@intentius/chant-lexicon-k8s 0.31.0 → 0.32.0

package/src/kube/wait.ts

@@ -0,0 +1,160 @@
+/**
+ * `chant kube wait` (chant #1079) — the issue names this one explicitly:
+ * "`wait` should use the existing readiness-spec registry in
+ * `op/activities/wait-for-ready.ts`, which already handles the Argo case
+ * where health and sync replace a `Ready` condition — something `kubectl
+ * wait --for` cannot express without jsonpath gymnastics." This verb is a
+ * thin CLI shell around that exact registry (`readinessFor`/`isReady`/
+ * `firstTerminal`/`waitForReady`) — not a second implementation of it.
+ *
+ * `--for=condition=<Type>[=<Status>]` overrides the registry with a single
+ * condition check, matching kubectl's own flag. `--for=delete` polls for
+ * absence instead. Neither given falls back to the registry: the generic
+ * `Ready` condition, or a resource-specific override (Argo's `Application`
+ * today).
+ */
+
+import { formatUnobserved } from "@intentius/chant/observation";
+import { defaultK8sConnector, type K8sConnector } from "../api/connect";
+import { classifyApiFailure } from "../api/classify";
+import {
+  waitForReady,
+  readinessFor,
+  ReadinessFailedError,
+  type ReadinessSpec,
+  type ResourceFetcher,
+} from "../op/activities/wait-for-ready";
+import { kubeConnect } from "./connect";
+import { parseKubeFlags, connectOptionsFrom, parseDurationMs } from "./flags";
+import { loadKubeProjectContext, type KubeProjectContext } from "./project";
+import { resolveKubeTarget, isTargetError, type KubeTarget } from "./target";
+
+export interface WaitDeps {
+  connect?: K8sConnector;
+  loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+
+type ForSpec = { kind: "delete" } | { kind: "spec"; spec: ReadinessSpec };
+
+function parseFor(value: string | undefined): ForSpec | undefined {
+  if (value === undefined) return undefined;
+  if (value === "delete") return { kind: "delete" };
+  const match = /^condition=([^=]+)(?:=(.+))?$/.exec(value);
+  if (!match) {
+    throw new Error(`--for expects "condition=<Type>[=<Status>]" or "delete", got "${value}"`);
+  }
+  return { kind: "spec", spec: { ready: [{ conditionType: match[1], status: match[2] ?? "True" }] } };
+}
+
+function targetLabel(target: KubeTarget): string {
+  return "apiVersion" in target.selector ? target.selector.kind : target.selector.resource;
+}
+
+export async function runWait(rawArgs: string[], deps: WaitDeps = {}): Promise<number> {
+  const connect = deps.connect ?? defaultK8sConnector;
+  const loadProject = deps.loadProject ?? loadKubeProjectContext;
+
+  let flags;
+  let forSpec: ForSpec | undefined;
+  let timeoutMs: number;
+  try {
+    flags = parseKubeFlags(rawArgs, { value: { "--for": "for", "--timeout": "timeout" } });
+    forSpec = parseFor(flags.values.for);
+    timeoutMs = flags.values.timeout !== undefined ? parseDurationMs(flags.values.timeout) : 30_000;
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+
+  const project = await loadProject();
+  const target = resolveKubeTarget(flags.positional, flags.values.namespace, project);
+  if (isTargetError(target)) {
+    console.error(`error: ${target.error}`);
+    return 1;
+  }
+  if (!target.name) {
+    console.error("error: chant kube wait requires a single named resource, e.g. `chant kube wait deployment web`");
+    return 1;
+  }
+
+  const connected = await kubeConnect(connectOptionsFrom(flags.values), connect);
+  if (connected.kind === "unobserved") {
+    console.error(formatUnobserved(targetLabel(target), { reason: connected.reason, detail: connected.detail }));
+    return 1;
+  }
+  const { client } = connected;
+
+  let info;
+  try {
+    info = await client.resolve(target.selector);
+  } catch (err) {
+    const outcome = classifyApiFailure(err);
+    console.error(
+      formatUnobserved(targetLabel(target), {
+        reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+        detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+      }),
+    );
+    return 1;
+  }
+  if (!info) {
+    console.error(`error: the server doesn't have a resource type "${targetLabel(target)}"`);
+    return 1;
+  }
+
+  const namespace = target.namespace ?? client.defaultNamespace;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    if (forSpec?.kind === "delete") {
+      await waitForDeletion(client, { apiVersion: info.apiVersion, kind: info.kind, name: target.name, namespace }, controller.signal);
+      console.log(`${info.kind}/${target.name} deleted`);
+      return 0;
+    }
+
+    const spec = forSpec?.kind === "spec" ? forSpec.spec : readinessFor(info.group, info.kind);
+    const fetcher: ResourceFetcher = async (args, signal) =>
+      (await client.read(
+        { apiVersion: info.apiVersion, kind: info.kind, name: args.name, ...(args.namespace ? { namespace: args.namespace } : {}) },
+        { signal },
+      )) as Record<string, unknown>;
+
+    await waitForReady({ kind: info.kind, name: target.name, namespace, group: info.group, spec }, controller.signal, fetcher);
+    console.log(`${info.kind}/${target.name} condition met`);
+    return 0;
+  } catch (err) {
+    if (err instanceof ReadinessFailedError) {
+      console.error(err.message);
+      return 1;
+    }
+    if (controller.signal.aborted) {
+      console.error(`error: timed out after ${timeoutMs}ms waiting for ${info.kind}/${target.name}`);
+      return 1;
+    }
+    const outcome = classifyApiFailure(err);
+    console.error(
+      formatUnobserved(`${info.kind}/${target.name}`, {
+        reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+        detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+      }),
+    );
+    return 1;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function waitForDeletion(
+  client: { readIfPresent: (ref: { apiVersion: string; kind: string; name: string; namespace?: string }, opts: { signal?: AbortSignal }) => Promise<unknown> },
+  ref: { apiVersion: string; kind: string; name: string; namespace?: string },
+  signal: AbortSignal,
+  intervalMs = 5_000,
+): Promise<void> {
+  while (true) {
+    if (signal.aborted) throw new Error("wait --for=delete aborted");
+    const obj = await client.readIfPresent(ref, { signal });
+    if (!obj) return;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}

package/src/op/activities/index.ts

@@ -2,7 +2,10 @@
  * k8s Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
- *   - kubectlApply — `kubectl apply` a rendered manifest
+ *   - kubectlApply — server-side apply a rendered manifest (and, since chant
+ *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
+ *     is the same work with a report of what it did, which is what the
+ *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
  *   - k3dUp / k3dDown — boot/tear down a local k3d cluster
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
@@ -11,8 +14,8 @@
  * dependency-light — it shells out to a CLI and does not import the k8s declarable
  * surface — so a Temporal worker loads it cheaply.
  */
-export { kubectlApply, readManifestDocuments } from "./kubectl";
-export type { KubectlApplyArgs } from "./kubectl";
+export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl";
+export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl";
 
 export { k3dUp, k3dDown, k3dUpCommand, k3dDownCommand, k3dExistsCommand } from "./k3d";
 export type { K3dUpArgs, K3dDownArgs } from "./k3d";

package/src/op/activities/kubectl.test.ts

@@ -1,19 +1,25 @@
 /**
- * `kubectlApply` over the typed API client (chant #1074).
+ * `kubectlApply` over the typed API client (chant #1074, #1075).
  *
  * The activity contract is what Temporal workers register, so the shape of the
  * arguments and the `Promise<void>` return are asserted alongside the new
  * behavior. Nothing here spawns a process or reads an ambient kubeconfig,
  * which is the acceptance criterion: a worker image needs no `kubectl` binary.
+ *
+ * chant #1075 adds two things to assert: that the field manager is derived
+ * from the project's `ownership.stack` rather than hardcoded, and that the
+ * ownership-scoped prune the shelled `kubectl apply --prune` used to do is
+ * still exactly as narrow now that it runs here.
  */
 
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { kubectlApply, readManifestDocuments } from "./kubectl";
-import { fakeCluster } from "../../api/fake-cluster";
+import { applyManifest, kubectlApply, readManifestDocuments, resolveFieldManager } from "./kubectl";
+import { fakeCluster, objectKey, ownedObject } from "../../api/fake-cluster";
 import { statusBody } from "@intentius/chant-k8s-client/testing";
+import type { RecordedRequest } from "@intentius/chant-k8s-client/testing";
 
 let dir: string;
 
@@ -35,6 +41,21 @@ spec:
     - port: 80
 `;
 
+/** Echo an applied object back, the way an API server does. */
+const echoApplies = (req: RecordedRequest): { body: unknown } | undefined =>
+  req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined;
+
+/** A project directory whose config sets an ownership stack. */
+function projectWithStack(stack: string, extra: Record<string, unknown> = {}): string {
+  const project = join(dir, `project-${stack}`);
+  mkdirSync(project, { recursive: true });
+  writeFileSync(
+    join(project, "chant.config.json"),
+    JSON.stringify({ lexicons: ["k8s"], ownership: { stack, ...extra } }),
+  );
+  return project;
+}
+
 beforeEach(() => {
   dir = mkdtempSync(join(tmpdir(), "chant-k8s-apply-"));
 });
@@ -65,15 +86,40 @@ describe("readManifestDocuments", () => {
   });
 });
 
+describe("the field manager chant applies as (chant #1075)", () => {
+  test("no ownership stack in the project → the unqualified chant", async () => {
+    const project = join(dir, "no-config");
+    mkdirSync(project);
+    expect(await resolveFieldManager({ manifest: "x", cwd: project })).toBe("chant");
+  });
+
+  test("an ownership stack qualifies it, from the same config the label marker reads", async () => {
+    expect(await resolveFieldManager({ manifest: "x", cwd: projectWithStack("web") })).toBe("chant:web");
+  });
+
+  test("ownership disabled falls back to the unqualified chant, as the label marker does", async () => {
+    const project = projectWithStack("web", { enabled: false });
+    expect(await resolveFieldManager({ manifest: "x", cwd: project })).toBe("chant");
+  });
+
+  test("an explicit field manager wins over the config", async () => {
+    const project = projectWithStack("web");
+    expect(await resolveFieldManager({ manifest: "x", cwd: project, fieldManager: "chant-op" })).toBe("chant-op");
+  });
+
+  test("an explicit stack wins over the config and skips reading it", async () => {
+    const project = projectWithStack("web");
+    expect(await resolveFieldManager({ manifest: "x", cwd: project, stack: "other" })).toBe("chant:other");
+  });
+});
+
 describe("kubectlApply", () => {
   test("server-side applies every document, in file order, as the chant field manager", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);
-    const cluster = fakeCluster({
-      respond: (req) => (req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined),
-    });
+    const cluster = fakeCluster({ respond: echoApplies });
 
-    await kubectlApply({ manifest: file }, undefined, cluster.connector);
+    await kubectlApply({ manifest: file, cwd: projectWithStack("web") }, undefined, cluster.connector);
 
     const patches = cluster.layer.requests.filter((r) => r.method === "PATCH");
     expect(patches.map((p) => p.path)).toEqual([
@@ -82,16 +128,14 @@ describe("kubectlApply", () => {
     ]);
     for (const patch of patches) {
       expect(patch.headers["Content-Type"]).toBe("application/apply-patch+yaml");
-      expect(patch.query).toMatchObject({ fieldManager: "chant", force: "false" });
+      expect(patch.query).toMatchObject({ fieldManager: "chant:web", force: "false" });
     }
   });
 
   test("an explicit context is honored and skips the environment lookup entirely", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);
-    const cluster = fakeCluster({
-      respond: (req) => (req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined),
-    });
+    const cluster = fakeCluster({ respond: echoApplies });
 
     await kubectlApply({ manifest: file, context: "test-context" }, undefined, cluster.connector);
 
@@ -102,47 +146,275 @@ describe("kubectlApply", () => {
   test("an environment is passed through so the cluster binding applies to the write path too", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);
-    const cluster = fakeCluster({
-      respond: (req) => (req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined),
-    });
+    const cluster = fakeCluster({ respond: echoApplies });
 
     await kubectlApply({ manifest: file, environment: "prod" }, undefined, cluster.connector);
     expect(cluster.connects[0]).toMatchObject({ environment: "prod" });
   });
 
-  test("force is forwarded, for the caller that means to take ownership (chant #1075)", async () => {
+  test("force is forwarded, for the caller that means to take ownership", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);
-    const cluster = fakeCluster({
-      respond: (req) => (req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined),
-    });
+    const cluster = fakeCluster({ respond: echoApplies });
 
     await kubectlApply({ manifest: file, force: true, fieldManager: "chant-op" }, undefined, cluster.connector);
     const patch = cluster.layer.requests.find((r) => r.method === "PATCH")!;
     expect(patch.query).toMatchObject({ force: "true", fieldManager: "chant-op" });
   });
 
-  test("a field-ownership conflict surfaces as a typed error rather than parsed stderr", async () => {
+  test("force is off unless asked for — chant never resolves a conflict by itself", async () => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({ respond: echoApplies });
+
+    await kubectlApply({ manifest: file }, undefined, cluster.connector);
+    for (const patch of cluster.layer.requests.filter((r) => r.method === "PATCH")) {
+      expect(patch.query.force).toBe("false");
+    }
+  });
+
+  test("a field-ownership conflict surfaces as a presented error, not a raw 409", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, deploymentYaml);
     const cluster = fakeCluster({
       respond: (req) =>
         req.method === "PATCH"
-          ? { status: 409, body: statusBody(409, "Conflict", 'Apply failed with 1 conflict: conflict with "kubectl"') }
+          ? {
+              status: 409,
+              body: {
+                ...statusBody(409, "Conflict", 'Apply failed with 1 conflict: conflict with "kubectl" using apps/v1'),
+                details: {
+                  causes: [
+                    {
+                      type: "FieldManagerConflict",
+                      message: 'conflict with "kubectl" using apps/v1',
+                      field: ".spec.replicas",
+                    },
+                  ],
+                },
+              },
+            }
           : undefined,
     });
 
-    const err = await kubectlApply({ manifest: file }, undefined, cluster.connector).catch((e: unknown) => e);
-    expect((err as { name?: string }).name).toBe("K8sApiError");
-    expect((err as { statusCode?: number }).statusCode).toBe(409);
+    const err = (await kubectlApply({ manifest: file, stack: "web" }, undefined, cluster.connector).catch(
+      (e: unknown) => e,
+    )) as Error & { statusCode?: number; byManager?: Record<string, string[]>; fieldManager?: string };
+
+    expect(err.name).toBe("FieldManagerConflictError");
+    expect(err.statusCode).toBe(409);
+    expect(err.byManager).toEqual({ kubectl: [".spec.replicas"] });
+    expect(err.fieldManager).toBe("chant:web");
+    expect(err.message).toContain("apps/v1 Deployment prod/web");
+    expect(err.message).toContain(".spec.replicas");
+    expect(err.message).toContain("chant does not force this for you");
   });
 
   test("resolves to undefined, keeping the activity's Promise<void> contract", async () => {
     const file = join(dir, "k8s.yaml");
     writeFileSync(file, "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: c\n  namespace: prod\n");
+    const cluster = fakeCluster({ respond: echoApplies });
+    await expect(kubectlApply({ manifest: file }, undefined, cluster.connector)).resolves.toBeUndefined();
+  });
+
+  test("applyManifest reports what it did, which is what nativeApply relays", async () => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(file, deploymentYaml);
+    const cluster = fakeCluster({ respond: echoApplies });
+    const result = await applyManifest({ manifest: file, stack: "web" }, undefined, cluster.connector);
+    expect(result.fieldManager).toBe("chant:web");
+    expect(result.applied).toEqual([
+      { apiVersion: "apps/v1", kind: "Deployment", name: "web", namespace: "prod" },
+      { apiVersion: "v1", kind: "Service", name: "web-svc", namespace: "prod" },
+    ]);
+    expect(result.pruned).toEqual([]);
+  });
+});
+
+describe("the ownership-scoped prune (chant #1075)", () => {
+  const manifest = (): string => {
+    const file = join(dir, "k8s.yaml");
+    writeFileSync(
+      file,
+      "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  namespace: prod\n",
+    );
+    return file;
+  };
+
+  /** A cluster holding one chant-owned orphan, one foreign object, and the declared one. */
+  const clusterWithOrphans = () =>
+    fakeCluster({
+      respond: echoApplies,
+      objects: {
+        [objectKey("apps/v1", "Deployment", "old", "prod")]: ownedObject("apps/v1", "Deployment", "old", "prod"),
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: ownedObject("apps/v1", "Deployment", "web", "prod"),
+        [objectKey("apps/v1", "Deployment", "handmade", "prod")]: {
+          apiVersion: "apps/v1",
+          kind: "Deployment",
+          metadata: { name: "handmade", namespace: "prod", labels: { app: "handmade" } },
+        },
+        [objectKey("apps/v1", "Deployment", "elsewhere", "staging")]: ownedObject(
+          "apps/v1",
+          "Deployment",
+          "elsewhere",
+          "staging",
+        ),
+      },
+    });
+
+  test("deleteMode never deletes nothing, and issues no DELETE at all", async () => {
+    const cluster = clusterWithOrphans();
+    const result = await applyManifest({ manifest: manifest() }, undefined, cluster.connector);
+    expect(result.pruned).toEqual([]);
+    expect(cluster.layer.requests.filter((r) => r.method === "DELETE")).toEqual([]);
+  });
+
+  test("owned-only deletes the chant-owned object the manifest no longer declares", async () => {
+    const cluster = clusterWithOrphans();
+    const result = await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only" },
+      undefined,
+      cluster.connector,
+    );
+    expect(result.pruned).toEqual([
+      { apiVersion: "apps/v1", kind: "Deployment", name: "old", namespace: "prod" },
+    ]);
+    expect(cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path)).toEqual([
+      "/apis/apps/v1/namespaces/prod/deployments/old",
+    ]);
+  });
+
+  test("gated prunes exactly as owned-only does — the gate is the composite's business", async () => {
+    const cluster = clusterWithOrphans();
+    const result = await applyManifest({ manifest: manifest(), deleteMode: "gated" }, undefined, cluster.connector);
+    expect(result.pruned.map((p) => p.name)).toEqual(["old"]);
+  });
+
+  test("an object without chant's marker is never a candidate", async () => {
+    const cluster = clusterWithOrphans();
+    await applyManifest({ manifest: manifest(), deleteMode: "owned-only" }, undefined, cluster.connector);
+    const deleted = cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path);
+    expect(deleted.some((p) => p.includes("handmade"))).toBe(false);
+  });
+
+  test("the object the manifest still declares is not pruned after being applied", async () => {
+    const cluster = clusterWithOrphans();
+    await applyManifest({ manifest: manifest(), deleteMode: "owned-only" }, undefined, cluster.connector);
+    const deleted = cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path);
+    expect(deleted.some((p) => p.endsWith("/deployments/web"))).toBe(false);
+  });
+
+  test("a namespace the manifest never mentions is not swept", async () => {
+    const cluster = clusterWithOrphans();
+    await applyManifest({ manifest: manifest(), deleteMode: "owned-only" }, undefined, cluster.connector);
+    const listed = cluster.layer.requests.filter((r) => r.method === "GET").map((r) => r.path);
+    expect(listed.some((p) => p.includes("/namespaces/staging/"))).toBe(false);
+  });
+
+  test("the sweep is sent to the server as a marker selector, stack-scoped when one is configured", async () => {
+    const cluster = clusterWithOrphans();
+    await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only", stack: "web" },
+      undefined,
+      cluster.connector,
+    );
+    const sweeps = cluster.layer.requests.filter((r) => r.query.labelSelector !== undefined);
+    expect(sweeps.length).toBeGreaterThan(0);
+    for (const sweep of sweeps) {
+      expect(sweep.query.labelSelector).toBe(
+        "app.kubernetes.io/managed-by=chant,chant.intentius.io/stack=web",
+      );
+    }
+  });
+
+  test("with no stack configured the selector is the marker alone, as the shelled prune's was", async () => {
+    const cluster = clusterWithOrphans();
+    const project = join(dir, "no-ownership");
+    mkdirSync(project);
+    await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only", cwd: project },
+      undefined,
+      cluster.connector,
+    );
+    const sweep = cluster.layer.requests.find((r) => r.query.labelSelector !== undefined)!;
+    expect(sweep.query.labelSelector).toBe("app.kubernetes.io/managed-by=chant");
+  });
+
+  test("a kind removed from source entirely is still swept, via the default sweep set", async () => {
+    // Nothing in the manifest is a Service, yet a chant-owned Service must not
+    // survive being deleted from source. This is why the sweep is the union of
+    // the applied kinds and the default set rather than the applied kinds alone.
     const cluster = fakeCluster({
-      respond: (req) => (req.method === "PATCH" ? { body: JSON.parse(String(req.body)) } : undefined),
+      respond: echoApplies,
+      objects: {
+        [objectKey("v1", "Service", "gone", "prod")]: ownedObject("v1", "Service", "gone", "prod"),
+      },
     });
-    await expect(kubectlApply({ manifest: file }, undefined, cluster.connector)).resolves.toBeUndefined();
+    const result = await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only" },
+      undefined,
+      cluster.connector,
+    );
+    expect(result.pruned).toEqual([{ apiVersion: "v1", kind: "Service", name: "gone", namespace: "prod" }]);
+  });
+
+  test("a kind the cluster does not serve is skipped, not fatal", async () => {
+    const cluster = fakeCluster({
+      respond: echoApplies,
+      // Only these two kinds exist here; every other sweep 404s on discovery.
+      serves: ["K8s::Apps::Deployment", "K8s::Core::Service"],
+      objects: {
+        [objectKey("apps/v1", "Deployment", "old", "prod")]: ownedObject("apps/v1", "Deployment", "old", "prod"),
+      },
+    });
+    const result = await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only" },
+      undefined,
+      cluster.connector,
+    );
+    expect(result.pruned.map((p) => p.name)).toEqual(["old"]);
+  });
+
+  test("a manifest that names no namespace does not become a cluster-wide sweep", async () => {
+    // Whether a kind is namespaced comes from the cluster's discovery, not from
+    // whether the document happened to name a namespace. Getting that wrong is
+    // the one way this could reach outside the namespace being applied to.
+    const file = join(dir, "no-namespace.yaml");
+    writeFileSync(file, "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n");
+    const cluster = fakeCluster({
+      respond: echoApplies,
+      objects: {
+        [objectKey("apps/v1", "Deployment", "elsewhere", "staging")]: ownedObject(
+          "apps/v1",
+          "Deployment",
+          "elsewhere",
+          "staging",
+        ),
+      },
+    });
+
+    const result = await applyManifest({ manifest: file, deleteMode: "owned-only" }, undefined, cluster.connector);
+
+    expect(result.pruned).toEqual([]);
+    const sweeps = cluster.layer.requests.filter((r) => r.query.labelSelector !== undefined).map((r) => r.path);
+    // Namespaced kinds are swept in the context's default namespace, never
+    // across the cluster.
+    expect(sweeps).toContain("/apis/apps/v1/namespaces/default/deployments");
+    expect(sweeps).not.toContain("/apis/apps/v1/deployments");
+  });
+
+  test("an object already terminating is left alone", async () => {
+    const terminating = ownedObject("apps/v1", "Deployment", "old", "prod");
+    terminating.metadata!.deletionTimestamp = "2026-07-20T10:00:00Z";
+    const cluster = fakeCluster({
+      respond: echoApplies,
+      objects: { [objectKey("apps/v1", "Deployment", "old", "prod")]: terminating },
+    });
+    const result = await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only" },
+      undefined,
+      cluster.connector,
+    );
+    expect(result.pruned).toEqual([]);
   });
 });