@intentius/chant 0.27.0 → 0.29.0

package/src/cli/commands/lint.ts

@@ -18,8 +18,7 @@ import { formatError, formatInfo } from "../format";
 import { GENERATED_MARKER } from "../../discovery/files";
 
 // Import config loader
-import { loadConfig, resolveRulesForFile, parseRuleConfig, findProjectRoot } from "../../lint/config";
-import type { RuleConfig } from "../../lint/rule";
+import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
 
 /**
  * Type guard to check if a value conforms to the LintRule interface.
@@ -263,28 +262,22 @@ function getDefaultRules(
   const ruleOptions = new Map<string, Record<string, unknown>>();
 
   for (const [ruleId, rule] of allRules) {
-    const configValue: RuleConfig | undefined = effectiveRules?.[ruleId];
-
-    if (configValue === undefined) {
-      // Rule not mentioned in config — include with default severity
-      rules.push(rule);
-      continue;
-    }
-
-    const parsed = parseRuleConfig(configValue);
+    // chant #1138 — the same resolution post-synth checks and COMP* checks
+    // now go through too (`resolveConfiguredSeverity`, ../../lint/config.ts),
+    // so `lint.rules: { ID: "off" }` suppresses a rule id identically no
+    // matter which phase produced it.
+    const { severity, options } = resolveConfiguredSeverity(effectiveRules, ruleId, rule.severity);
 
     // Skip rules that are explicitly turned off
-    if (parsed.severity === "off") continue;
+    if (severity === "off") continue;
 
-    // Override severity from config
-    rules.push({
-      ...rule,
-      severity: parsed.severity as "error" | "warning" | "info",
-    });
+    // Override severity from config (a no-op when the rule wasn't mentioned —
+    // `severity` is then just `rule.severity` again)
+    rules.push({ ...rule, severity });
 
     // Store options if present
-    if (parsed.options) {
-      ruleOptions.set(ruleId, parsed.options);
+    if (options) {
+      ruleOptions.set(ruleId, options);
     }
   }
 
@@ -394,12 +387,11 @@ async function runComponentCheckDiagnostics(
     // Discovery errors (COMP000) always surface at error severity — not user-configurable.
     let severity = d.severity;
     if (d.checkId !== "COMP000") {
-      const configValue = config.rules?.[d.checkId];
-      if (configValue !== undefined) {
-        const parsed = parseRuleConfig(configValue);
-        if (parsed.severity === "off") continue;
-        severity = parsed.severity;
-      }
+      // chant #1138 — same resolution function AST rules and post-synth
+      // checks use (`resolveConfiguredSeverity`, ../../lint/config.ts).
+      const resolved = resolveConfiguredSeverity(config.rules, d.checkId, d.severity);
+      if (resolved.severity === "off") continue;
+      severity = resolved.severity;
     }
 
     const disable = fileLevelDisable(d.file, d.checkId);

package/src/cli/handlers/components.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
 import { createMockPlugin, staticDescribeResources } from "@intentius/chant-test-utils";
 import type { LexiconPlugin, ResourceMetadata } from "../../lexicon";
 import type { BuildResult } from "../../build";
@@ -38,9 +38,13 @@ vi.mock("../../lifecycle/release-ledger", async () => {
   };
 });
 
-vi.mock("../../config", () => ({
-  loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
-}));
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return {
+    ...actual,
+    loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args),
+  };
+});
 
 vi.mock("../../build", () => ({
   build: (...args: unknown[]) => buildMock(...args),
@@ -267,6 +271,61 @@ describe("components handlers", () => {
       expect(rows[0]).toMatchObject({ component: "svc", reconciliation: "reconciled" });
     });
 
+    // #1166 — an environment can declare its own endpoint (a local emulator
+    // like Floci), applied here unless the ambient shell already set it, so
+    // `--live` status doesn't silently read the wrong account.
+    describe("declared endpoint (#1166)", () => {
+      const prevEndpoint = process.env.AWS_ENDPOINT_URL;
+
+      afterEach(() => {
+        if (prevEndpoint === undefined) delete process.env.AWS_ENDPOINT_URL;
+        else process.env.AWS_ENDPOINT_URL = prevEndpoint;
+      });
+
+      test("applies the declared endpoint to AWS_ENDPOINT_URL for the live describe, then restores it", async () => {
+        delete process.env.AWS_ENDPOINT_URL;
+        readReleaseLedgerMock.mockResolvedValue({
+          records: [{
+            version: 1,
+            component: "svc",
+            env: "floci",
+            digest: "sha256:abc",
+            gitSha: "sha1",
+            runId: "run-1",
+            timestamp: "2026-01-01T00:00:00.000Z",
+            actor: "alice",
+          }],
+          malformed: 0,
+        });
+        buildMock.mockResolvedValue(makeBuildResult({ aws: ["svc"] }));
+        loadChantConfigMock.mockResolvedValue({
+          config: { environments: [{ name: "floci", endpoint: "http://localhost:4566" }] },
+        });
+
+        let seenDuringDescribe: string | undefined;
+        const plugins: LexiconPlugin[] = [
+          createMockPlugin({
+            name: "aws",
+            describeResources: async () => {
+              seenDuringDescribe = process.env.AWS_ENDPOINT_URL;
+              return { svc: meta() };
+            },
+          }),
+        ];
+
+        const ctx = {
+          args: makeArgs({ extraPositional: "floci", live: true, json: true }),
+          plugins,
+          serializers: plugins.map((p) => p.serializer),
+        };
+        const exit = await runComponentsStatus(ctx);
+        expect(exit).toBe(0);
+        expect(seenDuringDescribe).toBe("http://localhost:4566");
+        expect(process.env.AWS_ENDPOINT_URL).toBeUndefined();
+        expect(stderrBuf.join("\n")).toMatch(/environment "floci" declares endpoint http:\/\/localhost:4566/);
+      });
+    });
+
     test("--live flags an unrecorded live+owned component", async () => {
       readReleaseLedgerMock.mockResolvedValue({ records: [], malformed: 0 });
       listReleaseEnvironmentsMock.mockResolvedValue(["prod"]);

package/src/cli/handlers/components.ts

@@ -40,11 +40,13 @@ import { buildLedgerEntries, componentBomSummary, type BuildLedgerEntry } from "
 import { findBuildManifestByArtifactDigest } from "../../lifecycle/build-ledger-store";
 import type { ComponentBomSummary } from "../../lifecycle/build-ledger";
 import { loadChantConfig } from "../../config";
+import { applyLiveEndpoint } from "../../live-endpoint";
 import { build } from "../../build";
 import { discoverComponents } from "../../components/discover";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
-import type { ResourceMetadata, LexiconPlugin } from "../../lexicon";
+import type { LexiconPlugin } from "../../lexicon";
+import { normalizeObservation, unobservedAll, type NormalizedObservation } from "../../observation";
 import type { Phase, Component } from "../../components/component";
 
 /**
@@ -177,7 +179,10 @@ interface StatusJsonRow {
   } | null;
   reconciliation: string;
   detail: string;
+  /** Present only when live state was requested AND read (#1089) — see `unobserved`. */
   live?: boolean;
+  /** Why live state could not be read for this component (#1089). Mutually exclusive with `live`. */
+  unobserved?: { reason: string; detail?: string };
   stack?: { name: string; status?: string; healthy?: boolean };
 }
 
@@ -248,7 +253,20 @@ async function observeComponentStacks(
       stacks.map((stack) => observer.describeStackStatus!({ environment, stack }).catch(() => null)),
     );
     const determinate = observed.filter((o): o is NonNullable<typeof o> => o !== null);
-    if (determinate.length === 0) continue;
+    if (determinate.length === 0) {
+      // Every stack read came back indeterminate (the lexicon's own "I cannot
+      // tell" — see describeStackStatus). Record the hole rather than dropping
+      // the component, which would leave a recorded component reading `stale`
+      // (#1089).
+      evidence.set(name, {
+        live: false,
+        unobserved: {
+          reason: "read-failed",
+          detail: `no determinate status for stack(s): ${stacks.join(", ")}`,
+        },
+      });
+      continue;
+    }
     const present = determinate.every((o) => o.present);
     // Surface the (first present, else first) stack's raw status for a richer
     // palette than the reconciliation verdict. One cfn-deploy stack per component
@@ -310,42 +328,66 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
 
     let liveEvidence;
     if (args.live) {
-      const targetSerializers = serializers;
-      const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers);
-      const merged: { env: string; entries: import("../../lifecycle/change-set").ChangeSetEntry[] } = { env: environment, entries: [] };
-      for (const plugin of plugins) {
-        if (!plugin.describeResources) continue;
-        const declared = new Set<string>();
-        const entities = new Map<string, { entityType: string; props: Record<string, unknown> }>();
-        for (const [name, entity] of buildResult.entities) {
-          if (entity.lexicon === plugin.name) {
-            declared.add(name);
-            entities.set(name, {
-              entityType: entity.entityType,
-              props: ("props" in entity && entity.props != null ? entity.props : {}) as Record<string, unknown>,
-            });
+      // #1166 — an environment can declare its own endpoint (a local emulator
+      // like Floci), applied here unless the ambient shell already set it, so
+      // `--live` status doesn't silently read the wrong account per environment.
+      const endpointResult = applyLiveEndpoint(
+        config.environments,
+        environment,
+        plugins.filter((p) => p.describeResources || p.describeStackStatus).map((p) => p.name),
+      );
+      if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
+      try {
+        const targetSerializers = serializers;
+        const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers);
+        const merged: { env: string; entries: import("../../lifecycle/change-set").ChangeSetEntry[] } = { env: environment, entries: [] };
+        for (const plugin of plugins) {
+          if (!plugin.describeResources) continue;
+          const declared = new Set<string>();
+          const entities = new Map<string, { entityType: string; props: Record<string, unknown> }>();
+          for (const [name, entity] of buildResult.entities) {
+            if (entity.lexicon === plugin.name) {
+              declared.add(name);
+              entities.set(name, {
+                entityType: entity.entityType,
+                props: ("props" in entity && entity.props != null ? entity.props : {}) as Record<string, unknown>,
+              });
+            }
           }
+          let observed: NormalizedObservation;
+          try {
+            observed = normalizeObservation(
+              await plugin.describeResources({ environment, buildOutput: "", entityNames: Array.from(declared), entities }),
+            );
+          } catch (err) {
+            // A failed read is not an empty environment (#1089): mark every
+            // declared entity NOT-OBSERVED so the status rows say "unknown"
+            // rather than "stale" (recorded, and nothing live).
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(formatWarning({ message: `${plugin.name}: describeResources failed — ${message} (components in this lexicon report unknown, not stale)` }));
+            observed = { resources: {}, unobserved: unobservedAll(declared, "read-failed", message, entities) };
+          }
+          const cs = buildChangeSet(environment, {
+            declared,
+            observedNow: observed.resources,
+            observedThen: undefined,
+            unobserved: observed.unobserved,
+          });
+          merged.entries.push(...cs.entries);
         }
-        let observedNow: Record<string, ResourceMetadata>;
-        try {
-          observedNow = await plugin.describeResources({ environment, buildOutput: "", entityNames: Array.from(declared), entities });
-        } catch (err) {
-          console.error(formatWarning({ message: `${plugin.name}: describeResources failed — ${err instanceof Error ? err.message : String(err)}` }));
-          continue;
-        }
-        const cs = buildChangeSet(environment, { declared, observedNow, observedThen: undefined });
-        merged.entries.push(...cs.entries);
-      }
-      liveEvidence = liveEvidenceFromChangeSet(merged, liveNameMapping);
+        liveEvidence = liveEvidenceFromChangeSet(merged, liveNameMapping);
 
-      // Multi-stack component projects (each component owns its own stack) are
-      // invisible to the entity-keyed, single-stack `describeResources` above —
-      // observe each component's own cfn-deploy stack directly and overlay it as
-      // the authoritative presence signal (#57).
-      const stackObserver = plugins.find((p) => p.describeStackStatus);
-      if (stackObserver) {
-        const stackEvidence = await observeComponentStacks(discovery.components, stackObserver, environment);
-        liveEvidence = mergeLiveEvidence(liveEvidence, stackEvidence);
+        // Multi-stack component projects (each component owns its own stack) are
+        // invisible to the entity-keyed, single-stack `describeResources` above —
+        // observe each component's own cfn-deploy stack directly and overlay it as
+        // the authoritative presence signal (#57).
+        const stackObserver = plugins.find((p) => p.describeStackStatus);
+        if (stackObserver) {
+          const stackEvidence = await observeComponentStacks(discovery.components, stackObserver, environment);
+          liveEvidence = mergeLiveEvidence(liveEvidence, stackEvidence);
+        }
+      } finally {
+        endpointResult.restore();
       }
     }
 
@@ -420,6 +462,7 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
         reconciliation: row.reconciliation,
         detail: row.detail,
         ...(row.live !== undefined ? { live: row.live } : {}),
+        ...(row.unobserved ? { unobserved: row.unobserved } : {}),
         ...(row.stack ? { stack: row.stack } : {}),
       });
     }

package/src/cli/handlers/graph.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
 import type { ParsedArgs } from "../registry";
 import { DECLARABLE_MARKER, type Declarable } from "../../declarable";
 import { AttrRef } from "../../attrref";
@@ -52,9 +52,14 @@ const discoverComponentsMock = vi.fn();
 vi.mock("../../components/discover", () => ({
   discoverComponents: (...a: unknown[]) => discoverComponentsMock(...a),
 }));
-vi.mock("../../config", () => ({
-  loadChantConfig: () => Promise.resolve({ config: {} }),
-}));
+const loadChantConfigMock = vi.fn();
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return {
+    ...actual,
+    loadChantConfig: (...a: unknown[]) => loadChantConfigMock(...a),
+  };
+});
 vi.mock("../../build", () => ({
   build: () => Promise.resolve({ errors: [] }),
   partitionByLexicon: () => ({}),
@@ -107,6 +112,8 @@ describe("runGraph", () => {
     observeMock.mockReset();
     loadPluginsMock.mockReset();
     resolveLexMock.mockReset();
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({ config: {} });
   });
 
   describe("Op graph (default)", () => {
@@ -332,6 +339,7 @@ describe("runGraph", () => {
       observeMock.mockResolvedValue({
         observations: [{ lexicon: "aws", resources: { "web-vpc": { type: "AWS::EC2::VPC", status: "OK" } } }],
         errors: [],
+        warnings: [],
       });
       const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "prod" }), plugins: [], serializers: [] });
       expect(exit).toBe(0);
@@ -349,7 +357,7 @@ describe("runGraph", () => {
       loadPluginsMock.mockResolvedValue([
         { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
       ]);
-      observeMock.mockResolvedValue({ observations: [], errors: [] });
+      observeMock.mockResolvedValue({ observations: [], errors: [], warnings: [] });
       const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "prod" }), plugins: [], serializers: [] });
       expect(exit).toBe(0);
       expect(observeMock).toHaveBeenCalledWith("prod", expect.anything(), expect.anything(), {
@@ -390,6 +398,7 @@ describe("runGraph", () => {
       observeMock.mockResolvedValue({
         observations: [{ lexicon: "aws", resources: { "loom-db": { type: "AWS::RDS::DBInstance", status: "OK" } } }],
         errors: [],
+        warnings: [],
       });
       const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "local" }), plugins: [], serializers: [] });
       expect(exit).toBe(0);
@@ -409,7 +418,7 @@ describe("runGraph", () => {
         { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
       ]);
       discoverComponentsMock.mockResolvedValue({ errors: [{ message: "bad component" }], sourceFiles: [], components: new Map() });
-      observeMock.mockResolvedValue({ observations: [], errors: [] });
+      observeMock.mockResolvedValue({ observations: [], errors: [], warnings: [] });
       const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "prod" }), plugins: [], serializers: [] });
       expect(exit).toBe(0);
       expect(observeMock).toHaveBeenCalledWith("prod", expect.anything(), expect.anything(), {
@@ -418,5 +427,59 @@ describe("runGraph", () => {
       });
       expect(stderrBuf.join("\n")).toMatch(/component discovery failed/i);
     });
+
+    // #1166 — an environment can declare its own endpoint (a local emulator
+    // like Floci), so `--live --env floci` observes the right target even when
+    // the ambient shell never exported AWS_ENDPOINT_URL.
+    describe("declared endpoint (#1166)", () => {
+      const prevEndpoint = process.env.AWS_ENDPOINT_URL;
+
+      afterEach(() => {
+        if (prevEndpoint === undefined) delete process.env.AWS_ENDPOINT_URL;
+        else process.env.AWS_ENDPOINT_URL = prevEndpoint;
+      });
+
+      test("applies the declared endpoint to AWS_ENDPOINT_URL for the observe call, then restores it", async () => {
+        delete process.env.AWS_ENDPOINT_URL;
+        loadChantConfigMock.mockResolvedValue({
+          config: { environments: [{ name: "floci", endpoint: "http://localhost:4566" }] },
+        });
+        resolveLexMock.mockResolvedValue(["aws"]);
+        loadPluginsMock.mockResolvedValue([
+          { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        ]);
+        let seenDuringObserve: string | undefined;
+        observeMock.mockImplementation(async () => {
+          seenDuringObserve = process.env.AWS_ENDPOINT_URL;
+          return { observations: [], errors: [], warnings: [] };
+        });
+        const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "floci" }), plugins: [], serializers: [] });
+        expect(exit).toBe(0);
+        expect(seenDuringObserve).toBe("http://localhost:4566");
+        expect(process.env.AWS_ENDPOINT_URL).toBeUndefined(); // restored after the read
+        expect(stderrBuf.join("\n")).toMatch(/environment "floci" declares endpoint http:\/\/localhost:4566/);
+      });
+
+      test("ambient AWS_ENDPOINT_URL still wins when already set", async () => {
+        process.env.AWS_ENDPOINT_URL = "http://real-endpoint.example";
+        loadChantConfigMock.mockResolvedValue({
+          config: { environments: [{ name: "floci", endpoint: "http://localhost:4566" }] },
+        });
+        resolveLexMock.mockResolvedValue(["aws"]);
+        loadPluginsMock.mockResolvedValue([
+          { name: "aws", serializer: {}, describeResources: () => Promise.resolve({}) },
+        ]);
+        let seenDuringObserve: string | undefined;
+        observeMock.mockImplementation(async () => {
+          seenDuringObserve = process.env.AWS_ENDPOINT_URL;
+          return { observations: [], errors: [], warnings: [] };
+        });
+        const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "floci" }), plugins: [], serializers: [] });
+        expect(exit).toBe(0);
+        expect(seenDuringObserve).toBe("http://real-endpoint.example"); // ambient wins
+        expect(process.env.AWS_ENDPOINT_URL).toBe("http://real-endpoint.example"); // untouched
+        expect(stderrBuf.join("\n")).toMatch(/ambient AWS_ENDPOINT_URL already set/);
+      });
+    });
   });
 });

package/src/cli/handlers/graph.ts

@@ -2,10 +2,11 @@ import { resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
 import { discover } from "../../discovery/index";
 import { partitionByLexicon, computeStackGraph, build } from "../../build";
-import { buildGraphIr, buildLiveGraphIr, overlayGraphs, sourceOverlayGraphs, type GraphIR } from "../../graph-ir";
+import { buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, type GraphIR, type LiveObservation } from "../../graph-ir";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
 import { observeResources } from "../../lifecycle/observe";
-import { loadChantConfig } from "../../config";
+import { loadChantConfig, environmentNames } from "../../config";
+import { applyLiveEndpoint } from "../../live-endpoint";
 import { applyDetail, type DetailLevel } from "../../graph-detail";
 import { applyLens, parseLens } from "../../graph-lens";
 import { toMermaid } from "../../graph-mermaid";
@@ -76,10 +77,11 @@ async function runGraphLive(
   // lexicon), so `ctx.plugins` is empty. The live path needs the project's
   // observation plugins — load them here, mirroring the lifecycle handlers.
   const plugins = ctx.plugins.length > 0 ? ctx.plugins : await loadPlugins(await resolveProjectLexicons(projectPath));
-  if (config.environments && !config.environments.includes(environment)) {
+  const declaredEnvNames = environmentNames(config.environments);
+  if (declaredEnvNames && !declaredEnvNames.includes(environment)) {
     console.error(formatError({
       message: `Unknown environment "${environment}"`,
-      hint: `Defined environments: ${config.environments.join(", ")}`,
+      hint: `Defined environments: ${declaredEnvNames.join(", ")}`,
     }));
     return 1;
   }
@@ -121,30 +123,58 @@ async function runGraphLive(
     console.error(formatWarning({ message: "component discovery failed — observing the single-stack convention instead" }));
   }
 
-  const { observations, errors } = await observeResources(environment, observing, buildResult, {
-    owned: true,
-    stacks: [...stacks],
-  });
-  for (const e of errors) console.error(formatWarning({ message: e }));
+  // #1166 — an environment can declare its own endpoint (a local emulator like
+  // Floci), so this read is self-sufficient even when the ambient shell never
+  // exported e.g. AWS_ENDPOINT_URL. Ambient always wins when it's already set.
+  // Scoped to just this describe/enrich pass — restored in `finally` so it
+  // never leaks into a later invocation in the same process.
+  const endpointResult = applyLiveEndpoint(config.environments, environment, observing.map((p) => p.name));
+  if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
 
-  let ir: GraphIR = buildLiveGraphIr(observations);
+  let ir: GraphIR;
+  let observations: LiveObservation[];
+  try {
+    const observeResult = await observeResources(environment, observing, buildResult, {
+      owned: true,
+      stacks: [...stacks],
+    });
+    observations = observeResult.observations;
+    const { errors, warnings } = observeResult;
+    for (const e of errors) console.error(formatWarning({ message: e }));
+    // Unobserved entities (#1089) arrive as warnings — a node missing from the
+    // live graph because nobody looked is a different fact from one that isn't
+    // deployed, and the diagram alone cannot say which. Capped: an estate with no
+    // ownership markers can produce one per declared entity, and a wall of them
+    // buries the graph output. The full list is `lifecycle diff --live`.
+    const WARN_CAP = 5;
+    for (const w of warnings.slice(0, WARN_CAP)) console.error(formatWarning({ message: w }));
+    if (warnings.length > WARN_CAP) {
+      console.error(formatWarning({
+        message: `... and ${warnings.length - WARN_CAP} more entity(ies) not observed — run \`chant lifecycle diff ${environment} --live\` for the full list`,
+      }));
+    }
 
-  // Enrich node attrs from the fuller live config (#784) so references are
-  // present for edge reconstruction — describeResources metadata alone is often
-  // too thin (e.g. AWS returns stack outputs, not per-resource references).
-  for (const p of observing) {
-    if (!p.enrichLiveAttrs) continue;
-    try {
-      const enriched = await p.enrichLiveAttrs({ environment, owned: true });
-      ir = {
-        ...ir,
-        nodes: ir.nodes.map((n) =>
-          n.lexicon === p.name && enriched[n.id] ? { ...n, attrs: { ...n.attrs, ...enriched[n.id] } } : n,
-        ),
-      };
-    } catch (err) {
-      console.error(formatWarning({ message: `${p.name}: live attr enrichment failed — edges may be sparse (${err instanceof Error ? err.message : String(err)})` }));
+    ir = buildLiveGraphIr(observations);
+
+    // Enrich node attrs from the fuller live config (#784) so references are
+    // present for edge reconstruction — describeResources metadata alone is often
+    // too thin (e.g. AWS returns stack outputs, not per-resource references).
+    for (const p of observing) {
+      if (!p.enrichLiveAttrs) continue;
+      try {
+        const enriched = await p.enrichLiveAttrs({ environment, owned: true });
+        ir = {
+          ...ir,
+          nodes: ir.nodes.map((n) =>
+            n.lexicon === p.name && enriched[n.id] ? { ...n, attrs: { ...n.attrs, ...enriched[n.id] } } : n,
+          ),
+        };
+      } catch (err) {
+        console.error(formatWarning({ message: `${p.name}: live attr enrichment failed — edges may be sparse (${err instanceof Error ? err.message : String(err)})` }));
+      }
     }
+  } finally {
+    endpointResult.restore();
   }
 
   // Reconstruct edges + containment from live references (#778): merge the
@@ -166,10 +196,14 @@ async function runGraphLive(
     const declared = await discover(resolve(args.src ?? config.sourceDir ?? "."));
     if (declared.errors.length === 0) {
       const declaredIr = buildGraphIr(declared.entities, projectPath);
+      // Declared nodes chant could not read are painted `neutral`, not
+      // `accent`/pending (#1089) — a wrong-cluster or unsupported-kind read
+      // must not draw the estate as "not deployed yet".
+      const overlayOpts = { unobserved: collectUnobserved(observations) };
       ir =
         args.overlayAnchor === "live"
-          ? overlayGraphs(ir, declaredIr)
-          : sourceOverlayGraphs(declaredIr, ir);
+          ? overlayGraphs(ir, declaredIr, overlayOpts)
+          : sourceOverlayGraphs(declaredIr, ir, overlayOpts);
     } else {
       console.error(formatWarning({ message: "overlay: source has discovery errors — showing the provisioned graph without the declared overlay" }));
     }