandleDeleteMetadata removes metadata for a host
+func (h *HostMetadataHandler) HandleDeleteMetadata(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	hostID := strings.TrimPrefix(r.URL.Path, "/api/hosts/metadata/")
+	if hostID == "" || hostID == "metadata" {
+		http.Error(w, "Host ID required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.store.Delete(hostID); err != nil {
+		log.Error().Err(err).Str("hostID", hostID).Msg("Failed to delete host metadata")
+		http.Error(w, "Failed to delete metadata", http.StatusInternalServerError)
+		return
+	}
+
+	log.Info().Str("hostID", hostID).Msg("Deleted host metadata")
+
+	w.WriteHeader(http.StatusNoContent)
+}
diff --git a/internal/api/kubernetes_agents.go b/internal/api/kubernetes_agents.go
new file mode 100644
index 0000000..44ab243
--- /dev/null
+++ b/internal/api/kubernetes_agents.go
@@ -0,0 +1,286 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/monitoring"
+	"github.com/rcourtman/pulse-go-rewrite/internal/utils"
+	"github.com/rcourtman/pulse-go-rewrite/internal/websocket"
+	agentsk8s "github.com/rcourtman/pulse-go-rewrite/pkg/agents/kubernetes"
+	"github.com/rs/zerolog/log"
+)
+
+// KubernetesAgentHandlers manages ingest from the Kubernetes agent.
+type KubernetesAgentHandlers struct {
+	monitor *monitoring.Monitor
+	wsHub   *websocket.Hub
+}
+
+// NewKubernetesAgentHandlers constructs a new Kubernetes agent handler group.
+func NewKubernetesAgentHandlers(m *monitoring.Monitor, hub *websocket.Hub) *KubernetesAgentHandlers {
+	return &KubernetesAgentHandlers{monitor: m, wsHub: hub}
+}
+
+// SetMonitor updates the monitor reference for kubernetes agent handlers.
+func (h *KubernetesAgentHandlers) SetMonitor(m *monitoring.Monitor) {
+	h.monitor = m
+}
+
+// HandleReport accepts heartbeat payloads from the Kubernetes agent.
+func (h *KubernetesAgentHandlers) HandleReport(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only POST is allowed", nil)
+		return
+	}
+
+	// Limit request body to 2MB to prevent memory exhaustion (pods can be sizable).
+	r.Body = http.MaxBytesReader(w, r.Body, 2*1024*1024)
+	defer r.Body.Close()
+
+	var report agentsk8s.Report
+	if err := json.NewDecoder(r.Body).Decode(&report); err != nil {
+		writeErrorResponse(w, http.StatusBadRequest, "invalid_json", "Failed to decode request body", map[string]string{"error": err.Error()})
+		return
+	}
+
+	if report.Timestamp.IsZero() {
+		report.Timestamp = time.Now()
+	}
+
+	tokenRecord := getAPITokenRecordFromRequest(r)
+
+	cluster, err := h.monitor.ApplyKubernetesReport(report, tokenRecord)
+	if err != nil {
+		writeErrorResponse(w, http.StatusBadRequest, "invalid_report", err.Error(), nil)
+		return
+	}
+
+	log.Debug().
+		Str("k8sClusterID", cluster.ID).
+		Str("k8sClusterName", cluster.Name).
+		Int("nodes", len(cluster.Nodes)).
+		Int("pods", len(cluster.Pods)).
+		Int("deployments", len(cluster.Deployments)).
+		Msg("Kubernetes agent report processed")
+
+	go h.wsHub.BroadcastState(h.monitor.GetState().ToFrontend())
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":     true,
+		"clusterId":   cluster.ID,
+		"nodes":       len(cluster.Nodes),
+		"pods":        len(cluster.Pods),
+		"deployments": len(cluster.Deployments),
+		"lastSeen":    cluster.LastSeen,
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes agent response")
+	}
+}
+
+// HandleClusterActions routes kubernetes cluster management actions based on path and method.
+func (h *KubernetesAgentHandlers) HandleClusterActions(w http.ResponseWriter, r *http.Request) {
+	// Allow reenroll request
+	if strings.HasSuffix(r.URL.Path, "/allow-reenroll") && r.Method == http.MethodPost {
+		h.HandleAllowReenroll(w, r)
+		return
+	}
+
+	// Unhide request
+	if strings.HasSuffix(r.URL.Path, "/unhide") && r.Method == http.MethodPut {
+		h.HandleUnhideCluster(w, r)
+		return
+	}
+
+	// Pending uninstall request
+	if strings.HasSuffix(r.URL.Path, "/pending-uninstall") && r.Method == http.MethodPut {
+		h.HandleMarkPendingUninstall(w, r)
+		return
+	}
+
+	// Custom display name update request
+	if strings.HasSuffix(r.URL.Path, "/display-name") && r.Method == http.MethodPut {
+		h.HandleSetCustomDisplayName(w, r)
+		return
+	}
+
+	// Delete/hide request
+	if r.Method == http.MethodDelete {
+		h.HandleDeleteCluster(w, r)
+		return
+	}
+
+	writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Method not allowed", nil)
+}
+
+// HandleDeleteCluster removes and blocks a cluster from re-enrolling.
+func (h *KubernetesAgentHandlers) HandleDeleteCluster(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodDelete {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only DELETE is allowed", nil)
+		return
+	}
+
+	trimmedPath := strings.TrimPrefix(r.URL.Path, "/api/agents/kubernetes/clusters/")
+	clusterID := strings.TrimSpace(trimmedPath)
+	clusterID = strings.TrimSuffix(clusterID, "/")
+	if clusterID == "" {
+		writeErrorResponse(w, http.StatusBadRequest, "missing_cluster_id", "Kubernetes cluster ID is required", nil)
+		return
+	}
+
+	cluster, err := h.monitor.RemoveKubernetesCluster(clusterID)
+	if err != nil {
+		writeErrorResponse(w, http.StatusNotFound, "kubernetes_cluster_not_found", err.Error(), nil)
+		return
+	}
+
+	go h.wsHub.BroadcastState(h.monitor.GetState().ToFrontend())
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":   true,
+		"clusterId": cluster.ID,
+		"message":   "Kubernetes cluster removed",
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes cluster operation response")
+	}
+}
+
+// HandleAllowReenroll clears the removal block for a cluster to permit future reports.
+func (h *KubernetesAgentHandlers) HandleAllowReenroll(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only POST is allowed", nil)
+		return
+	}
+
+	trimmedPath := strings.TrimPrefix(r.URL.Path, "/api/agents/kubernetes/clusters/")
+	trimmedPath = strings.TrimSuffix(trimmedPath, "/allow-reenroll")
+	clusterID := strings.TrimSpace(trimmedPath)
+	if clusterID == "" {
+		writeErrorResponse(w, http.StatusBadRequest, "missing_cluster_id", "Kubernetes cluster ID is required", nil)
+		return
+	}
+
+	if err := h.monitor.AllowKubernetesClusterReenroll(clusterID); err != nil {
+		writeErrorResponse(w, http.StatusBadRequest, "kubernetes_cluster_reenroll_failed", err.Error(), nil)
+		return
+	}
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":   true,
+		"clusterId": clusterID,
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes cluster allow reenroll response")
+	}
+}
+
+// HandleUnhideCluster unhides a previously hidden kubernetes cluster.
+func (h *KubernetesAgentHandlers) HandleUnhideCluster(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only PUT is allowed", nil)
+		return
+	}
+
+	trimmedPath := strings.TrimPrefix(r.URL.Path, "/api/agents/kubernetes/clusters/")
+	trimmedPath = strings.TrimSuffix(trimmedPath, "/unhide")
+	clusterID := strings.TrimSpace(trimmedPath)
+	if clusterID == "" {
+		writeErrorResponse(w, http.StatusBadRequest, "missing_cluster_id", "Kubernetes cluster ID is required", nil)
+		return
+	}
+
+	cluster, err := h.monitor.UnhideKubernetesCluster(clusterID)
+	if err != nil {
+		writeErrorResponse(w, http.StatusNotFound, "kubernetes_cluster_not_found", err.Error(), nil)
+		return
+	}
+
+	go h.wsHub.BroadcastState(h.monitor.GetState().ToFrontend())
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":   true,
+		"clusterId": cluster.ID,
+		"message":   "Kubernetes cluster unhidden",
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes cluster unhide response")
+	}
+}
+
+// HandleMarkPendingUninstall marks a cluster as pending uninstall.
+func (h *KubernetesAgentHandlers) HandleMarkPendingUninstall(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only PUT is allowed", nil)
+		return
+	}
+
+	trimmedPath := strings.TrimPrefix(r.URL.Path, "/api/agents/kubernetes/clusters/")
+	trimmedPath = strings.TrimSuffix(trimmedPath, "/pending-uninstall")
+	clusterID := strings.TrimSpace(trimmedPath)
+	if clusterID == "" {
+		writeErrorResponse(w, http.StatusBadRequest, "missing_cluster_id", "Kubernetes cluster ID is required", nil)
+		return
+	}
+
+	cluster, err := h.monitor.MarkKubernetesClusterPendingUninstall(clusterID)
+	if err != nil {
+		writeErrorResponse(w, http.StatusNotFound, "kubernetes_cluster_not_found", err.Error(), nil)
+		return
+	}
+
+	go h.wsHub.BroadcastState(h.monitor.GetState().ToFrontend())
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":   true,
+		"clusterId": cluster.ID,
+		"message":   "Kubernetes cluster marked as pending uninstall",
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes cluster pending uninstall response")
+	}
+}
+
+// HandleSetCustomDisplayName updates the custom display name for a kubernetes cluster.
+func (h *KubernetesAgentHandlers) HandleSetCustomDisplayName(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPut {
+		writeErrorResponse(w, http.StatusMethodNotAllowed, "method_not_allowed", "Only PUT is allowed", nil)
+		return
+	}
+
+	trimmedPath := strings.TrimPrefix(r.URL.Path, "/api/agents/kubernetes/clusters/")
+	trimmedPath = strings.TrimSuffix(trimmedPath, "/display-name")
+	clusterID := strings.TrimSpace(trimmedPath)
+	if clusterID == "" {
+		writeErrorResponse(w, http.StatusBadRequest, "missing_cluster_id", "Kubernetes cluster ID is required", nil)
+		return
+	}
+
+	// Limit request body to 8KB to prevent memory exhaustion
+	r.Body = http.MaxBytesReader(w, r.Body, 8*1024)
+	defer r.Body.Close()
+
+	var req struct {
+		DisplayName string `json:"displayName"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeErrorResponse(w, http.StatusBadRequest, "invalid_json", "Failed to decode request body", map[string]string{"error": err.Error()})
+		return
+	}
+
+	customName := strings.TrimSpace(req.DisplayName)
+
+	cluster, err := h.monitor.SetKubernetesClusterCustomDisplayName(clusterID, customName)
+	if err != nil {
+		writeErrorResponse(w, http.StatusNotFound, "kubernetes_cluster_not_found", err.Error(), nil)
+		return
+	}
+
+	go h.wsHub.BroadcastState(h.monitor.GetState().ToFrontend())
+
+	if err := utils.WriteJSONResponse(w, map[string]any{
+		"success":   true,
+		"clusterId": cluster.ID,
+		"message":   "Kubernetes cluster custom display name updated",
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to serialize kubernetes cluster custom display name response")
+	}
+}
diff --git a/internal/api/log_redact.go b/internal/api/log_redact.go
new file mode 100644
index 0000000..c8b019b
--- /dev/null
+++ b/internal/api/log_redact.go
@@ -0,0 +1,11 @@
+package api
+
+func safePrefixForLog(value string, n int) string {
+	if n <= 0 || value == "" {
+		return ""
+	}
+	if len(value) <= n {
+		return value
+	}
+	return value[:n]
+}
diff --git a/internal/api/metadata_provider.go b/internal/api/metadata_provider.go
new file mode 100644
index 0000000..77d3f8d
--- /dev/null
+++ b/internal/api/metadata_provider.go
@@ -0,0 +1,87 @@
+package api
+
+import (
+	"fmt"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+)
+
+// MetadataProviderImpl implements ai.MetadataProvider to allow AI to update resource URLs
+type MetadataProviderImpl struct {
+	guestStore  *config.GuestMetadataStore
+	dockerStore *config.DockerMetadataStore
+	hostStore   *config.HostMetadataStore
+}
+
+// NewMetadataProvider creates a new MetadataProvider with the given stores
+func NewMetadataProvider(
+	guestStore *config.GuestMetadataStore,
+	dockerStore *config.DockerMetadataStore,
+	hostStore *config.HostMetadataStore,
+) *MetadataProviderImpl {
+	return &MetadataProviderImpl{
+		guestStore:  guestStore,
+		dockerStore: dockerStore,
+		hostStore:   hostStore,
+	}
+}
+
+// SetGuestURL sets the custom URL for a Proxmox guest (VM/container)
+func (m *MetadataProviderImpl) SetGuestURL(guestID, customURL string) error {
+	if m.guestStore == nil {
+		return fmt.Errorf("guest metadata store not available")
+	}
+
+	// Get existing metadata or create new
+	existing := m.guestStore.Get(guestID)
+	if existing == nil {
+		existing = &config.GuestMetadata{
+			ID: guestID,
+		}
+	}
+
+	// Update the URL
+	existing.CustomURL = customURL
+
+	return m.guestStore.Set(guestID, existing)
+}
+
+// SetDockerURL sets the custom URL for a Docker container/service
+func (m *MetadataProviderImpl) SetDockerURL(resourceID, customURL string) error {
+	if m.dockerStore == nil {
+		return fmt.Errorf("docker metadata store not available")
+	}
+
+	// Get existing metadata or create new
+	existing := m.dockerStore.Get(resourceID)
+	if existing == nil {
+		existing = &config.DockerMetadata{
+			ID: resourceID,
+		}
+	}
+
+	// Update the URL
+	existing.CustomURL = customURL
+
+	return m.dockerStore.Set(resourceID, existing)
+}
+
+// SetHostURL sets the custom URL for a host
+func (m *MetadataProviderImpl) SetHostURL(hostID, customURL string) error {
+	if m.hostStore == nil {
+		return fmt.Errorf("host metadata store not available")
+	}
+
+	// Get existing metadata or create new
+	existing := m.hostStore.Get(hostID)
+	if existing == nil {
+		existing = &config.HostMetadata{
+			ID: hostID,
+		}
+	}
+
+	// Update the URL
+	existing.CustomURL = customURL
+
+	return m.hostStore.Set(hostID, existing)
+}
diff --git a/internal/api/recovery_tokens.go b/internal/api/recovery_tokens.go
index d72d7e8..d3ab0f8 100644
--- a/internal/api/recovery_tokens.go
+++ b/internal/api/recovery_tokens.go
@@ -83,7 +83,7 @@ func (r *RecoveryTokenStore) GenerateRecoveryToken(duration time.Duration) (stri
 	r.saveUnsafe()
 
 	log.Info().
-		Str("token", tokenStr[:8]+"...").
+		Str("token", safePrefixForLog(tokenStr, 8)+"...").
 		Time("expires", token.ExpiresAt).
 		Msg("Recovery token generated")
 
@@ -128,7 +128,7 @@ func (r *RecoveryTokenStore) ValidateRecoveryTokenConstantTime(providedToken str
 			r.mu.RLock()
 
 			log.Info().
-				Str("token", tokenStr[:8]+"...").
+				Str("token", safePrefixForLog(tokenStr, 8)+"...").
 				Str("ip", ip).
 				Msg("Recovery token successfully validated")
 
diff --git a/internal/api/resource_handlers.go b/internal/api/resource_handlers.go
new file mode 100644
index 0000000..c1cad68
--- /dev/null
+++ b/internal/api/resource_handlers.go
@@ -0,0 +1,254 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rcourtman/pulse-go-rewrite/internal/resources"
+)
+
+// StateProvider allows ResourceHandlers to fetch current state on demand.
+type StateProvider interface {
+	GetState() models.StateSnapshot
+}
+
+// ResourceHandlers provides HTTP handlers for the unified resource API.
+type ResourceHandlers struct {
+	store         *resources.Store
+	stateProvider StateProvider
+}
+
+// NewResourceHandlers creates resource handlers with a new store.
+func NewResourceHandlers() *ResourceHandlers {
+	return &ResourceHandlers{
+		store: resources.NewStore(),
+	}
+}
+
+// SetStateProvider sets the state provider for on-demand resource population.
+func (h *ResourceHandlers) SetStateProvider(provider StateProvider) {
+	h.stateProvider = provider
+}
+
+// Store returns the underlying resource store for populating from the monitor.
+func (h *ResourceHandlers) Store() *resources.Store {
+	return h.store
+}
+
+// HandleGetResources returns all resources, optionally filtered by query params.
+// GET /api/resources
+// Query params:
+//   - type: filter by resource type (comma-separated)
+//   - platform: filter by platform type (comma-separated)
+//   - status: filter by status (comma-separated)
+//   - parent: filter by parent ID
+//   - infrastructure: if "true", only return infrastructure resources
+//   - workloads: if "true", only return workload resources
+func (h *ResourceHandlers) HandleGetResources(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Populate from current state if we have a state provider
+	// This ensures fresh data even if the store hasn't been populated yet
+	if h.stateProvider != nil {
+		h.PopulateFromSnapshot(h.stateProvider.GetState())
+	}
+
+	query := h.store.Query()
+
+	// Parse type filter
+	if typeParam := r.URL.Query().Get("type"); typeParam != "" {
+		types := parseResourceTypes(typeParam)
+		if len(types) > 0 {
+			query = query.OfType(types...)
+		}
+	}
+
+	// Parse platform filter
+	if platformParam := r.URL.Query().Get("platform"); platformParam != "" {
+		platforms := parsePlatformTypes(platformParam)
+		if len(platforms) > 0 {
+			query = query.FromPlatform(platforms...)
+		}
+	}
+
+	// Parse status filter
+	if statusParam := r.URL.Query().Get("status"); statusParam != "" {
+		statuses := parseStatuses(statusParam)
+		if len(statuses) > 0 {
+			query = query.WithStatus(statuses...)
+		}
+	}
+
+	// Parse parent filter
+	if parentID := r.URL.Query().Get("parent"); parentID != "" {
+		query = query.WithParent(parentID)
+	}
+
+	// Parse alerts filter
+	if r.URL.Query().Get("alerts") == "true" {
+		query = query.WithAlerts()
+	}
+
+	// Execute query
+	var result []resources.Resource
+
+	// Handle infrastructure/workloads shortcut
+	if r.URL.Query().Get("infrastructure") == "true" {
+		result = h.store.GetInfrastructure()
+	} else if r.URL.Query().Get("workloads") == "true" {
+		result = h.store.GetWorkloads()
+	} else {
+		result = query.Execute()
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(ResourcesResponse{
+		Resources: result,
+		Count:     len(result),
+		Stats:     h.store.GetStats(),
+	})
+}
+
+// HandleGetResource returns a single resource by ID.
+// GET /api/resources/{id}
+func (h *ResourceHandlers) HandleGetResource(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Extract ID from path: /api/resources/{id}
+	path := strings.TrimPrefix(r.URL.Path, "/api/resources/")
+	if path == "" || path == "/" {
+		http.Error(w, "Resource ID required", http.StatusBadRequest)
+		return
+	}
+
+	resource, ok := h.store.Get(path)
+	if !ok {
+		http.Error(w, "Resource not found", http.StatusNotFound)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(resource)
+}
+
+// HandleGetResourceStats returns statistics about the resource store.
+// GET /api/resources/stats
+func (h *ResourceHandlers) HandleGetResourceStats(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	stats := h.store.GetStats()
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(stats)
+}
+
+// ResourcesResponse is the response for /api/resources.
+type ResourcesResponse struct {
+	Resources []resources.Resource `json:"resources"`
+	Count     int                  `json:"count"`
+	Stats     resources.StoreStats `json:"stats"`
+}
+
+// PopulateFromState converts all resources from a StateSnapshot to the unified store.
+// This should be called whenever the state is updated.
+func (h *ResourceHandlers) PopulateFromSnapshot(snapshot models.StateSnapshot) {
+	// Convert nodes
+	for _, node := range snapshot.Nodes {
+		r := resources.FromNode(node)
+		h.store.Upsert(r)
+	}
+
+	// Convert VMs
+	for _, vm := range snapshot.VMs {
+		r := resources.FromVM(vm)
+		h.store.Upsert(r)
+	}
+
+	// Convert containers
+	for _, ct := range snapshot.Containers {
+		r := resources.FromContainer(ct)
+		h.store.Upsert(r)
+	}
+
+	// Convert hosts
+	for _, host := range snapshot.Hosts {
+		r := resources.FromHost(host)
+		h.store.Upsert(r)
+	}
+
+	// Convert docker hosts and their containers
+	for _, dh := range snapshot.DockerHosts {
+		r := resources.FromDockerHost(dh)
+		h.store.Upsert(r)
+
+		// Convert containers within the docker host
+		for _, dc := range dh.Containers {
+			r := resources.FromDockerContainer(dc, dh.ID, dh.Hostname)
+			h.store.Upsert(r)
+		}
+	}
+
+	// Convert PBS instances
+	for _, pbs := range snapshot.PBSInstances {
+		r := resources.FromPBSInstance(pbs)
+		h.store.Upsert(r)
+	}
+
+	// Convert storage
+	for _, storage := range snapshot.Storage {
+		r := resources.FromStorage(storage)
+		h.store.Upsert(r)
+	}
+}
+
+// Helper functions for parsing query parameters
+
+func parseResourceTypes(s string) []resources.ResourceType {
+	parts := strings.Split(s, ",")
+	var result []resources.ResourceType
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		result = append(result, resources.ResourceType(p))
+	}
+	return result
+}
+
+func parsePlatformTypes(s string) []resources.PlatformType {
+	parts := strings.Split(s, ",")
+	var result []resources.PlatformType
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		result = append(result, resources.PlatformType(p))
+	}
+	return result
+}
+
+func parseStatuses(s string) []resources.ResourceStatus {
+	parts := strings.Split(s, ",")
+	var result []resources.ResourceStatus
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		result = append(result, resources.ResourceStatus(p))
+	}
+	return result
+}
diff --git a/internal/api/router.go b/internal/api/router.go
index fada56b..f47d92f 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -26,6 +26,9 @@ import (
 	"time"
 
 	"github.com/rcourtman/pulse-go-rewrite/internal/agentbinaries"
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentexec"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ai"
+	"github.com/rcourtman/pulse-go-rewrite/internal/alerts"
 	"github.com/rcourtman/pulse-go-rewrite/internal/auth"
 	"github.com/rcourtman/pulse-go-rewrite/internal/config"
 	"github.com/rcourtman/pulse-go-rewrite/internal/models"
@@ -48,14 +51,19 @@ type Router struct {
 	notificationHandlers      *NotificationHandlers
 	notificationQueueHandlers *NotificationQueueHandlers
 	dockerAgentHandlers       *DockerAgentHandlers
+	kubernetesAgentHandlers   *KubernetesAgentHandlers
 	hostAgentHandlers         *HostAgentHandlers
 	temperatureProxyHandlers  *TemperatureProxyHandlers
 	systemSettingsHandler     *SystemSettingsHandler
+	aiSettingsHandler         *AISettingsHandler
+	resourceHandlers          *ResourceHandlers
+	agentExecServer           *agentexec.Server
 	wsHub                     *websocket.Hub
 	reloadFunc                func() error
 	updateManager             *updates.Manager
 	updateHistory             *updates.UpdateHistory
 	exportLimiter             *RateLimiter
+	downloadLimiter           *RateLimiter
 	persistence               *config.ConfigPersistence
 	oidcMu                    sync.Mutex
 	oidcService               *OIDCService
@@ -70,6 +78,8 @@ type Router struct {
 	publicURLDetected    bool
 	bootstrapTokenHash   string
 	bootstrapTokenPath   string
+	checksumMu           sync.RWMutex
+	checksumCache        map[string]checksumCacheEntry
 }
 
 func pulseBinDir() string {
@@ -119,17 +129,19 @@ func NewRouter(cfg *config.Config, monitor *monitoring.Monitor, wsHub *websocket
 	updateManager.SetHistory(updateHistory)
 
 	r := &Router{
-		mux:           http.NewServeMux(),
-		config:        cfg,
-		monitor:       monitor,
-		wsHub:         wsHub,
-		reloadFunc:    reloadFunc,
-		updateManager: updateManager,
-		updateHistory: updateHistory,
-		exportLimiter: NewRateLimiter(5, 1*time.Minute), // 5 attempts per minute
-		persistence:   config.NewConfigPersistence(cfg.DataPath),
-		serverVersion: strings.TrimSpace(serverVersion),
-		projectRoot:   projectRoot,
+		mux:             http.NewServeMux(),
+		config:          cfg,
+		monitor:         monitor,
+		wsHub:           wsHub,
+		reloadFunc:      reloadFunc,
+		updateManager:   updateManager,
+		updateHistory:   updateHistory,
+		exportLimiter:   NewRateLimiter(5, 1*time.Minute),  // 5 attempts per minute
+		downloadLimiter: NewRateLimiter(60, 1*time.Minute), // downloads/installers per minute per IP
+		persistence:     config.NewConfigPersistence(cfg.DataPath),
+		serverVersion:   strings.TrimSpace(serverVersion),
+		projectRoot:     projectRoot,
+		checksumCache:   make(map[string]checksumCacheEntry),
 	}
 
 	r.initializeBootstrapToken()
@@ -173,17 +185,21 @@ func (r *Router) setupRoutes() {
 	r.notificationQueueHandlers = NewNotificationQueueHandlers(r.monitor)
 	guestMetadataHandler := NewGuestMetadataHandler(r.config.DataPath)
 	dockerMetadataHandler := NewDockerMetadataHandler(r.config.DataPath)
+	hostMetadataHandler := NewHostMetadataHandler(r.config.DataPath)
 	r.configHandlers = NewConfigHandlers(r.config, r.monitor, r.reloadFunc, r.wsHub, guestMetadataHandler, r.reloadSystemSettings)
 	updateHandlers := NewUpdateHandlers(r.updateManager, r.updateHistory)
 	r.dockerAgentHandlers = NewDockerAgentHandlers(r.monitor, r.wsHub)
+	r.kubernetesAgentHandlers = NewKubernetesAgentHandlers(r.monitor, r.wsHub)
 	r.hostAgentHandlers = NewHostAgentHandlers(r.monitor, r.wsHub)
 	r.temperatureProxyHandlers = NewTemperatureProxyHandlers(r.config, r.persistence, r.reloadFunc)
+	r.resourceHandlers = NewResourceHandlers()
 
 	// API routes
 	r.mux.HandleFunc("/api/health", r.handleHealth)
 	r.mux.HandleFunc("/api/monitoring/scheduler/health", RequireAuth(r.config, r.handleSchedulerHealth))
 	r.mux.HandleFunc("/api/state", r.handleState)
 	r.mux.HandleFunc("/api/agents/docker/report", RequireAuth(r.config, RequireScope(config.ScopeDockerReport, r.dockerAgentHandlers.HandleReport)))
+	r.mux.HandleFunc("/api/agents/kubernetes/report", RequireAuth(r.config, RequireScope(config.ScopeKubernetesReport, r.kubernetesAgentHandlers.HandleReport)))
 	r.mux.HandleFunc("/api/agents/host/report", RequireAuth(r.config, RequireScope(config.ScopeHostReport, r.hostAgentHandlers.HandleReport)))
 	r.mux.HandleFunc("/api/agents/host/lookup", RequireAuth(r.config, RequireScope(config.ScopeHostReport, r.hostAgentHandlers.HandleLookup)))
 	r.mux.HandleFunc("/api/agents/host/", RequireAdmin(r.config, RequireScope(config.ScopeHostManage, r.hostAgentHandlers.HandleDeleteHost)))
@@ -194,10 +210,13 @@ func (r *Router) setupRoutes() {
 	r.mux.HandleFunc("/api/temperature-proxy/host-status", RequireAdmin(r.config, RequireScope(config.ScopeSettingsRead, r.handleHostProxyStatus)))
 	r.mux.HandleFunc("/api/agents/docker/commands/", RequireAuth(r.config, RequireScope(config.ScopeDockerReport, r.dockerAgentHandlers.HandleCommandAck)))
 	r.mux.HandleFunc("/api/agents/docker/hosts/", RequireAdmin(r.config, RequireScope(config.ScopeDockerManage, r.dockerAgentHandlers.HandleDockerHostActions)))
+	r.mux.HandleFunc("/api/agents/kubernetes/clusters/", RequireAdmin(r.config, RequireScope(config.ScopeKubernetesManage, r.kubernetesAgentHandlers.HandleClusterActions)))
 	r.mux.HandleFunc("/api/version", r.handleVersion)
 	r.mux.HandleFunc("/api/storage/", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleStorage)))
 	r.mux.HandleFunc("/api/storage-charts", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleStorageCharts)))
 	r.mux.HandleFunc("/api/charts", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleCharts)))
+	r.mux.HandleFunc("/api/metrics-store/stats", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleMetricsStoreStats)))
+	r.mux.HandleFunc("/api/metrics-store/history", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleMetricsHistory)))
 	r.mux.HandleFunc("/api/diagnostics", RequireAuth(r.config, r.handleDiagnostics))
 	r.mux.HandleFunc("/api/diagnostics/temperature-proxy/register-nodes", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.handleDiagnosticsRegisterProxyNodes)))
 	r.mux.HandleFunc("/api/diagnostics/docker/prepare-token", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.handleDiagnosticsDockerPrepareToken)))
@@ -216,6 +235,11 @@ func (r *Router) setupRoutes() {
 	r.mux.HandleFunc("/api/backups/pbs", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleBackupsPBS)))
 	r.mux.HandleFunc("/api/snapshots", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.handleSnapshots)))
 
+	// Unified resources API (Phase 1 of unified resource architecture)
+	r.mux.HandleFunc("/api/resources", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.resourceHandlers.HandleGetResources)))
+	r.mux.HandleFunc("/api/resources/stats", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.resourceHandlers.HandleGetResourceStats)))
+	r.mux.HandleFunc("/api/resources/", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, r.resourceHandlers.HandleGetResource)))
+
 	// Guest metadata routes
 	r.mux.HandleFunc("/api/guests/metadata", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, guestMetadataHandler.HandleGetMetadata)))
 	r.mux.HandleFunc("/api/guests/metadata/", RequireAuth(r.config, func(w http.ResponseWriter, req *http.Request) {
@@ -264,6 +288,30 @@ func (r *Router) setupRoutes() {
 		}
 	}))
 
+	// Host metadata routes
+	r.mux.HandleFunc("/api/hosts/metadata", RequireAuth(r.config, RequireScope(config.ScopeMonitoringRead, hostMetadataHandler.HandleGetMetadata)))
+	r.mux.HandleFunc("/api/hosts/metadata/", RequireAuth(r.config, func(w http.ResponseWriter, req *http.Request) {
+		switch req.Method {
+		case http.MethodGet:
+			if !ensureScope(w, req, config.ScopeMonitoringRead) {
+				return
+			}
+			hostMetadataHandler.HandleGetMetadata(w, req)
+		case http.MethodPut, http.MethodPost:
+			if !ensureScope(w, req, config.ScopeMonitoringWrite) {
+				return
+			}
+			hostMetadataHandler.HandleUpdateMetadata(w, req)
+		case http.MethodDelete:
+			if !ensureScope(w, req, config.ScopeMonitoringWrite) {
+				return
+			}
+			hostMetadataHandler.HandleDeleteMetadata(w, req)
+		default:
+			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		}
+	}))
+
 	// Update routes
 	r.mux.HandleFunc("/api/updates/check", RequireAdmin(r.config, RequireScope(config.ScopeSettingsRead, updateHandlers.HandleCheckUpdates)))
 	r.mux.HandleFunc("/api/updates/apply", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, updateHandlers.HandleApplyUpdate)))
@@ -920,6 +968,9 @@ func (r *Router) setupRoutes() {
 	// Generate setup script URL with temporary token (for authenticated users)
 	r.mux.HandleFunc("/api/setup-script-url", r.configHandlers.HandleSetupScriptURL)
 
+	// Generate agent install command with API token (for authenticated users)
+	r.mux.HandleFunc("/api/agent-install-command", RequireAuth(r.config, r.configHandlers.HandleAgentInstallCommand))
+
 	// Auto-register route for setup scripts
 	r.mux.HandleFunc("/api/auto-register", r.configHandlers.HandleAutoRegister)
 	// Discovery endpoint
@@ -994,23 +1045,124 @@ func (r *Router) setupRoutes() {
 	r.mux.HandleFunc("/api/system/proxy-public-key", r.handleProxyPublicKey)
 	// Old API token endpoints removed - now using /api/security/regenerate-token
 
-	// Docker agent download endpoints
-	r.mux.HandleFunc("/install-docker-agent.sh", r.handleDownloadInstallScript) // Serves the Docker agent install script
-	r.mux.HandleFunc("/install-container-agent.sh", r.handleDownloadContainerAgentInstallScript)
-	r.mux.HandleFunc("/download/pulse-docker-agent", r.handleDownloadAgent)
+	// Agent execution server for AI tool use
+	r.agentExecServer = agentexec.NewServer(func(token string) bool {
+		// Validate agent tokens using the API tokens system
+		if r.config == nil {
+			return false
+		}
+		// First check the new API tokens system
+		if _, ok := r.config.ValidateAPIToken(token); ok {
+			return true
+		}
+		// Fall back to legacy single token if set
+		if r.config.APIToken != "" {
+			return auth.CompareAPIToken(token, r.config.APIToken)
+		}
+		return false
+	})
 
-	// Host agent download endpoints
-	r.mux.HandleFunc("/install-host-agent.sh", r.handleDownloadHostAgentInstallScript)
-	r.mux.HandleFunc("/install-host-agent.ps1", r.handleDownloadHostAgentInstallScriptPS)
-	r.mux.HandleFunc("/uninstall-host-agent.sh", r.handleDownloadHostAgentUninstallScript)
-	r.mux.HandleFunc("/uninstall-host-agent.ps1", r.handleDownloadHostAgentUninstallScriptPS)
-	r.mux.HandleFunc("/download/pulse-host-agent", r.handleDownloadHostAgent)
-	r.mux.HandleFunc("/download/pulse-host-agent.sha256", r.handleDownloadHostAgent)
+	// AI settings endpoints
+	r.aiSettingsHandler = NewAISettingsHandler(r.config, r.persistence, r.agentExecServer)
+	// Inject state provider so AI has access to full infrastructure context (VMs, containers, IPs)
+	if r.monitor != nil {
+		r.aiSettingsHandler.SetStateProvider(r.monitor)
+		// Inject alert provider so AI has awareness of current alerts
+		if alertManager := r.monitor.GetAlertManager(); alertManager != nil {
+			r.aiSettingsHandler.SetAlertProvider(ai.NewAlertManagerAdapter(alertManager))
+		}
+	}
+	// Inject unified resource provider for Phase 2 AI context (cleaner, deduplicated view)
+	if r.resourceHandlers != nil {
+		r.aiSettingsHandler.SetResourceProvider(r.resourceHandlers.Store())
+	}
+	// Inject metadata provider for AI URL discovery feature
+	// This allows AI to set resource URLs when it discovers web services
+	metadataProvider := NewMetadataProvider(
+		guestMetadataHandler.Store(),
+		dockerMetadataHandler.Store(),
+		hostMetadataHandler.Store(),
+	)
+	r.aiSettingsHandler.SetMetadataProvider(metadataProvider)
+	r.mux.HandleFunc("/api/settings/ai", RequireAdmin(r.config, RequireScope(config.ScopeSettingsRead, r.aiSettingsHandler.HandleGetAISettings)))
+	r.mux.HandleFunc("/api/settings/ai/update", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.aiSettingsHandler.HandleUpdateAISettings)))
+	r.mux.HandleFunc("/api/ai/test", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.aiSettingsHandler.HandleTestAIConnection)))
+	r.mux.HandleFunc("/api/ai/test/{provider}", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.aiSettingsHandler.HandleTestProvider)))
+	r.mux.HandleFunc("/api/ai/models", RequireAuth(r.config, r.aiSettingsHandler.HandleListModels))
+	r.mux.HandleFunc("/api/ai/execute", RequireAuth(r.config, r.aiSettingsHandler.HandleExecute))
+	r.mux.HandleFunc("/api/ai/execute/stream", RequireAuth(r.config, r.aiSettingsHandler.HandleExecuteStream))
+	r.mux.HandleFunc("/api/ai/investigate-alert", RequireAuth(r.config, r.aiSettingsHandler.HandleInvestigateAlert))
+	r.mux.HandleFunc("/api/ai/run-command", RequireAuth(r.config, r.aiSettingsHandler.HandleRunCommand))
+	r.mux.HandleFunc("/api/ai/knowledge", RequireAuth(r.config, r.aiSettingsHandler.HandleGetGuestKnowledge))
+	r.mux.HandleFunc("/api/ai/knowledge/save", RequireAuth(r.config, r.aiSettingsHandler.HandleSaveGuestNote))
+	r.mux.HandleFunc("/api/ai/knowledge/delete", RequireAuth(r.config, r.aiSettingsHandler.HandleDeleteGuestNote))
+	r.mux.HandleFunc("/api/ai/knowledge/export", RequireAuth(r.config, r.aiSettingsHandler.HandleExportGuestKnowledge))
+	r.mux.HandleFunc("/api/ai/knowledge/import", RequireAuth(r.config, r.aiSettingsHandler.HandleImportGuestKnowledge))
+	r.mux.HandleFunc("/api/ai/knowledge/clear", RequireAuth(r.config, r.aiSettingsHandler.HandleClearGuestKnowledge))
+	r.mux.HandleFunc("/api/ai/debug/context", RequireAdmin(r.config, r.aiSettingsHandler.HandleDebugContext))
+	r.mux.HandleFunc("/api/ai/agents", RequireAuth(r.config, r.aiSettingsHandler.HandleGetConnectedAgents))
+	r.mux.HandleFunc("/api/ai/cost/summary", RequireAuth(r.config, r.aiSettingsHandler.HandleGetAICostSummary))
+	r.mux.HandleFunc("/api/ai/cost/reset", RequireAdmin(r.config, RequireScope(config.ScopeSettingsWrite, r.aiSettingsHandler.HandleResetAICostHistory)))
+	r.mux.HandleFunc("/api/ai/cost/export", RequireAdmin(r.config, RequireScope(config.ScopeSettingsRead, r.aiSettingsHandler.HandleExportAICostHistory)))
+	// OAuth endpoints for Claude Pro/Max subscription authentication
+	r.mux.HandleFunc("/api/ai/oauth/start", RequireAdmin(r.config, r.aiSettingsHandler.HandleOAuthStart))
+	r.mux.HandleFunc("/api/ai/oauth/exchange", RequireAdmin(r.config, r.aiSettingsHandler.HandleOAuthExchange)) // Manual code input
+	r.mux.HandleFunc("/api/ai/oauth/callback", r.aiSettingsHandler.HandleOAuthCallback)                         // Public - receives redirect from Anthropic
+	r.mux.HandleFunc("/api/ai/oauth/disconnect", RequireAdmin(r.config, r.aiSettingsHandler.HandleOAuthDisconnect))
 
-	// Unified Agent endpoints
-	r.mux.HandleFunc("/install.sh", r.handleDownloadUnifiedInstallScript)
-	r.mux.HandleFunc("/install.ps1", r.handleDownloadUnifiedInstallScriptPS)
-	r.mux.HandleFunc("/download/pulse-agent", r.handleDownloadUnifiedAgent)
+	// AI Patrol routes for background monitoring
+	r.mux.HandleFunc("/api/ai/patrol/status", RequireAuth(r.config, r.aiSettingsHandler.HandleGetPatrolStatus))
+	r.mux.HandleFunc("/api/ai/patrol/stream", RequireAuth(r.config, r.aiSettingsHandler.HandlePatrolStream))
+	r.mux.HandleFunc("/api/ai/patrol/findings", RequireAuth(r.config, r.aiSettingsHandler.HandleGetPatrolFindings))
+	r.mux.HandleFunc("/api/ai/patrol/history", RequireAuth(r.config, r.aiSettingsHandler.HandleGetFindingsHistory))
+	r.mux.HandleFunc("/api/ai/patrol/run", RequireAdmin(r.config, r.aiSettingsHandler.HandleForcePatrol))
+	r.mux.HandleFunc("/api/ai/patrol/acknowledge", RequireAuth(r.config, r.aiSettingsHandler.HandleAcknowledgeFinding))
+	r.mux.HandleFunc("/api/ai/patrol/dismiss", RequireAuth(r.config, r.aiSettingsHandler.HandleDismissFinding))   // Dismiss with reason (LLM memory)
+	r.mux.HandleFunc("/api/ai/patrol/suppress", RequireAuth(r.config, r.aiSettingsHandler.HandleSuppressFinding)) // Permanently suppress (LLM memory)
+	r.mux.HandleFunc("/api/ai/patrol/snooze", RequireAuth(r.config, r.aiSettingsHandler.HandleSnoozeFinding))
+	r.mux.HandleFunc("/api/ai/patrol/resolve", RequireAuth(r.config, r.aiSettingsHandler.HandleResolveFinding))
+	r.mux.HandleFunc("/api/ai/patrol/runs", RequireAuth(r.config, r.aiSettingsHandler.HandleGetPatrolRunHistory))
+	// Suppression rules management
+	r.mux.HandleFunc("/api/ai/patrol/suppressions", RequireAuth(r.config, func(w http.ResponseWriter, req *http.Request) {
+		switch req.Method {
+		case http.MethodGet:
+			r.aiSettingsHandler.HandleGetSuppressionRules(w, req)
+		case http.MethodPost:
+			r.aiSettingsHandler.HandleAddSuppressionRule(w, req)
+		default:
+			http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		}
+	}))
+	r.mux.HandleFunc("/api/ai/patrol/suppressions/", RequireAuth(r.config, r.aiSettingsHandler.HandleDeleteSuppressionRule))
+	r.mux.HandleFunc("/api/ai/patrol/dismissed", RequireAuth(r.config, r.aiSettingsHandler.HandleGetDismissedFindings))
+
+	// AI Intelligence endpoints - expose learned patterns, correlations, and predictions
+	r.mux.HandleFunc("/api/ai/intelligence/patterns", RequireAuth(r.config, r.aiSettingsHandler.HandleGetPatterns))
+	r.mux.HandleFunc("/api/ai/intelligence/predictions", RequireAuth(r.config, r.aiSettingsHandler.HandleGetPredictions))
+	r.mux.HandleFunc("/api/ai/intelligence/correlations", RequireAuth(r.config, r.aiSettingsHandler.HandleGetCorrelations))
+	r.mux.HandleFunc("/api/ai/intelligence/changes", RequireAuth(r.config, r.aiSettingsHandler.HandleGetRecentChanges))
+	r.mux.HandleFunc("/api/ai/intelligence/baselines", RequireAuth(r.config, r.aiSettingsHandler.HandleGetBaselines))
+
+	// Agent WebSocket for AI command execution
+	r.mux.HandleFunc("/api/agent/ws", r.handleAgentWebSocket)
+
+	// Docker agent download endpoints (public but rate limited)
+	r.mux.HandleFunc("/install-docker-agent.sh", r.downloadLimiter.Middleware(r.handleDownloadInstallScript)) // Serves the Docker agent install script
+	r.mux.HandleFunc("/install-container-agent.sh", r.downloadLimiter.Middleware(r.handleDownloadContainerAgentInstallScript))
+	r.mux.HandleFunc("/download/pulse-docker-agent", r.downloadLimiter.Middleware(r.handleDownloadAgent))
+
+	// Host agent download endpoints (public but rate limited)
+	r.mux.HandleFunc("/install-host-agent.sh", r.downloadLimiter.Middleware(r.handleDownloadHostAgentInstallScript))
+	r.mux.HandleFunc("/install-host-agent.ps1", r.downloadLimiter.Middleware(r.handleDownloadHostAgentInstallScriptPS))
+	r.mux.HandleFunc("/uninstall-host-agent.sh", r.downloadLimiter.Middleware(r.handleDownloadHostAgentUninstallScript))
+	r.mux.HandleFunc("/uninstall-host-agent.ps1", r.downloadLimiter.Middleware(r.handleDownloadHostAgentUninstallScriptPS))
+	r.mux.HandleFunc("/download/pulse-host-agent", r.downloadLimiter.Middleware(r.handleDownloadHostAgent))
+	r.mux.HandleFunc("/download/pulse-host-agent.sha256", r.downloadLimiter.Middleware(r.handleDownloadHostAgent))
+
+	// Unified Agent endpoints (public but rate limited)
+	r.mux.HandleFunc("/install.sh", r.downloadLimiter.Middleware(r.handleDownloadUnifiedInstallScript))
+	r.mux.HandleFunc("/install.ps1", r.downloadLimiter.Middleware(r.handleDownloadUnifiedInstallScriptPS))
+	r.mux.HandleFunc("/download/pulse-agent", r.downloadLimiter.Middleware(r.handleDownloadUnifiedAgent))
 
 	r.mux.HandleFunc("/api/agent/version", r.handleAgentVersion)
 	r.mux.HandleFunc("/api/server/info", r.handleServerInfo)
@@ -1029,6 +1181,15 @@ func (r *Router) setupRoutes() {
 
 }
 
+// handleAgentWebSocket handles WebSocket connections from agents for AI command execution
+func (r *Router) handleAgentWebSocket(w http.ResponseWriter, req *http.Request) {
+	if r.agentExecServer == nil {
+		http.Error(w, "Agent execution not available", http.StatusServiceUnavailable)
+		return
+	}
+	r.agentExecServer.HandleWebSocket(w, req)
+}
+
 func (r *Router) handleVerifyTemperatureSSH(w http.ResponseWriter, req *http.Request) {
 	if r.configHandlers == nil {
 		http.Error(w, "Service unavailable", http.StatusServiceUnavailable)
@@ -1202,6 +1363,15 @@ func (r *Router) SetMonitor(m *monitoring.Monitor) {
 				mgr.SetPublicURL(url)
 			}
 		}
+		// Inject resource store for polling optimization
+		if r.resourceHandlers != nil {
+			log.Debug().Msg("[Router] Injecting resource store into monitor")
+			m.SetResourceStore(r.resourceHandlers.Store())
+			// Also set state provider for on-demand resource population
+			r.resourceHandlers.SetStateProvider(m)
+		} else {
+			log.Warn().Msg("[Router] resourceHandlers is nil, cannot inject resource store")
+		}
 	}
 }
 
@@ -1231,6 +1401,287 @@ func (r *Router) SetConfig(cfg *config.Config) {
 	}
 }
 
+// StartPatrol starts the AI patrol service for background infrastructure monitoring
+func (r *Router) StartPatrol(ctx context.Context) {
+	if r.aiSettingsHandler != nil {
+		// Connect patrol to user-configured alert thresholds so it warns before alerts fire
+		if r.monitor != nil {
+			if alertManager := r.monitor.GetAlertManager(); alertManager != nil {
+				thresholdAdapter := ai.NewAlertThresholdAdapter(alertManager)
+				r.aiSettingsHandler.SetPatrolThresholdProvider(thresholdAdapter)
+			}
+		}
+
+		// Enable findings persistence (load from disk, auto-save on changes)
+		if r.persistence != nil {
+			findingsPersistence := ai.NewFindingsPersistenceAdapter(r.persistence)
+			if err := r.aiSettingsHandler.SetPatrolFindingsPersistence(findingsPersistence); err != nil {
+				log.Error().Err(err).Msg("Failed to initialize AI findings persistence")
+			}
+
+			// Enable patrol run history persistence
+			historyPersistence := ai.NewPatrolHistoryPersistenceAdapter(r.persistence)
+			if err := r.aiSettingsHandler.SetPatrolRunHistoryPersistence(historyPersistence); err != nil {
+				log.Error().Err(err).Msg("Failed to initialize AI patrol run history persistence")
+			}
+		}
+
+		// Connect patrol to metrics history for enriched context (trends, predictions)
+		if r.monitor != nil {
+			if metricsHistory := r.monitor.GetMetricsHistory(); metricsHistory != nil {
+				adapter := ai.NewMetricsHistoryAdapter(metricsHistory)
+				if adapter != nil {
+					r.aiSettingsHandler.SetMetricsHistoryProvider(adapter)
+				}
+
+				// Initialize baseline store for anomaly detection
+				// Uses config dir for persistence
+				baselineCfg := ai.DefaultBaselineConfig()
+				if r.persistence != nil {
+					baselineCfg.DataDir = r.persistence.DataDir()
+				}
+				baselineStore := ai.NewBaselineStore(baselineCfg)
+				if baselineStore != nil {
+					r.aiSettingsHandler.SetBaselineStore(baselineStore)
+
+					// Start background baseline learning loop
+					go r.startBaselineLearning(ctx, baselineStore, metricsHistory)
+				}
+			}
+		}
+
+		// Initialize operational memory (change detection and remediation logging)
+		dataDir := ""
+		if r.persistence != nil {
+			dataDir = r.persistence.DataDir()
+		}
+
+		changeDetector := ai.NewChangeDetector(ai.ChangeDetectorConfig{
+			MaxChanges: 1000,
+			DataDir:    dataDir,
+		})
+		if changeDetector != nil {
+			r.aiSettingsHandler.SetChangeDetector(changeDetector)
+		}
+
+		remediationLog := ai.NewRemediationLog(ai.RemediationLogConfig{
+			MaxRecords: 500,
+			DataDir:    dataDir,
+		})
+		if remediationLog != nil {
+			r.aiSettingsHandler.SetRemediationLog(remediationLog)
+		}
+
+		// Initialize pattern detector for failure prediction
+		patternDetector := ai.NewPatternDetector(ai.PatternDetectorConfig{
+			MaxEvents:       5000,
+			MinOccurrences:  3,
+			PatternWindow:   90 * 24 * time.Hour,
+			PredictionLimit: 30 * 24 * time.Hour,
+			DataDir:         dataDir,
+		})
+		if patternDetector != nil {
+			r.aiSettingsHandler.SetPatternDetector(patternDetector)
+
+			// Wire alert history to pattern detector for event tracking
+			if alertManager := r.monitor.GetAlertManager(); alertManager != nil {
+				alertManager.OnAlertHistory(func(alert alerts.Alert) {
+					// Convert alert type to trackable event
+					patternDetector.RecordFromAlert(alert.ResourceID, alert.Type+"_"+string(alert.Level), alert.StartTime)
+				})
+				log.Info().Msg("AI Pattern Detector: Wired to alert history for failure prediction")
+			}
+		}
+
+		// Initialize correlation detector for multi-resource relationships
+		correlationDetector := ai.NewCorrelationDetector(ai.CorrelationConfig{
+			MaxEvents:         10000,
+			CorrelationWindow: 10 * time.Minute,
+			MinOccurrences:    3,
+			RetentionWindow:   30 * 24 * time.Hour,
+			DataDir:           dataDir,
+		})
+		if correlationDetector != nil {
+			r.aiSettingsHandler.SetCorrelationDetector(correlationDetector)
+
+			// Wire alert history to correlation detector
+			if alertManager := r.monitor.GetAlertManager(); alertManager != nil {
+				alertManager.OnAlertHistory(func(alert alerts.Alert) {
+					// Record as correlation event
+					eventType := ai.CorrelationEventType(ai.CorrelationEventAlert)
+					switch alert.Type {
+					case "cpu":
+						eventType = ai.CorrelationEventHighCPU
+					case "memory":
+						eventType = ai.CorrelationEventHighMem
+					case "disk":
+						eventType = ai.CorrelationEventDiskFull
+					case "offline", "connectivity":
+						eventType = ai.CorrelationEventOffline
+					}
+					correlationDetector.RecordEvent(ai.CorrelationEvent{
+						ResourceID:   alert.ResourceID,
+						ResourceName: alert.ResourceName,
+						ResourceType: alert.Type,
+						EventType:    eventType,
+						Timestamp:    alert.StartTime,
+						Value:        alert.Value,
+					})
+				})
+				log.Info().Msg("AI Correlation Detector: Wired to alert history for multi-resource analysis")
+			}
+		}
+
+		r.aiSettingsHandler.StartPatrol(ctx)
+	}
+}
+
+// StopPatrol stops the AI patrol service
+func (r *Router) StopPatrol() {
+	if r.aiSettingsHandler != nil {
+		r.aiSettingsHandler.StopPatrol()
+	}
+}
+
+// startBaselineLearning runs a background loop that learns baselines from metrics history
+// This enables anomaly detection by understanding what "normal" looks like for each resource
+func (r *Router) startBaselineLearning(ctx context.Context, store *ai.BaselineStore, metricsHistory *monitoring.MetricsHistory) {
+	if store == nil || metricsHistory == nil {
+		return
+	}
+
+	// Learn every hour
+	ticker := time.NewTicker(1 * time.Hour)
+	defer ticker.Stop()
+
+	// Run initial learning after a short delay (allow metrics to accumulate)
+	select {
+	case <-ctx.Done():
+		return
+	case <-time.After(5 * time.Minute):
+		r.learnBaselines(store, metricsHistory)
+	}
+
+	log.Info().Msg("Baseline learning loop started")
+
+	for {
+		select {
+		case <-ctx.Done():
+			// Save baselines before exit
+			if err := store.Save(); err != nil {
+				log.Warn().Err(err).Msg("Failed to save baselines on shutdown")
+			}
+			log.Info().Msg("Baseline learning loop stopped")
+			return
+		case <-ticker.C:
+			r.learnBaselines(store, metricsHistory)
+		}
+	}
+}
+
+// learnBaselines updates baselines for all resources from metrics history
+func (r *Router) learnBaselines(store *ai.BaselineStore, metricsHistory *monitoring.MetricsHistory) {
+	if r.monitor == nil {
+		return
+	}
+
+	state := r.monitor.GetState()
+	learningWindow := 7 * 24 * time.Hour // Learn from 7 days of data
+	var learned int
+
+	// Learn baselines for nodes
+	for _, node := range state.Nodes {
+		for _, metric := range []string{"cpu", "memory"} {
+			points := metricsHistory.GetNodeMetrics(node.ID, metric, learningWindow)
+			if len(points) > 0 {
+				baselinePoints := make([]ai.BaselineMetricPoint, len(points))
+				for i, p := range points {
+					baselinePoints[i] = ai.BaselineMetricPoint{Value: p.Value, Timestamp: p.Timestamp}
+				}
+				if err := store.Learn(node.ID, "node", metric, baselinePoints); err == nil {
+					learned++
+				}
+			}
+		}
+	}
+
+	// Learn baselines for VMs
+	for _, vm := range state.VMs {
+		if vm.Template {
+			continue
+		}
+		for _, metric := range []string{"cpu", "memory", "disk"} {
+			points := metricsHistory.GetGuestMetrics(vm.ID, metric, learningWindow)
+			if len(points) > 0 {
+				baselinePoints := make([]ai.BaselineMetricPoint, len(points))
+				for i, p := range points {
+					baselinePoints[i] = ai.BaselineMetricPoint{Value: p.Value, Timestamp: p.Timestamp}
+				}
+				if err := store.Learn(vm.ID, "vm", metric, baselinePoints); err == nil {
+					learned++
+				}
+			}
+		}
+	}
+
+	// Learn baselines for containers
+	for _, ct := range state.Containers {
+		if ct.Template {
+			continue
+		}
+		for _, metric := range []string{"cpu", "memory", "disk"} {
+			points := metricsHistory.GetGuestMetrics(ct.ID, metric, learningWindow)
+			if len(points) > 0 {
+				baselinePoints := make([]ai.BaselineMetricPoint, len(points))
+				for i, p := range points {
+					baselinePoints[i] = ai.BaselineMetricPoint{Value: p.Value, Timestamp: p.Timestamp}
+				}
+				if err := store.Learn(ct.ID, "container", metric, baselinePoints); err == nil {
+					learned++
+				}
+			}
+		}
+	}
+
+	// Save after learning
+	if err := store.Save(); err != nil {
+		log.Warn().Err(err).Msg("Failed to save baselines")
+	}
+
+	log.Debug().
+		Int("baselines_updated", learned).
+		Int("resources", store.ResourceCount()).
+		Msg("Baseline learning complete")
+}
+
+// GetAlertTriggeredAnalyzer returns the alert-triggered analyzer for wiring into the monitor's alert callback
+// This enables AI to analyze specific resources when alerts fire, providing token-efficient real-time insights
+func (r *Router) GetAlertTriggeredAnalyzer() *ai.AlertTriggeredAnalyzer {
+	if r.aiSettingsHandler != nil {
+		return r.aiSettingsHandler.GetAlertTriggeredAnalyzer()
+	}
+	return nil
+}
+
+// WireAlertTriggeredAI connects the alert-triggered AI analyzer to the monitor's alert callback
+// This should be called after StartPatrol() to ensure the analyzer is initialized
+func (r *Router) WireAlertTriggeredAI() {
+	analyzer := r.GetAlertTriggeredAnalyzer()
+	if analyzer == nil {
+		log.Debug().Msg("Alert-triggered AI analyzer not available")
+		return
+	}
+
+	if r.monitor == nil {
+		log.Debug().Msg("Monitor not available for AI alert callback")
+		return
+	}
+
+	// Wire the analyzer's OnAlertFired method to the monitor's alert callback
+	r.monitor.SetAlertTriggeredAICallback(analyzer.OnAlertFired)
+	log.Info().Msg("Alert-triggered AI analysis wired to monitor")
+}
+
 // reloadSystemSettings loads system settings from disk and caches them
 func (r *Router) reloadSystemSettings() {
 	r.settingsMu.Lock()
@@ -1289,6 +1740,10 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
 			w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Token, X-CSRF-Token, X-Setup-Token")
 			w.Header().Set("Access-Control-Expose-Headers", "X-CSRF-Token, X-Authenticated-User, X-Auth-Method")
+			// Allow credentials when origin is specific (not *)
+			if r.config.AllowedOrigins != "*" {
+				w.Header().Set("Access-Control-Allow-Credentials", "true")
+			}
 		}
 
 		// Handle preflight requests
@@ -1351,6 +1806,7 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 				"/install.ps1",                                       // Unified agent Windows installer
 				"/download/pulse-agent",                              // Unified agent binary
 				"/api/agent/version",                                 // Agent update checks need to work before auth
+				"/api/agent/ws",                                      // Agent WebSocket has its own auth via registration
 				"/api/server/info",                                   // Server info for installer script
 				"/api/install/install-sensor-proxy.sh",               // Temperature proxy installer fallback
 				"/api/install/pulse-sensor-proxy",                    // Temperature proxy binary fallback
@@ -1360,6 +1816,7 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 				"/api/system/proxy-public-key",                       // Temperature proxy public key for setup script
 				"/api/temperature-proxy/register",                    // Temperature proxy registration (called by installer)
 				"/api/temperature-proxy/authorized-nodes",            // Proxy control-plane sync
+				"/api/ai/oauth/callback",                             // OAuth callback from Anthropic for Claude subscription auth
 			}
 
 			// Also allow static assets without auth (JS, CSS, etc)
@@ -2401,6 +2858,13 @@ func (r *Router) handleState(w http.ResponseWriter, req *http.Request) {
 	}
 
 	state := r.monitor.GetState()
+
+	// Also populate the unified resource store (Phase 1 of unified architecture)
+	// This runs on every state request to keep resources up-to-date
+	if r.resourceHandlers != nil {
+		r.resourceHandlers.PopulateFromSnapshot(state)
+	}
+
 	frontendState := state.ToFrontend()
 
 	if err := utils.WriteJSONResponse(w, frontendState); err != nil {
@@ -2791,11 +3255,126 @@ func (r *Router) handleCharts(w http.ResponseWriter, req *http.Request) {
 		}
 	}
 
+	// Build guest types map for frontend to correctly identify VM vs Container
+	guestTypes := make(map[string]string)
+	for _, vm := range state.VMs {
+		guestTypes[vm.ID] = "vm"
+	}
+	for _, ct := range state.Containers {
+		guestTypes[ct.ID] = "container"
+	}
+
+	// Process Docker containers - get historical data
+	dockerData := make(map[string]VMChartData)
+	for _, host := range state.DockerHosts {
+		for _, container := range host.Containers {
+			if container.ID == "" {
+				continue
+			}
+
+			if dockerData[container.ID] == nil {
+				dockerData[container.ID] = make(VMChartData)
+			}
+
+			// Get historical metrics using the docker: prefix key
+			metricKey := fmt.Sprintf("docker:%s", container.ID)
+			metrics := r.monitor.GetGuestMetrics(metricKey, duration)
+
+			// Convert metric points to API format
+			for metricType, points := range metrics {
+				dockerData[container.ID][metricType] = make([]MetricPoint, len(points))
+				for i, point := range points {
+					ts := point.Timestamp.Unix() * 1000
+					if ts < oldestTimestamp {
+						oldestTimestamp = ts
+					}
+					dockerData[container.ID][metricType][i] = MetricPoint{
+						Timestamp: ts,
+						Value:     point.Value,
+					}
+				}
+			}
+
+			// If no historical data, add current value
+			if len(dockerData[container.ID]["cpu"]) == 0 {
+				dockerData[container.ID]["cpu"] = []MetricPoint{
+					{Timestamp: currentTime, Value: container.CPUPercent},
+				}
+				dockerData[container.ID]["memory"] = []MetricPoint{
+					{Timestamp: currentTime, Value: container.MemoryPercent},
+				}
+				// Calculate disk percentage for Docker containers
+				var diskPercent float64
+				if container.RootFilesystemBytes > 0 && container.WritableLayerBytes > 0 {
+					diskPercent = float64(container.WritableLayerBytes) / float64(container.RootFilesystemBytes) * 100
+					if diskPercent > 100 {
+						diskPercent = 100
+					}
+				}
+				dockerData[container.ID]["disk"] = []MetricPoint{
+					{Timestamp: currentTime, Value: diskPercent},
+				}
+			}
+		}
+	}
+
+	// Process Docker hosts - get historical data
+	dockerHostData := make(map[string]VMChartData)
+	for _, host := range state.DockerHosts {
+		if host.ID == "" {
+			continue
+		}
+
+		if dockerHostData[host.ID] == nil {
+			dockerHostData[host.ID] = make(VMChartData)
+		}
+
+		// Get historical metrics using the dockerHost: prefix key
+		metricKey := fmt.Sprintf("dockerHost:%s", host.ID)
+		metrics := r.monitor.GetGuestMetrics(metricKey, duration)
+
+		// Convert metric points to API format
+		for metricType, points := range metrics {
+			dockerHostData[host.ID][metricType] = make([]MetricPoint, len(points))
+			for i, point := range points {
+				ts := point.Timestamp.Unix() * 1000
+				if ts < oldestTimestamp {
+					oldestTimestamp = ts
+				}
+				dockerHostData[host.ID][metricType][i] = MetricPoint{
+					Timestamp: ts,
+					Value:     point.Value,
+				}
+			}
+		}
+
+		// If no historical data, add current value
+		if len(dockerHostData[host.ID]["cpu"]) == 0 {
+			dockerHostData[host.ID]["cpu"] = []MetricPoint{
+				{Timestamp: currentTime, Value: host.CPUUsage},
+			}
+			dockerHostData[host.ID]["memory"] = []MetricPoint{
+				{Timestamp: currentTime, Value: host.Memory.Usage},
+			}
+			// Use first disk for host disk percentage
+			var diskPercent float64
+			if len(host.Disks) > 0 {
+				diskPercent = host.Disks[0].Usage
+			}
+			dockerHostData[host.ID]["disk"] = []MetricPoint{
+				{Timestamp: currentTime, Value: diskPercent},
+			}
+		}
+	}
+
 	response := ChartResponse{
-		ChartData:   chartData,
-		NodeData:    nodeData,
-		StorageData: storageData,
-		Timestamp:   currentTime,
+		ChartData:      chartData,
+		NodeData:       nodeData,
+		StorageData:    storageData,
+		DockerData:     dockerData,
+		DockerHostData: dockerHostData,
+		GuestTypes:     guestTypes,
+		Timestamp:      currentTime,
 		Stats: ChartStats{
 			OldestDataTimestamp: oldestTimestamp,
 		},
@@ -2812,6 +3391,7 @@ func (r *Router) handleCharts(w http.ResponseWriter, req *http.Request) {
 		Int("guests", len(chartData)).
 		Int("nodes", len(nodeData)).
 		Int("storage", len(storageData)).
+		Int("dockerContainers", len(dockerData)).
 		Str("range", timeRange).
 		Msg("Chart data response sent")
 }
@@ -2856,6 +3436,185 @@ func (r *Router) handleStorageCharts(w http.ResponseWriter, req *http.Request) {
 	}
 }
 
+// handleMetricsStoreStats returns statistics about the persistent metrics store
+func (r *Router) handleMetricsStoreStats(w http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	store := r.monitor.GetMetricsStore()
+	if store == nil {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"enabled": false,
+			"error":   "Persistent metrics store not initialized",
+		})
+		return
+	}
+
+	stats := store.GetStats()
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(map[string]interface{}{
+		"enabled":       true,
+		"dbPath":        stats.DBPath,
+		"dbSize":        stats.DBSize,
+		"rawCount":      stats.RawCount,
+		"minuteCount":   stats.MinuteCount,
+		"hourlyCount":   stats.HourlyCount,
+		"dailyCount":    stats.DailyCount,
+		"totalWrites":   stats.TotalWrites,
+		"bufferSize":    stats.BufferSize,
+		"lastFlush":     stats.LastFlush,
+		"lastRollup":    stats.LastRollup,
+		"lastRetention": stats.LastRetention,
+	}); err != nil {
+		log.Error().Err(err).Msg("Failed to encode metrics store stats")
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	}
+}
+
+// handleMetricsHistory returns historical metrics from the persistent SQLite store
+// Query params:
+//   - resourceType: "node", "guest", "storage", "docker", "dockerHost" (required)
+//   - resourceId: the resource identifier (required)
+//   - metric: "cpu", "memory", "disk", etc. (optional, omit for all metrics)
+//   - range: time range like "1h", "24h", "7d", "30d", "90d" (optional, default "24h")
+func (r *Router) handleMetricsHistory(w http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodGet {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	store := r.monitor.GetMetricsStore()
+	if store == nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusServiceUnavailable)
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"error": "Persistent metrics store not available",
+		})
+		return
+	}
+
+	query := req.URL.Query()
+	resourceType := query.Get("resourceType")
+	resourceID := query.Get("resourceId")
+	metricType := query.Get("metric")
+	timeRange := query.Get("range")
+
+	if resourceType == "" || resourceID == "" {
+		http.Error(w, "resourceType and resourceId are required", http.StatusBadRequest)
+		return
+	}
+
+	// Parse time range
+	var duration time.Duration
+	switch timeRange {
+	case "1h":
+		duration = time.Hour
+	case "6h":
+		duration = 6 * time.Hour
+	case "12h":
+		duration = 12 * time.Hour
+	case "24h", "1d", "":
+		duration = 24 * time.Hour
+	case "7d":
+		duration = 7 * 24 * time.Hour
+	case "30d":
+		duration = 30 * 24 * time.Hour
+	case "90d":
+		duration = 90 * 24 * time.Hour
+	default:
+		// Try parsing as duration
+		var err error
+		duration, err = time.ParseDuration(timeRange)
+		if err != nil {
+			duration = 24 * time.Hour // Default to 24 hours
+		}
+	}
+
+	end := time.Now()
+	start := end.Add(-duration)
+
+	var response interface{}
+
+	if metricType != "" {
+		// Query single metric type
+		points, err := store.Query(resourceType, resourceID, metricType, start, end)
+		if err != nil {
+			log.Error().Err(err).
+				Str("resourceType", resourceType).
+				Str("resourceId", resourceID).
+				Str("metric", metricType).
+				Msg("Failed to query metrics history")
+			http.Error(w, "Failed to query metrics", http.StatusInternalServerError)
+			return
+		}
+
+		// Convert to frontend format (timestamps in milliseconds)
+		apiPoints := make([]map[string]interface{}, len(points))
+		for i, p := range points {
+			apiPoints[i] = map[string]interface{}{
+				"timestamp": p.Timestamp.UnixMilli(),
+				"value":     p.Value,
+				"min":       p.Min,
+				"max":       p.Max,
+			}
+		}
+
+		response = map[string]interface{}{
+			"resourceType": resourceType,
+			"resourceId":   resourceID,
+			"metric":       metricType,
+			"range":        timeRange,
+			"start":        start.UnixMilli(),
+			"end":          end.UnixMilli(),
+			"points":       apiPoints,
+		}
+	} else {
+		// Query all metrics for this resource
+		metricsMap, err := store.QueryAll(resourceType, resourceID, start, end)
+		if err != nil {
+			log.Error().Err(err).
+				Str("resourceType", resourceType).
+				Str("resourceId", resourceID).
+				Msg("Failed to query all metrics history")
+			http.Error(w, "Failed to query metrics", http.StatusInternalServerError)
+			return
+		}
+
+		// Convert to frontend format
+		apiData := make(map[string][]map[string]interface{})
+		for metric, points := range metricsMap {
+			apiPoints := make([]map[string]interface{}, len(points))
+			for i, p := range points {
+				apiPoints[i] = map[string]interface{}{
+					"timestamp": p.Timestamp.UnixMilli(),
+					"value":     p.Value,
+					"min":       p.Min,
+					"max":       p.Max,
+				}
+			}
+			apiData[metric] = apiPoints
+		}
+
+		response = map[string]interface{}{
+			"resourceType": resourceType,
+			"resourceId":   resourceID,
+			"range":        timeRange,
+			"start":        start.UnixMilli(),
+			"end":          end.UnixMilli(),
+			"metrics":      apiData,
+		}
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		log.Error().Err(err).Msg("Failed to encode metrics history response")
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	}
+}
+
 // handleConfig handles configuration requests
 func (r *Router) handleConfig(w http.ResponseWriter, req *http.Request) {
 	if req.Method != http.MethodGet {
@@ -3391,26 +4150,19 @@ func (r *Router) handleDownloadAgent(w http.ResponseWriter, req *http.Request) {
 			continue
 		}
 
+		checksum, err := r.cachedSHA256(candidate, info)
+		if err != nil {
+			log.Error().Err(err).Str("path", candidate).Msg("Failed to compute docker agent checksum")
+			continue
+		}
+
 		file, err := os.Open(candidate)
 		if err != nil {
 			log.Error().Err(err).Str("path", candidate).Msg("Failed to open docker agent binary for download")
 			continue
 		}
 
-		hasher := sha256.New()
-		if _, err := io.Copy(hasher, file); err != nil {
-			file.Close()
-			log.Error().Err(err).Str("path", candidate).Msg("Failed to hash docker agent binary")
-			continue
-		}
-
-		if _, err := file.Seek(0, io.SeekStart); err != nil {
-			file.Close()
-			log.Error().Err(err).Str("path", candidate).Msg("Failed to rewind docker agent binary")
-			continue
-		}
-
-		w.Header().Set("X-Checksum-Sha256", hex.EncodeToString(hasher.Sum(nil)))
+		w.Header().Set("X-Checksum-Sha256", checksum)
 		http.ServeContent(w, req, filepath.Base(candidate), info.ModTime(), file)
 		file.Close()
 		return
@@ -3661,22 +4413,73 @@ func sortedHostAgentKeys(missing map[string]agentbinaries.HostAgentBinary) []str
 	return keys
 }
 
-// serveChecksum computes and serves the SHA256 checksum of a file
-func (r *Router) serveChecksum(w http.ResponseWriter, filepath string) {
-	file, err := os.Open(filepath)
+type checksumCacheEntry struct {
+	checksum string
+	modTime  time.Time
+	size     int64
+}
+
+func (r *Router) cachedSHA256(filePath string, info os.FileInfo) (string, error) {
+	if filePath == "" {
+		return "", fmt.Errorf("empty file path")
+	}
+
+	if info == nil {
+		var err error
+		info, err = os.Stat(filePath)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	r.checksumMu.RLock()
+	entry, ok := r.checksumCache[filePath]
+	r.checksumMu.RUnlock()
+	if ok && entry.size == info.Size() && entry.modTime.Equal(info.ModTime()) {
+		return entry.checksum, nil
+	}
+
+	file, err := os.Open(filePath)
 	if err != nil {
-		http.Error(w, "Failed to open file", http.StatusInternalServerError)
-		return
+		return "", err
 	}
 	defer file.Close()
 
 	hasher := sha256.New()
 	if _, err := io.Copy(hasher, file); err != nil {
+		return "", err
+	}
+
+	checksum := hex.EncodeToString(hasher.Sum(nil))
+
+	r.checksumMu.Lock()
+	if r.checksumCache == nil {
+		r.checksumCache = make(map[string]checksumCacheEntry)
+	}
+	r.checksumCache[filePath] = checksumCacheEntry{
+		checksum: checksum,
+		modTime:  info.ModTime(),
+		size:     info.Size(),
+	}
+	r.checksumMu.Unlock()
+
+	return checksum, nil
+}
+
+// serveChecksum computes and serves the SHA256 checksum of a file
+func (r *Router) serveChecksum(w http.ResponseWriter, filePath string) {
+	info, err := os.Stat(filePath)
+	if err != nil {
+		http.Error(w, "Failed to stat file", http.StatusInternalServerError)
+		return
+	}
+
+	checksum, err := r.cachedSHA256(filePath, info)
+	if err != nil {
 		http.Error(w, "Failed to compute checksum", http.StatusInternalServerError)
 		return
 	}
 
-	checksum := hex.EncodeToString(hasher.Sum(nil))
 	w.Header().Set("Content-Type", "text/plain")
 	fmt.Fprintf(w, "%s\n", checksum)
 }
diff --git a/internal/api/security.go b/internal/api/security.go
index 89f83b2..3621f1f 100644
--- a/internal/api/security.go
+++ b/internal/api/security.go
@@ -32,11 +32,13 @@ func CheckCSRF(w http.ResponseWriter, r *http.Request) bool {
 
 	// Skip CSRF for API token auth (API clients don't have sessions)
 	if r.Header.Get("X-API-Token") != "" {
+		log.Debug().Str("path", r.URL.Path).Msg("CSRF check skipped: API token auth")
 		return true
 	}
 
 	// Skip CSRF for Basic Auth (doesn't use sessions, not vulnerable to CSRF)
 	if r.Header.Get("Authorization") != "" {
+		log.Debug().Str("path", r.URL.Path).Msg("CSRF check skipped: Basic Auth header present")
 		return true
 	}
 
@@ -45,6 +47,7 @@ func CheckCSRF(w http.ResponseWriter, r *http.Request) bool {
 	if err != nil {
 		// No session cookie means no CSRF check needed
 		// (either no auth configured or using basic auth which doesn't use sessions)
+		log.Debug().Str("path", r.URL.Path).Msg("CSRF check skipped: no session cookie")
 		return true
 	}
 
@@ -54,15 +57,24 @@ func CheckCSRF(w http.ResponseWriter, r *http.Request) bool {
 		csrfToken = r.FormValue("csrf_token")
 	}
 
+	// Log CSRF validation attempt for debugging
+	log.Debug().
+		Str("path", r.URL.Path).
+		Str("method", r.Method).
+		Str("session", safePrefixForLog(cookie.Value, 8)+"...").
+		Bool("has_csrf_token", csrfToken != "").
+		Msg("CSRF validation attempt")
+
 	// No CSRF token means request is not eligible for mutation
 	if csrfToken == "" {
 		log.Warn().
 			Str("path", r.URL.Path).
-			Str("session", cookie.Value[:8]+"...").
+			Str("session", safePrefixForLog(cookie.Value, 8)+"...").
 			Msg("Missing CSRF token")
 		clearCSRFCookie(w)
 		if newToken := issueNewCSRFCookie(w, r, cookie.Value); newToken != "" {
 			w.Header().Set("X-CSRF-Token", newToken)
+			log.Debug().Str("new_token", safePrefixForLog(newToken, 8)+"...").Msg("Issued new CSRF token after missing")
 		}
 		return false
 	}
@@ -71,16 +83,21 @@ func CheckCSRF(w http.ResponseWriter, r *http.Request) bool {
 	if !validateCSRFToken(cookie.Value, csrfToken) {
 		log.Warn().
 			Str("path", r.URL.Path).
-			Str("session", cookie.Value[:8]+"...").
-			Str("provided_token", csrfToken[:8]+"...").
+			Str("session", safePrefixForLog(cookie.Value, 8)+"...").
+			Str("provided_token", safePrefixForLog(csrfToken, 8)+"...").
 			Msg("Invalid CSRF token")
 		clearCSRFCookie(w)
 		if newToken := issueNewCSRFCookie(w, r, cookie.Value); newToken != "" {
 			w.Header().Set("X-CSRF-Token", newToken)
+			log.Debug().Str("new_token", safePrefixForLog(newToken, 8)+"...").Msg("Issued new CSRF token after invalid")
 		}
 		return false
 	}
 
+	log.Debug().
+		Str("path", r.URL.Path).
+		Str("session", safePrefixForLog(cookie.Value, 8)+"...").
+		Msg("CSRF validation successful")
 	return true
 }
 
diff --git a/internal/api/session_store.go b/internal/api/session_store.go
index f2f35d6..3e03cc5 100644
--- a/internal/api/session_store.go
+++ b/internal/api/session_store.go
@@ -150,7 +150,7 @@ func (s *SessionStore) cleanup() {
 	for key, session := range s.sessions {
 		if now.After(session.ExpiresAt) {
 			delete(s.sessions, key)
-			log.Debug().Str("sessionKey", key[:8]+"...").Msg("Cleaned up expired session")
+			log.Debug().Str("sessionKey", safePrefixForLog(key, 8)+"...").Msg("Cleaned up expired session")
 		}
 	}
 }
diff --git a/internal/api/types.go b/internal/api/types.go
index c2e34f9..8c21648 100644
--- a/internal/api/types.go
+++ b/internal/api/types.go
@@ -62,11 +62,14 @@ type StateResponse struct {
 
 // ChartResponse represents chart data
 type ChartResponse struct {
-	ChartData   map[string]VMChartData      `json:"data"`
-	NodeData    map[string]NodeChartData    `json:"nodeData"`
-	StorageData map[string]StorageChartData `json:"storageData"`
-	Timestamp   int64                       `json:"timestamp"`
-	Stats       ChartStats                  `json:"stats"`
+	ChartData      map[string]VMChartData      `json:"data"`
+	NodeData       map[string]NodeChartData    `json:"nodeData"`
+	StorageData    map[string]StorageChartData `json:"storageData"`
+	DockerData     map[string]VMChartData      `json:"dockerData"`     // Docker container metrics (keyed by container ID)
+	DockerHostData map[string]VMChartData      `json:"dockerHostData"` // Docker host metrics (keyed by host ID)
+	GuestTypes     map[string]string           `json:"guestTypes"`     // Maps guest ID to type ("vm" or "container")
+	Timestamp      int64                       `json:"timestamp"`
+	Stats          ChartStats                  `json:"stats"`
 }
 
 // ChartStats represents chart statistics
diff --git a/internal/api/unified_agent.go b/internal/api/unified_agent.go
index e608aa6..8e2e7d9 100644
--- a/internal/api/unified_agent.go
+++ b/internal/api/unified_agent.go
@@ -1,9 +1,6 @@
 package api
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
-	"io"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -139,26 +136,19 @@ func (r *Router) handleDownloadUnifiedAgent(w http.ResponseWriter, req *http.Req
 			continue
 		}
 
+		checksum, err := r.cachedSHA256(candidate, info)
+		if err != nil {
+			log.Error().Err(err).Str("path", candidate).Msg("Failed to compute unified agent checksum")
+			continue
+		}
+
 		file, err := os.Open(candidate)
 		if err != nil {
 			log.Error().Err(err).Str("path", candidate).Msg("Failed to open unified agent binary for download")
 			continue
 		}
 
-		hasher := sha256.New()
-		if _, err := io.Copy(hasher, file); err != nil {
-			file.Close()
-			log.Error().Err(err).Str("path", candidate).Msg("Failed to hash unified agent binary")
-			continue
-		}
-
-		if _, err := file.Seek(0, io.SeekStart); err != nil {
-			file.Close()
-			log.Error().Err(err).Str("path", candidate).Msg("Failed to rewind unified agent binary")
-			continue
-		}
-
-		w.Header().Set("X-Checksum-Sha256", hex.EncodeToString(hasher.Sum(nil)))
+		w.Header().Set("X-Checksum-Sha256", checksum)
 		http.ServeContent(w, req, filepath.Base(candidate), info.ModTime(), file)
 		file.Close()
 		return
diff --git a/internal/api/unified_agent_download_test.go b/internal/api/unified_agent_download_test.go
new file mode 100644
index 0000000..add85c2
--- /dev/null
+++ b/internal/api/unified_agent_download_test.go
@@ -0,0 +1,59 @@
+package api
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestHandleDownloadUnifiedAgentSetsChecksumAndInvalidatesOnChange(t *testing.T) {
+	binDir := setupTempPulseBin(t)
+	filePath := filepath.Join(binDir, "pulse-agent-linux-amd64")
+
+	payload1 := []byte("agent-binary-v1")
+	if err := os.WriteFile(filePath, payload1, 0o755); err != nil {
+		t.Fatalf("failed to write test binary: %v", err)
+	}
+
+	req1 := httptest.NewRequest(http.MethodGet, "/download/pulse-agent?arch=linux-amd64", nil)
+	rr1 := httptest.NewRecorder()
+
+	router := &Router{checksumCache: make(map[string]checksumCacheEntry)}
+	router.handleDownloadUnifiedAgent(rr1, req1)
+
+	if rr1.Code != http.StatusOK {
+		t.Fatalf("expected 200 OK, got %d", rr1.Code)
+	}
+
+	expected1 := fmt.Sprintf("%x", sha256.Sum256(payload1))
+	if got := rr1.Header().Get("X-Checksum-Sha256"); got != expected1 {
+		t.Fatalf("unexpected checksum header: got %q want %q", got, expected1)
+	}
+
+	// Ensure modtime changes for invalidation.
+	time.Sleep(10 * time.Millisecond)
+	payload2 := []byte("agent-binary-v2")
+	if err := os.WriteFile(filePath, payload2, 0o755); err != nil {
+		t.Fatalf("failed to rewrite test binary: %v", err)
+	}
+
+	req2 := httptest.NewRequest(http.MethodGet, "/download/pulse-agent?arch=linux-amd64", nil)
+	rr2 := httptest.NewRecorder()
+	router.handleDownloadUnifiedAgent(rr2, req2)
+
+	expected2 := fmt.Sprintf("%x", sha256.Sum256(payload2))
+	if got := rr2.Header().Get("X-Checksum-Sha256"); got != expected2 {
+		t.Fatalf("checksum did not update after file change: got %q want %q", got, expected2)
+	}
+
+	if strings.TrimSpace(rr2.Body.String()) != string(payload2) {
+		t.Fatalf("unexpected response body after update")
+	}
+}
+
diff --git a/internal/ceph/collector.go b/internal/ceph/collector.go
new file mode 100644
index 0000000..d6398b7
--- /dev/null
+++ b/internal/ceph/collector.go
@@ -0,0 +1,353 @@
+// Package ceph provides functionality for collecting Ceph cluster status
+// directly from the local system using the ceph CLI.
+package ceph
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// ClusterStatus represents the complete Ceph cluster status as collected by the agent.
+type ClusterStatus struct {
+	FSID          string         `json:"fsid"`
+	Health        HealthStatus   `json:"health"`
+	MonMap        MonitorMap     `json:"monMap,omitempty"`
+	MgrMap        ManagerMap     `json:"mgrMap,omitempty"`
+	OSDMap        OSDMap         `json:"osdMap"`
+	PGMap         PGMap          `json:"pgMap"`
+	Pools         []Pool         `json:"pools,omitempty"`
+	Services      []ServiceInfo  `json:"services,omitempty"`
+	CollectedAt   time.Time      `json:"collectedAt"`
+}
+
+// HealthStatus represents Ceph cluster health.
+type HealthStatus struct {
+	Status   string              `json:"status"` // HEALTH_OK, HEALTH_WARN, HEALTH_ERR
+	Checks   map[string]Check    `json:"checks,omitempty"`
+	Summary  []HealthSummary     `json:"summary,omitempty"`
+}
+
+// Check represents a health check detail.
+type Check struct {
+	Severity string   `json:"severity"`
+	Message  string   `json:"message,omitempty"`
+	Detail   []string `json:"detail,omitempty"`
+}
+
+// HealthSummary represents a health summary message.
+type HealthSummary struct {
+	Severity string `json:"severity"`
+	Message  string `json:"message"`
+}
+
+// MonitorMap represents Ceph monitor information.
+type MonitorMap struct {
+	Epoch    int       `json:"epoch"`
+	NumMons  int       `json:"numMons"`
+	Monitors []Monitor `json:"monitors,omitempty"`
+}
+
+// Monitor represents a single Ceph monitor.
+type Monitor struct {
+	Name   string `json:"name"`
+	Rank   int    `json:"rank"`
+	Addr   string `json:"addr,omitempty"`
+	Status string `json:"status,omitempty"`
+}
+
+// ManagerMap represents Ceph manager information.
+type ManagerMap struct {
+	Available bool   `json:"available"`
+	NumMgrs   int    `json:"numMgrs"`
+	ActiveMgr string `json:"activeMgr,omitempty"`
+	Standbys  int    `json:"standbys"`
+}
+
+// OSDMap represents OSD status summary.
+type OSDMap struct {
+	Epoch    int `json:"epoch"`
+	NumOSDs  int `json:"numOsds"`
+	NumUp    int `json:"numUp"`
+	NumIn    int `json:"numIn"`
+	NumDown  int `json:"numDown,omitempty"`
+	NumOut   int `json:"numOut,omitempty"`
+}
+
+// PGMap represents placement group statistics.
+type PGMap struct {
+	NumPGs         int     `json:"numPgs"`
+	BytesTotal     uint64  `json:"bytesTotal"`
+	BytesUsed      uint64  `json:"bytesUsed"`
+	BytesAvailable uint64  `json:"bytesAvailable"`
+	DataBytes      uint64  `json:"dataBytes,omitempty"`
+	UsagePercent   float64 `json:"usagePercent"`
+	DegradedRatio  float64 `json:"degradedRatio,omitempty"`
+	MisplacedRatio float64 `json:"misplacedRatio,omitempty"`
+	ReadBytesPerSec  uint64 `json:"readBytesPerSec,omitempty"`
+	WriteBytesPerSec uint64 `json:"writeBytesPerSec,omitempty"`
+	ReadOpsPerSec    uint64 `json:"readOpsPerSec,omitempty"`
+	WriteOpsPerSec   uint64 `json:"writeOpsPerSec,omitempty"`
+}
+
+// Pool represents a Ceph pool.
+type Pool struct {
+	ID             int     `json:"id"`
+	Name           string  `json:"name"`
+	BytesUsed      uint64  `json:"bytesUsed"`
+	BytesAvailable uint64  `json:"bytesAvailable"`
+	Objects        uint64  `json:"objects"`
+	PercentUsed    float64 `json:"percentUsed"`
+}
+
+// ServiceInfo represents a Ceph service summary.
+type ServiceInfo struct {
+	Type     string `json:"type"` // mon, mgr, osd, mds, rgw
+	Running  int    `json:"running"`
+	Total    int    `json:"total"`
+	Daemons  []string `json:"daemons,omitempty"`
+}
+
+// IsAvailable checks if the ceph CLI is available on the system.
+func IsAvailable(ctx context.Context) bool {
+	cmd := exec.CommandContext(ctx, "which", "ceph")
+	return cmd.Run() == nil
+}
+
+// Collect gathers Ceph cluster status using the ceph CLI.
+// Returns nil if Ceph is not available or not configured on this host.
+func Collect(ctx context.Context) (*ClusterStatus, error) {
+	// Check if ceph CLI is available
+	if !IsAvailable(ctx) {
+		return nil, nil
+	}
+
+	// Try to get ceph status - this will fail if not a ceph node
+	statusJSON, err := runCephCommand(ctx, "status", "--format", "json")
+	if err != nil {
+		// Not an error - just means this isn't a Ceph node
+		return nil, nil
+	}
+
+	status, err := parseStatus(statusJSON)
+	if err != nil {
+		return nil, fmt.Errorf("parse ceph status: %w", err)
+	}
+
+	// Get pool usage from ceph df
+	dfJSON, err := runCephCommand(ctx, "df", "--format", "json")
+	if err == nil {
+		pools, usagePercent, err := parseDF(dfJSON)
+		if err == nil {
+			status.Pools = pools
+			if status.PGMap.UsagePercent == 0 && usagePercent > 0 {
+				status.PGMap.UsagePercent = usagePercent
+			}
+		}
+	}
+
+	status.CollectedAt = time.Now().UTC()
+	return status, nil
+}
+
+// runCephCommand executes a ceph command and returns the output.
+func runCephCommand(ctx context.Context, args ...string) ([]byte, error) {
+	// Use a reasonable timeout for each command
+	cmdCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(cmdCtx, "ceph", args...)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("ceph %s failed: %w (stderr: %s)", 
+			strings.Join(args, " "), err, stderr.String())
+	}
+
+	return stdout.Bytes(), nil
+}
+
+// parseStatus parses the output of `ceph status --format json`.
+func parseStatus(data []byte) (*ClusterStatus, error) {
+	var raw struct {
+		FSID   string `json:"fsid"`
+		Health struct {
+			Status  string `json:"status"`
+			Checks  map[string]struct {
+				Severity string `json:"severity"`
+				Summary  struct {
+					Message string `json:"message"`
+				} `json:"summary"`
+				Detail []struct {
+					Message string `json:"message"`
+				} `json:"detail"`
+			} `json:"checks"`
+		} `json:"health"`
+		MonMap struct {
+			Epoch int `json:"epoch"`
+			Mons  []struct {
+				Name string `json:"name"`
+				Rank int    `json:"rank"`
+				Addr string `json:"addr"`
+			} `json:"mons"`
+		} `json:"monmap"`
+		MgrMap struct {
+			Available bool   `json:"available"`
+			NumActive int    `json:"num_active_name,omitempty"` 
+			ActiveName string `json:"active_name"`
+			Standbys  []struct {
+				Name string `json:"name"`
+			} `json:"standbys"`
+		} `json:"mgrmap"`
+		OSDMap struct {
+			Epoch  int `json:"epoch"`
+			NumOSD int `json:"num_osds"`
+			NumUp  int `json:"num_up_osds"`
+			NumIn  int `json:"num_in_osds"`
+		} `json:"osdmap"`
+		PGMap struct {
+			NumPGs     int     `json:"num_pgs"`
+			BytesTotal uint64  `json:"bytes_total"`
+			BytesUsed  uint64  `json:"bytes_used"`
+			BytesAvail uint64  `json:"bytes_avail"`
+			DataBytes  uint64  `json:"data_bytes"`
+			DegradedRatio float64 `json:"degraded_ratio"`
+			MisplacedRatio float64 `json:"misplaced_ratio"`
+			ReadBytesPerSec  uint64 `json:"read_bytes_sec"`
+			WriteBytesPerSec uint64 `json:"write_bytes_sec"`
+			ReadOpsPerSec    uint64 `json:"read_op_per_sec"`
+			WriteOpsPerSec   uint64 `json:"write_op_per_sec"`
+		} `json:"pgmap"`
+	}
+
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, fmt.Errorf("unmarshal: %w", err)
+	}
+
+	status := &ClusterStatus{
+		FSID: raw.FSID,
+		Health: HealthStatus{
+			Status: raw.Health.Status,
+			Checks: make(map[string]Check),
+		},
+		MonMap: MonitorMap{
+			Epoch:   raw.MonMap.Epoch,
+			NumMons: len(raw.MonMap.Mons),
+		},
+		MgrMap: ManagerMap{
+			Available: raw.MgrMap.Available,
+			NumMgrs:   1 + len(raw.MgrMap.Standbys),
+			ActiveMgr: raw.MgrMap.ActiveName,
+			Standbys:  len(raw.MgrMap.Standbys),
+		},
+		OSDMap: OSDMap{
+			Epoch:   raw.OSDMap.Epoch,
+			NumOSDs: raw.OSDMap.NumOSD,
+			NumUp:   raw.OSDMap.NumUp,
+			NumIn:   raw.OSDMap.NumIn,
+			NumDown: raw.OSDMap.NumOSD - raw.OSDMap.NumUp,
+			NumOut:  raw.OSDMap.NumOSD - raw.OSDMap.NumIn,
+		},
+		PGMap: PGMap{
+			NumPGs:         raw.PGMap.NumPGs,
+			BytesTotal:     raw.PGMap.BytesTotal,
+			BytesUsed:      raw.PGMap.BytesUsed,
+			BytesAvailable: raw.PGMap.BytesAvail,
+			DataBytes:      raw.PGMap.DataBytes,
+			DegradedRatio:  raw.PGMap.DegradedRatio,
+			MisplacedRatio: raw.PGMap.MisplacedRatio,
+			ReadBytesPerSec:  raw.PGMap.ReadBytesPerSec,
+			WriteBytesPerSec: raw.PGMap.WriteBytesPerSec,
+			ReadOpsPerSec:    raw.PGMap.ReadOpsPerSec,
+			WriteOpsPerSec:   raw.PGMap.WriteOpsPerSec,
+		},
+	}
+
+	// Calculate usage percent
+	if raw.PGMap.BytesTotal > 0 {
+		status.PGMap.UsagePercent = float64(raw.PGMap.BytesUsed) / float64(raw.PGMap.BytesTotal) * 100
+	}
+
+	// Parse monitors
+	for _, mon := range raw.MonMap.Mons {
+		status.MonMap.Monitors = append(status.MonMap.Monitors, Monitor{
+			Name: mon.Name,
+			Rank: mon.Rank,
+			Addr: mon.Addr,
+		})
+	}
+
+	// Parse health checks
+	for name, check := range raw.Health.Checks {
+		details := make([]string, 0, len(check.Detail))
+		for _, d := range check.Detail {
+			details = append(details, d.Message)
+		}
+		status.Health.Checks[name] = Check{
+			Severity: check.Severity,
+			Message:  check.Summary.Message,
+			Detail:   details,
+		}
+	}
+
+	// Build service summary
+	status.Services = []ServiceInfo{
+		{Type: "mon", Running: len(raw.MonMap.Mons), Total: len(raw.MonMap.Mons)},
+		{Type: "mgr", Running: boolToInt(raw.MgrMap.Available), Total: status.MgrMap.NumMgrs},
+		{Type: "osd", Running: raw.OSDMap.NumUp, Total: raw.OSDMap.NumOSD},
+	}
+
+	return status, nil
+}
+
+// parseDF parses the output of `ceph df --format json`.
+func parseDF(data []byte) ([]Pool, float64, error) {
+	var raw struct {
+		Stats struct {
+			TotalBytes     uint64  `json:"total_bytes"`
+			TotalUsedBytes uint64  `json:"total_used_bytes"`
+			PercentUsed    float64 `json:"percent_used"`
+		} `json:"stats"`
+		Pools []struct {
+			ID    int    `json:"id"`
+			Name  string `json:"name"`
+			Stats struct {
+				BytesUsed   uint64  `json:"bytes_used"`
+				MaxAvail    uint64  `json:"max_avail"`
+				Objects     uint64  `json:"objects"`
+				PercentUsed float64 `json:"percent_used"`
+			} `json:"stats"`
+		} `json:"pools"`
+	}
+
+	if err := json.Unmarshal(data, &raw); err != nil {
+		return nil, 0, fmt.Errorf("unmarshal df: %w", err)
+	}
+
+	pools := make([]Pool, 0, len(raw.Pools))
+	for _, p := range raw.Pools {
+		pools = append(pools, Pool{
+			ID:             p.ID,
+			Name:           p.Name,
+			BytesUsed:      p.Stats.BytesUsed,
+			BytesAvailable: p.Stats.MaxAvail,
+			Objects:        p.Stats.Objects,
+			PercentUsed:    p.Stats.PercentUsed * 100, // Convert from 0-1 to 0-100
+		})
+	}
+
+	return pools, raw.Stats.PercentUsed * 100, nil
+}
+
+func boolToInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
diff --git a/internal/config/ai.go b/internal/config/ai.go
new file mode 100644
index 0000000..3698973
--- /dev/null
+++ b/internal/config/ai.go
@@ -0,0 +1,411 @@
+package config
+
+import "time"
+
+// AuthMethod represents how Anthropic authentication is performed
+type AuthMethod string
+
+const (
+	// AuthMethodAPIKey uses a traditional API key (pay-per-use billing)
+	AuthMethodAPIKey AuthMethod = "api_key"
+	// AuthMethodOAuth uses OAuth tokens (subscription-based, Pro/Max plans)
+	AuthMethodOAuth AuthMethod = "oauth"
+)
+
+// AIConfig holds AI feature configuration
+// This is stored in ai.enc (encrypted) in the config directory
+type AIConfig struct {
+	Enabled        bool   `json:"enabled"`
+	Provider       string `json:"provider"`               // DEPRECATED: legacy single provider field, kept for migration
+	APIKey         string `json:"api_key"`                // DEPRECATED: legacy single API key, kept for migration
+	Model          string `json:"model"`                  // Currently selected default model (format: "provider:model-name")
+	ChatModel      string `json:"chat_model,omitempty"`   // Model for interactive chat (defaults to Model)
+	PatrolModel    string `json:"patrol_model,omitempty"` // Model for background patrol (defaults to Model, can be cheaper)
+	BaseURL        string `json:"base_url"`               // DEPRECATED: legacy base URL, kept for migration
+	AutonomousMode bool   `json:"autonomous_mode"`        // when true, AI executes commands without approval
+	CustomContext  string `json:"custom_context"`         // user-provided context about their infrastructure
+
+	// Multi-provider credentials - each provider can be configured independently
+	AnthropicAPIKey string `json:"anthropic_api_key,omitempty"` // Anthropic API key
+	OpenAIAPIKey    string `json:"openai_api_key,omitempty"`    // OpenAI API key
+	DeepSeekAPIKey  string `json:"deepseek_api_key,omitempty"`  // DeepSeek API key
+	OllamaBaseURL   string `json:"ollama_base_url,omitempty"`   // Ollama server URL (default: http://localhost:11434)
+	OpenAIBaseURL   string `json:"openai_base_url,omitempty"`   // Custom OpenAI-compatible base URL (optional)
+
+	// OAuth fields for Claude Pro/Max subscription authentication
+	AuthMethod        AuthMethod `json:"auth_method,omitempty"`         // "api_key" or "oauth" (for anthropic only)
+	OAuthAccessToken  string     `json:"oauth_access_token,omitempty"`  // OAuth access token (encrypted at rest)
+	OAuthRefreshToken string     `json:"oauth_refresh_token,omitempty"` // OAuth refresh token (encrypted at rest)
+	OAuthExpiresAt    time.Time  `json:"oauth_expires_at,omitempty"`    // Token expiration time
+
+	// Patrol settings for background AI monitoring
+	PatrolEnabled         bool   `json:"patrol_enabled"`                    // Enable background AI health patrol
+	PatrolIntervalMinutes int    `json:"patrol_interval_minutes,omitempty"` // How often to run quick patrols (default: 360 = 6 hours)
+	PatrolSchedulePreset  string `json:"patrol_schedule_preset,omitempty"`  // User-friendly preset: "15min", "1hr", "6hr", "12hr", "daily", "disabled"
+	PatrolAnalyzeNodes    bool   `json:"patrol_analyze_nodes,omitempty"`    // Include Proxmox nodes in patrol
+	PatrolAnalyzeGuests   bool   `json:"patrol_analyze_guests,omitempty"`   // Include VMs/containers in patrol
+	PatrolAnalyzeDocker   bool   `json:"patrol_analyze_docker,omitempty"`   // Include Docker hosts in patrol
+	PatrolAnalyzeStorage  bool   `json:"patrol_analyze_storage,omitempty"`  // Include storage in patrol
+	PatrolAutoFix         bool   `json:"patrol_auto_fix,omitempty"`         // When true, patrol can attempt automatic remediation (default: false, observe only)
+	AutoFixModel          string `json:"auto_fix_model,omitempty"`          // Model for automatic remediation (defaults to PatrolModel, may want more capable model)
+
+	// Alert-triggered AI analysis - analyze specific resources when alerts fire
+	AlertTriggeredAnalysis bool `json:"alert_triggered_analysis,omitempty"` // Enable AI analysis when alerts fire (token-efficient)
+
+	// AI cost controls
+	// Budget is expressed as an estimated USD amount over a 30-day window (pro-rated in UI for other ranges).
+	CostBudgetUSD30d float64 `json:"cost_budget_usd_30d,omitempty"`
+}
+
+// AIProvider constants
+const (
+	AIProviderAnthropic = "anthropic"
+	AIProviderOpenAI    = "openai"
+	AIProviderOllama    = "ollama"
+	AIProviderDeepSeek  = "deepseek"
+)
+
+// Default models per provider
+const (
+	DefaultAIModelAnthropic = "claude-opus-4-5-20251101"
+	DefaultAIModelOpenAI    = "gpt-4o"
+	DefaultAIModelOllama    = "llama3"
+	DefaultAIModelDeepSeek  = "deepseek-chat" // V3.2 with tool-use support
+	DefaultOllamaBaseURL    = "http://localhost:11434"
+	DefaultDeepSeekBaseURL  = "https://api.deepseek.com/chat/completions"
+)
+
+// ModelInfo represents information about an available model
+// Deprecated: Use providers.ModelInfo instead - models are now fetched dynamically from APIs
+type ModelInfo struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
+	IsDefault   bool   `json:"is_default,omitempty"`
+}
+
+// GetAvailableModels is deprecated - models are now fetched dynamically from provider APIs
+// This returns nil; use the /api/ai/models endpoint instead which queries the actual API
+func GetAvailableModels(provider string) []ModelInfo {
+	return nil
+}
+
+// NewDefaultAIConfig returns an AIConfig with sensible defaults
+func NewDefaultAIConfig() *AIConfig {
+	return &AIConfig{
+		Enabled:    false,
+		Provider:   AIProviderAnthropic,
+		Model:      DefaultAIModelAnthropic,
+		AuthMethod: AuthMethodAPIKey,
+		// Patrol defaults - enabled when AI is enabled
+		// Default to 6 hour intervals (much more token-efficient than 15 min)
+		PatrolEnabled:         true,
+		PatrolIntervalMinutes: 360, // 6 hours - balance between coverage and token efficiency
+		PatrolSchedulePreset:  "6hr",
+		PatrolAnalyzeNodes:    true,
+		PatrolAnalyzeGuests:   true,
+		PatrolAnalyzeDocker:   true,
+		PatrolAnalyzeStorage:  true,
+		// Alert-triggered analysis is highly token-efficient - enabled by default
+		AlertTriggeredAnalysis: true,
+	}
+}
+
+// IsConfigured returns true if the AI config has enough info to make API calls
+// For multi-provider setup, returns true if ANY provider is configured
+func (c *AIConfig) IsConfigured() bool {
+	if !c.Enabled {
+		return false
+	}
+
+	// Check multi-provider credentials first (new format)
+	if c.HasProvider(AIProviderAnthropic) || c.HasProvider(AIProviderOpenAI) ||
+		c.HasProvider(AIProviderDeepSeek) || c.HasProvider(AIProviderOllama) {
+		return true
+	}
+
+	// Fall back to legacy single-provider check for backward compatibility
+	switch c.Provider {
+	case AIProviderAnthropic:
+		if c.AuthMethod == AuthMethodOAuth {
+			return c.OAuthAccessToken != ""
+		}
+		return c.APIKey != ""
+	case AIProviderOpenAI, AIProviderDeepSeek:
+		return c.APIKey != ""
+	case AIProviderOllama:
+		return true
+	default:
+		return false
+	}
+}
+
+// HasProvider returns true if the specified provider has credentials configured
+func (c *AIConfig) HasProvider(provider string) bool {
+	switch provider {
+	case AIProviderAnthropic:
+		// Anthropic can use API key OR OAuth
+		if c.AuthMethod == AuthMethodOAuth && c.OAuthAccessToken != "" {
+			return true
+		}
+		return c.AnthropicAPIKey != ""
+	case AIProviderOpenAI:
+		return c.OpenAIAPIKey != ""
+	case AIProviderDeepSeek:
+		return c.DeepSeekAPIKey != ""
+	case AIProviderOllama:
+		// Ollama is only "configured" if user has explicitly set a base URL
+		return c.OllamaBaseURL != ""
+	default:
+		return false
+	}
+}
+
+// GetConfiguredProviders returns a list of all providers with credentials configured
+func (c *AIConfig) GetConfiguredProviders() []string {
+	var providers []string
+	if c.HasProvider(AIProviderAnthropic) {
+		providers = append(providers, AIProviderAnthropic)
+	}
+	if c.HasProvider(AIProviderOpenAI) {
+		providers = append(providers, AIProviderOpenAI)
+	}
+	if c.HasProvider(AIProviderDeepSeek) {
+		providers = append(providers, AIProviderDeepSeek)
+	}
+	if c.HasProvider(AIProviderOllama) {
+		providers = append(providers, AIProviderOllama)
+	}
+	return providers
+}
+
+// GetAPIKeyForProvider returns the API key for the specified provider
+func (c *AIConfig) GetAPIKeyForProvider(provider string) string {
+	switch provider {
+	case AIProviderAnthropic:
+		if c.AnthropicAPIKey != "" {
+			return c.AnthropicAPIKey
+		}
+		// Fall back to legacy API key if provider matches
+		if c.Provider == AIProviderAnthropic {
+			return c.APIKey
+		}
+	case AIProviderOpenAI:
+		if c.OpenAIAPIKey != "" {
+			return c.OpenAIAPIKey
+		}
+		if c.Provider == AIProviderOpenAI {
+			return c.APIKey
+		}
+	case AIProviderDeepSeek:
+		if c.DeepSeekAPIKey != "" {
+			return c.DeepSeekAPIKey
+		}
+		if c.Provider == AIProviderDeepSeek {
+			return c.APIKey
+		}
+	}
+	return ""
+}
+
+// GetBaseURLForProvider returns the base URL for the specified provider
+func (c *AIConfig) GetBaseURLForProvider(provider string) string {
+	switch provider {
+	case AIProviderOllama:
+		if c.OllamaBaseURL != "" {
+			return c.OllamaBaseURL
+		}
+		// Fall back to legacy BaseURL if provider matches
+		if c.Provider == AIProviderOllama && c.BaseURL != "" {
+			return c.BaseURL
+		}
+		return DefaultOllamaBaseURL
+	case AIProviderOpenAI:
+		if c.OpenAIBaseURL != "" {
+			return c.OpenAIBaseURL
+		}
+		return "" // Uses default OpenAI URL
+	case AIProviderDeepSeek:
+		return DefaultDeepSeekBaseURL
+	}
+	return ""
+}
+
+// IsUsingOAuth returns true if OAuth authentication is configured for Anthropic
+func (c *AIConfig) IsUsingOAuth() bool {
+	return c.AuthMethod == AuthMethodOAuth && c.OAuthAccessToken != ""
+}
+
+// ParseModelString parses a model string in "provider:model-name" format
+// Returns the provider and model name. If no provider prefix, attempts to detect.
+func ParseModelString(model string) (provider, modelName string) {
+	// Check for explicit provider prefix
+	for _, p := range []string{AIProviderAnthropic, AIProviderOpenAI, AIProviderDeepSeek, AIProviderOllama} {
+		prefix := p + ":"
+		if len(model) > len(prefix) && model[:len(prefix)] == prefix {
+			return p, model[len(prefix):]
+		}
+	}
+
+	// No prefix - try to detect from model name patterns
+	switch {
+	case len(model) >= 6 && model[:6] == "claude":
+		return AIProviderAnthropic, model
+	case len(model) >= 3 && (model[:3] == "gpt" || model[:2] == "o1" || model[:2] == "o3" || model[:2] == "o4"):
+		return AIProviderOpenAI, model
+	case len(model) >= 8 && model[:8] == "deepseek":
+		return AIProviderDeepSeek, model
+	default:
+		// Assume Ollama for unrecognized models (local models have varied names)
+		return AIProviderOllama, model
+	}
+}
+
+// FormatModelString creates a "provider:model-name" format string
+func FormatModelString(provider, modelName string) string {
+	return provider + ":" + modelName
+}
+
+// GetBaseURL returns the base URL, using defaults where appropriate
+// DEPRECATED: Use GetBaseURLForProvider instead
+func (c *AIConfig) GetBaseURL() string {
+	if c.BaseURL != "" {
+		return c.BaseURL
+	}
+	switch c.Provider {
+	case AIProviderOllama:
+		return DefaultOllamaBaseURL
+	case AIProviderDeepSeek:
+		return DefaultDeepSeekBaseURL
+	}
+	return ""
+}
+
+// GetModel returns the model, using defaults where appropriate
+func (c *AIConfig) GetModel() string {
+	if c.Model != "" {
+		return c.Model
+	}
+	switch c.Provider {
+	case AIProviderAnthropic:
+		return DefaultAIModelAnthropic
+	case AIProviderOpenAI:
+		return DefaultAIModelOpenAI
+	case AIProviderOllama:
+		return DefaultAIModelOllama
+	case AIProviderDeepSeek:
+		return DefaultAIModelDeepSeek
+	default:
+		return ""
+	}
+}
+
+// GetChatModel returns the model for interactive chat conversations
+// Falls back to the main Model if ChatModel is not set
+func (c *AIConfig) GetChatModel() string {
+	if c.ChatModel != "" {
+		return c.ChatModel
+	}
+	return c.GetModel()
+}
+
+// GetPatrolModel returns the model for background patrol analysis
+// Falls back to the main Model if PatrolModel is not set
+func (c *AIConfig) GetPatrolModel() string {
+	if c.PatrolModel != "" {
+		return c.PatrolModel
+	}
+	return c.GetModel()
+}
+
+// GetAutoFixModel returns the model for automatic remediation actions
+// Falls back to PatrolModel, then to the main Model if AutoFixModel is not set
+// Auto-fix may warrant a more capable model since it takes actions
+func (c *AIConfig) GetAutoFixModel() string {
+	if c.AutoFixModel != "" {
+		return c.AutoFixModel
+	}
+	return c.GetPatrolModel()
+}
+
+// ClearOAuthTokens clears OAuth tokens (used when switching back to API key auth)
+func (c *AIConfig) ClearOAuthTokens() {
+	c.OAuthAccessToken = ""
+	c.OAuthRefreshToken = ""
+	c.OAuthExpiresAt = time.Time{}
+}
+
+// ClearAPIKey clears the API key (used when switching to OAuth auth)
+func (c *AIConfig) ClearAPIKey() {
+	c.APIKey = ""
+}
+
+// GetPatrolInterval returns the patrol interval as a duration
+// Uses the preset if set, otherwise falls back to custom minutes
+func (c *AIConfig) GetPatrolInterval() time.Duration {
+	// If preset is set, use it
+	if c.PatrolSchedulePreset != "" {
+		switch c.PatrolSchedulePreset {
+		case "15min":
+			return 15 * time.Minute
+		case "1hr":
+			return 1 * time.Hour
+		case "6hr":
+			return 6 * time.Hour
+		case "12hr":
+			return 12 * time.Hour
+		case "daily":
+			return 24 * time.Hour
+		case "disabled":
+			return 0 // Signal that scheduled patrol is disabled
+		}
+	}
+
+	// Fall back to custom minutes if set
+	// BUT: If PatrolIntervalMinutes is the old default (15), migrate to new default (360 = 6hr)
+	// This provides better token efficiency for existing installations
+	if c.PatrolIntervalMinutes > 0 {
+		// Migrate old 15-minute default to new 6-hour default
+		if c.PatrolIntervalMinutes == 15 && c.PatrolSchedulePreset == "" {
+			return 6 * time.Hour
+		}
+		return time.Duration(c.PatrolIntervalMinutes) * time.Minute
+	}
+
+	return 6 * time.Hour // default to 6 hours
+}
+
+// PresetToMinutes converts a patrol schedule preset to minutes
+func PresetToMinutes(preset string) int {
+	switch preset {
+	case "15min":
+		return 15
+	case "1hr":
+		return 60
+	case "6hr":
+		return 360
+	case "12hr":
+		return 720
+	case "daily":
+		return 1440
+	case "disabled":
+		return 0
+	default:
+		return 360 // default 6hr
+	}
+}
+
+// IsPatrolEnabled returns true if patrol should run
+// Note: Patrol uses local heuristics and doesn't require an AI API key
+func (c *AIConfig) IsPatrolEnabled() bool {
+	// If preset is "disabled", patrol is disabled
+	if c.PatrolSchedulePreset == "disabled" {
+		return false
+	}
+	return c.PatrolEnabled
+}
+
+// IsAlertTriggeredAnalysisEnabled returns true if AI should analyze resources when alerts fire
+func (c *AIConfig) IsAlertTriggeredAnalysisEnabled() bool {
+	return c.AlertTriggeredAnalysis
+}
diff --git a/internal/config/ai_usage_persistence_test.go b/internal/config/ai_usage_persistence_test.go
new file mode 100644
index 0000000..7eb01fe
--- /dev/null
+++ b/internal/config/ai_usage_persistence_test.go
@@ -0,0 +1,41 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSaveLoadAIUsageHistory(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	now := time.Now()
+	events := []AIUsageEventRecord{
+		{
+			Timestamp:    now,
+			Provider:     "openai",
+			RequestModel: "openai:gpt-4o",
+			InputTokens:  123,
+			OutputTokens: 45,
+			UseCase:      "chat",
+			TargetType:   "vm",
+			TargetID:     "vm-101",
+		},
+	}
+
+	if err := cp.SaveAIUsageHistory(events); err != nil {
+		t.Fatalf("SaveAIUsageHistory: %v", err)
+	}
+
+	loaded, err := cp.LoadAIUsageHistory()
+	if err != nil {
+		t.Fatalf("LoadAIUsageHistory: %v", err)
+	}
+
+	if len(loaded.Events) != 1 {
+		t.Fatalf("expected 1 event, got %d", len(loaded.Events))
+	}
+	if loaded.Events[0].Provider != "openai" || loaded.Events[0].InputTokens != 123 {
+		t.Fatalf("loaded event mismatch: %+v", loaded.Events[0])
+	}
+}
diff --git a/internal/config/api_tokens.go b/internal/config/api_tokens.go
index d08e7c3..c5b8539 100644
--- a/internal/config/api_tokens.go
+++ b/internal/config/api_tokens.go
@@ -11,15 +11,17 @@ import (
 
 // Canonical API token scope strings.
 const (
-	ScopeWildcard        = "*"
-	ScopeMonitoringRead  = "monitoring:read"
-	ScopeMonitoringWrite = "monitoring:write"
-	ScopeDockerReport    = "docker:report"
-	ScopeDockerManage    = "docker:manage"
-	ScopeHostReport      = "host-agent:report"
-	ScopeHostManage      = "host-agent:manage"
-	ScopeSettingsRead    = "settings:read"
-	ScopeSettingsWrite   = "settings:write"
+	ScopeWildcard         = "*"
+	ScopeMonitoringRead   = "monitoring:read"
+	ScopeMonitoringWrite  = "monitoring:write"
+	ScopeDockerReport     = "docker:report"
+	ScopeDockerManage     = "docker:manage"
+	ScopeKubernetesReport = "kubernetes:report"
+	ScopeKubernetesManage = "kubernetes:manage"
+	ScopeHostReport       = "host-agent:report"
+	ScopeHostManage       = "host-agent:manage"
+	ScopeSettingsRead     = "settings:read"
+	ScopeSettingsWrite    = "settings:write"
 )
 
 // AllKnownScopes enumerates scopes recognized by the backend (excluding the wildcard sentinel).
@@ -28,6 +30,8 @@ var AllKnownScopes = []string{
 	ScopeMonitoringWrite,
 	ScopeDockerReport,
 	ScopeDockerManage,
+	ScopeKubernetesReport,
+	ScopeKubernetesManage,
 	ScopeHostReport,
 	ScopeHostManage,
 	ScopeSettingsRead,
diff --git a/internal/config/api_tokens_test.go b/internal/config/api_tokens_test.go
index 3d861e9..8b94b70 100644
--- a/internal/config/api_tokens_test.go
+++ b/internal/config/api_tokens_test.go
@@ -167,6 +167,8 @@ func TestIsKnownScope(t *testing.T) {
 		{name: "monitoring:write", scope: ScopeMonitoringWrite, expected: true},
 		{name: "docker:report", scope: ScopeDockerReport, expected: true},
 		{name: "docker:manage", scope: ScopeDockerManage, expected: true},
+		{name: "kubernetes:report", scope: ScopeKubernetesReport, expected: true},
+		{name: "kubernetes:manage", scope: ScopeKubernetesManage, expected: true},
 		{name: "host-agent:report", scope: ScopeHostReport, expected: true},
 		{name: "host-agent:manage", scope: ScopeHostManage, expected: true},
 		{name: "settings:read", scope: ScopeSettingsRead, expected: true},
diff --git a/internal/config/config.go b/internal/config/config.go
index 1308630..92bb8fe 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -95,7 +95,6 @@ type Config struct {
 	PMGPollingInterval              time.Duration `envconfig:"PMG_POLLING_INTERVAL"` // PMG polling interval (60s default)
 	ConcurrentPolling               bool          `envconfig:"CONCURRENT_POLLING" default:"true"`
 	ConnectionTimeout               time.Duration `envconfig:"CONNECTION_TIMEOUT" default:"45s"` // Increased for slow storage operations
-	MetricsRetentionDays            int           `envconfig:"METRICS_RETENTION_DAYS" default:"7"`
 	BackupPollingCycles             int           `envconfig:"BACKUP_POLLING_CYCLES" default:"10"`
 	BackupPollingInterval           time.Duration `envconfig:"BACKUP_POLLING_INTERVAL"`
 	EnableBackupPolling             bool          `envconfig:"ENABLE_BACKUP_POLLING" default:"true"`
@@ -112,6 +111,14 @@ type Config struct {
 	DNSCacheTimeout                 time.Duration `envconfig:"DNS_CACHE_TIMEOUT" default:"5m" json:"dnsCacheTimeout"`
 	SSHPort                         int           `envconfig:"SSH_PORT" default:"22" json:"sshPort"` // Default SSH port for temperature monitoring
 
+	// Metrics retention settings (tiered storage)
+	// These control how long historical metrics are retained at each aggregation level.
+	MetricsRetentionRawHours    int `json:"metricsRetentionRawHours"`    // Raw data (~5s intervals), default: 2 hours
+	MetricsRetentionMinuteHours int `json:"metricsRetentionMinuteHours"` // Minute averages, default: 24 hours
+	MetricsRetentionHourlyDays  int `json:"metricsRetentionHourlyDays"`  // Hourly averages, default: 7 days
+	MetricsRetentionDailyDays   int `json:"metricsRetentionDailyDays"`   // Daily averages, default: 90 days
+
+
 	// Logging settings
 	LogLevel    string `envconfig:"LOG_LEVEL" default:"info"`
 	LogFormat   string `envconfig:"LOG_FORMAT" default:"auto"` // "json", "console", or "auto"
@@ -171,6 +178,7 @@ type DiscoveryConfig struct {
 	EnvironmentOverride string   `json:"environment_override,omitempty"`
 	SubnetAllowlist     []string `json:"subnet_allowlist,omitempty"`
 	SubnetBlocklist     []string `json:"subnet_blocklist,omitempty"`
+	IPBlocklist         []string `json:"ip_blocklist,omitempty"` // Individual IPs to skip (auto-populated with configured Proxmox hosts)
 	MaxHostsPerScan     int      `json:"max_hosts_per_scan,omitempty"`
 	MaxConcurrent       int      `json:"max_concurrent,omitempty"`
 	EnableReverseDNS    bool     `json:"enable_reverse_dns"`
@@ -203,6 +211,9 @@ func CloneDiscoveryConfig(cfg DiscoveryConfig) DiscoveryConfig {
 	if cfg.SubnetBlocklist != nil {
 		clone.SubnetBlocklist = append([]string(nil), cfg.SubnetBlocklist...)
 	}
+	if cfg.IPBlocklist != nil {
+		clone.IPBlocklist = append([]string(nil), cfg.IPBlocklist...)
+	}
 	return clone
 }
 
@@ -424,6 +435,9 @@ type PVEInstance struct {
 	IsCluster        bool              // True if this is a cluster
 	ClusterName      string            // Cluster name if applicable
 	ClusterEndpoints []ClusterEndpoint // All discovered cluster nodes
+
+	// Agent tracking
+	Source string // "agent" or "script" - how this node was registered (empty = legacy/manual)
 }
 
 // ClusterEndpoint represents a single node in a cluster
@@ -461,6 +475,9 @@ type PBSInstance struct {
 	MonitorGarbageJobs           bool
 	TemperatureMonitoringEnabled *bool // Monitor temperature via SSH (nil = use global setting, true/false = override)
 	SSHPort                      int   // SSH port for temperature monitoring (0 = use global default)
+
+	// Agent tracking
+	Source string // "agent" or "script" - how this node was registered (empty = legacy/manual)
 }
 
 // PMGInstance represents a Proxmox Mail Gateway connection
@@ -537,7 +554,6 @@ func Load() (*Config, error) {
 		AppRoot:                         detectAppRoot(),
 		ConcurrentPolling:               true,
 		ConnectionTimeout:               60 * time.Second,
-		MetricsRetentionDays:            7,
 		BackupPollingCycles:             10,
 		BackupPollingInterval:           0,
 		EnableBackupPolling:             true,
@@ -566,6 +582,11 @@ func Load() (*Config, error) {
 		TemperatureMonitoringEnabled:    true,
 		EnvOverrides:                    make(map[string]bool),
 		OIDC:                            NewOIDCConfig(),
+		// Metrics retention defaults (tiered)
+		MetricsRetentionRawHours:    2,  // 2 hours of raw ~5s data
+		MetricsRetentionMinuteHours: 24, // 24 hours of minute averages
+		MetricsRetentionHourlyDays:  7,  // 7 days of hourly averages
+		MetricsRetentionDailyDays:   90, // 90 days of daily averages
 	}
 
 	cfg.Discovery = DefaultDiscoveryConfig()
@@ -661,11 +682,27 @@ func Load() (*Config, error) {
 			}
 			// Load HideLocalLogin
 			cfg.HideLocalLogin = systemSettings.HideLocalLogin
+
+			// Load metrics retention settings (only override if explicitly set)
+			if systemSettings.MetricsRetentionRawHours > 0 {
+				cfg.MetricsRetentionRawHours = systemSettings.MetricsRetentionRawHours
+			}
+			if systemSettings.MetricsRetentionMinuteHours > 0 {
+				cfg.MetricsRetentionMinuteHours = systemSettings.MetricsRetentionMinuteHours
+			}
+			if systemSettings.MetricsRetentionHourlyDays > 0 {
+				cfg.MetricsRetentionHourlyDays = systemSettings.MetricsRetentionHourlyDays
+			}
+			if systemSettings.MetricsRetentionDailyDays > 0 {
+				cfg.MetricsRetentionDailyDays = systemSettings.MetricsRetentionDailyDays
+			}
+
 			// APIToken no longer loaded from system.json - only from .env
 			log.Info().
 				Str("updateChannel", cfg.UpdateChannel).
 				Str("logLevel", cfg.LogLevel).
 				Dur("dnsCacheTimeout", cfg.DNSCacheTimeout).
+				Int("metricsRetentionDailyDays", cfg.MetricsRetentionDailyDays).
 				Msg("Loaded system configuration")
 		} else {
 			// No system.json exists - create default one
diff --git a/internal/config/docker_metadata.go b/internal/config/docker_metadata.go
index a482c0e..976fb19 100644
--- a/internal/config/docker_metadata.go
+++ b/internal/config/docker_metadata.go
@@ -16,6 +16,7 @@ type DockerMetadata struct {
 	CustomURL   string   `json:"customUrl"`   // Custom URL for the resource
 	Description string   `json:"description"` // Optional description
 	Tags        []string `json:"tags"`        // Optional tags for categorization
+	Notes       []string `json:"notes"`       // User annotations for AI context
 }
 
 // DockerHostMetadata holds additional metadata for a Docker host
diff --git a/internal/config/guest_metadata.go b/internal/config/guest_metadata.go
index 9af934f..7e6b965 100644
--- a/internal/config/guest_metadata.go
+++ b/internal/config/guest_metadata.go
@@ -16,6 +16,7 @@ type GuestMetadata struct {
 	CustomURL   string   `json:"customUrl"`   // Custom URL for the guest
 	Description string   `json:"description"` // Optional description
 	Tags        []string `json:"tags"`        // Optional tags for categorization
+	Notes       []string `json:"notes"`       // User annotations for AI context (e.g., "Runs PBS in Docker")
 	// Last-known identity (persisted even after guest deletion)
 	LastKnownName string `json:"lastKnownName,omitempty"` // Last known guest name
 	LastKnownType string `json:"lastKnownType,omitempty"` // Last known guest type (qemu, lxc)
diff --git a/internal/config/host_metadata.go b/internal/config/host_metadata.go
new file mode 100644
index 0000000..01bc0c8
--- /dev/null
+++ b/internal/config/host_metadata.go
@@ -0,0 +1,179 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/rs/zerolog/log"
+)
+
+// HostMetadata holds additional metadata for a host
+type HostMetadata struct {
+	ID          string   `json:"id"`          // Host ID
+	CustomURL   string   `json:"customUrl"`   // Custom URL for the host
+	Description string   `json:"description"` // Optional description
+	Tags        []string `json:"tags"`        // Optional tags for categorization
+	Notes       []string `json:"notes"`       // User annotations for AI context
+}
+
+// HostMetadataStore manages host metadata
+type HostMetadataStore struct {
+	mu       sync.RWMutex
+	metadata map[string]*HostMetadata // keyed by host ID
+	dataPath string
+}
+
+// NewHostMetadataStore creates a new host metadata store
+func NewHostMetadataStore(dataPath string) *HostMetadataStore {
+	store := &HostMetadataStore{
+		metadata: make(map[string]*HostMetadata),
+		dataPath: dataPath,
+	}
+
+	// Load existing metadata
+	if err := store.Load(); err != nil {
+		log.Warn().Err(err).Msg("Failed to load host metadata")
+	}
+
+	return store
+}
+
+// Get retrieves metadata for a host
+func (s *HostMetadataStore) Get(hostID string) *HostMetadata {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if meta, exists := s.metadata[hostID]; exists {
+		return meta
+	}
+	return nil
+}
+
+// GetAll retrieves all host metadata
+func (s *HostMetadataStore) GetAll() map[string]*HostMetadata {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	// Return a copy to prevent external modifications
+	result := make(map[string]*HostMetadata)
+	for k, v := range s.metadata {
+		result[k] = v
+	}
+	return result
+}
+
+// Set updates or creates metadata for a host
+func (s *HostMetadataStore) Set(hostID string, meta *HostMetadata) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if meta == nil {
+		return fmt.Errorf("metadata cannot be nil")
+	}
+
+	meta.ID = hostID
+	s.metadata[hostID] = meta
+
+	// Save to disk
+	return s.save()
+}
+
+// Delete removes metadata for a host
+func (s *HostMetadataStore) Delete(hostID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.metadata, hostID)
+
+	// Save to disk
+	return s.save()
+}
+
+// ReplaceAll replaces all metadata entries and persists them to disk.
+func (s *HostMetadataStore) ReplaceAll(metadata map[string]*HostMetadata) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.metadata = make(map[string]*HostMetadata)
+
+	for hostID, meta := range metadata {
+		if meta == nil {
+			continue
+		}
+
+		clone := *meta
+		clone.ID = hostID
+		// Ensure slice copy is not nil to allow JSON marshalling of empty tags
+		if clone.Tags == nil {
+			clone.Tags = []string{}
+		}
+		s.metadata[hostID] = &clone
+	}
+
+	return s.save()
+}
+
+// Load reads metadata from disk
+func (s *HostMetadataStore) Load() error {
+	filePath := filepath.Join(s.dataPath, "host_metadata.json")
+
+	log.Debug().Str("path", filePath).Msg("Loading host metadata from disk")
+
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// File doesn't exist yet, not an error
+			log.Debug().Str("path", filePath).Msg("Host metadata file does not exist yet")
+			return nil
+		}
+		return fmt.Errorf("failed to read metadata file: %w", err)
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if err := json.Unmarshal(data, &s.metadata); err != nil {
+		return fmt.Errorf("failed to unmarshal metadata: %w", err)
+	}
+
+	log.Info().
+		Int("hostCount", len(s.metadata)).
+		Msg("Loaded host metadata")
+
+	return nil
+}
+
+// save writes metadata to disk (must be called with lock held)
+func (s *HostMetadataStore) save() error {
+	filePath := filepath.Join(s.dataPath, "host_metadata.json")
+
+	log.Debug().Str("path", filePath).Msg("Saving host metadata to disk")
+
+	data, err := json.Marshal(s.metadata)
+	if err != nil {
+		return fmt.Errorf("failed to marshal metadata: %w", err)
+	}
+
+	// Ensure directory exists
+	if err := os.MkdirAll(s.dataPath, 0755); err != nil {
+		return fmt.Errorf("failed to create data directory: %w", err)
+	}
+
+	// Write to temp file first for atomic operation
+	tempFile := filePath + ".tmp"
+	if err := os.WriteFile(tempFile, data, 0644); err != nil {
+		return fmt.Errorf("failed to write metadata file: %w", err)
+	}
+
+	// Rename temp file to actual file (atomic on most systems)
+	if err := os.Rename(tempFile, filePath); err != nil {
+		return fmt.Errorf("failed to rename metadata file: %w", err)
+	}
+
+	log.Debug().Str("path", filePath).Int("hosts", len(s.metadata)).Msg("Host metadata saved successfully")
+
+	return nil
+}
diff --git a/internal/config/persistence.go b/internal/config/persistence.go
index 1f37f67..3fe77ba 100644
--- a/internal/config/persistence.go
+++ b/internal/config/persistence.go
@@ -20,18 +20,22 @@ import (
 
 // ConfigPersistence handles saving and loading configuration
 type ConfigPersistence struct {
-	mu            sync.RWMutex
-	tx            *importTransaction
-	configDir     string
-	alertFile     string
-	emailFile     string
-	webhookFile   string
-	appriseFile   string
-	nodesFile     string
-	systemFile    string
-	oidcFile      string
-	apiTokensFile string
-	crypto        *crypto.CryptoManager
+	mu                 sync.RWMutex
+	tx                 *importTransaction
+	configDir          string
+	alertFile          string
+	emailFile          string
+	webhookFile        string
+	appriseFile        string
+	nodesFile          string
+	systemFile         string
+	oidcFile           string
+	apiTokensFile      string
+	aiFile             string
+	aiFindingsFile     string
+	aiPatrolRunsFile   string
+	aiUsageHistoryFile string
+	crypto             *crypto.CryptoManager
 }
 
 // NewConfigPersistence creates a new config persistence manager.
@@ -64,16 +68,20 @@ func newConfigPersistence(configDir string) (*ConfigPersistence, error) {
 	}
 
 	cp := &ConfigPersistence{
-		configDir:     configDir,
-		alertFile:     filepath.Join(configDir, "alerts.json"),
-		emailFile:     filepath.Join(configDir, "email.enc"),
-		webhookFile:   filepath.Join(configDir, "webhooks.enc"),
-		appriseFile:   filepath.Join(configDir, "apprise.enc"),
-		nodesFile:     filepath.Join(configDir, "nodes.enc"),
-		systemFile:    filepath.Join(configDir, "system.json"),
-		oidcFile:      filepath.Join(configDir, "oidc.enc"),
-		apiTokensFile: filepath.Join(configDir, "api_tokens.json"),
-		crypto:        cryptoMgr,
+		configDir:          configDir,
+		alertFile:          filepath.Join(configDir, "alerts.json"),
+		emailFile:          filepath.Join(configDir, "email.enc"),
+		webhookFile:        filepath.Join(configDir, "webhooks.enc"),
+		appriseFile:        filepath.Join(configDir, "apprise.enc"),
+		nodesFile:          filepath.Join(configDir, "nodes.enc"),
+		systemFile:         filepath.Join(configDir, "system.json"),
+		oidcFile:           filepath.Join(configDir, "oidc.enc"),
+		apiTokensFile:      filepath.Join(configDir, "api_tokens.json"),
+		aiFile:             filepath.Join(configDir, "ai.enc"),
+		aiFindingsFile:     filepath.Join(configDir, "ai_findings.json"),
+		aiPatrolRunsFile:   filepath.Join(configDir, "ai_patrol_runs.json"),
+		aiUsageHistoryFile: filepath.Join(configDir, "ai_usage_history.json"),
+		crypto:             cryptoMgr,
 	}
 
 	log.Debug().
@@ -86,6 +94,11 @@ func newConfigPersistence(configDir string) (*ConfigPersistence, error) {
 	return cp, nil
 }
 
+// DataDir returns the configuration directory path
+func (c *ConfigPersistence) DataDir() string {
+	return c.configDir
+}
+
 // EnsureConfigDir ensures the configuration directory exists
 func (c *ConfigPersistence) EnsureConfigDir() error {
 	return os.MkdirAll(c.configDir, 0700)
@@ -832,6 +845,15 @@ type SystemSettings struct {
 	SSHPort                      int             `json:"sshPort,omitempty"`                    // Default SSH port for temperature monitoring (0 = use 22)
 	WebhookAllowedPrivateCIDRs   string          `json:"webhookAllowedPrivateCIDRs,omitempty"` // Comma-separated list of private CIDR ranges allowed for webhooks (e.g., "192.168.1.0/24,10.0.0.0/8")
 	HideLocalLogin               bool            `json:"hideLocalLogin"`                       // Hide local login form (username/password)
+
+	// Metrics retention configuration (in hours)
+	// These control how long historical metrics are stored at each aggregation tier.
+	// Longer retention enables trend analysis but increases storage usage.
+	MetricsRetentionRawHours    int `json:"metricsRetentionRawHours,omitempty"`    // Raw data (~5s intervals), default: 2 hours
+	MetricsRetentionMinuteHours int `json:"metricsRetentionMinuteHours,omitempty"` // Minute averages, default: 24 hours
+	MetricsRetentionHourlyDays  int `json:"metricsRetentionHourlyDays,omitempty"`  // Hourly averages, default: 7 days
+	MetricsRetentionDailyDays   int `json:"metricsRetentionDailyDays,omitempty"`   // Daily averages, default: 90 days
+
 	// APIToken removed - now handled via .env file only
 }
 
@@ -1291,6 +1313,372 @@ func (c *ConfigPersistence) LoadOIDCConfig() (*OIDCConfig, error) {
 	return &settings, nil
 }
 
+// SaveAIConfig stores AI settings, encrypting them when a crypto manager is available.
+func (c *ConfigPersistence) SaveAIConfig(settings AIConfig) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.EnsureConfigDir(); err != nil {
+		return err
+	}
+
+	data, err := json.Marshal(settings)
+	if err != nil {
+		return err
+	}
+
+	if c.crypto != nil {
+		encrypted, err := c.crypto.Encrypt(data)
+		if err != nil {
+			return err
+		}
+		data = encrypted
+	}
+
+	if err := c.writeConfigFileLocked(c.aiFile, data, 0600); err != nil {
+		return err
+	}
+
+	log.Info().Str("file", c.aiFile).Bool("enabled", settings.Enabled).Msg("AI configuration saved")
+	return nil
+}
+
+// LoadAIConfig retrieves the persisted AI settings. It returns default config when no configuration exists yet.
+func (c *ConfigPersistence) LoadAIConfig() (*AIConfig, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	data, err := os.ReadFile(c.aiFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Return default config if file doesn't exist
+			return NewDefaultAIConfig(), nil
+		}
+		return nil, err
+	}
+
+	if c.crypto != nil {
+		decrypted, err := c.crypto.Decrypt(data)
+		if err != nil {
+			return nil, err
+		}
+		data = decrypted
+	}
+
+	// Start with defaults so new fields get proper values
+	settings := NewDefaultAIConfig()
+	if err := json.Unmarshal(data, settings); err != nil {
+		return nil, err
+	}
+
+	// Migration: Ensure patrol settings have sensible defaults for existing configs
+	// PatrolIntervalMinutes=0 means it was never set - use default
+	if settings.PatrolIntervalMinutes <= 0 {
+		settings.PatrolIntervalMinutes = 15
+	}
+
+	log.Info().Str("file", c.aiFile).Bool("enabled", settings.Enabled).Bool("patrol_enabled", settings.PatrolEnabled).Msg("AI configuration loaded")
+	return settings, nil
+}
+
+// AIFindingsData represents persisted AI findings with metadata
+type AIFindingsData struct {
+	// Version for future migrations
+	Version int `json:"version"`
+	// LastSaved for debugging/diagnostics
+	LastSaved time.Time `json:"last_saved"`
+	// Findings is a map of finding ID to finding data
+	Findings map[string]*AIFindingRecord `json:"findings"`
+}
+
+// AIFindingRecord is a persisted finding with full history
+type AIFindingRecord struct {
+	ID             string     `json:"id"`
+	Severity       string     `json:"severity"`
+	Category       string     `json:"category"`
+	ResourceID     string     `json:"resource_id"`
+	ResourceName   string     `json:"resource_name"`
+	ResourceType   string     `json:"resource_type"`
+	Node           string     `json:"node,omitempty"`
+	Title          string     `json:"title"`
+	Description    string     `json:"description"`
+	Recommendation string     `json:"recommendation,omitempty"`
+	Evidence       string     `json:"evidence,omitempty"`
+	DetectedAt     time.Time  `json:"detected_at"`
+	LastSeenAt     time.Time  `json:"last_seen_at"`
+	ResolvedAt     *time.Time `json:"resolved_at,omitempty"`
+	AutoResolved   bool       `json:"auto_resolved"`
+	AcknowledgedAt *time.Time `json:"acknowledged_at,omitempty"`
+	SnoozedUntil   *time.Time `json:"snoozed_until,omitempty"`
+	AlertID        string     `json:"alert_id,omitempty"`
+}
+
+// SaveAIFindings persists AI findings to disk
+func (c *ConfigPersistence) SaveAIFindings(findings map[string]*AIFindingRecord) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.EnsureConfigDir(); err != nil {
+		return err
+	}
+
+	data := AIFindingsData{
+		Version:   1,
+		LastSaved: time.Now(),
+		Findings:  findings,
+	}
+
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	if err := c.writeConfigFileLocked(c.aiFindingsFile, jsonData, 0600); err != nil {
+		return err
+	}
+
+	log.Debug().
+		Str("file", c.aiFindingsFile).
+		Int("count", len(findings)).
+		Msg("AI findings saved")
+	return nil
+}
+
+// LoadAIFindings loads AI findings from disk
+func (c *ConfigPersistence) LoadAIFindings() (*AIFindingsData, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	data, err := os.ReadFile(c.aiFindingsFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Return empty data if file doesn't exist
+			return &AIFindingsData{
+				Version:  1,
+				Findings: make(map[string]*AIFindingRecord),
+			}, nil
+		}
+		return nil, err
+	}
+
+	var findingsData AIFindingsData
+	if err := json.Unmarshal(data, &findingsData); err != nil {
+		log.Error().Err(err).Str("file", c.aiFindingsFile).Msg("Failed to parse AI findings file")
+		// Return empty data on parse error rather than failing
+		return &AIFindingsData{
+			Version:  1,
+			Findings: make(map[string]*AIFindingRecord),
+		}, nil
+	}
+
+	if findingsData.Findings == nil {
+		findingsData.Findings = make(map[string]*AIFindingRecord)
+	}
+
+	log.Info().
+		Str("file", c.aiFindingsFile).
+		Int("count", len(findingsData.Findings)).
+		Time("last_saved", findingsData.LastSaved).
+		Msg("AI findings loaded")
+	return &findingsData, nil
+}
+
+// PatrolRunHistoryData represents persisted patrol run history with metadata
+type PatrolRunHistoryData struct {
+	Version   int               `json:"version"`
+	LastSaved time.Time         `json:"last_saved"`
+	Runs      []PatrolRunRecord `json:"runs"`
+}
+
+// PatrolRunRecord represents a single patrol check run
+type PatrolRunRecord struct {
+	ID               string    `json:"id"`
+	StartedAt        time.Time `json:"started_at"`
+	CompletedAt      time.Time `json:"completed_at"`
+	DurationMs       int64     `json:"duration_ms"`
+	Type             string    `json:"type"` // "quick" or "deep"
+	ResourcesChecked int       `json:"resources_checked"`
+	// Breakdown by resource type
+	NodesChecked   int `json:"nodes_checked"`
+	GuestsChecked  int `json:"guests_checked"`
+	DockerChecked  int `json:"docker_checked"`
+	StorageChecked int `json:"storage_checked"`
+	HostsChecked   int `json:"hosts_checked"`
+	PBSChecked     int `json:"pbs_checked"`
+	// Findings from this run
+	NewFindings      int      `json:"new_findings"`
+	ExistingFindings int      `json:"existing_findings"`
+	ResolvedFindings int      `json:"resolved_findings"`
+	FindingsSummary  string   `json:"findings_summary"`
+	FindingIDs       []string `json:"finding_ids,omitempty"`
+	ErrorCount       int      `json:"error_count"`
+	Status           string   `json:"status"` // "healthy", "issues_found", "critical", "error"
+	// AI Analysis details
+	AIAnalysis   string `json:"ai_analysis,omitempty"`   // The AI's raw response/analysis
+	InputTokens  int    `json:"input_tokens,omitempty"`  // Tokens sent to AI
+	OutputTokens int    `json:"output_tokens,omitempty"` // Tokens received from AI
+}
+
+// AIUsageHistoryData represents persisted AI usage history with metadata
+type AIUsageHistoryData struct {
+	Version   int                  `json:"version"`
+	LastSaved time.Time            `json:"last_saved"`
+	Events    []AIUsageEventRecord `json:"events"`
+}
+
+// AIUsageEventRecord is a persisted usage event for an AI provider call.
+// This intentionally excludes prompt/response content for privacy.
+type AIUsageEventRecord struct {
+	Timestamp     time.Time `json:"timestamp"`
+	Provider      string    `json:"provider"`
+	RequestModel  string    `json:"request_model"`
+	ResponseModel string    `json:"response_model,omitempty"`
+	UseCase       string    `json:"use_case,omitempty"` // "chat" or "patrol"
+	InputTokens   int       `json:"input_tokens,omitempty"`
+	OutputTokens  int       `json:"output_tokens,omitempty"`
+	TargetType    string    `json:"target_type,omitempty"`
+	TargetID      string    `json:"target_id,omitempty"`
+	FindingID     string    `json:"finding_id,omitempty"`
+}
+
+// SaveAIUsageHistory persists AI usage events to disk.
+func (c *ConfigPersistence) SaveAIUsageHistory(events []AIUsageEventRecord) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.EnsureConfigDir(); err != nil {
+		return err
+	}
+
+	data := AIUsageHistoryData{
+		Version:   1,
+		LastSaved: time.Now(),
+		Events:    events,
+	}
+
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	if err := c.writeConfigFileLocked(c.aiUsageHistoryFile, jsonData, 0600); err != nil {
+		return err
+	}
+
+	log.Debug().
+		Str("file", c.aiUsageHistoryFile).
+		Int("count", len(events)).
+		Msg("AI usage history saved")
+	return nil
+}
+
+// LoadAIUsageHistory loads AI usage events from disk.
+func (c *ConfigPersistence) LoadAIUsageHistory() (*AIUsageHistoryData, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	data, err := os.ReadFile(c.aiUsageHistoryFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return &AIUsageHistoryData{
+				Version: 1,
+				Events:  make([]AIUsageEventRecord, 0),
+			}, nil
+		}
+		return nil, err
+	}
+
+	var usageData AIUsageHistoryData
+	if err := json.Unmarshal(data, &usageData); err != nil {
+		log.Error().Err(err).Str("file", c.aiUsageHistoryFile).Msg("Failed to parse AI usage history file")
+		return &AIUsageHistoryData{
+			Version: 1,
+			Events:  make([]AIUsageEventRecord, 0),
+		}, nil
+	}
+
+	if usageData.Events == nil {
+		usageData.Events = make([]AIUsageEventRecord, 0)
+	}
+
+	log.Info().
+		Str("file", c.aiUsageHistoryFile).
+		Int("count", len(usageData.Events)).
+		Time("last_saved", usageData.LastSaved).
+		Msg("AI usage history loaded")
+	return &usageData, nil
+}
+
+// SavePatrolRunHistory persists patrol run history to disk
+func (c *ConfigPersistence) SavePatrolRunHistory(runs []PatrolRunRecord) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.EnsureConfigDir(); err != nil {
+		return err
+	}
+
+	data := PatrolRunHistoryData{
+		Version:   1,
+		LastSaved: time.Now(),
+		Runs:      runs,
+	}
+
+	jsonData, err := json.Marshal(data)
+	if err != nil {
+		return err
+	}
+
+	if err := c.writeConfigFileLocked(c.aiPatrolRunsFile, jsonData, 0600); err != nil {
+		return err
+	}
+
+	log.Debug().
+		Str("file", c.aiPatrolRunsFile).
+		Int("count", len(runs)).
+		Msg("Patrol run history saved")
+	return nil
+}
+
+// LoadPatrolRunHistory loads patrol run history from disk
+func (c *ConfigPersistence) LoadPatrolRunHistory() (*PatrolRunHistoryData, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	data, err := os.ReadFile(c.aiPatrolRunsFile)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Return empty data if file doesn't exist
+			return &PatrolRunHistoryData{
+				Version: 1,
+				Runs:    make([]PatrolRunRecord, 0),
+			}, nil
+		}
+		return nil, err
+	}
+
+	var historyData PatrolRunHistoryData
+	if err := json.Unmarshal(data, &historyData); err != nil {
+		log.Error().Err(err).Str("file", c.aiPatrolRunsFile).Msg("Failed to parse patrol run history file")
+		// Return empty data on parse error rather than failing
+		return &PatrolRunHistoryData{
+			Version: 1,
+			Runs:    make([]PatrolRunRecord, 0),
+		}, nil
+	}
+
+	if historyData.Runs == nil {
+		historyData.Runs = make([]PatrolRunRecord, 0)
+	}
+
+	log.Info().
+		Str("file", c.aiPatrolRunsFile).
+		Int("count", len(historyData.Runs)).
+		Time("last_saved", historyData.LastSaved).
+		Msg("Patrol run history loaded")
+	return &historyData, nil
+}
+
 // LoadSystemSettings loads system settings from file
 func (c *ConfigPersistence) LoadSystemSettings() (*SystemSettings, error) {
 	c.mu.RLock()
@@ -1440,3 +1828,60 @@ func (c *ConfigPersistence) cleanupOldBackups(pattern string) {
 		}
 	}
 }
+
+// LoadGuestMetadata loads all guest metadata from disk (for AI context)
+func (c *ConfigPersistence) LoadGuestMetadata() (map[string]*GuestMetadata, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	filePath := filepath.Join(c.configDir, "guest_metadata.json")
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]*GuestMetadata), nil
+		}
+		return nil, err
+	}
+
+	var metadata map[string]*GuestMetadata
+	if err := json.Unmarshal(data, &metadata); err != nil {
+		return nil, err
+	}
+
+	return metadata, nil
+}
+
+// LoadDockerMetadata loads all docker metadata from disk (for AI context)
+func (c *ConfigPersistence) LoadDockerMetadata() (map[string]*DockerMetadata, error) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	filePath := filepath.Join(c.configDir, "docker_metadata.json")
+	data, err := os.ReadFile(filePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[string]*DockerMetadata), nil
+		}
+		return nil, err
+	}
+
+	// Try versioned format first
+	var fileData struct {
+		Containers map[string]*DockerMetadata `json:"containers,omitempty"`
+	}
+	if err := json.Unmarshal(data, &fileData); err != nil {
+		return nil, err
+	}
+
+	if fileData.Containers != nil {
+		return fileData.Containers, nil
+	}
+
+	// Fall back to legacy format (direct map)
+	var metadata map[string]*DockerMetadata
+	if err := json.Unmarshal(data, &metadata); err != nil {
+		return nil, err
+	}
+
+	return metadata, nil
+}
diff --git a/internal/discovery/config_override.go b/internal/discovery/config_override.go
index 08d1f82..999f872 100644
--- a/internal/discovery/config_override.go
+++ b/internal/discovery/config_override.go
@@ -113,6 +113,19 @@ func ApplyConfigToProfile(profile *envdetect.EnvironmentProfile, cfg config.Disc
 	if cfg.HTTPTimeout > 0 {
 		profile.Policy.HTTPTimeout = time.Duration(cfg.HTTPTimeout) * time.Millisecond
 	}
+
+	// Apply IP blocklist (individual IPs to skip, e.g. already-configured Proxmox hosts)
+	for _, ipStr := range cfg.IPBlocklist {
+		ipStr = strings.TrimSpace(ipStr)
+		if ipStr == "" {
+			continue
+		}
+		if ip := net.ParseIP(ipStr); ip != nil {
+			profile.IPBlocklist = append(profile.IPBlocklist, ip)
+		} else {
+			profile.Warnings = append(profile.Warnings, fmt.Sprintf("Invalid IP in blocklist: %s", ipStr))
+		}
+	}
 }
 
 func shouldPruneContainerNetworks(env envdetect.Environment) bool {
diff --git a/internal/hostagent/agent.go b/internal/hostagent/agent.go
index 55f63c0..6efbd8f 100644
--- a/internal/hostagent/agent.go
+++ b/internal/hostagent/agent.go
@@ -12,7 +12,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/rcourtman/pulse-go-rewrite/internal/agentupdate"
 	"github.com/rcourtman/pulse-go-rewrite/internal/buffer"
+	"github.com/rcourtman/pulse-go-rewrite/internal/ceph"
 	"github.com/rcourtman/pulse-go-rewrite/internal/hostmetrics"
 	"github.com/rcourtman/pulse-go-rewrite/internal/mdadm"
 	"github.com/rcourtman/pulse-go-rewrite/internal/sensors"
@@ -35,6 +37,10 @@ type Config struct {
 	RunOnce            bool
 	LogLevel           zerolog.Level
 	Logger             *zerolog.Logger
+
+	// Proxmox integration
+	EnableProxmox bool   // If true, creates Proxmox API token and registers node on startup
+	ProxmoxType   string // "pve", "pbs", or "" for auto-detect
 }
 
 // Agent is responsible for collecting host metrics and shipping them to Pulse.
@@ -54,9 +60,11 @@ type Agent struct {
 	machineID       string
 	agentID         string
 	agentVersion    string
+	updatedFrom     string // Previous version if recently auto-updated (reported once)
 	interval        time.Duration
 	trimmedPulseURL string
 	reportBuffer    *buffer.Queue[agentshost.Report]
+	commandClient   *CommandClient
 }
 
 const defaultInterval = 30 * time.Second
@@ -168,7 +176,16 @@ func New(cfg Config) (*Agent, error) {
 
 	const bufferCapacity = 60
 
-	return &Agent{
+	// Check if agent was recently auto-updated (only reported once per restart)
+	updatedFrom := agentupdate.GetUpdatedFromVersion()
+	if updatedFrom != "" {
+		logger.Info().
+			Str("previousVersion", updatedFrom).
+			Str("currentVersion", agentVersion).
+			Msg("Agent was auto-updated")
+	}
+
+	agent := &Agent{
 		cfg:             cfg,
 		logger:          logger,
 		httpClient:      client,
@@ -183,10 +200,16 @@ func New(cfg Config) (*Agent, error) {
 		machineID:       machineID,
 		agentID:         agentID,
 		agentVersion:    agentVersion,
+		updatedFrom:     updatedFrom,
 		interval:        cfg.Interval,
 		trimmedPulseURL: pulseURL,
 		reportBuffer:    buffer.New[agentshost.Report](bufferCapacity),
-	}, nil
+	}
+
+	// Create command client for AI command execution
+	agent.commandClient = NewCommandClient(cfg, agentID, hostname, platform, agentVersion)
+
+	return agent, nil
 }
 
 // Run executes the agent until the context is cancelled.
@@ -195,6 +218,20 @@ func (a *Agent) Run(ctx context.Context) error {
 		return a.runOnce(ctx)
 	}
 
+	// Proxmox setup (if enabled)
+	if a.cfg.EnableProxmox {
+		a.runProxmoxSetup(ctx)
+	}
+
+	// Start command client in background for AI command execution
+	if a.commandClient != nil {
+		go func() {
+			if err := a.commandClient.Run(ctx); err != nil && !errors.Is(err, context.Canceled) {
+				a.logger.Error().Err(err).Msg("Command client stopped with error")
+			}
+		}()
+	}
+
 	ticker := time.NewTicker(a.interval)
 	defer ticker.Stop()
 
@@ -282,6 +319,9 @@ func (a *Agent) buildReport(ctx context.Context) (agentshost.Report, error) {
 	// Collect RAID array data (best effort - don't fail if unavailable)
 	raidData := a.collectRAIDArrays(collectCtx)
 
+	// Collect Ceph cluster data (best effort - only on Ceph nodes)
+	cephData := a.collectCephStatus(collectCtx)
+
 	report := agentshost.Report{
 		Agent: agentshost.AgentInfo{
 			ID:              a.agentID,
@@ -289,6 +329,7 @@ func (a *Agent) buildReport(ctx context.Context) (agentshost.Report, error) {
 			Type:            a.cfg.AgentType,
 			IntervalSeconds: int(a.interval / time.Second),
 			Hostname:        a.hostname,
+			UpdatedFrom:     a.updatedFrom,
 		},
 		Host: agentshost.HostInfo{
 			ID:            a.machineID,
@@ -310,9 +351,11 @@ func (a *Agent) buildReport(ctx context.Context) (agentshost.Report, error) {
 			Memory:          snapshot.Memory,
 		},
 		Disks:     append([]agentshost.Disk(nil), snapshot.Disks...),
+		DiskIO:    append([]agentshost.DiskIO(nil), snapshot.DiskIO...),
 		Network:   append([]agentshost.NetworkInterface(nil), snapshot.Network...),
 		Sensors:   sensorData,
 		RAID:      raidData,
+		Ceph:      cephData,
 		Tags:      append([]string(nil), a.cfg.Tags...),
 		Timestamp: time.Now().UTC(),
 	}
@@ -443,3 +486,160 @@ func (a *Agent) collectRAIDArrays(ctx context.Context) []agentshost.RAIDArray {
 
 	return arrays
 }
+
+// collectCephStatus attempts to collect Ceph cluster status.
+// Returns nil if Ceph is not available or not configured on this host.
+func (a *Agent) collectCephStatus(ctx context.Context) *agentshost.CephCluster {
+	// Only collect on Linux
+	if runtime.GOOS != "linux" {
+		return nil
+	}
+
+	status, err := ceph.Collect(ctx)
+	if err != nil {
+		a.logger.Debug().Err(err).Msg("Failed to collect Ceph status")
+		return nil
+	}
+	if status == nil {
+		return nil
+	}
+
+	// Convert internal ceph types to agent report types
+	result := &agentshost.CephCluster{
+		FSID: status.FSID,
+		Health: agentshost.CephHealth{
+			Status: status.Health.Status,
+			Checks: make(map[string]agentshost.CephCheck),
+		},
+		MonMap: agentshost.CephMonitorMap{
+			Epoch:   status.MonMap.Epoch,
+			NumMons: status.MonMap.NumMons,
+		},
+		MgrMap: agentshost.CephManagerMap{
+			Available: status.MgrMap.Available,
+			NumMgrs:   status.MgrMap.NumMgrs,
+			ActiveMgr: status.MgrMap.ActiveMgr,
+			Standbys:  status.MgrMap.Standbys,
+		},
+		OSDMap: agentshost.CephOSDMap{
+			Epoch:   status.OSDMap.Epoch,
+			NumOSDs: status.OSDMap.NumOSDs,
+			NumUp:   status.OSDMap.NumUp,
+			NumIn:   status.OSDMap.NumIn,
+			NumDown: status.OSDMap.NumDown,
+			NumOut:  status.OSDMap.NumOut,
+		},
+		PGMap: agentshost.CephPGMap{
+			NumPGs:           status.PGMap.NumPGs,
+			BytesTotal:       status.PGMap.BytesTotal,
+			BytesUsed:        status.PGMap.BytesUsed,
+			BytesAvailable:   status.PGMap.BytesAvailable,
+			DataBytes:        status.PGMap.DataBytes,
+			UsagePercent:     status.PGMap.UsagePercent,
+			DegradedRatio:    status.PGMap.DegradedRatio,
+			MisplacedRatio:   status.PGMap.MisplacedRatio,
+			ReadBytesPerSec:  status.PGMap.ReadBytesPerSec,
+			WriteBytesPerSec: status.PGMap.WriteBytesPerSec,
+			ReadOpsPerSec:    status.PGMap.ReadOpsPerSec,
+			WriteOpsPerSec:   status.PGMap.WriteOpsPerSec,
+		},
+		CollectedAt: status.CollectedAt.Format(time.RFC3339),
+	}
+
+	// Convert monitors
+	for _, mon := range status.MonMap.Monitors {
+		result.MonMap.Monitors = append(result.MonMap.Monitors, agentshost.CephMonitor{
+			Name:   mon.Name,
+			Rank:   mon.Rank,
+			Addr:   mon.Addr,
+			Status: mon.Status,
+		})
+	}
+
+	// Convert health checks
+	for name, check := range status.Health.Checks {
+		result.Health.Checks[name] = agentshost.CephCheck{
+			Severity: check.Severity,
+			Message:  check.Message,
+			Detail:   check.Detail,
+		}
+	}
+
+	// Convert health summary
+	for _, s := range status.Health.Summary {
+		result.Health.Summary = append(result.Health.Summary, agentshost.CephHealthSummary{
+			Severity: s.Severity,
+			Message:  s.Message,
+		})
+	}
+
+	// Convert pools
+	for _, pool := range status.Pools {
+		result.Pools = append(result.Pools, agentshost.CephPool{
+			ID:             pool.ID,
+			Name:           pool.Name,
+			BytesUsed:      pool.BytesUsed,
+			BytesAvailable: pool.BytesAvailable,
+			Objects:        pool.Objects,
+			PercentUsed:    pool.PercentUsed,
+		})
+	}
+
+	// Convert services
+	for _, svc := range status.Services {
+		result.Services = append(result.Services, agentshost.CephService{
+			Type:    svc.Type,
+			Running: svc.Running,
+			Total:   svc.Total,
+			Daemons: svc.Daemons,
+		})
+	}
+
+	a.logger.Debug().
+		Str("fsid", result.FSID).
+		Str("health", result.Health.Status).
+		Int("osds", result.OSDMap.NumOSDs).
+		Int("pools", len(result.Pools)).
+		Msg("Collected Ceph cluster status")
+
+	return result
+}
+
+// runProxmoxSetup performs one-time Proxmox API token setup and node registration.
+func (a *Agent) runProxmoxSetup(ctx context.Context) {
+	a.logger.Info().Msg("Proxmox mode enabled, checking setup...")
+
+	setup := NewProxmoxSetup(
+		a.logger,
+		a.httpClient,
+		a.trimmedPulseURL,
+		a.cfg.APIToken,
+		a.cfg.ProxmoxType,
+		a.hostname,
+		a.cfg.InsecureSkipVerify,
+	)
+
+	result, err := setup.Run(ctx)
+	if err != nil {
+		a.logger.Error().Err(err).Msg("Proxmox setup failed")
+		return
+	}
+
+	if result == nil {
+		// Already registered
+		return
+	}
+
+	if result.Registered {
+		a.logger.Info().
+			Str("type", result.ProxmoxType).
+			Str("host", result.NodeHost).
+			Str("token_id", result.TokenID).
+			Msg("Proxmox node registered successfully")
+	} else {
+		a.logger.Warn().
+			Str("type", result.ProxmoxType).
+			Str("host", result.NodeHost).
+			Msg("Proxmox token created but registration failed (node may need manual configuration)")
+	}
+}
diff --git a/internal/hostagent/commands.go b/internal/hostagent/commands.go
new file mode 100644
index 0000000..53e82d6
--- /dev/null
+++ b/internal/hostagent/commands.go
@@ -0,0 +1,446 @@
+package hostagent
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os/exec"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/websocket"
+	"github.com/rs/zerolog"
+)
+
+// CommandClient handles WebSocket connection to Pulse for AI command execution
+type CommandClient struct {
+	pulseURL           string
+	apiToken           string
+	agentID            string
+	hostname           string
+	platform           string
+	version            string
+	insecureSkipVerify bool
+	logger             zerolog.Logger
+
+	conn     *websocket.Conn
+	connMu   sync.Mutex
+	done     chan struct{}
+}
+
+// NewCommandClient creates a new command execution client
+func NewCommandClient(cfg Config, agentID, hostname, platform, version string) *CommandClient {
+	logger := cfg.Logger.With().Str("component", "command-client").Logger()
+
+	return &CommandClient{
+		pulseURL:           strings.TrimRight(cfg.PulseURL, "/"),
+		apiToken:           cfg.APIToken,
+		agentID:            agentID,
+		hostname:           hostname,
+		platform:           platform,
+		version:            version,
+		insecureSkipVerify: cfg.InsecureSkipVerify,
+		logger:             logger,
+		done:               make(chan struct{}),
+	}
+}
+
+// Message types matching agentexec package
+type messageType string
+
+const (
+	msgTypeAgentRegister messageType = "agent_register"
+	msgTypeAgentPing     messageType = "agent_ping"
+	msgTypeCommandResult messageType = "command_result"
+	msgTypeRegistered    messageType = "registered"
+	msgTypePong          messageType = "pong"
+	msgTypeExecuteCmd    messageType = "execute_command"
+	msgTypeReadFile      messageType = "read_file"
+)
+
+type wsMessage struct {
+	Type      messageType     `json:"type"`
+	ID        string          `json:"id,omitempty"`
+	Timestamp time.Time       `json:"timestamp"`
+	Payload   json.RawMessage `json:"payload,omitempty"`
+}
+
+type registerPayload struct {
+	AgentID  string   `json:"agent_id"`
+	Hostname string   `json:"hostname"`
+	Version  string   `json:"version"`
+	Platform string   `json:"platform"`
+	Tags     []string `json:"tags,omitempty"`
+	Token    string   `json:"token"`
+}
+
+type registeredPayload struct {
+	Success bool   `json:"success"`
+	Message string `json:"message,omitempty"`
+}
+
+type executeCommandPayload struct {
+	RequestID  string `json:"request_id"`
+	Command    string `json:"command"`
+	TargetType string `json:"target_type"`
+	TargetID   string `json:"target_id,omitempty"`
+	Timeout    int    `json:"timeout,omitempty"`
+}
+
+type commandResultPayload struct {
+	RequestID string `json:"request_id"`
+	Success   bool   `json:"success"`
+	Stdout    string `json:"stdout,omitempty"`
+	Stderr    string `json:"stderr,omitempty"`
+	ExitCode  int    `json:"exit_code"`
+	Error     string `json:"error,omitempty"`
+	Duration  int64  `json:"duration_ms"`
+}
+
+// Run starts the command client and maintains the WebSocket connection
+func (c *CommandClient) Run(ctx context.Context) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if err := c.connectAndHandle(ctx); err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			c.logger.Warn().Err(err).Msg("WebSocket connection failed, reconnecting in 10s")
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(10 * time.Second):
+			}
+		}
+	}
+}
+
+func (c *CommandClient) connectAndHandle(ctx context.Context) error {
+	// Build WebSocket URL
+	wsURL, err := c.buildWebSocketURL()
+	if err != nil {
+		return fmt.Errorf("build websocket url: %w", err)
+	}
+
+	c.logger.Info().Str("url", wsURL).Msg("Connecting to Pulse command server")
+
+	// Create dialer with TLS config
+	dialer := websocket.Dialer{
+		TLSClientConfig: &tls.Config{
+			MinVersion:         tls.VersionTLS12,
+			InsecureSkipVerify: c.insecureSkipVerify,
+		},
+		HandshakeTimeout: 45 * time.Second,
+	}
+
+	// Connect
+	conn, _, err := dialer.DialContext(ctx, wsURL, nil)
+	if err != nil {
+		return fmt.Errorf("dial websocket: %w", err)
+	}
+
+	c.connMu.Lock()
+	c.conn = conn
+	c.connMu.Unlock()
+
+	defer func() {
+		c.connMu.Lock()
+		c.conn = nil
+		c.connMu.Unlock()
+		conn.Close()
+	}()
+
+	// Send registration
+	if err := c.sendRegistration(conn); err != nil {
+		return fmt.Errorf("send registration: %w", err)
+	}
+
+	// Wait for registration response
+	if err := c.waitForRegistration(conn); err != nil {
+		return fmt.Errorf("registration failed: %w", err)
+	}
+
+	c.logger.Info().Msg("Connected and registered with Pulse command server")
+
+	// Clear any deadlines that may have been set during handshake
+	// The HandshakeTimeout in the Dialer may have set a deadline on the underlying connection
+	conn.SetReadDeadline(time.Time{})
+	conn.SetWriteDeadline(time.Time{})
+	if netConn := conn.NetConn(); netConn != nil {
+		netConn.SetReadDeadline(time.Time{})
+		netConn.SetWriteDeadline(time.Time{})
+	}
+
+	// Start ping loop
+	pingDone := make(chan struct{})
+	go c.pingLoop(ctx, conn, pingDone)
+	defer close(pingDone)
+
+	// Handle incoming messages
+	return c.handleMessages(ctx, conn)
+}
+
+func (c *CommandClient) buildWebSocketURL() (string, error) {
+	parsed, err := url.Parse(c.pulseURL)
+	if err != nil {
+		return "", err
+	}
+
+	// Convert http(s) to ws(s)
+	switch parsed.Scheme {
+	case "https":
+		parsed.Scheme = "wss"
+	case "http":
+		parsed.Scheme = "ws"
+	case "wss", "ws":
+		// Already WebSocket scheme
+	default:
+		parsed.Scheme = "ws"
+	}
+
+	parsed.Path = "/api/agent/ws"
+	return parsed.String(), nil
+}
+
+func (c *CommandClient) sendRegistration(conn *websocket.Conn) error {
+	payload, _ := json.Marshal(registerPayload{
+		AgentID:  c.agentID,
+		Hostname: c.hostname,
+		Version:  c.version,
+		Platform: c.platform,
+		Token:    c.apiToken,
+	})
+
+	msg := wsMessage{
+		Type:      msgTypeAgentRegister,
+		Timestamp: time.Now(),
+		Payload:   payload,
+	}
+
+	return conn.WriteJSON(msg)
+}
+
+func (c *CommandClient) waitForRegistration(conn *websocket.Conn) error {
+	conn.SetReadDeadline(time.Now().Add(30 * time.Second))
+	defer conn.SetReadDeadline(time.Time{})
+
+	var msg wsMessage
+	if err := conn.ReadJSON(&msg); err != nil {
+		return fmt.Errorf("read registration response: %w", err)
+	}
+
+	if msg.Type != msgTypeRegistered {
+		return fmt.Errorf("unexpected message type: %s", msg.Type)
+	}
+
+	var payload registeredPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return fmt.Errorf("parse registration response: %w", err)
+	}
+
+	if !payload.Success {
+		return fmt.Errorf("registration rejected: %s", payload.Message)
+	}
+
+	return nil
+}
+
+func (c *CommandClient) pingLoop(ctx context.Context, conn *websocket.Conn, done chan struct{}) {
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-done:
+			return
+		case <-ticker.C:
+			c.connMu.Lock()
+			if c.conn != nil {
+				msg := wsMessage{
+					Type:      msgTypeAgentPing,
+					Timestamp: time.Now(),
+				}
+				if err := conn.WriteJSON(msg); err != nil {
+					c.logger.Debug().Err(err).Msg("Failed to send ping")
+				}
+			}
+			c.connMu.Unlock()
+		}
+	}
+}
+
+func (c *CommandClient) handleMessages(ctx context.Context, conn *websocket.Conn) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		var msg wsMessage
+		if err := conn.ReadJSON(&msg); err != nil {
+			return fmt.Errorf("read message: %w", err)
+		}
+
+		switch msg.Type {
+		case msgTypePong:
+			// Ignore pong responses
+
+		case msgTypeExecuteCmd:
+			var payload executeCommandPayload
+			if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+				c.logger.Error().Err(err).Msg("Failed to parse execute_command payload")
+				continue
+			}
+
+			// Execute command in background
+			go c.handleExecuteCommand(ctx, conn, payload)
+
+		case msgTypeReadFile:
+			// Handle read_file similarly (uses cat command internally)
+			var payload executeCommandPayload
+			if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+				c.logger.Error().Err(err).Msg("Failed to parse read_file payload")
+				continue
+			}
+			go c.handleExecuteCommand(ctx, conn, payload)
+
+		default:
+			c.logger.Debug().Str("type", string(msg.Type)).Msg("Unknown message type")
+		}
+	}
+}
+
+func (c *CommandClient) handleExecuteCommand(ctx context.Context, conn *websocket.Conn, payload executeCommandPayload) {
+	startTime := time.Now()
+
+	c.logger.Info().
+		Str("request_id", payload.RequestID).
+		Str("command", payload.Command).
+		Str("target_type", payload.TargetType).
+		Str("target_id", payload.TargetID).
+		Msg("Executing command")
+
+	result := c.executeCommand(ctx, payload)
+	result.Duration = time.Since(startTime).Milliseconds()
+
+	// Send result back
+	resultPayload, _ := json.Marshal(result)
+	msg := wsMessage{
+		Type:      msgTypeCommandResult,
+		ID:        payload.RequestID,
+		Timestamp: time.Now(),
+		Payload:   resultPayload,
+	}
+
+	c.connMu.Lock()
+	err := conn.WriteJSON(msg)
+	c.connMu.Unlock()
+
+	if err != nil {
+		c.logger.Error().Err(err).Str("request_id", payload.RequestID).Msg("Failed to send command result")
+	} else {
+		c.logger.Info().
+			Str("request_id", payload.RequestID).
+			Bool("success", result.Success).
+			Int("exit_code", result.ExitCode).
+			Int64("duration_ms", result.Duration).
+			Msg("Command completed")
+	}
+}
+
+func (c *CommandClient) executeCommand(ctx context.Context, payload executeCommandPayload) commandResultPayload {
+	result := commandResultPayload{
+		RequestID: payload.RequestID,
+	}
+
+	// Determine timeout
+	timeout := time.Duration(payload.Timeout) * time.Second
+	if timeout <= 0 {
+		timeout = 60 * time.Second
+	}
+
+	cmdCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	// Build the command based on target type
+	command := payload.Command
+
+	// If targeting a container or VM, wrap the command
+	if payload.TargetType == "container" && payload.TargetID != "" {
+		// Use pct exec for LXC containers
+		command = fmt.Sprintf("pct exec %s -- %s", payload.TargetID, payload.Command)
+	} else if payload.TargetType == "vm" && payload.TargetID != "" {
+		// Use qm guest exec for VMs (requires QEMU guest agent)
+		command = fmt.Sprintf("qm guest exec %s -- %s", payload.TargetID, payload.Command)
+	}
+
+	// Execute the command
+	var cmd *exec.Cmd
+	if runtime.GOOS == "windows" {
+		cmd = exec.CommandContext(cmdCtx, "cmd", "/C", command)
+	} else {
+		cmd = exec.CommandContext(cmdCtx, "sh", "-c", command)
+	}
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+
+	result.Stdout = stdout.String()
+	result.Stderr = stderr.String()
+
+	if err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			result.ExitCode = exitErr.ExitCode()
+			result.Success = false
+		} else if cmdCtx.Err() == context.DeadlineExceeded {
+			result.Error = "command timed out"
+			result.ExitCode = -1
+			result.Success = false
+		} else {
+			result.Error = err.Error()
+			result.ExitCode = -1
+			result.Success = false
+		}
+	} else {
+		result.ExitCode = 0
+		result.Success = true
+	}
+
+	// Truncate output if too large (1MB limit)
+	const maxOutputSize = 1024 * 1024
+	if len(result.Stdout) > maxOutputSize {
+		result.Stdout = result.Stdout[:maxOutputSize] + "\n... (output truncated)"
+	}
+	if len(result.Stderr) > maxOutputSize {
+		result.Stderr = result.Stderr[:maxOutputSize] + "\n... (output truncated)"
+	}
+
+	return result
+}
+
+// Close closes the command client connection
+func (c *CommandClient) Close() error {
+	c.connMu.Lock()
+	defer c.connMu.Unlock()
+
+	if c.conn != nil {
+		return c.conn.Close()
+	}
+	return nil
+}
diff --git a/internal/hostagent/proxmox_setup.go b/internal/hostagent/proxmox_setup.go
new file mode 100644
index 0000000..5d021ac
--- /dev/null
+++ b/internal/hostagent/proxmox_setup.go
@@ -0,0 +1,344 @@
+package hostagent
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+)
+
+// ProxmoxSetup handles one-time Proxmox API token creation and node registration.
+type ProxmoxSetup struct {
+	logger             zerolog.Logger
+	httpClient         *http.Client
+	pulseURL           string
+	apiToken           string
+	proxmoxType        string // "pve", "pbs", or "" for auto-detect
+	hostname           string
+	insecureSkipVerify bool
+}
+
+// ProxmoxSetupResult contains the result of a successful Proxmox setup.
+type ProxmoxSetupResult struct {
+	ProxmoxType string // "pve" or "pbs"
+	TokenID     string // Full token ID (e.g., "pulse-monitor@pam!pulse-1234567890")
+	TokenValue  string // The secret token value
+	NodeHost    string // The host URL for auto-registration
+	Registered  bool   // Whether the node was successfully registered with Pulse
+}
+
+const (
+	proxmoxUser     = "pulse-monitor"
+	proxmoxUserPVE  = "pulse-monitor@pam"
+	proxmoxUserPBS  = "pulse-monitor@pbs"
+	proxmoxComment  = "Pulse monitoring service"
+	stateFilePath   = "/var/lib/pulse-agent/proxmox-registered"
+	stateFileDir    = "/var/lib/pulse-agent"
+)
+
+// NewProxmoxSetup creates a new ProxmoxSetup instance.
+func NewProxmoxSetup(logger zerolog.Logger, httpClient *http.Client, pulseURL, apiToken, proxmoxType, hostname string, insecure bool) *ProxmoxSetup {
+	return &ProxmoxSetup{
+		logger:             logger,
+		httpClient:         httpClient,
+		pulseURL:           strings.TrimRight(pulseURL, "/"),
+		apiToken:           apiToken,
+		proxmoxType:        proxmoxType,
+		hostname:           hostname,
+		insecureSkipVerify: insecure,
+	}
+}
+
+// Run executes the Proxmox setup process:
+// 1. Detects Proxmox type (if not specified)
+// 2. Creates the monitoring user and API token
+// 3. Registers the node with Pulse via auto-register
+func (p *ProxmoxSetup) Run(ctx context.Context) (*ProxmoxSetupResult, error) {
+	// Check if already registered (idempotency)
+	if p.isAlreadyRegistered() {
+		p.logger.Info().Msg("Proxmox node already registered, skipping setup")
+		return nil, nil
+	}
+
+	// Detect Proxmox type
+	ptype := p.proxmoxType
+	if ptype == "" {
+		detected := p.detectProxmoxType()
+		if detected == "" {
+			return nil, fmt.Errorf("this system does not appear to be a Proxmox VE or PBS node")
+		}
+		ptype = detected
+		p.logger.Info().Str("type", ptype).Msg("Auto-detected Proxmox type")
+	}
+
+	// Create monitoring user and token
+	tokenID, tokenValue, err := p.setupToken(ctx, ptype)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Proxmox API token: %w", err)
+	}
+
+	p.logger.Info().Str("token_id", tokenID).Msg("Created Proxmox API token")
+
+	// Get the host URL for registration
+	hostURL := p.getHostURL(ptype)
+
+	// Register with Pulse
+	registered := false
+	if err := p.registerWithPulse(ctx, ptype, hostURL, tokenID, tokenValue); err != nil {
+		p.logger.Warn().Err(err).Msg("Failed to register with Pulse (node may already exist)")
+	} else {
+		registered = true
+		p.markAsRegistered()
+		p.logger.Info().Str("host", hostURL).Msg("Successfully registered Proxmox node with Pulse")
+	}
+
+	return &ProxmoxSetupResult{
+		ProxmoxType: ptype,
+		TokenID:     tokenID,
+		TokenValue:  tokenValue,
+		NodeHost:    hostURL,
+		Registered:  registered,
+	}, nil
+}
+
+// detectProxmoxType checks for pvesh (PVE) or proxmox-backup-manager (PBS).
+func (p *ProxmoxSetup) detectProxmoxType() string {
+	// Check for PVE first
+	if _, err := exec.LookPath("pvesh"); err == nil {
+		return "pve"
+	}
+	// Check for PBS
+	if _, err := exec.LookPath("proxmox-backup-manager"); err == nil {
+		return "pbs"
+	}
+	return ""
+}
+
+// setupToken creates the monitoring user and API token.
+func (p *ProxmoxSetup) setupToken(ctx context.Context, ptype string) (string, string, error) {
+	tokenName := fmt.Sprintf("pulse-%d", time.Now().Unix())
+
+	if ptype == "pve" {
+		return p.setupPVEToken(ctx, tokenName)
+	}
+	return p.setupPBSToken(ctx, tokenName)
+}
+
+// setupPVEToken creates a PVE monitoring user and token.
+func (p *ProxmoxSetup) setupPVEToken(ctx context.Context, tokenName string) (string, string, error) {
+	// Create user (ignore error if already exists)
+	_ = runCommand(ctx, "pveum", "user", "add", proxmoxUserPVE, "--comment", proxmoxComment)
+
+	// Add PVEAuditor role
+	if err := runCommand(ctx, "pveum", "aclmod", "/", "-user", proxmoxUserPVE, "-role", "PVEAuditor"); err != nil {
+		p.logger.Warn().Err(err).Msg("Failed to add PVEAuditor role (may already exist)")
+	}
+
+	// Try to create PulseMonitor role with additional privileges
+	_ = runCommand(ctx, "pveum", "role", "add", "PulseMonitor", "-privs", "Sys.Audit,VM.Monitor,Datastore.Audit")
+	_ = runCommand(ctx, "pveum", "aclmod", "/", "-user", proxmoxUserPVE, "-role", "PulseMonitor")
+
+	// Create token with privilege separation disabled
+	output, err := runCommandOutput(ctx, "pveum", "user", "token", "add", proxmoxUserPVE, tokenName, "--privsep", "0")
+	if err != nil {
+		return "", "", fmt.Errorf("failed to create token: %w", err)
+	}
+
+	// Parse token value from output
+	tokenValue := p.parseTokenValue(output)
+	if tokenValue == "" {
+		return "", "", fmt.Errorf("failed to parse token value from pveum output")
+	}
+
+	tokenID := fmt.Sprintf("%s!%s", proxmoxUserPVE, tokenName)
+	return tokenID, tokenValue, nil
+}
+
+// setupPBSToken creates a PBS monitoring user and token.
+func (p *ProxmoxSetup) setupPBSToken(ctx context.Context, tokenName string) (string, string, error) {
+	// Create user (ignore error if already exists)
+	_ = runCommand(ctx, "proxmox-backup-manager", "user", "create", proxmoxUserPBS)
+
+	// Add Audit role
+	_ = runCommand(ctx, "proxmox-backup-manager", "acl", "update", "/", "Audit", "--auth-id", proxmoxUserPBS)
+
+	// Create token
+	output, err := runCommandOutput(ctx, "proxmox-backup-manager", "user", "generate-token", proxmoxUserPBS, tokenName)
+	if err != nil {
+		return "", "", fmt.Errorf("failed to create token: %w", err)
+	}
+
+	// Parse token value from JSON output
+	tokenValue := p.parsePBSTokenValue(output)
+	if tokenValue == "" {
+		return "", "", fmt.Errorf("failed to parse token value from PBS output")
+	}
+
+	// Add Audit role for the token itself
+	tokenID := fmt.Sprintf("%s!%s", proxmoxUserPBS, tokenName)
+	_ = runCommand(ctx, "proxmox-backup-manager", "acl", "update", "/", "Audit", "--auth-id", tokenID)
+
+	return tokenID, tokenValue, nil
+}
+
+// parseTokenValue extracts the token value from PVE pveum output.
+// The output format is typically a table with columns: │ key │ value │
+// Example output:
+// ┌──────────────┬──────────────────────────────────────┐
+// │ key          │ value                                │
+// ╞══════════════╪══════════════════════════════════════╡
+// │ full-tokenid │ pulse-monitor@pam!pulse-token        │
+// ├──────────────┼──────────────────────────────────────┤
+// │ info         │ {"privsep":"0"}                      │
+// ├──────────────┼──────────────────────────────────────┤
+// │ value        │ xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx │
+// └──────────────┴──────────────────────────────────────┘
+func (p *ProxmoxSetup) parseTokenValue(output string) string {
+	// Look for the "value" row in the table output - where "value" is the KEY column
+	// We need to find the row where parts[1] (key column) is "value", not any row
+	// containing the word "value" (which would match the header row)
+	lines := strings.Split(output, "\n")
+	for _, line := range lines {
+		// Split by the box drawing character │ (U+2502)
+		parts := strings.Split(line, "│")
+		if len(parts) >= 3 {
+			key := strings.TrimSpace(parts[1])
+			if key == "value" {
+				return strings.TrimSpace(parts[2])
+			}
+		}
+	}
+
+	// Fallback: try regex for UUID-like token
+	re := regexp.MustCompile(`[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`)
+	if match := re.FindString(output); match != "" {
+		return match
+	}
+
+	return ""
+}
+
+// parsePBSTokenValue extracts the token value from PBS JSON output.
+func (p *ProxmoxSetup) parsePBSTokenValue(output string) string {
+	// PBS outputs JSON like: {"tokenid": "...", "value": "..."}
+	var result struct {
+		Value string `json:"value"`
+	}
+	if err := json.Unmarshal([]byte(output), &result); err == nil && result.Value != "" {
+		return result.Value
+	}
+
+	// Fallback: extract from "value": "..." pattern
+	re := regexp.MustCompile(`"value"\s*:\s*"([^"]+)"`)
+	if matches := re.FindStringSubmatch(output); len(matches) >= 2 {
+		return matches[1]
+	}
+
+	return ""
+}
+
+// getHostURL constructs the host URL for this Proxmox node.
+// Prefers IP address over hostname since hostnames are often not DNS-resolvable.
+func (p *ProxmoxSetup) getHostURL(ptype string) string {
+	port := "8006"
+	if ptype == "pbs" {
+		port = "8007"
+	}
+
+	// Always prefer IP address since hostnames often can't be resolved by Pulse
+	// (e.g., "pi" hostname won't resolve via DNS)
+	if out, err := exec.Command("hostname", "-I").Output(); err == nil {
+		ips := strings.Fields(string(out))
+		if len(ips) > 0 {
+			// Use first non-loopback IP
+			for _, ip := range ips {
+				if ip != "127.0.0.1" && ip != "::1" {
+					return fmt.Sprintf("https://%s:%s", ip, port)
+				}
+			}
+		}
+	}
+
+	// Fallback to hostname if IP detection failed
+	hostname := p.hostname
+	if hostname == "" {
+		hostname = "localhost"
+	}
+	return fmt.Sprintf("https://%s:%s", hostname, port)
+}
+
+// registerWithPulse calls the auto-register endpoint to add the node.
+func (p *ProxmoxSetup) registerWithPulse(ctx context.Context, ptype, hostURL, tokenID, tokenValue string) error {
+	payload := map[string]interface{}{
+		"type":       ptype,
+		"host":       hostURL,
+		"serverName": p.hostname,
+		"tokenId":    tokenID,
+		"tokenValue": tokenValue,
+		"source":     "agent", // Indicates this was registered via agent
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal payload: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.pulseURL+"/api/auto-register", bytes.NewReader(body))
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-API-Token", p.apiToken)
+
+	resp, err := p.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("auto-register returned %d", resp.StatusCode)
+	}
+
+	return nil
+}
+
+// isAlreadyRegistered checks if we've already done Proxmox setup.
+func (p *ProxmoxSetup) isAlreadyRegistered() bool {
+	_, err := os.Stat(stateFilePath)
+	return err == nil
+}
+
+// markAsRegistered creates a state file to indicate setup is complete.
+func (p *ProxmoxSetup) markAsRegistered() {
+	if err := os.MkdirAll(stateFileDir, 0755); err != nil {
+		p.logger.Warn().Err(err).Msg("Failed to create state directory")
+		return
+	}
+
+	if err := os.WriteFile(stateFilePath, []byte(time.Now().Format(time.RFC3339)), 0644); err != nil {
+		p.logger.Warn().Err(err).Msg("Failed to write state file")
+	}
+}
+
+// runCommand executes a command and returns any error.
+func runCommand(ctx context.Context, name string, args ...string) error {
+	cmd := exec.CommandContext(ctx, name, args...)
+	return cmd.Run()
+}
+
+// runCommandOutput executes a command and returns the output.
+func runCommandOutput(ctx context.Context, name string, args ...string) (string, error) {
+	cmd := exec.CommandContext(ctx, name, args...)
+	output, err := cmd.CombinedOutput()
+	return string(output), err
+}
diff --git a/internal/hostmetrics/collector.go b/internal/hostmetrics/collector.go
index 7ef40df..6f1bd38 100644
--- a/internal/hostmetrics/collector.go
+++ b/internal/hostmetrics/collector.go
@@ -18,14 +18,15 @@ import (
 
 // System call wrappers for testing
 var (
-	cpuCounts      = gocpu.CountsWithContext
-	cpuPercent     = gocpu.PercentWithContext
-	loadAvg        = goload.AvgWithContext
-	virtualMemory  = gomem.VirtualMemoryWithContext
-	diskPartitions = godisk.PartitionsWithContext
-	diskUsage      = godisk.UsageWithContext
-	netInterfaces  = gonet.InterfacesWithContext
-	netIOCounters  = gonet.IOCountersWithContext
+	cpuCounts       = gocpu.CountsWithContext
+	cpuPercent      = gocpu.PercentWithContext
+	loadAvg         = goload.AvgWithContext
+	virtualMemory   = gomem.VirtualMemoryWithContext
+	diskPartitions  = godisk.PartitionsWithContext
+	diskUsage       = godisk.UsageWithContext
+	diskIOCounters  = godisk.IOCountersWithContext
+	netInterfaces   = gonet.InterfacesWithContext
+	netIOCounters   = gonet.IOCountersWithContext
 )
 
 // Snapshot represents a host resource utilisation sample.
@@ -35,6 +36,7 @@ type Snapshot struct {
 	LoadAverage     []float64
 	Memory          agentshost.MemoryMetric
 	Disks           []agentshost.Disk
+	DiskIO          []agentshost.DiskIO
 	Network         []agentshost.NetworkInterface
 }
 
@@ -77,6 +79,7 @@ func Collect(ctx context.Context) (Snapshot, error) {
 	}
 
 	snapshot.Disks = collectDisks(collectCtx)
+	snapshot.DiskIO = collectDiskIO(collectCtx)
 	snapshot.Network = collectNetwork(collectCtx)
 
 	return snapshot, nil
@@ -148,10 +151,12 @@ func collectDisks(ctx context.Context) []agentshost.Disk {
 			continue
 		}
 
-		// Skip read-only filesystems like squashfs (snap mounts), erofs, iso9660, etc.
-		// These are immutable and always report near-full usage, which causes false alerts.
-		// See issues #505 (Home Assistant OS) and #690 (Ubuntu snap mounts).
-		if fsfilters.ShouldIgnoreReadOnlyFilesystem(part.Fstype, usage.Total, usage.Used) {
+		// Skip filesystems that shouldn't be counted toward disk usage:
+		// - Read-only filesystems (squashfs, erofs, iso9660) - always report near-full
+		// - Virtual/pseudo filesystems (tmpfs, devtmpfs, cgroup, etc.)
+		// - Container overlay paths (Docker/Podman layers on ZFS, including TrueNAS .ix-apps)
+		// See issues #505, #690, #718, #790.
+		if shouldSkip, _ := fsfilters.ShouldSkipFilesystem(part.Fstype, part.Mountpoint, usage.Total, usage.Used); shouldSkip {
 			continue
 		}
 
@@ -232,3 +237,78 @@ func isLoopback(flags []string) bool {
 	}
 	return false
 }
+
+// collectDiskIO gathers I/O statistics for physical block devices.
+// Only reports whole disks (nvme0n1, sda), not partitions (nvme0n1p1, sda1).
+func collectDiskIO(ctx context.Context) []agentshost.DiskIO {
+	counters, err := diskIOCounters(ctx)
+	if err != nil {
+		return nil
+	}
+
+	devices := make([]agentshost.DiskIO, 0, len(counters))
+	for name, stats := range counters {
+		// Skip partitions - only report whole devices
+		if isPartition(name) {
+			continue
+		}
+		// Skip loop devices and ram disks
+		if strings.HasPrefix(name, "loop") || strings.HasPrefix(name, "ram") {
+			continue
+		}
+		// Skip device-mapper and md devices (report at physical level)
+		if strings.HasPrefix(name, "dm-") {
+			continue
+		}
+
+		devices = append(devices, agentshost.DiskIO{
+			Device:     name,
+			ReadBytes:  stats.ReadBytes,
+			WriteBytes: stats.WriteBytes,
+			ReadOps:    stats.ReadCount,
+			WriteOps:   stats.WriteCount,
+			ReadTime:   stats.ReadTime,
+			WriteTime:  stats.WriteTime,
+			IOTime:     stats.IoTime,
+		})
+	}
+
+	sort.Slice(devices, func(i, j int) bool { return devices[i].Device < devices[j].Device })
+	return devices
+}
+
+// isPartition returns true if the device name looks like a partition
+// e.g., sda1, nvme0n1p1, vda2
+func isPartition(name string) bool {
+	// NVMe partitions: nvme0n1p1, nvme0n1p2
+	if strings.Contains(name, "n") && strings.Contains(name, "p") {
+		// Check if it ends with pN where N is a digit
+		idx := strings.LastIndex(name, "p")
+		if idx > 0 && idx < len(name)-1 {
+			rest := name[idx+1:]
+			if len(rest) > 0 && rest[0] >= '0' && rest[0] <= '9' {
+				return true
+			}
+		}
+	}
+	// Traditional partitions: sda1, vda2, hda1
+	if len(name) > 2 {
+		last := name[len(name)-1]
+		if last >= '0' && last <= '9' {
+			// Check if second-to-last is a letter (sda1) or also a digit (sda10)
+			secondLast := name[len(name)-2]
+			if (secondLast >= 'a' && secondLast <= 'z') || (secondLast >= '0' && secondLast <= '9') {
+				// Exclude things like "md0" (whole device) - check for common prefixes
+				if strings.HasPrefix(name, "sd") || strings.HasPrefix(name, "vd") ||
+					strings.HasPrefix(name, "hd") || strings.HasPrefix(name, "xvd") {
+					return true
+				}
+			}
+		}
+	}
+	// ZFS devices: zd0p1, zd16p1
+	if strings.HasPrefix(name, "zd") && strings.Contains(name, "p") {
+		return true
+	}
+	return false
+}
diff --git a/internal/hostmetrics/collector_test.go b/internal/hostmetrics/collector_test.go
index e912b75..453c334 100644
--- a/internal/hostmetrics/collector_test.go
+++ b/internal/hostmetrics/collector_test.go
@@ -1,133 +1,25 @@
 package hostmetrics
 
 import (
-	"context"
-	"testing"
-
-	godisk "github.com/shirou/gopsutil/v4/disk"
-	"github.com/stretchr/testify/assert"
+    "context"
+    "encoding/json"
+    "testing"
 )
 
-func TestCollectDisks_ZFS_Deduplication(t *testing.T) {
-	// Save original functions and restore after test
-	origDiskPartitions := diskPartitions
-	origDiskUsage := diskUsage
-	defer func() {
-		diskPartitions = origDiskPartitions
-		diskUsage = origDiskUsage
-	}()
-
-	// Mock partitions
-	diskPartitions = func(ctx context.Context, all bool) ([]godisk.PartitionStat, error) {
-		return []godisk.PartitionStat{
-			{Device: "tank/dataset1", Mountpoint: "/mnt/dataset1", Fstype: "zfs"},
-			{Device: "tank/dataset2", Mountpoint: "/mnt/dataset2", Fstype: "zfs"},
-			{Device: "tank/dataset3", Mountpoint: "/mnt/dataset3", Fstype: "zfs"},
-		}, nil
-	}
-
-	// Mock usage
-	diskUsage = func(ctx context.Context, path string) (*godisk.UsageStat, error) {
-		// All datasets on the same pool share the same free space
-		return &godisk.UsageStat{
-			Total:       1000,
-			Used:        500,
-			Free:        500,
-			UsedPercent: 50.0,
-		}, nil
-	}
-
-	// Mock zpool stats query to fail so we test the fallback logic (which uses the datasets)
-	// We can't easily mock queryZpoolStats because it's in zfs.go and not exported/variable-ized in the same way,
-	// but we can rely on the fact that `exec.LookPath("zpool")` will likely fail or `zpool list` will fail in the test environment.
-	// However, to be sure, we should probably mock it.
-	// But wait, `summarizeZFSPools` calls `queryZpoolStats`.
-	// `queryZpoolStats` is a variable in zfs.go! `var queryZpoolStats = fetchZpoolStats`
-
-	// Let's mock queryZpoolStats too.
-	origQueryZpoolStats := queryZpoolStats
-	defer func() { queryZpoolStats = origQueryZpoolStats }()
-
-	queryZpoolStats = func(ctx context.Context, pools []string) (map[string]zpoolStats, error) {
-		return nil, assert.AnError // Simulate failure
-	}
-
-	ctx := context.Background()
-	disks := collectDisks(ctx)
-
-	// Should return 1 disk (the pool), not 3
-	assert.Len(t, disks, 1)
-	assert.Equal(t, "tank", disks[0].Device)
-	assert.Equal(t, int64(1000), disks[0].TotalBytes)
-}
-
-func TestCollectDisks_ZFS_CaseInsensitive(t *testing.T) {
-	// Save original functions
-	origDiskPartitions := diskPartitions
-	origDiskUsage := diskUsage
-	defer func() {
-		diskPartitions = origDiskPartitions
-		diskUsage = origDiskUsage
-	}()
-
-	// Mock partitions with "ZFS" (uppercase)
-	diskPartitions = func(ctx context.Context, all bool) ([]godisk.PartitionStat, error) {
-		return []godisk.PartitionStat{
-			{Device: "tank/dataset1", Mountpoint: "/mnt/dataset1", Fstype: "ZFS"},
-			{Device: "tank/dataset2", Mountpoint: "/mnt/dataset2", Fstype: "ZFS"},
-		}, nil
-	}
-
-	diskUsage = func(ctx context.Context, path string) (*godisk.UsageStat, error) {
-		return &godisk.UsageStat{Total: 1000, Used: 500, Free: 500}, nil
-	}
-
-	// Mock queryZpoolStats to fail
-	origQueryZpoolStats := queryZpoolStats
-	defer func() { queryZpoolStats = origQueryZpoolStats }()
-	queryZpoolStats = func(ctx context.Context, pools []string) (map[string]zpoolStats, error) {
-		return nil, assert.AnError
-	}
-
-	ctx := context.Background()
-	disks := collectDisks(ctx)
-
-	// If case-sensitive check fails, it will return 2 disks
-	// If we fix it, it should return 1
-	assert.Len(t, disks, 1)
-}
-
-func TestCollectDisks_ZFS_Fuse(t *testing.T) {
-	// Save original functions
-	origDiskPartitions := diskPartitions
-	origDiskUsage := diskUsage
-	defer func() {
-		diskPartitions = origDiskPartitions
-		diskUsage = origDiskUsage
-	}()
-
-	// Mock partitions with "fuse.zfs"
-	diskPartitions = func(ctx context.Context, all bool) ([]godisk.PartitionStat, error) {
-		return []godisk.PartitionStat{
-			{Device: "tank/dataset1", Mountpoint: "/mnt/dataset1", Fstype: "fuse.zfs"},
-			{Device: "tank/dataset2", Mountpoint: "/mnt/dataset2", Fstype: "fuse.zfs"},
-		}, nil
-	}
-
-	diskUsage = func(ctx context.Context, path string) (*godisk.UsageStat, error) {
-		return &godisk.UsageStat{Total: 1000, Used: 500, Free: 500}, nil
-	}
-
-	// Mock queryZpoolStats to fail
-	origQueryZpoolStats := queryZpoolStats
-	defer func() { queryZpoolStats = origQueryZpoolStats }()
-	queryZpoolStats = func(ctx context.Context, pools []string) (map[string]zpoolStats, error) {
-		return nil, assert.AnError
-	}
-
-	ctx := context.Background()
-	disks := collectDisks(ctx)
-
-	// If check fails, it will return 2 disks
-	assert.Len(t, disks, 1)
+func TestCollectDiskIO(t *testing.T) {
+    ctx := context.Background()
+    
+    snapshot, err := Collect(ctx)
+    if err != nil {
+        t.Fatalf("Collect failed: %v", err)
+    }
+    
+    t.Logf("DiskIO count: %d", len(snapshot.DiskIO))
+    
+    if len(snapshot.DiskIO) == 0 {
+        t.Error("Expected disk IO data but got none")
+    }
+    
+    data, _ := json.MarshalIndent(snapshot.DiskIO, "", "  ")
+    t.Logf("DiskIO data:\n%s", string(data))
 }
diff --git a/internal/kubernetesagent/agent.go b/internal/kubernetesagent/agent.go
new file mode 100644
index 0000000..29e0f01
--- /dev/null
+++ b/internal/kubernetesagent/agent.go
@@ -0,0 +1,683 @@
+package kubernetesagent
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/buffer"
+	agentsk8s "github.com/rcourtman/pulse-go-rewrite/pkg/agents/kubernetes"
+	"github.com/rs/zerolog"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+type Config struct {
+	PulseURL           string
+	APIToken           string
+	Interval           time.Duration
+	AgentID            string
+	AgentType          string // "unified" when running as part of pulse-agent
+	AgentVersion       string // Version to report; if empty, uses kubernetesagent.Version
+	InsecureSkipVerify bool
+	LogLevel           zerolog.Level
+	Logger             *zerolog.Logger
+
+	// Kubernetes connection
+	KubeconfigPath string
+	KubeContext    string
+
+	// Report shaping
+	IncludeNamespaces []string
+	ExcludeNamespaces []string
+	IncludeAllPods    bool // Include all non-succeeded pods (still capped)
+	MaxPods           int  // Max pods included in the report
+}
+
+type Agent struct {
+	cfg        Config
+	logger     zerolog.Logger
+	httpClient *http.Client
+
+	kubeClient *kubernetes.Clientset
+	restCfg    *rest.Config
+
+	agentID      string
+	agentVersion string
+	interval     time.Duration
+	pulseURL     string
+
+	clusterID      string
+	clusterName    string
+	clusterServer  string
+	clusterContext string
+	clusterVersion string
+
+	includeNamespaces sets.Set[string]
+	excludeNamespaces sets.Set[string]
+
+	reportBuffer *buffer.Queue[agentsk8s.Report]
+}
+
+const (
+	defaultInterval = 30 * time.Second
+	defaultMaxPods  = 200
+	requestTimeout  = 20 * time.Second
+	reportUserAgent = "pulse-kubernetes-agent/"
+)
+
+func New(cfg Config) (*Agent, error) {
+	if cfg.Interval <= 0 {
+		cfg.Interval = defaultInterval
+	}
+	if cfg.MaxPods <= 0 {
+		cfg.MaxPods = defaultMaxPods
+	}
+
+	if zerolog.GlobalLevel() == zerolog.DebugLevel && cfg.LogLevel != zerolog.DebugLevel {
+		zerolog.SetGlobalLevel(cfg.LogLevel)
+	}
+
+	logger := cfg.Logger
+	if logger == nil {
+		defaultLogger := zerolog.New(os.Stdout).Level(cfg.LogLevel).With().Timestamp().Str("component", "pulse-kubernetes-agent").Logger()
+		logger = &defaultLogger
+	} else {
+		scoped := logger.With().Str("component", "pulse-kubernetes-agent").Logger()
+		logger = &scoped
+	}
+
+	if strings.TrimSpace(cfg.APIToken) == "" {
+		return nil, fmt.Errorf("api token is required")
+	}
+
+	pulseURL := strings.TrimRight(strings.TrimSpace(cfg.PulseURL), "/")
+	if pulseURL == "" {
+		pulseURL = "http://localhost:7655"
+	}
+
+	restCfg, contextName, err := buildRESTConfig(cfg.KubeconfigPath, cfg.KubeContext)
+	if err != nil {
+		return nil, err
+	}
+
+	kubeClient, err := kubernetes.NewForConfig(restCfg)
+	if err != nil {
+		return nil, fmt.Errorf("create kubernetes client: %w", err)
+	}
+
+	agentVersion := strings.TrimSpace(cfg.AgentVersion)
+	if agentVersion == "" {
+		agentVersion = Version
+	}
+
+	tlsConfig := &tls.Config{MinVersion: tls.VersionTLS12}
+	if cfg.InsecureSkipVerify {
+		//nolint:gosec // Insecure mode is explicitly user-controlled.
+		tlsConfig.InsecureSkipVerify = true
+	}
+	httpClient := &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			Proxy:           http.ProxyFromEnvironment,
+			TLSClientConfig: tlsConfig,
+		},
+	}
+
+	clusterServer := strings.TrimSpace(restCfg.Host)
+	clusterContext := strings.TrimSpace(contextName)
+	clusterName := clusterContext
+	clusterID := computeClusterID(clusterServer, clusterContext, clusterName)
+
+	agentID := strings.TrimSpace(cfg.AgentID)
+	if agentID == "" {
+		agentID = clusterID
+	}
+
+	agent := &Agent{
+		cfg:               cfg,
+		logger:            *logger,
+		httpClient:        httpClient,
+		kubeClient:        kubeClient,
+		restCfg:           restCfg,
+		agentID:           agentID,
+		agentVersion:      agentVersion,
+		interval:          cfg.Interval,
+		pulseURL:          pulseURL,
+		clusterID:         clusterID,
+		clusterName:       clusterName,
+		clusterServer:     clusterServer,
+		clusterContext:    clusterContext,
+		includeNamespaces: makeNamespaceSet(cfg.IncludeNamespaces),
+		excludeNamespaces: makeNamespaceSet(cfg.ExcludeNamespaces),
+		reportBuffer:      buffer.New[agentsk8s.Report](60),
+	}
+
+	if err := agent.discoverClusterMetadata(context.Background()); err != nil {
+		agent.logger.Warn().Err(err).Msg("Failed to discover Kubernetes cluster metadata")
+	}
+
+	agent.logger.Info().
+		Str("cluster_id", agent.clusterID).
+		Str("cluster_name", agent.clusterName).
+		Str("server", agent.clusterServer).
+		Str("context", agent.clusterContext).
+		Msg("Kubernetes agent initialized")
+
+	return agent, nil
+}
+
+func buildRESTConfig(kubeconfigPath, kubeContext string) (*rest.Config, string, error) {
+	kubeconfigPath = strings.TrimSpace(kubeconfigPath)
+	kubeContext = strings.TrimSpace(kubeContext)
+
+	// Prefer explicit kubeconfig.
+	if kubeconfigPath != "" {
+		loadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: kubeconfigPath}
+		overrides := &clientcmd.ConfigOverrides{}
+		if kubeContext != "" {
+			overrides.CurrentContext = kubeContext
+		}
+
+		cc := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, overrides)
+		rawCfg, err := cc.RawConfig()
+		if err != nil {
+			return nil, "", fmt.Errorf("load kubeconfig: %w", err)
+		}
+
+		contextName := rawCfg.CurrentContext
+		if kubeContext != "" {
+			contextName = kubeContext
+		}
+
+		restCfg, err := cc.ClientConfig()
+		if err != nil {
+			return nil, "", fmt.Errorf("build kubeconfig rest config: %w", err)
+		}
+		return restCfg, contextName, nil
+	}
+
+	// Otherwise try in-cluster configuration.
+	restCfg, err := rest.InClusterConfig()
+	if err == nil {
+		return restCfg, "in-cluster", nil
+	}
+
+	// Fallback: default kubeconfig path.
+	cc := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+		clientcmd.NewDefaultClientConfigLoadingRules(),
+		&clientcmd.ConfigOverrides{CurrentContext: kubeContext},
+	)
+	rawCfg, rawErr := cc.RawConfig()
+	if rawErr != nil {
+		return nil, "", fmt.Errorf("kubernetes config not available (in-cluster failed: %v; kubeconfig failed: %w)", err, rawErr)
+	}
+
+	contextName := rawCfg.CurrentContext
+	if kubeContext != "" {
+		contextName = kubeContext
+	}
+
+	restCfg, cfgErr := cc.ClientConfig()
+	if cfgErr != nil {
+		return nil, "", fmt.Errorf("build kubeconfig rest config: %w", cfgErr)
+	}
+	return restCfg, contextName, nil
+}
+
+func makeNamespaceSet(values []string) sets.Set[string] {
+	set := sets.New[string]()
+	for _, v := range values {
+		v = strings.TrimSpace(v)
+		if v != "" {
+			set.Insert(v)
+		}
+	}
+	return set
+}
+
+func computeClusterID(server, context, name string) string {
+	payload := strings.TrimSpace(server) + "|" + strings.TrimSpace(context) + "|" + strings.TrimSpace(name)
+	sum := sha256.Sum256([]byte(payload))
+	return hex.EncodeToString(sum[:])
+}
+
+func (a *Agent) discoverClusterMetadata(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, requestTimeout)
+	defer cancel()
+
+	version, err := a.kubeClient.Discovery().ServerVersion()
+	if err != nil {
+		return err
+	}
+	if version != nil {
+		a.clusterVersion = strings.TrimSpace(version.GitVersion)
+	}
+	return nil
+}
+
+func (a *Agent) Run(ctx context.Context) error {
+	ticker := time.NewTicker(a.interval)
+	defer ticker.Stop()
+
+	a.runOnce(ctx)
+
+	for {
+		select {
+		case <-ticker.C:
+			a.runOnce(ctx)
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+func (a *Agent) runOnce(ctx context.Context) {
+	a.flushReports(ctx)
+
+	report, err := a.collectReport(ctx)
+	if err != nil {
+		a.logger.Warn().Err(err).Msg("Failed to collect Kubernetes report")
+		return
+	}
+
+	if err := a.sendReport(ctx, report); err != nil {
+		a.logger.Warn().Err(err).Msg("Failed to send Kubernetes report, buffering")
+		a.reportBuffer.Push(report)
+	}
+}
+
+func (a *Agent) flushReports(ctx context.Context) {
+	for {
+		report, ok := a.reportBuffer.Peek()
+		if !ok {
+			return
+		}
+		if err := a.sendReport(ctx, report); err != nil {
+			return
+		}
+		_, _ = a.reportBuffer.Pop()
+	}
+}
+
+func (a *Agent) namespaceAllowed(ns string) bool {
+	ns = strings.TrimSpace(ns)
+	if ns == "" {
+		return false
+	}
+	if a.excludeNamespaces.Has(ns) {
+		return false
+	}
+	if a.includeNamespaces.Len() == 0 {
+		return true
+	}
+	return a.includeNamespaces.Has(ns)
+}
+
+func (a *Agent) collectReport(ctx context.Context) (agentsk8s.Report, error) {
+	ctx, cancel := context.WithTimeout(ctx, requestTimeout)
+	defer cancel()
+
+	nodes, err := a.collectNodes(ctx)
+	if err != nil {
+		return agentsk8s.Report{}, err
+	}
+
+	pods, err := a.collectPods(ctx)
+	if err != nil {
+		return agentsk8s.Report{}, err
+	}
+
+	deployments, err := a.collectDeployments(ctx)
+	if err != nil {
+		return agentsk8s.Report{}, err
+	}
+
+	return agentsk8s.Report{
+		Agent: agentsk8s.AgentInfo{
+			ID:              a.agentID,
+			Version:         a.agentVersion,
+			Type:            strings.TrimSpace(a.cfg.AgentType),
+			IntervalSeconds: int(a.interval / time.Second),
+		},
+		Cluster: agentsk8s.ClusterInfo{
+			ID:      a.clusterID,
+			Name:    a.clusterName,
+			Server:  a.clusterServer,
+			Context: a.clusterContext,
+			Version: a.clusterVersion,
+		},
+		Nodes:       nodes,
+		Pods:        pods,
+		Deployments: deployments,
+		Timestamp:   time.Now().UTC(),
+	}, nil
+}
+
+func (a *Agent) collectNodes(ctx context.Context) ([]agentsk8s.Node, error) {
+	list, err := a.kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("list nodes: %w", err)
+	}
+
+	nodes := make([]agentsk8s.Node, 0, len(list.Items))
+	for _, node := range list.Items {
+		ready := isNodeReady(node)
+		nodes = append(nodes, agentsk8s.Node{
+			UID:                     string(node.UID),
+			Name:                    node.Name,
+			Ready:                   ready,
+			Unschedulable:           node.Spec.Unschedulable,
+			KubeletVersion:          node.Status.NodeInfo.KubeletVersion,
+			ContainerRuntimeVersion: node.Status.NodeInfo.ContainerRuntimeVersion,
+			OSImage:                 node.Status.NodeInfo.OSImage,
+			KernelVersion:           node.Status.NodeInfo.KernelVersion,
+			Architecture:            node.Status.NodeInfo.Architecture,
+			Capacity:                toNodeResources(node.Status.Capacity),
+			Allocatable:             toNodeResources(node.Status.Allocatable),
+			Roles:                   rolesFromNodeLabels(node.Labels),
+		})
+	}
+
+	sort.Slice(nodes, func(i, j int) bool { return nodes[i].Name < nodes[j].Name })
+	return nodes, nil
+}
+
+func isNodeReady(node corev1.Node) bool {
+	for _, cond := range node.Status.Conditions {
+		if cond.Type == corev1.NodeReady && cond.Status == corev1.ConditionTrue {
+			return true
+		}
+	}
+	return false
+}
+
+func rolesFromNodeLabels(nodeLabels map[string]string) []string {
+	roles := make([]string, 0, 4)
+	for k := range nodeLabels {
+		if strings.HasPrefix(k, "node-role.kubernetes.io/") {
+			role := strings.TrimPrefix(k, "node-role.kubernetes.io/")
+			role = strings.TrimSpace(role)
+			if role == "" {
+				role = "master"
+			}
+			roles = append(roles, role)
+		}
+	}
+	if v := strings.TrimSpace(nodeLabels["kubernetes.io/role"]); v != "" {
+		roles = append(roles, v)
+	}
+	roles = dedupeStrings(roles)
+	sort.Strings(roles)
+	return roles
+}
+
+func dedupeStrings(values []string) []string {
+	out := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, v := range values {
+		v = strings.TrimSpace(v)
+		if v == "" {
+			continue
+		}
+		if _, ok := seen[v]; ok {
+			continue
+		}
+		seen[v] = struct{}{}
+		out = append(out, v)
+	}
+	return out
+}
+
+func toNodeResources(list corev1.ResourceList) agentsk8s.NodeResources {
+	cpu := list[corev1.ResourceCPU]
+	mem := list[corev1.ResourceMemory]
+	pods := list[corev1.ResourcePods]
+
+	return agentsk8s.NodeResources{
+		CPUCores:    cpu.MilliValue() / 1000,
+		MemoryBytes: mem.Value(),
+		Pods:        pods.Value(),
+	}
+}
+
+func (a *Agent) collectPods(ctx context.Context) ([]agentsk8s.Pod, error) {
+	// Default: focus on non-succeeded pods to reduce payload size.
+	selector := fields.OneTermNotEqualSelector("status.phase", string(corev1.PodSucceeded))
+	listOpts := metav1.ListOptions{FieldSelector: selector.String()}
+
+	podList, err := a.kubeClient.CoreV1().Pods(metav1.NamespaceAll).List(ctx, listOpts)
+	if err != nil {
+		return nil, fmt.Errorf("list pods: %w", err)
+	}
+
+	items := make([]agentsk8s.Pod, 0)
+	for _, pod := range podList.Items {
+		if !a.namespaceAllowed(pod.Namespace) {
+			continue
+		}
+		if !a.cfg.IncludeAllPods && !isProblemPod(pod) {
+			continue
+		}
+
+		labelsCopy := make(map[string]string, len(pod.Labels))
+		for k, v := range pod.Labels {
+			labelsCopy[k] = v
+		}
+
+		containers := make([]agentsk8s.PodContainer, 0, len(pod.Status.ContainerStatuses))
+		restarts := 0
+		for _, cs := range pod.Status.ContainerStatuses {
+			restarts += int(cs.RestartCount)
+			state, reason, message := summarizeContainerState(cs)
+			containers = append(containers, agentsk8s.PodContainer{
+				Name:         cs.Name,
+				Image:        cs.Image,
+				Ready:        cs.Ready,
+				RestartCount: cs.RestartCount,
+				State:        state,
+				Reason:       reason,
+				Message:      message,
+			})
+		}
+
+		ownerKind, ownerName := ownerRef(pod.OwnerReferences)
+		createdAt := pod.CreationTimestamp.Time
+		var startTime *time.Time
+		if pod.Status.StartTime != nil {
+			t := pod.Status.StartTime.Time
+			startTime = &t
+		}
+
+		items = append(items, agentsk8s.Pod{
+			UID:        string(pod.UID),
+			Name:       pod.Name,
+			Namespace:  pod.Namespace,
+			NodeName:   pod.Spec.NodeName,
+			Phase:      string(pod.Status.Phase),
+			Reason:     pod.Status.Reason,
+			Message:    pod.Status.Message,
+			QoSClass:   string(pod.Status.QOSClass),
+			CreatedAt:  createdAt,
+			StartTime:  startTime,
+			Restarts:   restarts,
+			Labels:     labelsCopy,
+			OwnerKind:  ownerKind,
+			OwnerName:  ownerName,
+			Containers: containers,
+		})
+	}
+
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].Namespace == items[j].Namespace {
+			return items[i].Name < items[j].Name
+		}
+		return items[i].Namespace < items[j].Namespace
+	})
+
+	if len(items) > a.cfg.MaxPods {
+		items = items[:a.cfg.MaxPods]
+	}
+
+	return items, nil
+}
+
+func isProblemPod(pod corev1.Pod) bool {
+	switch pod.Status.Phase {
+	case corev1.PodPending, corev1.PodFailed, corev1.PodUnknown:
+		return true
+	}
+
+	for _, cs := range pod.Status.InitContainerStatuses {
+		if cs.State.Waiting != nil || cs.State.Terminated != nil {
+			return true
+		}
+		if !cs.Ready && (cs.State.Running == nil) {
+			return true
+		}
+	}
+
+	for _, cs := range pod.Status.ContainerStatuses {
+		if cs.State.Waiting != nil || cs.State.Terminated != nil {
+			return true
+		}
+		if !cs.Ready {
+			return true
+		}
+	}
+
+	return false
+}
+
+func summarizeContainerState(cs corev1.ContainerStatus) (string, string, string) {
+	switch {
+	case cs.State.Running != nil:
+		return "running", "", ""
+	case cs.State.Waiting != nil:
+		return "waiting", strings.TrimSpace(cs.State.Waiting.Reason), strings.TrimSpace(cs.State.Waiting.Message)
+	case cs.State.Terminated != nil:
+		return "terminated", strings.TrimSpace(cs.State.Terminated.Reason), strings.TrimSpace(cs.State.Terminated.Message)
+	default:
+		return "unknown", "", ""
+	}
+}
+
+func ownerRef(refs []metav1.OwnerReference) (string, string) {
+	for _, r := range refs {
+		if r.Controller != nil && *r.Controller {
+			return r.Kind, r.Name
+		}
+	}
+	if len(refs) > 0 {
+		return refs[0].Kind, refs[0].Name
+	}
+	return "", ""
+}
+
+func (a *Agent) collectDeployments(ctx context.Context) ([]agentsk8s.Deployment, error) {
+	depList, err := a.kubeClient.AppsV1().Deployments(metav1.NamespaceAll).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return nil, fmt.Errorf("list deployments: %w", err)
+	}
+
+	items := make([]agentsk8s.Deployment, 0)
+	for _, dep := range depList.Items {
+		if !a.namespaceAllowed(dep.Namespace) {
+			continue
+		}
+		if !isProblemDeployment(dep) {
+			continue
+		}
+
+		labelsCopy := make(map[string]string, len(dep.Labels))
+		for k, v := range dep.Labels {
+			labelsCopy[k] = v
+		}
+
+		items = append(items, agentsk8s.Deployment{
+			UID:               string(dep.UID),
+			Name:              dep.Name,
+			Namespace:         dep.Namespace,
+			DesiredReplicas:   desiredReplicas(dep),
+			UpdatedReplicas:   dep.Status.UpdatedReplicas,
+			ReadyReplicas:     dep.Status.ReadyReplicas,
+			AvailableReplicas: dep.Status.AvailableReplicas,
+			Labels:            labelsCopy,
+		})
+	}
+
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].Namespace == items[j].Namespace {
+			return items[i].Name < items[j].Name
+		}
+		return items[i].Namespace < items[j].Namespace
+	})
+
+	return items, nil
+}
+
+func desiredReplicas(dep appsv1.Deployment) int32 {
+	if dep.Spec.Replicas == nil {
+		return 0
+	}
+	return *dep.Spec.Replicas
+}
+
+func isProblemDeployment(dep appsv1.Deployment) bool {
+	desired := desiredReplicas(dep)
+	if desired <= 0 {
+		return false
+	}
+	return dep.Status.AvailableReplicas < desired || dep.Status.ReadyReplicas < desired || dep.Status.UpdatedReplicas < desired
+}
+
+func (a *Agent) sendReport(ctx context.Context, report agentsk8s.Report) error {
+	payload, err := json.Marshal(report)
+	if err != nil {
+		return fmt.Errorf("marshal report: %w", err)
+	}
+
+	url := fmt.Sprintf("%s/api/agents/kubernetes/report", a.pulseURL)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+a.cfg.APIToken)
+	req.Header.Set("X-API-Token", a.cfg.APIToken)
+	req.Header.Set("User-Agent", reportUserAgent+a.agentVersion)
+
+	resp, err := a.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4*1024))
+		msg := strings.TrimSpace(string(body))
+		if msg != "" {
+			return fmt.Errorf("pulse responded with status %s: %s", resp.Status, msg)
+		}
+		return fmt.Errorf("pulse responded with status %s", resp.Status)
+	}
+
+	return nil
+}
diff --git a/internal/kubernetesagent/version.go b/internal/kubernetesagent/version.go
new file mode 100644
index 0000000..f78fa92
--- /dev/null
+++ b/internal/kubernetesagent/version.go
@@ -0,0 +1,4 @@
+package kubernetesagent
+
+// Version is overridden at build time.
+var Version = "dev"
diff --git a/internal/metrics/store.go b/internal/metrics/store.go
new file mode 100644
index 0000000..d07a2e4
--- /dev/null
+++ b/internal/metrics/store.go
@@ -0,0 +1,575 @@
+// Package metrics provides persistent storage for time-series metrics data
+// using SQLite for durability across restarts.
+package metrics
+
+import (
+	"database/sql"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+	_ "modernc.org/sqlite"
+)
+
+// Tier represents the granularity of stored metrics
+type Tier string
+
+const (
+	TierRaw    Tier = "raw"    // Raw data, ~5s intervals
+	TierMinute Tier = "minute" // 1-minute averages
+	TierHourly Tier = "hourly" // 1-hour averages
+	TierDaily  Tier = "daily"  // 1-day averages
+)
+
+// MetricPoint represents a single metric data point
+type MetricPoint struct {
+	Timestamp time.Time
+	Value     float64
+	Min       float64 // For aggregated data
+	Max       float64 // For aggregated data
+}
+
+// StoreConfig holds configuration for the metrics store
+type StoreConfig struct {
+	DBPath          string
+	WriteBufferSize int           // Number of records to buffer before batch write
+	FlushInterval   time.Duration // Max time between flushes
+	RetentionRaw    time.Duration // How long to keep raw data
+	RetentionMinute time.Duration // How long to keep minute data
+	RetentionHourly time.Duration // How long to keep hourly data
+	RetentionDaily  time.Duration // How long to keep daily data
+}
+
+// DefaultConfig returns sensible defaults for metrics storage
+func DefaultConfig(dataDir string) StoreConfig {
+	return StoreConfig{
+		DBPath:          filepath.Join(dataDir, "metrics.db"),
+		WriteBufferSize: 100,
+		FlushInterval:   5 * time.Second,
+		RetentionRaw:    2 * time.Hour,
+		RetentionMinute: 24 * time.Hour,
+		RetentionHourly: 7 * 24 * time.Hour,
+		RetentionDaily:  90 * 24 * time.Hour,
+	}
+}
+
+// bufferedMetric holds a metric waiting to be written
+type bufferedMetric struct {
+	resourceType string
+	resourceID   string
+	metricType   string
+	value        float64
+	timestamp    time.Time
+}
+
+// Store provides persistent metrics storage
+type Store struct {
+	db     *sql.DB
+	config StoreConfig
+
+	// Write buffer
+	bufferMu sync.Mutex
+	buffer   []bufferedMetric
+
+	// Background workers
+	stopCh   chan struct{}
+	doneCh   chan struct{}
+	stopOnce sync.Once
+}
+
+// NewStore creates a new metrics store with the given configuration
+func NewStore(config StoreConfig) (*Store, error) {
+	// Ensure directory exists
+	dir := filepath.Dir(config.DBPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return nil, fmt.Errorf("failed to create metrics directory: %w", err)
+	}
+
+	// Open database with WAL mode for better concurrent access
+	db, err := sql.Open("sqlite", config.DBPath+"?_journal_mode=WAL&_busy_timeout=5000")
+	if err != nil {
+		return nil, fmt.Errorf("failed to open metrics database: %w", err)
+	}
+
+	// Configure connection pool (SQLite works best with single writer)
+	db.SetMaxOpenConns(1)
+	db.SetMaxIdleConns(1)
+	db.SetConnMaxLifetime(0)
+
+	store := &Store{
+		db:     db,
+		config: config,
+		buffer: make([]bufferedMetric, 0, config.WriteBufferSize),
+		stopCh: make(chan struct{}),
+		doneCh: make(chan struct{}),
+	}
+
+	// Initialize schema
+	if err := store.initSchema(); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("failed to initialize schema: %w", err)
+	}
+
+	// Start background workers
+	go store.backgroundWorker()
+
+	log.Info().
+		Str("path", config.DBPath).
+		Int("bufferSize", config.WriteBufferSize).
+		Msg("Metrics store initialized")
+
+	return store, nil
+}
+
+// initSchema creates the database schema if it doesn't exist
+func (s *Store) initSchema() error {
+	schema := `
+		-- Main metrics table
+		CREATE TABLE IF NOT EXISTS metrics (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			resource_type TEXT NOT NULL,
+			resource_id TEXT NOT NULL,
+			metric_type TEXT NOT NULL,
+			value REAL NOT NULL,
+			min_value REAL,
+			max_value REAL,
+			timestamp INTEGER NOT NULL,
+			tier TEXT NOT NULL DEFAULT 'raw'
+		);
+
+		-- Index for efficient queries by resource and time
+		CREATE INDEX IF NOT EXISTS idx_metrics_lookup 
+		ON metrics(resource_type, resource_id, metric_type, tier, timestamp);
+
+		-- Index for retention pruning
+		CREATE INDEX IF NOT EXISTS idx_metrics_tier_time 
+		ON metrics(tier, timestamp);
+
+		-- Metadata table for tracking rollup state
+		CREATE TABLE IF NOT EXISTS metrics_meta (
+			key TEXT PRIMARY KEY,
+			value TEXT NOT NULL
+		);
+	`
+
+	_, err := s.db.Exec(schema)
+	if err != nil {
+		return fmt.Errorf("failed to create schema: %w", err)
+	}
+
+	log.Debug().Msg("Metrics schema initialized")
+	return nil
+}
+
+// Write adds a metric to the write buffer
+func (s *Store) Write(resourceType, resourceID, metricType string, value float64, timestamp time.Time) {
+	s.bufferMu.Lock()
+	defer s.bufferMu.Unlock()
+
+	s.buffer = append(s.buffer, bufferedMetric{
+		resourceType: resourceType,
+		resourceID:   resourceID,
+		metricType:   metricType,
+		value:        value,
+		timestamp:    timestamp,
+	})
+
+	// Flush if buffer is full
+	if len(s.buffer) >= s.config.WriteBufferSize {
+		s.flushLocked()
+	}
+}
+
+// flush writes buffered metrics to the database (caller must hold bufferMu)
+func (s *Store) flushLocked() {
+	if len(s.buffer) == 0 {
+		return
+	}
+
+	// Copy buffer for writing
+	toWrite := make([]bufferedMetric, len(s.buffer))
+	copy(toWrite, s.buffer)
+	s.buffer = s.buffer[:0]
+
+	// Write in background to not block callers
+	go s.writeBatch(toWrite)
+}
+
+// writeBatch writes a batch of metrics to the database
+func (s *Store) writeBatch(metrics []bufferedMetric) {
+	if len(metrics) == 0 {
+		return
+	}
+
+	tx, err := s.db.Begin()
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to begin metrics transaction")
+		return
+	}
+
+	stmt, err := tx.Prepare(`
+		INSERT INTO metrics (resource_type, resource_id, metric_type, value, timestamp, tier)
+		VALUES (?, ?, ?, ?, ?, 'raw')
+	`)
+	if err != nil {
+		tx.Rollback()
+		log.Error().Err(err).Msg("Failed to prepare metrics insert")
+		return
+	}
+	defer stmt.Close()
+
+	for _, m := range metrics {
+		_, err := stmt.Exec(m.resourceType, m.resourceID, m.metricType, m.value, m.timestamp.Unix())
+		if err != nil {
+			log.Warn().Err(err).
+				Str("resource", m.resourceID).
+				Str("metric", m.metricType).
+				Msg("Failed to insert metric")
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		log.Error().Err(err).Msg("Failed to commit metrics batch")
+		return
+	}
+
+	log.Debug().Int("count", len(metrics)).Msg("Wrote metrics batch")
+}
+
+// Query retrieves metrics for a resource within a time range
+func (s *Store) Query(resourceType, resourceID, metricType string, start, end time.Time) ([]MetricPoint, error) {
+	// Select appropriate tier based on time range
+	tier := s.selectTier(end.Sub(start))
+
+	rows, err := s.db.Query(`
+		SELECT timestamp, value, COALESCE(min_value, value), COALESCE(max_value, value)
+		FROM metrics
+		WHERE resource_type = ? AND resource_id = ? AND metric_type = ? AND tier = ?
+		AND timestamp >= ? AND timestamp <= ?
+		ORDER BY timestamp ASC
+	`, resourceType, resourceID, metricType, string(tier), start.Unix(), end.Unix())
+	if err != nil {
+		return nil, fmt.Errorf("failed to query metrics: %w", err)
+	}
+	defer rows.Close()
+
+	var points []MetricPoint
+	for rows.Next() {
+		var ts int64
+		var p MetricPoint
+		if err := rows.Scan(&ts, &p.Value, &p.Min, &p.Max); err != nil {
+			log.Warn().Err(err).Msg("Failed to scan metric row")
+			continue
+		}
+		p.Timestamp = time.Unix(ts, 0)
+		points = append(points, p)
+	}
+
+	return points, rows.Err()
+}
+
+// QueryAll retrieves all metric types for a resource within a time range
+func (s *Store) QueryAll(resourceType, resourceID string, start, end time.Time) (map[string][]MetricPoint, error) {
+	tier := s.selectTier(end.Sub(start))
+
+	rows, err := s.db.Query(`
+		SELECT metric_type, timestamp, value, COALESCE(min_value, value), COALESCE(max_value, value)
+		FROM metrics
+		WHERE resource_type = ? AND resource_id = ? AND tier = ?
+		AND timestamp >= ? AND timestamp <= ?
+		ORDER BY metric_type, timestamp ASC
+	`, resourceType, resourceID, string(tier), start.Unix(), end.Unix())
+	if err != nil {
+		return nil, fmt.Errorf("failed to query all metrics: %w", err)
+	}
+	defer rows.Close()
+
+	result := make(map[string][]MetricPoint)
+	for rows.Next() {
+		var metricType string
+		var ts int64
+		var p MetricPoint
+		if err := rows.Scan(&metricType, &ts, &p.Value, &p.Min, &p.Max); err != nil {
+			log.Warn().Err(err).Msg("Failed to scan metric row")
+			continue
+		}
+		p.Timestamp = time.Unix(ts, 0)
+		result[metricType] = append(result[metricType], p)
+	}
+
+	return result, rows.Err()
+}
+
+// selectTier chooses the appropriate data tier based on time range
+func (s *Store) selectTier(duration time.Duration) Tier {
+	switch {
+	case duration <= s.config.RetentionRaw:
+		return TierRaw
+	case duration <= s.config.RetentionMinute:
+		return TierMinute
+	case duration <= s.config.RetentionHourly:
+		return TierHourly
+	default:
+		return TierDaily
+	}
+}
+
+// backgroundWorker runs periodic tasks
+func (s *Store) backgroundWorker() {
+	defer close(s.doneCh)
+
+	flushTicker := time.NewTicker(s.config.FlushInterval)
+	rollupTicker := time.NewTicker(5 * time.Minute)
+	retentionTicker := time.NewTicker(1 * time.Hour)
+
+	defer flushTicker.Stop()
+	defer rollupTicker.Stop()
+	defer retentionTicker.Stop()
+
+	for {
+		select {
+		case <-s.stopCh:
+			// Final flush before stopping
+			s.Flush()
+			return
+
+		case <-flushTicker.C:
+			s.Flush()
+
+		case <-rollupTicker.C:
+			s.runRollup()
+
+		case <-retentionTicker.C:
+			s.runRetention()
+		}
+	}
+}
+
+// Flush writes any buffered metrics to the database
+func (s *Store) Flush() {
+	s.bufferMu.Lock()
+	defer s.bufferMu.Unlock()
+	s.flushLocked()
+}
+
+// runRollup aggregates raw data into higher tiers
+func (s *Store) runRollup() {
+	start := time.Now()
+
+	// Rollup raw -> minute (for data older than 5 minutes)
+	s.rollupTier(TierRaw, TierMinute, time.Minute, 5*time.Minute)
+
+	// Rollup minute -> hourly (for data older than 1 hour)
+	s.rollupTier(TierMinute, TierHourly, time.Hour, time.Hour)
+
+	// Rollup hourly -> daily (for data older than 24 hours)
+	s.rollupTier(TierHourly, TierDaily, 24*time.Hour, 24*time.Hour)
+
+	log.Debug().Dur("duration", time.Since(start)).Msg("Metrics rollup completed")
+}
+
+// rollupTier aggregates data from one tier to another
+func (s *Store) rollupTier(fromTier, toTier Tier, bucketSize, minAge time.Duration) {
+	cutoff := time.Now().Add(-minAge).Unix()
+	bucketSecs := int64(bucketSize.Seconds())
+
+	// Find distinct resource/metric combinations that need rollup
+	rows, err := s.db.Query(`
+		SELECT DISTINCT resource_type, resource_id, metric_type
+		FROM metrics
+		WHERE tier = ? AND timestamp < ?
+	`, string(fromTier), cutoff)
+	if err != nil {
+		log.Error().Err(err).Str("tier", string(fromTier)).Msg("Failed to find rollup candidates")
+		return
+	}
+
+	var candidates []struct {
+		resourceType string
+		resourceID   string
+		metricType   string
+	}
+
+	for rows.Next() {
+		var c struct {
+			resourceType string
+			resourceID   string
+			metricType   string
+		}
+		if err := rows.Scan(&c.resourceType, &c.resourceID, &c.metricType); err == nil {
+			candidates = append(candidates, c)
+		}
+	}
+	rows.Close()
+
+	if len(candidates) == 0 {
+		return
+	}
+
+	// Process each candidate
+	for _, c := range candidates {
+		s.rollupCandidate(c.resourceType, c.resourceID, c.metricType, fromTier, toTier, bucketSecs, cutoff)
+	}
+}
+
+// rollupCandidate aggregates a single resource/metric from one tier to another
+func (s *Store) rollupCandidate(resourceType, resourceID, metricType string, fromTier, toTier Tier, bucketSecs, cutoff int64) {
+	tx, err := s.db.Begin()
+	if err != nil {
+		return
+	}
+	defer tx.Rollback()
+
+	// Aggregate data into buckets
+	_, err = tx.Exec(`
+		INSERT INTO metrics (resource_type, resource_id, metric_type, value, min_value, max_value, timestamp, tier)
+		SELECT 
+			resource_type, 
+			resource_id, 
+			metric_type,
+			AVG(value) as value,
+			MIN(value) as min_value,
+			MAX(value) as max_value,
+			(timestamp / ?) * ? as bucket_ts,
+			?
+		FROM metrics
+		WHERE resource_type = ? AND resource_id = ? AND metric_type = ? 
+		AND tier = ? AND timestamp < ?
+		GROUP BY resource_type, resource_id, metric_type, bucket_ts
+	`, bucketSecs, bucketSecs, string(toTier), resourceType, resourceID, metricType, string(fromTier), cutoff)
+
+	if err != nil {
+		log.Warn().Err(err).
+			Str("resource", resourceID).
+			Str("from", string(fromTier)).
+			Str("to", string(toTier)).
+			Msg("Failed to rollup metrics")
+		return
+	}
+
+	// Delete rolled-up raw data
+	_, err = tx.Exec(`
+		DELETE FROM metrics
+		WHERE resource_type = ? AND resource_id = ? AND metric_type = ?
+		AND tier = ? AND timestamp < ?
+	`, resourceType, resourceID, metricType, string(fromTier), cutoff)
+
+	if err != nil {
+		log.Warn().Err(err).Msg("Failed to delete rolled-up metrics")
+		return
+	}
+
+	tx.Commit()
+}
+
+// runRetention deletes data older than retention period
+func (s *Store) runRetention() {
+	start := time.Now()
+	now := time.Now()
+
+	// Delete old data for each tier
+	tiers := []struct {
+		tier      Tier
+		retention time.Duration
+	}{
+		{TierRaw, s.config.RetentionRaw},
+		{TierMinute, s.config.RetentionMinute},
+		{TierHourly, s.config.RetentionHourly},
+		{TierDaily, s.config.RetentionDaily},
+	}
+
+	var totalDeleted int64
+	for _, t := range tiers {
+		cutoff := now.Add(-t.retention).Unix()
+		result, err := s.db.Exec(`DELETE FROM metrics WHERE tier = ? AND timestamp < ?`, string(t.tier), cutoff)
+		if err != nil {
+			log.Warn().Err(err).Str("tier", string(t.tier)).Msg("Failed to prune metrics")
+			continue
+		}
+		if affected, _ := result.RowsAffected(); affected > 0 {
+			totalDeleted += affected
+		}
+	}
+
+	if totalDeleted > 0 {
+		log.Info().
+			Int64("deleted", totalDeleted).
+			Dur("duration", time.Since(start)).
+			Msg("Metrics retention cleanup completed")
+	}
+}
+
+// Close shuts down the store gracefully
+func (s *Store) Close() error {
+	s.stopOnce.Do(func() {
+		close(s.stopCh)
+	})
+
+	// Wait for background worker to finish
+	select {
+	case <-s.doneCh:
+	case <-time.After(5 * time.Second):
+		log.Warn().Msg("Metrics store shutdown timed out")
+	}
+
+	return s.db.Close()
+}
+
+// Stats holds metrics store statistics
+type Stats struct {
+	DBPath        string    `json:"dbPath"`
+	DBSize        int64     `json:"dbSize"`
+	RawCount      int64     `json:"rawCount"`
+	MinuteCount   int64     `json:"minuteCount"`
+	HourlyCount   int64     `json:"hourlyCount"`
+	DailyCount    int64     `json:"dailyCount"`
+	TotalWrites   int64     `json:"totalWrites"`
+	BufferSize    int       `json:"bufferSize"`
+	LastFlush     time.Time `json:"lastFlush"`
+	LastRollup    time.Time `json:"lastRollup"`
+	LastRetention time.Time `json:"lastRetention"`
+}
+
+// GetStats returns storage statistics
+func (s *Store) GetStats() Stats {
+	stats := Stats{
+		DBPath: s.config.DBPath,
+	}
+
+	// Count by tier
+	rows, err := s.db.Query(`SELECT tier, COUNT(*) FROM metrics GROUP BY tier`)
+	if err == nil {
+		defer rows.Close()
+		for rows.Next() {
+			var tier string
+			var count int64
+			if err := rows.Scan(&tier, &count); err == nil {
+				switch tier {
+				case "raw":
+					stats.RawCount = count
+				case "minute":
+					stats.MinuteCount = count
+				case "hourly":
+					stats.HourlyCount = count
+				case "daily":
+					stats.DailyCount = count
+				}
+			}
+		}
+	}
+
+	// Get database size
+	if fi, err := os.Stat(s.config.DBPath); err == nil {
+		stats.DBSize = fi.Size()
+	}
+
+	// Get buffer size
+	s.bufferMu.Lock()
+	stats.BufferSize = len(s.buffer)
+	s.bufferMu.Unlock()
+
+	return stats
+}
diff --git a/internal/mock/generator.go b/internal/mock/generator.go
index 564c154..19524f4 100644
--- a/internal/mock/generator.go
+++ b/internal/mock/generator.go
@@ -35,31 +35,40 @@ func titleCase(s string) string {
 }
 
 type MockConfig struct {
-	NodeCount               int
-	VMsPerNode              int
-	LXCsPerNode             int
-	DockerHostCount         int
-	DockerContainersPerHost int
-	GenericHostCount        int
-	RandomMetrics           bool
-	HighLoadNodes           []string // Specific nodes to simulate high load
-	StoppedPercent          float64  // Percentage of guests that should be stopped
+	NodeCount                int
+	VMsPerNode               int
+	LXCsPerNode              int
+	DockerHostCount          int
+	DockerContainersPerHost  int
+	GenericHostCount         int
+	K8sClusterCount          int
+	K8sNodesPerCluster       int
+	K8sPodsPerCluster        int
+	K8sDeploymentsPerCluster int
+	RandomMetrics            bool
+	HighLoadNodes            []string // Specific nodes to simulate high load
+	StoppedPercent           float64  // Percentage of guests that should be stopped
 }
 
 const (
-	dockerConnectionPrefix = "docker-"
-	hostConnectionPrefix   = "host-"
+	dockerConnectionPrefix     = "docker-"
+	kubernetesConnectionPrefix = "kubernetes-"
+	hostConnectionPrefix       = "host-"
 )
 
 var DefaultConfig = MockConfig{
-	NodeCount:               7, // Test the 5-9 node range by default
-	VMsPerNode:              5,
-	LXCsPerNode:             8,
-	DockerHostCount:         3,
-	DockerContainersPerHost: 12,
-	GenericHostCount:        4,
-	RandomMetrics:           true,
-	StoppedPercent:          0.2,
+	NodeCount:                7, // Test the 5-9 node range by default
+	VMsPerNode:               5,
+	LXCsPerNode:              8,
+	DockerHostCount:          3,
+	DockerContainersPerHost:  12,
+	GenericHostCount:         4,
+	K8sClusterCount:          2,
+	K8sNodesPerCluster:       4,
+	K8sPodsPerCluster:        30,
+	K8sDeploymentsPerCluster: 12,
+	RandomMetrics:            true,
+	StoppedPercent:           0.2,
 }
 
 var appNames = []string{
@@ -163,6 +172,77 @@ var hostAgentVersions = []string{
 	"0.2.0-alpha",
 }
 
+var k8sClusterNames = []string{
+	"production",
+	"staging",
+	"development",
+	"edge",
+	"internal",
+	"platform",
+}
+
+var k8sNamespaces = []string{
+	"default",
+	"kube-system",
+	"monitoring",
+	"logging",
+	"ingress-nginx",
+	"cert-manager",
+	"argocd",
+	"apps",
+	"services",
+	"databases",
+	"cache",
+}
+
+var k8sPodPrefixes = []string{
+	"nginx",
+	"redis",
+	"postgres",
+	"mysql",
+	"mongodb",
+	"prometheus",
+	"grafana",
+	"loki",
+	"jaeger",
+	"api",
+	"auth",
+	"worker",
+	"cron",
+	"coredns",
+	"metrics-server",
+	"cert-manager",
+	"ingress-controller",
+	"fluentd",
+}
+
+var k8sVersions = []string{
+	"v1.31.2",
+	"v1.30.4",
+	"v1.29.8",
+}
+
+var k8sImages = []string{
+	"nginx:1.27",
+	"redis:7.4",
+	"postgres:16",
+	"mysql:8.4",
+	"mongo:7.0",
+	"prom/prometheus:v2.54",
+	"grafana/grafana:11.3",
+	"grafana/loki:3.0",
+	"busybox:1.36",
+	"alpine:3.20",
+}
+
+var k8sNodeOS = []string{
+	"Ubuntu 24.04.1 LTS",
+	"Ubuntu 22.04.5 LTS",
+	"Debian GNU/Linux 12 (bookworm)",
+	"Fedora CoreOS 40",
+	"Talos Linux v1.8",
+}
+
 // Common tags used for VMs and containers
 var commonTags = []string{
 	"production", "staging", "development", "testing",
@@ -252,17 +332,19 @@ func GenerateMockData(config MockConfig) models.StateSnapshot {
 	// rand is automatically seeded in Go 1.20+
 
 	data := models.StateSnapshot{
-		Nodes:            generateNodes(config),
-		DockerHosts:      generateDockerHosts(config),
-		Hosts:            generateHosts(config),
-		VMs:              []models.VM{},
-		Containers:       []models.Container{},
-		PhysicalDisks:    []models.PhysicalDisk{},
-		ReplicationJobs:  []models.ReplicationJob{},
-		LastUpdate:       time.Now(),
-		ConnectionHealth: make(map[string]bool),
-		Stats:            models.Stats{},
-		ActiveAlerts:     []models.Alert{},
+		Nodes:                     generateNodes(config),
+		DockerHosts:               generateDockerHosts(config),
+		KubernetesClusters:        generateKubernetesClusters(config),
+		RemovedKubernetesClusters: []models.RemovedKubernetesCluster{},
+		Hosts:                     generateHosts(config),
+		VMs:                       []models.VM{},
+		Containers:                []models.Container{},
+		PhysicalDisks:             []models.PhysicalDisk{},
+		ReplicationJobs:           []models.ReplicationJob{},
+		LastUpdate:                time.Now(),
+		ConnectionHealth:          make(map[string]bool),
+		Stats:                     models.Stats{},
+		ActiveAlerts:              []models.Alert{},
 	}
 
 	// Generate physical disks for each node
@@ -274,6 +356,10 @@ func GenerateMockData(config MockConfig) models.StateSnapshot {
 		data.ConnectionHealth[dockerConnectionPrefix+host.ID] = host.Status != "offline"
 	}
 
+	for _, cluster := range data.KubernetesClusters {
+		data.ConnectionHealth[kubernetesConnectionPrefix+cluster.ID] = cluster.Status != "offline"
+	}
+
 	for _, host := range data.Hosts {
 		data.ConnectionHealth[hostConnectionPrefix+host.ID] = host.Status != "offline"
 	}
@@ -1053,6 +1139,342 @@ func generateGuestOSMetadata() (string, string) {
 	return choice.Name, choice.Version
 }
 
+func generateKubernetesClusters(config MockConfig) []models.KubernetesCluster {
+	clusterCount := config.K8sClusterCount
+	if clusterCount <= 0 {
+		return []models.KubernetesCluster{}
+	}
+
+	nodeCount := config.K8sNodesPerCluster
+	if nodeCount <= 0 {
+		nodeCount = 4
+	}
+
+	podCount := config.K8sPodsPerCluster
+	if podCount < 0 {
+		podCount = 0
+	}
+
+	deploymentCount := config.K8sDeploymentsPerCluster
+	if deploymentCount < 0 {
+		deploymentCount = 0
+	}
+
+	now := time.Now()
+	clusters := make([]models.KubernetesCluster, 0, clusterCount)
+
+	for i := 0; i < clusterCount; i++ {
+		name := k8sClusterNames[i%len(k8sClusterNames)]
+		clusterID := fmt.Sprintf("k8s-%s-%d", strings.ToLower(name), i+1)
+		server := fmt.Sprintf("https://%s.k8s.local:6443", strings.ToLower(name))
+		context := fmt.Sprintf("%s-context", strings.ToLower(name))
+
+		nodes := generateKubernetesNodes(clusterID, nodeCount)
+		pods := generateKubernetesPods(clusterID, nodes, podCount)
+		deployments := generateKubernetesDeployments(clusterID, deploymentCount)
+
+		lastSeen := now.Add(-time.Duration(rand.Intn(20)) * time.Second)
+		status := "online"
+
+		// Make the last cluster offline occasionally for UI coverage.
+		if clusterCount > 1 && i == clusterCount-1 && rand.Float64() < 0.55 {
+			status = "offline"
+			lastSeen = now.Add(-time.Duration(5+rand.Intn(20)) * time.Minute)
+		} else if clusterHasIssues(nodes, pods, deployments) {
+			status = "degraded"
+		}
+
+		clusters = append(clusters, models.KubernetesCluster{
+			ID:               clusterID,
+			AgentID:          fmt.Sprintf("%s-agent", clusterID),
+			Name:             name,
+			DisplayName:      titleCase(name),
+			Server:           server,
+			Context:          context,
+			Version:          k8sVersions[rand.Intn(len(k8sVersions))],
+			Status:           status,
+			LastSeen:         lastSeen,
+			IntervalSeconds:  30,
+			AgentVersion:     "0.1.0-mock",
+			Nodes:            nodes,
+			Pods:             pods,
+			Deployments:      deployments,
+			Hidden:           false,
+			PendingUninstall: false,
+		})
+	}
+
+	return clusters
+}
+
+func generateKubernetesNodes(clusterID string, count int) []models.KubernetesNode {
+	if count <= 0 {
+		return []models.KubernetesNode{}
+	}
+
+	nodes := make([]models.KubernetesNode, 0, count)
+	architectures := []string{"amd64", "arm64"}
+	runtimes := []string{"containerd://1.7.21", "containerd://1.7.20", "cri-o://1.30.4"}
+
+	for i := 0; i < count; i++ {
+		name := fmt.Sprintf("%s-node-%d", clusterID, i+1)
+		ready := rand.Float64() > 0.08
+		unschedulable := rand.Float64() < 0.08
+
+		roles := []string{"worker"}
+		if i == 0 {
+			roles = []string{"control-plane"}
+		} else if i == 1 && count > 3 {
+			roles = []string{"worker", "gpu"}
+		}
+
+		cpu := int64(2 + rand.Intn(30))
+		memGiB := int64(8 + rand.Intn(248))
+		pods := int64(110 + rand.Intn(50))
+		capacityMemory := memGiB * 1024 * 1024 * 1024
+		allocCPU := cpu - int64(rand.Intn(2))
+		if allocCPU < 1 {
+			allocCPU = 1
+		}
+		allocMem := capacityMemory - int64(rand.Intn(3))*1024*1024*1024
+		if allocMem < 1 {
+			allocMem = capacityMemory
+		}
+
+		nodes = append(nodes, models.KubernetesNode{
+			UID:                     fmt.Sprintf("%s-%s", name, randomHexString(8)),
+			Name:                    name,
+			Ready:                   ready,
+			Unschedulable:           unschedulable,
+			KubeletVersion:          k8sVersions[rand.Intn(len(k8sVersions))],
+			ContainerRuntimeVersion: runtimes[rand.Intn(len(runtimes))],
+			OSImage:                 k8sNodeOS[rand.Intn(len(k8sNodeOS))],
+			KernelVersion:           dockerKernelVersions[rand.Intn(len(dockerKernelVersions))],
+			Architecture:            architectures[rand.Intn(len(architectures))],
+			CapacityCPU:             cpu,
+			CapacityMemoryBytes:     capacityMemory,
+			CapacityPods:            pods,
+			AllocCPU:                allocCPU,
+			AllocMemoryBytes:        allocMem,
+			AllocPods:               pods - int64(rand.Intn(10)),
+			Roles:                   roles,
+		})
+	}
+
+	// Ensure at least one node issue sometimes.
+	if count > 2 && rand.Float64() < 0.35 {
+		idx := 1 + rand.Intn(count-1)
+		nodes[idx].Ready = false
+	}
+
+	return nodes
+}
+
+func generateKubernetesPods(clusterID string, nodes []models.KubernetesNode, count int) []models.KubernetesPod {
+	if count <= 0 {
+		return []models.KubernetesPod{}
+	}
+
+	now := time.Now()
+	pods := make([]models.KubernetesPod, 0, count)
+
+	for i := 0; i < count; i++ {
+		namespace := k8sNamespaces[rand.Intn(len(k8sNamespaces))]
+		prefix := k8sPodPrefixes[rand.Intn(len(k8sPodPrefixes))]
+		name := fmt.Sprintf("%s-%s-%d", prefix, randomHexString(5), i+1)
+		nodeName := ""
+		if len(nodes) > 0 && rand.Float64() > 0.08 {
+			nodeName = nodes[rand.Intn(len(nodes))].Name
+		}
+
+		createdAt := now.Add(-time.Duration(30+rand.Intn(7200)) * time.Second)
+		startTime := createdAt.Add(time.Duration(10+rand.Intn(120)) * time.Second)
+		qos := []string{"Guaranteed", "Burstable", "BestEffort"}[rand.Intn(3)]
+
+		phase := "Running"
+		reason := ""
+		message := ""
+		containerState := "running"
+		containerReason := ""
+		containerMessage := ""
+		containerReady := true
+		restarts := 0
+
+		roll := rand.Float64()
+		switch {
+		case roll < 0.08:
+			phase = "Pending"
+			reason = "Unschedulable"
+			message = "0/3 nodes available"
+			containerState = "waiting"
+			containerReason = "PodInitializing"
+			containerReady = false
+		case roll < 0.14:
+			phase = "Running"
+			containerState = "waiting"
+			containerReason = "CrashLoopBackOff"
+			containerMessage = "Back-off restarting failed container"
+			containerReady = false
+			restarts = 3 + rand.Intn(20)
+		case roll < 0.18:
+			phase = "Failed"
+			reason = "Error"
+			message = "Pod terminated with non-zero exit code"
+			containerState = "terminated"
+			containerReason = "Error"
+			containerReady = false
+			restarts = 1 + rand.Intn(6)
+		case roll < 0.22:
+			phase = "Unknown"
+			reason = "NodeLost"
+			message = "Node status is unknown"
+			containerState = "unknown"
+			containerReady = false
+		}
+
+		containerCount := 1
+		if rand.Float64() < 0.12 {
+			containerCount = 2
+		}
+
+		containers := make([]models.KubernetesPodContainer, 0, containerCount)
+		for c := 0; c < containerCount; c++ {
+			image := k8sImages[rand.Intn(len(k8sImages))]
+			containers = append(containers, models.KubernetesPodContainer{
+				Name:         fmt.Sprintf("%s-%d", prefix, c+1),
+				Image:        image,
+				Ready:        containerReady,
+				RestartCount: int32(restarts),
+				State:        containerState,
+				Reason:       containerReason,
+				Message:      containerMessage,
+			})
+		}
+
+		ownerKind := []string{"Deployment", "StatefulSet", "DaemonSet", "Job"}[rand.Intn(4)]
+		ownerName := fmt.Sprintf("%s-%s", strings.ToLower(prefix), randomHexString(4))
+
+		labels := map[string]string{
+			"app.kubernetes.io/name":       prefix,
+			"app.kubernetes.io/instance":   ownerName,
+			"app.kubernetes.io/managed-by": "mock",
+		}
+
+		pod := models.KubernetesPod{
+			UID:        fmt.Sprintf("%s-%s", name, randomHexString(10)),
+			Name:       name,
+			Namespace:  namespace,
+			NodeName:   nodeName,
+			Phase:      phase,
+			Reason:     reason,
+			Message:    message,
+			QoSClass:   qos,
+			CreatedAt:  createdAt,
+			StartTime:  &startTime,
+			Restarts:   restarts,
+			Labels:     labels,
+			OwnerKind:  ownerKind,
+			OwnerName:  ownerName,
+			Containers: containers,
+		}
+
+		if phase == "Pending" {
+			pod.StartTime = nil
+		}
+
+		pods = append(pods, pod)
+	}
+
+	return pods
+}
+
+func generateKubernetesDeployments(clusterID string, count int) []models.KubernetesDeployment {
+	if count <= 0 {
+		return []models.KubernetesDeployment{}
+	}
+
+	deployments := make([]models.KubernetesDeployment, 0, count)
+	for i := 0; i < count; i++ {
+		namespace := k8sNamespaces[rand.Intn(len(k8sNamespaces))]
+		prefix := k8sPodPrefixes[rand.Intn(len(k8sPodPrefixes))]
+		name := fmt.Sprintf("%s-%s", prefix, randomHexString(4))
+
+		desired := int32(1 + rand.Intn(6))
+		updated := desired
+		ready := desired
+		available := desired
+
+		// Degrade some deployments for UI coverage.
+		if rand.Float64() < 0.20 && desired > 0 {
+			ready = int32(rand.Intn(int(desired)))
+			available = ready
+			updated = int32(rand.Intn(int(desired) + 1))
+		}
+
+		deployments = append(deployments, models.KubernetesDeployment{
+			UID:               fmt.Sprintf("%s-%s", name, randomHexString(10)),
+			Name:              name,
+			Namespace:         namespace,
+			DesiredReplicas:   desired,
+			UpdatedReplicas:   updated,
+			ReadyReplicas:     ready,
+			AvailableReplicas: available,
+			Labels: map[string]string{
+				"app.kubernetes.io/name": prefix,
+				"cluster":                clusterID,
+			},
+		})
+	}
+
+	return deployments
+}
+
+func clusterHasIssues(nodes []models.KubernetesNode, pods []models.KubernetesPod, deployments []models.KubernetesDeployment) bool {
+	for _, node := range nodes {
+		if !node.Ready || node.Unschedulable {
+			return true
+		}
+	}
+
+	for _, pod := range pods {
+		if !kubernetesPodHealthy(pod) {
+			return true
+		}
+	}
+
+	for _, d := range deployments {
+		if !kubernetesDeploymentHealthy(d) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func kubernetesPodHealthy(pod models.KubernetesPod) bool {
+	if strings.ToLower(strings.TrimSpace(pod.Phase)) != "running" {
+		return false
+	}
+	for _, c := range pod.Containers {
+		if !c.Ready {
+			return false
+		}
+		state := strings.ToLower(strings.TrimSpace(c.State))
+		if state != "" && state != "running" {
+			return false
+		}
+	}
+	return true
+}
+
+func kubernetesDeploymentHealthy(d models.KubernetesDeployment) bool {
+	desired := d.DesiredReplicas
+	if desired <= 0 {
+		return true
+	}
+	return d.ReadyReplicas >= desired && d.AvailableReplicas >= desired && d.UpdatedReplicas >= desired
+}
+
 func generateDockerHosts(config MockConfig) []models.DockerHost {
 	hostCount := config.DockerHostCount
 	if hostCount <= 0 {
@@ -3107,6 +3529,7 @@ func generateSnapshots(vms []models.VM, containers []models.Container) []models.
 // UpdateMetrics simulates changing metrics over time
 func UpdateMetrics(data *models.StateSnapshot, config MockConfig) {
 	updateDockerHosts(data, config)
+	updateKubernetesClusters(data, config)
 	updateHosts(data, config)
 
 	if !config.RandomMetrics {
@@ -3316,6 +3739,74 @@ func UpdateMetrics(data *models.StateSnapshot, config MockConfig) {
 	data.LastUpdate = time.Now()
 }
 
+func updateKubernetesClusters(data *models.StateSnapshot, config MockConfig) {
+	if len(data.KubernetesClusters) == 0 {
+		return
+	}
+
+	now := time.Now()
+
+	for i := range data.KubernetesClusters {
+		cluster := &data.KubernetesClusters[i]
+
+		if cluster.Status != "offline" {
+			cluster.LastSeen = now.Add(-time.Duration(rand.Intn(12)) * time.Second)
+		} else if config.RandomMetrics && rand.Float64() < 0.01 {
+			cluster.Status = "online"
+			cluster.LastSeen = now
+		}
+
+		if config.RandomMetrics {
+			// Small chance to flip a node Ready state.
+			if len(cluster.Nodes) > 0 && rand.Float64() < 0.05 {
+				idx := rand.Intn(len(cluster.Nodes))
+				cluster.Nodes[idx].Ready = !cluster.Nodes[idx].Ready
+			}
+
+			// Small chance to flip a pod into/out of CrashLoopBackOff.
+			if len(cluster.Pods) > 0 && rand.Float64() < 0.07 {
+				idx := rand.Intn(len(cluster.Pods))
+				pod := &cluster.Pods[idx]
+				if kubernetesPodHealthy(*pod) {
+					pod.Phase = "Running"
+					pod.Reason = ""
+					pod.Message = ""
+					pod.Restarts += 1 + rand.Intn(3)
+					for j := range pod.Containers {
+						pod.Containers[j].Ready = false
+						pod.Containers[j].State = "waiting"
+						pod.Containers[j].Reason = "CrashLoopBackOff"
+						pod.Containers[j].Message = "Back-off restarting failed container"
+						pod.Containers[j].RestartCount += int32(1 + rand.Intn(3))
+					}
+				} else {
+					pod.Phase = "Running"
+					pod.Reason = ""
+					pod.Message = ""
+					for j := range pod.Containers {
+						pod.Containers[j].Ready = true
+						pod.Containers[j].State = "running"
+						pod.Containers[j].Reason = ""
+						pod.Containers[j].Message = ""
+					}
+				}
+			}
+		}
+
+		if cluster.Status != "offline" {
+			if clusterHasIssues(cluster.Nodes, cluster.Pods, cluster.Deployments) {
+				cluster.Status = "degraded"
+			} else {
+				cluster.Status = "online"
+			}
+		}
+
+		if data.ConnectionHealth != nil {
+			data.ConnectionHealth[kubernetesConnectionPrefix+cluster.ID] = cluster.Status != "offline"
+		}
+	}
+}
+
 func updateDockerHosts(data *models.StateSnapshot, config MockConfig) {
 	if len(data.DockerHosts) == 0 {
 		return
diff --git a/internal/mock/integration.go b/internal/mock/integration.go
index 4232289..22bb9c3 100644
--- a/internal/mock/integration.go
+++ b/internal/mock/integration.go
@@ -91,6 +91,10 @@ func enableMockMode(fromInit bool) {
 		Int("host_agents", config.GenericHostCount).
 		Int("docker_hosts", config.DockerHostCount).
 		Int("docker_containers_per_host", config.DockerContainersPerHost).
+		Int("k8s_clusters", config.K8sClusterCount).
+		Int("k8s_nodes_per_cluster", config.K8sNodesPerCluster).
+		Int("k8s_pods_per_cluster", config.K8sPodsPerCluster).
+		Int("k8s_deployments_per_cluster", config.K8sDeploymentsPerCluster).
 		Bool("random_metrics", config.RandomMetrics).
 		Float64("stopped_percent", config.StoppedPercent).
 		Msg("Mock mode enabled")
@@ -209,6 +213,30 @@ func LoadMockConfig() MockConfig {
 		}
 	}
 
+	if val := os.Getenv("PULSE_MOCK_K8S_CLUSTERS"); val != "" {
+		if n, err := strconv.Atoi(val); err == nil && n >= 0 {
+			config.K8sClusterCount = n
+		}
+	}
+
+	if val := os.Getenv("PULSE_MOCK_K8S_NODES"); val != "" {
+		if n, err := strconv.Atoi(val); err == nil && n >= 0 {
+			config.K8sNodesPerCluster = n
+		}
+	}
+
+	if val := os.Getenv("PULSE_MOCK_K8S_PODS"); val != "" {
+		if n, err := strconv.Atoi(val); err == nil && n >= 0 {
+			config.K8sPodsPerCluster = n
+		}
+	}
+
+	if val := os.Getenv("PULSE_MOCK_K8S_DEPLOYMENTS"); val != "" {
+		if n, err := strconv.Atoi(val); err == nil && n >= 0 {
+			config.K8sDeploymentsPerCluster = n
+		}
+	}
+
 	if val := os.Getenv("PULSE_MOCK_RANDOM_METRICS"); val != "" {
 		config.RandomMetrics = val == "true"
 	}
@@ -239,6 +267,10 @@ func SetMockConfig(cfg MockConfig) {
 		Int("lxcs_per_node", cfg.LXCsPerNode).
 		Int("docker_hosts", cfg.DockerHostCount).
 		Int("docker_containers_per_host", cfg.DockerContainersPerHost).
+		Int("k8s_clusters", cfg.K8sClusterCount).
+		Int("k8s_nodes_per_cluster", cfg.K8sNodesPerCluster).
+		Int("k8s_pods_per_cluster", cfg.K8sPodsPerCluster).
+		Int("k8s_deployments_per_cluster", cfg.K8sDeploymentsPerCluster).
 		Bool("random_metrics", cfg.RandomMetrics).
 		Float64("stopped_percent", cfg.StoppedPercent).
 		Msg("Mock configuration updated")
@@ -301,27 +333,67 @@ func GetMockAlertHistory(limit int) []models.Alert {
 }
 
 func cloneState(state models.StateSnapshot) models.StateSnapshot {
+	kubernetesClusters := make([]models.KubernetesCluster, len(state.KubernetesClusters))
+	for i, cluster := range state.KubernetesClusters {
+		clusterCopy := cluster
+
+		clusterCopy.Nodes = append([]models.KubernetesNode(nil), cluster.Nodes...)
+
+		clusterCopy.Pods = make([]models.KubernetesPod, len(cluster.Pods))
+		for j, pod := range cluster.Pods {
+			podCopy := pod
+
+			if pod.Labels != nil {
+				labelsCopy := make(map[string]string, len(pod.Labels))
+				for k, v := range pod.Labels {
+					labelsCopy[k] = v
+				}
+				podCopy.Labels = labelsCopy
+			}
+
+			podCopy.Containers = append([]models.KubernetesPodContainer(nil), pod.Containers...)
+			clusterCopy.Pods[j] = podCopy
+		}
+
+		clusterCopy.Deployments = make([]models.KubernetesDeployment, len(cluster.Deployments))
+		for j, dep := range cluster.Deployments {
+			depCopy := dep
+			if dep.Labels != nil {
+				labelsCopy := make(map[string]string, len(dep.Labels))
+				for k, v := range dep.Labels {
+					labelsCopy[k] = v
+				}
+				depCopy.Labels = labelsCopy
+			}
+			clusterCopy.Deployments[j] = depCopy
+		}
+
+		kubernetesClusters[i] = clusterCopy
+	}
+
 	copyState := models.StateSnapshot{
-		Nodes:            append([]models.Node(nil), state.Nodes...),
-		VMs:              append([]models.VM(nil), state.VMs...),
-		Containers:       append([]models.Container(nil), state.Containers...),
-		DockerHosts:      append([]models.DockerHost(nil), state.DockerHosts...),
-		Hosts:            append([]models.Host(nil), state.Hosts...),
-		PMGInstances:     append([]models.PMGInstance(nil), state.PMGInstances...),
-		Storage:          append([]models.Storage(nil), state.Storage...),
-		CephClusters:     append([]models.CephCluster(nil), state.CephClusters...),
-		PhysicalDisks:    append([]models.PhysicalDisk(nil), state.PhysicalDisks...),
-		PBSInstances:     append([]models.PBSInstance(nil), state.PBSInstances...),
-		PBSBackups:       append([]models.PBSBackup(nil), state.PBSBackups...),
-		PMGBackups:       append([]models.PMGBackup(nil), state.PMGBackups...),
-		ReplicationJobs:  append([]models.ReplicationJob(nil), state.ReplicationJobs...),
-		Metrics:          append([]models.Metric(nil), state.Metrics...),
-		Performance:      state.Performance,
-		Stats:            state.Stats,
-		ActiveAlerts:     append([]models.Alert(nil), state.ActiveAlerts...),
-		RecentlyResolved: append([]models.ResolvedAlert(nil), state.RecentlyResolved...),
-		LastUpdate:       state.LastUpdate,
-		ConnectionHealth: make(map[string]bool, len(state.ConnectionHealth)),
+		Nodes:                     append([]models.Node(nil), state.Nodes...),
+		VMs:                       append([]models.VM(nil), state.VMs...),
+		Containers:                append([]models.Container(nil), state.Containers...),
+		DockerHosts:               append([]models.DockerHost(nil), state.DockerHosts...),
+		KubernetesClusters:        kubernetesClusters,
+		RemovedKubernetesClusters: append([]models.RemovedKubernetesCluster(nil), state.RemovedKubernetesClusters...),
+		Hosts:                     append([]models.Host(nil), state.Hosts...),
+		PMGInstances:              append([]models.PMGInstance(nil), state.PMGInstances...),
+		Storage:                   append([]models.Storage(nil), state.Storage...),
+		CephClusters:              append([]models.CephCluster(nil), state.CephClusters...),
+		PhysicalDisks:             append([]models.PhysicalDisk(nil), state.PhysicalDisks...),
+		PBSInstances:              append([]models.PBSInstance(nil), state.PBSInstances...),
+		PBSBackups:                append([]models.PBSBackup(nil), state.PBSBackups...),
+		PMGBackups:                append([]models.PMGBackup(nil), state.PMGBackups...),
+		ReplicationJobs:           append([]models.ReplicationJob(nil), state.ReplicationJobs...),
+		Metrics:                   append([]models.Metric(nil), state.Metrics...),
+		Performance:               state.Performance,
+		Stats:                     state.Stats,
+		ActiveAlerts:              append([]models.Alert(nil), state.ActiveAlerts...),
+		RecentlyResolved:          append([]models.ResolvedAlert(nil), state.RecentlyResolved...),
+		LastUpdate:                state.LastUpdate,
+		ConnectionHealth:          make(map[string]bool, len(state.ConnectionHealth)),
 	}
 
 	copyState.PVEBackups = models.PVEBackups{
diff --git a/internal/models/converters.go b/internal/models/converters.go
index b8ac272..13f8cad 100644
--- a/internal/models/converters.go
+++ b/internal/models/converters.go
@@ -157,6 +157,19 @@ func (c Container) ToFrontend() ContainerFrontend {
 		LastSeen:  c.LastSeen.Unix() * 1000,
 	}
 
+	// OCI containers are classified separately from traditional LXC containers in the UI.
+	// Keep the frontend payload stable even if some internal sources only persist Type.
+	isOCI := c.IsOCI || strings.EqualFold(strings.TrimSpace(c.Type), "oci")
+	if isOCI {
+		ct.IsOCI = true
+		ct.Type = "oci"
+	}
+
+	// Preserve template metadata (LXC template or OCI image reference).
+	if c.OSTemplate != "" {
+		ct.OSTemplate = c.OSTemplate
+	}
+
 	// Convert tags array to string
 	if len(c.Tags) > 0 {
 		ct.Tags = strings.Join(c.Tags, ",")
@@ -191,6 +204,10 @@ func (c Container) ToFrontend() ContainerFrontend {
 		copy(ct.NetworkInterfaces, c.NetworkInterfaces)
 	}
 
+	if c.OSName != "" {
+		ct.OSName = c.OSName
+	}
+
 	return ct
 }
 
@@ -294,6 +311,151 @@ func (r RemovedDockerHost) ToFrontend() RemovedDockerHostFrontend {
 	}
 }
 
+// ToFrontend converts a KubernetesCluster to its frontend representation.
+func (c KubernetesCluster) ToFrontend() KubernetesClusterFrontend {
+	cluster := KubernetesClusterFrontend{
+		ID:                c.ID,
+		AgentID:           c.AgentID,
+		Name:              c.Name,
+		DisplayName:       c.DisplayName,
+		CustomDisplayName: c.CustomDisplayName,
+		Server:            c.Server,
+		Context:           c.Context,
+		Version:           c.Version,
+		Status:            c.Status,
+		LastSeen:          c.LastSeen.Unix() * 1000,
+		IntervalSeconds:   c.IntervalSeconds,
+		AgentVersion:      c.AgentVersion,
+		TokenID:           c.TokenID,
+		TokenName:         c.TokenName,
+		TokenHint:         c.TokenHint,
+		Hidden:            c.Hidden,
+		PendingUninstall:  c.PendingUninstall,
+	}
+
+	if c.TokenLastUsedAt != nil {
+		ts := c.TokenLastUsedAt.Unix() * 1000
+		cluster.TokenLastUsedAt = &ts
+	}
+
+	if len(c.Nodes) > 0 {
+		cluster.Nodes = make([]KubernetesNodeFrontend, len(c.Nodes))
+		for i, n := range c.Nodes {
+			cluster.Nodes[i] = KubernetesNodeFrontend{
+				UID:                     n.UID,
+				Name:                    n.Name,
+				Ready:                   n.Ready,
+				Unschedulable:           n.Unschedulable,
+				KubeletVersion:          n.KubeletVersion,
+				ContainerRuntimeVersion: n.ContainerRuntimeVersion,
+				OSImage:                 n.OSImage,
+				KernelVersion:           n.KernelVersion,
+				Architecture:            n.Architecture,
+				CapacityCPU:             n.CapacityCPU,
+				CapacityMemoryBytes:     n.CapacityMemoryBytes,
+				CapacityPods:            n.CapacityPods,
+				AllocCPU:                n.AllocCPU,
+				AllocMemoryBytes:        n.AllocMemoryBytes,
+				AllocPods:               n.AllocPods,
+				Roles:                   append([]string(nil), n.Roles...),
+			}
+		}
+	}
+
+	if len(c.Pods) > 0 {
+		cluster.Pods = make([]KubernetesPodFrontend, len(c.Pods))
+		for i, p := range c.Pods {
+			labels := make(map[string]string, len(p.Labels))
+			for k, v := range p.Labels {
+				labels[k] = v
+			}
+			containers := make([]KubernetesPodContainerFrontend, 0, len(p.Containers))
+			for _, cn := range p.Containers {
+				containers = append(containers, KubernetesPodContainerFrontend{
+					Name:         cn.Name,
+					Image:        cn.Image,
+					Ready:        cn.Ready,
+					RestartCount: cn.RestartCount,
+					State:        cn.State,
+					Reason:       cn.Reason,
+					Message:      cn.Message,
+				})
+			}
+
+			var startTime *int64
+			if p.StartTime != nil {
+				ts := p.StartTime.Unix() * 1000
+				startTime = &ts
+			}
+
+			cluster.Pods[i] = KubernetesPodFrontend{
+				UID:        p.UID,
+				Name:       p.Name,
+				Namespace:  p.Namespace,
+				NodeName:   p.NodeName,
+				Phase:      p.Phase,
+				Reason:     p.Reason,
+				Message:    p.Message,
+				QoSClass:   p.QoSClass,
+				CreatedAt:  timeToUnixMillis(p.CreatedAt),
+				StartTime:  startTime,
+				Restarts:   p.Restarts,
+				Labels:     labels,
+				OwnerKind:  p.OwnerKind,
+				OwnerName:  p.OwnerName,
+				Containers: containers,
+			}
+		}
+	}
+
+	if len(c.Deployments) > 0 {
+		cluster.Deployments = make([]KubernetesDeploymentFrontend, len(c.Deployments))
+		for i, d := range c.Deployments {
+			labels := make(map[string]string, len(d.Labels))
+			for k, v := range d.Labels {
+				labels[k] = v
+			}
+			cluster.Deployments[i] = KubernetesDeploymentFrontend{
+				UID:               d.UID,
+				Name:              d.Name,
+				Namespace:         d.Namespace,
+				DesiredReplicas:   d.DesiredReplicas,
+				UpdatedReplicas:   d.UpdatedReplicas,
+				ReadyReplicas:     d.ReadyReplicas,
+				AvailableReplicas: d.AvailableReplicas,
+				Labels:            labels,
+			}
+		}
+	}
+
+	if cluster.DisplayName == "" && cluster.Name != "" {
+		cluster.DisplayName = cluster.Name
+	}
+
+	if cluster.DisplayName == "" {
+		cluster.DisplayName = cluster.ID
+	}
+
+	return cluster
+}
+
+func timeToUnixMillis(t time.Time) int64 {
+	if t.IsZero() {
+		return 0
+	}
+	return t.Unix() * 1000
+}
+
+// ToFrontend converts a RemovedKubernetesCluster to its frontend representation.
+func (r RemovedKubernetesCluster) ToFrontend() RemovedKubernetesClusterFrontend {
+	return RemovedKubernetesClusterFrontend{
+		ID:          r.ID,
+		Name:        r.Name,
+		DisplayName: r.DisplayName,
+		RemovedAt:   r.RemovedAt.Unix() * 1000,
+	}
+}
+
 // ToFrontend converts a Host to HostFrontend.
 func (h Host) ToFrontend() HostFrontend {
 	host := HostFrontend{
@@ -336,6 +498,10 @@ func (h Host) ToFrontend() HostFrontend {
 		host.Disks = append([]Disk(nil), h.Disks...)
 	}
 
+	if len(h.DiskIO) > 0 {
+		host.DiskIO = append([]DiskIO(nil), h.DiskIO...)
+	}
+
 	if len(h.NetworkInterfaces) > 0 {
 		host.NetworkInterfaces = make([]HostNetworkInterface, len(h.NetworkInterfaces))
 		copy(host.NetworkInterfaces, h.NetworkInterfaces)
@@ -724,3 +890,141 @@ func zeroIfNegative(val int64) int64 {
 	}
 	return val
 }
+
+// ResourceToFrontend converts a resources.Resource to ResourceFrontend.
+// This function is in models package to avoid circular imports.
+// It takes individual fields rather than the whole Resource to avoid importing resources package.
+type ResourceConvertInput struct {
+	ID           string
+	Type         string
+	Name         string
+	DisplayName  string
+	PlatformID   string
+	PlatformType string
+	SourceType   string
+	ParentID     string
+	ClusterID    string
+	Status       string
+	CPU          *ResourceMetricInput
+	Memory       *ResourceMetricInput
+	Disk         *ResourceMetricInput
+	NetworkRX    int64
+	NetworkTX    int64
+	HasNetwork   bool
+	Temperature  *float64
+	Uptime       *int64
+	Tags         []string
+	Labels       map[string]string
+	LastSeenUnix int64
+	Alerts       []ResourceAlertInput
+	Identity     *ResourceIdentityInput
+	PlatformData map[string]any
+}
+
+// ResourceMetricInput represents a metric value for resource conversion.
+type ResourceMetricInput struct {
+	Current float64
+	Total   *int64
+	Used    *int64
+	Free    *int64
+}
+
+type ResourceAlertInput struct {
+	ID            string
+	Type          string
+	Level         string
+	Message       string
+	Value         float64
+	Threshold     float64
+	StartTimeUnix int64
+}
+
+type ResourceIdentityInput struct {
+	Hostname  string
+	MachineID string
+	IPs       []string
+}
+
+// ConvertResourceToFrontend converts input to ResourceFrontend.
+func ConvertResourceToFrontend(input ResourceConvertInput) ResourceFrontend {
+	rf := ResourceFrontend{
+		ID:           input.ID,
+		Type:         input.Type,
+		Name:         input.Name,
+		DisplayName:  input.DisplayName,
+		PlatformID:   input.PlatformID,
+		PlatformType: input.PlatformType,
+		SourceType:   input.SourceType,
+		ParentID:     input.ParentID,
+		ClusterID:    input.ClusterID,
+		Status:       input.Status,
+		Temperature:  input.Temperature,
+		Uptime:       input.Uptime,
+		Tags:         input.Tags,
+		Labels:       input.Labels,
+		LastSeen:     input.LastSeenUnix,
+		PlatformData: input.PlatformData,
+	}
+
+	// Convert metrics
+	if input.CPU != nil {
+		rf.CPU = &ResourceMetricFrontend{
+			Current: input.CPU.Current,
+			Total:   input.CPU.Total,
+			Used:    input.CPU.Used,
+			Free:    input.CPU.Free,
+		}
+	}
+
+	if input.Memory != nil {
+		rf.Memory = &ResourceMetricFrontend{
+			Current: input.Memory.Current,
+			Total:   input.Memory.Total,
+			Used:    input.Memory.Used,
+			Free:    input.Memory.Free,
+		}
+	}
+
+	if input.Disk != nil {
+		rf.Disk = &ResourceMetricFrontend{
+			Current: input.Disk.Current,
+			Total:   input.Disk.Total,
+			Used:    input.Disk.Used,
+			Free:    input.Disk.Free,
+		}
+	}
+
+	if input.HasNetwork {
+		rf.Network = &ResourceNetworkFrontend{
+			RXBytes: input.NetworkRX,
+			TXBytes: input.NetworkTX,
+		}
+	}
+
+	// Convert alerts
+	if len(input.Alerts) > 0 {
+		rf.Alerts = make([]ResourceAlertFrontend, len(input.Alerts))
+		for i, a := range input.Alerts {
+			rf.Alerts[i] = ResourceAlertFrontend{
+				ID:        a.ID,
+				Type:      a.Type,
+				Level:     a.Level,
+				Message:   a.Message,
+				Value:     a.Value,
+				Threshold: a.Threshold,
+				StartTime: a.StartTimeUnix,
+			}
+		}
+	}
+
+	// Convert identity
+	if input.Identity != nil {
+		rf.Identity = &ResourceIdentityFrontend{
+			Hostname:  input.Identity.Hostname,
+			MachineID: input.Identity.MachineID,
+			IPs:       input.Identity.IPs,
+		}
+	}
+
+	return rf
+}
diff --git a/internal/models/converters_test.go b/internal/models/converters_test.go
index 4d01d93..e077137 100644
--- a/internal/models/converters_test.go
+++ b/internal/models/converters_test.go
@@ -267,42 +267,99 @@ func TestVMToFrontend_NegativeNetworkValues(t *testing.T) {
 func TestContainerToFrontend(t *testing.T) {
 	now := time.Now()
 
-	container := Container{
-		ID:          "ct-101",
-		VMID:        101,
-		Name:        "test-ct",
-		Node:        "pve1",
-		Status:      "running",
-		Type:        "lxc",
-		CPU:         0.10,
-		CPUs:        2,
-		Memory:      Memory{Total: 4000000000, Used: 2000000000},
-		Disk:        Disk{Total: 50000000000, Used: 25000000000},
-		NetworkIn:   500000,
-		NetworkOut:  250000,
-		Uptime:      7200,
-		Tags:        []string{"dev", "database"},
-		LastSeen:    now,
-		IPAddresses: []string{"192.168.1.51"},
-	}
+	t.Run("lxc", func(t *testing.T) {
+		container := Container{
+			ID:          "ct-101",
+			VMID:        101,
+			Name:        "test-ct",
+			Node:        "pve1",
+			Status:      "running",
+			Type:        "lxc",
+			CPU:         0.10,
+			CPUs:        2,
+			Memory:      Memory{Total: 4000000000, Used: 2000000000},
+			Disk:        Disk{Total: 50000000000, Used: 25000000000},
+			NetworkIn:   500000,
+			NetworkOut:  250000,
+			Uptime:      7200,
+			Tags:        []string{"dev", "database"},
+			LastSeen:    now,
+			IPAddresses: []string{"192.168.1.51"},
+		}
 
-	frontend := container.ToFrontend()
+		frontend := container.ToFrontend()
 
-	if frontend.ID != container.ID {
-		t.Errorf("ID = %q, want %q", frontend.ID, container.ID)
-	}
-	if frontend.VMID != container.VMID {
-		t.Errorf("VMID = %d, want %d", frontend.VMID, container.VMID)
-	}
-	if frontend.Type != container.Type {
-		t.Errorf("Type = %q, want %q", frontend.Type, container.Type)
-	}
-	if frontend.Tags != "dev,database" {
-		t.Errorf("Tags = %q, want 'dev,database'", frontend.Tags)
-	}
-	if frontend.Memory == nil {
-		t.Error("Memory should not be nil when Total > 0")
-	}
+		if frontend.ID != container.ID {
+			t.Errorf("ID = %q, want %q", frontend.ID, container.ID)
+		}
+		if frontend.VMID != container.VMID {
+			t.Errorf("VMID = %d, want %d", frontend.VMID, container.VMID)
+		}
+		if frontend.Type != container.Type {
+			t.Errorf("Type = %q, want %q", frontend.Type, container.Type)
+		}
+		if frontend.IsOCI {
+			t.Errorf("IsOCI = %v, want false", frontend.IsOCI)
+		}
+		if frontend.Tags != "dev,database" {
+			t.Errorf("Tags = %q, want 'dev,database'", frontend.Tags)
+		}
+		if frontend.Memory == nil {
+			t.Error("Memory should not be nil when Total > 0")
+		}
+	})
+
+	t.Run("oci", func(t *testing.T) {
+		container := Container{
+			ID:         "ct-300",
+			VMID:       300,
+			Name:       "oci-alpine",
+			Node:       "pve1",
+			Status:     "running",
+			Type:       "lxc",
+			IsOCI:      true,
+			OSTemplate: "oci:docker.io/library/alpine:latest",
+			CPU:        0.05,
+			CPUs:       2,
+			Memory:     Memory{Total: 1000000000, Used: 100000000},
+			Disk:       Disk{Total: 10000000000, Used: 1000000000},
+			LastSeen:   now,
+		}
+
+		frontend := container.ToFrontend()
+
+		if frontend.Type != "oci" {
+			t.Errorf("Type = %q, want %q", frontend.Type, "oci")
+		}
+		if !frontend.IsOCI {
+			t.Errorf("IsOCI = %v, want true", frontend.IsOCI)
+		}
+		if frontend.OSTemplate != container.OSTemplate {
+			t.Errorf("OSTemplate = %q, want %q", frontend.OSTemplate, container.OSTemplate)
+		}
+	})
+
+	t.Run("oci-derived-from-type", func(t *testing.T) {
+		container := Container{
+			ID:       "ct-301",
+			VMID:     301,
+			Name:     "oci-from-type",
+			Node:     "pve1",
+			Status:   "running",
+			Type:     "oci",
+			IsOCI:    false,
+			LastSeen: now,
+		}
+
+		frontend := container.ToFrontend()
+
+		if frontend.Type != "oci" {
+			t.Errorf("Type = %q, want %q", frontend.Type, "oci")
+		}
+		if !frontend.IsOCI {
+			t.Errorf("IsOCI = %v, want true", frontend.IsOCI)
+		}
+	})
 }
 
 func TestDockerContainerToFrontend(t *testing.T) {
diff --git a/internal/models/models.go b/internal/models/models.go
index af20f17..cf1294b 100644
--- a/internal/models/models.go
+++ b/internal/models/models.go
@@ -11,30 +11,32 @@ import (
 // State represents the current state of all monitored resources
 type State struct {
 	mu                           sync.RWMutex
-	Nodes                        []Node              `json:"nodes"`
-	VMs                          []VM                `json:"vms"`
-	Containers                   []Container         `json:"containers"`
-	DockerHosts                  []DockerHost        `json:"dockerHosts"`
-	RemovedDockerHosts           []RemovedDockerHost `json:"removedDockerHosts"`
-	Hosts                        []Host              `json:"hosts"`
-	Storage                      []Storage           `json:"storage"`
-	CephClusters                 []CephCluster       `json:"cephClusters"`
-	PhysicalDisks                []PhysicalDisk      `json:"physicalDisks"`
-	PBSInstances                 []PBSInstance       `json:"pbs"`
-	PMGInstances                 []PMGInstance       `json:"pmg"`
-	PBSBackups                   []PBSBackup         `json:"pbsBackups"`
-	PMGBackups                   []PMGBackup         `json:"pmgBackups"`
-	Backups                      Backups             `json:"backups"`
-	ReplicationJobs              []ReplicationJob    `json:"replicationJobs"`
-	Metrics                      []Metric            `json:"metrics"`
-	PVEBackups                   PVEBackups          `json:"pveBackups"`
-	Performance                  Performance         `json:"performance"`
-	ConnectionHealth             map[string]bool     `json:"connectionHealth"`
-	Stats                        Stats               `json:"stats"`
-	ActiveAlerts                 []Alert             `json:"activeAlerts"`
-	RecentlyResolved             []ResolvedAlert     `json:"recentlyResolved"`
-	LastUpdate                   time.Time           `json:"lastUpdate"`
-	TemperatureMonitoringEnabled bool                `json:"temperatureMonitoringEnabled"`
+	Nodes                        []Node                     `json:"nodes"`
+	VMs                          []VM                       `json:"vms"`
+	Containers                   []Container                `json:"containers"`
+	DockerHosts                  []DockerHost               `json:"dockerHosts"`
+	RemovedDockerHosts           []RemovedDockerHost        `json:"removedDockerHosts"`
+	KubernetesClusters           []KubernetesCluster        `json:"kubernetesClusters"`
+	RemovedKubernetesClusters    []RemovedKubernetesCluster `json:"removedKubernetesClusters"`
+	Hosts                        []Host                     `json:"hosts"`
+	Storage                      []Storage                  `json:"storage"`
+	CephClusters                 []CephCluster              `json:"cephClusters"`
+	PhysicalDisks                []PhysicalDisk             `json:"physicalDisks"`
+	PBSInstances                 []PBSInstance              `json:"pbs"`
+	PMGInstances                 []PMGInstance              `json:"pmg"`
+	PBSBackups                   []PBSBackup                `json:"pbsBackups"`
+	PMGBackups                   []PMGBackup                `json:"pmgBackups"`
+	Backups                      Backups                    `json:"backups"`
+	ReplicationJobs              []ReplicationJob           `json:"replicationJobs"`
+	Metrics                      []Metric                   `json:"metrics"`
+	PVEBackups                   PVEBackups                 `json:"pveBackups"`
+	Performance                  Performance                `json:"performance"`
+	ConnectionHealth             map[string]bool            `json:"connectionHealth"`
+	Stats                        Stats                      `json:"stats"`
+	ActiveAlerts                 []Alert                    `json:"activeAlerts"`
+	RecentlyResolved             []ResolvedAlert            `json:"recentlyResolved"`
+	LastUpdate                   time.Time                  `json:"lastUpdate"`
+	TemperatureMonitoringEnabled bool                       `json:"temperatureMonitoringEnabled"`
 }
 
 // Alert represents an active alert (simplified for State)
@@ -145,6 +147,10 @@ type Container struct {
 	LastSeen          time.Time               `json:"lastSeen"`
 	IPAddresses       []string                `json:"ipAddresses,omitempty"`
 	NetworkInterfaces []GuestNetworkInterface `json:"networkInterfaces,omitempty"`
+	OSName            string                  `json:"osName,omitempty"`
+	// OCI container support (Proxmox VE 9.1+)
+	IsOCI      bool   `json:"isOci,omitempty"`      // True if this is an OCI container
+	OSTemplate string `json:"osTemplate,omitempty"` // Template or OCI image used (e.g., "docker:alpine:latest")
 }
 
 // Host represents a generic infrastructure host reporting via external agents.
@@ -162,9 +168,11 @@ type Host struct {
 	Memory            Memory                 `json:"memory"`
 	LoadAverage       []float64              `json:"loadAverage,omitempty"`
 	Disks             []Disk                 `json:"disks,omitempty"`
+	DiskIO            []DiskIO               `json:"diskIO,omitempty"`
 	NetworkInterfaces []HostNetworkInterface `json:"networkInterfaces,omitempty"`
 	Sensors           HostSensorSummary      `json:"sensors,omitempty"`
 	RAID              []HostRAIDArray        `json:"raid,omitempty"`
+	Ceph              *HostCephCluster       `json:"ceph,omitempty"`
 	Status            string                 `json:"status"`
 	UptimeSeconds     int64                  `json:"uptimeSeconds,omitempty"`
 	IntervalSeconds   int                    `json:"intervalSeconds,omitempty"`
@@ -219,6 +227,120 @@ type HostRAIDDevice struct {
 	Slot   int    `json:"slot"`
 }
 
+// HostCephCluster represents Ceph cluster status collected directly by the host agent.
+// This is separate from CephCluster which comes from the Proxmox API.
+type HostCephCluster struct {
+	FSID        string             `json:"fsid"`
+	Health      HostCephHealth     `json:"health"`
+	MonMap      HostCephMonitorMap `json:"monMap,omitempty"`
+	MgrMap      HostCephManagerMap `json:"mgrMap,omitempty"`
+	OSDMap      HostCephOSDMap     `json:"osdMap"`
+	PGMap       HostCephPGMap      `json:"pgMap"`
+	Pools       []HostCephPool     `json:"pools,omitempty"`
+	Services    []HostCephService  `json:"services,omitempty"`
+	CollectedAt time.Time          `json:"collectedAt"`
+}
+
+// HostCephHealth represents Ceph cluster health status.
+type HostCephHealth struct {
+	Status  string                   `json:"status"` // HEALTH_OK, HEALTH_WARN, HEALTH_ERR
+	Checks  map[string]HostCephCheck `json:"checks,omitempty"`
+	Summary []HostCephHealthSummary  `json:"summary,omitempty"`
+}
+
+// HostCephCheck represents a health check detail.
+type HostCephCheck struct {
+	Severity string   `json:"severity"`
+	Message  string   `json:"message,omitempty"`
+	Detail   []string `json:"detail,omitempty"`
+}
+
+// HostCephHealthSummary represents a health summary message.
+type HostCephHealthSummary struct {
+	Severity string `json:"severity"`
+	Message  string `json:"message"`
+}
+
+// HostCephMonitorMap represents Ceph monitor information.
+type HostCephMonitorMap struct {
+	Epoch    int               `json:"epoch"`
+	NumMons  int               `json:"numMons"`
+	Monitors []HostCephMonitor `json:"monitors,omitempty"`
+}
+
+// HostCephMonitor represents a single Ceph monitor.
+type HostCephMonitor struct {
+	Name   string `json:"name"`
+	Rank   int    `json:"rank"`
+	Addr   string `json:"addr,omitempty"`
+	Status string `json:"status,omitempty"`
+}
+
+// HostCephManagerMap represents Ceph manager information.
+type HostCephManagerMap struct {
+	Available bool   `json:"available"`
+	NumMgrs   int    `json:"numMgrs"`
+	ActiveMgr string `json:"activeMgr,omitempty"`
+	Standbys  int    `json:"standbys"`
+}
+
+// HostCephOSDMap represents OSD status summary.
+type HostCephOSDMap struct {
+	Epoch   int `json:"epoch"`
+	NumOSDs int `json:"numOsds"`
+	NumUp   int `json:"numUp"`
+	NumIn   int `json:"numIn"`
+	NumDown int `json:"numDown,omitempty"`
+	NumOut  int `json:"numOut,omitempty"`
+}
+
+// HostCephPGMap represents placement group statistics.
+type HostCephPGMap struct {
+	NumPGs           int     `json:"numPgs"`
+	BytesTotal       uint64  `json:"bytesTotal"`
+	BytesUsed        uint64  `json:"bytesUsed"`
+	BytesAvailable   uint64  `json:"bytesAvailable"`
+	DataBytes        uint64  `json:"dataBytes,omitempty"`
+	UsagePercent     float64 `json:"usagePercent"`
+	DegradedRatio    float64 `json:"degradedRatio,omitempty"`
+	MisplacedRatio   float64 `json:"misplacedRatio,omitempty"`
+	ReadBytesPerSec  uint64  `json:"readBytesPerSec,omitempty"`
+	WriteBytesPerSec uint64  `json:"writeBytesPerSec,omitempty"`
+	ReadOpsPerSec    uint64  `json:"readOpsPerSec,omitempty"`
+	WriteOpsPerSec   uint64  `json:"writeOpsPerSec,omitempty"`
+}
+
+// HostCephPool represents a Ceph pool.
+type HostCephPool struct {
+	ID             int     `json:"id"`
+	Name           string  `json:"name"`
+	BytesUsed      uint64  `json:"bytesUsed"`
+	BytesAvailable uint64  `json:"bytesAvailable"`
+	Objects        uint64  `json:"objects"`
+	PercentUsed    float64 `json:"percentUsed"`
+}
+
+// HostCephService represents a Ceph service summary.
+type HostCephService struct {
+	Type    string   `json:"type"` // mon, mgr, osd, mds, rgw
+	Running int      `json:"running"`
+	Total   int      `json:"total"`
+	Daemons []string `json:"daemons,omitempty"`
+}
+
+// DiskIO represents I/O statistics for a block device.
+// Counters are cumulative since boot.
+type DiskIO struct {
+	Device     string `json:"device"`
+	ReadBytes  uint64 `json:"readBytes,omitempty"`
+	WriteBytes uint64 `json:"writeBytes,omitempty"`
+	ReadOps    uint64 `json:"readOps,omitempty"`
+	WriteOps   uint64 `json:"writeOps,omitempty"`
+	ReadTime   uint64 `json:"readTimeMs,omitempty"`
+	WriteTime  uint64 `json:"writeTimeMs,omitempty"`
+	IOTime     uint64 `json:"ioTimeMs,omitempty"`
+}
+
 // DockerHost represents a Docker host reporting metrics via the external agent.
 type DockerHost struct {
 	ID                string                   `json:"id"`
@@ -344,6 +466,101 @@ type DockerContainerMount struct {
 	Driver      string `json:"driver,omitempty"`
 }
 
+// KubernetesCluster represents a Kubernetes cluster reporting telemetry via the agent.
+type KubernetesCluster struct {
+	ID                string    `json:"id"`
+	AgentID           string    `json:"agentId"`
+	Name              string    `json:"name,omitempty"`
+	DisplayName       string    `json:"displayName,omitempty"`
+	CustomDisplayName string    `json:"customDisplayName,omitempty"`
+	Server            string    `json:"server,omitempty"`
+	Context           string    `json:"context,omitempty"`
+	Version           string    `json:"version,omitempty"`
+	Status            string    `json:"status"`
+	LastSeen          time.Time `json:"lastSeen"`
+	IntervalSeconds   int       `json:"intervalSeconds"`
+	AgentVersion      string    `json:"agentVersion,omitempty"`
+
+	Nodes       []KubernetesNode       `json:"nodes,omitempty"`
+	Pods        []KubernetesPod        `json:"pods,omitempty"`
+	Deployments []KubernetesDeployment `json:"deployments,omitempty"`
+
+	// Token information
+	TokenID         string     `json:"tokenId,omitempty"`
+	TokenName       string     `json:"tokenName,omitempty"`
+	TokenHint       string     `json:"tokenHint,omitempty"`
+	TokenLastUsedAt *time.Time `json:"tokenLastUsedAt,omitempty"`
+
+	Hidden           bool `json:"hidden"`
+	PendingUninstall bool `json:"pendingUninstall"`
+}
+
+// RemovedKubernetesCluster tracks a Kubernetes cluster that was deliberately removed and blocked from reporting.
+type RemovedKubernetesCluster struct {
+	ID          string    `json:"id"`
+	Name        string    `json:"name,omitempty"`
+	DisplayName string    `json:"displayName,omitempty"`
+	RemovedAt   time.Time `json:"removedAt"`
+}
+
+type KubernetesNode struct {
+	UID                     string   `json:"uid"`
+	Name                    string   `json:"name"`
+	Ready                   bool     `json:"ready"`
+	Unschedulable           bool     `json:"unschedulable,omitempty"`
+	KubeletVersion          string   `json:"kubeletVersion,omitempty"`
+	ContainerRuntimeVersion string   `json:"containerRuntimeVersion,omitempty"`
+	OSImage                 string   `json:"osImage,omitempty"`
+	KernelVersion           string   `json:"kernelVersion,omitempty"`
+	Architecture            string   `json:"architecture,omitempty"`
+	CapacityCPU             int64    `json:"capacityCpuCores,omitempty"`
+	CapacityMemoryBytes     int64    `json:"capacityMemoryBytes,omitempty"`
+	CapacityPods            int64    `json:"capacityPods,omitempty"`
+	AllocCPU                int64    `json:"allocatableCpuCores,omitempty"`
+	AllocMemoryBytes        int64    `json:"allocatableMemoryBytes,omitempty"`
+	AllocPods               int64    `json:"allocatablePods,omitempty"`
+	Roles                   []string `json:"roles,omitempty"`
+}
+
+type KubernetesPod struct {
+	UID        string                   `json:"uid"`
+	Name       string                   `json:"name"`
+	Namespace  string                   `json:"namespace"`
+	NodeName   string                   `json:"nodeName,omitempty"`
+	Phase      string                   `json:"phase,omitempty"`
+	Reason     string                   `json:"reason,omitempty"`
+	Message    string                   `json:"message,omitempty"`
+	QoSClass   string                   `json:"qosClass,omitempty"`
+	CreatedAt  time.Time                `json:"createdAt,omitempty"`
+	StartTime  *time.Time               `json:"startTime,omitempty"`
+	Restarts   int                      `json:"restarts,omitempty"`
+	Labels     map[string]string        `json:"labels,omitempty"`
+	OwnerKind  string                   `json:"ownerKind,omitempty"`
+	OwnerName  string                   `json:"ownerName,omitempty"`
+	Containers []KubernetesPodContainer `json:"containers,omitempty"`
+}
+
+type KubernetesPodContainer struct {
+	Name         string `json:"name"`
+	Image        string `json:"image,omitempty"`
+	Ready        bool   `json:"ready"`
+	RestartCount int32  `json:"restartCount,omitempty"`
+	State        string `json:"state,omitempty"`
+	Reason       string `json:"reason,omitempty"`
+	Message      string `json:"message,omitempty"`
+}
+
+type KubernetesDeployment struct {
+	UID               string            `json:"uid"`
+	Name              string            `json:"name"`
+	Namespace         string            `json:"namespace"`
+	DesiredReplicas   int32             `json:"desiredReplicas,omitempty"`
+	UpdatedReplicas   int32             `json:"updatedReplicas,omitempty"`
+	ReadyReplicas     int32             `json:"readyReplicas,omitempty"`
+	AvailableReplicas int32             `json:"availableReplicas,omitempty"`
+	Labels            map[string]string `json:"labels,omitempty"`
+}
+
 // DockerService summarises a Docker Swarm service.
 type DockerService struct {
 	ID             string               `json:"id"`
@@ -1457,6 +1674,185 @@ func (s *State) GetRemovedDockerHosts() []RemovedDockerHost {
 	return entries
 }
 
+// UpsertKubernetesCluster inserts or updates a Kubernetes cluster in state.
+func (s *State) UpsertKubernetesCluster(cluster KubernetesCluster) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	updated := false
+	for i, existing := range s.KubernetesClusters {
+		if existing.ID == cluster.ID {
+			if existing.CustomDisplayName != "" {
+				cluster.CustomDisplayName = existing.CustomDisplayName
+			}
+			cluster.Hidden = existing.Hidden
+			cluster.PendingUninstall = existing.PendingUninstall
+			s.KubernetesClusters[i] = cluster
+			updated = true
+			break
+		}
+	}
+
+	if !updated {
+		s.KubernetesClusters = append(s.KubernetesClusters, cluster)
+	}
+
+	sort.Slice(s.KubernetesClusters, func(i, j int) bool {
+		left := s.KubernetesClusters[i].Name
+		right := s.KubernetesClusters[j].Name
+		if left == "" {
+			left = s.KubernetesClusters[i].ID
+		}
+		if right == "" {
+			right = s.KubernetesClusters[j].ID
+		}
+		return left < right
+	})
+
+	s.LastUpdate = time.Now()
+}
+
+// RemoveKubernetesCluster removes a Kubernetes cluster by ID and returns the removed cluster.
+func (s *State) RemoveKubernetesCluster(clusterID string) (KubernetesCluster, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, cluster := range s.KubernetesClusters {
+		if cluster.ID == clusterID {
+			s.KubernetesClusters = append(s.KubernetesClusters[:i], s.KubernetesClusters[i+1:]...)
+			s.LastUpdate = time.Now()
+			return cluster, true
+		}
+	}
+
+	return KubernetesCluster{}, false
+}
+
+// SetKubernetesClusterStatus updates the status of a kubernetes cluster if present.
+func (s *State) SetKubernetesClusterStatus(clusterID, status string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	changed := false
+	for i, cluster := range s.KubernetesClusters {
+		if cluster.ID == clusterID {
+			if cluster.Status != status {
+				cluster.Status = status
+				s.KubernetesClusters[i] = cluster
+				s.LastUpdate = time.Now()
+			}
+			changed = true
+			break
+		}
+	}
+	return changed
+}
+
+// SetKubernetesClusterHidden updates the hidden status of a kubernetes cluster and returns the updated cluster.
+func (s *State) SetKubernetesClusterHidden(clusterID string, hidden bool) (KubernetesCluster, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, cluster := range s.KubernetesClusters {
+		if cluster.ID == clusterID {
+			cluster.Hidden = hidden
+			s.KubernetesClusters[i] = cluster
+			s.LastUpdate = time.Now()
+			return cluster, true
+		}
+	}
+	return KubernetesCluster{}, false
+}
+
+// SetKubernetesClusterPendingUninstall updates the pending uninstall flag and returns the updated cluster.
+func (s *State) SetKubernetesClusterPendingUninstall(clusterID string, pending bool) (KubernetesCluster, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, cluster := range s.KubernetesClusters {
+		if cluster.ID == clusterID {
+			cluster.PendingUninstall = pending
+			s.KubernetesClusters[i] = cluster
+			s.LastUpdate = time.Now()
+			return cluster, true
+		}
+	}
+	return KubernetesCluster{}, false
+}
+
+// SetKubernetesClusterCustomDisplayName updates the custom display name for a kubernetes cluster.
+func (s *State) SetKubernetesClusterCustomDisplayName(clusterID string, customName string) (KubernetesCluster, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, cluster := range s.KubernetesClusters {
+		if cluster.ID == clusterID {
+			cluster.CustomDisplayName = customName
+			s.KubernetesClusters[i] = cluster
+			s.LastUpdate = time.Now()
+			return cluster, true
+		}
+	}
+
+	return KubernetesCluster{}, false
+}
+
+// GetKubernetesClusters returns a copy of kubernetes clusters.
+func (s *State) GetKubernetesClusters() []KubernetesCluster {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	clusters := make([]KubernetesCluster, len(s.KubernetesClusters))
+	copy(clusters, s.KubernetesClusters)
+	return clusters
+}
+
+// AddRemovedKubernetesCluster records a removed kubernetes cluster entry.
+func (s *State) AddRemovedKubernetesCluster(entry RemovedKubernetesCluster) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	replaced := false
+	for i, existing := range s.RemovedKubernetesClusters {
+		if existing.ID == entry.ID {
+			s.RemovedKubernetesClusters[i] = entry
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		s.RemovedKubernetesClusters = append(s.RemovedKubernetesClusters, entry)
+	}
+	sort.Slice(s.RemovedKubernetesClusters, func(i, j int) bool {
+		return s.RemovedKubernetesClusters[i].RemovedAt.After(s.RemovedKubernetesClusters[j].RemovedAt)
+	})
+	s.LastUpdate = time.Now()
+}
+
+// RemoveRemovedKubernetesCluster deletes a removed kubernetes cluster entry by ID.
+func (s *State) RemoveRemovedKubernetesCluster(clusterID string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, entry := range s.RemovedKubernetesClusters {
+		if entry.ID == clusterID {
+			s.RemovedKubernetesClusters = append(s.RemovedKubernetesClusters[:i], s.RemovedKubernetesClusters[i+1:]...)
+			s.LastUpdate = time.Now()
+			break
+		}
+	}
+}
+
+// GetRemovedKubernetesClusters returns a copy of removed kubernetes cluster entries.
+func (s *State) GetRemovedKubernetesClusters() []RemovedKubernetesCluster {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	entries := make([]RemovedKubernetesCluster, len(s.RemovedKubernetesClusters))
+	copy(entries, s.RemovedKubernetesClusters)
+	return entries
+}
+
 // UpsertHost inserts or updates a generic host in state.
 func (s *State) UpsertHost(host Host) {
 	s.mu.Lock()
@@ -1508,6 +1904,32 @@ func (s *State) RemoveHost(hostID string) (Host, bool) {
 	return Host{}, false
 }
 
+// UpsertCephCluster inserts or updates a Ceph cluster in the state.
+// Uses ID (typically the FSID) for matching.
+func (s *State) UpsertCephCluster(cluster CephCluster) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	updated := false
+	for i, existing := range s.CephClusters {
+		if existing.ID == cluster.ID {
+			s.CephClusters[i] = cluster
+			updated = true
+			break
+		}
+	}
+
+	if !updated {
+		s.CephClusters = append(s.CephClusters, cluster)
+	}
+
+	sort.Slice(s.CephClusters, func(i, j int) bool {
+		return s.CephClusters[i].Name < s.CephClusters[j].Name
+	})
+
+	s.LastUpdate = time.Now()
+}
+
 // SetHostStatus updates the status of a host if present.
 func (s *State) SetHostStatus(hostID, status string) bool {
 	s.mu.Lock()
diff --git a/internal/models/models_frontend.go b/internal/models/models_frontend.go
index cfbe29d..9ecb18c 100644
--- a/internal/models/models_frontend.go
+++ b/internal/models/models_frontend.go
@@ -68,13 +68,16 @@ type VMFrontend struct {
 
 // ContainerFrontend represents a Container with frontend-friendly field names
 type ContainerFrontend struct {
-	ID                string                  `json:"id"`
-	VMID              int                     `json:"vmid"`
-	Name              string                  `json:"name"`
-	Node              string                  `json:"node"`
-	Instance          string                  `json:"instance"`
-	Status            string                  `json:"status"`
-	Type              string                  `json:"type"`
+	ID       string `json:"id"`
+	VMID     int    `json:"vmid"`
+	Name     string `json:"name"`
+	Node     string `json:"node"`
+	Instance string `json:"instance"`
+	Status   string `json:"status"`
+	Type     string `json:"type"`
+	// OCI container support (Proxmox VE 9.1+)
+	IsOCI             bool                    `json:"isOci,omitempty"`      // True if this is an OCI container
+	OSTemplate        string                  `json:"osTemplate,omitempty"` // Template or OCI image used (e.g., "oci:docker.io/library/alpine:latest")
 	CPU               float64                 `json:"cpu"`
 	CPUs              int                     `json:"cpus"`
 	Memory            *Memory                 `json:"memory,omitempty"` // Full memory object
@@ -94,6 +97,7 @@ type ContainerFrontend struct {
 	Tags              string                  `json:"tags,omitempty"`       // Joined string
 	Lock              string                  `json:"lock,omitempty"`
 	LastSeen          int64                   `json:"lastSeen"` // Unix timestamp
+	OSName            string                  `json:"osName,omitempty"`
 }
 
 // DockerHostFrontend represents a Docker host with frontend-friendly fields
@@ -142,6 +146,98 @@ type RemovedDockerHostFrontend struct {
 	RemovedAt   int64  `json:"removedAt"`
 }
 
+// KubernetesClusterFrontend represents a Kubernetes cluster for the frontend.
+type KubernetesClusterFrontend struct {
+	ID                string `json:"id"`
+	AgentID           string `json:"agentId"`
+	Name              string `json:"name,omitempty"`
+	DisplayName       string `json:"displayName,omitempty"`
+	CustomDisplayName string `json:"customDisplayName,omitempty"`
+	Server            string `json:"server,omitempty"`
+	Context           string `json:"context,omitempty"`
+	Version           string `json:"version,omitempty"`
+	Status            string `json:"status"`
+	LastSeen          int64  `json:"lastSeen"`
+	IntervalSeconds   int    `json:"intervalSeconds"`
+	AgentVersion      string `json:"agentVersion,omitempty"`
+	TokenID           string `json:"tokenId,omitempty"`
+	TokenName         string `json:"tokenName,omitempty"`
+	TokenHint         string `json:"tokenHint,omitempty"`
+	TokenLastUsedAt   *int64 `json:"tokenLastUsedAt,omitempty"`
+	Hidden            bool   `json:"hidden"`
+	PendingUninstall  bool   `json:"pendingUninstall"`
+
+	Nodes       []KubernetesNodeFrontend       `json:"nodes,omitempty"`
+	Pods        []KubernetesPodFrontend        `json:"pods,omitempty"`
+	Deployments []KubernetesDeploymentFrontend `json:"deployments,omitempty"`
+}
+
+type KubernetesNodeFrontend struct {
+	UID                     string   `json:"uid"`
+	Name                    string   `json:"name"`
+	Ready                   bool     `json:"ready"`
+	Unschedulable           bool     `json:"unschedulable,omitempty"`
+	KubeletVersion          string   `json:"kubeletVersion,omitempty"`
+	ContainerRuntimeVersion string   `json:"containerRuntimeVersion,omitempty"`
+	OSImage                 string   `json:"osImage,omitempty"`
+	KernelVersion           string   `json:"kernelVersion,omitempty"`
+	Architecture            string   `json:"architecture,omitempty"`
+	CapacityCPU             int64    `json:"capacityCpuCores,omitempty"`
+	CapacityMemoryBytes     int64    `json:"capacityMemoryBytes,omitempty"`
+	CapacityPods            int64    `json:"capacityPods,omitempty"`
+	AllocCPU                int64    `json:"allocatableCpuCores,omitempty"`
+	AllocMemoryBytes        int64    `json:"allocatableMemoryBytes,omitempty"`
+	AllocPods               int64    `json:"allocatablePods,omitempty"`
+	Roles                   []string `json:"roles,omitempty"`
+}
+
+type KubernetesPodFrontend struct {
+	UID        string                           `json:"uid"`
+	Name       string                           `json:"name"`
+	Namespace  string                           `json:"namespace"`
+	NodeName   string                           `json:"nodeName,omitempty"`
+	Phase      string                           `json:"phase,omitempty"`
+	Reason     string                           `json:"reason,omitempty"`
+	Message    string                           `json:"message,omitempty"`
+	QoSClass   string                           `json:"qosClass,omitempty"`
+	CreatedAt  int64                            `json:"createdAt,omitempty"`
+	StartTime  *int64                           `json:"startTime,omitempty"`
+	Restarts   int                              `json:"restarts,omitempty"`
+	Labels     map[string]string                `json:"labels,omitempty"`
+	OwnerKind  string                           `json:"ownerKind,omitempty"`
+	OwnerName  string                           `json:"ownerName,omitempty"`
+	Containers []KubernetesPodContainerFrontend `json:"containers,omitempty"`
+}
+
+type KubernetesPodContainerFrontend struct {
+	Name         string `json:"name"`
+	Image        string `json:"image,omitempty"`
+	Ready        bool   `json:"ready"`
+	RestartCount int32  `json:"restartCount,omitempty"`
+	State        string `json:"state,omitempty"`
+	Reason       string `json:"reason,omitempty"`
+	Message      string `json:"message,omitempty"`
+}
+
+type KubernetesDeploymentFrontend struct {
+	UID               string            `json:"uid"`
+	Name              string            `json:"name"`
+	Namespace         string            `json:"namespace"`
+	DesiredReplicas   int32             `json:"desiredReplicas,omitempty"`
+	UpdatedReplicas   int32             `json:"updatedReplicas,omitempty"`
+	ReadyReplicas     int32             `json:"readyReplicas,omitempty"`
+	AvailableReplicas int32             `json:"availableReplicas,omitempty"`
+	Labels            map[string]string `json:"labels,omitempty"`
+}
+
+// RemovedKubernetesClusterFrontend represents a blocked kubernetes cluster entry for the frontend.
+type RemovedKubernetesClusterFrontend struct {
+	ID          string `json:"id"`
+	Name        string `json:"name,omitempty"`
+	DisplayName string `json:"displayName,omitempty"`
+	RemovedAt   int64  `json:"removedAt"`
+}
+
 // DockerContainerFrontend represents a Docker container for the frontend
 type DockerContainerFrontend struct {
 	ID                  string                           `json:"id"`
@@ -315,6 +411,7 @@ type HostFrontend struct {
 	LoadAverage       []float64                  `json:"loadAverage,omitempty"`
 	Memory            *Memory                    `json:"memory,omitempty"`
 	Disks             []Disk                     `json:"disks,omitempty"`
+	DiskIO            []DiskIO                   `json:"diskIO,omitempty"`
 	NetworkInterfaces []HostNetworkInterface     `json:"networkInterfaces,omitempty"`
 	Sensors           *HostSensorSummaryFrontend `json:"sensors,omitempty"`
 	Status            string                     `json:"status"`
@@ -421,27 +518,103 @@ type ReplicationJobFrontend struct {
 
 // StateFrontend represents the state with frontend-friendly field names
 type StateFrontend struct {
-	Nodes                        []NodeFrontend              `json:"nodes"`
-	VMs                          []VMFrontend                `json:"vms"`
-	Containers                   []ContainerFrontend         `json:"containers"`
-	DockerHosts                  []DockerHostFrontend        `json:"dockerHosts"`
-	RemovedDockerHosts           []RemovedDockerHostFrontend `json:"removedDockerHosts"`
-	Hosts                        []HostFrontend              `json:"hosts"`
-	Storage                      []StorageFrontend           `json:"storage"`
-	CephClusters                 []CephClusterFrontend       `json:"cephClusters"`
-	PhysicalDisks                []PhysicalDisk              `json:"physicalDisks"`
-	PBS                          []PBSInstance               `json:"pbs"` // Keep as is
-	PMG                          []PMGInstance               `json:"pmg"`
-	PBSBackups                   []PBSBackup                 `json:"pbsBackups"`
-	PMGBackups                   []PMGBackup                 `json:"pmgBackups"`
-	Backups                      Backups                     `json:"backups"`
-	ReplicationJobs              []ReplicationJobFrontend    `json:"replicationJobs"`
-	ActiveAlerts                 []Alert                     `json:"activeAlerts"`                 // Active alerts
-	Metrics                      map[string]any              `json:"metrics"`                      // Empty object for now
-	PVEBackups                   PVEBackups                  `json:"pveBackups"`                   // Keep as is
-	Performance                  map[string]any              `json:"performance"`                  // Empty object for now
-	ConnectionHealth             map[string]bool             `json:"connectionHealth"`             // Keep as is
-	Stats                        map[string]any              `json:"stats"`                        // Empty object for now
-	LastUpdate                   int64                       `json:"lastUpdate"`                   // Unix timestamp
-	TemperatureMonitoringEnabled bool                        `json:"temperatureMonitoringEnabled"` // Global temperature monitoring setting
+	Nodes                        []NodeFrontend                     `json:"nodes"`
+	VMs                          []VMFrontend                       `json:"vms"`
+	Containers                   []ContainerFrontend                `json:"containers"`
+	DockerHosts                  []DockerHostFrontend               `json:"dockerHosts"`
+	RemovedDockerHosts           []RemovedDockerHostFrontend        `json:"removedDockerHosts"`
+	KubernetesClusters           []KubernetesClusterFrontend        `json:"kubernetesClusters"`
+	RemovedKubernetesClusters    []RemovedKubernetesClusterFrontend `json:"removedKubernetesClusters"`
+	Hosts                        []HostFrontend                     `json:"hosts"`
+	Storage                      []StorageFrontend                  `json:"storage"`
+	CephClusters                 []CephClusterFrontend              `json:"cephClusters"`
+	PhysicalDisks                []PhysicalDisk                     `json:"physicalDisks"`
+	PBS                          []PBSInstance                      `json:"pbs"` // Keep as is
+	PMG                          []PMGInstance                      `json:"pmg"`
+	PBSBackups                   []PBSBackup                        `json:"pbsBackups"`
+	PMGBackups                   []PMGBackup                        `json:"pmgBackups"`
+	Backups                      Backups                            `json:"backups"`
+	ReplicationJobs              []ReplicationJobFrontend           `json:"replicationJobs"`
+	ActiveAlerts                 []Alert                            `json:"activeAlerts"`                 // Active alerts
+	Metrics                      map[string]any                     `json:"metrics"`                      // Empty object for now
+	PVEBackups                   PVEBackups                         `json:"pveBackups"`                   // Keep as is
+	Performance                  map[string]any                     `json:"performance"`                  // Empty object for now
+	ConnectionHealth             map[string]bool                    `json:"connectionHealth"`             // Keep as is
+	Stats                        map[string]any                     `json:"stats"`                        // Empty object for now
+	LastUpdate                   int64                              `json:"lastUpdate"`                   // Unix timestamp
+	TemperatureMonitoringEnabled bool                               `json:"temperatureMonitoringEnabled"` // Global temperature monitoring setting
+	// Unified resources - the new way to access all monitored entities
+	Resources []ResourceFrontend `json:"resources,omitempty"`
+}
+
+// ResourceFrontend is the frontend representation of a unified Resource.
+// This mirrors resources.Resource but with time.Time converted to Unix milliseconds.
+type ResourceFrontend struct {
+	// Identity
+	ID          string `json:"id"`
+	Type        string `json:"type"`
+	Name        string `json:"name"`
+	DisplayName string `json:"displayName"`
+
+	// Platform/Source
+	PlatformID   string `json:"platformId"`
+	PlatformType string `json:"platformType"`
+	SourceType   string `json:"sourceType"`
+
+	// Hierarchy
+	ParentID  string `json:"parentId,omitempty"`
+	ClusterID string `json:"clusterId,omitempty"`
+
+	// Universal Metrics
+	Status      string                   `json:"status"`
+	CPU         *ResourceMetricFrontend  `json:"cpu,omitempty"`
+	Memory      *ResourceMetricFrontend  `json:"memory,omitempty"`
+	Disk        *ResourceMetricFrontend  `json:"disk,omitempty"`
+	Network     *ResourceNetworkFrontend `json:"network,omitempty"`
+	Temperature *float64                 `json:"temperature,omitempty"`
+	Uptime      *int64                   `json:"uptime,omitempty"`
+
+	// Metadata
+	Tags     []string                `json:"tags,omitempty"`
+	Labels   map[string]string       `json:"labels,omitempty"`
+	LastSeen int64                   `json:"lastSeen"` // Unix milliseconds
+	Alerts   []ResourceAlertFrontend `json:"alerts,omitempty"`
+
+	// Identity for deduplication
+	Identity *ResourceIdentityFrontend `json:"identity,omitempty"`
+
+	// Platform-specific data (JSON blob)
+	PlatformData map[string]any `json:"platformData,omitempty"`
+}
+
+// ResourceMetricFrontend represents a metric value for the frontend.
+type ResourceMetricFrontend struct {
+	Current float64 `json:"current"`
+	Total   *int64  `json:"total,omitempty"`
+	Used    *int64  `json:"used,omitempty"`
+	Free    *int64  `json:"free,omitempty"`
+}
+
+// ResourceNetworkFrontend represents network metrics for the frontend.
+type ResourceNetworkFrontend struct {
+	RXBytes int64 `json:"rxBytes"`
+	TXBytes int64 `json:"txBytes"`
+}
+
+// ResourceAlertFrontend represents an alert on a resource.
+type ResourceAlertFrontend struct {
+	ID        string  `json:"id"`
+	Type      string  `json:"type"`
+	Level     string  `json:"level"`
+	Message   string  `json:"message"`
+	Value     float64 `json:"value"`
+	Threshold float64 `json:"threshold"`
+	StartTime int64   `json:"startTime"` // Unix milliseconds
+}
+
+// ResourceIdentityFrontend contains identity info for deduplication.
+type ResourceIdentityFrontend struct {
+	Hostname  string   `json:"hostname,omitempty"`
+	MachineID string   `json:"machineId,omitempty"`
+	IPs       []string `json:"ips,omitempty"`
 }
diff --git a/internal/models/state_snapshot.go b/internal/models/state_snapshot.go
index 0b84827..eed7588 100644
--- a/internal/models/state_snapshot.go
+++ b/internal/models/state_snapshot.go
@@ -4,30 +4,32 @@ import "time"
 
 // StateSnapshot represents a snapshot of the state without mutex
 type StateSnapshot struct {
-	Nodes                        []Node              `json:"nodes"`
-	VMs                          []VM                `json:"vms"`
-	Containers                   []Container         `json:"containers"`
-	DockerHosts                  []DockerHost        `json:"dockerHosts"`
-	RemovedDockerHosts           []RemovedDockerHost `json:"removedDockerHosts"`
-	Hosts                        []Host              `json:"hosts"`
-	Storage                      []Storage           `json:"storage"`
-	CephClusters                 []CephCluster       `json:"cephClusters"`
-	PhysicalDisks                []PhysicalDisk      `json:"physicalDisks"`
-	PBSInstances                 []PBSInstance       `json:"pbs"`
-	PMGInstances                 []PMGInstance       `json:"pmg"`
-	PBSBackups                   []PBSBackup         `json:"pbsBackups"`
-	PMGBackups                   []PMGBackup         `json:"pmgBackups"`
-	Backups                      Backups             `json:"backups"`
-	ReplicationJobs              []ReplicationJob    `json:"replicationJobs"`
-	Metrics                      []Metric            `json:"metrics"`
-	PVEBackups                   PVEBackups          `json:"pveBackups"`
-	Performance                  Performance         `json:"performance"`
-	ConnectionHealth             map[string]bool     `json:"connectionHealth"`
-	Stats                        Stats               `json:"stats"`
-	ActiveAlerts                 []Alert             `json:"activeAlerts"`
-	RecentlyResolved             []ResolvedAlert     `json:"recentlyResolved"`
-	LastUpdate                   time.Time           `json:"lastUpdate"`
-	TemperatureMonitoringEnabled bool                `json:"temperatureMonitoringEnabled"`
+	Nodes                        []Node                     `json:"nodes"`
+	VMs                          []VM                       `json:"vms"`
+	Containers                   []Container                `json:"containers"`
+	DockerHosts                  []DockerHost               `json:"dockerHosts"`
+	RemovedDockerHosts           []RemovedDockerHost        `json:"removedDockerHosts"`
+	KubernetesClusters           []KubernetesCluster        `json:"kubernetesClusters"`
+	RemovedKubernetesClusters    []RemovedKubernetesCluster `json:"removedKubernetesClusters"`
+	Hosts                        []Host                     `json:"hosts"`
+	Storage                      []Storage                  `json:"storage"`
+	CephClusters                 []CephCluster              `json:"cephClusters"`
+	PhysicalDisks                []PhysicalDisk             `json:"physicalDisks"`
+	PBSInstances                 []PBSInstance              `json:"pbs"`
+	PMGInstances                 []PMGInstance              `json:"pmg"`
+	PBSBackups                   []PBSBackup                `json:"pbsBackups"`
+	PMGBackups                   []PMGBackup                `json:"pmgBackups"`
+	Backups                      Backups                    `json:"backups"`
+	ReplicationJobs              []ReplicationJob           `json:"replicationJobs"`
+	Metrics                      []Metric                   `json:"metrics"`
+	PVEBackups                   PVEBackups                 `json:"pveBackups"`
+	Performance                  Performance                `json:"performance"`
+	ConnectionHealth             map[string]bool            `json:"connectionHealth"`
+	Stats                        Stats                      `json:"stats"`
+	ActiveAlerts                 []Alert                    `json:"activeAlerts"`
+	RecentlyResolved             []ResolvedAlert            `json:"recentlyResolved"`
+	LastUpdate                   time.Time                  `json:"lastUpdate"`
+	TemperatureMonitoringEnabled bool                       `json:"temperatureMonitoringEnabled"`
 }
 
 // GetSnapshot returns a snapshot of the current state without mutex
@@ -45,19 +47,21 @@ func (s *State) GetSnapshot() StateSnapshot {
 
 	// Create a snapshot without mutex
 	snapshot := StateSnapshot{
-		Nodes:              append([]Node{}, s.Nodes...),
-		VMs:                append([]VM{}, s.VMs...),
-		Containers:         append([]Container{}, s.Containers...),
-		DockerHosts:        append([]DockerHost{}, s.DockerHosts...),
-		RemovedDockerHosts: append([]RemovedDockerHost{}, s.RemovedDockerHosts...),
-		Hosts:              append([]Host{}, s.Hosts...),
-		Storage:            append([]Storage{}, s.Storage...),
-		CephClusters:       append([]CephCluster{}, s.CephClusters...),
-		PhysicalDisks:      append([]PhysicalDisk{}, s.PhysicalDisks...),
-		PBSInstances:       append([]PBSInstance{}, s.PBSInstances...),
-		PMGInstances:       append([]PMGInstance{}, s.PMGInstances...),
-		PBSBackups:         pbsBackups,
-		PMGBackups:         pmgBackups,
+		Nodes:                     append([]Node{}, s.Nodes...),
+		VMs:                       append([]VM{}, s.VMs...),
+		Containers:                append([]Container{}, s.Containers...),
+		DockerHosts:               append([]DockerHost{}, s.DockerHosts...),
+		RemovedDockerHosts:        append([]RemovedDockerHost{}, s.RemovedDockerHosts...),
+		KubernetesClusters:        append([]KubernetesCluster{}, s.KubernetesClusters...),
+		RemovedKubernetesClusters: append([]RemovedKubernetesCluster{}, s.RemovedKubernetesClusters...),
+		Hosts:                     append([]Host{}, s.Hosts...),
+		Storage:                   append([]Storage{}, s.Storage...),
+		CephClusters:              append([]CephCluster{}, s.CephClusters...),
+		PhysicalDisks:             append([]PhysicalDisk{}, s.PhysicalDisks...),
+		PBSInstances:              append([]PBSInstance{}, s.PBSInstances...),
+		PMGInstances:              append([]PMGInstance{}, s.PMGInstances...),
+		PBSBackups:                pbsBackups,
+		PMGBackups:                pmgBackups,
 		Backups: Backups{
 			PVE: pveBackups,
 			PBS: pbsBackups,
@@ -113,6 +117,16 @@ func (s StateSnapshot) ToFrontend() StateFrontend {
 		removedDockerHosts[i] = entry.ToFrontend()
 	}
 
+	kubernetesClusters := make([]KubernetesClusterFrontend, len(s.KubernetesClusters))
+	for i, cluster := range s.KubernetesClusters {
+		kubernetesClusters[i] = cluster.ToFrontend()
+	}
+
+	removedKubernetesClusters := make([]RemovedKubernetesClusterFrontend, len(s.RemovedKubernetesClusters))
+	for i, entry := range s.RemovedKubernetesClusters {
+		removedKubernetesClusters[i] = entry.ToFrontend()
+	}
+
 	hosts := make([]HostFrontend, len(s.Hosts))
 	for i, host := range s.Hosts {
 		hosts[i] = host.ToFrontend()
@@ -141,6 +155,8 @@ func (s StateSnapshot) ToFrontend() StateFrontend {
 		Containers:                   containers,
 		DockerHosts:                  dockerHosts,
 		RemovedDockerHosts:           removedDockerHosts,
+		KubernetesClusters:           kubernetesClusters,
+		RemovedKubernetesClusters:    removedKubernetesClusters,
 		Hosts:                        hosts,
 		Storage:                      storage,
 		CephClusters:                 cephClusters,
diff --git a/internal/monitoring/container_parsing.go b/internal/monitoring/container_parsing.go
index 82d15a1..cadb358 100644
--- a/internal/monitoring/container_parsing.go
+++ b/internal/monitoring/container_parsing.go
@@ -445,3 +445,152 @@ func extractContainerRootDeviceFromConfig(config map[string]interface{}) string
 	device := strings.TrimSpace(parts[0])
 	return device
 }
+
+// lxcOSTypeDisplayNames maps Proxmox LXC ostype values to human-readable OS names.
+// See: https://pve.proxmox.com/wiki/Manual:_pct.conf
+var lxcOSTypeDisplayNames = map[string]string{
+	"alpine":    "Alpine Linux",
+	"archlinux": "Arch Linux",
+	"centos":    "CentOS",
+	"debian":    "Debian",
+	"devuan":    "Devuan",
+	"fedora":    "Fedora",
+	"gentoo":    "Gentoo",
+	"nixos":     "NixOS",
+	"opensuse":  "openSUSE",
+	"ubuntu":    "Ubuntu",
+	"unmanaged": "Unmanaged",
+}
+
+// extractContainerOSType extracts and normalizes the ostype from container config.
+// Returns a human-readable OS name (e.g., "Ubuntu", "Debian", "Alpine Linux").
+func extractContainerOSType(config map[string]interface{}) string {
+	if len(config) == 0 {
+		return ""
+	}
+
+	raw, ok := config["ostype"]
+	if !ok {
+		return ""
+	}
+
+	ostype := strings.TrimSpace(strings.ToLower(fmt.Sprint(raw)))
+	if ostype == "" {
+		return ""
+	}
+
+	// Return display name if known, otherwise capitalize the ostype
+	if displayName, found := lxcOSTypeDisplayNames[ostype]; found {
+		return displayName
+	}
+
+	// Fallback: capitalize first letter
+	if len(ostype) > 0 {
+		return strings.ToUpper(ostype[:1]) + ostype[1:]
+	}
+	return ostype
+}
+
+// extractContainerOSTemplate extracts the ostemplate value from container config.
+// This is the template used to create the container, which may be an LXC template
+// or an OCI image reference (Proxmox VE 9.1+).
+func extractContainerOSTemplate(config map[string]interface{}) string {
+	if len(config) == 0 {
+		return ""
+	}
+
+	// Try common field names for the template
+	for _, key := range []string{"ostemplate", "template"} {
+		if raw, ok := config[key]; ok {
+			if value := strings.TrimSpace(fmt.Sprint(raw)); value != "" {
+				return value
+			}
+		}
+	}
+
+	return ""
+}
+
+// isOCITemplate returns true if the ostemplate string indicates an OCI container image.
+// Proxmox VE 9.1+ supports pulling OCI images from registries like Docker Hub.
+// OCI templates typically have formats like:
+//   - "oci:docker.io/library/alpine:latest"
+//   - "docker:alpine:latest"
+//   - "local:vztmpl/oci-alpine-latest.tar.gz" (pulled OCI image stored locally)
+func isOCITemplate(template string) bool {
+	if template == "" {
+		return false
+	}
+
+	template = strings.ToLower(strings.TrimSpace(template))
+
+	// Explicit OCI prefix
+	if strings.HasPrefix(template, "oci:") {
+		return true
+	}
+
+	// Docker Hub shorthand (docker:image:tag)
+	if strings.HasPrefix(template, "docker:") {
+		return true
+	}
+
+	// Check for common OCI registry URLs
+	ociRegistries := []string{
+		"docker.io/",
+		"ghcr.io/",
+		"gcr.io/",
+		"quay.io/",
+		"registry.hub.docker.com/",
+		"mcr.microsoft.com/",
+		"public.ecr.aws/",
+	}
+	for _, registry := range ociRegistries {
+		if strings.Contains(template, registry) {
+			return true
+		}
+	}
+
+	// Check for locally stored OCI images (typically have "oci" in the filename)
+	// e.g., "local:vztmpl/oci-alpine-3.18.tar.xz"
+	if strings.Contains(template, "/oci-") || strings.Contains(template, "/oci_") {
+		return true
+	}
+
+	return false
+}
+
+// isOCIContainerByConfig detects OCI containers by examining their configuration.
+// Proxmox VE 9.1+ OCI containers have specific config markers:
+//   - "entrypoint" field is set (only OCI containers have this)
+//   - "ostype" is often "unmanaged" for OCI containers
+//   - "cmode" is often "console" for OCI containers
+//
+// This is useful because Proxmox doesn't persist the ostemplate after container creation.
+func isOCIContainerByConfig(config map[string]interface{}) bool {
+	if len(config) == 0 {
+		return false
+	}
+
+	// Primary indicator: OCI containers have an "entrypoint" field
+	// Traditional LXC containers don't have this field
+	if _, hasEntrypoint := config["entrypoint"]; hasEntrypoint {
+		return true
+	}
+
+	// Secondary check: "unmanaged" ostype with console cmode is a strong hint
+	// (though not definitive as users could manually configure this)
+	ostype, _ := config["ostype"].(string)
+	cmode, _ := config["cmode"].(string)
+	if ostype == "unmanaged" && cmode == "console" {
+		// Check for other OCI indicators like lxc.signal.halt: SIGTERM
+		// (which is set by Proxmox for OCI containers)
+		if lxc, ok := config["lxc"]; ok {
+			lxcStr := fmt.Sprint(lxc)
+			if strings.Contains(lxcStr, "lxc.signal.halt") {
+				return true
+			}
+		}
+	}
+
+	return false
+}
diff --git a/internal/monitoring/container_parsing_test.go b/internal/monitoring/container_parsing_test.go
index fef1d18..a621ef0 100644
--- a/internal/monitoring/container_parsing_test.go
+++ b/internal/monitoring/container_parsing_test.go
@@ -1748,3 +1748,208 @@ func containersEqual(a, b *models.Container) bool {
 	}
 	return diskSlicesEqual(a.Disks, b.Disks)
 }
+
+// OCI Container Detection Tests (Proxmox VE 9.1+)
+
+func TestExtractContainerOSTemplate(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		config   map[string]interface{}
+		expected string
+	}{
+		{
+			name:     "empty config",
+			config:   map[string]interface{}{},
+			expected: "",
+		},
+		{
+			name: "standard LXC template",
+			config: map[string]interface{}{
+				"ostemplate": "local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst",
+			},
+			expected: "local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst",
+		},
+		{
+			name: "OCI image with oci prefix",
+			config: map[string]interface{}{
+				"ostemplate": "oci:docker.io/library/alpine:latest",
+			},
+			expected: "oci:docker.io/library/alpine:latest",
+		},
+		{
+			name: "Docker Hub shorthand",
+			config: map[string]interface{}{
+				"ostemplate": "docker:nginx:latest",
+			},
+			expected: "docker:nginx:latest",
+		},
+		{
+			name: "template field fallback",
+			config: map[string]interface{}{
+				"template": "oci:ghcr.io/myorg/myimage:v1.0",
+			},
+			expected: "oci:ghcr.io/myorg/myimage:v1.0",
+		},
+		{
+			name: "ostemplate takes precedence over template",
+			config: map[string]interface{}{
+				"ostemplate": "oci:docker.io/library/alpine:latest",
+				"template":   "local:vztmpl/something-else.tar.gz",
+			},
+			expected: "oci:docker.io/library/alpine:latest",
+		},
+		{
+			name: "whitespace trimmed",
+			config: map[string]interface{}{
+				"ostemplate": "  oci:docker.io/library/alpine:latest  ",
+			},
+			expected: "oci:docker.io/library/alpine:latest",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := extractContainerOSTemplate(tt.config)
+			if result != tt.expected {
+				t.Errorf("extractContainerOSTemplate() = %q, want %q", result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestIsOCITemplate(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		template string
+		expected bool
+	}{
+		// Empty/nil cases
+		{
+			name:     "empty string",
+			template: "",
+			expected: false,
+		},
+
+		// Standard LXC templates (should NOT be detected as OCI)
+		{
+			name:     "standard LXC template",
+			template: "local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst",
+			expected: false,
+		},
+		{
+			name:     "Proxmox template store",
+			template: "local:vztmpl/debian-12-standard_12.0-1_amd64.tar.zst",
+			expected: false,
+		},
+
+		// Explicit OCI prefix
+		{
+			name:     "oci prefix - Docker Hub",
+			template: "oci:docker.io/library/alpine:latest",
+			expected: true,
+		},
+		{
+			name:     "oci prefix - GHCR",
+			template: "oci:ghcr.io/myorg/myimage:v1.0",
+			expected: true,
+		},
+		{
+			name:     "oci prefix uppercase",
+			template: "OCI:docker.io/library/nginx:latest",
+			expected: true,
+		},
+
+		// Docker Hub shorthand
+		{
+			name:     "docker prefix simple",
+			template: "docker:alpine:latest",
+			expected: true,
+		},
+		{
+			name:     "docker prefix with path",
+			template: "docker:library/nginx:1.25",
+			expected: true,
+		},
+		{
+			name:     "docker prefix uppercase",
+			template: "DOCKER:redis:7",
+			expected: true,
+		},
+
+		// Registry URLs embedded (with slashes as the detection logic expects)
+		{
+			name:     "Docker Hub URL with slashes",
+			template: "docker.io/library/alpine:latest",
+			expected: true,
+		},
+		{
+			name:     "GHCR URL with slashes",
+			template: "ghcr.io/myorg/myapp:v2",
+			expected: true,
+		},
+		{
+			name:     "GCR URL",
+			template: "gcr.io/myproject/myimage:latest",
+			expected: true,
+		},
+		{
+			name:     "Quay.io URL",
+			template: "quay.io/coreos/etcd:v3.5",
+			expected: true,
+		},
+		{
+			name:     "Microsoft Container Registry",
+			template: "mcr.microsoft.com/dotnet/runtime:7.0",
+			expected: true,
+		},
+		{
+			name:     "AWS ECR Public",
+			template: "public.ecr.aws/amazonlinux/amazonlinux:latest",
+			expected: true,
+		},
+
+		// Locally stored OCI images
+		{
+			name:     "local OCI image with oci- prefix",
+			template: "local:vztmpl/oci-alpine-3.18.tar.xz",
+			expected: true,
+		},
+		{
+			name:     "local OCI image with oci_ prefix",
+			template: "local:vztmpl/oci_nginx_latest.tar.gz",
+			expected: true,
+		},
+
+		// Edge cases
+		{
+			name:     "case insensitive oci",
+			template: "OcI:docker.io/library/alpine:latest",
+			expected: true,
+		},
+		{
+			name:     "whitespace handling",
+			template: "  oci:docker.io/library/alpine:latest  ",
+			expected: true,
+		},
+		{
+			name:     "similar but not OCI - social.io",
+			template: "local:vztmpl/social.io-app.tar.gz",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := isOCITemplate(tt.template)
+			if result != tt.expected {
+				t.Errorf("isOCITemplate(%q) = %v, want %v", tt.template, result, tt.expected)
+			}
+		})
+	}
+}
diff --git a/internal/monitoring/enrich_container_metadata_test.go b/internal/monitoring/enrich_container_metadata_test.go
new file mode 100644
index 0000000..7d9ddb5
--- /dev/null
+++ b/internal/monitoring/enrich_container_metadata_test.go
@@ -0,0 +1,65 @@
+package monitoring
+
+import (
+	"context"
+	"testing"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rcourtman/pulse-go-rewrite/pkg/proxmox"
+)
+
+type stubPVEClientContainerMetadata struct {
+	stubPVEClient
+
+	config map[string]interface{}
+
+	configCalls int
+	statusCalls int
+}
+
+func (s *stubPVEClientContainerMetadata) GetContainerConfig(ctx context.Context, node string, vmid int) (map[string]interface{}, error) {
+	s.configCalls++
+	return s.config, nil
+}
+
+func (s *stubPVEClientContainerMetadata) GetContainerStatus(ctx context.Context, node string, vmid int) (*proxmox.Container, error) {
+	s.statusCalls++
+	return nil, nil
+}
+
+func TestEnrichContainerMetadata_DetectsOCIForStoppedContainer(t *testing.T) {
+	t.Parallel()
+
+	monitor := &Monitor{}
+	client := &stubPVEClientContainerMetadata{
+		config: map[string]interface{}{
+			"entrypoint": "/bin/sh",
+			"ostype":     "unmanaged",
+			"cmode":      "console",
+			"lxc":        "lxc.signal.halt: SIGTERM",
+		},
+	}
+
+	container := &models.Container{
+		VMID:   300,
+		Name:   "oci-alpine",
+		Status: "stopped",
+		Type:   "lxc",
+	}
+
+	monitor.enrichContainerMetadata(context.Background(), client, "delly", "delly", container)
+
+	if client.configCalls != 1 {
+		t.Fatalf("expected 1 config call, got %d", client.configCalls)
+	}
+	if client.statusCalls != 0 {
+		t.Fatalf("expected 0 status calls for stopped container, got %d", client.statusCalls)
+	}
+	if !container.IsOCI {
+		t.Fatalf("expected container.IsOCI true, got false")
+	}
+	if container.Type != "oci" {
+		t.Fatalf("expected container.Type oci, got %q", container.Type)
+	}
+}
+
diff --git a/internal/monitoring/host_agent_temps.go b/internal/monitoring/host_agent_temps.go
new file mode 100644
index 0000000..da7b069
--- /dev/null
+++ b/internal/monitoring/host_agent_temps.go
@@ -0,0 +1,272 @@
+package monitoring
+
+import (
+	"math"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rs/zerolog/log"
+)
+
+// getHostAgentTemperature looks for a matching host agent by hostname and converts
+// its sensor data to the Temperature model used by Proxmox nodes.
+// Returns nil if no matching host agent is found or if no temperature data is available.
+func (m *Monitor) getHostAgentTemperature(nodeName string) *models.Temperature {
+	if m.state == nil {
+		return nil
+	}
+
+	hosts := m.state.GetHosts()
+	if len(hosts) == 0 {
+		return nil
+	}
+
+	// Find a host agent whose hostname matches the Proxmox node name
+	// The agent on a Proxmox node will have the same hostname as the node
+	nodeLower := strings.ToLower(strings.TrimSpace(nodeName))
+	var matchedHost *models.Host
+	for i := range hosts {
+		hostnameLower := strings.ToLower(strings.TrimSpace(hosts[i].Hostname))
+		if hostnameLower == nodeLower {
+			matchedHost = &hosts[i]
+			break
+		}
+	}
+
+	if matchedHost == nil {
+		return nil
+	}
+
+	// Check if the host agent has temperature data
+	if len(matchedHost.Sensors.TemperatureCelsius) == 0 {
+		return nil
+	}
+
+	// Convert host agent sensor data to Temperature model
+	return convertHostSensorsToTemperature(matchedHost.Sensors, matchedHost.LastSeen)
+}
+
+// convertHostSensorsToTemperature converts HostSensorSummary to the Temperature model.
+// The host agent reports temperatures in a flat map with keys like:
+// - "cpu_package" -> CPU package temperature
+// - "cpu_core_0", "cpu_core_1", etc. -> individual core temperatures
+// - "nvme0", "nvme1", etc. -> NVMe temperatures
+// - "gpu_edge", "gpu_junction", etc. -> GPU temperatures
+func convertHostSensorsToTemperature(sensors models.HostSensorSummary, lastSeen time.Time) *models.Temperature {
+	if len(sensors.TemperatureCelsius) == 0 {
+		return nil
+	}
+
+	temp := &models.Temperature{
+		Available:  true,
+		LastUpdate: lastSeen,
+		Cores:      []models.CoreTemp{},
+		NVMe:       []models.NVMeTemp{},
+		GPU:        []models.GPUTemp{},
+	}
+
+	var coreTemps []float64
+	corePattern := regexp.MustCompile(`^cpu_core_(\d+)$`)
+	nvmePattern := regexp.MustCompile(`^(nvme\d+)$`)
+	gpuPattern := regexp.MustCompile(`^gpu_(.+)$`)
+
+	for key, value := range sensors.TemperatureCelsius {
+		keyLower := strings.ToLower(key)
+
+		// CPU package temperature
+		if keyLower == "cpu_package" {
+			temp.CPUPackage = value
+			temp.HasCPU = true
+			continue
+		}
+
+		// CPU core temperatures
+		if matches := corePattern.FindStringSubmatch(keyLower); len(matches) == 2 {
+			coreNum, err := strconv.Atoi(matches[1])
+			if err == nil {
+				temp.Cores = append(temp.Cores, models.CoreTemp{
+					Core: coreNum,
+					Temp: value,
+				})
+				coreTemps = append(coreTemps, value)
+				temp.HasCPU = true
+			}
+			continue
+		}
+
+		// NVMe temperatures
+		if matches := nvmePattern.FindStringSubmatch(keyLower); len(matches) == 2 {
+			temp.NVMe = append(temp.NVMe, models.NVMeTemp{
+				Device: matches[1],
+				Temp:   value,
+			})
+			temp.HasNVMe = true
+			continue
+		}
+
+		// GPU temperatures (gpu_edge, gpu_junction, gpu_mem, or generic gpu_<device>)
+		if matches := gpuPattern.FindStringSubmatch(keyLower); len(matches) == 2 {
+			gpuKey := matches[1]
+			// Handle specific GPU temp types
+			if gpuKey == "edge" || gpuKey == "junction" || gpuKey == "mem" {
+				// Find or create GPU entry for the default device
+				found := false
+				for i := range temp.GPU {
+					if temp.GPU[i].Device == "gpu0" {
+						switch gpuKey {
+						case "edge":
+							temp.GPU[i].Edge = value
+						case "junction":
+							temp.GPU[i].Junction = value
+						case "mem":
+							temp.GPU[i].Mem = value
+						}
+						found = true
+						break
+					}
+				}
+				if !found {
+					gpu := models.GPUTemp{Device: "gpu0"}
+					switch gpuKey {
+					case "edge":
+						gpu.Edge = value
+					case "junction":
+						gpu.Junction = value
+					case "mem":
+						gpu.Mem = value
+					}
+					temp.GPU = append(temp.GPU, gpu)
+				}
+			} else {
+				// Generic GPU entry with edge temp
+				temp.GPU = append(temp.GPU, models.GPUTemp{
+					Device: gpuKey,
+					Edge:   value,
+				})
+			}
+			temp.HasGPU = true
+			continue
+		}
+	}
+
+	// Sort cores by core number
+	sort.Slice(temp.Cores, func(i, j int) bool {
+		return temp.Cores[i].Core < temp.Cores[j].Core
+	})
+
+	// Sort NVMe by device name
+	sort.Slice(temp.NVMe, func(i, j int) bool {
+		return temp.NVMe[i].Device < temp.NVMe[j].Device
+	})
+
+	// Calculate CPUMax from core temperatures if package temp wasn't available
+	if len(coreTemps) > 0 {
+		maxTemp := 0.0
+		for _, t := range coreTemps {
+			if t > maxTemp {
+				maxTemp = t
+			}
+		}
+		temp.CPUMax = maxTemp
+
+		// If no package temp, use max core temp as package
+		if temp.CPUPackage == 0 {
+			temp.CPUPackage = maxTemp
+		}
+	}
+
+	// Validate we have at least some data
+	if !temp.HasCPU && !temp.HasGPU && !temp.HasNVMe {
+		return nil
+	}
+
+	log.Debug().
+		Str("source", "host-agent").
+		Float64("cpuPackage", temp.CPUPackage).
+		Float64("cpuMax", temp.CPUMax).
+		Int("coreCount", len(temp.Cores)).
+		Int("nvmeCount", len(temp.NVMe)).
+		Int("gpuCount", len(temp.GPU)).
+		Msg("Converted host agent sensors to temperature data")
+
+	return temp
+}
+
+// isHostAgentTemperatureRecent checks if the host agent temperature data is recent enough to use.
+// We consider data stale if the host hasn't reported in more than 2 minutes.
+func isHostAgentTemperatureRecent(lastSeen time.Time) bool {
+	const staleDuration = 2 * time.Minute
+	return time.Since(lastSeen) < staleDuration
+}
+
+// mergeTemperatureData merges host agent temperature with existing/proxy temperature data.
+// Host agent data takes priority for CPU temperatures since it's more reliable (no SSH required).
+// NVMe/SMART data is merged - host agent NVMe data supplements proxy SMART data.
+func mergeTemperatureData(hostAgentTemp, proxyTemp *models.Temperature) *models.Temperature {
+	if hostAgentTemp == nil {
+		return proxyTemp
+	}
+	if proxyTemp == nil {
+		return hostAgentTemp
+	}
+
+	// Start with host agent data as base since it's more reliable
+	result := &models.Temperature{
+		CPUPackage: hostAgentTemp.CPUPackage,
+		CPUMax:     hostAgentTemp.CPUMax,
+		CPUMin:     proxyTemp.CPUMin, // Preserve historical min
+		CPUMaxRecord: math.Max(hostAgentTemp.CPUPackage, proxyTemp.CPUMaxRecord), // Update historical max
+		MinRecorded: proxyTemp.MinRecorded,
+		MaxRecorded: proxyTemp.MaxRecorded,
+		Cores:       hostAgentTemp.Cores,
+		GPU:         hostAgentTemp.GPU,
+		NVMe:        hostAgentTemp.NVMe,
+		Available:   true,
+		HasCPU:      hostAgentTemp.HasCPU,
+		HasGPU:      hostAgentTemp.HasGPU,
+		HasNVMe:     hostAgentTemp.HasNVMe,
+		HasSMART:    proxyTemp.HasSMART, // SMART data only comes from proxy
+		LastUpdate:  hostAgentTemp.LastUpdate,
+	}
+
+	// Use host agent CPU data if available, fall back to proxy
+	if !hostAgentTemp.HasCPU && proxyTemp.HasCPU {
+		result.CPUPackage = proxyTemp.CPUPackage
+		result.CPUMax = proxyTemp.CPUMax
+		result.Cores = proxyTemp.Cores
+		result.HasCPU = true
+	}
+
+	// Keep proxy SMART data (host agent doesn't have smartctl access currently)
+	if proxyTemp.HasSMART {
+		result.SMART = proxyTemp.SMART
+	}
+
+	// Merge GPU data - prefer host agent if available
+	if !hostAgentTemp.HasGPU && proxyTemp.HasGPU {
+		result.GPU = proxyTemp.GPU
+		result.HasGPU = true
+	}
+
+	// Merge NVMe data - prefer host agent if available, fall back to proxy
+	if !hostAgentTemp.HasNVMe && proxyTemp.HasNVMe {
+		result.NVMe = proxyTemp.NVMe
+		result.HasNVMe = true
+	}
+
+	// Update historical max if current is higher
+	currentTemp := result.CPUPackage
+	if currentTemp == 0 && result.CPUMax > 0 {
+		currentTemp = result.CPUMax
+	}
+	if currentTemp > result.CPUMaxRecord {
+		result.CPUMaxRecord = currentTemp
+		result.MaxRecorded = time.Now()
+	}
+
+	return result
+}
diff --git a/internal/monitoring/kubernetes_agents.go b/internal/monitoring/kubernetes_agents.go
new file mode 100644
index 0000000..2ecb362
--- /dev/null
+++ b/internal/monitoring/kubernetes_agents.go
@@ -0,0 +1,390 @@
+package monitoring
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	"github.com/rcourtman/pulse-go-rewrite/internal/logging"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	agentsk8s "github.com/rcourtman/pulse-go-rewrite/pkg/agents/kubernetes"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	removedKubernetesClustersTTL = 24 * time.Hour
+)
+
+func normalizeKubernetesClusterIdentifier(report agentsk8s.Report) string {
+	if v := strings.TrimSpace(report.Cluster.ID); v != "" {
+		return v
+	}
+	if v := strings.TrimSpace(report.Agent.ID); v != "" {
+		return v
+	}
+
+	stableKey := strings.TrimSpace(report.Cluster.Server) + "|" + strings.TrimSpace(report.Cluster.Context) + "|" + strings.TrimSpace(report.Cluster.Name)
+	stableKey = strings.TrimSpace(stableKey)
+	if stableKey == "||" || stableKey == "" {
+		return ""
+	}
+
+	sum := sha256.Sum256([]byte(stableKey))
+	return hex.EncodeToString(sum[:])
+}
+
+// ApplyKubernetesReport ingests a Kubernetes agent report into state.
+func (m *Monitor) ApplyKubernetesReport(report agentsk8s.Report, tokenRecord *config.APITokenRecord) (models.KubernetesCluster, error) {
+	identifier := normalizeKubernetesClusterIdentifier(report)
+	if strings.TrimSpace(identifier) == "" {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes report missing cluster identifier")
+	}
+
+	// Check if this cluster was deliberately removed - reject report to prevent resurrection
+	m.mu.RLock()
+	removedAt, wasRemoved := m.removedKubernetesClusters[identifier]
+	m.mu.RUnlock()
+	if wasRemoved {
+		log.Info().
+			Str("k8sClusterID", identifier).
+			Time("removedAt", removedAt).
+			Msg("Rejecting report from deliberately removed Kubernetes cluster")
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster %q was removed at %v and cannot report again. Use Allow re-enroll in Settings -> Agents -> Removed Kubernetes Clusters or rerun the installer with a kubernetes:manage token to clear this block", identifier, removedAt.Format(time.RFC3339))
+	}
+
+	// Enforce token uniqueness: each token can only be bound to one cluster agent
+	if tokenRecord != nil && tokenRecord.ID != "" {
+		tokenID := strings.TrimSpace(tokenRecord.ID)
+		agentID := strings.TrimSpace(report.Agent.ID)
+		if agentID == "" {
+			agentID = identifier
+		}
+
+		m.mu.Lock()
+		if boundAgentID, exists := m.kubernetesTokenBindings[tokenID]; exists {
+			if boundAgentID != agentID {
+				m.mu.Unlock()
+				tokenHint := tokenHintFromRecord(tokenRecord)
+				if tokenHint != "" {
+					tokenHint = " (" + tokenHint + ")"
+				}
+				log.Warn().
+					Str("tokenID", tokenID).
+					Str("tokenHint", tokenHint).
+					Str("reportingAgentID", agentID).
+					Str("boundAgentID", boundAgentID).
+					Msg("Rejecting Kubernetes report: token already bound to different agent")
+				return models.KubernetesCluster{}, fmt.Errorf("API token%s is already in use by agent %q. Each Kubernetes agent must use a unique API token. Generate a new token for this agent", tokenHint, boundAgentID)
+			}
+		} else {
+			m.kubernetesTokenBindings[tokenID] = agentID
+			log.Debug().
+				Str("tokenID", tokenID).
+				Str("agentID", agentID).
+				Str("clusterID", identifier).
+				Msg("Bound Kubernetes agent token to agent identity")
+		}
+		m.mu.Unlock()
+	}
+
+	timestamp := report.Timestamp
+	if timestamp.IsZero() {
+		timestamp = time.Now()
+	}
+
+	agentID := strings.TrimSpace(report.Agent.ID)
+	if agentID == "" {
+		agentID = identifier
+	}
+
+	name := strings.TrimSpace(report.Cluster.Name)
+	displayName := name
+	if displayName == "" {
+		displayName = identifier
+	}
+
+	nodes := make([]models.KubernetesNode, 0, len(report.Nodes))
+	for _, n := range report.Nodes {
+		roles := append([]string(nil), n.Roles...)
+		nodes = append(nodes, models.KubernetesNode{
+			UID:                     strings.TrimSpace(n.UID),
+			Name:                    strings.TrimSpace(n.Name),
+			Ready:                   n.Ready,
+			Unschedulable:           n.Unschedulable,
+			KubeletVersion:          strings.TrimSpace(n.KubeletVersion),
+			ContainerRuntimeVersion: strings.TrimSpace(n.ContainerRuntimeVersion),
+			OSImage:                 strings.TrimSpace(n.OSImage),
+			KernelVersion:           strings.TrimSpace(n.KernelVersion),
+			Architecture:            strings.TrimSpace(n.Architecture),
+			CapacityCPU:             n.Capacity.CPUCores,
+			CapacityMemoryBytes:     n.Capacity.MemoryBytes,
+			CapacityPods:            n.Capacity.Pods,
+			AllocCPU:                n.Allocatable.CPUCores,
+			AllocMemoryBytes:        n.Allocatable.MemoryBytes,
+			AllocPods:               n.Allocatable.Pods,
+			Roles:                   roles,
+		})
+	}
+
+	pods := make([]models.KubernetesPod, 0, len(report.Pods))
+	for _, p := range report.Pods {
+		labels := make(map[string]string, len(p.Labels))
+		for k, v := range p.Labels {
+			labels[k] = v
+		}
+		containers := make([]models.KubernetesPodContainer, 0, len(p.Containers))
+		for _, c := range p.Containers {
+			containers = append(containers, models.KubernetesPodContainer{
+				Name:         strings.TrimSpace(c.Name),
+				Image:        strings.TrimSpace(c.Image),
+				Ready:        c.Ready,
+				RestartCount: c.RestartCount,
+				State:        strings.TrimSpace(c.State),
+				Reason:       strings.TrimSpace(c.Reason),
+				Message:      strings.TrimSpace(c.Message),
+			})
+		}
+		pods = append(pods, models.KubernetesPod{
+			UID:        strings.TrimSpace(p.UID),
+			Name:       strings.TrimSpace(p.Name),
+			Namespace:  strings.TrimSpace(p.Namespace),
+			NodeName:   strings.TrimSpace(p.NodeName),
+			Phase:      strings.TrimSpace(p.Phase),
+			Reason:     strings.TrimSpace(p.Reason),
+			Message:    strings.TrimSpace(p.Message),
+			QoSClass:   strings.TrimSpace(p.QoSClass),
+			CreatedAt:  p.CreatedAt,
+			StartTime:  p.StartTime,
+			Restarts:   p.Restarts,
+			Labels:     labels,
+			OwnerKind:  strings.TrimSpace(p.OwnerKind),
+			OwnerName:  strings.TrimSpace(p.OwnerName),
+			Containers: containers,
+		})
+	}
+
+	deployments := make([]models.KubernetesDeployment, 0, len(report.Deployments))
+	for _, d := range report.Deployments {
+		labels := make(map[string]string, len(d.Labels))
+		for k, v := range d.Labels {
+			labels[k] = v
+		}
+		deployments = append(deployments, models.KubernetesDeployment{
+			UID:               strings.TrimSpace(d.UID),
+			Name:              strings.TrimSpace(d.Name),
+			Namespace:         strings.TrimSpace(d.Namespace),
+			DesiredReplicas:   d.DesiredReplicas,
+			UpdatedReplicas:   d.UpdatedReplicas,
+			ReadyReplicas:     d.ReadyReplicas,
+			AvailableReplicas: d.AvailableReplicas,
+			Labels:            labels,
+		})
+	}
+
+	agentVersion := normalizeAgentVersion(report.Agent.Version)
+
+	cluster := models.KubernetesCluster{
+		ID:              identifier,
+		AgentID:         agentID,
+		Name:            name,
+		DisplayName:     displayName,
+		Server:          strings.TrimSpace(report.Cluster.Server),
+		Context:         strings.TrimSpace(report.Cluster.Context),
+		Version:         strings.TrimSpace(report.Cluster.Version),
+		Status:          "online",
+		LastSeen:        timestamp,
+		IntervalSeconds: report.Agent.IntervalSeconds,
+		AgentVersion:    agentVersion,
+		Nodes:           nodes,
+		Pods:            pods,
+		Deployments:     deployments,
+	}
+
+	if tokenRecord != nil {
+		cluster.TokenID = strings.TrimSpace(tokenRecord.ID)
+		cluster.TokenName = strings.TrimSpace(tokenRecord.Name)
+		cluster.TokenHint = tokenHintFromRecord(tokenRecord)
+		cluster.TokenLastUsedAt = tokenRecord.LastUsedAt
+	}
+
+	m.state.UpsertKubernetesCluster(cluster)
+	m.state.SetConnectionHealth(kubernetesConnectionPrefix+identifier, true)
+
+	return cluster, nil
+}
+
+// RemoveKubernetesCluster removes a kubernetes cluster from the shared state and clears related data.
+func (m *Monitor) RemoveKubernetesCluster(clusterID string) (models.KubernetesCluster, error) {
+	clusterID = strings.TrimSpace(clusterID)
+	if clusterID == "" {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster id is required")
+	}
+
+	cluster, removed := m.state.RemoveKubernetesCluster(clusterID)
+	if !removed {
+		if logging.IsLevelEnabled(zerolog.DebugLevel) {
+			log.Debug().Str("k8sClusterID", clusterID).Msg("Kubernetes cluster not present in state during removal; proceeding")
+		}
+		cluster = models.KubernetesCluster{
+			ID:          clusterID,
+			Name:        clusterID,
+			DisplayName: clusterID,
+		}
+	}
+
+	// Revoke the API token associated with this Kubernetes cluster
+	if cluster.TokenID != "" {
+		tokenRemoved := m.config.RemoveAPIToken(cluster.TokenID)
+		if tokenRemoved {
+			m.config.SortAPITokens()
+			m.config.APITokenEnabled = m.config.HasAPITokens()
+
+			if m.persistence != nil {
+				if err := m.persistence.SaveAPITokens(m.config.APITokens); err != nil {
+					log.Warn().Err(err).Str("tokenID", cluster.TokenID).Msg("Failed to persist API token revocation after Kubernetes cluster removal")
+				} else {
+					log.Info().Str("tokenID", cluster.TokenID).Str("tokenName", cluster.TokenName).Msg("API token revoked for removed Kubernetes cluster")
+				}
+			}
+		}
+	}
+
+	removedAt := time.Now()
+
+	m.mu.Lock()
+	m.removedKubernetesClusters[clusterID] = removedAt
+	if cluster.TokenID != "" {
+		delete(m.kubernetesTokenBindings, cluster.TokenID)
+		log.Debug().
+			Str("tokenID", cluster.TokenID).
+			Str("k8sClusterID", clusterID).
+			Msg("Unbound Kubernetes agent token from removed cluster")
+	}
+	m.mu.Unlock()
+
+	m.state.AddRemovedKubernetesCluster(models.RemovedKubernetesCluster{
+		ID:          clusterID,
+		Name:        cluster.Name,
+		DisplayName: cluster.DisplayName,
+		RemovedAt:   removedAt,
+	})
+
+	m.state.RemoveConnectionHealth(kubernetesConnectionPrefix + clusterID)
+
+	log.Info().
+		Str("k8sClusterID", clusterID).
+		Bool("removed", removed).
+		Msg("Kubernetes cluster removed")
+
+	return cluster, nil
+}
+
+// AllowKubernetesClusterReenroll clears the removal block for a kubernetes cluster.
+func (m *Monitor) AllowKubernetesClusterReenroll(clusterID string) error {
+	clusterID = strings.TrimSpace(clusterID)
+	if clusterID == "" {
+		return fmt.Errorf("kubernetes cluster id is required")
+	}
+
+	m.mu.Lock()
+	_, exists := m.removedKubernetesClusters[clusterID]
+	if !exists {
+		m.mu.Unlock()
+		return nil
+	}
+	delete(m.removedKubernetesClusters, clusterID)
+	m.mu.Unlock()
+
+	m.state.RemoveRemovedKubernetesCluster(clusterID)
+	return nil
+}
+
+// UnhideKubernetesCluster clears the hidden flag.
+func (m *Monitor) UnhideKubernetesCluster(clusterID string) (models.KubernetesCluster, error) {
+	clusterID = strings.TrimSpace(clusterID)
+	if clusterID == "" {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster id is required")
+	}
+
+	cluster, ok := m.state.SetKubernetesClusterHidden(clusterID, false)
+	if !ok {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster %q not found", clusterID)
+	}
+	return cluster, nil
+}
+
+// MarkKubernetesClusterPendingUninstall sets the pending uninstall flag on a cluster.
+func (m *Monitor) MarkKubernetesClusterPendingUninstall(clusterID string) (models.KubernetesCluster, error) {
+	clusterID = strings.TrimSpace(clusterID)
+	if clusterID == "" {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster id is required")
+	}
+
+	cluster, ok := m.state.SetKubernetesClusterPendingUninstall(clusterID, true)
+	if !ok {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster %q not found", clusterID)
+	}
+	return cluster, nil
+}
+
+// SetKubernetesClusterCustomDisplayName updates the custom display name for a cluster.
+func (m *Monitor) SetKubernetesClusterCustomDisplayName(clusterID, customName string) (models.KubernetesCluster, error) {
+	clusterID = strings.TrimSpace(clusterID)
+	if clusterID == "" {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster id is required")
+	}
+
+	cluster, ok := m.state.SetKubernetesClusterCustomDisplayName(clusterID, customName)
+	if !ok {
+		return models.KubernetesCluster{}, fmt.Errorf("kubernetes cluster %q not found", clusterID)
+	}
+	return cluster, nil
+}
+
+func (m *Monitor) evaluateKubernetesAgents(now time.Time) {
+	clusters := m.state.GetKubernetesClusters()
+	for _, cluster := range clusters {
+		interval := cluster.IntervalSeconds
+		if interval <= 0 {
+			interval = int(kubernetesMinimumHealthWindow / time.Second)
+		}
+
+		window := time.Duration(interval) * time.Second * kubernetesOfflineGraceMultiplier
+		if window < kubernetesMinimumHealthWindow {
+			window = kubernetesMinimumHealthWindow
+		} else if window > kubernetesMaximumHealthWindow {
+			window = kubernetesMaximumHealthWindow
+		}
+
+		healthy := !cluster.LastSeen.IsZero() && now.Sub(cluster.LastSeen) <= window
+		key := kubernetesConnectionPrefix + cluster.ID
+		m.state.SetConnectionHealth(key, healthy)
+		if healthy {
+			m.state.SetKubernetesClusterStatus(cluster.ID, "online")
+		} else {
+			m.state.SetKubernetesClusterStatus(cluster.ID, "offline")
+		}
+	}
+}
+
+func (m *Monitor) cleanupRemovedKubernetesClusters(now time.Time) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	for clusterID, removedAt := range m.removedKubernetesClusters {
+		if now.Sub(removedAt) > removedKubernetesClustersTTL {
+			delete(m.removedKubernetesClusters, clusterID)
+			m.state.RemoveRemovedKubernetesCluster(clusterID)
+			if logging.IsLevelEnabled(zerolog.DebugLevel) {
+				log.Debug().
+					Str("k8sClusterID", clusterID).
+					Time("removedAt", removedAt).
+					Msg("Cleaned up stale removed Kubernetes cluster block")
+			}
+		}
+	}
+}
diff --git a/internal/monitoring/metrics.db b/internal/monitoring/metrics.db
new file mode 100644
index 0000000..4d1f0c3
Binary files /dev/null and b/internal/monitoring/metrics.db differ
diff --git a/internal/monitoring/metrics_history.go b/internal/monitoring/metrics_history.go
index d80ea69..3b8095a 100644
--- a/internal/monitoring/metrics_history.go
+++ b/internal/monitoring/metrics_history.go
@@ -50,6 +50,16 @@ func NewMetricsHistory(maxDataPoints int, retentionTime time.Duration) *MetricsH
 	}
 }
 
+// Reset clears all historical metrics data.
+func (mh *MetricsHistory) Reset() {
+	mh.mu.Lock()
+	defer mh.mu.Unlock()
+
+	mh.guestMetrics = make(map[string]*GuestMetrics)
+	mh.nodeMetrics = make(map[string]*GuestMetrics)
+	mh.storageMetrics = make(map[string]*StorageMetrics)
+}
+
 // AddGuestMetric adds a metric value for a guest
 func (mh *MetricsHistory) AddGuestMetric(guestID string, metricType string, value float64, timestamp time.Time) {
 	mh.mu.Lock()
diff --git a/internal/monitoring/mock_metrics_history.go b/internal/monitoring/mock_metrics_history.go
new file mode 100644
index 0000000..f7e78f0
--- /dev/null
+++ b/internal/monitoring/mock_metrics_history.go
@@ -0,0 +1,411 @@
+package monitoring
+
+import (
+	"context"
+	"hash/fnv"
+	"math"
+	"math/rand"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/mock"
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+	"github.com/rs/zerolog/log"
+)
+
+const (
+	defaultMockSeedDuration   = time.Hour
+	defaultMockSampleInterval = 30 * time.Second
+)
+
+type mockMetricsSamplerConfig struct {
+	SeedDuration   time.Duration
+	SampleInterval time.Duration
+}
+
+func mockMetricsSamplerConfigFromEnv() mockMetricsSamplerConfig {
+	seedDuration := parseDurationEnv("PULSE_MOCK_TRENDS_SEED_DURATION", defaultMockSeedDuration)
+	sampleInterval := parseDurationEnv("PULSE_MOCK_TRENDS_SAMPLE_INTERVAL", defaultMockSampleInterval)
+
+	// Guardrails to keep memory and CPU bounded in demo mode.
+	if seedDuration < 5*time.Minute {
+		seedDuration = 5 * time.Minute
+	}
+	if seedDuration > 12*time.Hour {
+		seedDuration = 12 * time.Hour
+	}
+	if sampleInterval < 5*time.Second {
+		sampleInterval = 5 * time.Second
+	}
+	if sampleInterval > 5*time.Minute {
+		sampleInterval = 5 * time.Minute
+	}
+
+	// Ensure we can generate at least 2 points.
+	if seedDuration < sampleInterval {
+		seedDuration = sampleInterval
+	}
+
+	return mockMetricsSamplerConfig{
+		SeedDuration:   seedDuration,
+		SampleInterval: sampleInterval,
+	}
+}
+
+func hashSeed(parts ...string) uint64 {
+	h := fnv.New64a()
+	for _, p := range parts {
+		_, _ = h.Write([]byte(p))
+		_, _ = h.Write([]byte{0})
+	}
+	return h.Sum64()
+}
+
+type seededTrendClass int
+
+const (
+	trendStable seededTrendClass = iota
+	trendGrowing
+	trendDeclining
+	trendVolatile
+)
+
+func pickTrendClass(seed uint64) seededTrendClass {
+	switch seed % 4 {
+	case 0:
+		return trendStable
+	case 1:
+		return trendGrowing
+	case 2:
+		return trendDeclining
+	default:
+		return trendVolatile
+	}
+}
+
+func generateSeededSeries(current float64, points int, seed uint64, min, max float64) []float64 {
+	current = clampFloat(current, min, max)
+	if points <= 1 {
+		return []float64{current}
+	}
+
+	class := pickTrendClass(seed)
+	rng := rand.New(rand.NewSource(int64(seed))) // Deterministic per resource/metric
+	span := math.Max(1, max-min)
+
+	var totalSlope float64
+	var amplitude float64
+	var volatility float64
+
+	switch class {
+	case trendGrowing:
+		totalSlope = span * (0.06 + float64(seed%6)*0.01) // 6-11% of span over window
+		amplitude = span * 0.02
+		volatility = span * 0.01
+	case trendDeclining:
+		totalSlope = -span * (0.06 + float64(seed%6)*0.01)
+		amplitude = span * 0.02
+		volatility = span * 0.01
+	case trendVolatile:
+		totalSlope = 0
+		amplitude = span * (0.06 + float64(seed%6)*0.01)
+		volatility = span * 0.03
+	default:
+		totalSlope = 0
+		amplitude = span * 0.015
+		volatility = span * 0.007
+	}
+
+	cycles := int(seed%3) + 1
+	lastIdx := float64(points - 1)
+	slopePerStep := totalSlope / lastIdx
+
+	raw := make([]float64, points)
+	for i := 0; i < points; i++ {
+		progress := float64(i) / lastIdx
+		// 0 at both ends (progress 0 and 1), so the end value can align cleanly.
+		wave := math.Sin(2 * math.Pi * float64(cycles) * progress)
+		noiseScale := 1 - progress
+		noise := rng.NormFloat64() * volatility * noiseScale
+		raw[i] = current + slopePerStep*float64(i-(points-1)) + amplitude*wave + noise
+	}
+
+	// Shift so the last point exactly matches current.
+	offset := current - raw[points-1]
+	for i := range raw {
+		raw[i] = clampFloat(raw[i]+offset, min, max)
+	}
+	raw[points-1] = current
+	return raw
+}
+
+func seedMockMetricsHistory(mh *MetricsHistory, state models.StateSnapshot, now time.Time, seedDuration, interval time.Duration) {
+	if mh == nil {
+		return
+	}
+	if seedDuration <= 0 || interval <= 0 {
+		return
+	}
+
+	points := int(seedDuration/interval) + 1
+	if points < 2 {
+		points = 2
+	}
+
+	start := now.Add(-time.Duration(points-1) * interval)
+
+	recordNode := func(node models.Node) {
+		if node.ID == "" {
+			return
+		}
+
+		cpuSeries := generateSeededSeries(node.CPU*100, points, hashSeed("node", node.ID, "cpu"), 5, 85)
+		memSeries := generateSeededSeries(node.Memory.Usage, points, hashSeed("node", node.ID, "memory"), 10, 85)
+		diskSeries := generateSeededSeries(node.Disk.Usage, points, hashSeed("node", node.ID, "disk"), 5, 95)
+
+		for i := 0; i < points; i++ {
+			ts := start.Add(time.Duration(i) * interval)
+			mh.AddNodeMetric(node.ID, "cpu", cpuSeries[i], ts)
+			mh.AddNodeMetric(node.ID, "memory", memSeries[i], ts)
+			mh.AddNodeMetric(node.ID, "disk", diskSeries[i], ts)
+		}
+	}
+
+	recordGuest := func(id string, cpuPercent, memPercent, diskPercent float64) {
+		if id == "" {
+			return
+		}
+		cpuSeries := generateSeededSeries(cpuPercent, points, hashSeed("guest", id, "cpu"), 0, 100)
+		memSeries := generateSeededSeries(memPercent, points, hashSeed("guest", id, "memory"), 0, 100)
+		diskSeries := generateSeededSeries(diskPercent, points, hashSeed("guest", id, "disk"), 0, 100)
+
+		for i := 0; i < points; i++ {
+			ts := start.Add(time.Duration(i) * interval)
+			mh.AddGuestMetric(id, "cpu", cpuSeries[i], ts)
+			mh.AddGuestMetric(id, "memory", memSeries[i], ts)
+			mh.AddGuestMetric(id, "disk", diskSeries[i], ts)
+		}
+	}
+
+	for _, node := range state.Nodes {
+		recordNode(node)
+	}
+
+	for _, vm := range state.VMs {
+		if vm.Status != "running" {
+			continue
+		}
+		recordGuest(vm.ID, vm.CPU*100, vm.Memory.Usage, vm.Disk.Usage)
+	}
+
+	for _, ct := range state.Containers {
+		if ct.Status != "running" {
+			continue
+		}
+		recordGuest(ct.ID, ct.CPU*100, ct.Memory.Usage, ct.Disk.Usage)
+	}
+
+	for _, storage := range state.Storage {
+		if storage.ID == "" {
+			continue
+		}
+		usageSeries := generateSeededSeries(storage.Usage, points, hashSeed("storage", storage.ID, "usage"), 0, 100)
+		for i := 0; i < points; i++ {
+			ts := start.Add(time.Duration(i) * interval)
+			mh.AddStorageMetric(storage.ID, "usage", usageSeries[i], ts)
+			mh.AddStorageMetric(storage.ID, "used", float64(storage.Used), ts)
+			mh.AddStorageMetric(storage.ID, "total", float64(storage.Total), ts)
+			mh.AddStorageMetric(storage.ID, "avail", float64(storage.Free), ts)
+		}
+	}
+
+	for _, host := range state.DockerHosts {
+		if host.ID == "" {
+			continue
+		}
+
+		var diskPercent float64
+		var usedTotal, totalTotal int64
+		for _, d := range host.Disks {
+			if d.Total > 0 {
+				usedTotal += d.Used
+				totalTotal += d.Total
+			}
+		}
+		if totalTotal > 0 {
+			diskPercent = float64(usedTotal) / float64(totalTotal) * 100
+		}
+
+		recordGuest("dockerHost:"+host.ID, host.CPUUsage, host.Memory.Usage, diskPercent)
+
+		for _, container := range host.Containers {
+			if container.ID == "" || container.State != "running" {
+				continue
+			}
+
+			var containerDisk float64
+			if container.RootFilesystemBytes > 0 && container.WritableLayerBytes > 0 {
+				containerDisk = float64(container.WritableLayerBytes) / float64(container.RootFilesystemBytes) * 100
+				containerDisk = clampFloat(containerDisk, 0, 100)
+			}
+			recordGuest("docker:"+container.ID, container.CPUPercent, container.MemoryPercent, containerDisk)
+		}
+	}
+}
+
+func recordMockStateToMetricsHistory(mh *MetricsHistory, state models.StateSnapshot, ts time.Time) {
+	if mh == nil {
+		return
+	}
+
+	for _, node := range state.Nodes {
+		if node.ID == "" || node.Status != "online" {
+			continue
+		}
+		mh.AddNodeMetric(node.ID, "cpu", node.CPU*100, ts)
+		mh.AddNodeMetric(node.ID, "memory", node.Memory.Usage, ts)
+		mh.AddNodeMetric(node.ID, "disk", node.Disk.Usage, ts)
+	}
+
+	for _, vm := range state.VMs {
+		if vm.ID == "" || vm.Status != "running" {
+			continue
+		}
+		mh.AddGuestMetric(vm.ID, "cpu", vm.CPU*100, ts)
+		mh.AddGuestMetric(vm.ID, "memory", vm.Memory.Usage, ts)
+		mh.AddGuestMetric(vm.ID, "disk", vm.Disk.Usage, ts)
+		mh.AddGuestMetric(vm.ID, "diskread", float64(vm.DiskRead), ts)
+		mh.AddGuestMetric(vm.ID, "diskwrite", float64(vm.DiskWrite), ts)
+		mh.AddGuestMetric(vm.ID, "netin", float64(vm.NetworkIn), ts)
+		mh.AddGuestMetric(vm.ID, "netout", float64(vm.NetworkOut), ts)
+	}
+
+	for _, ct := range state.Containers {
+		if ct.ID == "" || ct.Status != "running" {
+			continue
+		}
+		mh.AddGuestMetric(ct.ID, "cpu", ct.CPU*100, ts)
+		mh.AddGuestMetric(ct.ID, "memory", ct.Memory.Usage, ts)
+		mh.AddGuestMetric(ct.ID, "disk", ct.Disk.Usage, ts)
+		mh.AddGuestMetric(ct.ID, "diskread", float64(ct.DiskRead), ts)
+		mh.AddGuestMetric(ct.ID, "diskwrite", float64(ct.DiskWrite), ts)
+		mh.AddGuestMetric(ct.ID, "netin", float64(ct.NetworkIn), ts)
+		mh.AddGuestMetric(ct.ID, "netout", float64(ct.NetworkOut), ts)
+	}
+
+	for _, storage := range state.Storage {
+		if storage.ID == "" || storage.Status != "available" {
+			continue
+		}
+		mh.AddStorageMetric(storage.ID, "usage", storage.Usage, ts)
+		mh.AddStorageMetric(storage.ID, "used", float64(storage.Used), ts)
+		mh.AddStorageMetric(storage.ID, "total", float64(storage.Total), ts)
+		mh.AddStorageMetric(storage.ID, "avail", float64(storage.Free), ts)
+	}
+
+	for _, host := range state.DockerHosts {
+		if host.ID == "" || host.Status != "online" {
+			continue
+		}
+
+		var diskPercent float64
+		var usedTotal, totalTotal int64
+		for _, d := range host.Disks {
+			if d.Total > 0 {
+				usedTotal += d.Used
+				totalTotal += d.Total
+			}
+		}
+		if totalTotal > 0 {
+			diskPercent = float64(usedTotal) / float64(totalTotal) * 100
+		}
+
+		hostKey := "dockerHost:" + host.ID
+		mh.AddGuestMetric(hostKey, "cpu", host.CPUUsage, ts)
+		mh.AddGuestMetric(hostKey, "memory", host.Memory.Usage, ts)
+		mh.AddGuestMetric(hostKey, "disk", diskPercent, ts)
+
+		for _, container := range host.Containers {
+			if container.ID == "" || container.State != "running" {
+				continue
+			}
+
+			var containerDisk float64
+			if container.RootFilesystemBytes > 0 && container.WritableLayerBytes > 0 {
+				containerDisk = float64(container.WritableLayerBytes) / float64(container.RootFilesystemBytes) * 100
+				containerDisk = clampFloat(containerDisk, 0, 100)
+			}
+
+			metricKey := "docker:" + container.ID
+			mh.AddGuestMetric(metricKey, "cpu", container.CPUPercent, ts)
+			mh.AddGuestMetric(metricKey, "memory", container.MemoryPercent, ts)
+			mh.AddGuestMetric(metricKey, "disk", containerDisk, ts)
+		}
+	}
+}
+
+func (m *Monitor) startMockMetricsSampler(ctx context.Context) {
+	if ctx == nil || m == nil {
+		return
+	}
+	if !mock.IsMockEnabled() {
+		return
+	}
+
+	cfg := mockMetricsSamplerConfigFromEnv()
+
+	m.mu.Lock()
+	if m.mockMetricsCancel != nil {
+		m.mu.Unlock()
+		return
+	}
+	samplerCtx, cancel := context.WithCancel(ctx)
+	m.mockMetricsCancel = cancel
+	m.mu.Unlock()
+
+	m.metricsHistory.Reset()
+	state := mock.GetMockState()
+	seedMockMetricsHistory(m.metricsHistory, state, time.Now(), cfg.SeedDuration, cfg.SampleInterval)
+	recordMockStateToMetricsHistory(m.metricsHistory, state, time.Now())
+
+	m.mockMetricsWg.Add(1)
+	go func() {
+		defer m.mockMetricsWg.Done()
+
+		ticker := time.NewTicker(cfg.SampleInterval)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-samplerCtx.Done():
+				return
+			case <-ticker.C:
+				if !mock.IsMockEnabled() {
+					continue
+				}
+				recordMockStateToMetricsHistory(m.metricsHistory, mock.GetMockState(), time.Now())
+			}
+		}
+	}()
+
+	log.Info().
+		Dur("seedDuration", cfg.SeedDuration).
+		Dur("sampleInterval", cfg.SampleInterval).
+		Msg("Mock metrics history sampler started")
+}
+
+func (m *Monitor) stopMockMetricsSampler() {
+	if m == nil {
+		return
+	}
+
+	m.mu.Lock()
+	cancel := m.mockMetricsCancel
+	m.mockMetricsCancel = nil
+	m.mu.Unlock()
+
+	if cancel != nil {
+		cancel()
+		m.mockMetricsWg.Wait()
+		log.Info().Msg("Mock metrics history sampler stopped")
+	}
+}
diff --git a/internal/monitoring/mock_metrics_history_test.go b/internal/monitoring/mock_metrics_history_test.go
new file mode 100644
index 0000000..660f72f
--- /dev/null
+++ b/internal/monitoring/mock_metrics_history_test.go
@@ -0,0 +1,102 @@
+package monitoring
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+func TestSeedMockMetricsHistory_PopulatesSeries(t *testing.T) {
+	now := time.Now()
+
+	state := models.StateSnapshot{
+		Nodes: []models.Node{
+			{
+				ID:     "node-1",
+				Status: "online",
+				CPU:    0.33,
+				Memory: models.Memory{Usage: 62, Total: 128 * 1024 * 1024 * 1024},
+				Disk:   models.Disk{Usage: 41, Total: 1024, Used: 512},
+			},
+		},
+		VMs: []models.VM{
+			{
+				ID:     "vm-100",
+				Status: "running",
+				CPU:    0.21,
+				Memory: models.Memory{Usage: 47, Total: 8 * 1024 * 1024 * 1024},
+				Disk:   models.Disk{Usage: 28, Total: 1024, Used: 256},
+			},
+		},
+		Containers: []models.Container{
+			{
+				ID:     "ct-200",
+				Status: "running",
+				CPU:    0.09,
+				Memory: models.Memory{Usage: 53, Total: 2 * 1024 * 1024 * 1024},
+				Disk:   models.Disk{Usage: 17, Total: 512, Used: 128},
+			},
+		},
+		Storage: []models.Storage{
+			{
+				ID:     "local",
+				Status: "available",
+				Total:  1000,
+				Used:   420,
+				Free:   580,
+				Usage:  42,
+			},
+		},
+		DockerHosts: []models.DockerHost{
+			{
+				ID:       "host-1",
+				Status:   "online",
+				CPUUsage: 22.5,
+				Memory:   models.Memory{Usage: 58, Total: 16 * 1024 * 1024 * 1024},
+				Disks: []models.Disk{
+					{Total: 1000, Used: 600, Usage: 60},
+				},
+				Containers: []models.DockerContainer{
+					{
+						ID:                  "cont-1",
+						State:               "running",
+						CPUPercent:          3.3,
+						MemoryPercent:       11.2,
+						WritableLayerBytes:  10,
+						RootFilesystemBytes: 100,
+					},
+				},
+			},
+		},
+	}
+
+	mh := NewMetricsHistory(1000, 24*time.Hour)
+	seedMockMetricsHistory(mh, state, now, time.Hour, 30*time.Second)
+
+	nodeCPU := mh.GetNodeMetrics("node-1", "cpu", time.Hour)
+	if len(nodeCPU) < 10 {
+		t.Fatalf("expected seeded node cpu points, got %d", len(nodeCPU))
+	}
+	if got, want := nodeCPU[len(nodeCPU)-1].Value, state.Nodes[0].CPU*100; math.Abs(got-want) > 1e-9 {
+		t.Fatalf("expected last node cpu point to match current, got=%v want=%v", got, want)
+	}
+
+	vmCPU := mh.GetGuestMetrics("vm-100", "cpu", time.Hour)
+	if len(vmCPU) < 10 {
+		t.Fatalf("expected seeded vm cpu points, got %d", len(vmCPU))
+	}
+	if got, want := vmCPU[len(vmCPU)-1].Value, state.VMs[0].CPU*100; math.Abs(got-want) > 1e-9 {
+		t.Fatalf("expected last vm cpu point to match current, got=%v want=%v", got, want)
+	}
+
+	dockerCPU := mh.GetGuestMetrics("docker:cont-1", "cpu", time.Hour)
+	if len(dockerCPU) < 10 {
+		t.Fatalf("expected seeded docker container cpu points, got %d", len(dockerCPU))
+	}
+	if got, want := dockerCPU[len(dockerCPU)-1].Value, state.DockerHosts[0].Containers[0].CPUPercent; math.Abs(got-want) > 1e-9 {
+		t.Fatalf("expected last docker cpu point to match current, got=%v want=%v", got, want)
+	}
+}
+
diff --git a/internal/monitoring/monitor.go b/internal/monitoring/monitor.go
index e931415..f94e8a7 100644
--- a/internal/monitoring/monitor.go
+++ b/internal/monitoring/monitor.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/sha1"
 	"encoding/hex"
+	"encoding/json"
 	stderrors "errors"
 	"fmt"
 	"math"
@@ -24,9 +25,11 @@ import (
 	"github.com/rcourtman/pulse-go-rewrite/internal/discovery"
 	"github.com/rcourtman/pulse-go-rewrite/internal/errors"
 	"github.com/rcourtman/pulse-go-rewrite/internal/logging"
+	"github.com/rcourtman/pulse-go-rewrite/internal/metrics"
 	"github.com/rcourtman/pulse-go-rewrite/internal/mock"
 	"github.com/rcourtman/pulse-go-rewrite/internal/models"
 	"github.com/rcourtman/pulse-go-rewrite/internal/notifications"
+	"github.com/rcourtman/pulse-go-rewrite/internal/resources"
 	"github.com/rcourtman/pulse-go-rewrite/internal/system"
 	"github.com/rcourtman/pulse-go-rewrite/internal/tempproxy"
 	"github.com/rcourtman/pulse-go-rewrite/internal/types"
@@ -79,6 +82,21 @@ type PVEClientInterface interface {
 	GetCephDF(ctx context.Context) (*proxmox.CephDF, error)
 }
 
+// ResourceStoreInterface provides methods for polling optimization and resource access.
+// When an agent is monitoring a node, we can reduce API polling for that node.
+type ResourceStoreInterface interface {
+	// ShouldSkipAPIPolling returns true if API polling should be skipped for the hostname
+	// because an agent is providing richer data.
+	ShouldSkipAPIPolling(hostname string) bool
+	// GetPollingRecommendations returns a map of hostname -> polling multiplier.
+	// 0 = skip entirely, 0.5 = half frequency, 1 = normal
+	GetPollingRecommendations() map[string]float64
+	// GetAll returns all resources in the store (for WebSocket broadcasts)
+	GetAll() []resources.Resource
+	// PopulateFromSnapshot updates the store with data from a StateSnapshot
+	PopulateFromSnapshot(snapshot models.StateSnapshot)
+}
+
 func getNodeDisplayName(instance *config.PVEInstance, nodeName string) string {
 	baseName := strings.TrimSpace(nodeName)
 	if baseName == "" {
@@ -144,6 +162,18 @@ func mergeNVMeTempsIntoDisks(disks []models.PhysicalDisk, nodes []models.Node) [
 	nvmeTempsByNode := make(map[string][]models.NVMeTemp)
 
 	for _, node := range nodes {
+		log.Debug().
+			Str("nodeName", node.Name).
+			Bool("hasTemp", node.Temperature != nil).
+			Bool("tempAvailable", node.Temperature != nil && node.Temperature.Available).
+			Int("smartCount", func() int {
+				if node.Temperature != nil {
+					return len(node.Temperature.SMART)
+				}
+				return 0
+			}()).
+			Msg("mergeNVMeTempsIntoDisks: checking node temperature")
+
 		if node.Temperature == nil || !node.Temperature.Available {
 			continue
 		}
@@ -153,6 +183,10 @@ func mergeNVMeTempsIntoDisks(disks []models.PhysicalDisk, nodes []models.Node) [
 			temps := make([]models.DiskTemp, len(node.Temperature.SMART))
 			copy(temps, node.Temperature.SMART)
 			smartTempsByNode[node.Name] = temps
+			log.Debug().
+				Str("nodeName", node.Name).
+				Int("smartTempCount", len(temps)).
+				Msg("mergeNVMeTempsIntoDisks: collected SMART temps for node")
 		}
 
 		// Collect legacy NVMe temps as fallback
@@ -167,15 +201,30 @@ func mergeNVMeTempsIntoDisks(disks []models.PhysicalDisk, nodes []models.Node) [
 	}
 
 	if len(smartTempsByNode) == 0 && len(nvmeTempsByNode) == 0 {
+		log.Debug().
+			Int("diskCount", len(disks)).
+			Msg("mergeNVMeTempsIntoDisks: no SMART or NVMe temperature data available")
 		return disks
 	}
 
+	log.Debug().
+		Int("smartNodeCount", len(smartTempsByNode)).
+		Int("nvmeNodeCount", len(nvmeTempsByNode)).
+		Int("diskCount", len(disks)).
+		Msg("mergeNVMeTempsIntoDisks: starting disk temperature merge")
+
 	updated := make([]models.PhysicalDisk, len(disks))
 	copy(updated, disks)
 
 	// Process SMART temperatures first (preferred method)
 	for i := range updated {
 		smartTemps, ok := smartTempsByNode[updated[i].Node]
+		log.Debug().
+			Str("diskDevPath", updated[i].DevPath).
+			Str("diskNode", updated[i].Node).
+			Bool("hasSMARTData", ok).
+			Int("smartTempCount", len(smartTemps)).
+			Msg("mergeNVMeTempsIntoDisks: checking disk for SMART temp match")
 		if !ok || len(smartTemps) == 0 {
 			continue
 		}
@@ -553,6 +602,7 @@ type Monitor struct {
 	startTime                  time.Time
 	rateTracker                *RateTracker
 	metricsHistory             *MetricsHistory
+	metricsStore               *metrics.Store // Persistent SQLite metrics storage
 	alertManager               *alerts.Manager
 	notificationMgr            *notifications.NotificationManager
 	configPersist              *config.ConfigPersistence
@@ -576,6 +626,8 @@ type Monitor struct {
 	nodeRRDMemCache            map[string]rrdMemCacheEntry
 	removedDockerHosts         map[string]time.Time // Track deliberately removed Docker hosts (ID -> removal time)
 	dockerTokenBindings        map[string]string    // Track token ID -> agent ID bindings to enforce uniqueness
+	removedKubernetesClusters  map[string]time.Time // Track deliberately removed Kubernetes clusters (ID -> removal time)
+	kubernetesTokenBindings    map[string]string    // Track token ID -> agent ID bindings to enforce uniqueness
 	hostTokenBindings          map[string]string    // Track token ID -> agent ID bindings to enforce uniqueness
 	dockerCommands             map[string]*dockerHostCommand
 	dockerCommandIndex         map[string]string
@@ -601,7 +653,10 @@ type Monitor struct {
 	instanceInfoCache        map[string]*instanceInfo
 	pollStatusMap            map[string]*pollStatus
 	dlqInsightMap            map[string]*dlqInsight
-	nodeLastOnline           map[string]time.Time // Track last time each node was seen online (for grace period)
+	nodeLastOnline           map[string]time.Time   // Track last time each node was seen online (for grace period)
+	resourceStore            ResourceStoreInterface // Optional unified resource store for polling optimization
+	mockMetricsCancel         context.CancelFunc
+	mockMetricsWg             sync.WaitGroup
 }
 
 type rrdMemCacheEntry struct {
@@ -866,17 +921,21 @@ func (m *Monitor) shouldRunBackupPoll(last time.Time, now time.Time) (bool, stri
 }
 
 const (
-	dockerConnectionPrefix       = "docker-"
-	hostConnectionPrefix         = "host-"
-	dockerOfflineGraceMultiplier = 4
-	dockerMinimumHealthWindow    = 30 * time.Second
-	dockerMaximumHealthWindow    = 10 * time.Minute
-	hostOfflineGraceMultiplier   = 4
-	hostMinimumHealthWindow      = 30 * time.Second
-	hostMaximumHealthWindow      = 10 * time.Minute
-	nodeOfflineGracePeriod       = 60 * time.Second // Grace period before marking Proxmox nodes offline
-	nodeRRDCacheTTL              = 30 * time.Second
-	nodeRRDRequestTimeout        = 2 * time.Second
+	dockerConnectionPrefix           = "docker-"
+	kubernetesConnectionPrefix       = "kubernetes-"
+	hostConnectionPrefix             = "host-"
+	dockerOfflineGraceMultiplier     = 4
+	dockerMinimumHealthWindow        = 30 * time.Second
+	dockerMaximumHealthWindow        = 10 * time.Minute
+	kubernetesOfflineGraceMultiplier = 4
+	kubernetesMinimumHealthWindow    = 30 * time.Second
+	kubernetesMaximumHealthWindow    = 10 * time.Minute
+	hostOfflineGraceMultiplier       = 6
+	hostMinimumHealthWindow          = 60 * time.Second
+	hostMaximumHealthWindow          = 10 * time.Minute
+	nodeOfflineGracePeriod           = 60 * time.Second // Grace period before marking Proxmox nodes offline
+	nodeRRDCacheTTL                  = 30 * time.Second
+	nodeRRDRequestTimeout            = 2 * time.Second
 )
 
 type taskOutcome struct {
@@ -1712,6 +1771,63 @@ func (m *Monitor) ApplyDockerReport(report agentsdocker.Report, tokenRecord *con
 		m.alertManager.CheckDockerHost(host)
 	}
 
+	// Record Docker HOST metrics for sparkline charts
+	now := time.Now()
+	hostMetricKey := fmt.Sprintf("dockerHost:%s", host.ID)
+
+	// Record host CPU usage
+	m.metricsHistory.AddGuestMetric(hostMetricKey, "cpu", host.CPUUsage, now)
+
+	// Record host Memory usage
+	m.metricsHistory.AddGuestMetric(hostMetricKey, "memory", host.Memory.Usage, now)
+
+	// Record host Disk usage (use first disk or calculate total)
+	var hostDiskPercent float64
+	if len(host.Disks) > 0 {
+		hostDiskPercent = host.Disks[0].Usage
+	}
+	m.metricsHistory.AddGuestMetric(hostMetricKey, "disk", hostDiskPercent, now)
+
+	// Also write to persistent SQLite store
+	if m.metricsStore != nil {
+		m.metricsStore.Write("dockerHost", host.ID, "cpu", host.CPUUsage, now)
+		m.metricsStore.Write("dockerHost", host.ID, "memory", host.Memory.Usage, now)
+		m.metricsStore.Write("dockerHost", host.ID, "disk", hostDiskPercent, now)
+	}
+
+	// Record Docker CONTAINER metrics for sparkline charts
+	// Use a prefixed key (docker:containerID) to distinguish from Proxmox containers
+	for _, container := range containers {
+		if container.ID == "" {
+			continue
+		}
+		// Build a unique metric key for Docker containers
+		metricKey := fmt.Sprintf("docker:%s", container.ID)
+
+		// Record CPU (already a percentage 0-100)
+		m.metricsHistory.AddGuestMetric(metricKey, "cpu", container.CPUPercent, now)
+
+		// Record Memory (already a percentage 0-100)
+		m.metricsHistory.AddGuestMetric(metricKey, "memory", container.MemoryPercent, now)
+
+		// Record Disk usage as percentage of writable layer vs root filesystem
+		var diskPercent float64
+		if container.RootFilesystemBytes > 0 && container.WritableLayerBytes > 0 {
+			diskPercent = float64(container.WritableLayerBytes) / float64(container.RootFilesystemBytes) * 100
+			if diskPercent > 100 {
+				diskPercent = 100
+			}
+		}
+		m.metricsHistory.AddGuestMetric(metricKey, "disk", diskPercent, now)
+
+		// Also write to persistent SQLite store for long-term storage
+		if m.metricsStore != nil {
+			m.metricsStore.Write("dockerContainer", container.ID, "cpu", container.CPUPercent, now)
+			m.metricsStore.Write("dockerContainer", container.ID, "memory", container.MemoryPercent, now)
+			m.metricsStore.Write("dockerContainer", container.ID, "disk", diskPercent, now)
+		}
+	}
+
 	log.Debug().
 		Str("dockerHost", host.Hostname).
 		Int("containers", len(containers)).
@@ -1875,6 +1991,20 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 		})
 	}
 
+	diskIO := make([]models.DiskIO, 0, len(report.DiskIO))
+	for _, io := range report.DiskIO {
+		diskIO = append(diskIO, models.DiskIO{
+			Device:     io.Device,
+			ReadBytes:  io.ReadBytes,
+			WriteBytes: io.WriteBytes,
+			ReadOps:    io.ReadOps,
+			WriteOps:   io.WriteOps,
+			ReadTime:   io.ReadTime,
+			WriteTime:  io.WriteTime,
+			IOTime:     io.IOTime,
+		})
+	}
+
 	network := make([]models.HostNetworkInterface, 0, len(report.Network))
 	for _, nic := range report.Network {
 		network = append(network, models.HostNetworkInterface{
@@ -1914,6 +2044,12 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 		})
 	}
 
+	// Convert Ceph data from agent report
+	var cephData *models.HostCephCluster
+	if report.Ceph != nil {
+		cephData = convertAgentCephToModels(report.Ceph)
+	}
+
 	host := models.Host{
 		ID:                identifier,
 		Hostname:          hostname,
@@ -1928,6 +2064,7 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 		LoadAverage:       append([]float64(nil), report.Host.LoadAverage...),
 		Memory:            memory,
 		Disks:             disks,
+		DiskIO:            diskIO,
 		NetworkInterfaces: network,
 		Sensors: models.HostSensorSummary{
 			TemperatureCelsius: cloneStringFloatMap(report.Sensors.TemperatureCelsius),
@@ -1935,6 +2072,7 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 			Additional:         cloneStringFloatMap(report.Sensors.Additional),
 		},
 		RAID:            raid,
+		Ceph:            cephData,
 		Status:          "online",
 		UptimeSeconds:   report.Host.UptimeSeconds,
 		IntervalSeconds: report.Agent.IntervalSeconds,
@@ -1950,6 +2088,9 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 	if len(host.Disks) == 0 {
 		host.Disks = nil
 	}
+	if len(host.DiskIO) == 0 {
+		host.DiskIO = nil
+	}
 	if len(host.NetworkInterfaces) == 0 {
 		host.NetworkInterfaces = nil
 	}
@@ -1978,6 +2119,19 @@ func (m *Monitor) ApplyHostReport(report agentshost.Report, tokenRecord *config.
 	m.state.UpsertHost(host)
 	m.state.SetConnectionHealth(hostConnectionPrefix+host.ID, true)
 
+	// If host reports Ceph data, also update the global CephClusters state
+	if report.Ceph != nil {
+		cephCluster := convertAgentCephToGlobalCluster(report.Ceph, hostname, identifier, timestamp)
+		m.state.UpsertCephCluster(cephCluster)
+		log.Debug().
+			Str("hostId", identifier).
+			Str("hostname", hostname).
+			Str("fsid", cephCluster.FSID).
+			Str("health", cephCluster.Health).
+			Int("osds", cephCluster.NumOSDs).
+			Msg("Updated Ceph cluster from host agent")
+	}
+
 	if m.alertManager != nil {
 		m.alertManager.CheckHost(host)
 	}
@@ -2152,19 +2306,41 @@ func (m *Monitor) evaluateHostAgents(now time.Time) {
 			window = hostMaximumHealthWindow
 		}
 
-		healthy := !host.LastSeen.IsZero() && now.Sub(host.LastSeen) <= window
+		age := now.Sub(host.LastSeen)
+		healthy := !host.LastSeen.IsZero() && age <= window
 		key := hostConnectionPrefix + host.ID
 		m.state.SetConnectionHealth(key, healthy)
 
 		hostCopy := host
 		if healthy {
 			hostCopy.Status = "online"
+			// Log status transition from offline to online
+			if host.Status == "offline" {
+				log.Debug().
+					Str("hostID", host.ID).
+					Str("hostname", host.Hostname).
+					Dur("age", age).
+					Dur("window", window).
+					Msg("Host agent back online")
+			}
 			m.state.SetHostStatus(host.ID, "online")
 			if m.alertManager != nil {
 				m.alertManager.HandleHostOnline(hostCopy)
 			}
 		} else {
 			hostCopy.Status = "offline"
+			// Log status transition from online to offline with diagnostic info
+			if host.Status == "online" || host.Status == "" {
+				log.Debug().
+					Str("hostID", host.ID).
+					Str("hostname", host.Hostname).
+					Time("lastSeen", host.LastSeen).
+					Dur("age", age).
+					Dur("window", window).
+					Int("intervalSeconds", host.IntervalSeconds).
+					Bool("lastSeenZero", host.LastSeen.IsZero()).
+					Msg("Host agent appears offline")
+			}
 			m.state.SetHostStatus(host.ID, "offline")
 			if m.alertManager != nil {
 				m.alertManager.HandleHostOffline(hostCopy)
@@ -2190,25 +2366,28 @@ func (m *Monitor) enrichContainerMetadata(ctx context.Context, client PVEClientI
 
 	ensureContainerRootDiskEntry(container)
 
-	if client == nil || container.Status != "running" {
+	if client == nil {
 		return
 	}
 
-	statusCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	status, err := client.GetContainerStatus(statusCtx, nodeName, container.VMID)
-	cancel()
-	if err != nil {
-		log.Debug().
-			Err(err).
-			Str("instance", instanceName).
-			Str("node", nodeName).
-			Str("container", container.Name).
-			Int("vmid", container.VMID).
-			Msg("Container status metadata unavailable")
-		return
-	}
-	if status == nil {
-		return
+	isRunning := container.Status == "running"
+
+	var status *proxmox.Container
+	if isRunning {
+		statusCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		statusResp, err := client.GetContainerStatus(statusCtx, nodeName, container.VMID)
+		cancel()
+		if err != nil {
+			log.Debug().
+				Err(err).
+				Str("instance", instanceName).
+				Str("node", nodeName).
+				Str("container", container.Name).
+				Int("vmid", container.VMID).
+				Msg("Container status metadata unavailable")
+		} else {
+			status = statusResp
+		}
 	}
 
 	rootDeviceHint := ""
@@ -2228,55 +2407,60 @@ func (m *Monitor) enrichContainerMetadata(ctx context.Context, client PVEClientI
 		addressOrder = append(addressOrder, addr)
 	}
 
-	for _, addr := range sanitizeGuestAddressStrings(status.IP) {
-		addAddress(addr)
-	}
-	for _, addr := range sanitizeGuestAddressStrings(status.IP6) {
-		addAddress(addr)
-	}
-	for _, addr := range parseContainerRawIPs(status.IPv4) {
-		addAddress(addr)
-	}
-	for _, addr := range parseContainerRawIPs(status.IPv6) {
-		addAddress(addr)
+	if status != nil {
+		for _, addr := range sanitizeGuestAddressStrings(status.IP) {
+			addAddress(addr)
+		}
+		for _, addr := range sanitizeGuestAddressStrings(status.IP6) {
+			addAddress(addr)
+		}
+		for _, addr := range parseContainerRawIPs(status.IPv4) {
+			addAddress(addr)
+		}
+		for _, addr := range parseContainerRawIPs(status.IPv6) {
+			addAddress(addr)
+		}
 	}
 
-	networkIfaces := make([]models.GuestNetworkInterface, 0, len(status.Network))
-	for rawName, cfg := range status.Network {
-		if cfg == (proxmox.ContainerNetworkConfig{}) {
-			continue
-		}
+	networkIfaces := make([]models.GuestNetworkInterface, 0, 4)
+	if status != nil {
+		networkIfaces = make([]models.GuestNetworkInterface, 0, len(status.Network))
+		for rawName, cfg := range status.Network {
+			if cfg == (proxmox.ContainerNetworkConfig{}) {
+				continue
+			}
 
-		iface := models.GuestNetworkInterface{}
-		name := strings.TrimSpace(cfg.Name)
-		if name == "" {
-			name = strings.TrimSpace(rawName)
-		}
-		if name != "" {
-			iface.Name = name
-		}
-		if mac := strings.TrimSpace(cfg.HWAddr); mac != "" {
-			iface.MAC = mac
-		}
+			iface := models.GuestNetworkInterface{}
+			name := strings.TrimSpace(cfg.Name)
+			if name == "" {
+				name = strings.TrimSpace(rawName)
+			}
+			if name != "" {
+				iface.Name = name
+			}
+			if mac := strings.TrimSpace(cfg.HWAddr); mac != "" {
+				iface.MAC = mac
+			}
 
-		addrCandidates := make([]string, 0, 4)
-		addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IP)...)
-		addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IP6)...)
-		addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IPv4)...)
-		addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IPv6)...)
+			addrCandidates := make([]string, 0, 4)
+			addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IP)...)
+			addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IP6)...)
+			addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IPv4)...)
+			addrCandidates = append(addrCandidates, collectIPsFromInterface(cfg.IPv6)...)
 
-		if len(addrCandidates) > 0 {
-			deduped := dedupeStringsPreserveOrder(addrCandidates)
-			if len(deduped) > 0 {
-				iface.Addresses = deduped
-				for _, addr := range deduped {
-					addAddress(addr)
+			if len(addrCandidates) > 0 {
+				deduped := dedupeStringsPreserveOrder(addrCandidates)
+				if len(deduped) > 0 {
+					iface.Addresses = deduped
+					for _, addr := range deduped {
+						addAddress(addr)
+					}
 				}
 			}
-		}
 
-		if iface.Name != "" || iface.MAC != "" || len(iface.Addresses) > 0 {
-			networkIfaces = append(networkIfaces, iface)
+			if iface.Name != "" || iface.MAC != "" || len(iface.Addresses) > 0 {
+				networkIfaces = append(networkIfaces, iface)
+			}
 		}
 	}
 
@@ -2311,41 +2495,57 @@ func (m *Monitor) enrichContainerMetadata(ctx context.Context, client PVEClientI
 			}
 			mergeContainerNetworkInterface(&networkIfaces, detail)
 		}
+		// Extract OS type from container config
+		if osName := extractContainerOSType(configData); osName != "" {
+			container.OSName = osName
+		}
+		// Detect OCI containers (Proxmox VE 9.1+)
+		// Method 1: Check ostemplate for OCI registry patterns
+		if osTemplate := extractContainerOSTemplate(configData); osTemplate != "" {
+			container.OSTemplate = osTemplate
+			if isOCITemplate(osTemplate) {
+				container.IsOCI = true
+				container.Type = "oci"
+				log.Debug().
+					Str("container", container.Name).
+					Int("vmid", container.VMID).
+					Str("osTemplate", osTemplate).
+					Msg("Detected OCI container by template")
+			}
+		}
+		// Method 2: Check config fields (entrypoint, ostype, cmode)
+		// This is needed because Proxmox doesn't persist ostemplate after creation
+		if !container.IsOCI && isOCIContainerByConfig(configData) {
+			container.IsOCI = true
+			container.Type = "oci"
+			log.Debug().
+				Str("container", container.Name).
+				Int("vmid", container.VMID).
+				Msg("Detected OCI container by config (entrypoint/ostype)")
+		}
 	}
 
 	if len(addressOrder) == 0 {
-		interfacesCtx, cancelInterfaces := context.WithTimeout(ctx, 5*time.Second)
-		ifaceDetails, ifaceErr := client.GetContainerInterfaces(interfacesCtx, nodeName, container.VMID)
-		cancelInterfaces()
-		if ifaceErr != nil {
-			log.Debug().
-				Err(ifaceErr).
-				Str("instance", instanceName).
-				Str("node", nodeName).
-				Str("container", container.Name).
-				Int("vmid", container.VMID).
-				Msg("Container interface metadata unavailable")
-		} else if len(ifaceDetails) > 0 {
-			for _, detail := range ifaceDetails {
-				parsed := containerNetworkDetails{}
-				parsed.Name = strings.TrimSpace(detail.Name)
-				parsed.MAC = strings.ToUpper(strings.TrimSpace(detail.HWAddr))
+		if isRunning {
+			interfacesCtx, cancelInterfaces := context.WithTimeout(ctx, 5*time.Second)
+			ifaceDetails, ifaceErr := client.GetContainerInterfaces(interfacesCtx, nodeName, container.VMID)
+			cancelInterfaces()
+			if ifaceErr != nil {
+				log.Debug().
+					Err(ifaceErr).
+					Str("instance", instanceName).
+					Str("node", nodeName).
+					Str("container", container.Name).
+					Int("vmid", container.VMID).
+					Msg("Container interface metadata unavailable")
+			} else if len(ifaceDetails) > 0 {
+				for _, detail := range ifaceDetails {
+					parsed := containerNetworkDetails{}
+					parsed.Name = strings.TrimSpace(detail.Name)
+					parsed.MAC = strings.ToUpper(strings.TrimSpace(detail.HWAddr))
 
-				for _, addr := range detail.IPAddresses {
-					stripped := strings.TrimSpace(addr.Address)
-					if stripped == "" {
-						continue
-					}
-					if slash := strings.Index(stripped, "/"); slash > 0 {
-						stripped = stripped[:slash]
-					}
-					parsed.Addresses = append(parsed.Addresses, sanitizeGuestAddressStrings(stripped)...)
-				}
-
-				if len(parsed.Addresses) == 0 && strings.TrimSpace(detail.Inet) != "" {
-					parts := strings.Fields(detail.Inet)
-					for _, part := range parts {
-						stripped := strings.TrimSpace(part)
+					for _, addr := range detail.IPAddresses {
+						stripped := strings.TrimSpace(addr.Address)
 						if stripped == "" {
 							continue
 						}
@@ -2354,18 +2554,32 @@ func (m *Monitor) enrichContainerMetadata(ctx context.Context, client PVEClientI
 						}
 						parsed.Addresses = append(parsed.Addresses, sanitizeGuestAddressStrings(stripped)...)
 					}
-				}
 
-				parsed.Addresses = dedupeStringsPreserveOrder(parsed.Addresses)
-
-				if len(parsed.Addresses) > 0 {
-					for _, addr := range parsed.Addresses {
-						addAddress(addr)
+					if len(parsed.Addresses) == 0 && strings.TrimSpace(detail.Inet) != "" {
+						parts := strings.Fields(detail.Inet)
+						for _, part := range parts {
+							stripped := strings.TrimSpace(part)
+							if stripped == "" {
+								continue
+							}
+							if slash := strings.Index(stripped, "/"); slash > 0 {
+								stripped = stripped[:slash]
+							}
+							parsed.Addresses = append(parsed.Addresses, sanitizeGuestAddressStrings(stripped)...)
+						}
 					}
-				}
 
-				if parsed.Name != "" || parsed.MAC != "" || len(parsed.Addresses) > 0 {
-					mergeContainerNetworkInterface(&networkIfaces, parsed)
+					parsed.Addresses = dedupeStringsPreserveOrder(parsed.Addresses)
+
+					if len(parsed.Addresses) > 0 {
+						for _, addr := range parsed.Addresses {
+							addAddress(addr)
+						}
+					}
+
+					if parsed.Name != "" || parsed.MAC != "" || len(parsed.Addresses) > 0 {
+						mergeContainerNetworkInterface(&networkIfaces, parsed)
+					}
 				}
 			}
 		}
@@ -2532,7 +2746,7 @@ func checkContainerizedTempMonitoring() {
 
 	// Log warning
 	log.Warn().
-		Msg("🔐 SECURITY NOTICE: Pulse is running in a container with SSH-based temperature monitoring enabled. " +
+		Msg("SECURITY NOTICE: Pulse is running in a container with SSH-based temperature monitoring enabled. " +
 			"SSH private keys are stored inside the container, which could be a security risk if the container is compromised. " +
 			"Future versions will use agent-based architecture for better security. " +
 			"See documentation for hardening recommendations.")
@@ -2616,6 +2830,36 @@ func New(cfg *config.Config) (*Monitor, error) {
 	guestAgentVersionTimeout := parseDurationEnv("GUEST_AGENT_VERSION_TIMEOUT", defaultGuestAgentVersionTimeout)
 	guestAgentRetries := parseIntEnv("GUEST_AGENT_RETRIES", defaultGuestAgentRetries)
 
+	// Initialize persistent metrics store (SQLite) with configurable retention
+	var metricsStore *metrics.Store
+	metricsStoreConfig := metrics.DefaultConfig(cfg.DataPath)
+	// Override retention settings from config (allows tier-based pricing in future)
+	if cfg.MetricsRetentionRawHours > 0 {
+		metricsStoreConfig.RetentionRaw = time.Duration(cfg.MetricsRetentionRawHours) * time.Hour
+	}
+	if cfg.MetricsRetentionMinuteHours > 0 {
+		metricsStoreConfig.RetentionMinute = time.Duration(cfg.MetricsRetentionMinuteHours) * time.Hour
+	}
+	if cfg.MetricsRetentionHourlyDays > 0 {
+		metricsStoreConfig.RetentionHourly = time.Duration(cfg.MetricsRetentionHourlyDays) * 24 * time.Hour
+	}
+	if cfg.MetricsRetentionDailyDays > 0 {
+		metricsStoreConfig.RetentionDaily = time.Duration(cfg.MetricsRetentionDailyDays) * 24 * time.Hour
+	}
+	ms, err := metrics.NewStore(metricsStoreConfig)
+	if err != nil {
+		log.Error().Err(err).Msg("Failed to initialize persistent metrics store - continuing with in-memory only")
+	} else {
+		metricsStore = ms
+		log.Info().
+			Str("path", metricsStoreConfig.DBPath).
+			Dur("retentionRaw", metricsStoreConfig.RetentionRaw).
+			Dur("retentionMinute", metricsStoreConfig.RetentionMinute).
+			Dur("retentionHourly", metricsStoreConfig.RetentionHourly).
+			Dur("retentionDaily", metricsStoreConfig.RetentionDaily).
+			Msg("Persistent metrics store initialized with configurable retention")
+	}
+
 	m := &Monitor{
 		config:                     cfg,
 		state:                      models.NewState(),
@@ -2640,6 +2884,7 @@ func New(cfg *config.Config) (*Monitor, error) {
 		startTime:                  time.Now(),
 		rateTracker:                NewRateTracker(),
 		metricsHistory:             NewMetricsHistory(1000, 24*time.Hour), // Keep up to 1000 points or 24 hours
+		metricsStore:               metricsStore,                          // Persistent SQLite storage
 		alertManager:               alerts.NewManager(),
 		notificationMgr:            notifications.NewNotificationManager(cfg.PublicURL),
 		configPersist:              config.NewConfigPersistence(cfg.DataPath),
@@ -2657,6 +2902,8 @@ func New(cfg *config.Config) (*Monitor, error) {
 		nodeRRDMemCache:            make(map[string]rrdMemCacheEntry),
 		removedDockerHosts:         make(map[string]time.Time),
 		dockerTokenBindings:        make(map[string]string),
+		removedKubernetesClusters:  make(map[string]time.Time),
+		kubernetesTokenBindings:    make(map[string]string),
 		hostTokenBindings:          make(map[string]string),
 		dockerCommands:             make(map[string]*dockerHostCommand),
 		dockerCommandIndex:         make(map[string]string),
@@ -3081,6 +3328,91 @@ func (m *Monitor) baseIntervalForInstanceType(instanceType InstanceType) time.Du
 	}
 }
 
+// getConfiguredHostIPs returns a list of IP addresses from all configured Proxmox hosts.
+// This is used to prevent discovery from probing hosts we already know about.
+// Caller must hold m.mu.RLock or m.mu.Lock.
+func (m *Monitor) getConfiguredHostIPs() []string {
+	if m.config == nil {
+		return nil
+	}
+
+	seen := make(map[string]struct{})
+	var ips []string
+
+	addHost := func(host string) {
+		// Parse the host to extract IP/hostname
+		host = strings.TrimSpace(host)
+		if host == "" {
+			return
+		}
+		// Remove scheme if present
+		if strings.HasPrefix(host, "https://") {
+			host = strings.TrimPrefix(host, "https://")
+		} else if strings.HasPrefix(host, "http://") {
+			host = strings.TrimPrefix(host, "http://")
+		}
+		// Remove port if present
+		if colonIdx := strings.LastIndex(host, ":"); colonIdx != -1 {
+			// Check if it's an IPv6 address
+			if !strings.Contains(host[colonIdx:], "]") {
+				host = host[:colonIdx]
+			}
+		}
+		// Remove trailing path
+		if slashIdx := strings.Index(host, "/"); slashIdx != -1 {
+			host = host[:slashIdx]
+		}
+		host = strings.TrimSpace(host)
+		if host == "" {
+			return
+		}
+		// Check if it's already an IP
+		if ip := net.ParseIP(host); ip != nil {
+			if _, exists := seen[host]; !exists {
+				seen[host] = struct{}{}
+				ips = append(ips, host)
+			}
+			return
+		}
+		// Try to resolve hostname to IP
+		if addrs, err := net.LookupIP(host); err == nil && len(addrs) > 0 {
+			for _, addr := range addrs {
+				// Prefer IPv4
+				if v4 := addr.To4(); v4 != nil {
+					ipStr := v4.String()
+					if _, exists := seen[ipStr]; !exists {
+						seen[ipStr] = struct{}{}
+						ips = append(ips, ipStr)
+					}
+					break
+				}
+			}
+		}
+	}
+
+	// Add PVE hosts
+	for _, pve := range m.config.PVEInstances {
+		addHost(pve.Host)
+		// Also add cluster endpoints
+		for _, ep := range pve.ClusterEndpoints {
+			addHost(ep.Host)
+			addHost(ep.IP)
+		}
+	}
+
+	// Add PBS hosts
+	for _, pbs := range m.config.PBSInstances {
+		addHost(pbs.Host)
+	}
+
+	// Add PMG hosts
+	for _, pmg := range m.config.PMGInstances {
+		addHost(pmg.Host)
+	}
+
+	return ips
+}
+
 // Start begins the monitoring loop
 func (m *Monitor) Start(ctx context.Context, wsHub *websocket.Hub) {
 	pollingInterval := m.effectivePVEPollingInterval()
@@ -3092,6 +3424,11 @@ func (m *Monitor) Start(ctx context.Context, wsHub *websocket.Hub) {
 	m.runtimeCtx = ctx
 	m.wsHub = wsHub
 	m.mu.Unlock()
+	defer m.stopMockMetricsSampler()
+
+	if mock.IsMockEnabled() {
+		m.startMockMetricsSampler(ctx)
+	}
 
 	// Initialize and start discovery service if enabled
 	if mock.IsMockEnabled() {
@@ -3108,7 +3445,11 @@ func (m *Monitor) Start(ctx context.Context, wsHub *websocket.Hub) {
 			if m.config == nil {
 				return config.DefaultDiscoveryConfig()
 			}
-			return config.CloneDiscoveryConfig(m.config.Discovery)
+			cfg := config.CloneDiscoveryConfig(m.config.Discovery)
+			// Auto-populate IPBlocklist with configured Proxmox host IPs to avoid
+			// probing hosts we already know about (reduces PBS auth failure log spam)
+			cfg.IPBlocklist = m.getConfiguredHostIPs()
+			return cfg
 		}
 		m.discoveryService = discovery.NewService(wsHub, 5*time.Minute, discoverySubnet, cfgProvider)
 		if m.discoveryService != nil {
@@ -3211,8 +3552,10 @@ func (m *Monitor) Start(ctx context.Context, wsHub *websocket.Hub) {
 		case <-pollTicker.C:
 			now := time.Now()
 			m.evaluateDockerAgents(now)
+			m.evaluateKubernetesAgents(now)
 			m.evaluateHostAgents(now)
 			m.cleanupRemovedDockerHosts(now)
+			m.cleanupRemovedKubernetesClusters(now)
 			m.cleanupGuestMetadataCache(now)
 			m.cleanupDiagnosticSnapshots(now)
 			m.cleanupRRDCache(now)
@@ -3232,12 +3575,17 @@ func (m *Monitor) Start(ctx context.Context, wsHub *websocket.Hub) {
 				Int("nodes", len(state.Nodes)).
 				Int("vms", len(state.VMs)).
 				Int("containers", len(state.Containers)).
+				Int("hosts", len(state.Hosts)).
 				Int("pbs", len(state.PBSInstances)).
 				Int("pbsBackups", len(state.Backups.PBS)).
 				Int("physicalDisks", len(state.PhysicalDisks)).
 				Msg("Broadcasting state update (ticker)")
 			// Convert to frontend format before broadcasting (converts time.Time to int64, etc.)
-			wsHub.BroadcastState(state.ToFrontend())
+			frontendState := state.ToFrontend()
+			// Update and inject unified resources if resource store is available
+			m.updateResourceStore(state)
+			frontendState.Resources = m.getResourcesForBroadcast()
+			wsHub.BroadcastState(frontendState)
 
 		case <-ctx.Done():
 			log.Info().Msg("Monitoring loop stopped")
@@ -4608,57 +4956,142 @@ func (m *Monitor) pollPVEInstance(ctx context.Context, instanceName string, clie
 	// Update state first so we have nodes available
 	m.state.UpdateNodesForInstance(instanceName, modelNodes)
 
-	// Now get storage data to use as fallback for disk metrics if needed
+	// Storage fallback is used to provide disk metrics when rootfs is not available.
+	// We run this asynchronously with a short timeout so it doesn't block VM/container polling.
+	// This addresses the issue where slow storage APIs (e.g., NFS mounts) can cause the entire
+	// polling task to timeout before reaching VM/container polling.
 	storageByNode := make(map[string]models.Disk)
+	var storageByNodeMu sync.Mutex
+	storageFallbackDone := make(chan struct{})
+
 	if instanceCfg.MonitorStorage {
-		_, err := client.GetAllStorage(ctx)
-		if err == nil {
+		go func() {
+			defer close(storageFallbackDone)
+
+			// Use a short timeout for storage fallback - it's an optimization, not critical
+			storageFallbackTimeout := 10 * time.Second
+			storageCtx, storageCancel := context.WithTimeout(context.Background(), storageFallbackTimeout)
+			defer storageCancel()
+
+			_, err := client.GetAllStorage(storageCtx)
+			if err != nil {
+				if storageCtx.Err() != nil {
+					log.Debug().
+						Str("instance", instanceName).
+						Dur("timeout", storageFallbackTimeout).
+						Msg("Storage fallback timed out - continuing without disk fallback data")
+				}
+				return
+			}
+
 			for _, node := range nodes {
+				// Check if context was cancelled
+				select {
+				case <-storageCtx.Done():
+					log.Debug().
+						Str("instance", instanceName).
+						Msg("Storage fallback cancelled - partial data collected")
+					return
+				default:
+				}
+
 				// Skip offline nodes to avoid 595 errors
 				if nodeEffectiveStatus[node.Node] != "online" {
 					continue
 				}
 
-				nodeStorages, err := client.GetStorage(ctx, node.Node)
-				if err == nil {
-					// Look for local or local-lvm storage as most stable disk metric
-					for _, storage := range nodeStorages {
-						if reason, skip := readOnlyFilesystemReason(storage.Type, storage.Total, storage.Used); skip {
+				nodeStorages, err := client.GetStorage(storageCtx, node.Node)
+				if err != nil {
+					continue
+				}
+
+				// Look for local or local-lvm storage as most stable disk metric
+				for _, storage := range nodeStorages {
+					if reason, skip := readOnlyFilesystemReason(storage.Type, storage.Total, storage.Used); skip {
+						log.Debug().
+							Str("node", node.Node).
+							Str("storage", storage.Storage).
+							Str("type", storage.Type).
+							Str("skipReason", reason).
+							Uint64("total", storage.Total).
+							Uint64("used", storage.Used).
+							Msg("Skipping read-only storage while building disk fallback")
+						continue
+					}
+					if storage.Storage == "local" || storage.Storage == "local-lvm" {
+						disk := models.Disk{
+							Total: int64(storage.Total),
+							Used:  int64(storage.Used),
+							Free:  int64(storage.Available),
+							Usage: safePercentage(float64(storage.Used), float64(storage.Total)),
+						}
+						// Prefer "local" over "local-lvm"
+						storageByNodeMu.Lock()
+						if _, exists := storageByNode[node.Node]; !exists || storage.Storage == "local" {
+							storageByNode[node.Node] = disk
 							log.Debug().
 								Str("node", node.Node).
 								Str("storage", storage.Storage).
-								Str("type", storage.Type).
-								Str("skipReason", reason).
-								Uint64("total", storage.Total).
-								Uint64("used", storage.Used).
-								Msg("Skipping read-only storage while building disk fallback")
-							continue
-						}
-						if storage.Storage == "local" || storage.Storage == "local-lvm" {
-							disk := models.Disk{
-								Total: int64(storage.Total),
-								Used:  int64(storage.Used),
-								Free:  int64(storage.Available),
-								Usage: safePercentage(float64(storage.Used), float64(storage.Total)),
-							}
-							// Prefer "local" over "local-lvm"
-							if _, exists := storageByNode[node.Node]; !exists || storage.Storage == "local" {
-								storageByNode[node.Node] = disk
-								log.Debug().
-									Str("node", node.Node).
-									Str("storage", storage.Storage).
-									Float64("usage", disk.Usage).
-									Msg("Using storage for disk metrics fallback")
-							}
+								Float64("usage", disk.Usage).
+								Msg("Using storage for disk metrics fallback")
 						}
+						storageByNodeMu.Unlock()
 					}
 				}
 			}
+		}()
+	} else {
+		// No storage monitoring, close channel immediately
+		close(storageFallbackDone)
+	}
+
+	// Poll VMs and containers FIRST - this is the most critical data.
+	// This happens immediately after starting the storage fallback goroutine,
+	// so VM/container polling runs in parallel with (and is not blocked by) storage operations.
+	if instanceCfg.MonitorVMs || instanceCfg.MonitorContainers {
+		select {
+		case <-ctx.Done():
+			pollErr = ctx.Err()
+			return
+		default:
+			// Always try the efficient cluster/resources endpoint first
+			// This endpoint works on both clustered and standalone nodes
+			// Testing confirmed it works on standalone nodes like pimox
+			useClusterEndpoint := m.pollVMsAndContainersEfficient(ctx, instanceName, client, nodeEffectiveStatus)
+
+			if !useClusterEndpoint {
+				// Fall back to traditional polling only if cluster/resources not available
+				// This should be rare - only for very old Proxmox versions
+				log.Debug().
+					Str("instance", instanceName).
+					Msg("cluster/resources endpoint not available, using traditional polling")
+
+				// Check if configuration needs updating
+				if instanceCfg.IsCluster {
+					isActuallyCluster, checkErr := client.IsClusterMember(ctx)
+					if checkErr == nil && !isActuallyCluster {
+						log.Warn().
+							Str("instance", instanceName).
+							Msg("Instance marked as cluster but is actually standalone - consider updating configuration")
+						instanceCfg.IsCluster = false
+					}
+				}
+
+				// Use optimized parallel polling for better performance
+				if instanceCfg.MonitorVMs {
+					m.pollVMsWithNodes(ctx, instanceName, client, nodes, nodeEffectiveStatus)
+				}
+				if instanceCfg.MonitorContainers {
+					m.pollContainersWithNodes(ctx, instanceName, client, nodes, nodeEffectiveStatus)
+				}
+			}
 		}
 	}
 
 	// Poll physical disks for health monitoring (enabled by default unless explicitly disabled)
 	// Skip if MonitorPhysicalDisks is explicitly set to false
+	// Physical disk polling runs in a background goroutine since GetDisks can be slow
+	// and we don't want it to cause task timeouts. It has its own 5-minute interval anyway.
 	if instanceCfg.MonitorPhysicalDisks != nil && !*instanceCfg.MonitorPhysicalDisks {
 		log.Debug().Str("instance", instanceName).Msg("Physical disk monitoring explicitly disabled")
 		// Keep any existing disk data visible (don't clear it)
@@ -4698,152 +5131,192 @@ func (m *Monitor) pollPVEInstance(ctx context.Context, instanceName string, clie
 				m.state.UpdatePhysicalDisks(instanceName, updated)
 			}
 		} else {
-			log.Debug().
-				Int("nodeCount", len(nodes)).
-				Dur("interval", pollingInterval).
-				Msg("Starting disk health polling")
+			// Run physical disk polling in background to avoid blocking the main task
+			go func(inst string, pveClient PVEClientInterface, nodeList []proxmox.Node, nodeStatus map[string]string, modelNodesCopy []models.Node) {
+				defer recoverFromPanic(fmt.Sprintf("pollPhysicalDisks-%s", inst))
 
-			// Get existing disks from state to preserve data for offline nodes
-			currentState := m.state.GetSnapshot()
-			existingDisksMap := make(map[string]models.PhysicalDisk)
-			for _, disk := range currentState.PhysicalDisks {
-				if disk.Instance == instanceName {
-					existingDisksMap[disk.ID] = disk
-				}
-			}
-
-			var allDisks []models.PhysicalDisk
-			polledNodes := make(map[string]bool) // Track which nodes we successfully polled
-
-			for _, node := range nodes {
-				// Skip offline nodes but preserve their existing disk data
-				if nodeEffectiveStatus[node.Node] != "online" {
-					log.Debug().Str("node", node.Node).Msg("Skipping disk poll for offline node - preserving existing data")
-					continue
-				}
-
-				// Get disk list for this node
-				log.Debug().Str("node", node.Node).Msg("Getting disk list for node")
-				disks, err := client.GetDisks(ctx, node.Node)
-				if err != nil {
-					// Check if it's a permission error or if the endpoint doesn't exist
-					errStr := err.Error()
-					if strings.Contains(errStr, "401") || strings.Contains(errStr, "403") {
-						log.Warn().
-							Str("node", node.Node).
-							Err(err).
-							Msg("Insufficient permissions to access disk information - check API token permissions")
-					} else if strings.Contains(errStr, "404") || strings.Contains(errStr, "501") {
-						log.Info().
-							Str("node", node.Node).
-							Msg("Disk monitoring not available on this node (may be using non-standard storage)")
-					} else {
-						log.Warn().
-							Str("node", node.Node).
-							Err(err).
-							Msg("Failed to get disk list")
-					}
-					continue
-				}
+				// Use a generous timeout for disk polling
+				diskTimeout := 60 * time.Second
+				diskCtx, diskCancel := context.WithTimeout(context.Background(), diskTimeout)
+				defer diskCancel()
 
 				log.Debug().
-					Str("node", node.Node).
-					Int("diskCount", len(disks)).
-					Msg("Got disk list for node")
+					Int("nodeCount", len(nodeList)).
+					Dur("interval", pollingInterval).
+					Msg("Starting disk health polling")
 
-				// Mark this node as successfully polled
-				polledNodes[node.Node] = true
+				// Get existing disks from state to preserve data for offline nodes
+				currentState := m.state.GetSnapshot()
+				existingDisksMap := make(map[string]models.PhysicalDisk)
+				for _, disk := range currentState.PhysicalDisks {
+					if disk.Instance == inst {
+						existingDisksMap[disk.ID] = disk
+					}
+				}
 
-				// Check each disk for health issues and add to state
-				for _, disk := range disks {
-					// Create PhysicalDisk model
-					diskID := fmt.Sprintf("%s-%s-%s", instanceName, node.Node, strings.ReplaceAll(disk.DevPath, "/", "-"))
-					physicalDisk := models.PhysicalDisk{
-						ID:          diskID,
-						Node:        node.Node,
-						Instance:    instanceName,
-						DevPath:     disk.DevPath,
-						Model:       disk.Model,
-						Serial:      disk.Serial,
-						WWN:         disk.WWN,
-						Type:        disk.Type,
-						Size:        disk.Size,
-						Health:      disk.Health,
-						Wearout:     disk.Wearout,
-						RPM:         disk.RPM,
-						Used:        disk.Used,
-						LastChecked: time.Now(),
+				var allDisks []models.PhysicalDisk
+				polledNodes := make(map[string]bool) // Track which nodes we successfully polled
+
+				for _, node := range nodeList {
+					// Check if context timed out
+					select {
+					case <-diskCtx.Done():
+						log.Debug().
+							Str("instance", inst).
+							Msg("Physical disk polling timed out - preserving existing data")
+						return
+					default:
 					}
 
-					allDisks = append(allDisks, physicalDisk)
+					// Skip offline nodes but preserve their existing disk data
+					if nodeStatus[node.Node] != "online" {
+						log.Debug().Str("node", node.Node).Msg("Skipping disk poll for offline node - preserving existing data")
+						continue
+					}
+
+					// Get disk list for this node
+					log.Debug().Str("node", node.Node).Msg("Getting disk list for node")
+					disks, err := pveClient.GetDisks(diskCtx, node.Node)
+					if err != nil {
+						// Check if it's a permission error or if the endpoint doesn't exist
+						errStr := err.Error()
+						if strings.Contains(errStr, "401") || strings.Contains(errStr, "403") {
+							log.Warn().
+								Str("node", node.Node).
+								Err(err).
+								Msg("Insufficient permissions to access disk information - check API token permissions")
+						} else if strings.Contains(errStr, "404") || strings.Contains(errStr, "501") {
+							log.Info().
+								Str("node", node.Node).
+								Msg("Disk monitoring not available on this node (may be using non-standard storage)")
+						} else {
+							log.Warn().
+								Str("node", node.Node).
+								Err(err).
+								Msg("Failed to get disk list")
+						}
+						continue
+					}
 
 					log.Debug().
 						Str("node", node.Node).
-						Str("disk", disk.DevPath).
-						Str("model", disk.Model).
-						Str("health", disk.Health).
-						Int("wearout", disk.Wearout).
-						Msg("Checking disk health")
+						Int("diskCount", len(disks)).
+						Msg("Got disk list for node")
 
-					normalizedHealth := strings.ToUpper(strings.TrimSpace(disk.Health))
-					if normalizedHealth != "" && normalizedHealth != "UNKNOWN" && normalizedHealth != "PASSED" && normalizedHealth != "OK" {
-						// Disk has failed or is failing - alert manager will handle this
-						log.Warn().
+					// Mark this node as successfully polled
+					polledNodes[node.Node] = true
+
+					// Check each disk for health issues and add to state
+					for _, disk := range disks {
+						// Create PhysicalDisk model
+						diskID := fmt.Sprintf("%s-%s-%s", inst, node.Node, strings.ReplaceAll(disk.DevPath, "/", "-"))
+						physicalDisk := models.PhysicalDisk{
+							ID:          diskID,
+							Node:        node.Node,
+							Instance:    inst,
+							DevPath:     disk.DevPath,
+							Model:       disk.Model,
+							Serial:      disk.Serial,
+							WWN:         disk.WWN,
+							Type:        disk.Type,
+							Size:        disk.Size,
+							Health:      disk.Health,
+							Wearout:     disk.Wearout,
+							RPM:         disk.RPM,
+							Used:        disk.Used,
+							LastChecked: time.Now(),
+						}
+
+						allDisks = append(allDisks, physicalDisk)
+
+						log.Debug().
 							Str("node", node.Node).
 							Str("disk", disk.DevPath).
 							Str("model", disk.Model).
 							Str("health", disk.Health).
 							Int("wearout", disk.Wearout).
-							Msg("Disk health issue detected")
+							Msg("Checking disk health")
 
-						// Pass disk info to alert manager
-						m.alertManager.CheckDiskHealth(instanceName, node.Node, disk)
-					} else if disk.Wearout > 0 && disk.Wearout < 10 {
-						// Low wearout warning (less than 10% life remaining)
-						log.Warn().
-							Str("node", node.Node).
-							Str("disk", disk.DevPath).
-							Str("model", disk.Model).
-							Int("wearout", disk.Wearout).
-							Msg("SSD wearout critical - less than 10% life remaining")
+						normalizedHealth := strings.ToUpper(strings.TrimSpace(disk.Health))
+						if normalizedHealth != "" && normalizedHealth != "UNKNOWN" && normalizedHealth != "PASSED" && normalizedHealth != "OK" {
+							// Disk has failed or is failing - alert manager will handle this
+							log.Warn().
+								Str("node", node.Node).
+								Str("disk", disk.DevPath).
+								Str("model", disk.Model).
+								Str("health", disk.Health).
+								Int("wearout", disk.Wearout).
+								Msg("Disk health issue detected")
 
-						// Pass to alert manager for wearout alert
-						m.alertManager.CheckDiskHealth(instanceName, node.Node, disk)
+							// Pass disk info to alert manager
+							m.alertManager.CheckDiskHealth(inst, node.Node, disk)
+						} else if disk.Wearout > 0 && disk.Wearout < 10 {
+							// Low wearout warning (less than 10% life remaining)
+							log.Warn().
+								Str("node", node.Node).
+								Str("disk", disk.DevPath).
+								Str("model", disk.Model).
+								Int("wearout", disk.Wearout).
+								Msg("SSD wearout critical - less than 10% life remaining")
+
+							// Pass to alert manager for wearout alert
+							m.alertManager.CheckDiskHealth(inst, node.Node, disk)
+						}
 					}
 				}
-			}
 
-			// Preserve existing disk data for nodes that weren't polled (offline or error)
-			for _, existingDisk := range existingDisksMap {
-				// Only preserve if we didn't poll this node
-				if !polledNodes[existingDisk.Node] {
-					// Keep the existing disk data but update the LastChecked to indicate it's stale
-					allDisks = append(allDisks, existingDisk)
-					log.Debug().
-						Str("node", existingDisk.Node).
-						Str("disk", existingDisk.DevPath).
-						Msg("Preserving existing disk data for unpolled node")
+				// Preserve existing disk data for nodes that weren't polled (offline or error)
+				for _, existingDisk := range existingDisksMap {
+					// Only preserve if we didn't poll this node
+					if !polledNodes[existingDisk.Node] {
+						// Keep the existing disk data but update the LastChecked to indicate it's stale
+						allDisks = append(allDisks, existingDisk)
+						log.Debug().
+							Str("node", existingDisk.Node).
+							Str("disk", existingDisk.DevPath).
+							Msg("Preserving existing disk data for unpolled node")
+					}
 				}
-			}
 
-			allDisks = mergeNVMeTempsIntoDisks(allDisks, modelNodes)
+				allDisks = mergeNVMeTempsIntoDisks(allDisks, modelNodesCopy)
 
-			// Update physical disks in state
-			log.Debug().
-				Str("instance", instanceName).
-				Int("diskCount", len(allDisks)).
-				Int("preservedCount", len(existingDisksMap)-len(polledNodes)).
-				Msg("Updating physical disks in state")
-			m.state.UpdatePhysicalDisks(instanceName, allDisks)
+				// Update physical disks in state
+				log.Debug().
+					Str("instance", inst).
+					Int("diskCount", len(allDisks)).
+					Int("preservedCount", len(existingDisksMap)-len(polledNodes)).
+					Msg("Updating physical disks in state")
+				m.state.UpdatePhysicalDisks(inst, allDisks)
+			}(instanceName, client, nodes, nodeEffectiveStatus, modelNodes)
 		}
 	}
 	// Note: Physical disk monitoring is now enabled by default with a 5-minute polling interval.
 	// Users can explicitly disable it in node settings. Disk data is preserved between polls.
 
+	// Wait for storage fallback to complete (with a short timeout) before using the data.
+	// This is non-blocking in the sense that VM/container polling has already completed by now.
+	// We give the storage fallback goroutine up to 2 additional seconds to finish if it's still running.
+	select {
+	case <-storageFallbackDone:
+		// Storage fallback completed normally
+	case <-time.After(2 * time.Second):
+		log.Debug().
+			Str("instance", instanceName).
+			Msg("Storage fallback still running - proceeding without waiting (disk fallback may be unavailable)")
+	}
+
 	// Update nodes with storage fallback if rootfs was not available
+	// Copy storageByNode under lock, then release to avoid holding during metric updates
+	storageByNodeMu.Lock()
+	localStorageByNode := make(map[string]models.Disk, len(storageByNode))
+	for k, v := range storageByNode {
+		localStorageByNode[k] = v
+	}
+	storageByNodeMu.Unlock()
+
 	for i := range modelNodes {
 		if modelNodes[i].Disk.Total == 0 {
-			if disk, exists := storageByNode[modelNodes[i].Name]; exists {
+			if disk, exists := localStorageByNode[modelNodes[i].Name]; exists {
 				modelNodes[i].Disk = disk
 				log.Debug().
 					Str("node", modelNodes[i].Name).
@@ -4858,6 +5331,12 @@ func (m *Monitor) pollPVEInstance(ctx context.Context, instanceName string, clie
 			m.metricsHistory.AddNodeMetric(modelNodes[i].ID, "cpu", modelNodes[i].CPU*100, now)
 			m.metricsHistory.AddNodeMetric(modelNodes[i].ID, "memory", modelNodes[i].Memory.Usage, now)
 			m.metricsHistory.AddNodeMetric(modelNodes[i].ID, "disk", modelNodes[i].Disk.Usage, now)
+			// Also write to persistent store
+			if m.metricsStore != nil {
+				m.metricsStore.Write("node", modelNodes[i].ID, "cpu", modelNodes[i].CPU*100, now)
+				m.metricsStore.Write("node", modelNodes[i].ID, "memory", modelNodes[i].Memory.Usage, now)
+				m.metricsStore.Write("node", modelNodes[i].ID, "disk", modelNodes[i].Disk.Usage, now)
+			}
 		}
 
 		// Check thresholds for alerts
@@ -4964,55 +5443,25 @@ func (m *Monitor) pollPVEInstance(ctx context.Context, instanceName string, clie
 		}
 	}
 
-	// Poll VMs and containers together using cluster/resources for efficiency
-	if instanceCfg.MonitorVMs || instanceCfg.MonitorContainers {
-		select {
-		case <-ctx.Done():
-			pollErr = ctx.Err()
-			return
-		default:
-			// Always try the efficient cluster/resources endpoint first
-			// This endpoint works on both clustered and standalone nodes
-			// Testing confirmed it works on standalone nodes like pimox
-			useClusterEndpoint := m.pollVMsAndContainersEfficient(ctx, instanceName, client, nodeEffectiveStatus)
-
-			if !useClusterEndpoint {
-				// Fall back to traditional polling only if cluster/resources not available
-				// This should be rare - only for very old Proxmox versions
-				log.Debug().
-					Str("instance", instanceName).
-					Msg("cluster/resources endpoint not available, using traditional polling")
-
-				// Check if configuration needs updating
-				if instanceCfg.IsCluster {
-					isActuallyCluster, checkErr := client.IsClusterMember(ctx)
-					if checkErr == nil && !isActuallyCluster {
-						log.Warn().
-							Str("instance", instanceName).
-							Msg("Instance marked as cluster but is actually standalone - consider updating configuration")
-						instanceCfg.IsCluster = false
-					}
-				}
-
-				// Use optimized parallel polling for better performance
-				if instanceCfg.MonitorVMs {
-					m.pollVMsWithNodes(ctx, instanceName, client, nodes, nodeEffectiveStatus)
-				}
-				if instanceCfg.MonitorContainers {
-					m.pollContainersWithNodes(ctx, instanceName, client, nodes, nodeEffectiveStatus)
-				}
-			}
-		}
-	}
-
-	// Poll storage if enabled
+	// Poll storage in background if enabled - storage APIs can be slow (NFS mounts, etc.)
+	// so we run this asynchronously to prevent it from causing task timeouts.
+	// This is similar to how backup polling runs in the background.
 	if instanceCfg.MonitorStorage {
 		select {
 		case <-ctx.Done():
 			pollErr = ctx.Err()
 			return
 		default:
-			m.pollStorageWithNodes(ctx, instanceName, client, nodes)
+			go func(inst string, pveClient PVEClientInterface, nodeList []proxmox.Node) {
+				defer recoverFromPanic(fmt.Sprintf("pollStorageWithNodes-%s", inst))
+
+				// Use a generous timeout for storage polling - it's not blocking the main task
+				storageTimeout := 60 * time.Second
+				storageCtx, storageCancel := context.WithTimeout(context.Background(), storageTimeout)
+				defer storageCancel()
+
+				m.pollStorageWithNodes(storageCtx, inst, pveClient, nodeList)
+			}(instanceName, client, nodes)
 		}
 	}
 
@@ -5104,6 +5553,22 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 		return false
 	}
 
+	// Seed OCI classification from previous state so we never "downgrade" to LXC
+	// if container config fetching intermittently fails (permissions or transient API errors).
+	prevState := m.GetState()
+	prevContainerIsOCI := make(map[int]bool)
+	for _, ct := range prevState.Containers {
+		if ct.Instance != instanceName {
+			continue
+		}
+		if ct.VMID <= 0 {
+			continue
+		}
+		if ct.Type == "oci" || ct.IsOCI {
+			prevContainerIsOCI[ct.VMID] = true
+		}
+	}
+
 	var allVMs []models.VM
 	var allContainers []models.Container
 
@@ -5747,6 +6212,11 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 				LastSeen:   time.Now(),
 			}
 
+			if prevContainerIsOCI[container.VMID] {
+				container.IsOCI = true
+				container.Type = "oci"
+			}
+
 			// Parse tags
 			if res.Tags != "" {
 				container.Tags = strings.Split(res.Tags, ";")
@@ -5766,6 +6236,25 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 
 			m.enrichContainerMetadata(ctx, client, instanceName, res.Node, &container)
 
+			// For non-running containers, zero out resource usage metrics to prevent false alerts.
+			// Proxmox may report stale or residual metrics for stopped containers.
+			if container.Status != "running" {
+				log.Debug().
+					Str("container", container.Name).
+					Str("status", container.Status).
+					Float64("originalCpu", container.CPU).
+					Float64("originalMemUsage", container.Memory.Usage).
+					Msg("Non-running container detected - zeroing metrics")
+
+				container.CPU = 0
+				container.Memory.Usage = 0
+				container.Disk.Usage = 0
+				container.NetworkIn = 0
+				container.NetworkOut = 0
+				container.DiskRead = 0
+				container.DiskWrite = 0
+			}
+
 			allContainers = append(allContainers, container)
 
 			m.recordGuestSnapshot(instanceName, container.Type, res.Node, res.VMID, GuestMemorySnapshot{
@@ -5777,26 +6266,6 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 				Raw:          guestRaw,
 			})
 
-			// For non-running containers, zero out resource usage metrics to prevent false alerts
-			// Proxmox may report stale or residual metrics for stopped containers
-			if container.Status != "running" {
-				log.Debug().
-					Str("container", container.Name).
-					Str("status", container.Status).
-					Float64("originalCpu", container.CPU).
-					Float64("originalMemUsage", container.Memory.Usage).
-					Msg("Non-running container detected - zeroing metrics")
-
-				// Zero out all usage metrics for stopped/paused containers
-				container.CPU = 0
-				container.Memory.Usage = 0
-				container.Disk.Usage = 0
-				container.NetworkIn = 0
-				container.NetworkOut = 0
-				container.DiskRead = 0
-				container.DiskWrite = 0
-			}
-
 			// Check thresholds for alerts
 			m.alertManager.CheckGuest(container, instanceName)
 		}
@@ -5805,8 +6274,6 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 	// Preserve VMs and containers from nodes within grace period
 	// The cluster/resources endpoint doesn't return VMs/containers from nodes Proxmox considers offline,
 	// but we want to keep showing them if the node is within grace period
-	prevState := m.GetState()
-
 	// Count previous resources for this instance
 	prevVMCount := 0
 	prevContainerCount := 0
@@ -5911,6 +6378,43 @@ func (m *Monitor) pollVMsAndContainersEfficient(ctx context.Context, instanceNam
 	m.state.UpdateVMsForInstance(instanceName, allVMs)
 	m.state.UpdateContainersForInstance(instanceName, allContainers)
 
+	// Record guest metrics history for running guests (enables sparkline/trends view)
+	now := time.Now()
+	for _, vm := range allVMs {
+		if vm.Status == "running" {
+			m.metricsHistory.AddGuestMetric(vm.ID, "cpu", vm.CPU*100, now)
+			m.metricsHistory.AddGuestMetric(vm.ID, "memory", vm.Memory.Usage, now)
+			if vm.Disk.Usage >= 0 {
+				m.metricsHistory.AddGuestMetric(vm.ID, "disk", vm.Disk.Usage, now)
+			}
+			// Also write to persistent store
+			if m.metricsStore != nil {
+				m.metricsStore.Write("vm", vm.ID, "cpu", vm.CPU*100, now)
+				m.metricsStore.Write("vm", vm.ID, "memory", vm.Memory.Usage, now)
+				if vm.Disk.Usage >= 0 {
+					m.metricsStore.Write("vm", vm.ID, "disk", vm.Disk.Usage, now)
+				}
+			}
+		}
+	}
+	for _, ct := range allContainers {
+		if ct.Status == "running" {
+			m.metricsHistory.AddGuestMetric(ct.ID, "cpu", ct.CPU*100, now)
+			m.metricsHistory.AddGuestMetric(ct.ID, "memory", ct.Memory.Usage, now)
+			if ct.Disk.Usage >= 0 {
+				m.metricsHistory.AddGuestMetric(ct.ID, "disk", ct.Disk.Usage, now)
+			}
+			// Also write to persistent store
+			if m.metricsStore != nil {
+				m.metricsStore.Write("container", ct.ID, "cpu", ct.CPU*100, now)
+				m.metricsStore.Write("container", ct.ID, "memory", ct.Memory.Usage, now)
+				if ct.Disk.Usage >= 0 {
+					m.metricsStore.Write("container", ct.ID, "disk", ct.Disk.Usage, now)
+				}
+			}
+		}
+	}
+
 	m.pollReplicationStatus(ctx, instanceName, client, allVMs)
 
 	log.Info().
@@ -6781,18 +7285,28 @@ func (m *Monitor) SetMockMode(enable bool) {
 	}
 
 	if enable {
+		m.stopMockMetricsSampler()
 		mock.SetEnabled(true)
 		m.alertManager.ClearActiveAlerts()
 		m.mu.Lock()
 		m.resetStateLocked()
+		m.metricsHistory.Reset()
 		m.mu.Unlock()
 		m.StopDiscoveryService()
+		m.mu.RLock()
+		ctx := m.runtimeCtx
+		m.mu.RUnlock()
+		if ctx != nil {
+			m.startMockMetricsSampler(ctx)
+		}
 		log.Info().Msg("Switched monitor to mock mode")
 	} else {
+		m.stopMockMetricsSampler()
 		mock.SetEnabled(false)
 		m.alertManager.ClearActiveAlerts()
 		m.mu.Lock()
 		m.resetStateLocked()
+		m.metricsHistory.Reset()
 		m.mu.Unlock()
 		log.Info().Msg("Switched monitor to real data mode")
 	}
@@ -6803,7 +7317,11 @@ func (m *Monitor) SetMockMode(enable bool) {
 	m.mu.RUnlock()
 
 	if hub != nil {
-		hub.BroadcastState(m.GetState().ToFrontend())
+		state := m.GetState()
+		frontendState := state.ToFrontend()
+		m.updateResourceStore(state)
+		frontendState.Resources = m.getResourcesForBroadcast()
+		hub.BroadcastState(frontendState)
 	}
 
 	if !enable && ctx != nil && hub != nil {
@@ -6911,6 +7429,50 @@ func (m *Monitor) GetAlertManager() *alerts.Manager {
 	return m.alertManager
 }
 
+// SetAlertTriggeredAICallback sets an additional callback for AI analysis when alerts fire
+// This enables token-efficient, real-time AI insights on specific resources
+func (m *Monitor) SetAlertTriggeredAICallback(callback func(*alerts.Alert)) {
+	if m.alertManager == nil || callback == nil {
+		return
+	}
+
+	// Get the current callback
+	originalCallback := m.alertManager
+
+	// Wrap the existing callback to also call the AI callback
+	m.alertManager.SetAlertCallback(func(alert *alerts.Alert) {
+		// Broadcast to WebSocket (this happens via the callback set in Start())
+		if m.wsHub != nil {
+			m.wsHub.BroadcastAlert(alert)
+		}
+
+		// Send notifications
+		log.Debug().
+			Str("alertID", alert.ID).
+			Str("level", string(alert.Level)).
+			Msg("Alert raised, sending to notification manager")
+		go m.notificationMgr.SendAlert(alert)
+
+		// Trigger AI analysis
+		go callback(alert)
+	})
+
+	// Avoid unused variable warning
+	_ = originalCallback
+
+	log.Info().Msg("Alert-triggered AI callback registered")
+}
+
+// SetResourceStore sets the resource store for polling optimization.
+// When set, the monitor will check if it should reduce polling frequency
+// for nodes that have host agents providing data.
+func (m *Monitor) SetResourceStore(store ResourceStoreInterface) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.resourceStore = store
+	log.Info().Msg("Resource store set for polling optimization")
+}
+
 // GetNotificationManager returns the notification manager
 func (m *Monitor) GetNotificationManager() *notifications.NotificationManager {
 	return m.notificationMgr
@@ -6921,6 +7483,169 @@ func (m *Monitor) GetConfigPersistence() *config.ConfigPersistence {
 	return m.configPersist
 }
 
+// GetMetricsStore returns the persistent metrics store
+func (m *Monitor) GetMetricsStore() *metrics.Store {
+	return m.metricsStore
+}
+
+// GetMetricsHistory returns the in-memory metrics history for trend analysis
+// This is used by the AI context builder to compute trends and predictions
+func (m *Monitor) GetMetricsHistory() *MetricsHistory {
+	return m.metricsHistory
+}
+
+// shouldSkipNodeMetrics returns true if we should skip detailed metric polling
+// for the given node because a host agent is providing richer data.
+// This helps reduce API load when agents are active.
+func (m *Monitor) shouldSkipNodeMetrics(nodeName string) bool {
+	m.mu.RLock()
+	store := m.resourceStore
+	m.mu.RUnlock()
+
+	if store == nil {
+		return false
+	}
+
+	should := store.ShouldSkipAPIPolling(nodeName)
+	if should {
+		log.Debug().
+			Str("node", nodeName).
+			Msg("Skipping detailed node metrics - host agent provides data")
+	}
+	return should
+}
+
+// updateResourceStore populates the resource store with data from the current state.
+// This should be called before broadcasting to ensure fresh data.
+func (m *Monitor) updateResourceStore(state models.StateSnapshot) {
+	m.mu.RLock()
+	store := m.resourceStore
+	m.mu.RUnlock()
+
+	if store == nil {
+		log.Debug().Msg("[Resources] No resource store configured, skipping population")
+		return
+	}
+
+	log.Debug().
+		Int("nodes", len(state.Nodes)).
+		Int("vms", len(state.VMs)).
+		Int("containers", len(state.Containers)).
+		Int("hosts", len(state.Hosts)).
+		Int("dockerHosts", len(state.DockerHosts)).
+		Msg("[Resources] Populating resource store from state snapshot")
+
+	store.PopulateFromSnapshot(state)
+}
+
+// getResourcesForBroadcast retrieves all resources from the store and converts them to frontend format.
+// Returns nil if no resource store is configured.
+func (m *Monitor) getResourcesForBroadcast() []models.ResourceFrontend {
+	m.mu.RLock()
+	store := m.resourceStore
+	m.mu.RUnlock()
+
+	if store == nil {
+		log.Debug().Msg("[Resources] No store for broadcast")
+		return nil
+	}
+
+	allResources := store.GetAll()
+	log.Debug().Int("count", len(allResources)).Msg("[Resources] Got resources for broadcast")
+	if len(allResources) == 0 {
+		return nil
+	}
+
+	result := make([]models.ResourceFrontend, len(allResources))
+	for i, r := range allResources {
+		input := models.ResourceConvertInput{
+			ID:           r.ID,
+			Type:         string(r.Type),
+			Name:         r.Name,
+			DisplayName:  r.DisplayName,
+			PlatformID:   r.PlatformID,
+			PlatformType: string(r.PlatformType),
+			SourceType:   string(r.SourceType),
+			ParentID:     r.ParentID,
+			ClusterID:    r.ClusterID,
+			Status:       string(r.Status),
+			Temperature:  r.Temperature,
+			Uptime:       r.Uptime,
+			Tags:         r.Tags,
+			Labels:       r.Labels,
+			LastSeenUnix: r.LastSeen.UnixMilli(),
+		}
+
+		// Convert metrics
+		if r.CPU != nil {
+			input.CPU = &models.ResourceMetricInput{
+				Current: r.CPU.Current,
+				Total:   r.CPU.Total,
+				Used:    r.CPU.Used,
+				Free:    r.CPU.Free,
+			}
+		}
+		if r.Memory != nil {
+			input.Memory = &models.ResourceMetricInput{
+				Current: r.Memory.Current,
+				Total:   r.Memory.Total,
+				Used:    r.Memory.Used,
+				Free:    r.Memory.Free,
+			}
+		}
+		if r.Disk != nil {
+			input.Disk = &models.ResourceMetricInput{
+				Current: r.Disk.Current,
+				Total:   r.Disk.Total,
+				Used:    r.Disk.Used,
+				Free:    r.Disk.Free,
+			}
+		}
+		if r.Network != nil {
+			input.HasNetwork = true
+			input.NetworkRX = r.Network.RXBytes
+			input.NetworkTX = r.Network.TXBytes
+		}
+
+		// Convert alerts
+		if len(r.Alerts) > 0 {
+			input.Alerts = make([]models.ResourceAlertInput, len(r.Alerts))
+			for j, a := range r.Alerts {
+				input.Alerts[j] = models.ResourceAlertInput{
+					ID:            a.ID,
+					Type:          a.Type,
+					Level:         a.Level,
+					Message:       a.Message,
+					Value:         a.Value,
+					Threshold:     a.Threshold,
+					StartTimeUnix: a.StartTime.UnixMilli(),
+				}
+			}
+		}
+
+		// Convert identity
+		if r.Identity != nil {
+			input.Identity = &models.ResourceIdentityInput{
+				Hostname:  r.Identity.Hostname,
+				MachineID: r.Identity.MachineID,
+				IPs:       r.Identity.IPs,
+			}
+		}
+
+		// Convert platform data from json.RawMessage to map
+		if len(r.PlatformData) > 0 {
+			var platformMap map[string]any
+			if err := json.Unmarshal(r.PlatformData, &platformMap); err == nil {
+				input.PlatformData = platformMap
+			}
+		}
+
+		result[i] = models.ConvertResourceToFrontend(input)
+	}
+
+	return result
+}
+
 // pollStorageBackupsWithNodes polls backups using a provided nodes list to avoid duplicate GetNodes calls
 func (m *Monitor) pollStorageBackupsWithNodes(ctx context.Context, instanceName string, client PVEClientInterface, nodes []proxmox.Node, nodeEffectiveStatus map[string]string) {
 
@@ -7356,6 +8081,17 @@ func persistGuestIdentity(metadataStore *config.GuestMetadataStore, guestKey, na
 		}
 	}
 
+	guestType = strings.TrimSpace(guestType)
+	if guestType == "" {
+		return
+	}
+
+	// Never "downgrade" OCI containers back to LXC. OCI classification can be transiently
+	// unavailable if Proxmox config reads fail due to permissions or transient API errors.
+	if existing.LastKnownType == "oci" && guestType != "oci" {
+		guestType = existing.LastKnownType
+	}
+
 	// Only update if the name or type has changed
 	if existing.LastKnownName != name || existing.LastKnownType != guestType {
 		existing.LastKnownName = name
@@ -7759,6 +8495,15 @@ func (m *Monitor) Stop() {
 		m.notificationMgr.Stop()
 	}
 
+	// Close persistent metrics store (flushes buffered data)
+	if m.metricsStore != nil {
+		if err := m.metricsStore.Close(); err != nil {
+			log.Error().Err(err).Msg("Failed to close metrics store")
+		} else {
+			log.Info().Msg("Metrics store closed successfully")
+		}
+	}
+
 	log.Info().Msg("Monitor stopped")
 }
 
@@ -8385,3 +9130,167 @@ func isLegacyDockerAgent(agentType string) bool {
 	// Legacy standalone agents have empty type
 	return agentType != "unified"
 }
+
+// convertAgentCephToModels converts agent report Ceph data to the models.HostCephCluster format.
+func convertAgentCephToModels(ceph *agentshost.CephCluster) *models.HostCephCluster {
+	if ceph == nil {
+		return nil
+	}
+
+	collectedAt, _ := time.Parse(time.RFC3339, ceph.CollectedAt)
+
+	result := &models.HostCephCluster{
+		FSID: ceph.FSID,
+		Health: models.HostCephHealth{
+			Status: ceph.Health.Status,
+			Checks: make(map[string]models.HostCephCheck),
+		},
+		MonMap: models.HostCephMonitorMap{
+			Epoch:   ceph.MonMap.Epoch,
+			NumMons: ceph.MonMap.NumMons,
+		},
+		MgrMap: models.HostCephManagerMap{
+			Available: ceph.MgrMap.Available,
+			NumMgrs:   ceph.MgrMap.NumMgrs,
+			ActiveMgr: ceph.MgrMap.ActiveMgr,
+			Standbys:  ceph.MgrMap.Standbys,
+		},
+		OSDMap: models.HostCephOSDMap{
+			Epoch:   ceph.OSDMap.Epoch,
+			NumOSDs: ceph.OSDMap.NumOSDs,
+			NumUp:   ceph.OSDMap.NumUp,
+			NumIn:   ceph.OSDMap.NumIn,
+			NumDown: ceph.OSDMap.NumDown,
+			NumOut:  ceph.OSDMap.NumOut,
+		},
+		PGMap: models.HostCephPGMap{
+			NumPGs:           ceph.PGMap.NumPGs,
+			BytesTotal:       ceph.PGMap.BytesTotal,
+			BytesUsed:        ceph.PGMap.BytesUsed,
+			BytesAvailable:   ceph.PGMap.BytesAvailable,
+			DataBytes:        ceph.PGMap.DataBytes,
+			UsagePercent:     ceph.PGMap.UsagePercent,
+			DegradedRatio:    ceph.PGMap.DegradedRatio,
+			MisplacedRatio:   ceph.PGMap.MisplacedRatio,
+			ReadBytesPerSec:  ceph.PGMap.ReadBytesPerSec,
+			WriteBytesPerSec: ceph.PGMap.WriteBytesPerSec,
+			ReadOpsPerSec:    ceph.PGMap.ReadOpsPerSec,
+			WriteOpsPerSec:   ceph.PGMap.WriteOpsPerSec,
+		},
+		CollectedAt: collectedAt,
+	}
+
+	// Convert monitors
+	for _, mon := range ceph.MonMap.Monitors {
+		result.MonMap.Monitors = append(result.MonMap.Monitors, models.HostCephMonitor{
+			Name:   mon.Name,
+			Rank:   mon.Rank,
+			Addr:   mon.Addr,
+			Status: mon.Status,
+		})
+	}
+
+	// Convert health checks
+	for name, check := range ceph.Health.Checks {
+		result.Health.Checks[name] = models.HostCephCheck{
+			Severity: check.Severity,
+			Message:  check.Message,
+			Detail:   check.Detail,
+		}
+	}
+
+	// Convert health summary
+	for _, s := range ceph.Health.Summary {
+		result.Health.Summary = append(result.Health.Summary, models.HostCephHealthSummary{
+			Severity: s.Severity,
+			Message:  s.Message,
+		})
+	}
+
+	// Convert pools
+	for _, pool := range ceph.Pools {
+		result.Pools = append(result.Pools, models.HostCephPool{
+			ID:             pool.ID,
+			Name:           pool.Name,
+			BytesUsed:      pool.BytesUsed,
+			BytesAvailable: pool.BytesAvailable,
+			Objects:        pool.Objects,
+			PercentUsed:    pool.PercentUsed,
+		})
+	}
+
+	// Convert services
+	for _, svc := range ceph.Services {
+		result.Services = append(result.Services, models.HostCephService{
+			Type:    svc.Type,
+			Running: svc.Running,
+			Total:   svc.Total,
+			Daemons: svc.Daemons,
+		})
+	}
+
+	return result
+}
+
+// convertAgentCephToGlobalCluster converts agent Ceph data to the global CephCluster format
+// used by the State.CephClusters list.
+func convertAgentCephToGlobalCluster(ceph *agentshost.CephCluster, hostname, hostID string, timestamp time.Time) models.CephCluster {
+	// Use FSID as the primary ID since it's unique per Ceph cluster
+	id := ceph.FSID
+	if id == "" {
+		id = "agent-ceph-" + hostID
+	}
+
+	cluster := models.CephCluster{
+		ID:             id,
+		Instance:       "agent:" + hostname,
+		Name:           hostname + " Ceph",
+		FSID:           ceph.FSID,
+		Health:         strings.TrimPrefix(ceph.Health.Status, "HEALTH_"),
+		TotalBytes:     int64(ceph.PGMap.BytesTotal),
+		UsedBytes:      int64(ceph.PGMap.BytesUsed),
+		AvailableBytes: int64(ceph.PGMap.BytesAvailable),
+		UsagePercent:   ceph.PGMap.UsagePercent,
+		NumMons:        ceph.MonMap.NumMons,
+		NumMgrs:        ceph.MgrMap.NumMgrs,
+		NumOSDs:        ceph.OSDMap.NumOSDs,
+		NumOSDsUp:      ceph.OSDMap.NumUp,
+		NumOSDsIn:      ceph.OSDMap.NumIn,
+		NumPGs:         ceph.PGMap.NumPGs,
+		LastUpdated:    timestamp,
+	}
+
+	// Build health message from checks
+	var healthMessages []string
+	for _, check := range ceph.Health.Checks {
+		if check.Message != "" {
+			healthMessages = append(healthMessages, check.Message)
+		}
+	}
+	if len(healthMessages) > 0 {
+		cluster.HealthMessage = strings.Join(healthMessages, "; ")
+	}
+
+	// Convert pools
+	for _, pool := range ceph.Pools {
+		cluster.Pools = append(cluster.Pools, models.CephPool{
+			ID:             pool.ID,
+			Name:           pool.Name,
+			StoredBytes:    int64(pool.BytesUsed),
+			AvailableBytes: int64(pool.BytesAvailable),
+			Objects:        int64(pool.Objects),
+			PercentUsed:    pool.PercentUsed,
+		})
+	}
+
+	// Convert services
+	for _, svc := range ceph.Services {
+		cluster.Services = append(cluster.Services, models.CephServiceStatus{
+			Type:    svc.Type,
+			Running: svc.Running,
+			Total:   svc.Total,
+		})
+	}
+
+	return cluster
+}
diff --git a/internal/monitoring/monitor_docker_test.go b/internal/monitoring/monitor_docker_test.go
index d343279..5c12d44 100644
--- a/internal/monitoring/monitor_docker_test.go
+++ b/internal/monitoring/monitor_docker_test.go
@@ -19,6 +19,7 @@ func newTestMonitor(t *testing.T) *Monitor {
 		alertManager:        alerts.NewManager(),
 		removedDockerHosts:  make(map[string]time.Time),
 		rateTracker:         NewRateTracker(),
+		metricsHistory:      NewMetricsHistory(1000, 24*time.Hour),
 		dockerTokenBindings: make(map[string]string),
 		dockerMetadataStore: config.NewDockerMetadataStore(t.TempDir()),
 	}
diff --git a/internal/monitoring/monitor_host_agents_test.go b/internal/monitoring/monitor_host_agents_test.go
index a904155..19613bb 100644
--- a/internal/monitoring/monitor_host_agents_test.go
+++ b/internal/monitoring/monitor_host_agents_test.go
@@ -227,8 +227,8 @@ func TestEvaluateHostAgentsZeroIntervalUsesDefault(t *testing.T) {
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
 	hostID := "host-zero-interval"
-	// IntervalSeconds = 0, LastSeen = now, should use default interval (30s)
-	// Default window = 30s * 4 = 120s, but minimum is 30s, so window = 30s
+	// IntervalSeconds = 0, LastSeen = now, should use default interval (60s)
+	// Default window = 60s * 6 = 360s, but minimum is 60s, so window = 60s
 	// With LastSeen = now, the host should be healthy
 	monitor.state.UpsertHost(models.Host{
 		ID:              hostID,
@@ -288,15 +288,15 @@ func TestEvaluateHostAgentsWindowClampedToMinimum(t *testing.T) {
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
 	hostID := "host-min-window"
-	// IntervalSeconds = 1, so window = 1s * 4 = 4s, but minimum is 30s
-	// Host last seen 25s ago should still be healthy (within 30s minimum window)
+	// IntervalSeconds = 1, so window = 1s * 6 = 6s, but minimum is 60s
+	// Host last seen 55s ago should still be healthy (within 60s minimum window)
 	now := time.Now()
 	monitor.state.UpsertHost(models.Host{
 		ID:              hostID,
 		Hostname:        "min-window.local",
 		Status:          "unknown",
 		IntervalSeconds: 1, // Very small interval
-		LastSeen:        now.Add(-25 * time.Second),
+		LastSeen:        now.Add(-55 * time.Second),
 	})
 
 	monitor.evaluateHostAgents(now)
@@ -304,7 +304,7 @@ func TestEvaluateHostAgentsWindowClampedToMinimum(t *testing.T) {
 	snapshot := monitor.state.GetSnapshot()
 	connKey := hostConnectionPrefix + hostID
 	if healthy, ok := snapshot.ConnectionHealth[connKey]; !ok || !healthy {
-		t.Fatalf("expected connection health true (window clamped to minimum 30s), got %v (exists=%v)", healthy, ok)
+		t.Fatalf("expected connection health true (window clamped to minimum 60s), got %v (exists=%v)", healthy, ok)
 	}
 
 	for _, host := range snapshot.Hosts {
@@ -323,7 +323,7 @@ func TestEvaluateHostAgentsWindowClampedToMaximum(t *testing.T) {
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
 	hostID := "host-max-window"
-	// IntervalSeconds = 300 (5 min), so window = 300s * 4 = 1200s (20 min)
+	// IntervalSeconds = 300 (5 min), so window = 300s * 6 = 1800s (30 min)
 	// But maximum is 10 min = 600s
 	// Host last seen 11 minutes ago should be unhealthy (outside 10 min max window)
 	now := time.Now()
@@ -360,7 +360,7 @@ func TestEvaluateHostAgentsRecentLastSeenIsHealthy(t *testing.T) {
 
 	hostID := "host-recent"
 	now := time.Now()
-	// IntervalSeconds = 30, window = 30s * 4 = 120s (clamped to min 30s is not needed)
+	// IntervalSeconds = 30, window = 30s * 6 = 180s (clamped to min 60s is not needed)
 	// LastSeen = 10s ago, should be healthy
 	monitor.state.UpsertHost(models.Host{
 		ID:              hostID,
@@ -427,7 +427,7 @@ func TestEvaluateHostAgentsOldLastSeenIsUnhealthy(t *testing.T) {
 
 	hostID := "host-old-lastseen"
 	now := time.Now()
-	// IntervalSeconds = 30, window = 30s * 4 = 120s
+	// IntervalSeconds = 30, window = 30s * 6 = 180s
 	// LastSeen = 5 minutes ago, should be unhealthy
 	monitor.state.UpsertHost(models.Host{
 		ID:              hostID,
diff --git a/internal/monitoring/monitor_polling.go b/internal/monitoring/monitor_polling.go
index 51f2b22..58a42bb 100644
--- a/internal/monitoring/monitor_polling.go
+++ b/internal/monitoring/monitor_polling.go
@@ -842,6 +842,26 @@ func (m *Monitor) pollVMsWithNodes(ctx context.Context, instanceName string, cli
 	// Update state with all VMs
 	m.state.UpdateVMsForInstance(instanceName, allVMs)
 
+	// Record guest metrics history for running VMs (enables sparkline/trends view)
+	now := time.Now()
+	for _, vm := range allVMs {
+		if vm.Status == "running" {
+			m.metricsHistory.AddGuestMetric(vm.ID, "cpu", vm.CPU*100, now)
+			m.metricsHistory.AddGuestMetric(vm.ID, "memory", vm.Memory.Usage, now)
+			if vm.Disk.Usage >= 0 {
+				m.metricsHistory.AddGuestMetric(vm.ID, "disk", vm.Disk.Usage, now)
+			}
+			// Also write to persistent store
+			if m.metricsStore != nil {
+				m.metricsStore.Write("vm", vm.ID, "cpu", vm.CPU*100, now)
+				m.metricsStore.Write("vm", vm.ID, "memory", vm.Memory.Usage, now)
+				if vm.Disk.Usage >= 0 {
+					m.metricsStore.Write("vm", vm.ID, "disk", vm.Disk.Usage, now)
+				}
+			}
+		}
+	}
+
 	duration := time.Since(startTime)
 	log.Info().
 		Str("instance", instanceName).
@@ -874,6 +894,22 @@ func (m *Monitor) pollContainersWithNodes(ctx context.Context, instanceName stri
 		}
 	}
 
+	// Seed OCI classification from previous state so we never "downgrade" to LXC
+	// if container config fetching intermittently fails (permissions or transient API errors).
+	prevState := m.GetState()
+	prevContainerIsOCI := make(map[int]bool)
+	for _, ct := range prevState.Containers {
+		if ct.Instance != instanceName {
+			continue
+		}
+		if ct.VMID <= 0 {
+			continue
+		}
+		if ct.Type == "oci" || ct.IsOCI {
+			prevContainerIsOCI[ct.VMID] = true
+		}
+	}
+
 	log.Info().
 		Str("instance", instanceName).
 		Int("totalNodes", len(nodes)).
@@ -1006,6 +1042,11 @@ func (m *Monitor) pollContainersWithNodes(ctx context.Context, instanceName stri
 					Tags:       tags,
 				}
 
+				if prevContainerIsOCI[modelContainer.VMID] {
+					modelContainer.IsOCI = true
+					modelContainer.Type = "oci"
+				}
+
 				if override, ok := rootUsageOverrides[int(container.VMID)]; ok {
 					overrideUsed := clampToInt64(override.Used)
 					overrideTotal := clampToInt64(override.Total)
@@ -1109,6 +1150,26 @@ func (m *Monitor) pollContainersWithNodes(ctx context.Context, instanceName stri
 	// Update state with all containers
 	m.state.UpdateContainersForInstance(instanceName, allContainers)
 
+	// Record guest metrics history for running containers (enables sparkline/trends view)
+	now := time.Now()
+	for _, ct := range allContainers {
+		if ct.Status == "running" {
+			m.metricsHistory.AddGuestMetric(ct.ID, "cpu", ct.CPU*100, now)
+			m.metricsHistory.AddGuestMetric(ct.ID, "memory", ct.Memory.Usage, now)
+			if ct.Disk.Usage >= 0 {
+				m.metricsHistory.AddGuestMetric(ct.ID, "disk", ct.Disk.Usage, now)
+			}
+			// Also write to persistent store
+			if m.metricsStore != nil {
+				m.metricsStore.Write("container", ct.ID, "cpu", ct.CPU*100, now)
+				m.metricsStore.Write("container", ct.ID, "memory", ct.Memory.Usage, now)
+				if ct.Disk.Usage >= 0 {
+					m.metricsStore.Write("container", ct.ID, "disk", ct.Disk.Usage, now)
+				}
+			}
+		}
+	}
+
 	duration := time.Since(startTime)
 	log.Info().
 		Str("instance", instanceName).
@@ -1694,7 +1755,7 @@ func (m *Monitor) pollPVENode(
 		GuestURL:    guestURL,
 		Status:      effectiveStatus,
 		Type:        "node",
-		CPU:         safeFloat(node.CPU), // Already in percentage
+		CPU:         safeFloat(node.CPU), // Proxmox returns 0-1 ratio (e.g., 0.15 = 15%)
 		Memory: models.Memory{
 			Total: int64(node.MaxMem),
 			Used:  int64(node.Mem),
@@ -2086,48 +2147,103 @@ func (m *Monitor) pollPVENode(
 	if instanceCfg.TemperatureMonitoringEnabled != nil {
 		tempMonitoringEnabled = *instanceCfg.TemperatureMonitoringEnabled
 	}
-	if effectiveStatus == "online" && m.tempCollector != nil && tempMonitoringEnabled {
-		tempCtx, tempCancel := context.WithTimeout(ctx, 30*time.Second) // Increased to accommodate SSH operations via proxy
-		defer tempCancel()
+	if effectiveStatus == "online" && tempMonitoringEnabled {
+		// First, check if there's a matching host agent with temperature data.
+		// Host agent temperatures are preferred because they don't require SSH access.
+		hostAgentTemp := m.getHostAgentTemperature(node.Node)
+		if hostAgentTemp != nil {
+			log.Debug().
+				Str("node", node.Node).
+				Float64("cpuPackage", hostAgentTemp.CPUPackage).
+				Float64("cpuMax", hostAgentTemp.CPUMax).
+				Int("nvmeCount", len(hostAgentTemp.NVMe)).
+				Msg("Using temperature data from host agent")
+		}
 
-		// Determine SSH hostname to use (most robust approach):
-		// Prefer the resolved host for this node, with cluster overrides when available.
-		sshHost := modelNode.Host
-		foundNodeEndpoint := false
+		// If no host agent temp or we need additional data (SMART), try SSH/proxy collection
+		var proxyTemp *models.Temperature
+		var err error
+		if m.tempCollector != nil {
+			// Temperature collection is best-effort - use a short timeout to avoid blocking node polling
+			// Use context.Background() so the timeout is truly independent of the parent polling context
+			// If SSH is slow or unresponsive, we'll preserve previous temperature data
+			tempCtx, tempCancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer tempCancel()
 
-		if modelNode.IsClusterMember && instanceCfg.IsCluster {
-			// Try to find specific endpoint configuration for this node
-			if len(instanceCfg.ClusterEndpoints) > 0 {
-				hasFingerprint := instanceCfg.Fingerprint != ""
-				for _, ep := range instanceCfg.ClusterEndpoints {
-					if strings.EqualFold(ep.NodeName, node.Node) {
-						if effective := clusterEndpointEffectiveURL(ep, instanceCfg.VerifySSL, hasFingerprint); effective != "" {
-							sshHost = effective
-							foundNodeEndpoint = true
+			// Determine SSH hostname to use (most robust approach):
+			// Prefer the resolved host for this node, with cluster overrides when available.
+			sshHost := modelNode.Host
+			foundNodeEndpoint := false
+
+			if modelNode.IsClusterMember && instanceCfg.IsCluster {
+				// Try to find specific endpoint configuration for this node
+				if len(instanceCfg.ClusterEndpoints) > 0 {
+					hasFingerprint := instanceCfg.Fingerprint != ""
+					for _, ep := range instanceCfg.ClusterEndpoints {
+						if strings.EqualFold(ep.NodeName, node.Node) {
+							if effective := clusterEndpointEffectiveURL(ep, instanceCfg.VerifySSL, hasFingerprint); effective != "" {
+								sshHost = effective
+								foundNodeEndpoint = true
+							}
+							break
 						}
-						break
 					}
 				}
+
+				// If no specific endpoint found, fall back to node name
+				if !foundNodeEndpoint {
+					sshHost = node.Node
+					log.Debug().
+						Str("node", node.Node).
+						Str("instance", instanceCfg.Name).
+						Msg("Node endpoint not found in cluster metadata - falling back to node name for temperature collection")
+				}
 			}
 
-			// If no specific endpoint found, fall back to node name
-			if !foundNodeEndpoint {
+			if strings.TrimSpace(sshHost) == "" {
 				sshHost = node.Node
+			}
+
+			// Skip SSH/proxy collection if we already have host agent data and no proxy is configured
+			// (proxy might provide additional SMART data that host agent doesn't have)
+			skipProxyCollection := hostAgentTemp != nil &&
+				strings.TrimSpace(instanceCfg.TemperatureProxyURL) == "" &&
+				!m.HasSocketTemperatureProxy()
+
+			if !skipProxyCollection {
+				// Use HTTP proxy if configured for this instance, otherwise fall back to socket/SSH
+				proxyTemp, err = m.tempCollector.CollectTemperatureWithProxy(tempCtx, sshHost, node.Node, instanceCfg.TemperatureProxyURL, instanceCfg.TemperatureProxyToken)
+				if err != nil && hostAgentTemp == nil {
+					log.Debug().
+						Str("node", node.Node).
+						Str("sshHost", sshHost).
+						Bool("isCluster", modelNode.IsClusterMember).
+						Int("endpointCount", len(instanceCfg.ClusterEndpoints)).
+						Msg("Temperature collection failed - check SSH access")
+				}
+			}
+
+			// Debug: log proxy temp details before merge
+			if proxyTemp != nil {
 				log.Debug().
 					Str("node", node.Node).
-					Str("instance", instanceCfg.Name).
-					Msg("Node endpoint not found in cluster metadata - falling back to node name for temperature collection")
+					Bool("proxyTempAvailable", proxyTemp.Available).
+					Bool("proxyHasSMART", proxyTemp.HasSMART).
+					Int("proxySMARTCount", len(proxyTemp.SMART)).
+					Bool("proxyHasNVMe", proxyTemp.HasNVMe).
+					Int("proxyNVMeCount", len(proxyTemp.NVMe)).
+					Msg("Proxy temperature data before merge")
+			} else {
+				log.Debug().
+					Str("node", node.Node).
+					Msg("Proxy temperature data is nil")
 			}
 		}
 
-		if strings.TrimSpace(sshHost) == "" {
-			sshHost = node.Node
-		}
+		// Merge host agent and proxy temperatures
+		temp := mergeTemperatureData(hostAgentTemp, proxyTemp)
 
-		// Use HTTP proxy if configured for this instance, otherwise fall back to socket/SSH
-		temp, err := m.tempCollector.CollectTemperatureWithProxy(tempCtx, sshHost, node.Node, instanceCfg.TemperatureProxyURL, instanceCfg.TemperatureProxyToken)
-
-		if err == nil && temp != nil && temp.Available {
+		if temp != nil && temp.Available {
 			// Get the current CPU temperature (prefer package, fall back to max)
 			currentTemp := temp.CPUPackage
 			if currentTemp == 0 && temp.CPUMax > 0 {
@@ -2171,28 +2287,53 @@ func (m *Monitor) pollPVENode(
 			}
 
 			modelNode.Temperature = temp
+
+			// Determine source for logging
+			tempSource := "proxy/ssh"
+			if hostAgentTemp != nil && proxyTemp == nil {
+				tempSource = "host-agent"
+			} else if hostAgentTemp != nil && proxyTemp != nil {
+				tempSource = "host-agent+proxy"
+			}
+
 			log.Debug().
 				Str("node", node.Node).
-				Str("sshHost", sshHost).
+				Str("source", tempSource).
 				Float64("cpuPackage", temp.CPUPackage).
 				Float64("cpuMax", temp.CPUMax).
 				Float64("cpuMin", temp.CPUMin).
 				Float64("cpuMaxRecord", temp.CPUMaxRecord).
 				Int("nvmeCount", len(temp.NVMe)).
 				Msg("Collected temperature data")
-		} else if err != nil {
-			log.Debug().
-				Str("node", node.Node).
-				Str("sshHost", sshHost).
-				Bool("isCluster", modelNode.IsClusterMember).
-				Int("endpointCount", len(instanceCfg.ClusterEndpoints)).
-				Msg("Temperature collection failed - check SSH access")
-		} else if temp != nil {
-			log.Debug().
-				Str("node", node.Node).
-				Str("sshHost", sshHost).
-				Bool("available", temp.Available).
-				Msg("Temperature data unavailable after collection")
+		} else {
+			// Temperature data returned but not available (temp != nil && !temp.Available)
+			// OR no temperature data from any source - preserve previous temperature if available
+			// This prevents the temperature column from flickering when collection temporarily fails
+			var prevTemp *models.Temperature
+			for _, prevNode := range prevInstanceNodes {
+				if prevNode.ID == modelNode.ID && prevNode.Temperature != nil && prevNode.Temperature.Available {
+					prevTemp = prevNode.Temperature
+					break
+				}
+			}
+
+			if prevTemp != nil {
+				// Clone the previous temperature to avoid modifying historical data
+				preserved := *prevTemp
+				preserved.LastUpdate = prevTemp.LastUpdate // Keep original update time to indicate staleness
+				modelNode.Temperature = &preserved
+				log.Debug().
+					Str("node", node.Node).
+					Bool("isCluster", modelNode.IsClusterMember).
+					Float64("cpuPackage", preserved.CPUPackage).
+					Time("lastUpdate", preserved.LastUpdate).
+					Msg("Preserved previous temperature data (current collection failed or unavailable)")
+			} else {
+				log.Debug().
+					Str("node", node.Node).
+					Bool("isCluster", modelNode.IsClusterMember).
+					Msg("No temperature data available (collection failed, no previous data to preserve)")
+			}
 		}
 	}
 
diff --git a/internal/resources/converters.go b/internal/resources/converters.go
new file mode 100644
index 0000000..907ab92
--- /dev/null
+++ b/internal/resources/converters.go
@@ -0,0 +1,1085 @@
+package resources
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+// FromNode converts a Proxmox Node to a unified Resource.
+func FromNode(n models.Node) Resource {
+	// Calculate primary temperature if available
+	var temp *float64
+	if n.Temperature != nil && n.Temperature.Available && n.Temperature.HasCPU {
+		// Use CPU package temperature if available, otherwise average core temps
+		if n.Temperature.CPUPackage > 0 {
+			temp = &n.Temperature.CPUPackage
+		} else if len(n.Temperature.Cores) > 0 {
+			avg := 0.0
+			for _, c := range n.Temperature.Cores {
+				avg += c.Temp
+			}
+			avg /= float64(len(n.Temperature.Cores))
+			temp = &avg
+		}
+	}
+
+	// Build memory metric
+	var memory *MetricValue
+	if n.Memory.Total > 0 {
+		memory = &MetricValue{
+			Current: n.Memory.Usage,
+			Total:   &n.Memory.Total,
+			Used:    &n.Memory.Used,
+			Free:    &n.Memory.Free,
+		}
+	}
+
+	// Build disk metric
+	var disk *MetricValue
+	if n.Disk.Total > 0 {
+		disk = &MetricValue{
+			Current: n.Disk.Usage,
+			Total:   &n.Disk.Total,
+			Used:    &n.Disk.Used,
+			Free:    &n.Disk.Free,
+		}
+	}
+
+	// Build platform data
+	platformData := NodePlatformData{
+		Instance:         n.Instance,
+		Host:             n.Host,
+		GuestURL:         n.GuestURL,
+		PVEVersion:       n.PVEVersion,
+		KernelVersion:    n.KernelVersion,
+		LoadAverage:      n.LoadAverage,
+		IsClusterMember:  n.IsClusterMember,
+		ClusterName:      n.ClusterName,
+		ConnectionHealth: n.ConnectionHealth,
+		CPUInfo: CPUInfo{
+			Model:   n.CPUInfo.Model,
+			Cores:   n.CPUInfo.Cores,
+			Sockets: n.CPUInfo.Sockets,
+		},
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Determine cluster ID
+	clusterID := ""
+	if n.IsClusterMember && n.ClusterName != "" {
+		clusterID = fmt.Sprintf("pve-cluster/%s", n.ClusterName)
+	}
+
+	return Resource{
+		ID:           n.ID,
+		Type:         ResourceTypeNode,
+		Name:         n.Name,
+		DisplayName:  n.DisplayName,
+		PlatformID:   n.Instance,
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		ClusterID:    clusterID,
+		Status:       mapNodeStatus(n.Status),
+		CPU: &MetricValue{
+			Current: n.CPU * 100, // Node CPU is 0-1, convert to percentage
+		},
+		Memory:       memory,
+		Disk:         disk,
+		Temperature:  temp,
+		Uptime:       &n.Uptime,
+		LastSeen:     n.LastSeen,
+		PlatformData: platformDataJSON,
+		Identity: &ResourceIdentity{
+			Hostname: n.Name,
+		},
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromVM converts a Proxmox VM to a unified Resource.
+func FromVM(vm models.VM) Resource {
+	// Build memory metric
+	var memory *MetricValue
+	if vm.Memory.Total > 0 {
+		memory = &MetricValue{
+			Current: vm.Memory.Usage,
+			Total:   &vm.Memory.Total,
+			Used:    &vm.Memory.Used,
+			Free:    &vm.Memory.Free,
+		}
+	}
+
+	// Build disk metric
+	var disk *MetricValue
+	if vm.Disk.Total > 0 {
+		disk = &MetricValue{
+			Current: vm.Disk.Usage,
+			Total:   &vm.Disk.Total,
+			Used:    &vm.Disk.Used,
+			Free:    &vm.Disk.Free,
+		}
+	}
+
+	// Build network metric
+	network := &NetworkMetric{
+		RXBytes: vm.NetworkIn,
+		TXBytes: vm.NetworkOut,
+	}
+
+	// Build platform data
+	var lastBackup *time.Time
+	if !vm.LastBackup.IsZero() {
+		lastBackup = &vm.LastBackup
+	}
+	platformData := VMPlatformData{
+		VMID:         vm.VMID,
+		Node:         vm.Node,
+		Instance:     vm.Instance,
+		CPUs:         vm.CPUs,
+		Template:     vm.Template,
+		Lock:         vm.Lock,
+		AgentVersion: vm.AgentVersion,
+		OSName:       vm.OSName,
+		OSVersion:    vm.OSVersion,
+		IPAddresses:  vm.IPAddresses,
+		NetworkIn:    vm.NetworkIn,
+		NetworkOut:   vm.NetworkOut,
+		DiskRead:     vm.DiskRead,
+		DiskWrite:    vm.DiskWrite,
+		LastBackup:   lastBackup,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Parent is the node - format matches Node.ID: instance-nodename
+	parentID := fmt.Sprintf("%s-%s", vm.Instance, vm.Node)
+
+	return Resource{
+		ID:           vm.ID,
+		Type:         ResourceTypeVM,
+		Name:         vm.Name,
+		PlatformID:   vm.Instance,
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		ParentID:     parentID,
+		Status:       mapGuestStatus(vm.Status),
+		CPU: &MetricValue{
+			Current: vm.CPU * 100, // VM CPU is 0-1, convert to percentage
+		},
+		Memory:        memory,
+		Disk:          disk,
+		Network:       network,
+		Uptime:        &vm.Uptime,
+		Tags:          vm.Tags,
+		LastSeen:      vm.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromContainer converts a Proxmox LXC Container to a unified Resource.
+func FromContainer(ct models.Container) Resource {
+	// Build memory metric
+	var memory *MetricValue
+	if ct.Memory.Total > 0 {
+		memory = &MetricValue{
+			Current: ct.Memory.Usage,
+			Total:   &ct.Memory.Total,
+			Used:    &ct.Memory.Used,
+			Free:    &ct.Memory.Free,
+		}
+	}
+
+	// Build disk metric
+	var disk *MetricValue
+	if ct.Disk.Total > 0 {
+		disk = &MetricValue{
+			Current: ct.Disk.Usage,
+			Total:   &ct.Disk.Total,
+			Used:    &ct.Disk.Used,
+			Free:    &ct.Disk.Free,
+		}
+	}
+
+	// Build network metric
+	network := &NetworkMetric{
+		RXBytes: ct.NetworkIn,
+		TXBytes: ct.NetworkOut,
+	}
+
+	// Build platform data
+	var lastBackup *time.Time
+	if !ct.LastBackup.IsZero() {
+		lastBackup = &ct.LastBackup
+	}
+	platformData := ContainerPlatformData{
+		VMID:        ct.VMID,
+		Node:        ct.Node,
+		Instance:    ct.Instance,
+		Type:        ct.Type,
+		CPUs:        ct.CPUs,
+		Template:    ct.Template,
+		Lock:        ct.Lock,
+		OSName:      ct.OSName,
+		IPAddresses: ct.IPAddresses,
+		IsOCI:       ct.IsOCI || strings.EqualFold(strings.TrimSpace(ct.Type), "oci"),
+		OSTemplate:  ct.OSTemplate,
+		NetworkIn:   ct.NetworkIn,
+		NetworkOut:  ct.NetworkOut,
+		DiskRead:    ct.DiskRead,
+		DiskWrite:   ct.DiskWrite,
+		LastBackup:  lastBackup,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Parent is the node - format matches Node.ID: instance-nodename
+	parentID := fmt.Sprintf("%s-%s", ct.Instance, ct.Node)
+
+	resourceType := ResourceTypeContainer
+	if platformData.IsOCI {
+		resourceType = ResourceTypeOCIContainer
+	}
+
+	return Resource{
+		ID:           ct.ID,
+		Type:         resourceType,
+		Name:         ct.Name,
+		PlatformID:   ct.Instance,
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		ParentID:     parentID,
+		Status:       mapGuestStatus(ct.Status),
+		CPU: &MetricValue{
+			Current: ct.CPU * 100, // Container CPU is 0-1, convert to percentage
+		},
+		Memory:        memory,
+		Disk:          disk,
+		Network:       network,
+		Uptime:        &ct.Uptime,
+		Tags:          ct.Tags,
+		LastSeen:      ct.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromHost converts a Host agent to a unified Resource.
+func FromHost(h models.Host) Resource {
+	// Build memory metric
+	var memory *MetricValue
+	if h.Memory.Total > 0 {
+		memory = &MetricValue{
+			Current: h.Memory.Usage,
+			Total:   &h.Memory.Total,
+			Used:    &h.Memory.Used,
+			Free:    &h.Memory.Free,
+		}
+	}
+
+	// Combine disk metrics from multiple disks
+	var disk *MetricValue
+	var totalDisk, usedDisk, freeDisk int64
+	for _, d := range h.Disks {
+		totalDisk += d.Total
+		usedDisk += d.Used
+		freeDisk += d.Free
+	}
+	if totalDisk > 0 {
+		usage := float64(usedDisk) / float64(totalDisk) * 100
+		disk = &MetricValue{
+			Current: usage,
+			Total:   &totalDisk,
+			Used:    &usedDisk,
+			Free:    &freeDisk,
+		}
+	}
+
+	// Calculate network totals
+	var rxTotal, txTotal int64
+	for _, iface := range h.NetworkInterfaces {
+		rxTotal += int64(iface.RXBytes)
+		txTotal += int64(iface.TXBytes)
+	}
+	network := &NetworkMetric{
+		RXBytes: rxTotal,
+		TXBytes: txTotal,
+	}
+
+	// Get primary temperature
+	var temp *float64
+	if len(h.Sensors.TemperatureCelsius) > 0 {
+		// Pick the first available temperature
+		for _, t := range h.Sensors.TemperatureCelsius {
+			temp = &t
+			break
+		}
+	}
+
+	// Build platform data
+	disks := make([]DiskInfo, len(h.Disks))
+	for i, d := range h.Disks {
+		disks[i] = DiskInfo{
+			Mountpoint: d.Mountpoint,
+			Device:     d.Device,
+			Type:       d.Type,
+			Total:      d.Total,
+			Used:       d.Used,
+			Free:       d.Free,
+			Usage:      d.Usage,
+		}
+	}
+
+	interfaces := make([]NetworkInterface, len(h.NetworkInterfaces))
+	for i, iface := range h.NetworkInterfaces {
+		interfaces[i] = NetworkInterface{
+			Name:      iface.Name,
+			MAC:       iface.MAC,
+			Addresses: iface.Addresses,
+			RXBytes:   iface.RXBytes,
+			TXBytes:   iface.TXBytes,
+			SpeedMbps: iface.SpeedMbps,
+		}
+	}
+
+	diskIO := make([]DiskIOStats, len(h.DiskIO))
+	for i, d := range h.DiskIO {
+		diskIO[i] = DiskIOStats{
+			Device:      d.Device,
+			ReadBytes:   d.ReadBytes,
+			WriteBytes:  d.WriteBytes,
+			ReadOps:     d.ReadOps,
+			WriteOps:    d.WriteOps,
+			ReadTimeMs:  d.ReadTime,
+			WriteTimeMs: d.WriteTime,
+			IOTimeMs:    d.IOTime,
+		}
+	}
+
+	raid := make([]HostRAIDArray, len(h.RAID))
+	for i, r := range h.RAID {
+		devices := make([]HostRAIDDevice, len(r.Devices))
+		for j, d := range r.Devices {
+			devices[j] = HostRAIDDevice{
+				Device: d.Device,
+				State:  d.State,
+				Slot:   d.Slot,
+			}
+		}
+		raid[i] = HostRAIDArray{
+			Device:         r.Device,
+			Name:           r.Name,
+			Level:          r.Level,
+			State:          r.State,
+			TotalDevices:   r.TotalDevices,
+			ActiveDevices:  r.ActiveDevices,
+			WorkingDevices: r.WorkingDevices,
+			FailedDevices:  r.FailedDevices,
+			SpareDevices:   r.SpareDevices,
+			UUID:           r.UUID,
+			Devices:        devices,
+			RebuildPercent: r.RebuildPercent,
+			RebuildSpeed:   r.RebuildSpeed,
+		}
+	}
+
+	platformData := HostPlatformData{
+		Platform:        h.Platform,
+		OSName:          h.OSName,
+		OSVersion:       h.OSVersion,
+		KernelVersion:   h.KernelVersion,
+		Architecture:    h.Architecture,
+		CPUCount:        h.CPUCount,
+		LoadAverage:     h.LoadAverage,
+		AgentVersion:    h.AgentVersion,
+		IsLegacy:        h.IsLegacy,
+		Disks:           disks,
+		Interfaces:      interfaces,
+		DiskIO:          diskIO,
+		RAID:            raid,
+		TokenID:         h.TokenID,
+		TokenName:       h.TokenName,
+		TokenHint:       h.TokenHint,
+		TokenLastUsedAt: h.TokenLastUsedAt,
+		Sensors: HostSensorSummary{
+			TemperatureCelsius: h.Sensors.TemperatureCelsius,
+			FanRPM:             h.Sensors.FanRPM,
+			Additional:         h.Sensors.Additional,
+		},
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Collect IPs for identity
+	var ips []string
+	for _, iface := range h.NetworkInterfaces {
+		ips = append(ips, iface.Addresses...)
+	}
+
+	return Resource{
+		ID:           h.ID,
+		Type:         ResourceTypeHost,
+		Name:         h.Hostname,
+		DisplayName:  h.DisplayName,
+		PlatformID:   "host-agent", // No specific platform ID for host agents
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		Status:       mapHostStatus(h.Status),
+		CPU: &MetricValue{
+			Current: h.CPUUsage,
+		},
+		Memory:       memory,
+		Disk:         disk,
+		Network:      network,
+		Temperature:  temp,
+		Uptime:       &h.UptimeSeconds,
+		Tags:         h.Tags,
+		LastSeen:     h.LastSeen,
+		PlatformData: platformDataJSON,
+		Identity: &ResourceIdentity{
+			Hostname: h.Hostname,
+			IPs:      ips,
+		},
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromDockerHost converts a DockerHost to a unified Resource.
+func FromDockerHost(dh models.DockerHost) Resource {
+	// Build memory metric
+	var memory *MetricValue
+	if dh.Memory.Total > 0 {
+		memory = &MetricValue{
+			Current: dh.Memory.Usage,
+			Total:   &dh.Memory.Total,
+			Used:    &dh.Memory.Used,
+			Free:    &dh.Memory.Free,
+		}
+	}
+
+	// Combine disk metrics
+	var disk *MetricValue
+	var totalDisk, usedDisk, freeDisk int64
+	for _, d := range dh.Disks {
+		totalDisk += d.Total
+		usedDisk += d.Used
+		freeDisk += d.Free
+	}
+	if totalDisk > 0 {
+		usage := float64(usedDisk) / float64(totalDisk) * 100
+		disk = &MetricValue{
+			Current: usage,
+			Total:   &totalDisk,
+			Used:    &usedDisk,
+			Free:    &freeDisk,
+		}
+	}
+
+	// Calculate network totals
+	var rxTotal, txTotal int64
+	for _, iface := range dh.NetworkInterfaces {
+		rxTotal += int64(iface.RXBytes)
+		txTotal += int64(iface.TXBytes)
+	}
+	network := &NetworkMetric{
+		RXBytes: rxTotal,
+		TXBytes: txTotal,
+	}
+
+	// Build platform data
+	disks := make([]DiskInfo, len(dh.Disks))
+	for i, d := range dh.Disks {
+		disks[i] = DiskInfo{
+			Mountpoint: d.Mountpoint,
+			Device:     d.Device,
+			Type:       d.Type,
+			Total:      d.Total,
+			Used:       d.Used,
+			Free:       d.Free,
+			Usage:      d.Usage,
+		}
+	}
+
+	interfaces := make([]NetworkInterface, len(dh.NetworkInterfaces))
+	for i, iface := range dh.NetworkInterfaces {
+		interfaces[i] = NetworkInterface{
+			Name:      iface.Name,
+			MAC:       iface.MAC,
+			Addresses: iface.Addresses,
+			RXBytes:   iface.RXBytes,
+			TXBytes:   iface.TXBytes,
+			SpeedMbps: iface.SpeedMbps,
+		}
+	}
+
+	var swarm *DockerSwarmInfo
+	if dh.Swarm != nil {
+		swarm = &DockerSwarmInfo{
+			NodeID:           dh.Swarm.NodeID,
+			NodeRole:         dh.Swarm.NodeRole,
+			LocalState:       dh.Swarm.LocalState,
+			ControlAvailable: dh.Swarm.ControlAvailable,
+			ClusterID:        dh.Swarm.ClusterID,
+			ClusterName:      dh.Swarm.ClusterName,
+			Scope:            dh.Swarm.Scope,
+			Error:            dh.Swarm.Error,
+		}
+	}
+
+	platformData := DockerHostPlatformData{
+		AgentID:           dh.AgentID,
+		MachineID:         dh.MachineID,
+		OS:                dh.OS,
+		KernelVersion:     dh.KernelVersion,
+		Architecture:      dh.Architecture,
+		Runtime:           dh.Runtime,
+		RuntimeVersion:    dh.RuntimeVersion,
+		DockerVersion:     dh.DockerVersion,
+		LoadAverage:       dh.LoadAverage,
+		AgentVersion:      dh.AgentVersion,
+		CPUs:              dh.CPUs,
+		IsLegacy:          dh.IsLegacy,
+		Disks:             disks,
+		Interfaces:        interfaces,
+		CustomDisplayName: dh.CustomDisplayName,
+		Hidden:            dh.Hidden,
+		PendingUninstall:  dh.PendingUninstall,
+		Swarm:             swarm,
+		TokenID:           dh.TokenID,
+		TokenName:         dh.TokenName,
+		TokenHint:         dh.TokenHint,
+		TokenLastUsedAt:   dh.TokenLastUsedAt,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Collect IPs for identity
+	var ips []string
+	for _, iface := range dh.NetworkInterfaces {
+		ips = append(ips, iface.Addresses...)
+	}
+
+	// Determine display name
+	displayName := dh.DisplayName
+	if dh.CustomDisplayName != "" {
+		displayName = dh.CustomDisplayName
+	}
+
+	// Determine cluster ID from swarm
+	clusterID := ""
+	if dh.Swarm != nil && dh.Swarm.ClusterID != "" {
+		clusterID = fmt.Sprintf("docker-swarm/%s", dh.Swarm.ClusterID)
+	}
+
+	return Resource{
+		ID:           dh.ID,
+		Type:         ResourceTypeDockerHost,
+		Name:         dh.Hostname,
+		DisplayName:  displayName,
+		PlatformID:   dh.AgentID,
+		PlatformType: PlatformDocker,
+		SourceType:   SourceAgent,
+		ClusterID:    clusterID,
+		Status:       mapDockerHostStatus(dh.Status),
+		CPU: &MetricValue{
+			Current: dh.CPUUsage,
+		},
+		Memory:       memory,
+		Disk:         disk,
+		Network:      network,
+		Uptime:       &dh.UptimeSeconds,
+		LastSeen:     dh.LastSeen,
+		PlatformData: platformDataJSON,
+		Identity: &ResourceIdentity{
+			Hostname:  dh.Hostname,
+			MachineID: dh.MachineID,
+			IPs:       ips,
+		},
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromDockerContainer converts a DockerContainer to a unified Resource.
+func FromDockerContainer(dc models.DockerContainer, hostID, hostName string) Resource {
+	// Build memory metric
+	memTotal := dc.MemoryLimit
+	memUsed := dc.MemoryUsage
+	var memory *MetricValue
+	if memTotal > 0 {
+		memory = &MetricValue{
+			Current: dc.MemoryPercent,
+			Total:   &memTotal,
+			Used:    &memUsed,
+		}
+	}
+
+	// Build platform data
+	ports := make([]ContainerPort, len(dc.Ports))
+	for i, p := range dc.Ports {
+		ports[i] = ContainerPort{
+			PrivatePort: p.PrivatePort,
+			PublicPort:  p.PublicPort,
+			Protocol:    p.Protocol,
+			IP:          p.IP,
+		}
+	}
+
+	networks := make([]ContainerNetwork, len(dc.Networks))
+	for i, n := range dc.Networks {
+		networks[i] = ContainerNetwork{
+			Name: n.Name,
+			IPv4: n.IPv4,
+			IPv6: n.IPv6,
+		}
+	}
+
+	var podman *PodmanContainerInfo
+	if dc.Podman != nil {
+		podman = &PodmanContainerInfo{
+			PodName:        dc.Podman.PodName,
+			PodID:          dc.Podman.PodID,
+			Infra:          dc.Podman.Infra,
+			ComposeProject: dc.Podman.ComposeProject,
+			ComposeService: dc.Podman.ComposeService,
+		}
+	}
+
+	platformData := DockerContainerPlatformData{
+		HostID:       hostID,
+		HostName:     hostName,
+		Image:        dc.Image,
+		State:        dc.State,
+		Status:       dc.Status,
+		Health:       dc.Health,
+		RestartCount: dc.RestartCount,
+		ExitCode:     dc.ExitCode,
+		CreatedAt:    dc.CreatedAt,
+		StartedAt:    dc.StartedAt,
+		FinishedAt:   dc.FinishedAt,
+		Labels:       dc.Labels,
+		Ports:        ports,
+		Networks:     networks,
+		Podman:       podman,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	// Create unique ID combining host and container
+	resourceID := fmt.Sprintf("%s/%s", hostID, dc.ID)
+
+	return Resource{
+		ID:           resourceID,
+		Type:         ResourceTypeDockerContainer,
+		Name:         dc.Name,
+		PlatformID:   hostID,
+		PlatformType: PlatformDocker,
+		SourceType:   SourceAgent,
+		ParentID:     hostID,
+		Status:       mapDockerContainerStatus(dc.State),
+		CPU: &MetricValue{
+			Current: dc.CPUPercent,
+		},
+		Memory:        memory,
+		Uptime:        &dc.UptimeSeconds,
+		Labels:        dc.Labels,
+		LastSeen:      time.Now(), // Containers don't have their own LastSeen
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromKubernetesCluster converts a KubernetesCluster to a unified Resource.
+func FromKubernetesCluster(cluster models.KubernetesCluster) Resource {
+	platformData := KubernetesClusterPlatformData{
+		AgentID:           cluster.AgentID,
+		Server:            cluster.Server,
+		Context:           cluster.Context,
+		Version:           cluster.Version,
+		CustomDisplayName: cluster.CustomDisplayName,
+		Hidden:            cluster.Hidden,
+		PendingUninstall:  cluster.PendingUninstall,
+		NodeCount:         len(cluster.Nodes),
+		PodCount:          len(cluster.Pods),
+		DeploymentCount:   len(cluster.Deployments),
+		TokenID:           cluster.TokenID,
+		TokenName:         cluster.TokenName,
+		TokenHint:         cluster.TokenHint,
+		TokenLastUsedAt:   cluster.TokenLastUsedAt,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	displayName := strings.TrimSpace(cluster.DisplayName)
+	if displayName == "" {
+		displayName = strings.TrimSpace(cluster.Name)
+	}
+	if cluster.CustomDisplayName != "" {
+		displayName = cluster.CustomDisplayName
+	}
+	if displayName == "" {
+		displayName = cluster.ID
+	}
+
+	name := strings.TrimSpace(cluster.Name)
+	if name == "" {
+		name = displayName
+	}
+
+	return Resource{
+		ID:            cluster.ID,
+		Type:          ResourceTypeK8sCluster,
+		Name:          name,
+		DisplayName:   displayName,
+		PlatformID:    cluster.AgentID,
+		PlatformType:  PlatformKubernetes,
+		SourceType:    SourceAgent,
+		Status:        mapKubernetesClusterStatus(cluster.Status),
+		LastSeen:      cluster.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromKubernetesNode converts a KubernetesNode to a unified Resource.
+func FromKubernetesNode(node models.KubernetesNode, cluster models.KubernetesCluster) Resource {
+	platformData := KubernetesNodePlatformData{
+		ClusterID:               cluster.ID,
+		Ready:                   node.Ready,
+		Unschedulable:           node.Unschedulable,
+		KubeletVersion:          node.KubeletVersion,
+		ContainerRuntimeVersion: node.ContainerRuntimeVersion,
+		OSImage:                 node.OSImage,
+		KernelVersion:           node.KernelVersion,
+		Architecture:            node.Architecture,
+		CapacityCPUCores:        node.CapacityCPU,
+		CapacityMemoryBytes:     node.CapacityMemoryBytes,
+		CapacityPods:            node.CapacityPods,
+		AllocatableCPUCores:     node.AllocCPU,
+		AllocatableMemoryBytes:  node.AllocMemoryBytes,
+		AllocatablePods:         node.AllocPods,
+		Roles:                   append([]string(nil), node.Roles...),
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	nodeID := strings.TrimSpace(node.UID)
+	if nodeID == "" {
+		nodeID = node.Name
+	}
+	resourceID := fmt.Sprintf("%s/node/%s", cluster.ID, nodeID)
+
+	status := StatusUnknown
+	if node.Ready {
+		status = StatusOnline
+	} else {
+		status = StatusOffline
+	}
+	if node.Unschedulable && status == StatusOnline {
+		status = StatusDegraded
+	}
+
+	return Resource{
+		ID:            resourceID,
+		Type:          ResourceTypeK8sNode,
+		Name:          node.Name,
+		PlatformID:    cluster.ID,
+		PlatformType:  PlatformKubernetes,
+		SourceType:    SourceAgent,
+		ParentID:      cluster.ID,
+		Status:        status,
+		LastSeen:      cluster.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromKubernetesPod converts a KubernetesPod to a unified Resource.
+func FromKubernetesPod(pod models.KubernetesPod, cluster models.KubernetesCluster) Resource {
+	containers := make([]KubernetesPodContainerInfo, 0, len(pod.Containers))
+	for _, c := range pod.Containers {
+		containers = append(containers, KubernetesPodContainerInfo{
+			Name:         c.Name,
+			Image:        c.Image,
+			Ready:        c.Ready,
+			RestartCount: c.RestartCount,
+			State:        c.State,
+			Reason:       c.Reason,
+			Message:      c.Message,
+		})
+	}
+
+	platformData := KubernetesPodPlatformData{
+		ClusterID:  cluster.ID,
+		Namespace:  pod.Namespace,
+		NodeName:   pod.NodeName,
+		Phase:      pod.Phase,
+		Reason:     pod.Reason,
+		Message:    pod.Message,
+		QoSClass:   pod.QoSClass,
+		Restarts:   pod.Restarts,
+		OwnerKind:  pod.OwnerKind,
+		OwnerName:  pod.OwnerName,
+		Containers: containers,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	podID := strings.TrimSpace(pod.UID)
+	if podID == "" {
+		podID = fmt.Sprintf("%s/%s", pod.Namespace, pod.Name)
+	}
+	resourceID := fmt.Sprintf("%s/pod/%s", cluster.ID, podID)
+
+	parentID := cluster.ID
+	if strings.TrimSpace(pod.NodeName) != "" {
+		parentID = fmt.Sprintf("%s/node/%s", cluster.ID, pod.NodeName)
+	}
+
+	lastSeen := cluster.LastSeen
+
+	return Resource{
+		ID:            resourceID,
+		Type:          ResourceTypePod,
+		Name:          pod.Name,
+		PlatformID:    cluster.ID,
+		PlatformType:  PlatformKubernetes,
+		SourceType:    SourceAgent,
+		ParentID:      parentID,
+		Status:        mapKubernetesPodStatus(pod.Phase),
+		Labels:        pod.Labels,
+		LastSeen:      lastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromKubernetesDeployment converts a KubernetesDeployment to a unified Resource.
+func FromKubernetesDeployment(dep models.KubernetesDeployment, cluster models.KubernetesCluster) Resource {
+	platformData := KubernetesDeploymentPlatformData{
+		ClusterID:         cluster.ID,
+		Namespace:         dep.Namespace,
+		DesiredReplicas:   dep.DesiredReplicas,
+		UpdatedReplicas:   dep.UpdatedReplicas,
+		ReadyReplicas:     dep.ReadyReplicas,
+		AvailableReplicas: dep.AvailableReplicas,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	depID := strings.TrimSpace(dep.UID)
+	if depID == "" {
+		depID = fmt.Sprintf("%s/%s", dep.Namespace, dep.Name)
+	}
+	resourceID := fmt.Sprintf("%s/deployment/%s", cluster.ID, depID)
+
+	status := StatusUnknown
+	switch {
+	case dep.DesiredReplicas == 0:
+		status = StatusStopped
+	case dep.AvailableReplicas >= dep.DesiredReplicas:
+		status = StatusRunning
+	case dep.AvailableReplicas > 0:
+		status = StatusDegraded
+	}
+
+	return Resource{
+		ID:            resourceID,
+		Type:          ResourceTypeK8sDeployment,
+		Name:          dep.Name,
+		PlatformID:    cluster.ID,
+		PlatformType:  PlatformKubernetes,
+		SourceType:    SourceAgent,
+		ParentID:      cluster.ID,
+		Status:        status,
+		Labels:        dep.Labels,
+		LastSeen:      cluster.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromPBSInstance converts a PBS instance to a unified Resource.
+func FromPBSInstance(pbs models.PBSInstance) Resource {
+	// Build memory metric
+	var memory *MetricValue
+	if pbs.MemoryTotal > 0 {
+		memory = &MetricValue{
+			Current: pbs.Memory,
+			Total:   &pbs.MemoryTotal,
+			Used:    &pbs.MemoryUsed,
+		}
+	}
+
+	platformData := PBSPlatformData{
+		Host:             pbs.Host,
+		Version:          pbs.Version,
+		ConnectionHealth: pbs.ConnectionHealth,
+		MemoryUsed:       pbs.MemoryUsed,
+		MemoryTotal:      pbs.MemoryTotal,
+		NumDatastores:    len(pbs.Datastores),
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	return Resource{
+		ID:           pbs.ID,
+		Type:         ResourceTypePBS,
+		Name:         pbs.Name,
+		PlatformID:   pbs.Host,
+		PlatformType: PlatformProxmoxPBS,
+		SourceType:   SourceAPI,
+		Status:       mapPBSStatus(pbs.Status, pbs.ConnectionHealth),
+		CPU: &MetricValue{
+			Current: pbs.CPU,
+		},
+		Memory:        memory,
+		Uptime:        &pbs.Uptime,
+		LastSeen:      pbs.LastSeen,
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// FromStorage converts a Proxmox Storage to a unified Resource.
+func FromStorage(s models.Storage) Resource {
+	var disk *MetricValue
+	if s.Total > 0 {
+		disk = &MetricValue{
+			Current: s.Usage,
+			Total:   &s.Total,
+			Used:    &s.Used,
+			Free:    &s.Free,
+		}
+	}
+
+	platformData := StoragePlatformData{
+		Instance: s.Instance,
+		Node:     s.Node,
+		Nodes:    s.Nodes,
+		Type:     s.Type,
+		Content:  s.Content,
+		Shared:   s.Shared,
+		Enabled:  s.Enabled,
+		Active:   s.Active,
+	}
+	platformDataJSON, _ := json.Marshal(platformData)
+
+	status := StatusOnline
+	if !s.Active {
+		status = StatusOffline
+	} else if !s.Enabled {
+		status = StatusStopped
+	}
+
+	return Resource{
+		ID:            s.ID,
+		Type:          ResourceTypeStorage,
+		Name:          s.Name,
+		PlatformID:    s.Instance,
+		PlatformType:  PlatformProxmoxPVE,
+		SourceType:    SourceAPI,
+		ParentID:      fmt.Sprintf("%s-%s", s.Instance, s.Node), // Format matches Node.ID: instance-nodename
+		Status:        status,
+		Disk:          disk,
+		LastSeen:      time.Now(), // Storage doesn't have LastSeen
+		PlatformData:  platformDataJSON,
+		SchemaVersion: CurrentSchemaVersion,
+	}
+}
+
+// Status mapping helpers
+
+func mapNodeStatus(status string) ResourceStatus {
+	switch strings.ToLower(status) {
+	case "online":
+		return StatusOnline
+	case "offline":
+		return StatusOffline
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapGuestStatus(status string) ResourceStatus {
+	switch strings.ToLower(status) {
+	case "running":
+		return StatusRunning
+	case "stopped":
+		return StatusStopped
+	case "paused":
+		return StatusPaused
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapHostStatus(status string) ResourceStatus {
+	switch strings.ToLower(status) {
+	case "online":
+		return StatusOnline
+	case "offline":
+		return StatusOffline
+	case "degraded":
+		return StatusDegraded
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapDockerHostStatus(status string) ResourceStatus {
+	switch strings.ToLower(status) {
+	case "online":
+		return StatusOnline
+	case "offline":
+		return StatusOffline
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapDockerContainerStatus(state string) ResourceStatus {
+	switch strings.ToLower(state) {
+	case "running":
+		return StatusRunning
+	case "exited", "dead":
+		return StatusStopped
+	case "paused":
+		return StatusPaused
+	case "restarting", "created":
+		return StatusUnknown
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapKubernetesClusterStatus(status string) ResourceStatus {
+	switch strings.ToLower(strings.TrimSpace(status)) {
+	case "online":
+		return StatusOnline
+	case "offline":
+		return StatusOffline
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapKubernetesPodStatus(phase string) ResourceStatus {
+	switch strings.ToLower(strings.TrimSpace(phase)) {
+	case "running":
+		return StatusRunning
+	case "succeeded", "failed":
+		return StatusStopped
+	case "pending":
+		return StatusUnknown
+	default:
+		return StatusUnknown
+	}
+}
+
+func mapPBSStatus(status, connectionHealth string) ResourceStatus {
+	if connectionHealth != "healthy" {
+		return StatusDegraded
+	}
+	switch strings.ToLower(status) {
+	case "online":
+		return StatusOnline
+	case "offline":
+		return StatusOffline
+	default:
+		return StatusUnknown
+	}
+}
diff --git a/internal/resources/converters_test.go b/internal/resources/converters_test.go
new file mode 100644
index 0000000..01679e9
--- /dev/null
+++ b/internal/resources/converters_test.go
@@ -0,0 +1,598 @@
+package resources
+
+import (
+	"testing"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+func TestFromNode(t *testing.T) {
+	node := models.Node{
+		ID:          "pve1/node/node1",
+		Name:        "node1",
+		DisplayName: "Production Node 1",
+		Instance:    "pve1",
+		Host:        "https://192.168.1.100:8006",
+		Status:      "online",
+		CPU:         0.25, // 25%
+		Memory: models.Memory{
+			Total: 16 * 1024 * 1024 * 1024, // 16GB
+			Used:  8 * 1024 * 1024 * 1024,  // 8GB
+			Free:  8 * 1024 * 1024 * 1024,
+			Usage: 50.0,
+		},
+		Disk: models.Disk{
+			Total: 500 * 1024 * 1024 * 1024, // 500GB
+			Used:  200 * 1024 * 1024 * 1024, // 200GB
+			Free:  300 * 1024 * 1024 * 1024,
+			Usage: 40.0,
+		},
+		Uptime:          86400,
+		KernelVersion:   "6.8.4-2-pve",
+		PVEVersion:      "8.2.2",
+		IsClusterMember: true,
+		ClusterName:     "production",
+		LastSeen:        time.Now(),
+		LoadAverage:     []float64{1.5, 2.0, 1.8},
+	}
+
+	r := FromNode(node)
+
+	// Check basic fields
+	if r.ID != node.ID {
+		t.Errorf("Expected ID %s, got %s", node.ID, r.ID)
+	}
+	if r.Type != ResourceTypeNode {
+		t.Errorf("Expected type %s, got %s", ResourceTypeNode, r.Type)
+	}
+	if r.Name != node.Name {
+		t.Errorf("Expected name %s, got %s", node.Name, r.Name)
+	}
+	if r.DisplayName != node.DisplayName {
+		t.Errorf("Expected displayName %s, got %s", node.DisplayName, r.DisplayName)
+	}
+	if r.PlatformType != PlatformProxmoxPVE {
+		t.Errorf("Expected platform %s, got %s", PlatformProxmoxPVE, r.PlatformType)
+	}
+	if r.SourceType != SourceAPI {
+		t.Errorf("Expected source %s, got %s", SourceAPI, r.SourceType)
+	}
+	if r.Status != StatusOnline {
+		t.Errorf("Expected status %s, got %s", StatusOnline, r.Status)
+	}
+
+	// Check metrics
+	if r.CPU == nil {
+		t.Fatal("CPU should not be nil")
+	}
+	if r.CPU.Current != 25.0 { // Converted from 0-1 to percentage
+		t.Errorf("Expected CPU 25%%, got %f%%", r.CPU.Current)
+	}
+
+	if r.Memory == nil {
+		t.Fatal("Memory should not be nil")
+	}
+	if r.Memory.Current != 50.0 {
+		t.Errorf("Expected memory 50%%, got %f%%", r.Memory.Current)
+	}
+
+	if r.Disk == nil {
+		t.Fatal("Disk should not be nil")
+	}
+	if r.Disk.Current != 40.0 {
+		t.Errorf("Expected disk 40%%, got %f%%", r.Disk.Current)
+	}
+
+	if r.Uptime == nil || *r.Uptime != 86400 {
+		t.Errorf("Expected uptime 86400, got %v", r.Uptime)
+	}
+
+	// Check cluster info
+	if r.ClusterID != "pve-cluster/production" {
+		t.Errorf("Expected clusterID pve-cluster/production, got %s", r.ClusterID)
+	}
+
+	// Check identity
+	if r.Identity == nil {
+		t.Fatal("Identity should not be nil")
+	}
+	if r.Identity.Hostname != "node1" {
+		t.Errorf("Expected hostname node1, got %s", r.Identity.Hostname)
+	}
+
+	// Check platform data
+	var pd NodePlatformData
+	if err := r.GetPlatformData(&pd); err != nil {
+		t.Fatalf("Failed to get platform data: %v", err)
+	}
+	if pd.PVEVersion != "8.2.2" {
+		t.Errorf("Expected PVE version 8.2.2, got %s", pd.PVEVersion)
+	}
+	if pd.KernelVersion != "6.8.4-2-pve" {
+		t.Errorf("Expected kernel version 6.8.4-2-pve, got %s", pd.KernelVersion)
+	}
+	if len(pd.LoadAverage) != 3 {
+		t.Errorf("Expected 3 load average values, got %d", len(pd.LoadAverage))
+	}
+}
+
+func TestFromVM(t *testing.T) {
+	vm := models.VM{
+		ID:        "pve1/qemu/100",
+		VMID:      100,
+		Name:      "webserver",
+		Node:      "node1",
+		Instance:  "pve1",
+		Status:    "running",
+		Type:      "qemu",
+		CPU:       0.15,
+		CPUs:      4,
+		Memory: models.Memory{
+			Total: 8 * 1024 * 1024 * 1024,
+			Used:  4 * 1024 * 1024 * 1024,
+			Free:  4 * 1024 * 1024 * 1024,
+			Usage: 50.0,
+		},
+		Disk: models.Disk{
+			Total: 100 * 1024 * 1024 * 1024,
+			Used:  30 * 1024 * 1024 * 1024,
+			Free:  70 * 1024 * 1024 * 1024,
+			Usage: 30.0,
+		},
+		NetworkIn:  1000000,
+		NetworkOut: 500000,
+		DiskRead:   2000000,
+		DiskWrite:  1000000,
+		Uptime:     3600,
+		Tags:       []string{"production", "web"},
+		LastSeen:   time.Now(),
+	}
+
+	r := FromVM(vm)
+
+	if r.ID != vm.ID {
+		t.Errorf("Expected ID %s, got %s", vm.ID, r.ID)
+	}
+	if r.Type != ResourceTypeVM {
+		t.Errorf("Expected type %s, got %s", ResourceTypeVM, r.Type)
+	}
+	if r.Status != StatusRunning {
+		t.Errorf("Expected status %s, got %s", StatusRunning, r.Status)
+	}
+	if r.ParentID != "pve1-node1" {
+		t.Errorf("Expected parent pve1-node1, got %s", r.ParentID)
+	}
+
+	// Check CPU is converted to percentage
+	if r.CPU.Current != 15.0 {
+		t.Errorf("Expected CPU 15%%, got %f%%", r.CPU.Current)
+	}
+
+	// Check network
+	if r.Network == nil {
+		t.Fatal("Network should not be nil")
+	}
+	if r.Network.RXBytes != 1000000 {
+		t.Errorf("Expected RXBytes 1000000, got %d", r.Network.RXBytes)
+	}
+	if r.Network.TXBytes != 500000 {
+		t.Errorf("Expected TXBytes 500000, got %d", r.Network.TXBytes)
+	}
+
+	// Check tags
+	if len(r.Tags) != 2 {
+		t.Errorf("Expected 2 tags, got %d", len(r.Tags))
+	}
+
+	// Check platform data
+	var pd VMPlatformData
+	if err := r.GetPlatformData(&pd); err != nil {
+		t.Fatalf("Failed to get platform data: %v", err)
+	}
+	if pd.VMID != 100 {
+		t.Errorf("Expected VMID 100, got %d", pd.VMID)
+	}
+	if pd.CPUs != 4 {
+		t.Errorf("Expected 4 CPUs, got %d", pd.CPUs)
+	}
+}
+
+func TestFromContainer(t *testing.T) {
+	now := time.Now()
+
+	t.Run("lxc", func(t *testing.T) {
+		ct := models.Container{
+			ID:       "pve1/lxc/101",
+			VMID:     101,
+			Name:     "database",
+			Node:     "node1",
+			Instance: "pve1",
+			Status:   "stopped",
+			Type:     "lxc",
+			CPU:      0.0,
+			CPUs:     2,
+			Memory: models.Memory{
+				Total: 4 * 1024 * 1024 * 1024,
+				Used:  0,
+				Free:  4 * 1024 * 1024 * 1024,
+				Usage: 0.0,
+			},
+			Uptime:      0,
+			Tags:        []string{"database"},
+			IPAddresses: []string{"192.168.1.50"},
+			LastSeen:    now,
+		}
+
+		r := FromContainer(ct)
+
+		if r.Type != ResourceTypeContainer {
+			t.Errorf("Expected type %s, got %s", ResourceTypeContainer, r.Type)
+		}
+		if r.Status != StatusStopped {
+			t.Errorf("Expected status %s, got %s", StatusStopped, r.Status)
+		}
+		if r.ParentID != "pve1-node1" {
+			t.Errorf("Expected parent pve1-node1, got %s", r.ParentID)
+		}
+
+		var pd ContainerPlatformData
+		if err := r.GetPlatformData(&pd); err != nil {
+			t.Fatalf("Failed to get platform data: %v", err)
+		}
+		if pd.Type != "lxc" {
+			t.Errorf("Expected platformData type lxc, got %q", pd.Type)
+		}
+		if pd.IsOCI {
+			t.Errorf("Expected IsOCI false, got %v", pd.IsOCI)
+		}
+		if len(pd.IPAddresses) != 1 || pd.IPAddresses[0] != "192.168.1.50" {
+			t.Errorf("Expected IP 192.168.1.50, got %v", pd.IPAddresses)
+		}
+	})
+
+	t.Run("oci", func(t *testing.T) {
+		ct := models.Container{
+			ID:         "pve1/lxc/300",
+			VMID:       300,
+			Name:       "oci-alpine",
+			Node:       "node1",
+			Instance:   "pve1",
+			Status:     "running",
+			Type:       "oci",
+			IsOCI:      true,
+			OSTemplate: "oci:docker.io/library/alpine:latest",
+			CPU:        0.01,
+			CPUs:       1,
+			Memory: models.Memory{
+				Total: 1024 * 1024 * 1024,
+				Used:  128 * 1024 * 1024,
+				Free:  896 * 1024 * 1024,
+				Usage: 12.5,
+			},
+			LastSeen: now,
+		}
+
+		r := FromContainer(ct)
+		if r.Type != ResourceTypeOCIContainer {
+			t.Errorf("Expected type %s, got %s", ResourceTypeOCIContainer, r.Type)
+		}
+
+		var pd ContainerPlatformData
+		if err := r.GetPlatformData(&pd); err != nil {
+			t.Fatalf("Failed to get platform data: %v", err)
+		}
+		if !pd.IsOCI {
+			t.Errorf("Expected IsOCI true, got %v", pd.IsOCI)
+		}
+		if pd.Type != "oci" {
+			t.Errorf("Expected platformData type oci, got %q", pd.Type)
+		}
+		if pd.OSTemplate != ct.OSTemplate {
+			t.Errorf("Expected OSTemplate %q, got %q", ct.OSTemplate, pd.OSTemplate)
+		}
+	})
+}
+
+func TestFromHost(t *testing.T) {
+	host := models.Host{
+		ID:            "host-abc123",
+		Hostname:      "standalone-server",
+		DisplayName:   "Standalone Server",
+		Platform:      "linux",
+		OSName:        "Ubuntu",
+		OSVersion:     "22.04",
+		KernelVersion: "5.15.0-generic",
+		Architecture:  "amd64",
+		CPUCount:      8,
+		CPUUsage:      45.5,
+		Memory: models.Memory{
+			Total: 32 * 1024 * 1024 * 1024,
+			Used:  16 * 1024 * 1024 * 1024,
+			Free:  16 * 1024 * 1024 * 1024,
+			Usage: 50.0,
+		},
+		LoadAverage: []float64{2.5, 2.0, 1.5},
+		Disks: []models.Disk{
+			{
+				Mountpoint: "/",
+				Total:      500 * 1024 * 1024 * 1024,
+				Used:       200 * 1024 * 1024 * 1024,
+				Free:       300 * 1024 * 1024 * 1024,
+				Usage:      40.0,
+			},
+		},
+		NetworkInterfaces: []models.HostNetworkInterface{
+			{
+				Name:      "eth0",
+				MAC:       "aa:bb:cc:dd:ee:ff",
+				Addresses: []string{"192.168.1.100", "fe80::1"},
+				RXBytes:   10000000,
+				TXBytes:   5000000,
+			},
+		},
+		Sensors: models.HostSensorSummary{
+			TemperatureCelsius: map[string]float64{
+				"cpu_temp": 55.0,
+			},
+		},
+		Status:        "online",
+		UptimeSeconds: 86400 * 30, // 30 days
+		AgentVersion:  "1.2.3",
+		Tags:          []string{"production"},
+		LastSeen:      time.Now(),
+	}
+
+	r := FromHost(host)
+
+	if r.Type != ResourceTypeHost {
+		t.Errorf("Expected type %s, got %s", ResourceTypeHost, r.Type)
+	}
+	if r.PlatformType != PlatformHostAgent {
+		t.Errorf("Expected platform %s, got %s", PlatformHostAgent, r.PlatformType)
+	}
+	if r.SourceType != SourceAgent {
+		t.Errorf("Expected source %s, got %s", SourceAgent, r.SourceType)
+	}
+
+	// CPU is already a percentage for hosts
+	if r.CPU.Current != 45.5 {
+		t.Errorf("Expected CPU 45.5%%, got %f%%", r.CPU.Current)
+	}
+
+	// Check temperature
+	if r.Temperature == nil || *r.Temperature != 55.0 {
+		t.Errorf("Expected temperature 55.0, got %v", r.Temperature)
+	}
+
+	// Check identity includes IP
+	if r.Identity == nil {
+		t.Fatal("Identity should not be nil")
+	}
+	if r.Identity.Hostname != "standalone-server" {
+		t.Errorf("Expected hostname standalone-server, got %s", r.Identity.Hostname)
+	}
+	if len(r.Identity.IPs) < 1 {
+		t.Error("Expected at least 1 IP in identity")
+	}
+
+	// Check platform data
+	var pd HostPlatformData
+	if err := r.GetPlatformData(&pd); err != nil {
+		t.Fatalf("Failed to get platform data: %v", err)
+	}
+	if pd.CPUCount != 8 {
+		t.Errorf("Expected 8 CPUs, got %d", pd.CPUCount)
+	}
+	if pd.AgentVersion != "1.2.3" {
+		t.Errorf("Expected agent version 1.2.3, got %s", pd.AgentVersion)
+	}
+}
+
+func TestFromDockerHost(t *testing.T) {
+	dh := models.DockerHost{
+		ID:           "docker-host-1",
+		AgentID:      "agent-xyz",
+		Hostname:     "docker-server",
+		DisplayName:  "Docker Server",
+		MachineID:    "machine-id-123",
+		OS:           "linux",
+		Architecture: "amd64",
+		Runtime:      "docker",
+		DockerVersion: "24.0.5",
+		CPUs:         16,
+		CPUUsage:     35.0,
+		Memory: models.Memory{
+			Total: 64 * 1024 * 1024 * 1024,
+			Used:  32 * 1024 * 1024 * 1024,
+			Free:  32 * 1024 * 1024 * 1024,
+			Usage: 50.0,
+		},
+		UptimeSeconds: 86400,
+		Status:        "online",
+		LastSeen:      time.Now(),
+		Swarm: &models.DockerSwarmInfo{
+			NodeID:      "swarm-node-1",
+			NodeRole:    "manager",
+			ClusterID:   "swarm-cluster-1",
+			ClusterName: "production-swarm",
+		},
+		NetworkInterfaces: []models.HostNetworkInterface{
+			{
+				Name:      "docker0",
+				Addresses: []string{"172.17.0.1"},
+			},
+		},
+	}
+
+	r := FromDockerHost(dh)
+
+	if r.Type != ResourceTypeDockerHost {
+		t.Errorf("Expected type %s, got %s", ResourceTypeDockerHost, r.Type)
+	}
+	if r.PlatformType != PlatformDocker {
+		t.Errorf("Expected platform %s, got %s", PlatformDocker, r.PlatformType)
+	}
+
+	// Check cluster ID from swarm
+	if r.ClusterID != "docker-swarm/swarm-cluster-1" {
+		t.Errorf("Expected clusterID docker-swarm/swarm-cluster-1, got %s", r.ClusterID)
+	}
+
+	// Check identity includes machine ID
+	if r.Identity == nil {
+		t.Fatal("Identity should not be nil")
+	}
+	if r.Identity.MachineID != "machine-id-123" {
+		t.Errorf("Expected machineID machine-id-123, got %s", r.Identity.MachineID)
+	}
+
+	var pd DockerHostPlatformData
+	if err := r.GetPlatformData(&pd); err != nil {
+		t.Fatalf("Failed to get platform data: %v", err)
+	}
+	if pd.DockerVersion != "24.0.5" {
+		t.Errorf("Expected Docker version 24.0.5, got %s", pd.DockerVersion)
+	}
+	if pd.Swarm == nil || pd.Swarm.NodeRole != "manager" {
+		t.Error("Expected swarm info with manager role")
+	}
+}
+
+func TestFromDockerContainer(t *testing.T) {
+	dc := models.DockerContainer{
+		ID:            "container-123",
+		Name:          "nginx",
+		Image:         "nginx:latest",
+		State:         "running",
+		Status:        "Up 2 hours",
+		Health:        "healthy",
+		CPUPercent:    5.5,
+		MemoryUsage:   256 * 1024 * 1024, // 256MB
+		MemoryLimit:   512 * 1024 * 1024, // 512MB
+		MemoryPercent: 50.0,
+		UptimeSeconds: 7200,
+		RestartCount:  0,
+		CreatedAt:     time.Now().Add(-24 * time.Hour),
+		Labels: map[string]string{
+			"app": "web",
+		},
+		Ports: []models.DockerContainerPort{
+			{PrivatePort: 80, PublicPort: 8080, Protocol: "tcp"},
+		},
+	}
+
+	r := FromDockerContainer(dc, "docker-host-1", "docker-server")
+
+	if r.Type != ResourceTypeDockerContainer {
+		t.Errorf("Expected type %s, got %s", ResourceTypeDockerContainer, r.Type)
+	}
+	if r.ParentID != "docker-host-1" {
+		t.Errorf("Expected parent docker-host-1, got %s", r.ParentID)
+	}
+	if r.Status != StatusRunning {
+		t.Errorf("Expected status %s, got %s", StatusRunning, r.Status)
+	}
+
+	if r.CPU.Current != 5.5 {
+		t.Errorf("Expected CPU 5.5%%, got %f%%", r.CPU.Current)
+	}
+	if r.Memory == nil || r.Memory.Current != 50.0 {
+		t.Errorf("Expected memory 50%%, got %v", r.Memory)
+	}
+
+	if r.Labels["app"] != "web" {
+		t.Error("Expected label app=web")
+	}
+
+	var pd DockerContainerPlatformData
+	if err := r.GetPlatformData(&pd); err != nil {
+		t.Fatalf("Failed to get platform data: %v", err)
+	}
+	if pd.Image != "nginx:latest" {
+		t.Errorf("Expected image nginx:latest, got %s", pd.Image)
+	}
+	if pd.Health != "healthy" {
+		t.Errorf("Expected health healthy, got %s", pd.Health)
+	}
+	if len(pd.Ports) != 1 || pd.Ports[0].PublicPort != 8080 {
+		t.Error("Expected port 8080 mapping")
+	}
+}
+
+func TestResourceMethods(t *testing.T) {
+	// Test IsInfrastructure
+	nodeResource := Resource{Type: ResourceTypeNode}
+	if !nodeResource.IsInfrastructure() {
+		t.Error("Node should be infrastructure")
+	}
+	if nodeResource.IsWorkload() {
+		t.Error("Node should not be workload")
+	}
+
+	vmResource := Resource{Type: ResourceTypeVM}
+	if vmResource.IsInfrastructure() {
+		t.Error("VM should not be infrastructure")
+	}
+	if !vmResource.IsWorkload() {
+		t.Error("VM should be workload")
+	}
+
+	// Test EffectiveDisplayName
+	r := Resource{Name: "name", DisplayName: ""}
+	if r.EffectiveDisplayName() != "name" {
+		t.Error("Should return Name when DisplayName is empty")
+	}
+	r.DisplayName = "custom"
+	if r.EffectiveDisplayName() != "custom" {
+		t.Error("Should return DisplayName when set")
+	}
+
+	// Test CPUPercent
+	r = Resource{}
+	if r.CPUPercent() != 0 {
+		t.Error("CPUPercent should be 0 when CPU is nil")
+	}
+	r.CPU = &MetricValue{Current: 75.5}
+	if r.CPUPercent() != 75.5 {
+		t.Errorf("Expected 75.5, got %f", r.CPUPercent())
+	}
+
+	// Test MemoryPercent
+	r = Resource{}
+	if r.MemoryPercent() != 0 {
+		t.Error("MemoryPercent should be 0 when Memory is nil")
+	}
+	r.Memory = &MetricValue{Current: 60.0}
+	if r.MemoryPercent() != 60.0 {
+		t.Errorf("Expected 60.0, got %f", r.MemoryPercent())
+	}
+}
+
+func TestStatusMapping(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected ResourceStatus
+		mapper   func(string) ResourceStatus
+	}{
+		{"online", StatusOnline, mapNodeStatus},
+		{"offline", StatusOffline, mapNodeStatus},
+		{"unknown", StatusUnknown, mapNodeStatus},
+		{"running", StatusRunning, mapGuestStatus},
+		{"stopped", StatusStopped, mapGuestStatus},
+		{"paused", StatusPaused, mapGuestStatus},
+		{"online", StatusOnline, mapHostStatus},
+		{"degraded", StatusDegraded, mapHostStatus},
+		{"running", StatusRunning, mapDockerContainerStatus},
+		{"exited", StatusStopped, mapDockerContainerStatus},
+		{"dead", StatusStopped, mapDockerContainerStatus},
+		{"paused", StatusPaused, mapDockerContainerStatus},
+	}
+
+	for _, test := range tests {
+		result := test.mapper(test.input)
+		if result != test.expected {
+			t.Errorf("Mapping %s: expected %s, got %s", test.input, test.expected, result)
+		}
+	}
+}
diff --git a/internal/resources/ip_filtering_test.go b/internal/resources/ip_filtering_test.go
new file mode 100644
index 0000000..a3ef888
--- /dev/null
+++ b/internal/resources/ip_filtering_test.go
@@ -0,0 +1,213 @@
+package resources
+
+import (
+	"testing"
+	"time"
+)
+
+// TestIsNonUniqueIP tests the IP filtering logic for deduplication.
+// This was added to fix the issue where Docker bridge IPs (172.17.0.1) were
+// causing false positive deduplication between hosts.
+func TestIsNonUniqueIP(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		ip       string
+		expected bool
+	}{
+		// Localhost addresses - should be filtered
+		{"localhost IPv4", "127.0.0.1", true},
+		{"localhost IPv4 alternate", "127.0.0.2", true},
+		{"localhost IPv4 high", "127.255.255.255", true},
+		{"localhost IPv6", "::1", true},
+
+		// Docker bridge network addresses - should be filtered (the key fix)
+		{"docker bridge default", "172.17.0.1", true},
+		{"docker bridge container", "172.17.0.2", true},
+		{"docker bridge high", "172.17.255.255", true},
+		{"docker bridge 172.18.x", "172.18.0.1", true},
+		{"docker bridge 172.19.x", "172.19.0.1", true},
+		{"docker bridge 172.20.x", "172.20.0.1", true},
+		{"docker bridge 172.21.x", "172.21.0.1", true},
+		{"docker bridge 172.22.x", "172.22.0.1", true},
+
+		// Link-local IPv6 - should be filtered
+		{"link-local IPv6", "fe80::1", true},
+		{"link-local IPv6 full", "fe80:0000:0000:0000:0000:0000:0000:0001", true},
+		{"link-local uppercase", "FE80::1:2:3", true},
+
+		// Valid private IPs - should NOT be filtered
+		{"private 192.168.x", "192.168.1.100", false},
+		{"private 192.168.0.x", "192.168.0.1", false},
+		{"private 10.x", "10.0.0.1", false},
+		{"private 10.x alternate", "10.10.10.10", false},
+		{"private 172.16.x", "172.16.0.1", false},
+		{"private 172.23.x", "172.23.0.1", false}, // Outside Docker bridge range
+		{"private 172.24.x", "172.24.0.1", false},
+		{"private 172.31.x", "172.31.255.255", false},
+
+		// Public IPs - should NOT be filtered
+		{"public IP 1", "8.8.8.8", false},
+		{"public IP 2", "1.1.1.1", false},
+		{"public IP 3", "203.0.113.42", false},
+
+		// Public IPv6 - should NOT be filtered
+		{"public IPv6", "2001:db8::1", false},
+		{"public IPv6 documentation", "2001:0db8:85a3::8a2e:0370:7334", false},
+
+		// Edge cases
+		{"empty string", "", false},
+		{"random string", "not-an-ip", false},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result := isNonUniqueIP(tt.ip)
+			if result != tt.expected {
+				t.Errorf("isNonUniqueIP(%q) = %v, want %v", tt.ip, result, tt.expected)
+			}
+		})
+	}
+}
+
+// TestNoDeduplicationForDockerBridgeIP verifies that hosts with Docker bridge IPs
+// are not incorrectly deduplicated. This was the root cause of the "delly disappearing" bug.
+func TestNoDeduplicationForDockerBridgeIP(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// Host 1 with Docker bridge IP
+	host1 := Resource{
+		ID:           "host-1",
+		Type:         ResourceTypeHost,
+		Name:         "server1",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server1",
+			IPs:      []string{"192.168.1.10", "172.17.0.1"}, // 172.17.0.1 is Docker bridge
+		},
+	}
+	store.Upsert(host1)
+
+	// Host 2 with same Docker bridge IP (every Docker host has this!)
+	host2 := Resource{
+		ID:           "host-2",
+		Type:         ResourceTypeHost,
+		Name:         "server2",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server2",
+			IPs:      []string{"192.168.1.20", "172.17.0.1"}, // Same Docker bridge IP
+		},
+	}
+	store.Upsert(host2)
+
+	// Both should exist (172.17.0.1 shouldn't trigger dedup)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 hosts (Docker bridge IP shouldn't cause dedup), got %d", len(all))
+	}
+
+	// Verify both are retrievable
+	_, ok1 := store.Get("host-1")
+	_, ok2 := store.Get("host-2")
+	if !ok1 || !ok2 {
+		t.Error("Both hosts should be retrievable independently")
+	}
+}
+
+// TestDeduplicationStillWorksForUniqueIPs verifies that deduplication still works
+// for actual unique IPs while filtering out non-unique ones.
+func TestDeduplicationStillWorksForUniqueIPs(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// Add first host
+	host1 := Resource{
+		ID:           "host-old",
+		Type:         ResourceTypeHost,
+		Name:         "server",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server",
+			IPs:      []string{"192.168.1.100"}, // Unique IP
+		},
+	}
+	store.Upsert(host1)
+
+	// Add second host with same unique IP but different ID (same physical machine)
+	host2 := Resource{
+		ID:           "host-new",
+		Type:         ResourceTypeHost,
+		Name:         "server-renamed",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now.Add(time.Second), // Newer
+		Identity: &ResourceIdentity{
+			Hostname: "server-renamed",
+			IPs:      []string{"192.168.1.100"}, // Same unique IP
+		},
+	}
+	store.Upsert(host2)
+
+	// Should have only 1 host (deduplicated by unique IP)
+	all := store.GetAll()
+	if len(all) != 1 {
+		t.Errorf("Expected 1 host (deduplicated by unique IP), got %d", len(all))
+	}
+}
+
+// TestMixedIPsDeduplication verifies that a host with both unique and non-unique IPs
+// is properly handled (dedup only on unique IPs).
+func TestMixedIPsDeduplication(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// Host with unique IP and Docker bridge
+	host1 := Resource{
+		ID:           "host-1",
+		Type:         ResourceTypeHost,
+		Name:         "docker-server-1",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "docker-server-1",
+			IPs:      []string{"192.168.1.50", "172.17.0.1", "127.0.0.1"},
+		},
+	}
+	store.Upsert(host1)
+
+	// Different host sharing only the non-unique IPs
+	host2 := Resource{
+		ID:           "host-2",
+		Type:         ResourceTypeHost,
+		Name:         "docker-server-2",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "docker-server-2",
+			IPs:      []string{"192.168.1.60", "172.17.0.1", "127.0.0.1"}, // Different unique IP
+		},
+	}
+	store.Upsert(host2)
+
+	// Both should exist (only 127.0.0.1 and 172.17.0.1 are shared, which are non-unique)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 hosts (shared non-unique IPs only), got %d", len(all))
+	}
+}
diff --git a/internal/resources/platform_data.go b/internal/resources/platform_data.go
new file mode 100644
index 0000000..05e4208
--- /dev/null
+++ b/internal/resources/platform_data.go
@@ -0,0 +1,373 @@
+package resources
+
+import "time"
+
+// NodePlatformData contains Proxmox VE node-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeNode.
+type NodePlatformData struct {
+	Instance      string    `json:"instance"`      // Proxmox instance URL
+	Host          string    `json:"host"`          // Full host URL from config
+	GuestURL      string    `json:"guestURL"`      // Optional guest-accessible URL
+	PVEVersion    string    `json:"pveVersion"`    // Proxmox VE version
+	KernelVersion string    `json:"kernelVersion"` // Linux kernel version
+	CPUInfo       CPUInfo   `json:"cpuInfo"`       // CPU details
+	LoadAverage   []float64 `json:"loadAverage"`   // 1, 5, 15 minute load averages
+
+	// Cluster information
+	IsClusterMember bool   `json:"isClusterMember"`
+	ClusterName     string `json:"clusterName"`
+
+	// Connection status
+	ConnectionHealth string `json:"connectionHealth"`
+}
+
+// CPUInfo contains CPU hardware details.
+type CPUInfo struct {
+	Model   string `json:"model"`
+	Cores   int    `json:"cores"`
+	Sockets int    `json:"sockets"`
+}
+
+// VMPlatformData contains Proxmox VM-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeVM.
+type VMPlatformData struct {
+	VMID         int      `json:"vmid"`
+	Node         string   `json:"node"`     // Proxmox node hosting this VM
+	Instance     string   `json:"instance"` // Proxmox instance URL
+	CPUs         int      `json:"cpus"`     // Number of vCPUs
+	Template     bool     `json:"template"`
+	Lock         string   `json:"lock,omitempty"` // Lock status (backup, migrate, etc.)
+	AgentVersion string   `json:"agentVersion,omitempty"`
+	OSName       string   `json:"osName,omitempty"`
+	OSVersion    string   `json:"osVersion,omitempty"`
+	IPAddresses  []string `json:"ipAddresses,omitempty"`
+
+	// I/O stats
+	NetworkIn  int64 `json:"networkIn"`
+	NetworkOut int64 `json:"networkOut"`
+	DiskRead   int64 `json:"diskRead"`
+	DiskWrite  int64 `json:"diskWrite"`
+
+	// Backup info
+	LastBackup *time.Time `json:"lastBackup,omitempty"`
+}
+
+// ContainerPlatformData contains Proxmox LXC container-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeContainer or ResourceTypeOCIContainer.
+type ContainerPlatformData struct {
+	VMID        int      `json:"vmid"`
+	Node        string   `json:"node"`           // Proxmox node hosting this container
+	Instance    string   `json:"instance"`       // Proxmox instance URL
+	Type        string   `json:"type,omitempty"` // lxc or oci
+	CPUs        int      `json:"cpus"`           // Number of vCPUs
+	Template    bool     `json:"template"`
+	Lock        string   `json:"lock,omitempty"`
+	OSName      string   `json:"osName,omitempty"`
+	IPAddresses []string `json:"ipAddresses,omitempty"`
+	// OCI container support (Proxmox VE 9.1+)
+	IsOCI      bool   `json:"isOci,omitempty"`      // True if this is an OCI container
+	OSTemplate string `json:"osTemplate,omitempty"` // Template or OCI image reference if available
+
+	// I/O stats
+	NetworkIn  int64 `json:"networkIn"`
+	NetworkOut int64 `json:"networkOut"`
+	DiskRead   int64 `json:"diskRead"`
+	DiskWrite  int64 `json:"diskWrite"`
+
+	// Backup info
+	LastBackup *time.Time `json:"lastBackup,omitempty"`
+}
+
+// HostPlatformData contains host-agent specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeHost.
+type HostPlatformData struct {
+	Platform      string             `json:"platform,omitempty"`      // linux, windows, darwin
+	OSName        string             `json:"osName,omitempty"`        // e.g., "Ubuntu 22.04"
+	OSVersion     string             `json:"osVersion,omitempty"`     // OS version string
+	KernelVersion string             `json:"kernelVersion,omitempty"` // Kernel version
+	Architecture  string             `json:"architecture,omitempty"`  // amd64, arm64, etc.
+	CPUCount      int                `json:"cpuCount,omitempty"`      // Number of CPUs
+	LoadAverage   []float64          `json:"loadAverage,omitempty"`   // 1, 5, 15 minute loads
+	AgentVersion  string             `json:"agentVersion,omitempty"`  // Pulse agent version
+	IsLegacy      bool               `json:"isLegacy,omitempty"`      // Legacy agent indicator
+	Sensors       HostSensorSummary  `json:"sensors,omitempty"`       // Temperature/fan sensors
+	RAID          []HostRAIDArray    `json:"raid,omitempty"`          // RAID arrays
+	DiskIO        []DiskIOStats      `json:"diskIO,omitempty"`        // Per-disk I/O stats
+	Disks         []DiskInfo         `json:"disks,omitempty"`         // Disk usage info
+	Interfaces    []NetworkInterface `json:"interfaces,omitempty"`    // Network interfaces
+
+	// Token information
+	TokenID         string     `json:"tokenId,omitempty"`
+	TokenName       string     `json:"tokenName,omitempty"`
+	TokenHint       string     `json:"tokenHint,omitempty"`
+	TokenLastUsedAt *time.Time `json:"tokenLastUsedAt,omitempty"`
+}
+
+// HostSensorSummary captures sensor readings from a host.
+type HostSensorSummary struct {
+	TemperatureCelsius map[string]float64 `json:"temperatureCelsius,omitempty"`
+	FanRPM             map[string]float64 `json:"fanRpm,omitempty"`
+	Additional         map[string]float64 `json:"additional,omitempty"`
+}
+
+// HostRAIDArray represents an mdadm RAID array.
+type HostRAIDArray struct {
+	Device         string           `json:"device"`
+	Name           string           `json:"name,omitempty"`
+	Level          string           `json:"level"`
+	State          string           `json:"state"`
+	TotalDevices   int              `json:"totalDevices"`
+	ActiveDevices  int              `json:"activeDevices"`
+	WorkingDevices int              `json:"workingDevices"`
+	FailedDevices  int              `json:"failedDevices"`
+	SpareDevices   int              `json:"spareDevices"`
+	UUID           string           `json:"uuid,omitempty"`
+	Devices        []HostRAIDDevice `json:"devices"`
+	RebuildPercent float64          `json:"rebuildPercent"`
+	RebuildSpeed   string           `json:"rebuildSpeed,omitempty"`
+}
+
+// HostRAIDDevice represents a device in a RAID array.
+type HostRAIDDevice struct {
+	Device string `json:"device"`
+	State  string `json:"state"`
+	Slot   int    `json:"slot"`
+}
+
+// DiskIOStats captures I/O statistics for a disk device.
+type DiskIOStats struct {
+	Device      string `json:"device"`
+	ReadBytes   uint64 `json:"readBytes,omitempty"`
+	WriteBytes  uint64 `json:"writeBytes,omitempty"`
+	ReadOps     uint64 `json:"readOps,omitempty"`
+	WriteOps    uint64 `json:"writeOps,omitempty"`
+	ReadTimeMs  uint64 `json:"readTimeMs,omitempty"`
+	WriteTimeMs uint64 `json:"writeTimeMs,omitempty"`
+	IOTimeMs    uint64 `json:"ioTimeMs,omitempty"`
+}
+
+// DiskInfo represents disk/partition usage.
+type DiskInfo struct {
+	Mountpoint string  `json:"mountpoint,omitempty"`
+	Device     string  `json:"device,omitempty"`
+	Type       string  `json:"type,omitempty"`
+	Total      int64   `json:"total"`
+	Used       int64   `json:"used"`
+	Free       int64   `json:"free"`
+	Usage      float64 `json:"usage"`
+}
+
+// NetworkInterface represents a network interface.
+type NetworkInterface struct {
+	Name      string   `json:"name"`
+	MAC       string   `json:"mac,omitempty"`
+	Addresses []string `json:"addresses,omitempty"`
+	RXBytes   uint64   `json:"rxBytes,omitempty"`
+	TXBytes   uint64   `json:"txBytes,omitempty"`
+	SpeedMbps *int64   `json:"speedMbps,omitempty"`
+}
+
+// DockerHostPlatformData contains Docker host-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeDockerHost.
+type DockerHostPlatformData struct {
+	AgentID           string             `json:"agentId"`
+	MachineID         string             `json:"machineId,omitempty"`
+	OS                string             `json:"os,omitempty"`
+	KernelVersion     string             `json:"kernelVersion,omitempty"`
+	Architecture      string             `json:"architecture,omitempty"`
+	Runtime           string             `json:"runtime,omitempty"` // docker, podman
+	RuntimeVersion    string             `json:"runtimeVersion,omitempty"`
+	DockerVersion     string             `json:"dockerVersion,omitempty"`
+	LoadAverage       []float64          `json:"loadAverage,omitempty"`
+	AgentVersion      string             `json:"agentVersion,omitempty"`
+	CPUs              int                `json:"cpus"`
+	IsLegacy          bool               `json:"isLegacy,omitempty"`
+	Disks             []DiskInfo         `json:"disks,omitempty"`
+	Interfaces        []NetworkInterface `json:"interfaces,omitempty"`
+	CustomDisplayName string             `json:"customDisplayName,omitempty"`
+	Hidden            bool               `json:"hidden"`
+	PendingUninstall  bool               `json:"pendingUninstall"`
+
+	// Swarm information
+	Swarm *DockerSwarmInfo `json:"swarm,omitempty"`
+
+	// Token information
+	TokenID         string     `json:"tokenId,omitempty"`
+	TokenName       string     `json:"tokenName,omitempty"`
+	TokenHint       string     `json:"tokenHint,omitempty"`
+	TokenLastUsedAt *time.Time `json:"tokenLastUsedAt,omitempty"`
+}
+
+// DockerSwarmInfo captures Docker Swarm membership details.
+type DockerSwarmInfo struct {
+	NodeID           string `json:"nodeId,omitempty"`
+	NodeRole         string `json:"nodeRole,omitempty"`
+	LocalState       string `json:"localState,omitempty"`
+	ControlAvailable bool   `json:"controlAvailable,omitempty"`
+	ClusterID        string `json:"clusterId,omitempty"`
+	ClusterName      string `json:"clusterName,omitempty"`
+	Scope            string `json:"scope,omitempty"`
+	Error            string `json:"error,omitempty"`
+}
+
+// DockerContainerPlatformData contains Docker container-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeDockerContainer.
+type DockerContainerPlatformData struct {
+	HostID       string             `json:"hostId"`   // Parent Docker host ID
+	HostName     string             `json:"hostName"` // Parent Docker host name
+	Image        string             `json:"image"`    // Container image
+	State        string             `json:"state"`    // created, running, paused, restarting, exited, dead
+	Status       string             `json:"status"`   // Human-readable status
+	Health       string             `json:"health"`   // healthy, unhealthy, starting, none
+	RestartCount int                `json:"restartCount"`
+	ExitCode     int                `json:"exitCode"`
+	CreatedAt    time.Time          `json:"createdAt"`
+	StartedAt    *time.Time         `json:"startedAt,omitempty"`
+	FinishedAt   *time.Time         `json:"finishedAt,omitempty"`
+	Labels       map[string]string  `json:"labels,omitempty"`
+	Ports        []ContainerPort    `json:"ports,omitempty"`
+	Networks     []ContainerNetwork `json:"networks,omitempty"`
+
+	// Podman-specific
+	Podman *PodmanContainerInfo `json:"podman,omitempty"`
+}
+
+// KubernetesClusterPlatformData contains Kubernetes cluster-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeK8sCluster.
+type KubernetesClusterPlatformData struct {
+	AgentID           string `json:"agentId"`
+	Server            string `json:"server,omitempty"`
+	Context           string `json:"context,omitempty"`
+	Version           string `json:"version,omitempty"`
+	CustomDisplayName string `json:"customDisplayName,omitempty"`
+	Hidden            bool   `json:"hidden"`
+	PendingUninstall  bool   `json:"pendingUninstall"`
+
+	NodeCount       int `json:"nodeCount,omitempty"`
+	PodCount        int `json:"podCount,omitempty"`
+	DeploymentCount int `json:"deploymentCount,omitempty"`
+
+	// Token information
+	TokenID         string     `json:"tokenId,omitempty"`
+	TokenName       string     `json:"tokenName,omitempty"`
+	TokenHint       string     `json:"tokenHint,omitempty"`
+	TokenLastUsedAt *time.Time `json:"tokenLastUsedAt,omitempty"`
+}
+
+// KubernetesNodePlatformData contains Kubernetes node-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeK8sNode.
+type KubernetesNodePlatformData struct {
+	ClusterID               string   `json:"clusterId"`
+	Ready                   bool     `json:"ready"`
+	Unschedulable           bool     `json:"unschedulable,omitempty"`
+	KubeletVersion          string   `json:"kubeletVersion,omitempty"`
+	ContainerRuntimeVersion string   `json:"containerRuntimeVersion,omitempty"`
+	OSImage                 string   `json:"osImage,omitempty"`
+	KernelVersion           string   `json:"kernelVersion,omitempty"`
+	Architecture            string   `json:"architecture,omitempty"`
+	CapacityCPUCores        int64    `json:"capacityCpuCores,omitempty"`
+	CapacityMemoryBytes     int64    `json:"capacityMemoryBytes,omitempty"`
+	CapacityPods            int64    `json:"capacityPods,omitempty"`
+	AllocatableCPUCores     int64    `json:"allocatableCpuCores,omitempty"`
+	AllocatableMemoryBytes  int64    `json:"allocatableMemoryBytes,omitempty"`
+	AllocatablePods         int64    `json:"allocatablePods,omitempty"`
+	Roles                   []string `json:"roles,omitempty"`
+}
+
+// KubernetesPodPlatformData contains Kubernetes pod-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypePod.
+type KubernetesPodPlatformData struct {
+	ClusterID string `json:"clusterId"`
+	Namespace string `json:"namespace"`
+	NodeName  string `json:"nodeName,omitempty"`
+	Phase     string `json:"phase,omitempty"`
+	Reason    string `json:"reason,omitempty"`
+	Message   string `json:"message,omitempty"`
+	QoSClass  string `json:"qosClass,omitempty"`
+	Restarts  int    `json:"restarts,omitempty"`
+
+	OwnerKind string `json:"ownerKind,omitempty"`
+	OwnerName string `json:"ownerName,omitempty"`
+
+	Containers []KubernetesPodContainerInfo `json:"containers,omitempty"`
+}
+
+// KubernetesPodContainerInfo captures per-container pod status.
+type KubernetesPodContainerInfo struct {
+	Name         string `json:"name"`
+	Image        string `json:"image,omitempty"`
+	Ready        bool   `json:"ready"`
+	RestartCount int32  `json:"restartCount,omitempty"`
+	State        string `json:"state,omitempty"`
+	Reason       string `json:"reason,omitempty"`
+	Message      string `json:"message,omitempty"`
+}
+
+// KubernetesDeploymentPlatformData contains Kubernetes deployment-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeK8sDeployment.
+type KubernetesDeploymentPlatformData struct {
+	ClusterID         string `json:"clusterId"`
+	Namespace         string `json:"namespace"`
+	DesiredReplicas   int32  `json:"desiredReplicas,omitempty"`
+	UpdatedReplicas   int32  `json:"updatedReplicas,omitempty"`
+	ReadyReplicas     int32  `json:"readyReplicas,omitempty"`
+	AvailableReplicas int32  `json:"availableReplicas,omitempty"`
+}
+
+// ContainerPort describes a port mapping.
+type ContainerPort struct {
+	PrivatePort int    `json:"privatePort"`
+	PublicPort  int    `json:"publicPort,omitempty"`
+	Protocol    string `json:"protocol"`
+	IP          string `json:"ip,omitempty"`
+}
+
+// ContainerNetwork describes a container's network attachment.
+type ContainerNetwork struct {
+	Name string `json:"name"`
+	IPv4 string `json:"ipv4,omitempty"`
+	IPv6 string `json:"ipv6,omitempty"`
+}
+
+// PodmanContainerInfo captures Podman-specific container info.
+type PodmanContainerInfo struct {
+	PodName        string `json:"podName,omitempty"`
+	PodID          string `json:"podId,omitempty"`
+	Infra          bool   `json:"infra,omitempty"`
+	ComposeProject string `json:"composeProject,omitempty"`
+	ComposeService string `json:"composeService,omitempty"`
+}
+
+// PBSPlatformData contains PBS-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypePBS.
+type PBSPlatformData struct {
+	Host             string `json:"host"`
+	Version          string `json:"version"`
+	ConnectionHealth string `json:"connectionHealth"`
+	MemoryUsed       int64  `json:"memoryUsed"`
+	MemoryTotal      int64  `json:"memoryTotal"`
+	NumDatastores    int    `json:"numDatastores"`
+}
+
+// DatastorePlatformData contains PBS datastore-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeDatastore.
+type DatastorePlatformData struct {
+	PBSInstanceID       string  `json:"pbsInstanceId"`
+	PBSInstanceName     string  `json:"pbsInstanceName"`
+	Content             string  `json:"content,omitempty"`
+	Error               string  `json:"error,omitempty"`
+	DeduplicationFactor float64 `json:"deduplicationFactor,omitempty"`
+}
+
+// StoragePlatformData contains Proxmox storage-specific fields.
+// Stored in Resource.PlatformData when Type is ResourceTypeStorage.
+type StoragePlatformData struct {
+	Instance string   `json:"instance"`
+	Node     string   `json:"node"`            // Primary node
+	Nodes    []string `json:"nodes,omitempty"` // All nodes (for shared storage)
+	Type     string   `json:"type"`            // zfspool, lvmthin, cephfs, etc.
+	Content  string   `json:"content"`
+	Shared   bool     `json:"shared"`
+	Enabled  bool     `json:"enabled"`
+	Active   bool     `json:"active"`
+}
diff --git a/internal/resources/populate_test.go b/internal/resources/populate_test.go
new file mode 100644
index 0000000..f0d3c5d
--- /dev/null
+++ b/internal/resources/populate_test.go
@@ -0,0 +1,188 @@
+package resources
+
+import (
+	"testing"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+func TestStorePopulateFromSnapshot(t *testing.T) {
+	store := NewStore()
+
+	// Create a minimal snapshot with test data
+	snapshot := models.StateSnapshot{
+		Nodes: []models.Node{
+			{
+				ID:       "node-1",
+				Name:     "pve-node-1",
+				Instance: "https://pve1.local:8006",
+				Status:   "online",
+				CPU:      0.455, // Proxmox API returns 0-1 ratio
+				Memory: models.Memory{
+					Total: 16000000000,
+					Used:  8000000000,
+					Free:  8000000000,
+					Usage: 50.0,
+				},
+				Uptime:   86400,
+				LastSeen: time.Now(),
+			},
+		},
+		VMs: []models.VM{
+			{
+				ID:       "vm-100",
+				VMID:     100,
+				Name:     "test-vm",
+				Node:     "pve-node-1",
+				Instance: "https://pve1.local:8006",
+				Status:   "running",
+				CPU:      0.25, // Proxmox API returns 0-1 ratio
+				Memory: models.Memory{
+					Total: 4000000000,
+					Used:  2000000000,
+					Free:  2000000000,
+					Usage: 50.0,
+				},
+			},
+		},
+		Containers: []models.Container{
+			{
+				ID:       "ct-200",
+				VMID:     200,
+				Name:     "test-container",
+				Node:     "pve-node-1",
+				Instance: "https://pve1.local:8006",
+				Status:   "running",
+			},
+		},
+		Hosts: []models.Host{
+			{
+				ID:       "host-1",
+				Hostname: "my-host",
+				Status:   "online",
+			},
+		},
+	}
+
+	// Populate the store
+	store.PopulateFromSnapshot(snapshot)
+
+	// Verify resources were created
+	all := store.GetAll()
+	if len(all) == 0 {
+		t.Fatal("Expected resources to be populated, got 0")
+	}
+
+	t.Logf("Populated %d resources", len(all))
+
+	// Check for each type
+	nodes := store.Query().OfType(ResourceTypeNode).Execute()
+	if len(nodes) != 1 {
+		t.Errorf("Expected 1 node, got %d", len(nodes))
+	} else {
+		t.Logf("Node: id=%s, name=%s, cpu=%.1f%%", nodes[0].ID, nodes[0].Name, nodes[0].CPU.Current)
+	}
+
+	vms := store.Query().OfType(ResourceTypeVM).Execute()
+	if len(vms) != 1 {
+		t.Errorf("Expected 1 VM, got %d", len(vms))
+	} else {
+		t.Logf("VM: id=%s, name=%s, status=%s", vms[0].ID, vms[0].Name, vms[0].Status)
+	}
+
+	containers := store.Query().OfType(ResourceTypeContainer).Execute()
+	if len(containers) != 1 {
+		t.Errorf("Expected 1 container, got %d", len(containers))
+	} else {
+		t.Logf("Container: id=%s, name=%s", containers[0].ID, containers[0].Name)
+	}
+
+	hosts := store.Query().OfType(ResourceTypeHost).Execute()
+	if len(hosts) != 1 {
+		t.Errorf("Expected 1 host, got %d", len(hosts))
+	} else {
+		t.Logf("Host: id=%s, hostname=%s", hosts[0].ID, hosts[0].Identity.Hostname)
+	}
+
+	// Test summary
+	t.Logf("SUCCESS: PopulateFromSnapshot works correctly!")
+	t.Logf("Total resources: %d (1 node + 1 VM + 1 container + 1 host)", len(all))
+}
+
+// TestPopulateFromSnapshotRemovesStaleResources verifies that resources not present
+// in subsequent snapshots are removed from the store (fixing the "ghost LXCs" bug).
+func TestPopulateFromSnapshotRemovesStaleResources(t *testing.T) {
+	store := NewStore()
+
+	// First snapshot with 2 containers
+	snapshot1 := models.StateSnapshot{
+		Containers: []models.Container{
+			{
+				ID:       "ct-100",
+				VMID:     100,
+				Name:     "container-to-keep",
+				Node:     "pve-node-1",
+				Instance: "pve1",
+				Status:   "running",
+			},
+			{
+				ID:       "ct-200",
+				VMID:     200,
+				Name:     "container-to-remove",
+				Node:     "pve-node-1",
+				Instance: "pve1",
+				Status:   "running",
+			},
+		},
+	}
+
+	// Populate with first snapshot
+	store.PopulateFromSnapshot(snapshot1)
+
+	// Verify both containers exist
+	containers := store.Query().OfType(ResourceTypeContainer).Execute()
+	if len(containers) != 2 {
+		t.Fatalf("Expected 2 containers after first snapshot, got %d", len(containers))
+	}
+	t.Logf("After first snapshot: %d containers", len(containers))
+
+	// Second snapshot with only 1 container (the other was "deleted" from Proxmox)
+	snapshot2 := models.StateSnapshot{
+		Containers: []models.Container{
+			{
+				ID:       "ct-100",
+				VMID:     100,
+				Name:     "container-to-keep",
+				Node:     "pve-node-1",
+				Instance: "pve1",
+				Status:   "running",
+			},
+			// container-to-remove is NOT included - simulating it was deleted
+		},
+	}
+
+	// Populate with second snapshot
+	store.PopulateFromSnapshot(snapshot2)
+
+	// Verify only 1 container remains
+	containers = store.Query().OfType(ResourceTypeContainer).Execute()
+	if len(containers) != 1 {
+		t.Fatalf("Expected 1 container after second snapshot (removed container should be gone), got %d", len(containers))
+	}
+
+	// Verify the correct container remains
+	if containers[0].ID != "ct-100" {
+		t.Errorf("Expected container-to-keep (ct-100) to remain, got %s", containers[0].ID)
+	}
+
+	// Verify the removed container is gone
+	_, found := store.Get("ct-200")
+	if found {
+		t.Error("container-to-remove (ct-200) should have been removed from the store")
+	}
+
+	t.Logf("SUCCESS: Removed resources are correctly cleaned up!")
+	t.Logf("After second snapshot: %d container(s) - 'container-to-remove' was properly removed", len(containers))
+}
+
diff --git a/internal/resources/resource.go b/internal/resources/resource.go
new file mode 100644
index 0000000..b02a90d
--- /dev/null
+++ b/internal/resources/resource.go
@@ -0,0 +1,251 @@
+// Package resources provides a unified abstraction for all monitored entities
+// across different platforms (Proxmox, Docker, Kubernetes, TrueNAS, etc.).
+//
+// The Resource type is the core abstraction that normalizes platform-specific
+// types like Node, Host, DockerHost, VM, Container into a common data model.
+// This enables:
+//   - AI intelligence across all platforms
+//   - Elimination of duplicate monitoring (one machine = one set of alerts)
+//   - Extensibility for new platforms
+//   - Foundation for unified views
+package resources
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// Resource is the universal abstraction for any monitored entity.
+// All platform-specific types (Node, VM, Container, DockerHost, etc.) can be
+// converted to this common type for unified handling.
+type Resource struct {
+	// Identity
+	ID          string       `json:"id"`          // Globally unique ID
+	Type        ResourceType `json:"type"`        // vm, container, docker-container, pod, host, etc.
+	Name        string       `json:"name"`        // Human-readable name
+	DisplayName string       `json:"displayName"` // Custom display name (if set)
+
+	// Platform/Source
+	PlatformID   string       `json:"platformId"`   // Which platform instance (e.g., cluster URL)
+	PlatformType PlatformType `json:"platformType"` // proxmox-pve, docker, kubernetes, etc.
+	SourceType   SourceType   `json:"sourceType"`   // api, agent, hybrid
+
+	// Hierarchy
+	ParentID  string `json:"parentId,omitempty"`  // VM → Node, Pod → K8s Node
+	ClusterID string `json:"clusterId,omitempty"` // Cluster membership
+
+	// Universal Metrics (nullable - not all resources have all metrics)
+	Status      ResourceStatus `json:"status"`                // online, offline, running, stopped, degraded
+	CPU         *MetricValue   `json:"cpu,omitempty"`         // CPU usage percentage
+	Memory      *MetricValue   `json:"memory,omitempty"`      // Memory usage
+	Disk        *MetricValue   `json:"disk,omitempty"`        // Primary disk usage
+	Network     *NetworkMetric `json:"network,omitempty"`     // Network I/O
+	Temperature *float64       `json:"temperature,omitempty"` // Temperature in Celsius
+	Uptime      *int64         `json:"uptime,omitempty"`      // Uptime in seconds
+
+	// Universal Metadata
+	Tags     []string          `json:"tags,omitempty"`
+	Labels   map[string]string `json:"labels,omitempty"`
+	LastSeen time.Time         `json:"lastSeen"`
+	Alerts   []ResourceAlert   `json:"alerts,omitempty"`
+
+	// Platform-Specific Data (discriminated by Type)
+	// This preserves all the rich data while allowing common handling.
+	// Use GetPlatformData() to unmarshal into the appropriate type.
+	PlatformData json.RawMessage `json:"platformData,omitempty"`
+
+	// Identity information for deduplication
+	Identity *ResourceIdentity `json:"identity,omitempty"`
+
+	// Schema version for future evolution
+	SchemaVersion int `json:"schemaVersion"`
+}
+
+// ResourceType identifies the kind of monitored entity.
+type ResourceType string
+
+const (
+	// Infrastructure - physical or virtual hosts that run workloads
+	ResourceTypeNode       ResourceType = "node"        // Proxmox VE node
+	ResourceTypeHost       ResourceType = "host"        // Standalone host (via host-agent)
+	ResourceTypeDockerHost ResourceType = "docker-host" // Docker/Podman host
+	ResourceTypeK8sCluster ResourceType = "k8s-cluster" // Kubernetes cluster
+	ResourceTypeK8sNode    ResourceType = "k8s-node"    // Kubernetes node
+	ResourceTypeTrueNAS    ResourceType = "truenas"     // TrueNAS system
+
+	// Compute Workloads - individual running instances
+	ResourceTypeVM              ResourceType = "vm"               // Proxmox VM
+	ResourceTypeContainer       ResourceType = "container"        // LXC container
+	ResourceTypeOCIContainer    ResourceType = "oci-container"    // OCI container (Proxmox VE 9.1+)
+	ResourceTypeDockerContainer ResourceType = "docker-container" // Docker container
+	ResourceTypePod             ResourceType = "pod"              // Kubernetes pod
+	ResourceTypeJail            ResourceType = "jail"             // BSD jail / TrueNAS jail
+
+	// Services - logical groupings of workloads
+	ResourceTypeDockerService ResourceType = "docker-service" // Docker Swarm service
+	ResourceTypeK8sDeployment ResourceType = "k8s-deployment" // Kubernetes deployment
+	ResourceTypeK8sService    ResourceType = "k8s-service"    // Kubernetes service
+
+	// Storage - storage resources
+	ResourceTypeStorage   ResourceType = "storage"   // Generic storage
+	ResourceTypeDatastore ResourceType = "datastore" // PBS datastore
+	ResourceTypePool      ResourceType = "pool"      // ZFS/Ceph pool
+	ResourceTypeDataset   ResourceType = "dataset"   // ZFS dataset
+
+	// Backup Systems
+	ResourceTypePBS ResourceType = "pbs" // Proxmox Backup Server
+	ResourceTypePMG ResourceType = "pmg" // Proxmox Mail Gateway
+)
+
+// PlatformType identifies the source platform/system.
+type PlatformType string
+
+const (
+	PlatformProxmoxPVE PlatformType = "proxmox-pve"
+	PlatformProxmoxPBS PlatformType = "proxmox-pbs"
+	PlatformProxmoxPMG PlatformType = "proxmox-pmg"
+	PlatformDocker     PlatformType = "docker"
+	PlatformKubernetes PlatformType = "kubernetes"
+	PlatformTrueNAS    PlatformType = "truenas"
+	PlatformHostAgent  PlatformType = "host-agent"
+)
+
+// SourceType indicates how data is collected for this resource.
+type SourceType string
+
+const (
+	SourceAPI    SourceType = "api"    // Data from polling an API
+	SourceAgent  SourceType = "agent"  // Data pushed from agent
+	SourceHybrid SourceType = "hybrid" // Both sources, agent preferred
+)
+
+// ResourceStatus represents the operational state of a resource.
+type ResourceStatus string
+
+const (
+	StatusOnline   ResourceStatus = "online"
+	StatusOffline  ResourceStatus = "offline"
+	StatusRunning  ResourceStatus = "running"
+	StatusStopped  ResourceStatus = "stopped"
+	StatusDegraded ResourceStatus = "degraded"
+	StatusPaused   ResourceStatus = "paused"
+	StatusUnknown  ResourceStatus = "unknown"
+)
+
+// MetricValue represents a metric with current value and optional limits.
+type MetricValue struct {
+	Current float64 `json:"current"`         // Current value (percentage for CPU, bytes for memory/disk)
+	Total   *int64  `json:"total,omitempty"` // Total capacity (bytes) - nil for percentages like CPU
+	Used    *int64  `json:"used,omitempty"`  // Used amount (bytes) - nil for percentages
+	Free    *int64  `json:"free,omitempty"`  // Free amount (bytes) - nil for percentages
+}
+
+// NetworkMetric captures network I/O.
+type NetworkMetric struct {
+	RXBytes int64 `json:"rxBytes"` // Total bytes received
+	TXBytes int64 `json:"txBytes"` // Total bytes transmitted
+}
+
+// ResourceAlert represents an alert associated with a resource.
+type ResourceAlert struct {
+	ID        string    `json:"id"`
+	Type      string    `json:"type"`  // cpu, memory, disk, temperature, etc.
+	Level     string    `json:"level"` // warning, critical
+	Message   string    `json:"message"`
+	Value     float64   `json:"value"`
+	Threshold float64   `json:"threshold"`
+	StartTime time.Time `json:"startTime"`
+}
+
+// ResourceIdentity contains information used for deduplication.
+// When multiple sources report on the same physical machine, we use
+// these fields to identify and merge them.
+type ResourceIdentity struct {
+	Hostname  string   `json:"hostname,omitempty"`  // Primary identifier
+	MachineID string   `json:"machineId,omitempty"` // /etc/machine-id or equivalent
+	IPs       []string `json:"ips,omitempty"`       // Network addresses
+}
+
+// CurrentSchemaVersion is the current version of the Resource schema.
+const CurrentSchemaVersion = 1
+
+// GetPlatformData unmarshals the PlatformData into the provided type.
+// Example: var nodeData NodePlatformData; r.GetPlatformData(&nodeData)
+func (r *Resource) GetPlatformData(v interface{}) error {
+	if r.PlatformData == nil {
+		return nil
+	}
+	return json.Unmarshal(r.PlatformData, v)
+}
+
+// SetPlatformData marshals the provided value into PlatformData.
+func (r *Resource) SetPlatformData(v interface{}) error {
+	data, err := json.Marshal(v)
+	if err != nil {
+		return err
+	}
+	r.PlatformData = data
+	return nil
+}
+
+// IsInfrastructure returns true if this resource is an infrastructure host
+// (node, host, docker-host) rather than a workload (vm, container).
+func (r *Resource) IsInfrastructure() bool {
+	switch r.Type {
+	case ResourceTypeNode, ResourceTypeHost, ResourceTypeDockerHost, ResourceTypeK8sCluster, ResourceTypeK8sNode, ResourceTypeTrueNAS:
+		return true
+	default:
+		return false
+	}
+}
+
+// IsWorkload returns true if this resource is a workload (vm, container, pod)
+// rather than infrastructure.
+func (r *Resource) IsWorkload() bool {
+	switch r.Type {
+	case ResourceTypeVM, ResourceTypeContainer, ResourceTypeOCIContainer, ResourceTypeDockerContainer, ResourceTypePod, ResourceTypeJail:
+		return true
+	default:
+		return false
+	}
+}
+
+// EffectiveDisplayName returns DisplayName if set, otherwise Name.
+func (r *Resource) EffectiveDisplayName() string {
+	if r.DisplayName != "" {
+		return r.DisplayName
+	}
+	return r.Name
+}
+
+// CPUPercent returns the CPU usage as a percentage, or 0 if not available.
+func (r *Resource) CPUPercent() float64 {
+	if r.CPU == nil {
+		return 0
+	}
+	return r.CPU.Current
+}
+
+// MemoryPercent returns the memory usage as a percentage, or 0 if not available.
+func (r *Resource) MemoryPercent() float64 {
+	if r.Memory == nil {
+		return 0
+	}
+	// If we have used/total, calculate percentage
+	if r.Memory.Total != nil && *r.Memory.Total > 0 && r.Memory.Used != nil {
+		return float64(*r.Memory.Used) / float64(*r.Memory.Total) * 100
+	}
+	// Otherwise, Current is the percentage
+	return r.Memory.Current
+}
+
+// DiskPercent returns the disk usage as a percentage, or 0 if not available.
+func (r *Resource) DiskPercent() float64 {
+	if r.Disk == nil {
+		return 0
+	}
+	if r.Disk.Total != nil && *r.Disk.Total > 0 && r.Disk.Used != nil {
+		return float64(*r.Disk.Used) / float64(*r.Disk.Total) * 100
+	}
+	return r.Disk.Current
+}
diff --git a/internal/resources/store.go b/internal/resources/store.go
new file mode 100644
index 0000000..c453021
--- /dev/null
+++ b/internal/resources/store.go
@@ -0,0 +1,1280 @@
+package resources
+
+import (
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/models"
+)
+
+// Store maintains a unified collection of all resources with deduplication.
+type Store struct {
+	mu        sync.RWMutex
+	resources map[string]*Resource // Keyed by Resource.ID
+
+	// Index by identity for deduplication
+	byHostname  map[string][]string // hostname (lower) -> resource IDs
+	byMachineID map[string]string   // machine-id -> resource ID
+	byIP        map[string][]string // IP -> resource IDs
+
+	// Track merged resources (one source is preferred over another)
+	mergedFrom map[string]string // suppressed ID -> preferred ID
+}
+
+// NewStore creates a new resource store.
+func NewStore() *Store {
+	return &Store{
+		resources:   make(map[string]*Resource),
+		byHostname:  make(map[string][]string),
+		byMachineID: make(map[string]string),
+		byIP:        make(map[string][]string),
+		mergedFrom:  make(map[string]string),
+	}
+}
+
+// Upsert adds or updates a resource in the store, performing deduplication.
+// Returns the ID of the resource (may differ if merged with existing).
+func (s *Store) Upsert(r Resource) string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	// Check for duplicates
+	if r.Identity != nil {
+		if existingID := s.findDuplicate(&r); existingID != "" {
+			// Found a duplicate - determine which to prefer
+			existing := s.resources[existingID]
+			preferred := s.preferredResource(existing, &r)
+
+			if preferred == &r {
+				// New resource is preferred, replace the old one
+				s.removeFromIndexes(existing)
+				delete(s.resources, existingID)
+				s.mergedFrom[existingID] = r.ID
+			} else {
+				// Existing resource is preferred, mark this as merged
+				s.mergedFrom[r.ID] = existingID
+				return existingID
+			}
+		}
+	}
+
+	// Add/update the resource
+	s.resources[r.ID] = &r
+	s.addToIndexes(&r)
+
+	return r.ID
+}
+
+// Get retrieves a resource by ID.
+func (s *Store) Get(id string) (*Resource, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	// Check if this ID was merged into another
+	if preferredID, merged := s.mergedFrom[id]; merged {
+		r, ok := s.resources[preferredID]
+		return r, ok
+	}
+
+	r, ok := s.resources[id]
+	return r, ok
+}
+
+// GetAll returns all resources (excluding suppressed duplicates).
+func (s *Store) GetAll() []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	result := make([]Resource, 0, len(s.resources))
+	for _, r := range s.resources {
+		result = append(result, *r)
+	}
+	return result
+}
+
+// GetByType returns all resources of a specific type.
+func (s *Store) GetByType(t ResourceType) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var result []Resource
+	for _, r := range s.resources {
+		if r.Type == t {
+			result = append(result, *r)
+		}
+	}
+	return result
+}
+
+// GetByPlatform returns all resources from a specific platform.
+func (s *Store) GetByPlatform(p PlatformType) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var result []Resource
+	for _, r := range s.resources {
+		if r.PlatformType == p {
+			result = append(result, *r)
+		}
+	}
+	return result
+}
+
+// GetInfrastructure returns all infrastructure resources (nodes, hosts).
+func (s *Store) GetInfrastructure() []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var result []Resource
+	for _, r := range s.resources {
+		if r.IsInfrastructure() {
+			result = append(result, *r)
+		}
+	}
+	return result
+}
+
+// GetWorkloads returns all workload resources (VMs, containers).
+func (s *Store) GetWorkloads() []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var result []Resource
+	for _, r := range s.resources {
+		if r.IsWorkload() {
+			result = append(result, *r)
+		}
+	}
+	return result
+}
+
+// GetChildren returns all resources with the specified parent ID.
+func (s *Store) GetChildren(parentID string) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var result []Resource
+	for _, r := range s.resources {
+		if r.ParentID == parentID {
+			result = append(result, *r)
+		}
+	}
+	return result
+}
+
+// FindContainerHost looks up a Docker container by name or ID and returns the
+// hostname of its parent DockerHost. This is used by AI routing to automatically
+// determine which host should execute commands for a container.
+// Returns empty string if not found.
+func (s *Store) FindContainerHost(containerNameOrID string) string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if containerNameOrID == "" {
+		return ""
+	}
+
+	containerNameLower := strings.ToLower(containerNameOrID)
+
+	// Find the container
+	var container *Resource
+	for _, r := range s.resources {
+		if r.Type != ResourceTypeDockerContainer {
+			continue
+		}
+		// Match by name or ID (case-insensitive)
+		if strings.EqualFold(r.Name, containerNameOrID) ||
+			strings.EqualFold(r.ID, containerNameOrID) ||
+			strings.Contains(strings.ToLower(r.Name), containerNameLower) ||
+			strings.Contains(strings.ToLower(r.ID), containerNameLower) {
+			container = r
+			break
+		}
+	}
+
+	if container == nil || container.ParentID == "" {
+		return ""
+	}
+
+	// Find the parent DockerHost
+	parent := s.resources[container.ParentID]
+	if parent == nil {
+		return ""
+	}
+
+	// Return the hostname from identity, or the name
+	if parent.Identity != nil && parent.Identity.Hostname != "" {
+		return parent.Identity.Hostname
+	}
+	return parent.Name
+}
+
+// Remove removes a resource from the store.
+func (s *Store) Remove(id string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if r, ok := s.resources[id]; ok {
+		s.removeFromIndexes(r)
+		delete(s.resources, id)
+	}
+
+	// Also clean up any merge references
+	delete(s.mergedFrom, id)
+	for k, v := range s.mergedFrom {
+		if v == id {
+			delete(s.mergedFrom, k)
+		}
+	}
+}
+
+// IsSuppressed returns true if the resource ID has been merged/suppressed by another.
+func (s *Store) IsSuppressed(id string) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	_, suppressed := s.mergedFrom[id]
+	return suppressed
+}
+
+// GetPreferredID returns the preferred resource ID if this one is suppressed.
+func (s *Store) GetPreferredID(id string) string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if preferredID, ok := s.mergedFrom[id]; ok {
+		return preferredID
+	}
+	return id
+}
+
+// GetStats returns statistics about the store.
+func (s *Store) GetStats() StoreStats {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	stats := StoreStats{
+		TotalResources:      len(s.resources),
+		SuppressedResources: len(s.mergedFrom),
+		ByType:              make(map[ResourceType]int),
+		ByPlatform:          make(map[PlatformType]int),
+		ByStatus:            make(map[ResourceStatus]int),
+		WithAlerts:          0,
+		LastUpdated:         time.Now().UTC().Format(time.RFC3339),
+	}
+
+	for _, r := range s.resources {
+		stats.ByType[r.Type]++
+		stats.ByPlatform[r.PlatformType]++
+		stats.ByStatus[r.Status]++
+		if len(r.Alerts) > 0 {
+			stats.WithAlerts++
+		}
+	}
+
+	return stats
+}
+
+// StoreStats contains statistics about the resource store.
+type StoreStats struct {
+	TotalResources      int                    `json:"totalResources"`
+	SuppressedResources int                    `json:"suppressedResources"`
+	ByType              map[ResourceType]int   `json:"byType"`
+	ByPlatform          map[PlatformType]int   `json:"byPlatform"`
+	ByStatus            map[ResourceStatus]int `json:"byStatus"`
+	WithAlerts          int                    `json:"withAlerts"`
+	LastUpdated         string                 `json:"lastUpdated"`
+}
+
+// GetPreferredResourceFor returns the preferred resource for a given ID.
+// If the ID was merged into another resource, returns that preferred resource.
+// If not merged, returns the resource itself. Returns nil if not found.
+func (s *Store) GetPreferredResourceFor(resourceID string) *Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	// Check if this ID was merged
+	if preferredID, merged := s.mergedFrom[resourceID]; merged {
+		if r, ok := s.resources[preferredID]; ok {
+			return r
+		}
+	}
+
+	// Return the resource itself if it exists
+	if r, ok := s.resources[resourceID]; ok {
+		return r
+	}
+	return nil
+}
+
+// IsSamePhysicalMachine checks if two resource IDs represent the same physical machine.
+// This is useful for alert deduplication between different source types (API vs Agent).
+func (s *Store) IsSamePhysicalMachine(id1, id2 string) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	// Check if they're literally the same
+	if id1 == id2 {
+		return true
+	}
+
+	// Check if both map to the same preferred resource
+	preferred1 := id1
+	if pid, merged := s.mergedFrom[id1]; merged {
+		preferred1 = pid
+	}
+
+	preferred2 := id2
+	if pid, merged := s.mergedFrom[id2]; merged {
+		preferred2 = pid
+	}
+
+	return preferred1 == preferred2
+}
+
+// HasPreferredSourceForHostname checks if there's a resource with a preferred source
+// (like host-agent) monitoring a machine with the given hostname.
+// This helps alert managers determine if they should skip alerts from API sources.
+func (s *Store) HasPreferredSourceForHostname(hostname string) bool {
+	if hostname == "" {
+		return false
+	}
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	hostnameLower := strings.ToLower(hostname)
+	resourceIDs, exists := s.byHostname[hostnameLower]
+	if !exists {
+		return false
+	}
+
+	// Check if any resource with this hostname has a preferred source type
+	for _, id := range resourceIDs {
+		if r, ok := s.resources[id]; ok {
+			// Host agent and Docker agent sources are preferred over API
+			if r.SourceType == SourceAgent || r.SourceType == SourceHybrid {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// ============================================================================
+// Polling Optimization Methods (Phase 3)
+// These methods help reduce redundant API polling when agents are active
+// ============================================================================
+
+// ShouldSkipAPIPolling returns true if API polling should be skipped for the
+// given hostname because an agent is providing richer, more frequent data.
+// This is useful for reducing load when both Proxmox API and host agents monitor
+// the same machine.
+func (s *Store) ShouldSkipAPIPolling(hostname string) bool {
+	return s.HasPreferredSourceForHostname(hostname)
+}
+
+// GetAgentMonitoredHostnames returns a list of hostnames that are being monitored
+// by agents (host-agent, docker-agent). This can be used by the monitoring loop
+// to adjust polling behavior for these hosts.
+func (s *Store) GetAgentMonitoredHostnames() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var hostnames []string
+	seen := make(map[string]bool)
+
+	for _, r := range s.resources {
+		if r.SourceType != SourceAgent && r.SourceType != SourceHybrid {
+			continue
+		}
+		if r.Identity == nil || r.Identity.Hostname == "" {
+			continue
+		}
+		hostnameLower := strings.ToLower(r.Identity.Hostname)
+		if !seen[hostnameLower] {
+			seen[hostnameLower] = true
+			hostnames = append(hostnames, r.Identity.Hostname)
+		}
+	}
+
+	return hostnames
+}
+
+// GetPollingRecommendations returns recommendations for optimizing polling.
+// Returns a map of hostname -> recommended polling interval multiplier.
+// - Value of 0 means skip entirely (agent provides all needed data)
+// - Value > 1 means reduce frequency (poll less often)
+// - Value of 1 means normal polling
+func (s *Store) GetPollingRecommendations() map[string]float64 {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	recommendations := make(map[string]float64)
+
+	for _, r := range s.resources {
+		if r.Identity == nil || r.Identity.Hostname == "" {
+			continue
+		}
+		hostname := strings.ToLower(r.Identity.Hostname)
+
+		switch r.SourceType {
+		case SourceAgent:
+			// Agent provides all data - skip API polling for metrics
+			// (we may still want to poll for cluster-wide info)
+			recommendations[hostname] = 0
+		case SourceHybrid:
+			// Hybrid mode - reduce frequency but don't skip
+			recommendations[hostname] = 0.5 // Poll at half frequency
+		}
+	}
+
+	return recommendations
+}
+
+// findDuplicate looks for an existing resource that represents the same machine.
+// Must be called with the lock held.
+func (s *Store) findDuplicate(r *Resource) string {
+	if r.Identity == nil {
+		return ""
+	}
+
+	// 1. Machine ID match (most reliable) - but only for same type
+	// A node and host agent on the same machine should coexist as different data sources
+	if r.Identity.MachineID != "" && r.IsInfrastructure() {
+		if existingID, ok := s.byMachineID[r.Identity.MachineID]; ok && existingID != r.ID {
+			existing := s.resources[existingID]
+			// Only match if same type
+			if existing != nil && existing.Type == r.Type {
+				return existingID
+			}
+		}
+	}
+
+	// 2. Hostname match (case-insensitive) - only for same infrastructure type
+	// Workloads (VMs, containers) can have duplicate names across clusters
+	if r.Identity.Hostname != "" && r.IsInfrastructure() {
+		hostnameLower := strings.ToLower(r.Identity.Hostname)
+		if existingIDs, ok := s.byHostname[hostnameLower]; ok {
+			for _, existingID := range existingIDs {
+				if existingID != r.ID {
+					existing := s.resources[existingID]
+					// Only match same infrastructure type (e.g., host with host, node with node)
+					// Different types represent different data sources and should coexist
+					if existing.Type == r.Type {
+						return existingID
+					}
+				}
+			}
+		}
+	}
+
+	// 3. IP overlap (if same non-localhost IP, likely same machine) - only for same infrastructure type
+	if r.IsInfrastructure() {
+		for _, ip := range r.Identity.IPs {
+			if isNonUniqueIP(ip) {
+				continue
+			}
+			if existingIDs, ok := s.byIP[ip]; ok {
+				for _, existingID := range existingIDs {
+					if existingID != r.ID {
+						existing := s.resources[existingID]
+						// Only match same infrastructure type
+						if existing.Type == r.Type {
+							return existingID
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return ""
+}
+
+// preferredResource determines which of two duplicate resources should be kept.
+// Agent data is preferred over API data.
+func (s *Store) preferredResource(a, b *Resource) *Resource {
+	// Prefer agent over API
+	aScore := s.sourceScore(a.SourceType)
+	bScore := s.sourceScore(b.SourceType)
+
+	if aScore > bScore {
+		return a
+	}
+	if bScore > aScore {
+		return b
+	}
+
+	// Same source type - prefer the one with more recent data
+	if a.LastSeen.After(b.LastSeen) {
+		return a
+	}
+	return b
+}
+
+func (s *Store) sourceScore(st SourceType) int {
+	switch st {
+	case SourceAgent:
+		return 3 // Agent data is most preferred
+	case SourceHybrid:
+		return 2 // Hybrid is second
+	case SourceAPI:
+		return 1 // API is least preferred
+	default:
+		return 0
+	}
+}
+
+func (s *Store) addToIndexes(r *Resource) {
+	if r.Identity == nil {
+		return
+	}
+
+	if r.Identity.MachineID != "" {
+		s.byMachineID[r.Identity.MachineID] = r.ID
+	}
+
+	if r.Identity.Hostname != "" {
+		hostnameLower := strings.ToLower(r.Identity.Hostname)
+		s.byHostname[hostnameLower] = append(s.byHostname[hostnameLower], r.ID)
+	}
+
+	for _, ip := range r.Identity.IPs {
+		if !isNonUniqueIP(ip) {
+			s.byIP[ip] = append(s.byIP[ip], r.ID)
+		}
+	}
+}
+
+func (s *Store) removeFromIndexes(r *Resource) {
+	if r.Identity == nil {
+		return
+	}
+
+	if r.Identity.MachineID != "" {
+		if s.byMachineID[r.Identity.MachineID] == r.ID {
+			delete(s.byMachineID, r.Identity.MachineID)
+		}
+	}
+
+	if r.Identity.Hostname != "" {
+		hostnameLower := strings.ToLower(r.Identity.Hostname)
+		s.byHostname[hostnameLower] = removeFromSlice(s.byHostname[hostnameLower], r.ID)
+		if len(s.byHostname[hostnameLower]) == 0 {
+			delete(s.byHostname, hostnameLower)
+		}
+	}
+
+	for _, ip := range r.Identity.IPs {
+		s.byIP[ip] = removeFromSlice(s.byIP[ip], r.ID)
+		if len(s.byIP[ip]) == 0 {
+			delete(s.byIP, ip)
+		}
+	}
+}
+
+func removeFromSlice(slice []string, item string) []string {
+	result := make([]string, 0, len(slice))
+	for _, s := range slice {
+		if s != item {
+			result = append(result, s)
+		}
+	}
+	return result
+}
+
+// isNonUniqueIP returns true if the IP address is not useful for machine identification.
+// This includes localhost addresses and Docker bridge IPs that exist on every Docker host.
+func isNonUniqueIP(ip string) bool {
+	// Localhost addresses
+	if ip == "127.0.0.1" || ip == "::1" || strings.HasPrefix(ip, "127.") {
+		return true
+	}
+
+	// Docker bridge network - 172.17.0.1/16 exists on every Docker host
+	// Also filter other Docker-assigned bridge networks (172.17-31.x.x)
+	if strings.HasPrefix(ip, "172.17.") || strings.HasPrefix(ip, "172.18.") ||
+		strings.HasPrefix(ip, "172.19.") || strings.HasPrefix(ip, "172.20.") ||
+		strings.HasPrefix(ip, "172.21.") || strings.HasPrefix(ip, "172.22.") {
+		return true
+	}
+
+	// Link-local addresses (fe80::)
+	if strings.HasPrefix(strings.ToLower(ip), "fe80:") {
+		return true
+	}
+
+	return false
+}
+
+// MarkStale marks resources that haven't been updated recently.
+func (s *Store) MarkStale(threshold time.Duration) []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	now := time.Now()
+	var staleIDs []string
+
+	for id, r := range s.resources {
+		if now.Sub(r.LastSeen) > threshold {
+			// Mark as offline/degraded
+			if r.Status == StatusOnline || r.Status == StatusRunning {
+				r.Status = StatusDegraded
+				staleIDs = append(staleIDs, id)
+			}
+		}
+	}
+
+	return staleIDs
+}
+
+// PruneStale removes resources that have been stale for too long.
+func (s *Store) PruneStale(staleThreshold, removeThreshold time.Duration) []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	now := time.Now()
+	var removedIDs []string
+
+	for id, r := range s.resources {
+		if now.Sub(r.LastSeen) > removeThreshold {
+			s.removeFromIndexes(r)
+			delete(s.resources, id)
+			removedIDs = append(removedIDs, id)
+		}
+	}
+
+	return removedIDs
+}
+
+// Query provides a fluent interface for querying resources.
+func (s *Store) Query() *ResourceQuery {
+	return &ResourceQuery{store: s}
+}
+
+// ResourceQuery provides a fluent query interface.
+type ResourceQuery struct {
+	store     *Store
+	types     []ResourceType
+	platforms []PlatformType
+	statuses  []ResourceStatus
+	parentID  *string
+	clusterID *string
+	hasAlerts *bool
+	sortBy    string
+	sortDesc  bool
+	limit     int
+	offset    int
+}
+
+// OfType filters by resource types.
+func (q *ResourceQuery) OfType(types ...ResourceType) *ResourceQuery {
+	q.types = types
+	return q
+}
+
+// FromPlatform filters by platform types.
+func (q *ResourceQuery) FromPlatform(platforms ...PlatformType) *ResourceQuery {
+	q.platforms = platforms
+	return q
+}
+
+// WithStatus filters by resource status.
+func (q *ResourceQuery) WithStatus(statuses ...ResourceStatus) *ResourceQuery {
+	q.statuses = statuses
+	return q
+}
+
+// WithParent filters by parent ID.
+func (q *ResourceQuery) WithParent(parentID string) *ResourceQuery {
+	q.parentID = &parentID
+	return q
+}
+
+// InCluster filters by cluster ID.
+func (q *ResourceQuery) InCluster(clusterID string) *ResourceQuery {
+	q.clusterID = &clusterID
+	return q
+}
+
+// WithAlerts filters to resources that have active alerts.
+func (q *ResourceQuery) WithAlerts() *ResourceQuery {
+	hasAlerts := true
+	q.hasAlerts = &hasAlerts
+	return q
+}
+
+// SortBy sets the sort field.
+func (q *ResourceQuery) SortBy(field string, desc bool) *ResourceQuery {
+	q.sortBy = field
+	q.sortDesc = desc
+	return q
+}
+
+// Limit sets the maximum number of results.
+func (q *ResourceQuery) Limit(n int) *ResourceQuery {
+	q.limit = n
+	return q
+}
+
+// Offset sets the offset for pagination.
+func (q *ResourceQuery) Offset(n int) *ResourceQuery {
+	q.offset = n
+	return q
+}
+
+// Execute runs the query and returns matching resources.
+func (q *ResourceQuery) Execute() []Resource {
+	q.store.mu.RLock()
+	defer q.store.mu.RUnlock()
+
+	var results []Resource
+
+	for _, r := range q.store.resources {
+		if q.matches(r) {
+			results = append(results, *r)
+		}
+	}
+
+	// Apply sorting if specified
+	if q.sortBy != "" {
+		sortResources(results, q.sortBy, q.sortDesc)
+	}
+
+	// Apply pagination
+	if q.offset > 0 {
+		if q.offset >= len(results) {
+			return []Resource{}
+		}
+		results = results[q.offset:]
+	}
+
+	if q.limit > 0 && q.limit < len(results) {
+		results = results[:q.limit]
+	}
+
+	return results
+}
+
+// Count returns the number of matching resources without fetching them.
+func (q *ResourceQuery) Count() int {
+	q.store.mu.RLock()
+	defer q.store.mu.RUnlock()
+
+	count := 0
+	for _, r := range q.store.resources {
+		if q.matches(r) {
+			count++
+		}
+	}
+	return count
+}
+
+func (q *ResourceQuery) matches(r *Resource) bool {
+	// Type filter
+	if len(q.types) > 0 {
+		found := false
+		for _, t := range q.types {
+			if r.Type == t {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	// Platform filter
+	if len(q.platforms) > 0 {
+		found := false
+		for _, p := range q.platforms {
+			if r.PlatformType == p {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	// Status filter
+	if len(q.statuses) > 0 {
+		found := false
+		for _, s := range q.statuses {
+			if r.Status == s {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+
+	// Parent filter
+	if q.parentID != nil && r.ParentID != *q.parentID {
+		return false
+	}
+
+	// Cluster filter
+	if q.clusterID != nil && r.ClusterID != *q.clusterID {
+		return false
+	}
+
+	// Alerts filter
+	if q.hasAlerts != nil && *q.hasAlerts && len(r.Alerts) == 0 {
+		return false
+	}
+
+	return true
+}
+
+// sortResources sorts a slice of resources by the given field.
+// Supported fields: name, type, status, cpu, memory, disk, last_seen
+func sortResources(resources []Resource, field string, desc bool) {
+	if len(resources) < 2 {
+		return
+	}
+
+	// Simple bubble sort for consistency (stable sort)
+	// For production, could use sort.Slice with a compare function
+	for i := 0; i < len(resources)-1; i++ {
+		for j := i + 1; j < len(resources); j++ {
+			shouldSwap := false
+
+			switch strings.ToLower(field) {
+			case "name":
+				if desc {
+					shouldSwap = resources[i].EffectiveDisplayName() < resources[j].EffectiveDisplayName()
+				} else {
+					shouldSwap = resources[i].EffectiveDisplayName() > resources[j].EffectiveDisplayName()
+				}
+			case "type":
+				if desc {
+					shouldSwap = string(resources[i].Type) < string(resources[j].Type)
+				} else {
+					shouldSwap = string(resources[i].Type) > string(resources[j].Type)
+				}
+			case "status":
+				if desc {
+					shouldSwap = string(resources[i].Status) < string(resources[j].Status)
+				} else {
+					shouldSwap = string(resources[i].Status) > string(resources[j].Status)
+				}
+			case "cpu":
+				if desc {
+					shouldSwap = resources[i].CPUPercent() < resources[j].CPUPercent()
+				} else {
+					shouldSwap = resources[i].CPUPercent() > resources[j].CPUPercent()
+				}
+			case "memory", "mem":
+				if desc {
+					shouldSwap = resources[i].MemoryPercent() < resources[j].MemoryPercent()
+				} else {
+					shouldSwap = resources[i].MemoryPercent() > resources[j].MemoryPercent()
+				}
+			case "disk":
+				if desc {
+					shouldSwap = resources[i].DiskPercent() < resources[j].DiskPercent()
+				} else {
+					shouldSwap = resources[i].DiskPercent() > resources[j].DiskPercent()
+				}
+			case "last_seen", "lastseen":
+				if desc {
+					shouldSwap = resources[i].LastSeen.Before(resources[j].LastSeen)
+				} else {
+					shouldSwap = resources[i].LastSeen.After(resources[j].LastSeen)
+				}
+			}
+
+			if shouldSwap {
+				resources[i], resources[j] = resources[j], resources[i]
+			}
+		}
+	}
+}
+
+// ============================================================================
+// Cross-Platform Analysis Methods
+// These methods support AI queries like "what's using the most CPU"
+// ============================================================================
+
+// GetTopByCPU returns resources sorted by CPU usage (highest first).
+// Optionally filter by resource types. Pass nil to include all types.
+func (s *Store) GetTopByCPU(limit int, types []ResourceType) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var resources []Resource
+	for _, r := range s.resources {
+		if r.CPU == nil || r.CPU.Current == 0 {
+			continue
+		}
+		if len(types) > 0 {
+			matched := false
+			for _, t := range types {
+				if r.Type == t {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+		resources = append(resources, *r)
+	}
+
+	// Sort by CPU usage descending
+	for i := 0; i < len(resources)-1; i++ {
+		for j := i + 1; j < len(resources); j++ {
+			if resources[j].CPUPercent() > resources[i].CPUPercent() {
+				resources[i], resources[j] = resources[j], resources[i]
+			}
+		}
+	}
+
+	if limit > 0 && limit < len(resources) {
+		return resources[:limit]
+	}
+	return resources
+}
+
+// GetTopByMemory returns resources sorted by memory usage (highest first).
+// Optionally filter by resource types. Pass nil to include all types.
+func (s *Store) GetTopByMemory(limit int, types []ResourceType) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var resources []Resource
+	for _, r := range s.resources {
+		if r.Memory == nil || r.Memory.Current == 0 {
+			continue
+		}
+		if len(types) > 0 {
+			matched := false
+			for _, t := range types {
+				if r.Type == t {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+		resources = append(resources, *r)
+	}
+
+	// Sort by memory usage descending
+	for i := 0; i < len(resources)-1; i++ {
+		for j := i + 1; j < len(resources); j++ {
+			if resources[j].MemoryPercent() > resources[i].MemoryPercent() {
+				resources[i], resources[j] = resources[j], resources[i]
+			}
+		}
+	}
+
+	if limit > 0 && limit < len(resources) {
+		return resources[:limit]
+	}
+	return resources
+}
+
+// GetTopByDisk returns resources sorted by disk usage (highest first).
+// Optionally filter by resource types. Pass nil to include all types.
+func (s *Store) GetTopByDisk(limit int, types []ResourceType) []Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	var resources []Resource
+	for _, r := range s.resources {
+		if r.Disk == nil || r.Disk.Current == 0 {
+			continue
+		}
+		if len(types) > 0 {
+			matched := false
+			for _, t := range types {
+				if r.Type == t {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+		resources = append(resources, *r)
+	}
+
+	// Sort by disk usage descending
+	for i := 0; i < len(resources)-1; i++ {
+		for j := i + 1; j < len(resources); j++ {
+			if resources[j].DiskPercent() > resources[i].DiskPercent() {
+				resources[i], resources[j] = resources[j], resources[i]
+			}
+		}
+	}
+
+	if limit > 0 && limit < len(resources) {
+		return resources[:limit]
+	}
+	return resources
+}
+
+// GetRelated returns resources that are related to the given resource.
+// This includes: parent, children, siblings (same parent), and co-located resources (same cluster).
+func (s *Store) GetRelated(resourceID string) map[string][]Resource {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	result := make(map[string][]Resource)
+
+	r, ok := s.resources[resourceID]
+	if !ok {
+		return result
+	}
+
+	// Get parent
+	if r.ParentID != "" {
+		if parent, ok := s.resources[r.ParentID]; ok {
+			result["parent"] = []Resource{*parent}
+		}
+	}
+
+	// Get children
+	var children []Resource
+	for _, other := range s.resources {
+		if other.ParentID == resourceID {
+			children = append(children, *other)
+		}
+	}
+	if len(children) > 0 {
+		result["children"] = children
+	}
+
+	// Get siblings (same parent)
+	if r.ParentID != "" {
+		var siblings []Resource
+		for _, other := range s.resources {
+			if other.ID != resourceID && other.ParentID == r.ParentID {
+				siblings = append(siblings, *other)
+			}
+		}
+		if len(siblings) > 0 {
+			result["siblings"] = siblings
+		}
+	}
+
+	// Get co-located resources (same cluster)
+	if r.ClusterID != "" {
+		var colocated []Resource
+		for _, other := range s.resources {
+			if other.ID != resourceID && other.ClusterID == r.ClusterID {
+				colocated = append(colocated, *other)
+			}
+		}
+		if len(colocated) > 0 {
+			result["cluster_members"] = colocated
+		}
+	}
+
+	return result
+}
+
+// GetResourceSummary returns a summary of resource utilization across the infrastructure.
+// This is useful for AI to get a quick overview of the infrastructure state.
+func (s *Store) GetResourceSummary() ResourceSummary {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	summary := ResourceSummary{
+		ByType:     make(map[ResourceType]TypeSummary),
+		ByPlatform: make(map[PlatformType]PlatformSummary),
+	}
+
+	for _, r := range s.resources {
+		summary.TotalResources++
+
+		// Count by status
+		switch r.Status {
+		case StatusOnline, StatusRunning:
+			summary.Healthy++
+		case StatusDegraded:
+			summary.Degraded++
+		case StatusOffline, StatusStopped, StatusUnknown:
+			summary.Offline++
+		}
+
+		// Track alerts
+		if len(r.Alerts) > 0 {
+			summary.WithAlerts++
+		}
+
+		// Aggregate by type
+		ts := summary.ByType[r.Type]
+		ts.Count++
+		if r.CPU != nil {
+			ts.TotalCPUPercent += r.CPUPercent()
+		}
+		if r.Memory != nil {
+			ts.TotalMemoryPercent += r.MemoryPercent()
+		}
+		summary.ByType[r.Type] = ts
+
+		// Aggregate by platform
+		ps := summary.ByPlatform[r.PlatformType]
+		ps.Count++
+		summary.ByPlatform[r.PlatformType] = ps
+	}
+
+	// Calculate averages
+	for t, ts := range summary.ByType {
+		if ts.Count > 0 {
+			ts.AvgCPUPercent = ts.TotalCPUPercent / float64(ts.Count)
+			ts.AvgMemoryPercent = ts.TotalMemoryPercent / float64(ts.Count)
+			summary.ByType[t] = ts
+		}
+	}
+
+	return summary
+}
+
+// ResourceSummary provides an overview of resource utilization.
+type ResourceSummary struct {
+	TotalResources int
+	Healthy        int
+	Degraded       int
+	Offline        int
+	WithAlerts     int
+	ByType         map[ResourceType]TypeSummary
+	ByPlatform     map[PlatformType]PlatformSummary
+}
+
+// TypeSummary aggregates metrics for a resource type.
+type TypeSummary struct {
+	Count              int
+	TotalCPUPercent    float64
+	TotalMemoryPercent float64
+	AvgCPUPercent      float64
+	AvgMemoryPercent   float64
+}
+
+// PlatformSummary aggregates counts for a platform.
+type PlatformSummary struct {
+	Count int
+}
+
+// PopulateFromSnapshot converts all resources from a StateSnapshot to the unified store.
+// This should be called whenever the state is updated (e.g., before WebSocket broadcasts).
+// It also removes resources that are no longer present in the snapshot (except agent-sourced
+// resources which persist independently of the Proxmox API polling).
+func (s *Store) PopulateFromSnapshot(snapshot models.StateSnapshot) {
+	// Track which resource IDs we see in this snapshot
+	seenIDs := make(map[string]bool)
+
+	// Convert nodes
+	for _, node := range snapshot.Nodes {
+		r := FromNode(node)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Convert VMs
+	for _, vm := range snapshot.VMs {
+		r := FromVM(vm)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Convert containers
+	for _, ct := range snapshot.Containers {
+		r := FromContainer(ct)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Convert hosts
+	for _, host := range snapshot.Hosts {
+		r := FromHost(host)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Convert docker hosts and their containers
+	for _, dh := range snapshot.DockerHosts {
+		r := FromDockerHost(dh)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+
+		// Convert containers within the docker host
+		for _, dc := range dh.Containers {
+			r := FromDockerContainer(dc, dh.ID, dh.Hostname)
+			id := s.Upsert(r)
+			seenIDs[id] = true
+		}
+	}
+
+	// Convert Kubernetes clusters and their resources
+	for _, cluster := range snapshot.KubernetesClusters {
+		r := FromKubernetesCluster(cluster)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+
+		for _, node := range cluster.Nodes {
+			r := FromKubernetesNode(node, cluster)
+			id := s.Upsert(r)
+			seenIDs[id] = true
+		}
+
+		for _, pod := range cluster.Pods {
+			r := FromKubernetesPod(pod, cluster)
+			id := s.Upsert(r)
+			seenIDs[id] = true
+		}
+
+		for _, dep := range cluster.Deployments {
+			r := FromKubernetesDeployment(dep, cluster)
+			id := s.Upsert(r)
+			seenIDs[id] = true
+		}
+	}
+
+	// Convert PBS instances
+	for _, pbs := range snapshot.PBSInstances {
+		r := FromPBSInstance(pbs)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Convert storage
+	for _, storage := range snapshot.Storage {
+		r := FromStorage(storage)
+		id := s.Upsert(r)
+		seenIDs[id] = true
+	}
+
+	// Remove resources that were NOT in this snapshot.
+	// The snapshot is the authoritative source for the in-memory store (including agent-sourced data).
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	var toRemove []string
+	for id := range s.resources {
+		if !seenIDs[id] {
+			toRemove = append(toRemove, id)
+		}
+	}
+
+	for _, id := range toRemove {
+		if r, ok := s.resources[id]; ok {
+			s.removeFromIndexes(r)
+			delete(s.resources, id)
+		}
+	}
+}
diff --git a/internal/resources/store_test.go b/internal/resources/store_test.go
new file mode 100644
index 0000000..c32efe3
--- /dev/null
+++ b/internal/resources/store_test.go
@@ -0,0 +1,780 @@
+package resources
+
+import (
+	"testing"
+	"time"
+)
+
+func TestStoreUpsertAndGet(t *testing.T) {
+	store := NewStore()
+
+	r := Resource{
+		ID:           "test-1",
+		Type:         ResourceTypeNode,
+		Name:         "node1",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		Status:       StatusOnline,
+		LastSeen:     time.Now(),
+	}
+
+	id := store.Upsert(r)
+	if id != "test-1" {
+		t.Errorf("Expected ID test-1, got %s", id)
+	}
+
+	retrieved, ok := store.Get("test-1")
+	if !ok {
+		t.Fatal("Failed to retrieve resource")
+	}
+	if retrieved.Name != "node1" {
+		t.Errorf("Expected name node1, got %s", retrieved.Name)
+	}
+}
+
+func TestStoreGetAll(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "1", Type: ResourceTypeNode, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "2", Type: ResourceTypeVM, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "3", Type: ResourceTypeContainer, LastSeen: time.Now()})
+
+	all := store.GetAll()
+	if len(all) != 3 {
+		t.Errorf("Expected 3 resources, got %d", len(all))
+	}
+}
+
+func TestStoreGetByType(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "node1", Type: ResourceTypeNode, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "node2", Type: ResourceTypeNode, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "vm1", Type: ResourceTypeVM, LastSeen: time.Now()})
+
+	nodes := store.GetByType(ResourceTypeNode)
+	if len(nodes) != 2 {
+		t.Errorf("Expected 2 nodes, got %d", len(nodes))
+	}
+
+	vms := store.GetByType(ResourceTypeVM)
+	if len(vms) != 1 {
+		t.Errorf("Expected 1 VM, got %d", len(vms))
+	}
+}
+
+func TestStoreGetByPlatform(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "1", PlatformType: PlatformProxmoxPVE, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "2", PlatformType: PlatformProxmoxPVE, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "3", PlatformType: PlatformDocker, LastSeen: time.Now()})
+
+	pve := store.GetByPlatform(PlatformProxmoxPVE)
+	if len(pve) != 2 {
+		t.Errorf("Expected 2 PVE resources, got %d", len(pve))
+	}
+
+	docker := store.GetByPlatform(PlatformDocker)
+	if len(docker) != 1 {
+		t.Errorf("Expected 1 Docker resource, got %d", len(docker))
+	}
+}
+
+func TestStoreGetInfrastructureAndWorkloads(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "node1", Type: ResourceTypeNode, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "host1", Type: ResourceTypeHost, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "vm1", Type: ResourceTypeVM, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "ct1", Type: ResourceTypeContainer, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "dc1", Type: ResourceTypeDockerContainer, LastSeen: time.Now()})
+
+	infra := store.GetInfrastructure()
+	if len(infra) != 2 {
+		t.Errorf("Expected 2 infrastructure resources, got %d", len(infra))
+	}
+
+	workloads := store.GetWorkloads()
+	if len(workloads) != 3 {
+		t.Errorf("Expected 3 workload resources, got %d", len(workloads))
+	}
+}
+
+func TestStoreGetChildren(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "node1", Type: ResourceTypeNode, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "vm1", Type: ResourceTypeVM, ParentID: "node1", LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "vm2", Type: ResourceTypeVM, ParentID: "node1", LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "vm3", Type: ResourceTypeVM, ParentID: "node2", LastSeen: time.Now()})
+
+	children := store.GetChildren("node1")
+	if len(children) != 2 {
+		t.Errorf("Expected 2 children of node1, got %d", len(children))
+	}
+}
+
+func TestStoreRemove(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "test-1", LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "test-2", LastSeen: time.Now()})
+
+	if len(store.GetAll()) != 2 {
+		t.Fatal("Expected 2 resources before remove")
+	}
+
+	store.Remove("test-1")
+
+	if len(store.GetAll()) != 1 {
+		t.Error("Expected 1 resource after remove")
+	}
+
+	_, ok := store.Get("test-1")
+	if ok {
+		t.Error("Removed resource should not be retrievable")
+	}
+}
+
+func TestDeduplicationByHostname(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// Add a Proxmox node (API source)
+	nodeResource := Resource{
+		ID:           "pve1/node/server1",
+		Type:         ResourceTypeNode,
+		Name:         "server1",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		Status:       StatusOnline,
+		CPU:          &MetricValue{Current: 50.0},
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server1",
+		},
+	}
+	store.Upsert(nodeResource)
+
+	// Add a host agent for the same server (agent source)
+	// Different types should coexist, not merge
+	hostResource := Resource{
+		ID:           "host-agent/server1",
+		Type:         ResourceTypeHost,
+		Name:         "server1",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		Status:       StatusOnline,
+		CPU:          &MetricValue{Current: 55.0},
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server1",
+		},
+	}
+	store.Upsert(hostResource)
+
+	// Different types should coexist (node + host = 2 resources)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 resources (node + host coexist), got %d", len(all))
+	}
+
+	// Both should be retrievable
+	_, ok := store.Get("pve1/node/server1")
+	if !ok {
+		t.Error("Node resource should be retrievable")
+	}
+	_, ok = store.Get("host-agent/server1")
+	if !ok {
+		t.Error("Host resource should be retrievable")
+	}
+
+	// Now test same-type deduplication: add another node with same hostname
+	nodeResource2 := Resource{
+		ID:           "pve2/node/server1",
+		Type:         ResourceTypeNode,
+		Name:         "server1",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		Status:       StatusOnline,
+		CPU:          &MetricValue{Current: 60.0},
+		LastSeen:     now.Add(time.Second), // Newer
+		Identity: &ResourceIdentity{
+			Hostname: "server1",
+		},
+	}
+	store.Upsert(nodeResource2)
+
+	// Should still have 2 (newer node replaces old node, host remains)
+	all = store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 resources after same-type dedup, got %d", len(all))
+	}
+
+	// The newer node should have replaced the old one
+	r, ok := store.Get("pve2/node/server1")
+	if !ok {
+		t.Error("Newer node should be present")
+	}
+	if r.CPU.Current != 60.0 {
+		t.Errorf("Expected CPU 60.0 from newer node, got %f", r.CPU.Current)
+	}
+}
+
+func TestDeduplicationByMachineID(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+	machineID := "abc-123-def-456"
+
+	// Add a Docker host
+	dockerHost := Resource{
+		ID:           "docker-host-1",
+		Type:         ResourceTypeDockerHost,
+		Name:         "server-different-name",
+		PlatformType: PlatformDocker,
+		SourceType:   SourceAgent,
+		Status:       StatusOnline,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname:  "server-different-name",
+			MachineID: machineID,
+		},
+	}
+	store.Upsert(dockerHost)
+
+	// Add a host agent with the same machine ID but different type
+	// Different types should coexist
+	hostAgent := Resource{
+		ID:           "host-agent-1",
+		Type:         ResourceTypeHost,
+		Name:         "server-production",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		Status:       StatusOnline,
+		LastSeen:     now.Add(time.Second),
+		Identity: &ResourceIdentity{
+			Hostname:  "server-production",
+			MachineID: machineID,
+		},
+	}
+	store.Upsert(hostAgent)
+
+	// Different types should coexist (docker-host + host = 2 resources)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 resources (different types coexist with same machineID), got %d", len(all))
+	}
+
+	// Now test same-type deduplication: add another host with same machine ID
+	hostAgent2 := Resource{
+		ID:           "host-agent-2",
+		Type:         ResourceTypeHost, // Same type as first host
+		Name:         "server-newer",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		Status:       StatusOnline,
+		LastSeen:     now.Add(2 * time.Second), // Newer
+		Identity: &ResourceIdentity{
+			Hostname:  "server-newer",
+			MachineID: machineID,
+		},
+	}
+	store.Upsert(hostAgent2)
+
+	// Should still have 2 (newer host replaces old host, docker-host remains)
+	all = store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 resources after same-type dedup, got %d", len(all))
+	}
+}
+
+func TestDeduplicationByIP(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+	sharedIP := "192.168.1.100"
+
+	// Add a Proxmox node
+	node := Resource{
+		ID:           "node-1",
+		Type:         ResourceTypeNode,
+		Name:         "pve-node",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		Status:       StatusOnline,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "pve-node",
+			IPs:      []string{sharedIP},
+		},
+	}
+	store.Upsert(node)
+
+	// Add a host agent with the same IP but different type
+	// Different types should coexist
+	host := Resource{
+		ID:           "host-1",
+		Type:         ResourceTypeHost,
+		Name:         "different-hostname",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		Status:       StatusOnline,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "different-hostname",
+			IPs:      []string{sharedIP},
+		},
+	}
+	store.Upsert(host)
+
+	// Different types should coexist (node + host = 2 resources)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 resources (different types coexist), got %d", len(all))
+	}
+
+	// Both should be retrievable
+	_, ok := store.Get("node-1")
+	if !ok {
+		t.Error("Node should be retrievable")
+	}
+	_, ok = store.Get("host-1")
+	if !ok {
+		t.Error("Host should be retrievable")
+	}
+}
+
+func TestNoDeduplicationForWorkloads(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// VMs with the same hostname should NOT be deduplicated
+	// (they're workloads, not infrastructure)
+	vm1 := Resource{
+		ID:           "pve1/vm/100",
+		Type:         ResourceTypeVM,
+		Name:         "webserver",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "webserver", // Same hostname
+		},
+	}
+	store.Upsert(vm1)
+
+	vm2 := Resource{
+		ID:           "pve2/vm/100",
+		Type:         ResourceTypeVM,
+		Name:         "webserver",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "webserver", // Same hostname
+		},
+	}
+	store.Upsert(vm2)
+
+	// Both VMs should exist (workloads are not deduplicated)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 VMs (no dedup for workloads), got %d", len(all))
+	}
+}
+
+func TestNoDeduplicationForLocalhost(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	host1 := Resource{
+		ID:           "host-1",
+		Type:         ResourceTypeHost,
+		Name:         "server1",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server1",
+			IPs:      []string{"127.0.0.1", "192.168.1.1"},
+		},
+	}
+	store.Upsert(host1)
+
+	host2 := Resource{
+		ID:           "host-2",
+		Type:         ResourceTypeHost,
+		Name:         "server2",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server2",
+			IPs:      []string{"127.0.0.1", "192.168.1.2"}, // Both have localhost
+		},
+	}
+	store.Upsert(host2)
+
+	// Both should exist (127.0.0.1 shouldn't trigger dedup)
+	all := store.GetAll()
+	if len(all) != 2 {
+		t.Errorf("Expected 2 hosts (localhost shouldn't dedup), got %d", len(all))
+	}
+}
+
+func TestStoreStats(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{ID: "1", Type: ResourceTypeNode, PlatformType: PlatformProxmoxPVE, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "2", Type: ResourceTypeNode, PlatformType: PlatformProxmoxPVE, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "3", Type: ResourceTypeVM, PlatformType: PlatformProxmoxPVE, LastSeen: time.Now()})
+	store.Upsert(Resource{ID: "4", Type: ResourceTypeDockerHost, PlatformType: PlatformDocker, LastSeen: time.Now()})
+
+	stats := store.GetStats()
+
+	if stats.TotalResources != 4 {
+		t.Errorf("Expected 4 total resources, got %d", stats.TotalResources)
+	}
+	if stats.ByType[ResourceTypeNode] != 2 {
+		t.Errorf("Expected 2 nodes, got %d", stats.ByType[ResourceTypeNode])
+	}
+	if stats.ByPlatform[PlatformProxmoxPVE] != 3 {
+		t.Errorf("Expected 3 PVE resources, got %d", stats.ByPlatform[PlatformProxmoxPVE])
+	}
+}
+
+func TestStoreQuery(t *testing.T) {
+	store := NewStore()
+
+	store.Upsert(Resource{
+		ID:           "1",
+		Type:         ResourceTypeNode,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusOnline,
+		LastSeen:     time.Now(),
+	})
+	store.Upsert(Resource{
+		ID:           "2",
+		Type:         ResourceTypeVM,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusRunning,
+		ParentID:     "1",
+		LastSeen:     time.Now(),
+	})
+	store.Upsert(Resource{
+		ID:           "3",
+		Type:         ResourceTypeVM,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusStopped,
+		ParentID:     "1",
+		LastSeen:     time.Now(),
+	})
+	store.Upsert(Resource{
+		ID:           "4",
+		Type:         ResourceTypeDockerContainer,
+		PlatformType: PlatformDocker,
+		Status:       StatusRunning,
+		LastSeen:     time.Now(),
+	})
+
+	// Query by type
+	vms := store.Query().OfType(ResourceTypeVM).Execute()
+	if len(vms) != 2 {
+		t.Errorf("Expected 2 VMs, got %d", len(vms))
+	}
+
+	// Query by status
+	running := store.Query().WithStatus(StatusRunning).Execute()
+	if len(running) != 2 {
+		t.Errorf("Expected 2 running resources, got %d", len(running))
+	}
+
+	// Query by platform
+	pve := store.Query().FromPlatform(PlatformProxmoxPVE).Execute()
+	if len(pve) != 3 {
+		t.Errorf("Expected 3 PVE resources, got %d", len(pve))
+	}
+
+	// Query by parent
+	node1Children := store.Query().WithParent("1").Execute()
+	if len(node1Children) != 2 {
+		t.Errorf("Expected 2 children of node 1, got %d", len(node1Children))
+	}
+
+	// Combined query
+	runningVMs := store.Query().
+		OfType(ResourceTypeVM).
+		WithStatus(StatusRunning).
+		Execute()
+	if len(runningVMs) != 1 {
+		t.Errorf("Expected 1 running VM, got %d", len(runningVMs))
+	}
+
+	// Count
+	count := store.Query().OfType(ResourceTypeVM).Count()
+	if count != 2 {
+		t.Errorf("Expected count 2, got %d", count)
+	}
+
+	// Limit
+	limited := store.Query().Limit(2).Execute()
+	if len(limited) > 2 {
+		t.Errorf("Expected at most 2 results, got %d", len(limited))
+	}
+}
+
+func TestMarkStale(t *testing.T) {
+	store := NewStore()
+
+	old := time.Now().Add(-2 * time.Hour)
+	recent := time.Now()
+
+	store.Upsert(Resource{
+		ID:       "old-1",
+		Status:   StatusOnline,
+		LastSeen: old,
+	})
+	store.Upsert(Resource{
+		ID:       "recent-1",
+		Status:   StatusOnline,
+		LastSeen: recent,
+	})
+
+	stale := store.MarkStale(time.Hour)
+
+	if len(stale) != 1 {
+		t.Errorf("Expected 1 stale resource, got %d", len(stale))
+	}
+
+	r, _ := store.Get("old-1")
+	if r.Status != StatusDegraded {
+		t.Errorf("Expected stale resource to be degraded, got %s", r.Status)
+	}
+
+	r, _ = store.Get("recent-1")
+	if r.Status != StatusOnline {
+		t.Errorf("Recent resource should still be online, got %s", r.Status)
+	}
+}
+
+func TestPruneStale(t *testing.T) {
+	store := NewStore()
+
+	veryOld := time.Now().Add(-48 * time.Hour)
+	old := time.Now().Add(-2 * time.Hour)
+	recent := time.Now()
+
+	store.Upsert(Resource{ID: "very-old", LastSeen: veryOld})
+	store.Upsert(Resource{ID: "old", LastSeen: old})
+	store.Upsert(Resource{ID: "recent", LastSeen: recent})
+
+	removed := store.PruneStale(time.Hour, 24*time.Hour)
+
+	if len(removed) != 1 {
+		t.Errorf("Expected 1 removed resource, got %d", len(removed))
+	}
+
+	if len(store.GetAll()) != 2 {
+		t.Errorf("Expected 2 remaining resources, got %d", len(store.GetAll()))
+	}
+}
+
+func TestAPIToAgentPreference(t *testing.T) {
+	store := NewStore()
+
+	now := time.Now()
+
+	// First, add an API-sourced host
+	apiResource := Resource{
+		ID:           "api-host",
+		Type:         ResourceTypeHost, // Same type as agent
+		Name:         "server",
+		PlatformType: PlatformProxmoxPVE,
+		SourceType:   SourceAPI,
+		CPU:          &MetricValue{Current: 50.0},
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server",
+		},
+	}
+	store.Upsert(apiResource)
+
+	// Then, add an agent resource for the same machine (same type, different source)
+	agentResource := Resource{
+		ID:           "agent-host",
+		Type:         ResourceTypeHost, // Same type
+		Name:         "server",
+		PlatformType: PlatformHostAgent,
+		SourceType:   SourceAgent,
+		CPU:          &MetricValue{Current: 55.0},
+		LastSeen:     now,
+		Identity: &ResourceIdentity{
+			Hostname: "server",
+		},
+	}
+	store.Upsert(agentResource)
+
+	// Only agent resource should exist (same type = dedup, agent preferred)
+	all := store.GetAll()
+	if len(all) != 1 {
+		t.Fatalf("Expected 1 resource (same type dedup), got %d", len(all))
+	}
+
+	if all[0].SourceType != SourceAgent {
+		t.Errorf("Expected agent source type (preferred), got %s", all[0].SourceType)
+	}
+}
+
+func TestGetTopByCPU(t *testing.T) {
+	store := NewStore()
+	now := time.Now()
+
+	store.Upsert(Resource{
+		ID:       "vm1",
+		Type:     ResourceTypeVM,
+		Name:     "low-cpu-vm",
+		CPU:      &MetricValue{Current: 20.0},
+		LastSeen: now,
+	})
+	store.Upsert(Resource{
+		ID:       "vm2",
+		Type:     ResourceTypeVM,
+		Name:     "high-cpu-vm",
+		CPU:      &MetricValue{Current: 85.0},
+		LastSeen: now,
+	})
+	store.Upsert(Resource{
+		ID:       "node1",
+		Type:     ResourceTypeNode,
+		Name:     "busy-node",
+		CPU:      &MetricValue{Current: 75.0},
+		LastSeen: now,
+	})
+
+	// Get top 2 by CPU
+	top := store.GetTopByCPU(2, nil)
+	if len(top) != 2 {
+		t.Fatalf("Expected 2 resources, got %d", len(top))
+	}
+	if top[0].Name != "high-cpu-vm" {
+		t.Errorf("Expected high-cpu-vm first, got %s", top[0].Name)
+	}
+	if top[1].Name != "busy-node" {
+		t.Errorf("Expected busy-node second, got %s", top[1].Name)
+	}
+
+	// Filter by type
+	topVMs := store.GetTopByCPU(10, []ResourceType{ResourceTypeVM})
+	if len(topVMs) != 2 {
+		t.Errorf("Expected 2 VMs, got %d", len(topVMs))
+	}
+}
+
+func TestGetRelated(t *testing.T) {
+	store := NewStore()
+	now := time.Now()
+
+	store.Upsert(Resource{
+		ID:        "node1",
+		Type:      ResourceTypeNode,
+		Name:      "parent-node",
+		ClusterID: "cluster1",
+		LastSeen:  now,
+	})
+	store.Upsert(Resource{
+		ID:        "vm1",
+		Type:      ResourceTypeVM,
+		Name:      "child-vm-1",
+		ParentID:  "node1",
+		ClusterID: "cluster1",
+		LastSeen:  now,
+	})
+	store.Upsert(Resource{
+		ID:        "vm2",
+		Type:      ResourceTypeVM,
+		Name:      "child-vm-2",
+		ParentID:  "node1",
+		ClusterID: "cluster1",
+		LastSeen:  now,
+	})
+	store.Upsert(Resource{
+		ID:        "node2",
+		Type:      ResourceTypeNode,
+		Name:      "cluster-peer",
+		ClusterID: "cluster1",
+		LastSeen:  now,
+	})
+
+	// Get related resources for vm1
+	related := store.GetRelated("vm1")
+
+	// Should have parent
+	if parent, ok := related["parent"]; !ok || len(parent) != 1 {
+		t.Error("Expected 1 parent")
+	}
+
+	// Should have sibling (vm2)
+	if siblings, ok := related["siblings"]; !ok || len(siblings) != 1 {
+		t.Errorf("Expected 1 sibling, got %d", len(related["siblings"]))
+	}
+
+	// Should have cluster members
+	if cluster, ok := related["cluster_members"]; !ok || len(cluster) != 3 {
+		t.Errorf("Expected 3 cluster members, got %d", len(related["cluster_members"]))
+	}
+}
+
+func TestGetResourceSummary(t *testing.T) {
+	store := NewStore()
+	now := time.Now()
+
+	store.Upsert(Resource{
+		ID:           "node1",
+		Type:         ResourceTypeNode,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusOnline,
+		CPU:          &MetricValue{Current: 50},
+		Memory:       &MetricValue{Current: 50}, // 50% usage
+		LastSeen:     now,
+	})
+	store.Upsert(Resource{
+		ID:           "vm1",
+		Type:         ResourceTypeVM,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusRunning,
+		CPU:          &MetricValue{Current: 70},
+		Memory:       &MetricValue{Current: 50}, // 50% usage
+		LastSeen:     now,
+	})
+	store.Upsert(Resource{
+		ID:           "vm2",
+		Type:         ResourceTypeVM,
+		PlatformType: PlatformProxmoxPVE,
+		Status:       StatusStopped,
+		LastSeen:     now,
+	})
+
+	summary := store.GetResourceSummary()
+
+	if summary.TotalResources != 3 {
+		t.Errorf("Expected 3 total resources, got %d", summary.TotalResources)
+	}
+	if summary.Healthy != 2 {
+		t.Errorf("Expected 2 healthy, got %d", summary.Healthy)
+	}
+	if summary.Offline != 1 {
+		t.Errorf("Expected 1 offline, got %d", summary.Offline)
+	}
+
+	// Check per-type stats
+	vmStats := summary.ByType[ResourceTypeVM]
+	if vmStats.Count != 2 {
+		t.Errorf("Expected 2 VMs, got %d", vmStats.Count)
+	}
+}
+
diff --git a/internal/sensors/parser.go b/internal/sensors/parser.go
index d60299e..4f68353 100644
--- a/internal/sensors/parser.go
+++ b/internal/sensors/parser.go
@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"math"
+	"sort"
 	"strings"
 
 	"github.com/rs/zerolog/log"
@@ -37,6 +38,7 @@ func Parse(jsonStr string) (*TemperatureData, error) {
 	}
 
 	foundCPUChip := false
+	nvmeTempsByChip := make(map[string]float64)
 
 	// Parse each sensor chip
 	for chipName, chipData := range sensorsData {
@@ -54,8 +56,10 @@ func Parse(jsonStr string) (*TemperatureData, error) {
 		}
 
 		// Handle NVMe temperature sensors
-		if strings.Contains(chipName, "nvme") {
-			parseNVMeTemps(chipName, chipMap, data)
+		if strings.Contains(chipLower, "nvme") {
+			if tempVal, ok := extractNVMeCompositeTemp(chipMap); ok {
+				nvmeTempsByChip[chipName] = tempVal
+			}
 		}
 
 		// Handle GPU temperature sensors
@@ -75,6 +79,23 @@ func Parse(jsonStr string) (*TemperatureData, error) {
 		data.CPUPackage = data.CPUMax
 	}
 
+	if len(nvmeTempsByChip) > 0 {
+		chips := make([]string, 0, len(nvmeTempsByChip))
+		for chip := range nvmeTempsByChip {
+			chips = append(chips, chip)
+		}
+		sort.Strings(chips)
+		for i, chip := range chips {
+			normalizedName := fmt.Sprintf("nvme%d", i)
+			data.NVMe[normalizedName] = nvmeTempsByChip[chip]
+			log.Debug().
+				Str("chip", chip).
+				Str("normalizedName", normalizedName).
+				Float64("temp", nvmeTempsByChip[chip]).
+				Msg("Found NVMe temperature")
+		}
+	}
+
 	data.Available = foundCPUChip || len(data.NVMe) > 0 || len(data.GPU) > 0
 
 	log.Debug().
@@ -109,6 +130,7 @@ func isCPUChip(chipLower string) bool {
 func parseCPUTemps(chipMap map[string]interface{}, data *TemperatureData) {
 	foundPackageTemp := false
 	var chipletTemps []float64
+	var genericTemp float64 // For chips that only report temp1
 
 	for sensorName, sensorData := range chipMap {
 		sensorMap, ok := sensorData.(map[string]interface{})
@@ -131,6 +153,14 @@ func parseCPUTemps(chipMap map[string]interface{}, data *TemperatureData) {
 			}
 		}
 
+		// Capture generic temp1 for chips like cpu_thermal (RPi, ARM SoCs)
+		// that don't have labeled sensors
+		if sensorNameLower == "temp1" {
+			if tempVal := extractTempInput(sensorMap); !math.IsNaN(tempVal) && tempVal > 0 {
+				genericTemp = tempVal
+			}
+		}
+
 		// Look for AMD chiplet temperatures
 		if strings.HasPrefix(sensorName, "Tccd") {
 			if tempVal := extractTempInput(sensorMap); !math.IsNaN(tempVal) && tempVal > 0 {
@@ -175,9 +205,17 @@ func parseCPUTemps(chipMap map[string]interface{}, data *TemperatureData) {
 			}
 		}
 	}
+
+	// Fallback: use generic temp1 for chips like cpu_thermal (RPi, ARM SoCs)
+	if !foundPackageTemp && data.CPUPackage == 0 && genericTemp > 0 {
+		data.CPUPackage = genericTemp
+		if genericTemp > data.CPUMax {
+			data.CPUMax = genericTemp
+		}
+	}
 }
 
-func parseNVMeTemps(chipName string, chipMap map[string]interface{}, data *TemperatureData) {
+func extractNVMeCompositeTemp(chipMap map[string]interface{}) (float64, bool) {
 	for sensorName, sensorData := range chipMap {
 		sensorMap, ok := sensorData.(map[string]interface{})
 		if !ok {
@@ -186,15 +224,12 @@ func parseNVMeTemps(chipName string, chipMap map[string]interface{}, data *Tempe
 
 		// Look for Composite temperature (main NVMe temp)
 		if strings.Contains(sensorName, "Composite") {
-			if tempVal := extractTempInput(sensorMap); !math.IsNaN(tempVal) {
-				data.NVMe[chipName] = tempVal
-				log.Debug().
-					Str("chip", chipName).
-					Float64("temp", tempVal).
-					Msg("Found NVMe temperature")
+			if tempVal := extractTempInput(sensorMap); !math.IsNaN(tempVal) && tempVal > 0 {
+				return tempVal, true
 			}
 		}
 	}
+	return 0, false
 }
 
 func parseGPUTemps(chipName string, chipMap map[string]interface{}, data *TemperatureData) {
diff --git a/internal/sensors/parser_test.go b/internal/sensors/parser_test.go
index d4ee80d..ac8949f 100644
--- a/internal/sensors/parser_test.go
+++ b/internal/sensors/parser_test.go
@@ -146,12 +146,12 @@ func TestParse_NVMe(t *testing.T) {
 		t.Errorf("len(NVMe) = %d, want 2", len(data.NVMe))
 	}
 
-	if data.NVMe["nvme-pci-0100"] != 38.85 {
-		t.Errorf("nvme-pci-0100 = %v, want 38.85", data.NVMe["nvme-pci-0100"])
+	if data.NVMe["nvme0"] != 38.85 {
+		t.Errorf("nvme0 = %v, want 38.85", data.NVMe["nvme0"])
 	}
 
-	if data.NVMe["nvme-pci-0200"] != 42.0 {
-		t.Errorf("nvme-pci-0200 = %v, want 42.0", data.NVMe["nvme-pci-0200"])
+	if data.NVMe["nvme1"] != 42.0 {
+		t.Errorf("nvme1 = %v, want 42.0", data.NVMe["nvme1"])
 	}
 }
 
@@ -223,6 +223,10 @@ func TestParse_Combined(t *testing.T) {
 		t.Errorf("len(NVMe) = %d, want 1", len(data.NVMe))
 	}
 
+	if data.NVMe["nvme0"] != 40.0 {
+		t.Errorf("nvme0 = %v, want 40.0", data.NVMe["nvme0"])
+	}
+
 	if len(data.GPU) != 1 {
 		t.Errorf("len(GPU) = %d, want 1", len(data.GPU))
 	}
diff --git a/internal/utils/helpers.go b/internal/utils/helpers.go
index 2e1d7c0..1eb602f 100644
--- a/internal/utils/helpers.go
+++ b/internal/utils/helpers.go
@@ -42,9 +42,65 @@ func GetenvTrim(key string) string {
 	return strings.TrimSpace(os.Getenv(key))
 }
 
-// NormalizeVersion strips the "v" prefix from version strings for comparison.
-// This normalizes versions like "v4.33.1" to "4.33.1" so that version strings
-// from different sources (agent vs server) can be compared consistently.
+// NormalizeVersion normalizes version strings for comparison by:
+// 1. Stripping whitespace
+// 2. Removing the "v" prefix (e.g., "v4.33.1" -> "4.33.1")
+// 3. Stripping build metadata after "+" (e.g., "4.36.2+git.14.dirty" -> "4.36.2")
+//
+// Per semver spec, build metadata MUST be ignored when determining version precedence.
+// This fixes issues where dirty builds like "4.36.2+git.14.g469307d6.dirty" would
+// incorrectly be treated as newer than "4.36.2", causing infinite update loops.
 func NormalizeVersion(version string) string {
-	return strings.TrimPrefix(strings.TrimSpace(version), "v")
+	v := strings.TrimPrefix(strings.TrimSpace(version), "v")
+	// Strip build metadata (everything after +)
+	// Per semver: build metadata MUST be ignored when determining version precedence
+	if idx := strings.Index(v, "+"); idx != -1 {
+		v = v[:idx]
+	}
+	return v
+}
+
+// CompareVersions compares two semver-like version strings.
+// Returns:
+//
+//	1 if a > b (a is newer)
+//	0 if a == b
+//
+// -1 if a < b (b is newer)
+//
+// Handles versions like "4.33.1", "v4.33.1", "4.33" gracefully.
+func CompareVersions(a, b string) int {
+	// Normalize both versions
+	a = NormalizeVersion(a)
+	b = NormalizeVersion(b)
+
+	// Split into parts
+	partsA := strings.Split(a, ".")
+	partsB := strings.Split(b, ".")
+
+	// Compare each part numerically
+	maxLen := len(partsA)
+	if len(partsB) > maxLen {
+		maxLen = len(partsB)
+	}
+
+	for i := 0; i < maxLen; i++ {
+		var numA, numB int
+
+		if i < len(partsA) {
+			fmt.Sscanf(partsA[i], "%d", &numA)
+		}
+		if i < len(partsB) {
+			fmt.Sscanf(partsB[i], "%d", &numB)
+		}
+
+		if numA > numB {
+			return 1
+		}
+		if numA < numB {
+			return -1
+		}
+	}
+
+	return 0
 }
diff --git a/internal/utils/utils_test.go b/internal/utils/utils_test.go
index f772db1..c2110ad 100644
--- a/internal/utils/utils_test.go
+++ b/internal/utils/utils_test.go
@@ -307,6 +307,12 @@ func TestNormalizeVersion(t *testing.T) {
 		{"v", ""},
 		{" ", ""},
 		{"vv4.33.1", "v4.33.1"}, // Only removes one v
+
+		// Build metadata (semver +suffix should be stripped)
+		{"4.36.2+git.14.g469307d6.dirty", "4.36.2"},
+		{"v4.36.2+build123", "4.36.2"},
+		{"1.0.0+20231215", "1.0.0"},
+		{"v1.0.0-rc1+build.456", "1.0.0-rc1"},
 	}
 
 	for _, tc := range tests {
@@ -318,3 +324,58 @@ func TestNormalizeVersion(t *testing.T) {
 		})
 	}
 }
+
+func TestCompareVersions(t *testing.T) {
+	tests := []struct {
+		a        string
+		b        string
+		expected int
+	}{
+		// Equal versions
+		{"4.33.1", "4.33.1", 0},
+		{"v4.33.1", "4.33.1", 0},
+		{"4.33.1", "v4.33.1", 0},
+		{"1.0.0", "1.0.0", 0},
+
+		// a > b (a is newer)
+		{"4.33.2", "4.33.1", 1},
+		{"4.34.0", "4.33.1", 1},
+		{"5.0.0", "4.33.1", 1},
+		{"4.33.10", "4.33.9", 1},
+		{"4.33.1", "4.33", 1}, // Missing patch = 0
+
+		// a < b (b is newer)
+		{"4.33.1", "4.33.2", -1},
+		{"4.33.1", "4.34.0", -1},
+		{"4.33.1", "5.0.0", -1},
+		{"4.33.9", "4.33.10", -1},
+		{"4.33", "4.33.1", -1},
+
+		// With v prefix
+		{"v4.34.0", "v4.33.1", 1},
+		{"v4.33.1", "v4.34.0", -1},
+
+		// Edge cases
+		{"0.0.1", "0.0.0", 1},
+		{"0.0.0", "0.0.1", -1},
+		{"1.0", "0.9.9", 1},
+
+		// Build metadata should be ignored (semver +suffix)
+		// This is the critical fix for the infinite agent update loop bug
+		{"4.36.2+git.14.g469307d6.dirty", "4.36.2", 0},   // Dirty == clean
+		{"4.36.2", "4.36.2+git.14.g469307d6.dirty", 0},   // Clean == dirty
+		{"v4.36.2+build123", "v4.36.2", 0},               // With v prefix
+		{"4.36.3", "4.36.2+git.14.g469307d6.dirty", 1},   // Newer beats dirty
+		{"4.36.2+git.14.g469307d6.dirty", "4.36.3", -1},  // Dirty older than newer
+	}
+
+	for _, tc := range tests {
+		name := tc.a + "_vs_" + tc.b
+		t.Run(name, func(t *testing.T) {
+			result := CompareVersions(tc.a, tc.b)
+			if result != tc.expected {
+				t.Errorf("CompareVersions(%q, %q) = %d, want %d", tc.a, tc.b, result, tc.expected)
+			}
+		})
+	}
+}
diff --git a/mock.env b/mock.env
index dae2cf5..8d180ef 100644
--- a/mock.env
+++ b/mock.env
@@ -1,6 +1,13 @@
-PULSE_MOCK_MODE=true
+PULSE_MOCK_MODE=false
 PULSE_MOCK_NODES=7
 PULSE_MOCK_VMS_PER_NODE=5
 PULSE_MOCK_LXCS_PER_NODE=8
+PULSE_MOCK_DOCKER_HOSTS=3
+PULSE_MOCK_DOCKER_CONTAINERS=12
+PULSE_MOCK_GENERIC_HOSTS=4
+PULSE_MOCK_K8S_CLUSTERS=2
+PULSE_MOCK_K8S_NODES=4
+PULSE_MOCK_K8S_PODS=30
+PULSE_MOCK_K8S_DEPLOYMENTS=12
 PULSE_MOCK_RANDOM_METRICS=true
 PULSE_MOCK_STOPPED_PERCENT=20
diff --git a/pkg/agents/host/report.go b/pkg/agents/host/report.go
index 8242d3a..26e6fee 100644
--- a/pkg/agents/host/report.go
+++ b/pkg/agents/host/report.go
@@ -8,9 +8,11 @@ type Report struct {
 	Host       HostInfo           `json:"host"`
 	Metrics    Metrics            `json:"metrics"`
 	Disks      []Disk             `json:"disks,omitempty"`
+	DiskIO     []DiskIO           `json:"diskIO,omitempty"`
 	Network    []NetworkInterface `json:"network,omitempty"`
 	Sensors    Sensors            `json:"sensors,omitempty"`
 	RAID       []RAIDArray        `json:"raid,omitempty"`
+	Ceph       *CephCluster       `json:"ceph,omitempty"`
 	Tags       []string           `json:"tags,omitempty"`
 	Timestamp  time.Time          `json:"timestamp"`
 	SequenceID string             `json:"sequenceId,omitempty"`
@@ -23,6 +25,7 @@ type AgentInfo struct {
 	Type            string `json:"type,omitempty"` // "unified", "host", or "docker" - empty means legacy
 	IntervalSeconds int    `json:"intervalSeconds,omitempty"`
 	Hostname        string `json:"hostname,omitempty"`
+	UpdatedFrom     string `json:"updatedFrom,omitempty"` // Previous version if recently auto-updated
 }
 
 // HostInfo contains platform and identification details about the monitored host.
@@ -70,6 +73,19 @@ type Disk struct {
 	Usage      float64 `json:"usage,omitempty"`
 }
 
+// DiskIO represents disk I/O statistics for a block device.
+// These are cumulative counters since boot - the backend calculates rates.
+type DiskIO struct {
+	Device     string `json:"device"`               // e.g., "nvme0n1", "sda"
+	ReadBytes  uint64 `json:"readBytes,omitempty"`  // Total bytes read
+	WriteBytes uint64 `json:"writeBytes,omitempty"` // Total bytes written
+	ReadOps    uint64 `json:"readOps,omitempty"`    // Total read operations
+	WriteOps   uint64 `json:"writeOps,omitempty"`   // Total write operations
+	ReadTime   uint64 `json:"readTimeMs,omitempty"` // Total time spent reading (ms)
+	WriteTime  uint64 `json:"writeTimeMs,omitempty"`// Total time spent writing (ms)
+	IOTime     uint64 `json:"ioTimeMs,omitempty"`   // Total time spent doing I/O (ms)
+}
+
 // NetworkInterface summarises network adapter statistics.
 type NetworkInterface struct {
 	Name      string   `json:"name"`
@@ -110,3 +126,103 @@ type RAIDDevice struct {
 	State  string `json:"state"`  // active, spare, faulty, removed
 	Slot   int    `json:"slot"`   // Position in array (-1 if not applicable)
 }
+
+// CephCluster represents Ceph cluster status collected by the host agent.
+type CephCluster struct {
+	FSID        string           `json:"fsid"`
+	Health      CephHealth       `json:"health"`
+	MonMap      CephMonitorMap   `json:"monMap,omitempty"`
+	MgrMap      CephManagerMap   `json:"mgrMap,omitempty"`
+	OSDMap      CephOSDMap       `json:"osdMap"`
+	PGMap       CephPGMap        `json:"pgMap"`
+	Pools       []CephPool       `json:"pools,omitempty"`
+	Services    []CephService    `json:"services,omitempty"`
+	CollectedAt string           `json:"collectedAt"`
+}
+
+// CephHealth represents Ceph cluster health status.
+type CephHealth struct {
+	Status  string                 `json:"status"` // HEALTH_OK, HEALTH_WARN, HEALTH_ERR
+	Checks  map[string]CephCheck   `json:"checks,omitempty"`
+	Summary []CephHealthSummary    `json:"summary,omitempty"`
+}
+
+// CephCheck represents a health check detail.
+type CephCheck struct {
+	Severity string   `json:"severity"`
+	Message  string   `json:"message,omitempty"`
+	Detail   []string `json:"detail,omitempty"`
+}
+
+// CephHealthSummary represents a health summary message.
+type CephHealthSummary struct {
+	Severity string `json:"severity"`
+	Message  string `json:"message"`
+}
+
+// CephMonitorMap represents Ceph monitor information.
+type CephMonitorMap struct {
+	Epoch    int           `json:"epoch"`
+	NumMons  int           `json:"numMons"`
+	Monitors []CephMonitor `json:"monitors,omitempty"`
+}
+
+// CephMonitor represents a single Ceph monitor.
+type CephMonitor struct {
+	Name   string `json:"name"`
+	Rank   int    `json:"rank"`
+	Addr   string `json:"addr,omitempty"`
+	Status string `json:"status,omitempty"`
+}
+
+// CephManagerMap represents Ceph manager information.
+type CephManagerMap struct {
+	Available bool   `json:"available"`
+	NumMgrs   int    `json:"numMgrs"`
+	ActiveMgr string `json:"activeMgr,omitempty"`
+	Standbys  int    `json:"standbys"`
+}
+
+// CephOSDMap represents OSD status summary.
+type CephOSDMap struct {
+	Epoch   int `json:"epoch"`
+	NumOSDs int `json:"numOsds"`
+	NumUp   int `json:"numUp"`
+	NumIn   int `json:"numIn"`
+	NumDown int `json:"numDown,omitempty"`
+	NumOut  int `json:"numOut,omitempty"`
+}
+
+// CephPGMap represents placement group statistics.
+type CephPGMap struct {
+	NumPGs           int     `json:"numPgs"`
+	BytesTotal       uint64  `json:"bytesTotal"`
+	BytesUsed        uint64  `json:"bytesUsed"`
+	BytesAvailable   uint64  `json:"bytesAvailable"`
+	DataBytes        uint64  `json:"dataBytes,omitempty"`
+	UsagePercent     float64 `json:"usagePercent"`
+	DegradedRatio    float64 `json:"degradedRatio,omitempty"`
+	MisplacedRatio   float64 `json:"misplacedRatio,omitempty"`
+	ReadBytesPerSec  uint64  `json:"readBytesPerSec,omitempty"`
+	WriteBytesPerSec uint64  `json:"writeBytesPerSec,omitempty"`
+	ReadOpsPerSec    uint64  `json:"readOpsPerSec,omitempty"`
+	WriteOpsPerSec   uint64  `json:"writeOpsPerSec,omitempty"`
+}
+
+// CephPool represents a Ceph pool.
+type CephPool struct {
+	ID             int     `json:"id"`
+	Name           string  `json:"name"`
+	BytesUsed      uint64  `json:"bytesUsed"`
+	BytesAvailable uint64  `json:"bytesAvailable"`
+	Objects        uint64  `json:"objects"`
+	PercentUsed    float64 `json:"percentUsed"`
+}
+
+// CephService represents a Ceph service summary.
+type CephService struct {
+	Type    string   `json:"type"` // mon, mgr, osd, mds, rgw
+	Running int      `json:"running"`
+	Total   int      `json:"total"`
+	Daemons []string `json:"daemons,omitempty"`
+}
diff --git a/pkg/agents/kubernetes/report.go b/pkg/agents/kubernetes/report.go
new file mode 100644
index 0000000..8de5329
--- /dev/null
+++ b/pkg/agents/kubernetes/report.go
@@ -0,0 +1,98 @@
+package kubernetes
+
+import "time"
+
+// Report represents a single heartbeat from the Kubernetes agent to Pulse.
+// It is designed to be useful without requiring Metrics Server (metrics.k8s.io).
+type Report struct {
+	Agent       AgentInfo    `json:"agent"`
+	Cluster     ClusterInfo  `json:"cluster"`
+	Nodes       []Node       `json:"nodes,omitempty"`
+	Pods        []Pod        `json:"pods,omitempty"`
+	Deployments []Deployment `json:"deployments,omitempty"`
+	Timestamp   time.Time    `json:"timestamp"`
+}
+
+// AgentInfo describes the reporting agent instance.
+type AgentInfo struct {
+	ID              string `json:"id"`
+	Version         string `json:"version"`
+	Type            string `json:"type,omitempty"` // "unified" when running as part of pulse-agent
+	IntervalSeconds int    `json:"intervalSeconds"`
+}
+
+// ClusterInfo identifies the Kubernetes cluster and provides basic metadata.
+type ClusterInfo struct {
+	ID        string `json:"id"`                  // Stable cluster identifier (agent-generated)
+	Name      string `json:"name,omitempty"`      // Optional human-friendly name
+	Server    string `json:"server,omitempty"`    // API server URL
+	Context   string `json:"context,omitempty"`   // Kubeconfig context name if applicable
+	Version   string `json:"version,omitempty"`   // Kubernetes version string
+	Provider  string `json:"provider,omitempty"`  // Optional: gke, eks, aks, etc (best-effort)
+	Namespace string `json:"namespace,omitempty"` // Optional agent namespace when running in-cluster
+}
+
+// Node represents a Kubernetes node at report time.
+type Node struct {
+	UID                     string        `json:"uid"`
+	Name                    string        `json:"name"`
+	Ready                   bool          `json:"ready"`
+	Unschedulable           bool          `json:"unschedulable,omitempty"`
+	KubeletVersion          string        `json:"kubeletVersion,omitempty"`
+	ContainerRuntimeVersion string        `json:"containerRuntimeVersion,omitempty"`
+	OSImage                 string        `json:"osImage,omitempty"`
+	KernelVersion           string        `json:"kernelVersion,omitempty"`
+	Architecture            string        `json:"architecture,omitempty"`
+	Capacity                NodeResources `json:"capacity,omitempty"`
+	Allocatable             NodeResources `json:"allocatable,omitempty"`
+	Roles                   []string      `json:"roles,omitempty"`
+}
+
+type NodeResources struct {
+	CPUCores    int64 `json:"cpuCores,omitempty"`
+	MemoryBytes int64 `json:"memoryBytes,omitempty"`
+	Pods        int64 `json:"pods,omitempty"`
+}
+
+// Pod represents a Kubernetes pod at report time.
+type Pod struct {
+	UID       string            `json:"uid"`
+	Name      string            `json:"name"`
+	Namespace string            `json:"namespace"`
+	NodeName  string            `json:"nodeName,omitempty"`
+	Phase     string            `json:"phase,omitempty"`  // Pending, Running, Succeeded, Failed, Unknown
+	Reason    string            `json:"reason,omitempty"` // Best-effort
+	Message   string            `json:"message,omitempty"`
+	QoSClass  string            `json:"qosClass,omitempty"`
+	CreatedAt time.Time         `json:"createdAt,omitempty"`
+	StartTime *time.Time        `json:"startTime,omitempty"`
+	Restarts  int               `json:"restarts,omitempty"`
+	Labels    map[string]string `json:"labels,omitempty"`
+
+	OwnerKind string `json:"ownerKind,omitempty"`
+	OwnerName string `json:"ownerName,omitempty"`
+
+	Containers []PodContainer `json:"containers,omitempty"`
+}
+
+type PodContainer struct {
+	Name         string `json:"name"`
+	Image        string `json:"image,omitempty"`
+	Ready        bool   `json:"ready"`
+	RestartCount int32  `json:"restartCount,omitempty"`
+	State        string `json:"state,omitempty"`  // waiting, running, terminated
+	Reason       string `json:"reason,omitempty"` // waiting/terminated reason
+	Message      string `json:"message,omitempty"`
+}
+
+// Deployment represents a Kubernetes deployment at report time.
+type Deployment struct {
+	UID               string            `json:"uid"`
+	Name              string            `json:"name"`
+	Namespace         string            `json:"namespace"`
+	DesiredReplicas   int32             `json:"desiredReplicas,omitempty"`
+	UpdatedReplicas   int32             `json:"updatedReplicas,omitempty"`
+	ReadyReplicas     int32             `json:"readyReplicas,omitempty"`
+	AvailableReplicas int32             `json:"availableReplicas,omitempty"`
+	Labels            map[string]string `json:"labels,omitempty"`
+}
diff --git a/pkg/discovery/discovery.go b/pkg/discovery/discovery.go
index 93fe008..8c1f0e2 100644
--- a/pkg/discovery/discovery.go
+++ b/pkg/discovery/discovery.go
@@ -234,9 +234,33 @@ func (s *Scanner) DiscoverServersWithCallbacks(ctx context.Context, subnet strin
 
 	seenIPs := make(map[string]struct{})
 
+	// Pre-populate seenIPs with blocked IPs to skip them during scanning
+	// This prevents probing already-configured Proxmox hosts (reduces PBS auth failure log spam)
+	blockedCount := 0
+	if activeProfile != nil {
+		for _, ip := range activeProfile.IPBlocklist {
+			if ip == nil {
+				continue
+			}
+			if ip4 := ip.To4(); ip4 != nil {
+				seenIPs[ip4.String()] = struct{}{}
+				blockedCount++
+			}
+		}
+		if blockedCount > 0 {
+			log.Debug().
+				Int("blocked_ips", blockedCount).
+				Msg("Pre-populated blocked IPs to skip during discovery")
+		}
+	}
+
 	// Calculate total targets and phases for progress tracking
 	// Use a preview map to ensure we count only unique IPs that will actually be scanned
+	// Copy blocked IPs to preview map as well
 	previewSeen := make(map[string]struct{})
+	for ip := range seenIPs {
+		previewSeen[ip] = struct{}{}
+	}
 	var totalTargets int
 	var validPhases []envdetect.SubnetPhase
 	phases := append([]envdetect.SubnetPhase(nil), activeProfile.Phases...)
diff --git a/pkg/discovery/envdetect/envdetect.go b/pkg/discovery/envdetect/envdetect.go
index 644d6df..aaab3a8 100644
--- a/pkg/discovery/envdetect/envdetect.go
+++ b/pkg/discovery/envdetect/envdetect.go
@@ -86,6 +86,7 @@ type EnvironmentProfile struct {
 	Type         Environment       // Detected environment.
 	Phases       []SubnetPhase     // Subnet scanning phases.
 	ExtraTargets []net.IP          // IPs to always probe.
+	IPBlocklist  []net.IP          // Individual IPs to skip (auto-populated with configured Proxmox hosts).
 	Policy       ScanPolicy        // Applied scan policy.
 	Confidence   float64           // Overall confidence (0.0 - 1.0).
 	Warnings     []string          // Non-fatal detection warnings.
diff --git a/pkg/fsfilters/filters.go b/pkg/fsfilters/filters.go
index 2dd8792..2665632 100644
--- a/pkg/fsfilters/filters.go
+++ b/pkg/fsfilters/filters.go
@@ -101,6 +101,12 @@ var containerOverlayPatterns = []string{
 	"/merged",
 }
 
+// containerPathPrefixes detect container-related paths that should be excluded
+// from disk usage, even if they don't contain "/containers/".
+var containerPathPrefixes = []string{
+	"/mnt/.ix-apps/docker/", // TrueNAS SCALE Docker overlay mounts
+}
+
 // ShouldSkipFilesystem determines if a filesystem should be excluded from disk
 // usage aggregation. It checks for read-only filesystems, virtual/pseudo filesystems,
 // network mounts, and special system mountpoints. Returns skip=true if the filesystem
@@ -155,6 +161,15 @@ func ShouldSkipFilesystem(fsType, mountpoint string, totalBytes, usedBytes uint6
 		}
 	}
 
+	// Check for container paths that don't follow the /containers/ pattern
+	// (e.g., TrueNAS SCALE uses /mnt/.ix-apps/docker/overlay2/...). Related to #718.
+	for _, prefix := range containerPathPrefixes {
+		if strings.HasPrefix(mountpoint, prefix) {
+			reasons = append(reasons, "container-overlay")
+			break
+		}
+	}
+
 	// EnhanceCP uses /var/container_tmp/{uuid}/merged for container overlays.
 	// Filter these as they're ephemeral container layers, not user storage. Related to #790.
 	if strings.Contains(mountpoint, "/container_tmp/") {
diff --git a/pkg/fsfilters/filters_test.go b/pkg/fsfilters/filters_test.go
index bb04749..1298907 100644
--- a/pkg/fsfilters/filters_test.go
+++ b/pkg/fsfilters/filters_test.go
@@ -183,6 +183,10 @@ func TestShouldSkipFilesystem(t *testing.T) {
 		{"enhancecp container_tmp merged", "overlay", "/var/container_tmp/0d6eaae4-1aa0-4aad-a9d9-d430329c2e38/merged", 1000000, 500000, true},
 		{"enhancecp container_tmp overlay", "overlay", "/var/container_tmp/abc123/overlay/layer", 1000000, 500000, true},
 
+		// TrueNAS SCALE Docker overlay paths (issue #718)
+		{"truenas ix-apps docker overlay2", "zfs", "/mnt/.ix-apps/docker/overlay2/6c9aad59ec9b0bc33d5e374/merged", 173 * 1024 * 1024 * 1024 * 1024, 399 * 1024 * 1024, true},
+		{"truenas ix-apps docker overlay2 diff", "zfs", "/mnt/.ix-apps/docker/overlay2/c5e317c7340f9273d394dc0/diff", 173 * 1024 * 1024 * 1024 * 1024, 399 * 1024 * 1024, true},
+
 		// Windows paths
 		{"Windows System Reserved", "NTFS", "System Reserved", 500 * 1024 * 1024, 100 * 1024 * 1024, true},
 		{"Windows C drive - should NOT skip", "NTFS", "C:\\", 500 * 1024 * 1024 * 1024, 200 * 1024 * 1024 * 1024, false},
diff --git a/pkg/proxmox/cluster_client.go b/pkg/proxmox/cluster_client.go
index d87fa62..48a4772 100644
--- a/pkg/proxmox/cluster_client.go
+++ b/pkg/proxmox/cluster_client.go
@@ -343,8 +343,8 @@ func (cc *ClusterClient) getHealthyClient(ctx context.Context) (*Client, error)
 			return nil, fmt.Errorf("failed to create client for %s: %w", selectedEndpoint, err)
 		}
 
-		// Quick connectivity test
-		testCtx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		// Connectivity test - 5 seconds to allow for TLS handshake (~3s typical)
+		testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 		testNodes, testErr := testClient.GetNodes(testCtx)
 		cancel()
 
@@ -489,10 +489,12 @@ func (cc *ClusterClient) recoverUnhealthyNodes(ctx context.Context) {
 			cc.lastHealthCheck[ep] = now
 			cc.mu.Unlock()
 
-			// Try to create a client and test connection with shorter timeout
+			// Try to create a client and test connection
+			// Note: 5-second timeout needed because TLS handshake to Proxmox API
+			// typically takes ~3 seconds on local networks
 			cfg := cc.config
 			cfg.Host = ep
-			cfg.Timeout = 2 * time.Second // Use shorter timeout for recovery attempts
+			cfg.Timeout = 5 * time.Second
 
 			testClient, err := NewClient(cfg)
 			if err != nil {
@@ -504,8 +506,8 @@ func (cc *ClusterClient) recoverUnhealthyNodes(ctx context.Context) {
 				return
 			}
 
-			// Try a simple API call with short timeout
-			testCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+			// Try a simple API call
+			testCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 			_, err = testClient.GetNodes(testCtx)
 			cancel()
 
@@ -630,6 +632,8 @@ func (cc *ClusterClient) executeWithFailover(ctx context.Context, fn func(*Clien
 		// Error 400 with "ds" parameter error means Proxmox 9.x doesn't support RRD data source filtering
 		// JSON unmarshal errors are data format issues, not connectivity problems
 		// Context deadline/timeout errors on storage endpoints mean storage issues, not node unreachability
+		// PBS (Proxmox Backup Server) errors are upstream storage issues, not node connectivity problems
+		// RRD data timeouts are secondary data fetch failures, not node unreachability
 		if isVMSpecificError(errStr) ||
 			strings.Contains(errStr, "595") ||
 			(strings.Contains(errStr, "500") && strings.Contains(errStr, "hostname lookup")) ||
@@ -641,7 +645,14 @@ func (cc *ClusterClient) executeWithFailover(ctx context.Context, fn func(*Clien
 			(strings.Contains(errStr, "storage '") && strings.Contains(errStr, "is not available on node")) ||
 			strings.Contains(errStr, "unexpected response format") ||
 			(strings.Contains(errStr, "context deadline exceeded") && strings.Contains(errStr, "/storage")) ||
-			(strings.Contains(errStr, "Client.Timeout exceeded") && strings.Contains(errStr, "/storage")) {
+			(strings.Contains(errStr, "Client.Timeout exceeded") && strings.Contains(errStr, "/storage")) ||
+			// PBS storage errors - Proxmox can't reach PBS, but node is still reachable
+			(strings.Contains(errStr, "500") && strings.Contains(errStr, "pbs-") && strings.Contains(errStr, "error fetching datastores")) ||
+			(strings.Contains(errStr, "500") && strings.Contains(errStr, "Can't connect to") && strings.Contains(errStr, ":8007")) ||
+			// RRD data timeouts - secondary metric fetch failures, node is still working
+			(strings.Contains(errStr, "context deadline exceeded") && strings.Contains(errStr, "/rrddata")) ||
+			(strings.Contains(errStr, "context deadline exceeded") && strings.Contains(errStr, "/lxc/") && strings.Contains(errStr, "rrd")) ||
+			(strings.Contains(errStr, "context deadline exceeded") && strings.Contains(errStr, "/qemu/") && strings.Contains(errStr, "rrd")) {
 			// This is likely a node-specific failure, not an endpoint failure
 			// Return the error but don't mark the endpoint as unhealthy
 			log.Debug().
diff --git a/scripts/hot-dev.sh b/scripts/hot-dev.sh
index 5c0459d..4003906 100755
--- a/scripts/hot-dev.sh
+++ b/scripts/hot-dev.sh
@@ -78,7 +78,9 @@ if [[ -z ${PULSE_DEV_WS_URL:-} ]]; then
     fi
 fi
 
-ALLOWED_ORIGINS="*"
+# Set specific allowed origin for CORS with credentials
+# Use the frontend dev URL so cross-port SSE requests work with auth cookies
+ALLOWED_ORIGINS="http://${PULSE_DEV_API_HOST:-127.0.0.1}:${FRONTEND_DEV_PORT:-7655}"
 
 export FRONTEND_PORT PORT
 export FRONTEND_DEV_HOST FRONTEND_DEV_PORT
@@ -239,6 +241,26 @@ else
         log_info "Production mode: Using dev config directory: ${PULSE_DATA_DIR}"
     fi
 
+    # Auto-restore encryption key from backup if missing
+    if [[ ! -f "${PULSE_DATA_DIR}/.encryption.key" ]]; then
+        BACKUP_KEY=$(find "${PULSE_DATA_DIR}" -maxdepth 1 -name '.encryption.key.bak*' -type f 2>/dev/null | head -1)
+        if [[ -n "${BACKUP_KEY}" ]] && [[ -f "${BACKUP_KEY}" ]]; then
+            echo ""
+            log_error "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+            log_error "!! ENCRYPTION KEY WAS MISSING - AUTO-RESTORING FROM BACKUP !!"
+            log_error "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+            log_error "!! Backup used: ${BACKUP_KEY}"
+            log_error "!! "
+            log_error "!! To find out what deleted the key, run:"
+            log_error "!!   sudo journalctl -u encryption-key-watcher -n 100"
+            log_error "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+            echo ""
+            cp -f "${BACKUP_KEY}" "${PULSE_DATA_DIR}/.encryption.key"
+            chmod 600 "${PULSE_DATA_DIR}/.encryption.key"
+            log_info "Restored encryption key from backup"
+        fi
+    fi
+
     if [[ -z ${PULSE_ENCRYPTION_KEY:-} ]]; then
         if [[ -f "${PULSE_DATA_DIR}/.encryption.key" ]]; then
             export PULSE_ENCRYPTION_KEY="$(<"${PULSE_DATA_DIR}/.encryption.key")"
diff --git a/scripts/install.ps1 b/scripts/install.ps1
index cd2ba42..dc8e8cb 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -9,6 +9,7 @@ param (
     [string]$Interval = "30s",
     [bool]$EnableHost = $true,
     [bool]$EnableDocker = $false,
+    [bool]$EnableKubernetes = $false,
     [bool]$Insecure = $false,
     [bool]$Uninstall = $false,
     [string]$AgentId = ""
@@ -21,6 +22,43 @@ $InstallDir = "C:\Program Files\Pulse"
 $LogFile = "$env:ProgramData\Pulse\pulse-agent.log"
 $DownloadTimeoutSec = 300
 
+function Parse-Bool {
+    param(
+        [string]$Value,
+        [bool]$Default = $false
+    )
+    if ([string]::IsNullOrWhiteSpace($Value)) {
+        return $Default
+    }
+    switch ($Value.Trim().ToLowerInvariant()) {
+        '1' { return $true }
+        'true' { return $true }
+        'yes' { return $true }
+        'y' { return $true }
+        'on' { return $true }
+        '0' { return $false }
+        'false' { return $false }
+        'no' { return $false }
+        'n' { return $false }
+        'off' { return $false }
+        default { return $Default }
+    }
+}
+
+# Support env-var configuration for boolean flags (unless explicitly passed as parameters).
+if (-not $PSBoundParameters.ContainsKey('EnableHost') -and -not [string]::IsNullOrWhiteSpace($env:PULSE_ENABLE_HOST)) {
+    $EnableHost = Parse-Bool $env:PULSE_ENABLE_HOST $EnableHost
+}
+if (-not $PSBoundParameters.ContainsKey('EnableDocker') -and -not [string]::IsNullOrWhiteSpace($env:PULSE_ENABLE_DOCKER)) {
+    $EnableDocker = Parse-Bool $env:PULSE_ENABLE_DOCKER $EnableDocker
+}
+if (-not $PSBoundParameters.ContainsKey('EnableKubernetes') -and -not [string]::IsNullOrWhiteSpace($env:PULSE_ENABLE_KUBERNETES)) {
+    $EnableKubernetes = Parse-Bool $env:PULSE_ENABLE_KUBERNETES $EnableKubernetes
+}
+if (-not $PSBoundParameters.ContainsKey('Insecure') -and -not [string]::IsNullOrWhiteSpace($env:PULSE_INSECURE_SKIP_VERIFY)) {
+    $Insecure = Parse-Bool $env:PULSE_INSECURE_SKIP_VERIFY $Insecure
+}
+
 # --- Administrator Check ---
 $isAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
 if (-not $isAdmin) {
@@ -309,6 +347,7 @@ $ServiceArgs = @(
 )
 if ($EnableHost) { $ServiceArgs += "--enable-host" }
 if ($EnableDocker) { $ServiceArgs += "--enable-docker" }
+if ($EnableKubernetes) { $ServiceArgs += "--enable-kubernetes" }
 if ($Insecure) { $ServiceArgs += "--insecure" }
 if (-not [string]::IsNullOrWhiteSpace($AgentId)) { $ServiceArgs += @("--agent-id", "`"$AgentId`"") }
 
@@ -319,7 +358,7 @@ try {
     New-Service -Name $AgentName `
                 -BinaryPathName $BinPath `
                 -DisplayName "Pulse Unified Agent" `
-                -Description "Pulse Unified Agent for Host and Docker monitoring" `
+                -Description "Pulse Unified Agent for Host, Docker, and Kubernetes monitoring" `
                 -StartupType Automatic | Out-Null
     Write-Host "Service created successfully" -ForegroundColor Green
 } catch {
diff --git a/scripts/install.sh b/scripts/install.sh
old mode 100644
new mode 100755
index aa95ce0..5494ba8
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -9,6 +9,7 @@
 # Options:
 #   --enable-host       Enable host metrics (default: true)
 #   --enable-docker     Enable docker metrics (default: false)
+#   --enable-kubernetes Enable Kubernetes metrics (default: false)
 #   --interval <dur>    Reporting interval (default: 30s)
 #   --agent-id <id>     Custom agent identifier (default: auto-generated)
 #   --uninstall         Remove the agent
@@ -54,6 +55,9 @@ PULSE_TOKEN=""
 INTERVAL="30s"
 ENABLE_HOST="true"
 ENABLE_DOCKER="false"
+ENABLE_KUBERNETES="false"
+ENABLE_PROXMOX="false"
+PROXMOX_TYPE=""
 UNINSTALL="false"
 INSECURE="false"
 AGENT_ID=""
@@ -83,6 +87,9 @@ build_exec_args() {
         EXEC_ARGS="$EXEC_ARGS --enable-host=false"
     fi
     if [[ "$ENABLE_DOCKER" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-docker"; fi
+    if [[ "$ENABLE_KUBERNETES" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-kubernetes"; fi
+    if [[ "$ENABLE_PROXMOX" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-proxmox"; fi
+    if [[ -n "$PROXMOX_TYPE" ]]; then EXEC_ARGS="$EXEC_ARGS --proxmox-type ${PROXMOX_TYPE}"; fi
     if [[ "$INSECURE" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --insecure"; fi
     if [[ -n "$AGENT_ID" ]]; then EXEC_ARGS="$EXEC_ARGS --agent-id ${AGENT_ID}"; fi
 }
@@ -98,6 +105,9 @@ build_exec_args_array() {
         EXEC_ARGS_ARRAY+=(--enable-host=false)
     fi
     if [[ "$ENABLE_DOCKER" == "true" ]]; then EXEC_ARGS_ARRAY+=(--enable-docker); fi
+    if [[ "$ENABLE_KUBERNETES" == "true" ]]; then EXEC_ARGS_ARRAY+=(--enable-kubernetes); fi
+    if [[ "$ENABLE_PROXMOX" == "true" ]]; then EXEC_ARGS_ARRAY+=(--enable-proxmox); fi
+    if [[ -n "$PROXMOX_TYPE" ]]; then EXEC_ARGS_ARRAY+=(--proxmox-type "$PROXMOX_TYPE"); fi
     if [[ "$INSECURE" == "true" ]]; then EXEC_ARGS_ARRAY+=(--insecure); fi
     if [[ -n "$AGENT_ID" ]]; then EXEC_ARGS_ARRAY+=(--agent-id "$AGENT_ID"); fi
 }
@@ -112,6 +122,10 @@ while [[ $# -gt 0 ]]; do
         --disable-host) ENABLE_HOST="false"; shift ;;
         --enable-docker) ENABLE_DOCKER="true"; shift ;;
         --disable-docker) ENABLE_DOCKER="false"; shift ;;
+        --enable-kubernetes) ENABLE_KUBERNETES="true"; shift ;;
+        --disable-kubernetes) ENABLE_KUBERNETES="false"; shift ;;
+        --enable-proxmox) ENABLE_PROXMOX="true"; shift ;;
+        --proxmox-type) PROXMOX_TYPE="$2"; shift 2 ;;
         --insecure) INSECURE="true"; shift ;;
         --uninstall) UNINSTALL="true"; shift ;;
         --agent-id) AGENT_ID="$2"; shift 2 ;;
@@ -325,18 +339,26 @@ chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
 
 # --- Legacy Cleanup ---
 # Remove old agents if they exist to prevent conflicts
+# This is critical because legacy agents use the same system ID and will cause
+# connection conflicts (rapid connect/disconnect cycles) with the unified agent.
 log_info "Checking for legacy agents..."
 
-# Legacy Host Agent
+# Kill any running legacy agent processes first (even if started manually)
+# This prevents WebSocket connection conflicts during installation
+pkill -f "pulse-host-agent" 2>/dev/null || true
+pkill -f "pulse-docker-agent" 2>/dev/null || true
+sleep 1
+
+# Legacy Host Agent - systemd cleanup
 if command -v systemctl >/dev/null 2>&1; then
-    if systemctl is-active --quiet pulse-host-agent 2>/dev/null || systemctl is-enabled --quiet pulse-host-agent 2>/dev/null; then
+    if systemctl is-active --quiet pulse-host-agent 2>/dev/null || systemctl is-enabled --quiet pulse-host-agent 2>/dev/null || [[ -f /etc/systemd/system/pulse-host-agent.service ]]; then
         log_warn "Removing legacy pulse-host-agent..."
         systemctl stop pulse-host-agent 2>/dev/null || true
         systemctl disable pulse-host-agent 2>/dev/null || true
         rm -f /etc/systemd/system/pulse-host-agent.service
         rm -f /usr/local/bin/pulse-host-agent
     fi
-    if systemctl is-active --quiet pulse-docker-agent 2>/dev/null || systemctl is-enabled --quiet pulse-docker-agent 2>/dev/null; then
+    if systemctl is-active --quiet pulse-docker-agent 2>/dev/null || systemctl is-enabled --quiet pulse-docker-agent 2>/dev/null || [[ -f /etc/systemd/system/pulse-docker-agent.service ]]; then
         log_warn "Removing legacy pulse-docker-agent..."
         systemctl stop pulse-docker-agent 2>/dev/null || true
         systemctl disable pulse-docker-agent 2>/dev/null || true
@@ -390,6 +412,10 @@ if [[ "$OS" == "darwin" ]]; then
         PLIST_ARGS="${PLIST_ARGS}
         <string>--enable-docker</string>"
     fi
+    if [[ "$ENABLE_KUBERNETES" == "true" ]]; then
+        PLIST_ARGS="${PLIST_ARGS}
+        <string>--enable-kubernetes</string>"
+    fi
     if [[ "$INSECURE" == "true" ]]; then
         PLIST_ARGS="${PLIST_ARGS}
         <string>--insecure</string>"
@@ -678,6 +704,7 @@ PULSE_TOKEN=${PULSE_TOKEN}
 PULSE_INTERVAL=${INTERVAL}
 PULSE_ENABLE_HOST=${ENABLE_HOST}
 PULSE_ENABLE_DOCKER=${ENABLE_DOCKER}
+PULSE_ENABLE_KUBERNETES=${ENABLE_KUBERNETES}
 EOF
     chmod 600 "$TRUENAS_ENV_FILE"
 
diff --git a/scripts/lib/common.sh b/scripts/lib/common.sh
old mode 100644
new mode 100755
diff --git a/scripts/lib/http.sh b/scripts/lib/http.sh
old mode 100644
new mode 100755
diff --git a/scripts/lib/systemd.sh b/scripts/lib/systemd.sh
old mode 100644
new mode 100755
diff --git a/scripts/migrate-sensor-proxy-control-plane.sh b/scripts/migrate-sensor-proxy-control-plane.sh
old mode 100644
new mode 100755
diff --git a/scripts/migrate-temperature-proxy.sh b/scripts/migrate-temperature-proxy.sh
old mode 100644
new mode 100755
diff --git a/scripts/sync-production-config.sh b/scripts/sync-production-config.sh
index 8e7dc48..4c6cd52 100755
--- a/scripts/sync-production-config.sh
+++ b/scripts/sync-production-config.sh
@@ -22,6 +22,29 @@ echo ""
 HAVE_PROD_KEY=false
 
 # CRITICAL: Always sync production encryption key to dev when it exists
+# First, check if the key is missing but a backup exists - auto-restore it
+if [ ! -f "$PROD_DIR/.encryption.key" ]; then
+    # Look for backup keys in production directory
+    BACKUP_KEY=$(find "$PROD_DIR" -maxdepth 1 -name '.encryption.key.bak*' -type f 2>/dev/null | head -1)
+    if [ -n "$BACKUP_KEY" ] && [ -f "$BACKUP_KEY" ]; then
+        echo ""
+        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+        echo "!! ENCRYPTION KEY WAS MISSING - AUTO-RESTORING FROM BACKUP !!"
+        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+        echo "!! Backup used: $BACKUP_KEY"
+        echo "!! "
+        echo "!! To find out what deleted the key, run:"
+        echo "!!   sudo journalctl -u encryption-key-watcher -n 100"
+        echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+        echo ""
+        cp -f "$BACKUP_KEY" "$PROD_DIR/.encryption.key"
+        chmod 600 "$PROD_DIR/.encryption.key"
+        # Ensure proper ownership (may need root, so try but don't fail)
+        chown pulse:pulse "$PROD_DIR/.encryption.key" 2>/dev/null || true
+        echo "✓ Restored encryption key from backup"
+    fi
+fi
+
 if [ -f "$PROD_DIR/.encryption.key" ]; then
     if [ ! -f "$DEV_DIR/.encryption.key" ]; then
         cp -f "$PROD_DIR/.encryption.key" "$DEV_DIR/.encryption.key"
diff --git a/scripts/watch-encryption-key.sh b/scripts/watch-encryption-key.sh
new file mode 100755
index 0000000..ac71757
--- /dev/null
+++ b/scripts/watch-encryption-key.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# Watch the encryption key file for any modifications or deletions
+# Logs to journald with full context about what process did it
+
+LOG_TAG="encryption-key-watcher"
+WATCH_DIR="/etc/pulse"
+WATCH_FILE=".encryption.key"
+
+log_event() {
+    local event="$1"
+    local file="$2"
+    
+    # Get current process info
+    echo "[$LOG_TAG] EVENT: $event on $file at $(date '+%Y-%m-%d %H:%M:%S')"
+    
+    # Try to capture what processes are accessing /etc/pulse
+    echo "[$LOG_TAG] Processes with open files in /etc/pulse:"
+    lsof +D /etc/pulse 2>/dev/null | head -20 || echo "  (lsof failed)"
+    
+    # Log the current state of the file
+    if [[ -f "$WATCH_DIR/$WATCH_FILE" ]]; then
+        echo "[$LOG_TAG] File still exists: $(ls -la "$WATCH_DIR/$WATCH_FILE")"
+    else
+        echo "[$LOG_TAG] *** FILE IS MISSING! ***"
+        echo "[$LOG_TAG] Contents of $WATCH_DIR:"
+        ls -la "$WATCH_DIR" | grep -i enc
+    fi
+    
+    # Log recent sudo commands
+    echo "[$LOG_TAG] Recent sudo activity:"
+    journalctl -u sudo --since "2 minutes ago" --no-pager 2>/dev/null | tail -10 || true
+}
+
+echo "[$LOG_TAG] Starting encryption key watcher..."
+echo "[$LOG_TAG] Monitoring: $WATCH_DIR/$WATCH_FILE"
+
+# Watch for all relevant events on the directory
+inotifywait -m -e delete,move,modify,attrib,create "$WATCH_DIR" --format '%e %f' 2>/dev/null | while read event file; do
+    # Only log events related to encryption key
+    if [[ "$file" == ".encryption.key"* ]]; then
+        log_event "$event" "$file"
+    fi
+done