@@ -88,6 +88,29 @@ shared renderers.
   or the generic pass reintroducing warnings for intentional states. Don't suppress
   a whole API group when only some kinds are covered.
 
+### Finalizer controller recognition
+
+Stuck-deletion detection covers already-watched, synchronized CRDs. Adding an
+owner enriches those findings; it needs no per-kind detector or renderer.
+
+- [ ] Add documented keys and controller names, labels and image paths in
+  [`pkg/finalizers/catalog.go`](../pkg/finalizers/catalog.go). Disambiguate shared
+  keys by API group/kind, and shared images or identities by role/image checks.
+  Name guesses for uncataloged finalizers remain candidates, never owners.
+- [ ] Review cleanup semantics before setting `AllowConditionalCleanup` (false
+  by default). Leave it disabled for unreviewed cleanup, off-cluster controllers
+  or infrastructure cleanup; record those limits on the entry.
+- [ ] Add identity fixtures in
+  [`pkg/finalizers/catalog_test.go`](../pkg/finalizers/catalog_test.go) and
+  guidance/eligibility cases in
+  [`internal/issues/finalizers_test.go`](../internal/issues/finalizers_test.go),
+  including unrelated workloads and incomplete visibility.
+- [ ] Keep reads and policy in `internal/issues/finalizers.go`, pod health in
+  `pkg/health`. Catalog additions should not change the shared API/UI machinery.
+- [ ] Verify a real stuck deletion, including intentional uninstall if enabling
+  removal. Update the [MCP contract](mcp.md#read-tools) when supported behavior
+  changes; distinguish controller evidence from synthetic fixtures.
+
 ### MCP / AI context
 
 - [ ] Check existing resource-tool output in `pkg/ai/context/summary_crd.go`,
 
@@ -90,7 +90,7 @@ Radar treats Terminating as a distinct lifecycle phase that dominates other stat
 - **Detail header**: orange `[Terminating]` chip replaces Sync/Health badges. Source / Revision / Last reconcile / Sync mode metadata swaps to `Pending deletion · Finalizers`, with the original fields behind a "Show pre-deletion metadata" toggle
 - **Action buttons**: Sync, Reconcile, Suspend / Resume, Rollback, Sync-with-source disable with a tooltip explaining why. Refresh and Terminate stay enabled — they're read-only / cleanup-only verbs
 - **Lifecycle banner**: a dedicated orange banner above the Issues band; pre-deletion failures collapse behind a `Pre-deletion issues (N)` disclosure
-- **Severity ramp**: info <5min, warning 5-30min, alert >30min. Past 30min the Issue's Cause line names the controller responsible for the finalizer and reports its pod state ("helm-controller is not running in flux-system")
+- **Severity ramp**: info <5min, warning 5-30min, alert >30min. Past 30min the Issue's Cause line names the controller responsible for the finalizer and reports its pod state ("helm-controller is not running in flux-system"). No matching pods in Argo CD’s conventional namespace is inconclusive: its controller may run elsewhere or outside the cluster (Amazon EKS Capabilities)
 - **Fleet view**: `—` in Sync/Health columns, orange row stripe, `[TERMINATING]` chip in the leftmost slot, `Pending Nago` instead of "Last Sync"
 - **Topology**: orange left-stripe on the root + children; stale sync/health chips suppressed
 - **Cluster Audit**: `stuckTerminating` check across all typed K8s resources with the same 5-minute/30-minute thresholds, presented as Medium/High posture priority
 
@@ -491,6 +491,55 @@ API group is part of a resource's identity. Radar infers the canonical group for
 
 This selects the Argo Rollout workload path; it does not imply that `diagnose` supports arbitrary custom resource shapes.
 
+Watched, synchronized custom resources that remain deleting appear in `issues`
+as `termination_stuck`, timed from the deletion request. Radar starts no new
+watches for this scan; an empty result does not establish that unwatched kinds
+are healthy. These findings also feed Active Issues and AI resource/search
+summaries, but not dashboard health summaries or `cluster://health`.
+
+Findings start at warning after 10 minutes. At 30 minutes, controller-owned
+finalizers follow this policy:
+
+| Controller evidence | Severity | Next step |
+|---|---|---|
+| Recognized controller is fully ready | Warning | Check logs, permissions and deletion-blocking dependencies. No removal. |
+| Recognized controller is installed but not fully ready | Critical | Repair the controller so it can resume cleanup. No removal. |
+| No recognized controller, or all recognized copies are scaled to zero | Warning | Restore it if it should be running. Removal may be offered conditionally. |
+| Owner or controller state cannot be established | Warning | Identify and check the controller. No removal. |
+
+A fully ready controller for any finalizer keeps a mixed-finalizer finding at
+warning; repair advice for other controllers remains. In-use guards and
+GC-only finalizers can reach critical at 30 minutes. Resolve their dependencies
+rather than removing them; orphaning preserves dependents.
+
+The catalog recognizes Argo CD, Flux, VictoriaMetrics and Karpenter through
+known finalizer keys and workload identities. Name-only guesses for uncataloged
+finalizers never establish ownership. Renamed installs and mirrors can be
+recognized through published images; controller-specific identity rules are in
+[`pkg/finalizers/catalog.go`](../pkg/finalizers/catalog.go).
+
+Ordinary namespaced subjects require namespace access; Secrets also require
+Secret access, and cluster-scoped subjects require list on their exact kind.
+Controller evidence follows namespace access for namespaced reads and exact-kind
+list for cluster-wide searches. A missing or down controller requires complete
+cluster-wide Pod, Deployment,
+StatefulSet and DaemonSet visibility. Incomplete inventory cannot enable removal.
+A negative search is not proof of an uninstall; a controller may run elsewhere
+or use an identity Radar does not recognize.
+
+Only Flux and VictoriaMetrics currently opt into `conditional_cleanup`, separate
+from `action`. It contains `condition`, `agent_guidance`, `caution`, and `removals`
+with one entry per finalizer (`finalizer`, `patch_resource`, `kubectl`). An agent
+may propose removal only after the user confirms intentional uninstall or a
+permanent stop. The UI keeps these commands in a collapsed conditional section.
+
+Each command defaults to a server dry run and tests the object's UID and the
+finalizer at its index. Review the preview before applying; re-read after every
+removal because indices change. Removal bypasses controller cleanup and can
+leave Kubernetes resources, infrastructure or storage behind. Dependents with
+their own finalizers can remain stuck even after the controller is restored;
+older VictoriaMetrics operators place such finalizers on managed objects.
+
 For `issues`, read `timing_summary` when present; it explains timing combinations that are easy to misread without schema context. The raw provenance fields remain available for filtering. `first_seen` is an evidence-backed lower bound, `onset_unknown` means no contributing signal has a known onset, and `resource_created_at` is resource-age context rather than issue age. A missing `first_seen` is exposed to CEL as `0`; require `first_seen != 0` for any age filter, and also require `onset_coverage_unknown == 0` when the whole row must have exact timing.
 
 Resource context distinguishes observed dependency references (`dependencies` and
 
@@ -18,6 +18,7 @@ import (
 // inject fakes without standing up an informer stack.
 type Provider interface {
 	DetectProblems(namespaces []string) []k8s.Detection
+	DetectDynamicTerminatingProblems(namespaces []string, canList func(group, resource, namespace string) bool) []k8s.Detection
 	DetectCAPIProblems(namespaces []string) []k8s.Detection
 	// DetectGitOpsProblems returns failing ArgoCD Applications and Flux
 	// Kustomizations/HelmReleases — the reconciler-health failure class the
@@ -141,6 +142,10 @@ func ComposeWithStats(p Provider, f Filters) ([]Issue, ComposeStats) {
 		}
 		return correlationAllowed
 	}
+	canList := func(group, resource, namespace string) bool {
+		return f.CanReadEvidence != nil && f.CanReadEvidence(EvidenceRead{Group: group, Resource: resource, Namespace: namespace, Verb: "list"})
+	}
+	finalizerObservations := map[string]finalizerObservation{}
 	emit := func(ps []k8s.Detection, source Source) {
 		for _, pr := range ps {
 			if pr.Severity == "info" {
@@ -155,17 +160,24 @@ func ComposeWithStats(p Provider, f Filters) ([]Issue, ComposeStats) {
 					pr.Cause, pr.Action = "", ""
 				}
 			}
+			if len(pr.TerminatingFinalizers) > 0 {
+				pr = enrichTerminatingProblem(pr, p, canList, finalizerObservations)
+			}
 			out = append(out, fromProblem(pr, now, source))
 		}
 	}
-	emit(p.DetectProblems(f.Namespaces), SourceProblem)       // hardcoded per-kind checks
+	emit(p.DetectProblems(f.Namespaces), SourceProblem) // hardcoded per-kind checks
+	if f.CanReadEvidence != nil {
+		emit(p.DetectDynamicTerminatingProblems(f.Namespaces, canList), SourceProblem)
+	}
 	emit(p.DetectCAPIProblems(f.Namespaces), SourceProblem)   // Cluster API
 	emit(p.DetectGitOpsProblems(f.Namespaces), SourceProblem) // Argo/Flux reconciler health
 	emit(p.DetectMissingRefs(f.Namespaces), SourceMissingRef) // dangling by-name refs
 	emit(p.DetectScheduling(f.Namespaces), SourceScheduling)  // placement/admission/post-bind
 	karpenterIssues, karpenterOwnedSubjects := detectKarpenterIssues(p, f)
 	out = append(out, karpenterIssues...)
 	out = append(out, detectGenericCRDIssues(p, f, karpenterOwnedSubjects)...) // generic CRD .status.conditions
+	out = foldDeletingConditions(out)
 	out = elevateAdmissionWebhookBackendSeverity(out, p)
 
 	// ---- 2. Evidence-level transforms (operate on flat rows) ---------