@intentius/chant 0.124.52 → 0.124.54

package/src/graph-ir.ts

@@ -7,7 +7,9 @@ import { getProvenance } from "./provenance";
 import { INTRINSIC_MARKER } from "./intrinsic";
 import { subTemplateRefs } from "./graph-sub-template";
 import type { ResourceMetadata } from "./lexicon";
-import type { UnobservedEntity } from "./observation";
+import { entityInstanceRollup, observedInstanceNodeId, type InstanceRollup } from "./instance-nodes";
+import type { RootRead, UnobservedEntity } from "./observation";
+import type { EdgeGrain, EngineFacts } from "./engine-facts";
 
 export { subTemplateRefs };
 
@@ -95,6 +97,68 @@ export interface IRNode {
    * unaffected.
    */
   runtimeOwner?: string;
+  /**
+   * On an instance node of a `count` or `for_each` block (#4454): the block
+   * node's id. The node's own id is that id followed by {@link instanceKey},
+   * `aws_eip.pool[0]` under `aws_eip.pool`, and the block node stays in the
+   * graph as the rollup. Absent on every other node. See `./instance-nodes.ts`.
+   */
+  instanceOf?: string;
+  /**
+   * With {@link instanceOf}: the block's own instance key as the engine
+   * prints it, `[0]` or `["a"]`. Absent on an instance that only an
+   * expanded enclosing scope makes (#4486), a block without `count` under
+   * `module "app" { count = 2 }`.
+   */
+  instanceKey?: string;
+  /**
+   * With {@link instanceOf}, under an expanded enclosing scope (#4486): that
+   * scope's path as the engine prints it, `module.app[0]`. The node id then
+   * carries the key on the scope's segment, `estate/module.app[0]/aws_eip.pool[1]`.
+   */
+  instanceScope?: string;
+  /**
+   * On a block node whose `count` or `for_each` the declared graph cannot
+   * count (#4489): why it stays one node, and the expression. Absent on a
+   * block that is not expanded and on one whose instances are listed. See
+   * `./instance-nodes.ts`.
+   */
+  instanceRollup?: InstanceRollup;
+  /**
+   * What an ownership engine (choudoufu, plunge) observed about this node
+   * (#4520, #4527). On a live node it is copied from `ResourceMetadata.facts`.
+   * On a declared node it comes from the entity's {@link entityFacts}: the
+   * pulumi lexicon reads a plunge member's checked-in `engine-graph.json`
+   * beside its stack export (#4529). For people and for readers that show
+   * the graph. Nothing in chant decides from it, and {@link ownership} keeps
+   * its own meaning. Absent unless an engine supplied it. See `./engine-facts.ts`.
+   */
+  facts?: EngineFacts;
+  /**
+   * Indexed nodes only (#4521, behold#1025): the inventory API's own type
+   * name, as the cloud lister read it: `AWS::S3::Bucket`,
+   * `microsoft.storage/storageaccounts`, `storage.googleapis.com/Bucket`,
+   * `apps/v1/Deployment`. Absent on every node a cloud listing did not make.
+   */
+  listedType?: string;
+  /**
+   * Indexed nodes only: the region or location the object was listed in,
+   * `global` for a global type, a namespace or `cluster` for Kubernetes.
+   */
+  location?: string;
+  /**
+   * Indexed nodes only: the identifier the listing returned, Cloud Control's
+   * `Identifier`, the ARM id, the asset `name`, or `namespace/name`.
+   */
+  nativeId?: string;
+  /** Indexed nodes only: tags or labels as read, masked by key. Where markers come from. */
+  tags?: Record<string, string>;
+  /**
+   * Indexed nodes only: true when no lexicon kind maps the listed type. The
+   * node keeps `kind` = {@link listedType} and `lexicon` = the substrate, and
+   * is never dropped (#4521).
+   */
+  unmappedKind?: boolean;
 }
 
 /**
@@ -134,6 +198,34 @@ export interface IREdge {
    * this to route the edge between groups. Absent on every in-pipeline edge.
    */
   crossPipeline?: boolean;
+  /**
+   * What the edge joins (#4520): two blocks, two instances, or a property of
+   * one instance to another. Set by an engine's graph (choudoufu: `block`;
+   * plunge: `instance` for dependencies, parents and providers, `property`
+   * for property dependencies). Absent when the source does not say. Two
+   * edges between the same pair that differ only in grain are two edges.
+   */
+  grain?: EdgeGrain;
+  /**
+   * Where the edge came from (behold#1025): `declared` (an AttrRef or an
+   * EntityReference), `observed` (the engine or the cloud reported it), or
+   * `derived` (a reference catalog rule matched an attribute value to another
+   * node, #4522). Absent reads as `declared` on a source IR and `observed` on
+   * a live one, which is what both meant before the field.
+   */
+  origin?: "declared" | "observed" | "derived";
+  /**
+   * With `origin: "derived"`: the rule that produced the edge,
+   * `<lexicon>:<from kind>:<path>` for a catalog rule and
+   * `<lexicon>:<from kind>:tag:<key>` for a typed tag rule.
+   */
+  rule?: string;
+  /**
+   * `reference` (the default when absent) or `containment`: the holder sits
+   * inside the target (a subnet in its VPC). A containment edge is also in
+   * `groups.byContainer`, so a renderer that draws boxes can skip the line.
+   */
+  relation?: "reference" | "containment";
 }
 
 /**
@@ -286,6 +378,8 @@ export interface EntityReference {
   viaAttr?: string;
   /** The producer-side attribute referenced (`IREdge.toAttr`), when the reference named exactly one. */
   toAttr?: string;
+  /** What the reference joins (`IREdge.grain`, #4529), when its source says. */
+  grain?: EdgeGrain;
 }
 
 /** True when `value` has the {@link EntityReference} shape. */
@@ -329,6 +423,59 @@ export function entityStack(entity: Declarable): string | undefined {
   return typeof stack === "string" && stack.length > 0 ? stack : undefined;
 }
 
+/**
+ * What an ownership engine observed about an entity (#4529), or undefined.
+ * Duck-typed like {@link entityStack}: the pulumi lexicon sets `facts` on a
+ * plunge member's entity from the member's checked-in engine graph. It is
+ * defined non-enumerable there, so a chant older than this reader does not
+ * project it into `attrs`. {@link buildGraphIr} copies it onto the node, and
+ * nothing in chant decides from it (see `IRNode.facts`).
+ */
+export function entityFacts(entity: Declarable): EngineFacts | undefined {
+  const facts = (entity as unknown as { facts?: unknown }).facts;
+  return typeof facts === "object" && facts !== null && !Array.isArray(facts) ? (facts as EngineFacts) : undefined;
+}
+
+/**
+ * The instance keys an entity says its source expands to (#4454), as the
+ * engine prints them (`[0]`, `["a"]`), or an empty list. Duck-typed like
+ * {@link entityStack}: the terraform lexicon sets `instanceKeys` on a block
+ * whose `count` or `for_each` is a literal.
+ */
+export function entityInstanceKeys(entity: Declarable): readonly string[] {
+  const keys = (entity as unknown as { instanceKeys?: unknown }).instanceKeys;
+  if (!Array.isArray(keys)) return [];
+  return keys.filter((k): k is string => typeof k === "string" && k.startsWith("[") && k.endsWith("]"));
+}
+
+/** One instance node an entity names (#4486): its full id, and the key and scope it carries. */
+export interface EntityInstance {
+  id: string;
+  key?: string;
+  scope?: string;
+}
+
+/**
+ * The instance nodes an entity names, given its own key `name`: the
+ * duck-typed `instances` list when it carries one (full ids, which an
+ * instance under an expanded module call needs, #4486), else one per
+ * {@link entityInstanceKeys} key, id `<name><key>`.
+ */
+export function entityInstances(name: string, entity: Declarable): EntityInstance[] {
+  const listed = (entity as unknown as { instances?: unknown }).instances;
+  if (Array.isArray(listed)) {
+    const out: EntityInstance[] = [];
+    for (const item of listed) {
+      if (typeof item !== "object" || item === null) continue;
+      const { id, key, scope } = item as { id?: unknown; key?: unknown; scope?: unknown };
+      if (typeof id !== "string" || id.length === 0 || id === name) continue;
+      out.push({ id, ...(typeof key === "string" ? { key } : {}), ...(typeof scope === "string" ? { scope } : {}) });
+    }
+    return out;
+  }
+  return entityInstanceKeys(entity).map((key) => ({ id: `${name}${key}`, key }));
+}
+
 /** Grouping metadata for cluster/subgraph rendering. Maps group name -> node ids. */
 export interface IRGroups {
   byLexicon?: Record<string, string[]>;
@@ -517,6 +664,18 @@ export interface GraphIR {
    * (`capabilities/view.ts`). Absent unless asked for.
    */
   capabilityView?: unknown;
+  /**
+   * With `chant graph --live` (INTENTIUS/chant#4452): which read answered each
+   * root, the observation's structured {@link RootRead} report passed through
+   * as the lexicon wrote it, keyed by the lexicon's root key (terraform uses
+   * `terraform.roots.<root>`). `depth` is the read asked for, and `fellBackTo`
+   * and `reason` are set only when that read failed, so the read that answered
+   * is `fellBackTo ?? depth`. A consumer reads this and never the stderr notes
+   * that say the same thing in prose. Additive: absent when no lexicon reported
+   * one (a lexicon with one read path, a source graph, an `--at` replay), and
+   * an older chant never writes it.
+   */
+  rootReads?: Record<string, RootRead>;
 }
 
 /** A node is anything that serializes to a resource — not a property or output. */
@@ -730,7 +889,8 @@ function subEnvelope(sub: SubForm, seen: Set<unknown>, reverse: Map<object, stri
 // entity's place in the graph, not declared configuration, and both are read
 // directly, so projecting them into `attrs` would only restate an edge and a
 // group key the IR already carries.
-const SKIP_KEYS = new Set(["lexicon", "entityType", "kind", "attributes", "Ref", "references", "stack"]);
+// `facts` (#4529) is an engine's observation, carried onto `IRNode.facts`, not configuration.
+const SKIP_KEYS = new Set(["lexicon", "entityType", "kind", "attributes", "Ref", "references", "stack", "facts"]);
 
 /** The config bag of a node, paired with each key. Lexicon entities keep their
  * declared props in a (usually non-enumerable) `props` object; simpler entities
@@ -790,6 +950,7 @@ function collectEdges(
       kind: "ref",
       ...(ref.viaAttr ? { viaAttr: ref.viaAttr } : {}),
       ...(ref.toAttr ? { toAttr: ref.toAttr } : {}),
+      ...(ref.grain === "block" || ref.grain === "instance" || ref.grain === "property" ? { grain: ref.grain } : {}),
     });
   }
   const seen = new Set<unknown>();
@@ -868,7 +1029,8 @@ function collectEdges(
 
 /** Stable key for deduping and sorting an edge. */
 function edgeKey(e: IREdge): string {
-  return `${e.from}\0${e.to}\0${e.viaAttr ?? ""}`;
+  // `grain` joins the key only when set, so an edge without one keys as before.
+  return `${e.from}\0${e.to}\0${e.viaAttr ?? ""}${e.grain ? `\0${e.grain}` : ""}`;
 }
 
 /**
@@ -907,6 +1069,8 @@ export function buildGraphIr(
     if (prov?.compositeInstance) node.compositeInstance = prov.compositeInstance;
     const file = relFile(prov?.sourceFile, projectPath);
     if (file) node.sourceLoc = { file };
+    const facts = entityFacts(entity);
+    if (facts) node.facts = facts;
     nodes.push(node);
 
     (byLexicon[entity.lexicon] ??= []).push(name);
@@ -982,6 +1146,71 @@ export function buildGraphIr(
   return ir;
 }
 
+/**
+ * Add an instance node (#4454) under each node whose entity names its
+ * instances ({@link entityInstances}): id `<block id><key>`, or the full id
+ * the entity lists under an expanded module call (#4486), the
+ * block's kind, lexicon and source location, `instanceOf` and `instanceKey`,
+ * no attrs and no edges. Each instance joins every group its block is in, so
+ * a renderer draws it in the block's box. A block node whose entity carries
+ * an `instanceRollup` (#4489) gets it. Pure. Returns `ir` itself when no
+ * entity has instance keys or a rollup, so a graph with none prints what it
+ * did before.
+ *
+ * Called by `chant graph` and the declared half of `--live`, not by
+ * {@link buildGraphIr}, so `chant search`, which reads the base IR, still
+ * counts blocks.
+ */
+export function withInstanceNodes(ir: GraphIR, entities: ReadonlyMap<string, Declarable>): GraphIR {
+  const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+  const added: IRNode[] = [];
+  const childrenOf = new Map<string, string[]>();
+  const rolledUp = new Map<string, InstanceRollup>();
+  for (const [name, entity] of entities) {
+    const block = byId.get(name);
+    if (!block || block.instanceOf) continue;
+    const rollup = entityInstanceRollup(entity);
+    if (rollup) rolledUp.set(name, rollup);
+    for (const { id, key, scope } of entityInstances(name, entity)) {
+      if (byId.has(id)) continue;
+      const node: IRNode = {
+        id,
+        kind: block.kind,
+        lexicon: block.lexicon,
+        attrs: {},
+        instanceOf: name,
+        ...(key !== undefined ? { instanceKey: key } : {}),
+        ...(scope !== undefined ? { instanceScope: scope } : {}),
+      };
+      if (block.sourceLoc) node.sourceLoc = { ...block.sourceLoc };
+      if (block.compositeParent) node.compositeParent = block.compositeParent;
+      if (block.compositeInstance) node.compositeInstance = block.compositeInstance;
+      added.push(node);
+      byId.set(id, node);
+      (childrenOf.get(name) ?? childrenOf.set(name, []).get(name)!).push(id);
+    }
+  }
+  if (added.length === 0 && rolledUp.size === 0) return ir;
+  const own = ir.nodes.map((n) => {
+    const rollup = rolledUp.get(n.id);
+    return rollup ? { ...n, instanceRollup: rollup } : n;
+  });
+  if (added.length === 0) return { ...ir, nodes: own };
+  const nodes = [...own, ...added].sort((a, b) => a.id.localeCompare(b.id));
+  const withChildren = (rec: Record<string, string[]> | undefined): Record<string, string[]> | undefined => {
+    if (!rec) return rec;
+    const out: Record<string, string[]> = {};
+    for (const [k, ids] of Object.entries(rec)) out[k] = [...ids, ...ids.flatMap((id) => childrenOf.get(id) ?? [])].sort();
+    return out;
+  };
+  const groups: IRGroups = { ...ir.groups };
+  for (const key of ["byLexicon", "byComposite", "byStack"] as const) {
+    const grown = withChildren(ir.groups[key]);
+    if (grown) groups[key] = grown;
+  }
+  return { ...ir, nodes, groups };
+}
+
 /**
  * Add what the lexicons' `graphEdges` hooks reported (#3910) to a built IR.
  *
@@ -1152,10 +1381,39 @@ export function buildLiveGraphIr(observations: LiveObservation[]): GraphIR {
       // ownership above, since `unowned`/`foreign`/`unknown` all mean "no
       // declared owner", which is simply the absence of this field.
       if (meta.ownerChain?.root === "declared") node.runtimeOwner = meta.ownerChain.entity;
+      // An engine's facts (#4527) ride beside `physicalId`, as the engine gave them.
+      if (meta.facts) node.facts = meta.facts;
       nodes.push(node);
       (byLexicon[lexicon] ??= []).push(name);
       // A live lexicon maps to one deployable stack, same as the source IR.
       (byStack[lexicon] ??= []).push(name);
+      // Each present instance of a `count` or `for_each` block is a node of
+      // its own under the block's (#4454), so the overlay paints it alone.
+      // The block node above is the rollup. An absent or not-observed
+      // instance is no live node: the overlay reads that off `instances`.
+      // Under an expanded module call the id follows the declared graph's
+      // rule (#4486, #4488), `estate/module.app[0]/aws_eip.pool[1]`, with
+      // `instanceScope` and no `instanceKey` when only the call is expanded.
+      for (const inst of meta.instances ?? []) {
+        if (inst.verdict !== "present") continue;
+        const id = observedInstanceNodeId(name, inst);
+        if (id === undefined) continue;
+        const child: IRNode = {
+          id,
+          kind: meta.type,
+          lexicon,
+          attrs: { address: inst.address, ...(inst.status ? { status: inst.status } : {}) },
+          instanceOf: name,
+          ...(inst.key !== undefined ? { instanceKey: inst.key } : {}),
+          ...(inst.scope !== undefined ? { instanceScope: inst.scope } : {}),
+        };
+        if (inst.physicalId) child.physicalId = inst.physicalId;
+        if (inst.ownership === "owned" || inst.ownership === "foreign") child.ownership = inst.ownership;
+        if (inst.facts) child.facts = inst.facts;
+        nodes.push(child);
+        (byLexicon[lexicon] ??= []).push(id);
+        (byStack[lexicon] ??= []).push(id);
+      }
     }
   }
 
@@ -1178,7 +1436,9 @@ export function buildLiveGraphIr(observations: LiveObservation[]): GraphIR {
   for (const observation of observations) {
     for (const edge of observation.edges ?? []) {
       if (!observedIds.has(edge.from) || !observedIds.has(edge.to)) continue;
-      const key = `${edge.from}\u0000${edge.to}\u0000${edge.viaAttr ?? ""}\u0000${edge.toAttr ?? ""}`;
+      // `grain` is in the key (#4527): a block edge and an instance edge
+      // between the same pair stay two edges.
+      const key = `${edge.from}\u0000${edge.to}\u0000${edge.viaAttr ?? ""}\u0000${edge.toAttr ?? ""}\u0000${edge.grain ?? ""}`;
       if (seen.has(key)) continue;
       seen.add(key);
       edges.push(edge);
@@ -1188,7 +1448,8 @@ export function buildLiveGraphIr(observations: LiveObservation[]): GraphIR {
     (a, b) =>
       a.from.localeCompare(b.from) ||
       a.to.localeCompare(b.to) ||
-      (a.viaAttr ?? "").localeCompare(b.viaAttr ?? ""),
+      (a.viaAttr ?? "").localeCompare(b.viaAttr ?? "") ||
+      (a.grain ?? "").localeCompare(b.grain ?? ""),
   );
 
   // Stack exports (#1279) land on the IR's `exports`, the same place the
@@ -1226,17 +1487,48 @@ export function collectUnobserved(observations: LiveObservation[]): Record<strin
  * `runtime` = live, undeclared, owner chain reaches a declared entity (#1077). */
 type OverlayNodeStatus = "good" | "warn" | "accent" | "neutral" | "runtime";
 
+/**
+ * The overlay paint on one node. `_ownership` (#4534, behold#906 Q2) is
+ * chant's own marker verdict, {@link IRNode.ownership}, beside `_status`, so
+ * `chant search` answers ownership with no grammar of its own:
+ * `attr:_ownership=foreign`, `--show _ownership`, `--count-by attr:_ownership`.
+ * It is `owned` or `foreign`; absent means unknown (no marker channel on the
+ * read, or a node nobody observed). It never reads `facts.ownership`, the
+ * engine's verdict, which stays for display (#4520 Q1).
+ */
 function tagStatus(n: IRNode, status: OverlayNodeStatus, unobserved?: UnobservedEntity): IRNode {
   return {
     ...n,
     attrs: {
       ...n.attrs,
       _status: status,
+      ...(n.ownership ? { _ownership: n.ownership } : {}),
       ...(unobserved ? { _unobserved: unobserved.reason } : {}),
     },
   };
 }
 
+/**
+ * The paint for a declared instance node (#4454) the live graph has no node
+ * for. Its block not observed: `neutral` with the block's reason, since the
+ * rollup put the whole block there. Its block live with instances read: the
+ * instance is not among them, so `accent`, pending. Its block live with no
+ * instance read at all: `neutral`, since nothing said either way. Its block
+ * absent: `accent`, like the block.
+ */
+function missingInstance(n: IRNode, live: ReadonlySet<string>, read: ReadonlySet<string>, unobserved: Record<string, UnobservedEntity>): IRNode {
+  const block = n.instanceOf!;
+  const u = unobserved[n.id] ?? unobserved[block];
+  if (u) return tagStatus(n, "neutral", u);
+  if (live.has(block) && !read.has(block)) return tagStatus(n, "neutral");
+  return tagStatus(n, "accent");
+}
+
+/** The block ids some live instance node names (#4454): the blocks whose read reported instances. */
+function blocksWithInstances(live: GraphIR): Set<string> {
+  return new Set(live.nodes.map((n) => n.instanceOf).filter((b): b is string => b !== undefined));
+}
+
 /**
  * Overlay the declared graph on the provisioned one (#780, `chant graph --live
  * --overlay`) and classify each resource, tagging a `_status` a renderer colours:
@@ -1256,8 +1548,13 @@ export function overlayGraphs(live: GraphIR, declared: GraphIR, opts?: OverlayOp
   const liveIds = new Set(live.nodes.map((n) => n.id));
   const unobserved = opts?.unobserved ?? {};
 
+  const read = blocksWithInstances(live);
+
   const nodes: IRNode[] = live.nodes.map((n) => {
     const d = declaredById.get(n.id);
+    // A live instance of a declared block whose expansion the source could
+    // not count (`count = var.n`) is managed, never foreign (#4454).
+    if (!d && n.instanceOf && declaredById.has(n.instanceOf)) return tagStatus(n, "good");
     if (!d) return tagStatus(n, n.runtimeOwner ? "runtime" : "warn");
     // A managed node keeps the composite it was declared in, so `--detail 1`
     // collapses it with its siblings and rolls their status up (#4227).
@@ -1269,6 +1566,10 @@ export function overlayGraphs(live: GraphIR, declared: GraphIR, opts?: OverlayOp
   });
   for (const n of declared.nodes) {
     if (liveIds.has(n.id)) continue;
+    if (n.instanceOf) {
+      nodes.push(missingInstance(n, liveIds, read, unobserved));
+      continue;
+    }
     const u = unobserved[n.id];
     nodes.push(u ? tagStatus(n, "neutral", u) : tagStatus(n, "accent"));
   }
@@ -1287,7 +1588,7 @@ export function overlayGraphs(live: GraphIR, declared: GraphIR, opts?: OverlayOp
  *
  * Each declared node is classified against live observation and tagged `_status`:
  *   - **managed** (declared + provisioned) → `good`, carrying the observed
- *     `physicalId` / `ownership` onto the declared node
+ *     `physicalId` / `ownership` / engine `facts` onto the declared node
  *   - **pending** (declared, provider confirmed absent) → `accent`
  *   - **unobserved** (declared, chant could not look — #1089) → `neutral`, with
  *     the reason on `_unobserved`. A wrong-cluster or unsupported-kind read used
@@ -1302,12 +1603,19 @@ export function overlayGraphs(live: GraphIR, declared: GraphIR, opts?: OverlayOp
  */
 export function sourceOverlayGraphs(declared: GraphIR, live: GraphIR, opts?: OverlayOptions): GraphIR {
   const liveById = new Map(live.nodes.map((n) => [n.id, n]));
+  const liveIds = new Set(liveById.keys());
   const declaredIds = new Set(declared.nodes.map((n) => n.id));
-  const foreignIds = new Set(live.nodes.filter((n) => !declaredIds.has(n.id)).map((n) => n.id));
+  // A live instance of a declared block (#4454) the source could not count
+  // is managed: appended `good`, and never foreign.
+  const managedInstances = live.nodes.filter((n) => !declaredIds.has(n.id) && n.instanceOf !== undefined && declaredIds.has(n.instanceOf));
+  const managedInstanceIds = new Set(managedInstances.map((n) => n.id));
+  const foreignIds = new Set(live.nodes.filter((n) => !declaredIds.has(n.id) && !managedInstanceIds.has(n.id)).map((n) => n.id));
   const unobserved = opts?.unobserved ?? {};
+  const read = blocksWithInstances(live);
 
   const nodes: IRNode[] = declared.nodes.map((n) => {
     const obs = liveById.get(n.id);
+    if (!obs && n.instanceOf) return missingInstance(n, liveIds, read, unobserved);
     if (!obs) {
       const u = unobserved[n.id];
       // unobserved — declared, and nobody looked; not "pending"
@@ -1316,6 +1624,7 @@ export function sourceOverlayGraphs(declared: GraphIR, live: GraphIR, opts?: Ove
     const merged: IRNode = { ...n }; // managed — carry the observed identity
     if (obs.physicalId) merged.physicalId = obs.physicalId;
     if (obs.ownership) merged.ownership = obs.ownership;
+    if (obs.facts) merged.facts = obs.facts;
     // ...and what was observed ABOUT it (#1279). The declared canvas holds what
     // the source says; the observation holds what the account says, and a fact
     // like `VpcId` exists only on the second. Dropping it here made every
@@ -1334,6 +1643,7 @@ export function sourceOverlayGraphs(declared: GraphIR, live: GraphIR, opts?: Ove
     if (!foreignIds.has(n.id)) continue;
     nodes.push(tagStatus(n, n.runtimeOwner ? "runtime" : "warn")); // runtime child or foreign
   }
+  for (const n of managedInstances) nodes.push(tagStatus(n, "good"));
   nodes.sort((a, b) => a.id.localeCompare(b.id));
 
   // Declared edges are the canvas (the cross-substrate topology). Add only the