@intentius/chant-lexicon-k8s 0.41.20 → 0.42.1

package/dist/okf/types/Status.md

@@ -0,0 +1,17 @@
+---
+type: resource-type
+title: Status
+description: k8s resource type K8s::Core::Status
+name: Status
+lexicon: k8s
+resource_type: K8s::Core::Status
+---
+`K8s::Core::Status`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `code` (`number`, optional): Suggested HTTP return code for this status, 0 if not set.
+- `details` (`Record<string, unknown>`, optional): Extended data associated with the reason. Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.
+- `message` (`string`, optional): A human-readable description of the status of this operation.
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+- `reason` (`string`, optional): A machine-readable description of why this operation is in the "Failure" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.

package/dist/okf/types/StorageClass.md

@@ -0,0 +1,20 @@
+---
+type: resource-type
+title: StorageClass
+description: k8s resource type K8s::Storage::StorageClass
+name: StorageClass
+lexicon: k8s
+resource_type: K8s::Storage::StorageClass
+---
+`K8s::Storage::StorageClass`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `provisioner` (`string`, required): provisioner indicates the type of the provisioner.
+- `allowedTopologies` (`Record<string, unknown>[]`, optional): allowedTopologies restrict the node topologies where volumes can be dynamically provisioned. Each volume plugin defines its own supported topology specifications. An empty TopologySelectorTerm list means there is no topology restriction. This field is only honored by servers that enable the VolumeScheduling feature.
+- `allowVolumeExpansion` (`boolean`, optional): allowVolumeExpansion shows whether the storage class allow volume expand.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `mountOptions` (`string[]`, optional): mountOptions controls the mountOptions for dynamically provisioned PersistentVolumes of this storage class. e.g. ["ro", "soft"]. Not validated - mount of the PVs will simply fail if one is invalid.
+- `parameters` (`Record<string, string>`, optional): parameters holds the parameters for the provisioner that should create volumes of this storage class.
+- `reclaimPolicy` (`string`, optional): reclaimPolicy controls the reclaimPolicy for dynamically provisioned PersistentVolumes of this storage class. Defaults to Delete.
+- `volumeBindingMode` (`string`, optional): volumeBindingMode indicates how PersistentVolumeClaims should be provisioned and bound. When unset, VolumeBindingImmediate is used. This field is only honored by servers that enable the VolumeScheduling feature.

package/dist/okf/types/StorageClassList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: StorageClassList
+description: k8s resource type K8s::Storage::StorageClassList
+name: StorageClassList
+lexicon: k8s
+resource_type: K8s::Storage::StorageClassList
+---
+`K8s::Storage::StorageClassList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): items is the list of StorageClasses
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/StorageVersionMigration.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: StorageVersionMigration
+description: k8s resource type K8s::Storagemigration::StorageVersionMigration
+name: StorageVersionMigration
+lexicon: k8s
+resource_type: K8s::Storagemigration::StorageVersionMigration
+---
+`K8s::Storagemigration::StorageVersionMigration`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `spec` (`Record<string, unknown>`, optional): Specification of the migration.

package/dist/okf/types/StorageVersionMigrationList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: StorageVersionMigrationList
+description: k8s resource type K8s::Storagemigration::StorageVersionMigrationList
+name: StorageVersionMigrationList
+lexicon: k8s
+resource_type: K8s::Storagemigration::StorageVersionMigrationList
+---
+`K8s::Storagemigration::StorageVersionMigrationList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): Items is the list of StorageVersionMigration
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/SubjectAccessReview.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: SubjectAccessReview
+description: k8s resource type K8s::Authorization::SubjectAccessReview
+name: SubjectAccessReview
+lexicon: k8s
+resource_type: K8s::Authorization::SubjectAccessReview
+---
+`K8s::Authorization::SubjectAccessReview`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec holds information about the request being evaluated
+- `metadata` (`ObjectMeta`, optional): metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/TLSOption.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: TLSOption
+description: k8s resource type K8s::Traefik::TLSOption
+name: TLSOption
+lexicon: k8s
+resource_type: K8s::Traefik::TLSOption
+---
+`K8s::Traefik::TLSOption`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): TLSOptionSpec defines the desired state of a TLSOption.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/TLSStore.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: TLSStore
+description: k8s resource type K8s::Traefik::TLSStore
+name: TLSStore
+lexicon: k8s
+resource_type: K8s::Traefik::TLSStore
+---
+`K8s::Traefik::TLSStore`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): TLSStoreSpec defines the desired state of a TLSStore.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/TokenRequest.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: TokenRequest
+description: k8s resource type K8s::Authentication::TokenRequest
+name: TokenRequest
+lexicon: k8s
+resource_type: K8s::Authentication::TokenRequest
+---
+`K8s::Authentication::TokenRequest`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `spec` (`Record<string, unknown>`, optional): spec holds information about the request being evaluated

package/dist/okf/types/TokenReview.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: TokenReview
+description: k8s resource type K8s::Authentication::TokenReview
+name: TokenReview
+lexicon: k8s
+resource_type: K8s::Authentication::TokenReview
+---
+`K8s::Authentication::TokenReview`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec holds information about the request being evaluated
+- `metadata` (`ObjectMeta`, optional): metadata is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/TraefikService.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: TraefikService
+description: k8s resource type K8s::Traefik::TraefikService
+name: TraefikService
+lexicon: k8s
+resource_type: K8s::Traefik::TraefikService
+---
+`K8s::Traefik::TraefikService`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): TraefikServiceSpec defines the desired state of a TraefikService.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata.

package/dist/okf/types/ValidatingAdmissionPolicy.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingAdmissionPolicy
+description: k8s resource type K8s::Admissionregistration::ValidatingAdmissionPolicy
+name: ValidatingAdmissionPolicy
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingAdmissionPolicy
+---
+`K8s::Admissionregistration::ValidatingAdmissionPolicy`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+- `spec` (`Record<string, unknown>`, optional): spec defines the desired behavior of the ValidatingAdmissionPolicy.

package/dist/okf/types/ValidatingAdmissionPolicyBinding.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingAdmissionPolicyBinding
+description: k8s resource type K8s::Admissionregistration::ValidatingAdmissionPolicyBinding
+name: ValidatingAdmissionPolicyBinding
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingAdmissionPolicyBinding
+---
+`K8s::Admissionregistration::ValidatingAdmissionPolicyBinding`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.
+- `metadata` (`ObjectMeta`, optional): metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.

package/dist/okf/types/ValidatingAdmissionPolicyBindingList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingAdmissionPolicyBindingList
+description: k8s resource type K8s::Admissionregistration::ValidatingAdmissionPolicyBindingList
+name: ValidatingAdmissionPolicyBindingList
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingAdmissionPolicyBindingList
+---
+`K8s::Admissionregistration::ValidatingAdmissionPolicyBindingList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): List of PolicyBinding.
+- `metadata` (`Record<string, unknown>`, optional): metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

package/dist/okf/types/ValidatingAdmissionPolicyList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingAdmissionPolicyList
+description: k8s resource type K8s::Admissionregistration::ValidatingAdmissionPolicyList
+name: ValidatingAdmissionPolicyList
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingAdmissionPolicyList
+---
+`K8s::Admissionregistration::ValidatingAdmissionPolicyList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): List of ValidatingAdmissionPolicy.
+- `metadata` (`Record<string, unknown>`, optional): metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

package/dist/okf/types/ValidatingWebhookConfiguration.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingWebhookConfiguration
+description: k8s resource type K8s::Admissionregistration::ValidatingWebhookConfiguration
+name: ValidatingWebhookConfiguration
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingWebhookConfiguration
+---
+`K8s::Admissionregistration::ValidatingWebhookConfiguration`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `metadata` (`ObjectMeta`, optional): metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
+- `webhooks` (`Record<string, unknown>[]`, optional): webhooks is a list of webhooks and the affected resources and operations.

package/dist/okf/types/ValidatingWebhookConfigurationList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ValidatingWebhookConfigurationList
+description: k8s resource type K8s::Admissionregistration::ValidatingWebhookConfigurationList
+name: ValidatingWebhookConfigurationList
+lexicon: k8s
+resource_type: K8s::Admissionregistration::ValidatingWebhookConfigurationList
+---
+`K8s::Admissionregistration::ValidatingWebhookConfigurationList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): List of ValidatingWebhookConfiguration.
+- `metadata` (`Record<string, unknown>`, optional): metadata is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

package/dist/okf/types/VolumeAttachment.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: VolumeAttachment
+description: k8s resource type K8s::Storage::VolumeAttachment
+name: VolumeAttachment
+lexicon: k8s
+resource_type: K8s::Storage::VolumeAttachment
+---
+`K8s::Storage::VolumeAttachment`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `spec` (`Record<string, unknown>`, required): spec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.
+- `metadata` (`ObjectMeta`, optional): Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/VolumeAttachmentList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: VolumeAttachmentList
+description: k8s resource type K8s::Storage::VolumeAttachmentList
+name: VolumeAttachmentList
+lexicon: k8s
+resource_type: K8s::Storage::VolumeAttachmentList
+---
+`K8s::Storage::VolumeAttachmentList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): items is the list of VolumeAttachments
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/VolumeAttributesClass.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VolumeAttributesClass
+description: k8s resource type K8s::Storage::VolumeAttributesClass
+name: VolumeAttributesClass
+lexicon: k8s
+resource_type: K8s::Storage::VolumeAttributesClass
+---
+`K8s::Storage::VolumeAttributesClass`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `driverName` (`string`, required): Name of the CSI driver This field is immutable.
+- `metadata` (`ObjectMeta`, optional): Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+- `parameters` (`Record<string, string>`, optional): parameters hold volume attributes defined by the CSI driver. These values are opaque to the Kubernetes and are passed directly to the CSI driver. The underlying storage provider supports changing these attributes on an existing volume, however the parameters field itself is immutable. To invoke a volume update, a new VolumeAttributesClass should be created with new parameters, and the PersistentVolumeClaim should be updated to reference the new VolumeAttributesClass. This field is required and must contain at least one key/value pair. The keys cannot be empty, and the maximum number of parameters is 512, with a cumulative max size of 256K. If the CSI driver rejects invalid parameters, the target PersistentVolumeClaim will be set to an "Infeasible" state in the modifyVolumeStatus field.

package/dist/okf/types/VolumeAttributesClassList.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: VolumeAttributesClassList
+description: k8s resource type K8s::Storage::VolumeAttributesClassList
+name: VolumeAttributesClassList
+lexicon: k8s
+resource_type: K8s::Storage::VolumeAttributesClassList
+---
+`K8s::Storage::VolumeAttributesClassList`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `items` (`Record<string, unknown>[]`, required): items is the list of VolumeAttributesClass objects.
+- `metadata` (`Record<string, unknown>`, optional): Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

package/dist/okf/types/WatchEvent.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: WatchEvent
+description: k8s resource type K8s::Core::WatchEvent
+name: WatchEvent
+lexicon: k8s
+resource_type: K8s::Core::WatchEvent
+---
+`K8s::Core::WatchEvent`, a resource type of the k8s lexicon.
+
+## Properties
+
+- `object` (`Record<string, unknown>`, required): Object is: If Type is Added or Modified: the new state of the object. If Type is Deleted: the state of the object immediately before deletion. If Type is Error: *Status is recommended; other types may make sense depending on context.
+- `type` (`string`, required)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-k8s",
-  "version": "0.41.20",
+  "version": "0.42.1",
   "description": "Kubernetes lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -84,7 +84,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.42.1",
     "typescript": "^5.9.3"
   }
 }

package/src/deep-observe-hooks.ts

@@ -44,6 +44,7 @@
 import { createRequire } from "module";
 import type { DeepArrayElement, DeepNode, DeepNormalizationHooks } from "@intentius/chant/lexicon";
 import { K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS, k8sListMapOrderKey } from "@intentius/chant/managed-fields";
+import { LABEL_OWNERSHIP_KEYS, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 
 // This module ships as ESM (tsx strips types from src/ directly), where a bare
 // `require` is not defined — the same reason serializer.ts and the LSP modules
@@ -86,13 +87,64 @@ export const K8S_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
     "spec.template.spec.restartPolicy": "Always",
     "spec.template.spec.terminationGracePeriodSeconds": 30,
     "spec.template.spec.schedulerName": "default-scheduler",
+    // Widened on the CC canonical estate (#1214): a container declaring an
+    // httpGet probe, a named port, or nothing about termination gets exactly
+    // these from the API server. SSA attributes a server-defaulted field to no
+    // manager, so the managed-fields prune deliberately leaves them diffable
+    // (see ./deep-observe.ts) — this table is where they subtract.
+    "spec.template.spec.containers[].livenessProbe.failureThreshold": 3,
+    "spec.template.spec.containers[].livenessProbe.periodSeconds": 10,
+    "spec.template.spec.containers[].livenessProbe.successThreshold": 1,
+    "spec.template.spec.containers[].livenessProbe.timeoutSeconds": 1,
+    "spec.template.spec.containers[].livenessProbe.httpGet.scheme": "HTTP",
+    "spec.template.spec.containers[].readinessProbe.failureThreshold": 3,
+    "spec.template.spec.containers[].readinessProbe.periodSeconds": 10,
+    "spec.template.spec.containers[].readinessProbe.successThreshold": 1,
+    "spec.template.spec.containers[].readinessProbe.timeoutSeconds": 1,
+    "spec.template.spec.containers[].readinessProbe.httpGet.scheme": "HTTP",
+    "spec.template.spec.containers[].ports[].protocol": "TCP",
+    "spec.template.spec.containers[].terminationMessagePath": "/dev/termination-log",
+    "spec.template.spec.containers[].terminationMessagePolicy": "File",
+    "spec.template.spec.securityContext": {},
   },
   "K8s::Core::Service": {
     "spec.sessionAffinity": "None",
     "spec.type": "ClusterIP",
+    "spec.internalTrafficPolicy": "Cluster",
+    "spec.ipFamilyPolicy": "SingleStack",
+    "spec.ports[].protocol": "TCP",
   },
 };
 
+/**
+ * Server-ASSIGNED fields — populated by the API server with a value that
+ * varies per object (an allocated ClusterIP, the resolved IP family list), so
+ * unlike {@link K8S_SERVICE_DEFAULTS} there is no fixed value to compare
+ * against. Counterpart-gated like the defaults table: a declared `clusterIP`
+ * is still compared, only the purely server-filled appearance is noise.
+ */
+export const K8S_SERVER_ASSIGNED_PATTERNS: Record<string, ReadonlySet<string>> = {
+  "K8s::Core::Service": new Set(["spec.clusterIP", "spec.clusterIPs", "spec.ipFamilies"]),
+};
+
+/**
+ * chant's own ownership marker, as label paths (#1214 — the k8s edition of
+ * azure's #1213 rule). The build stamps `app.kubernetes.io/managed-by` +
+ * `chant.intentius.io/{stack,env}` into every manifest it emits, so a managed
+ * object always carries them live while the declared *source* the diff
+ * compares does not — chant reading its own signature back as drift. The
+ * managed-fields prune cannot subtract them: they are in the applied config,
+ * so chant's field manager owns them, and chant-owned is always diffable.
+ * Counterpart-gated at the call site; managed-by is additionally gated on the
+ * value `"chant"`, so `managed-by: helm` appearing out of band still surfaces.
+ */
+const K8S_OWNERSHIP_LABEL_PATTERNS: ReadonlySet<string> = new Set([
+  `metadata.labels.${LABEL_OWNERSHIP_KEYS.stack}`,
+  `metadata.labels.${LABEL_OWNERSHIP_KEYS.env}`,
+]);
+
+const K8S_MANAGED_BY_LABEL_PATTERN = `metadata.labels.${LABEL_OWNERSHIP_KEYS.managedBy}`;
+
 /** Stable JSON with sorted keys — the fallback ordering key for a set-like array without a natural identity field. */
 function canonicalJson(value: unknown): string {
   return (
@@ -206,6 +258,14 @@ export const k8sDeepNormalizationHooks: DeepNormalizationHooks = {
     if (K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has(node.pattern)) return true;
 
     if (node.side !== "live" || node.counterpart !== "absent") return false;
+
+    // chant's own ownership marker is not drift (see the sets' docs).
+    if (K8S_OWNERSHIP_LABEL_PATTERNS.has(node.pattern)) return true;
+    if (node.pattern === K8S_MANAGED_BY_LABEL_PATTERN && node.value === OWNERSHIP_MANAGED_BY_VALUE) return true;
+
+    // A server-assigned value nobody declared is allocation, not drift.
+    if (K8S_SERVER_ASSIGNED_PATTERNS[node.entityType]?.has(node.pattern)) return true;
+
     const defaults = K8S_SERVICE_DEFAULTS[node.entityType];
     if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, node.pattern)) return false;
     return canonicalJson(defaults[node.pattern]) === canonicalJson(node.value);

package/src/deep-observe.test.ts

@@ -96,6 +96,120 @@ describe("k8sDeepNormalizationHooks — the static rules", () => {
     expect(declaredExplicit).toEqual({ spec: { strategy: strategyDefault, replicas: 3 } });
   });
 
+  test("chant's own stamped labels are not drift; a foreign managed-by and a user label still are", () => {
+    const live = {
+      metadata: {
+        name: "web",
+        labels: {
+          "app.kubernetes.io/managed-by": "chant",
+          "chant.intentius.io/stack": "cc-azure-canonical",
+          "chant.intentius.io/env": "local",
+          team: "platform",
+        },
+      },
+    };
+    const out = normalizeDeepProperties(live, {
+      entityType: "K8s::Apps::Deployment",
+      side: "live",
+      hooks: k8sDeepNormalizationHooks,
+      counterpartPaths: new Set(["metadata", "metadata.name"]),
+    });
+    expect(out).toEqual({ metadata: { name: "web", labels: { team: "platform" } } });
+
+    const foreign = normalizeDeepProperties(
+      { metadata: { name: "web", labels: { "app.kubernetes.io/managed-by": "helm" } } },
+      {
+        entityType: "K8s::Apps::Deployment",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["metadata", "metadata.name"]),
+      },
+    );
+    expect(foreign).toEqual({ metadata: { name: "web", labels: { "app.kubernetes.io/managed-by": "helm" } } });
+  });
+
+  test("a server-assigned ClusterIP nobody declared subtracts; a declared one is compared", () => {
+    const undeclared = normalizeDeepProperties(
+      { spec: { clusterIP: "10.43.201.161", clusterIPs: ["10.43.201.161"], ipFamilies: ["IPv4"], selector: { app: "web" } } },
+      {
+        entityType: "K8s::Core::Service",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["spec", "spec.selector", "spec.selector.app"]),
+      },
+    );
+    expect(undeclared).toEqual({ spec: { selector: { app: "web" } } });
+
+    const declared = normalizeDeepProperties(
+      { spec: { clusterIP: "10.43.0.10" } },
+      {
+        entityType: "K8s::Core::Service",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set(["spec", "spec.clusterIP"]),
+      },
+    );
+    expect(declared).toEqual({ spec: { clusterIP: "10.43.0.10" } });
+  });
+
+  test("probe and termination defaults subtract inside a declared container", () => {
+    const out = normalizeDeepProperties(
+      {
+        spec: {
+          template: {
+            spec: {
+              securityContext: {},
+              containers: [
+                {
+                  name: "api",
+                  image: "example:1",
+                  terminationMessagePath: "/dev/termination-log",
+                  terminationMessagePolicy: "File",
+                  livenessProbe: { httpGet: { path: "/", port: 8080, scheme: "HTTP" }, failureThreshold: 3, periodSeconds: 10, successThreshold: 1, timeoutSeconds: 1 },
+                  ports: [{ containerPort: 8080, name: "http", protocol: "TCP" }],
+                },
+              ],
+            },
+          },
+        },
+      },
+      {
+        entityType: "K8s::Apps::Deployment",
+        side: "live",
+        hooks: k8sDeepNormalizationHooks,
+        counterpartPaths: new Set([
+          "spec", "spec.template", "spec.template.spec",
+          "spec.template.spec.containers", "spec.template.spec.containers[]",
+          "spec.template.spec.containers[].name", "spec.template.spec.containers[].image",
+          "spec.template.spec.containers[].livenessProbe",
+          "spec.template.spec.containers[].livenessProbe.httpGet",
+          "spec.template.spec.containers[].livenessProbe.httpGet.path",
+          "spec.template.spec.containers[].livenessProbe.httpGet.port",
+          "spec.template.spec.containers[].ports",
+          "spec.template.spec.containers[].ports[]",
+          "spec.template.spec.containers[].ports[].containerPort",
+          "spec.template.spec.containers[].ports[].name",
+        ]),
+      },
+    );
+    expect(out).toEqual({
+      spec: {
+        template: {
+          spec: {
+            containers: [
+              {
+                name: "api",
+                image: "example:1",
+                livenessProbe: { httpGet: { path: "/", port: 8080 } },
+                ports: [{ containerPort: 8080, name: "http" }],
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+
   test("a one-sided pass never subtracts defaults — the reader has no declared tree yet", () => {
     const out = normalizeDeepProperties(
       { spec: { strategy: { type: "RollingUpdate", rollingUpdate: { maxSurge: "25%", maxUnavailable: "25%" } } } },