timeline: includeManaged source parity + delta/deep-link contract tests

[nadaverell]

Follow-ups from the #1111 review that were deferred at merge, now done.

includeManaged parity (TimelineSource substitutability)

A consumer passing includeManaged: false got server-side filtering in local mode but nothing in retained mode — the retained endpoint has no include_managed param, and the local path's 'all' preset re-includes managed rows anyway, so the flag's behavior depended on the source. applyClientFilters now enforces it uniformly for both sources, mirroring the Go store's IsManaged predicate (owned, or ReplicaSet/Pod/Event). Default (unset) keeps machinery rows — the swimlane's pod/RS child lanes need them — so Radar's own UI behavior is unchanged, and no Radar Hub change is needed.

Contract tests

• Store conformance suite (internal/timeline/store_conformance_test.go): one suite run against both EventStore implementations, pinning the Seq/delta contract — strictly increasing arrival numbers, oldest-first delta pages that resume a burst beyond the page limit losslessly, relist dupes never re-delivered, K8s-event count bumps re-arriving at the frontier exactly once. The two stores enforce this with unrelated mechanisms; a violation is silent client-side event loss.
• Delta-sync client orchestration (client.deltaSync.test.ts): the useChanges queryFn body is extracted verbatim into runDeltaSyncFetch (state passed explicitly; behavior identical) and tested at the fetch boundary — cursor priming from headers, merge-by-id, empty-but-headered delta advancing the cursor, cached-reference return on empty delta, epoch-reset full resync, and the full+deltas ≡ fresh-full equivalence.
• Deep-link contract (TimelineView.urlparams.test.ts): parseTimeMode / writeTimelineParams / onlyHighFreqDiffer / timeModeEqual exported as test seams and round-trip tested — including maxRangeDays capping of hand-typed ?from&to and the replace-vs-push rule that keeps window pans from flooding history (pinning the back/forward-loop fix).

Verification

• Go: full sweep green in both modules, conformance suite passes against MemoryStore and SQLiteStore
• make tsc clean · web vitest 69/69 (31 new) · k8s-ui vitest 1152/1152
• No runtime behavior change outside the includeManaged: false path (which nothing in Radar's UI sets today)

---

Note

Low Risk
Primary product change is client-side includeManaged: false parity, which the PR states Radar UI does not use today; the rest is test refactors and exports with behavior-preserving extraction of delta sync.

Overview
includeManaged: false now behaves the same for local and retained timeline sources. Client-side filtering in applyClientFilters mirrors Go TimelineEvent.IsManaged (owned resources plus ReplicaSet/Pod/Event kinds). Unset/default still keeps machinery rows for swimlanes; only an explicit false strips them.

EventStore seq/delta behavior is centralized in pkg/timeline/storetest. Duplicate informer-ID, K8s bump upsert, stale bump, enrichment preservation, and delta paging tests are removed from per-store SQLite/memory test files and run once via RunConformance for both MemoryStore and SQLiteStore.

useChanges delta orchestration is testable without React. The queryFn logic moves into exported runDeltaSyncFetch with explicit meta/cache/now; client.deltaSync.test.ts covers cursor priming from headers, merge-by-id, empty deltas advancing the cursor, cached reference on no-op deltas, epoch-mismatch full resync, and incremental vs fresh-full equivalence.

Timeline deep-link URL helpers are exported and covered (parseTimeMode, writeTimelineParams, onlyHighFreqDiffer, timeModeEqual) in TimelineView.urlparams.test.ts for round-trips, retention caps, and replace-vs-push history rules.

^{Reviewed by Cursor Bugbot for commit b714938. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a68d7f7. Configure here.}