@@ -53,6 +53,7 @@ import { DiagnosticsOverlay } from './components/ui/DiagnosticsOverlay'
 import { useEventSource } from './hooks/useEventSource'
 import { debugNamespaceLog, useNamespaces, useNamespaceScope, useSetActiveNamespace, useSwitchContext, useAuthMe, useAudit } from './api/client'
 import { buildAuditSeverityMap } from './utils/auditBadges'
+import { isInNamespaceScope, scopeNodesToNamespaces } from './utils/topology-namespace'
 import { routePath, apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from './api/config'
 import { KeyboardShortcutProvider, useRegisterShortcut, useRegisterShortcuts, useSuppressBaseShortcuts } from './hooks/useKeyboardShortcuts'
 import { useAnimatedUnmount } from './hooks/useAnimatedUnmount'
@@ -1604,8 +1605,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     // Filter by namespace (client-side) and by visible kinds
     const nsSet = namespaces.length > 0 ? new Set(namespaces) : null
     const filteredNodes = displayedTopology.nodes.filter(node =>
-      effectiveKinds.has(node.kind) &&
-      (!nsSet || nsSet.has(node.data.namespace as string) || !(node.data.namespace as string))
+      effectiveKinds.has(node.kind) && isInNamespaceScope(node, nsSet)
     )
     const filteredNodeIds = new Set(filteredNodes.map(n => n.id))
 
@@ -1630,6 +1630,16 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     }
   }, [displayedTopology, visibleKinds, namespaces, topologyMode])
 
+  // Namespace-scoped but NOT kind-filtered: the sidebar derives its kind list
+  // and visible/hidden footer counts from this prop, so handing it the
+  // kind-filtered graph nodes would drop every hidden kind from the list and
+  // "hidden" would always read zero. Reads displayedTopology so the counts
+  // freeze with the graph while paused.
+  const filterSidebarNodes = useMemo(() => {
+    if (!displayedTopology) return []
+    return scopeNodesToNamespaces(displayedTopology.nodes, namespaces)
+  }, [displayedTopology, namespaces])
+
   // Cluster Audit findings, joined onto topology nodes by the audit key the
   // backend stamps on each node (data.auditKey). Only badge-worthy findings
   // reach the graph; the raw auditDanger/auditWarning property names remain at
@@ -2182,14 +2192,14 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
               <>
                 {/* Filter sidebar */}
                 <TopologyFilterSidebar
-                  nodes={topology?.nodes || []}
+                  nodes={filterSidebarNodes}
                   visibleKinds={visibleKinds}
                   onToggleKind={handleToggleKind}
                   onShowAll={handleShowAllKinds}
                   onHideAll={handleHideAllKinds}
                   collapsed={filterSidebarCollapsed}
                   onToggleCollapse={() => setFilterSidebarCollapsed(prev => !prev)}
-                  hiddenKinds={topology?.hiddenKinds}
+                  hiddenKinds={displayedTopology?.hiddenKinds}
                   onEnableHiddenKind={(kind) => {
                     setVisibleKinds(prev => new Set(prev).add(kind as NodeKind))
                     console.log(`[topology] User requested to show hidden kind: ${kind}`)
 
@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import type { TopologyNode } from '@skyhook-io/k8s-ui/types/core'
+import { isInNamespaceScope, scopeNodesToNamespaces } from './topology-namespace'
+
+function node(id: string, kind: string, namespace?: string): TopologyNode {
+  return {
+    id,
+    kind,
+    name: id,
+    status: 'healthy',
+    data: namespace === undefined ? {} : { namespace },
+  } as TopologyNode
+}
+
+const nodes = [
+  node('web', 'Deployment', 'prod'),
+  node('ing', 'Ingress', 'staging'),
+  node('db', 'StatefulSet', 'prod'),
+  node('node-1', 'Node'),          // cluster-scoped
+  node('pv-1', 'PersistentVolume'), // cluster-scoped
+]
+
+describe('scopeNodesToNamespaces', () => {
+  it('returns every node when no namespace is selected', () => {
+    expect(scopeNodesToNamespaces(nodes, [])).toHaveLength(5)
+  })
+
+  it('keeps only the selected namespace, plus cluster-scoped nodes', () => {
+    const scoped = scopeNodesToNamespaces(nodes, ['prod'])
+    expect(scoped.map(n => n.id)).toEqual(['web', 'db', 'node-1', 'pv-1'])
+  })
+
+  it('drops a kind that exists only outside the scope', () => {
+    const scoped = scopeNodesToNamespaces(nodes, ['prod'])
+    expect(scoped.some(n => n.kind === 'Ingress')).toBe(false)
+  })
+
+  it('accepts several namespaces at once', () => {
+    const scoped = scopeNodesToNamespaces(nodes, ['prod', 'staging'])
+    expect(scoped).toHaveLength(5)
+  })
+
+  it('returns the same array identity when the scope is empty', () => {
+    expect(scopeNodesToNamespaces(nodes, [])).toBe(nodes)
+  })
+})
+
+describe('isInNamespaceScope', () => {
+  it('passes everything for a null scope', () => {
+    expect(isInNamespaceScope(node('x', 'Pod', 'any'), null)).toBe(true)
+  })
+
+  it('always passes a node with no namespace', () => {
+    expect(isInNamespaceScope(node('node-1', 'Node'), new Set(['prod']))).toBe(true)
+  })
+
+  it('treats an empty-string namespace as cluster-scoped', () => {
+    expect(isInNamespaceScope(node('n', 'Node', ''), new Set(['prod']))).toBe(true)
+  })
+
+  it('rejects a namespaced node outside the scope', () => {
+    expect(isInNamespaceScope(node('ing', 'Ingress', 'staging'), new Set(['prod']))).toBe(false)
+  })
+})
@@ -0,0 +1,18 @@
+import type { TopologyNode } from '@skyhook-io/k8s-ui/types/core'
+
+// A node with no namespace is cluster-scoped (Node, PersistentVolume,
+// Namespace, ...) and stays visible in every scope.
+export function isInNamespaceScope(node: TopologyNode, nsSet: Set<string> | null): boolean {
+  if (!nsSet) return true
+  const ns = node.data?.namespace as string | undefined
+  return !ns || nsSet.has(ns)
+}
+
+// Shared by the topology graph and the filter sidebar so the two cannot
+// disagree about which nodes are in scope. Namespace carve-out only — kind
+// filtering stays on the graph.
+export function scopeNodesToNamespaces(nodes: TopologyNode[], namespaces: string[]): TopologyNode[] {
+  if (namespaces.length === 0) return nodes
+  const nsSet = new Set(namespaces)
+  return nodes.filter(node => isInNamespaceScope(node, nsSet))
+}