feat: node-scoped Networking operator page (#1603)

* feat: add node-scoped Networking operator page

Adds a Networking view with overview, topology, inventory, and findings.

Shared aggregate reads back the page; Resources keeps prune and redirects here.

Includes fail-closed network delete guards, operator docs, and /nodes/:slug/networking routing.

* fix: rename unused variable n to _n to satisfy no-unused-vars lint

* fix: keep top bar search clickable when nav grows

* feat: complete Compose-first Networking Phase 2 operator assistant

* fix: move networking action visibility helper out of component module

* feat(networking): complete Compose-first Networking operator page

Finish the node-scoped Networking page (Overview, Networks, Topology,
Findings) with design-system parity and correct finding semantics.

- Rebuild detail sheets on SystemSheet/SheetSection; align the tab band,
  masthead, and mobile tone with Fleet and Security.
- Encode the host-mode and exposure severity matrix; fix collision counts
  so intentional shared externals are not flagged; add one typed drift
  predicate shared by inventory, topology, badges, and overview counts.
- Preserve per-container attachments and IPs on topology node clicks;
  drawer-only click with an explicit logs action; ownership and boolean
  filters; bound large graphs before layout.
- Aggregate cached Compose Doctor findings into the Findings tab with
  honest source labels, structural merge and dedupe, staleness
  reconciliation, and a shared exposure-context helper both engines use.
- Networks tab: privacy-safe service search, precise ownership counts,
  schema v3 with version-2 adapters on every endpoint, pre-confirm delete
  reasons, and the shared sortable table with an internal scroll region.
- Interop: Fleet node-card networking signal with pending-intent
  navigation, stack-to-node backlink, and Dossier/Drift deep links.
- Enrich sanitized inspect with an allowlisted connected-container list;
  fetch topology once and filter client-side.
- Docs and tests across every new finding kind, adapter, and flow.

* fix(networking): correct drift count, exposure fail-soft, and inspect crash paths

Address code-review findings on the Networking page implementation:
- Fix the Overview drift count to use the shared drift-kind predicate instead
  of a hardcoded list that omitted external-network-missing.
- Gate Compose Doctor's unclassified-exposure and reverse-proxy-undocumented
  rules on exposure-context availability, so a DB read failure no longer
  fabricates findings (mirrors the live engine's existing fail-soft behavior).
- Guard the per-stack exposure-intent read in topology aggregation so a
  transient DB failure degrades to unknown intent instead of failing the
  whole response.
- Harden the network detail drawer against a partial inspect payload from an
  older remote node, and log the real error instead of a bare catch.
- Remove now-duplicated severity-rank and drift-kind helpers in favor of the
  shared modules; drop dead backend-only exports; widen the frontend schema
  version type to a plain number instead of casting past a literal type.
- Add coverage for the delete-guard precedence, the full host-mode severity
  matrix, the schema-2 compatibility adapter, and the sanitized connected-
  container allowlist; tighten two tests that were not exercising the
  behavior they claimed to.

* fix: add missing onOpenNodeNetworking prop to FleetView experimental test

The added required prop on FleetViewProps broke the merge-build when the
test file (on main but not on this branch) was compiled against the
updated FleetView interface.

docs/docs.json

@@ -102,6 +102,7 @@
                   "features/editor",
                   "features/stack-file-explorer",
                   "features/resources",
+                  "features/networking",
                   "features/dashboard",
                   "features/app-store",
                   "features/global-search",

docs/features/compose-doctor.mdx

@@ -165,6 +165,10 @@ To resolve exposure-related findings:
 
 Once an intent and access URLs are set, Sencho can detect when the configuration contradicts the documented intent, making future runs more precise.
 
+## Networking-relevant findings on the Networking page
+
+The networking-relevant rules on this page (host mode, exposure intent, port conflicts, and the exposure-intent checks above) also surface on the node-wide [Networking](/features/networking) page's Findings tab, using the result of your last run here. A finding both engines detect is merged into one card; a finding only these Doctor rules catch appears there labeled with the run's timestamp. Acknowledging a finding here also excludes it from the Networking page.
+
 ## Node-state checks and graceful degradation
 
 Six of the 30 rules require live Docker state to run: five are in the Node state category (external networks and volumes, new-resource notices, and container_name collision) and one is "Host port is already in use" in Port conflicts. All six are skipped when the Docker daemon is unreachable.

docs/features/compose-networking.mdx

@@ -171,6 +171,8 @@ When Compose Doctor is available on the active node, a prompt at the bottom of t
 
 See [Compose Doctor](/features/compose-doctor) for the complete check set and severity levels.
 
+A **View node networking** link near the bottom of the tab opens the node-wide [Networking](/features/networking) page, for when you want to see this stack's networks in the context of every other stack sharing them.
+
 ## Creating networks
 
 <Frame>
@@ -180,7 +182,7 @@ See [Compose Doctor](/features/compose-doctor) for the complete check set and se
   />
 </Frame>
 
-Admins can create a new Docker network directly from the Networking tab using the **create network** button in the panel header. This is the same action available from the Resources Hub Networks tab.
+Admins can create a new Docker network from the stack **Networking** tab or from the node [Networking](/features/networking) operator page using the **create network** button in the panel header.
 
 | Field | Required | Description |
 |-------|----------|-------------|
@@ -199,7 +201,7 @@ After the network is created, the Networking tab refreshes automatically. The ne
 
 ## Limitations
 
-- **No modify or delete.** Sencho can create networks (via the create network dialog) but never modifies or deletes existing networks from this tab. Cleanup is handled by `docker compose down` or the Resources Hub prune actions.
+- **No modify or delete from the stack tab.** Sencho can create networks (via the create network dialog on the stack tab or the operator Networking page) but never modifies or deletes existing networks from the stack tab. Cleanup is handled by `docker compose down`, the operator [Networking](/features/networking) page for inventory, or Resources prune actions.
 - **Structural fields only.** Environment variable values and label values are never returned. Secrets interpolated into structural fields (network `name:`, ports, `extra_hosts`) are resolved and do appear.
 - **Runtime drift requires Docker reachability.** When the node is not reachable, the tab shows the declared model but cannot compare against the live state.
 - **Capability-gated tab.** The Networking tab only appears when the active node reports that it supports Compose Networking. Older nodes hide the tab until they are updated.

docs/features/deep-links.mdx

@@ -17,6 +17,7 @@ Sencho encodes the active node, the view you are on, and the deep state that vie
 | Compose editor | `/nodes/local/stacks/radarr/compose` | Radarr's compose.yaml Monaco editor |
 | Env tab + file | `/nodes/local/stacks/radarr/env?env=.env.prod` | Radarr's env tab with a specific env file selected |
 | Resources | `/nodes/local/resources` | Resources for the active node |
+| Networking | `/nodes/local/networking` | Networking operator page for the active node |
 | Security tab | `/nodes/local/security/images` | Security view on the Images tab |
 | Settings section | `/nodes/local/settings/nodes` | Settings on the Nodes section |
 | Fleet tab | `/nodes/local/fleet/snapshots` | Fleet on the Snapshots tab (desktop) |
@@ -81,7 +82,7 @@ On a phone, `/nodes/local/stacks/<stack>/files` opens the compose editor instead
 
 Some in-app state is intentionally not encoded:
 
-- **Stack Anatomy sub-tabs** (Anatomy, Activity, Dossier, Drift, Environment, and the rest) stay in memory only. Refresh returns you to the default Anatomy tab for that stack.
+- **Stack Anatomy sub-tabs** (Anatomy, Activity, Dossier, Drift, Environment, and the rest) stay in memory only. Refresh returns you to the default Anatomy tab for that stack. A [Networking](/features/networking) finding's action can open a stack directly on its Doctor, Dossier, or Drift tab; this is in-app navigation, not a separate URL, so the same refresh behavior applies.
 
 ## Tips
 

docs/features/global-search.mdx

@@ -6,7 +6,7 @@ description: Jump to any page, node, or stack from anywhere in the app with a si
 The **global search palette** lets you move around Sencho without reaching for the mouse. It covers the destinations the top bar exposes for your tier and role, every configured node, and every stack on every online node in your fleet.
 
 <Frame>
-  <img src="/images/global-search/palette-pages.png" alt="Sencho global search palette open with no query, the Pages group listing Home, Fleet, Resources, App Store, Logs, and Auto-Update each with a leading icon." />
+  <img src="/images/global-search/palette-pages.png" alt="Sencho global search palette open with no query, the Pages group listing Home, Fleet, Resources, Networking, App Store, Logs, and Auto-Update each with a leading icon." />
 </Frame>
 
 ## Opening the palette
@@ -25,7 +25,7 @@ The palette groups results into three sections.
 
 | Group | What it contains | What happens when you pick one |
 |-------|------------------|--------------------------------|
-| **Pages** | The same set of destinations the top bar shows you. Home, Fleet, Resources, App Store, and Logs always appear; Update and Schedules appear for admins; Console appears for admins when that limited-availability surface is present; Audit appears on Admiral for roles with the audit permission (the full Audit view, statistics, export, anomalies, and extended retention). Community keeps a rolling 14-day recent-activity audit API window without the Audit view in navigation. | Navigates to that page |
+| **Pages** | The same set of destinations the top bar shows you. Home, Fleet, Resources, Networking, App Store, and Logs always appear; Update and Schedules appear for admins; Console appears for admins when that limited-availability surface is present; Audit appears on Admiral for roles with the audit permission (the full Audit view, statistics, export, anomalies, and extended retention). Community keeps a rolling 14-day recent-activity audit API window without the Audit view in navigation. | Navigates to that page |
 | **Nodes** | Every node in your fleet, with a green dot for online and a grey dot for offline. The currently active node carries a small **ACTIVE** chip on the right. | Switches the active node without leaving the current page |
 | **Stacks** | Every compose stack on every online node, matched on the compose filename (extension included). | Switches to the stack's node and opens it in the editor |
 

docs/features/multi-node.mdx

@@ -154,7 +154,7 @@ Top-level views that manage fleet-wide state are scoped to the local hub and are
 | **Logs** | Aggregates logs across the fleet. |
 | **Auto-Update** | Compares image versions across all nodes in your fleet. |
 
-Node-level views (Home, Resources, App Store, Console, the editor) work as expected against whichever node you have selected.
+Node-level views (Home, Resources, Networking, App Store, Console, the editor) work as expected against whichever node you have selected.
 
 ## The Nodes table
 

docs/features/networking.mdx

@@ -0,0 +1,79 @@
+---
+title: Networking
+description: Node-scoped Compose network inventory, topology, inspect, and findings on a dedicated operator page.
+---
+
+The **Networking** page is a first-class operator view for the active node. It answers how Docker networks on that node relate to your Sencho stacks: what exists, what is connected, where Compose intent and runtime disagree, and which issues deserve attention next.
+
+This page is distinct from the stack editor **Networking** tab, which stays stack-scoped and models one deployment at a time. Use the operator page for node-wide inventory and hygiene; use the stack tab when you are editing or validating a single stack's compose model. See [Compose Networking](/features/compose-networking) for the stack tab.
+
+Networking follows whichever node is selected in the top bar. Remote nodes load through the same distributed API proxy as other node views.
+
+## Overview
+
+The overview masthead summarizes the node at a glance and derives its posture from findings: action needed, review, contained, partial networking data, or runtime unavailable. Stat cards break down network counts by ownership (Sencho-managed, external dependency, system) alongside exposed stacks, unknown exposure, missing externals, and name collisions; each links to the relevant inventory or findings view.
+
+The **operator attention** list ranks the top findings needing review, with a one-click primary action per row and a link to the full Findings tab. Three Compose-first sections round out the page: external network dependencies, networks shared across stacks, and services publishing without a classified exposure intent. The activity band below shows recent node-wide stack work, linked back to the owning stack.
+
+Use **Refresh** to re-fetch live Docker state and Compose facts in one pass.
+
+## Topology
+
+The **Topology** tab reuses Sencho's interactive network graph: networks on top, containers below, animated edges, pan and zoom, and a mini-map.
+
+- **Network nodes** show the network name and driver, color-coded by managed, external, or system status.
+- **Container nodes** show the container name, state, stack badge, image, and IPv4 on each attachment.
+- **Click-to-logs** on a running container opens its log stream.
+- **Show system networks** toggles `bridge`, `host`, and `none` into the graph when you need to debug default-bridge attachments.
+
+Data comes from `GET /api/networking/topology` on the active node. Missing external dependencies appear as a distinct graph node when Docker is available. These synthetic nodes cannot be inspected or deleted, but link back to the declaring stack.
+
+## Networks
+
+The **Networks** tab distinguishes runtime ownership from Compose dependency intent. Ownership identifies system, Sencho-managed, Compose-managed, or unmanaged networks. An external dependency is a separate signal: a network can be owned by a stack and still be declared as external by another stack. Filter chips cover managed, external dependencies, system, shared, exposed, and drift signals.
+
+Click the eye icon on a row to open the detail drawer. Inspect is sanitized: structural fields and label **keys** only, never secret values interpolated into names or options.
+
+### Create network
+
+Admins can open **Create network** from the page header. The dialog matches the fields documented in [Compose Networking → Creating networks](/features/compose-networking#creating-networks). Creating a network here does not attach it to a stack; add it to the Compose file with `external: true` and redeploy when you are ready to use it.
+
+## Findings
+
+The **Findings** tab lists Compose-first networking issues Sencho derives from the effective model plus one live Docker snapshot per refresh, grouped into **Needs action**, **Review recommended**, and **Informational**. Examples include missing external networks, duplicate network names across stacks, host-network exposure mismatches, and stacks whose model could not be rendered.
+
+Findings also fold in the networking-relevant results from your last Compose Doctor run on each stack. A finding both engines detect shows **Live · also found by Doctor**; a finding only Doctor caught (Doctor checks a few things the live engine does not, such as host port conflicts) shows **Last Doctor run** with the timestamp of that run. Doctor's contribution is always the cached result of the last run on that stack, not a fresh check, so run Doctor again on a stack if you want its findings current. An active acknowledgement on a Doctor finding excludes it here too.
+
+Each finding includes a severity, evidence, and the actions that are appropriate for the current operator. Depending on permissions and the finding, this can open the affected stack, its Networking, Doctor, Dossier, or Drift tab, filter topology, inspect a network, create a missing network, copy a safe Compose snippet, or refresh the data.
+
+## Resources and cleanup
+
+Day-to-day network cleanup stays on [Resources](/features/resources): **Quick Clean → Prune Dead Networks** removes unused networks that are safe to prune under the scope you choose. The Resources page also links here when you need the full inventory or topology view.
+
+## Deep links and search
+
+- URL: `/nodes/local/networking` for the default local node (remote nodes use their stable slug).
+- Global search (`Ctrl+K` / `Cmd+K`) lists **Networking** under **Pages** alongside Home, Resources, and the other top-level views.
+
+## Troubleshooting
+
+<AccordionGroup>
+  <Accordion title="The Networking page says it is not available on this node">
+    The node must expose the Compose Networking capability. Older remote agents that have not been updated show a lock card instead of the operator page. Update the node to the current Sencho version and try again.
+  </Accordion>
+  <Accordion title="I expected network list or topology under Resources">
+    Network inventory, topology, inspect, and findings moved to this page. Resources still handles images, volumes, unmanaged containers, reclaim, and **Prune Dead Networks**. Pick **Networking** from the top navigation to find them.
+  </Accordion>
+  <Accordion title="Findings mention a stack that failed to render">
+    Sencho compares live Docker state against each stack's effective Compose model. When `docker compose config` fails for a stack, that stack is listed under render failures on the overview and related findings may be incomplete until the Compose file is fixed.
+  </Accordion>
+  <Accordion title="The overview says runtime unavailable">
+    Sencho could not reach Docker on this node. Compose-model findings remain visible, while runtime-only inventory, drift, missing external checks, and inspect are unavailable until Docker responds again.
+  </Accordion>
+  <Accordion title="The overview says partial networking data">
+    The selected remote node supports the earlier networking response format. Inventory fields may be available, but Sencho does not infer a healthy posture or show enriched finding actions. Update that node to use the complete operator view.
+  </Accordion>
+  <Accordion title="A network is marked as an external dependency">
+    This means one or more Compose stacks expect the network to exist before deployment. It does not imply that the network is unmanaged. Review the ownership and declaring stacks together before changing or deleting it.
+  </Accordion>
+</AccordionGroup>

docs/features/overview.mdx

@@ -29,7 +29,11 @@ Browse, preview, and download files inside a stack's directory from the dashboar
 
 ### Resources hub
 
-View and manage Docker images, volumes, networks, and unmanaged containers. Resources are classified as Managed, External, or Unused / Reclaimable, so cleanup decisions are visible before you prune. [Learn more →](/features/resources)
+View and manage Docker images, volumes, and unmanaged containers. Resources are classified as Managed, External, or Unused / Reclaimable, so cleanup decisions are visible before you prune. Network inventory and topology live on the Networking page; Resources keeps Quick Clean prune for dead networks. [Learn more →](/features/resources)
+
+### Networking
+
+Browse node-wide Docker network inventory, topology, inspect, and Compose-first findings on a dedicated operator page. Distinct from the stack editor Networking tab, which stays scoped to one deployment. [Learn more →](/features/networking)
 
 ### Dashboard
 

docs/features/resources.mdx

@@ -1,9 +1,9 @@
 ---
 title: Resources Hub
-description: Browse, filter, scan, and clean up Docker images, volumes, networks, and unmanaged containers from a single view.
+description: Browse, filter, scan, and clean up Docker images, volumes, and unmanaged containers from a single view.
 ---
 
-The **Resources** tab shows everything Docker is storing on your host, broken down by ownership, with one-click cleanup, on-demand vulnerability scanning, and a topology view of how your containers connect.
+The **Resources** tab shows everything Docker is storing on your host, broken down by ownership, with one-click cleanup and on-demand vulnerability scanning.
 
 <Frame>
   <img src="/images/resources/resources-reclaim.png" alt="Resources Hub with the You can reclaim banner, Docker Disk Footprint treemap, Quick Clean panel, and the Images tab populated below" />
@@ -56,7 +56,9 @@ A confirmation dialog appears before any destructive prune. Sencho first builds
 
 ## Resource tabs
 
-Below the hero, four tabs partition your inventory: **images**, **volumes**, **networks**, and **Unmanaged**. The Unmanaged tab shows a count badge whenever orphan containers are detected.
+Below the hero, three tabs partition your inventory: **images**, **volumes**, and **Unmanaged**. The Unmanaged tab shows a count badge whenever orphan containers are detected.
+
+Network inventory, topology, inspect, and findings live on the dedicated [Networking](/features/networking) page. **Quick Clean** still includes **Prune Dead Networks**.
 
 A **Scan history** button sits on the right of the tab strip when image vulnerability scanning is configured for the node. It takes you to the [Security page](/features/security) History tab so you can review past results without launching a new scan. See [Vulnerability scanning](/features/vulnerability-scanning) for the full workflow.
 
@@ -126,77 +128,6 @@ Click the folder icon on any volume row (admin-only) to open a read-only browser
   Volumes commonly contain database files, password hashes, certificates, and other secrets. Treat the volume browser as a high-power admin tool.
 </Warning>
 
-### Networks
-
-<Frame>
-  <img src="/images/networks/networks-list.png" alt="Networks tab in List view with filter chips, view-mode toggle, Create Network button, and the network table" />
-</Frame>
-
-Lists all Docker networks with ID, name, driver, scope (`local`, `global`, `swarm`), and managed status. System networks (`bridge`, `host`, `none`) are shown but cannot be deleted.
-
-**Filter chips:** `All`, `Managed`, `External`, each with its count.
-
-A **List | Topology** view-mode toggle sits on the right of the toolbar. **List** is the default tabular view; **Topology** is a graph view of how containers connect to networks (covered below).
-
-#### Create Network
-
-In **List** view, the **+ Create Network** button (admin-only) opens the creation dialog.
-
-<Frame>
-  <img src="/images/networks/create-network.png" alt="Create network dialog with Name, Driver, Subnet, Gateway fields, and Internal and Attachable toggles" />
-</Frame>
-
-| Field | Required | Description |
-|-------|----------|-------------|
-| **Name** | Yes | Alphanumeric, hyphens, underscores, and dots |
-| **Driver** | No | `bridge` (default), `overlay`, `macvlan`, `host`, or `none` |
-| **Subnet** | No | CIDR notation, for example `172.20.0.0/16` |
-| **Gateway** | No | Gateway IP, for example `172.20.0.1` |
-| **Internal** | No | Isolates the network from external access |
-| **Attachable** | No | Allows containers to be manually attached |
-
-The footer shows a **DRIVER** chip that mirrors the selected driver, and a **Create network** button that stays disabled until the form is valid.
-
-#### Inspect network
-
-Click the eye icon on any network row to open a detail sheet.
-
-<Frame>
-  <img src="/images/networks/network-inspect.png" alt="Network inspect sheet for arr-net showing the Overview, IPAM configuration, and Connected containers sections" />
-</Frame>
-
-The sheet is grouped into sections:
-
-- **Overview** lists the ID, driver, scope, creation date, and the internal/attachable flags.
-- **IPAM configuration** shows the subnet, gateway, and IP range for each configured address pool.
-- **Options** lists driver-specific options applied to the network (rendered only when present).
-- **Connected** shows every container attached to the network, with its name, IPv4 address, and MAC address. The section header counts the containers.
-- **Labels** lists all Docker labels on the network (rendered only when present).
-
-#### Network topology
-
-Switch to the **Topology** view to see an interactive graph of your Docker networks and the containers attached to them. The graph uses an automatic hierarchical layout (networks on top, containers below) that scales cleanly regardless of how many networks and containers you have.
-
-<Frame>
-  <img src="/images/networks/network-topology.png" alt="Network topology graph with arr-net at top and the connected containers fanned out below it, mini-map and zoom controls visible" />
-</Frame>
-
-- **Network nodes** are dashed-border cards showing the network name and driver, color-coded by status (managed, external, system).
-- **Container nodes** are cards showing the container name, a state indicator, the stack badge, the image name, and the IPv4 address per network.
-- **Edges** are animated, color-coded connections between networks and their containers.
-- **Click-to-logs.** Click any running container node to open its log viewer directly.
-- **Refresh.** Use the refresh button in the toolbar to re-fetch the topology on demand.
-- Pan, zoom, and drag nodes to explore the graph.
-- A **mini-map** in the bottom-right gives an overview of the full graph. Zoom and fit-view controls sit on the bottom-left.
-
-##### Show system networks
-
-By default, system networks (`bridge`, `host`, `none`) are hidden so the graph stays focused on user networks. Toggle **Show system networks** to include them, which is useful for debugging containers attached to the default bridge.
-
-<Frame>
-  <img src="/images/networks/network-topology-toggle.png" alt="Topology with Show system networks toggled on; arr-net plus the bridge, none, and host system networks all visible at the top" />
-</Frame>
-
 ### Unmanaged
 
 <Frame>