@intentius/chant 0.30.0 → 0.32.0

package/src/lifecycle/change-set.test.ts

@@ -106,6 +106,77 @@ describe("buildChangeSet (#118)", () => {
     expect(cs.entries.filter((e) => e.action === "adopt").map((e) => e.name)).toEqual(["b", "c"]);
   });
 
+  // ── Owner-reference chain classification (#1077) ──────────────────────────
+
+  test("undeclared, owner chain reaches a declared entity → runtime, never delete or adopt", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["web"]),
+      observedNow: {
+        web: meta({ type: "K8s::Apps::Deployment" }),
+        "prod/web-abc": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+      },
+      observedThen: undefined,
+    });
+    const e = cs.entries.find((x) => x.name === "prod/web-abc")!;
+    expect(e.action).toBe("runtime");
+    expect(e.runtimeOwner).toBe("web");
+  });
+
+  test("a runtime child that also carries chant's own ownership marker is still `runtime`, never `delete`", () => {
+    // Guards the ordering in buildChangeSet: runtimeOwner must be checked
+    // before the ownership marker, in case a runtime child ever inherits the
+    // marker (e.g. label propagation from its owner's pod template).
+    const cs = buildChangeSet("prod", {
+      declared: new Set(),
+      observedNow: {
+        "prod/web-abc": meta({ ownership: "owned", ownerChain: { root: "declared", entity: "web" } }),
+      },
+      observedThen: undefined,
+    });
+    const e = cs.entries.find((x) => x.name === "prod/web-abc")!;
+    expect(e.action).toBe("runtime");
+  });
+
+  test("undeclared, unowned → orphan/adopt, not runtime", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(),
+      observedNow: { "prod/standalone": meta({ ownerChain: { root: "unowned" } }) },
+      observedThen: undefined,
+    });
+    const e = cs.entries.find((x) => x.name === "prod/standalone")!;
+    expect(e.action).toBe("adopt");
+    expect(e.runtimeOwner).toBeUndefined();
+  });
+
+  test("undeclared, foreign root → orphan/adopt, not runtime", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(),
+      observedNow: { "prod/other": meta({ ownerChain: { root: "foreign" } }) },
+      observedThen: undefined,
+    });
+    expect(cs.entries.find((x) => x.name === "prod/other")!.action).toBe("adopt");
+  });
+
+  test("undeclared, unresolved chain (unreadable/cycle/depth) → conservative adopt, not runtime", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(),
+      observedNow: { "prod/mystery": meta({ ownerChain: { root: "unknown" } }) },
+      observedThen: undefined,
+    });
+    const e = cs.entries.find((x) => x.name === "prod/mystery")!;
+    expect(e.action).toBe("adopt");
+    expect(e.runtimeOwner).toBeUndefined();
+  });
+
+  test("a lexicon with no owner chain at all is unaffected — undeclared stays adopt/delete as before", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(),
+      observedNow: { orphan: meta({ ownership: "owned" }) },
+      observedThen: undefined,
+    });
+    expect(cs.entries.find((x) => x.name === "orphan")!.action).toBe("delete");
+  });
+
   test("only in snapshot (gone now, undeclared) → noop", () => {
     const cs = buildChangeSet("prod", {
       declared: new Set(),
@@ -148,6 +219,23 @@ describe("summarize / renderChangeSet", () => {
     expect(out).toContain("ADOPT:");
     expect(out).toContain("orphan");
   });
+
+  test("summarize and render surface the runtime action (#1077)", () => {
+    const withRuntime = buildChangeSet("prod", {
+      declared: new Set(["web"]),
+      observedNow: {
+        web: meta({ type: "K8s::Apps::Deployment" }),
+        "prod/web-abc": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+      },
+      observedThen: undefined,
+    });
+    expect(summarize(withRuntime).runtime).toBe(1);
+    expect(summarize(withRuntime).adopt).toBe(0);
+    const out = renderChangeSet(withRuntime);
+    expect(out).toContain("RUNTIME");
+    expect(out).toContain("prod/web-abc");
+    expect(out).toContain("owned by web");
+  });
 });
 
 describe("gitlabMrReport (#329)", () => {
@@ -169,6 +257,18 @@ describe("gitlabMrReport (#329)", () => {
     expect(gitlabMrReport(cs)).toEqual({ create: 1, update: 1, delete: 1 });
   });
 
+  test("a runtime child (#1077) is excluded from the widget — never counted as a change", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["web"]),
+      observedNow: {
+        web: meta({ type: "K8s::Apps::Deployment" }),
+        "prod/web-abc": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+      },
+      observedThen: undefined,
+    });
+    expect(gitlabMrReport(cs)).toEqual({ create: 0, update: 0, delete: 0 });
+  });
+
   test("empty plan reports all zeros", () => {
     const cs = buildChangeSet("prod", {
       declared: new Set(),

package/src/lifecycle/change-set.ts

@@ -3,8 +3,8 @@
  *
  * `chant lifecycle diff --live` computes a three-way comparison — declared now /
  * last snapshot / live now — and prints it. `buildChangeSet` promotes that
- * same signal into a classified create/update/delete/adopt/noop set that other
- * tooling (reconcile, apply) can act on.
+ * same signal into a classified create/update/delete/adopt/runtime/noop set
+ * that other tooling (reconcile, apply) can act on.
  *
  * Strictly read-only and pure: no I/O, no mutation. The classification reads
  * ownership from the live marker only (populated downstream); until ownership
@@ -25,12 +25,17 @@ import { unobservedReasonText, type UnobservedReason } from "../observation";
  *   snapshot.
  * - `adopt` — live but undeclared, ownership not established → a candidate to
  *   pull back into source, never an auto-delete.
+ * - `runtime` — live but undeclared, and its owner-reference chain reaches a
+ *   declared entity (#1077): a Pod a declared Deployment's controller
+ *   created, for instance. Never a delete, never an adopt candidate — it is
+ *   not drift, just the runtime doing its job. `runtimeOwner` names the
+ *   declared entity it belongs to.
  * - `noop` — declared and live with no drift, or already reconciled.
  * - `unobserved` — declared, and the lexicon could not look (#1089). Not a
  *   proposal at all: it is the plan admitting a hole. Never a create, never a
  *   delete. Read `unobservedReason` for which hole.
  */
-export type ChangeAction = "create" | "update" | "delete" | "adopt" | "noop" | "unobserved";
+export type ChangeAction = "create" | "update" | "delete" | "adopt" | "runtime" | "noop" | "unobserved";
 
 /**
  * Who answers "is this resource chant's?". `unknown` until a live ownership
@@ -69,6 +74,8 @@ export interface ChangeSetEntry {
   unobservedReason?: UnobservedReason;
   /** Human-readable backing for `unobservedReason` (the failing command, the missing binding). */
   unobservedDetail?: string;
+  /** The declared entity this resource's owner chain resolves to, for `action: "runtime"` (#1077). */
+  runtimeOwner?: string;
 }
 
 export interface ChangeSet {
@@ -121,6 +128,15 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
     // record chant has to host.
     const ownership: Ownership = observedNow[name]?.ownership ?? "unknown";
 
+    // Owner-reference chain (#1077), same live-only provenance as ownership
+    // above. Only a `declared` root changes the classification; `unknown` is
+    // deliberately not escalated (#1168's tri-state precedent — an
+    // unconfirmed chain never earns the more confident verdict).
+    const runtimeOwner =
+      !isDeclared && observedNow[name]?.ownerChain?.root === "declared"
+        ? observedNow[name]!.ownerChain!.entity
+        : undefined;
+
     let action: ChangeAction;
     let deltas: AttributeChange[] | undefined;
 
@@ -140,6 +156,13 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
       } else {
         action = "noop";
       }
+    } else if (live && runtimeOwner) {
+      // Live, undeclared, and its owner chain reaches a declared entity
+      // (#1077) — expected runtime, never a delete/adopt candidate, checked
+      // ahead of the ownership marker below: even a runtime child that
+      // happens to carry chant's own marker (label propagation from its
+      // owner's template) must never be proposed for deletion.
+      action = "runtime";
     } else if (live) {
       // Live but undeclared. Only a chant-owned orphan is a safe delete; a
       // foreign or unknown orphan can be adopted but never auto-deleted.
@@ -162,6 +185,7 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
             ...(unobservedEntry.detail ? { unobservedDetail: unobservedEntry.detail } : {}),
           }
         : {}),
+      ...(runtimeOwner ? { runtimeOwner } : {}),
     });
   }
 
@@ -169,7 +193,7 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
   return { env, entries };
 }
 
-const ACTION_ORDER: ChangeAction[] = ["create", "update", "delete", "adopt", "noop", "unobserved"];
+const ACTION_ORDER: ChangeAction[] = ["create", "update", "delete", "adopt", "runtime", "noop", "unobserved"];
 
 /** Count entries per action. */
 export function summarize(cs: ChangeSet): Record<ChangeAction, number> {
@@ -178,6 +202,7 @@ export function summarize(cs: ChangeSet): Record<ChangeAction, number> {
     update: 0,
     delete: 0,
     adopt: 0,
+    runtime: 0,
     noop: 0,
     unobserved: 0,
   };
@@ -191,10 +216,11 @@ export function summarize(cs: ChangeSet): Record<ChangeAction, number> {
  * GitLab renders an `artifacts:reports:terraform` artifact in the merge-request
  * UI as "N to add, M to change, K to delete". The format is generic — any tool
  * that emits this JSON gets the widget — and the chant plan maps onto it
- * directly. Only the mutating actions count: `adopt`, `noop` and `unobserved`
- * are excluded, since the widget has no column for "live but undeclared", "no
- * change", or "could not look" (#1089). The widget is therefore a floor, not a
- * complete plan: read the full change set when entities are unobserved.
+ * directly. Only the mutating actions count: `adopt`, `runtime`, `noop` and
+ * `unobserved` are excluded, since the widget has no column for "live but
+ * undeclared", "expected runtime child" (#1077), "no change", or "could not
+ * look" (#1089). The widget is therefore a floor, not a complete plan: read
+ * the full change set when entities are unobserved or classified runtime.
  *
  * The widget label reads "Terraform" regardless of producer; that is GitLab's
  * fixed string, not a claim chant makes.
@@ -223,14 +249,17 @@ export function renderChangeSet(cs: ChangeSet): string {
     lines.push(
       action === "unobserved"
         ? "\nUNOBSERVED (declared; chant could not read live state — no action proposed):"
-        : `\n${action.toUpperCase()}:`,
+        : action === "runtime"
+          ? "\nRUNTIME (owned by a declared resource; not drift, never a delete/adopt candidate):"
+          : `\n${action.toUpperCase()}:`,
     );
     for (const e of group) {
       const own = e.ownership === "unknown" ? "" : ` [${e.ownership}]`;
       const why = e.unobservedReason
         ? ` — ${unobservedReasonText(e.unobservedReason)}${e.unobservedDetail ? `: ${e.unobservedDetail}` : ""}`
         : "";
-      lines.push(`  ${e.name}${e.type ? ` (${e.type})` : ""}${own}${why}`);
+      const owner = e.runtimeOwner ? ` — owned by ${e.runtimeOwner}` : "";
+      lines.push(`  ${e.name}${e.type ? ` (${e.type})` : ""}${own}${why}${owner}`);
       for (const d of e.deltas ?? []) {
         lines.push(`      ${d.path}: ${fmt(d.oldValue)} → ${fmt(d.newValue)}`);
       }

package/src/lifecycle/live-diff.test.ts

@@ -19,6 +19,7 @@ describe("diffLive", () => {
     expect(result).toEqual({
       missing: [],
       orphan: [],
+      runtimeChildren: [],
       disappeared: [],
       newlyObserved: [],
       driftedSinceSnapshot: [],
@@ -114,6 +115,93 @@ describe("diffLive", () => {
     expect(result.unchanged).toEqual(["b"]);
   });
 
+  // ── Owner-reference chain classification (#1077) ──────────────────────────
+
+  describe("runtime children vs orphans", () => {
+    test("undeclared, chain reaches a declared entity → runtimeChildren, never orphan", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-abc123": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-abc123", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("undeclared, no owner reference at all → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/standalone": meta({ ownerChain: { root: "unowned" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/standalone"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain resolves to a foreign (non-declared) root → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/other-app-pod": meta({ ownerChain: { root: "foreign" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/other-app-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain could not be resolved (unreadable owner/cycle/depth) → conservative orphan, not runtime", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/mystery-pod": meta({ ownerChain: { root: "unknown" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/mystery-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a lexicon that never sets ownerChain is unaffected — undeclared stays orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { legacy: meta() }, // no ownerChain at all
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["legacy"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a runtime child rolling to a new name between snapshots is not `disappeared`", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-newname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: { "prod/web-oldname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }) },
+      });
+      expect(result.disappeared).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-newname", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("a runtime child's own status change between snapshots is not driftedSinceSnapshot", () => {
+      const podThen = meta({ type: "K8s::Core::Pod", status: "PROGRESSING", ownerChain: { root: "declared", entity: "web" } });
+      const podNow = meta({ type: "K8s::Core::Pod", status: "READY", ownerChain: { root: "declared", entity: "web" } });
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: { web: meta({ type: "K8s::Apps::Deployment" }), "prod/web-stable-0": podNow },
+        observedThen: { "prod/web-stable-0": podThen },
+      });
+      expect(result.driftedSinceSnapshot).toEqual([]);
+      expect(result.unchanged).not.toContain("prod/web-stable-0");
+      expect(result.runtimeChildren.map((r) => r.name)).toEqual(["prod/web-stable-0"]);
+    });
+  });
+
   // ── The observation tri-state (#1089) ─────────────────────────────────────
 
   test("declared and not observed → unobserved, not missing", () => {

package/src/lifecycle/live-diff.ts

@@ -36,6 +36,19 @@ export interface UnobservedResource {
   detail?: string;
 }
 
+/**
+ * A live, undeclared resource whose owner-reference chain reaches a declared
+ * entity (#1077) — a Pod a declared Deployment's controller created, for
+ * instance. Reported separately from `orphan`: it is expected runtime, not a
+ * delete/adopt candidate, and is never counted as drift.
+ */
+export interface RuntimeChildResource {
+  name: string;
+  type: string;
+  /** The declared chant entity this resource's owner chain resolves to. */
+  owner: string;
+}
+
 export interface LiveDiffResult {
   /**
    * Declared in current build, and the provider reported it absent. Entities
@@ -43,8 +56,20 @@ export interface LiveDiffResult {
    * (#1089), so "missing" keeps meaning "confirmed not there".
    */
   missing: string[];
-  /** Observed in cloud right now, but not declared. */
+  /**
+   * Observed in cloud right now, not declared, and either carries no owner
+   * chain, or the chain does not reach a declared entity (unowned, foreign,
+   * or unresolvable — #1077 never escalates an incomplete chain read to
+   * `runtimeChildren`). A resource whose chain *does* reach a declared entity
+   * is in `runtimeChildren` instead.
+   */
   orphan: string[];
+  /**
+   * Observed in cloud right now, not declared, whose owner-reference chain
+   * reaches a declared entity (#1077) — expected runtime, not drift. Never a
+   * delete/adopt candidate; excluded from `orphan` and from drift counts.
+   */
+  runtimeChildren: RuntimeChildResource[];
   /** Was in last snapshot but isn't observed now. */
   disappeared: string[];
   /** Observed now and declared, but not in the previous snapshot. */
@@ -169,6 +194,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
 
   const missing: string[] = [];
   const orphan: string[] = [];
+  const runtimeChildren: RuntimeChildResource[] = [];
   const disappeared: string[] = [];
   const newlyObserved: string[] = [];
   const driftedSinceSnapshot: ResourceDrift[] = [];
@@ -194,23 +220,43 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
     }
   }
 
-  // In cloud right now but not declared → orphan
+  // In cloud right now but not declared → orphan, unless its owner-reference
+  // chain reaches a declared entity (#1077), in which case it is expected
+  // runtime rather than drift. An `unknown` chain (unreadable hop, cycle, or
+  // depth bound) is deliberately NOT escalated to runtime — it stays orphan,
+  // same as `unowned`/`foreign` — composing with #1168's tri-state precedent:
+  // an incomplete read never earns the more confident classification.
+  const runtimeChildNames = new Set<string>();
   for (const name of observedNowNames) {
-    if (!declared.has(name)) {
+    if (declared.has(name)) continue;
+    const chain = observedNow[name]?.ownerChain;
+    if (chain?.root === "declared") {
+      runtimeChildNames.add(name);
+      runtimeChildren.push({ name, type: observedNow[name].type, owner: chain.entity });
+    } else {
       orphan.push(name);
     }
   }
 
   // In previous snapshot but not observed now → disappeared. An entity nobody
-  // could look at has not disappeared; it is unobserved.
+  // could look at has not disappeared; it is unobserved. A resource the
+  // *previous* snapshot recorded as a runtime child (#1077) rolling to a new
+  // name (a Pod replaced by its controller) is not disappearance either — it
+  // is the same expected churn `runtimeChildren` excludes above, and counting
+  // it here would recreate the drift noise this module exists to remove.
   for (const name of observedThenNames) {
-    if (!observedNowNames.has(name) && !unobservedNames.has(name)) {
-      disappeared.push(name);
-    }
+    if (observedNowNames.has(name) || unobservedNames.has(name)) continue;
+    if (!declared.has(name) && observedThenMap[name]?.ownerChain?.root === "declared") continue;
+    disappeared.push(name);
   }
 
-  // Observed now: classify drift relative to previous snapshot
+  // Observed now: classify drift relative to previous snapshot. Runtime
+  // children (#1077) are excluded entirely — a controller-owned object's
+  // transient status is not drift chant should surface, and a snapshot that
+  // happened to record the same name (e.g. a StatefulSet's stable pod
+  // identity) must not turn its ordinary churn into `driftedSinceSnapshot`.
   for (const name of observedNowNames) {
+    if (runtimeChildNames.has(name)) continue;
     const now = observedNow[name];
     const then = observedThenMap[name];
     if (!then) {
@@ -235,6 +281,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
   return {
     missing: missing.sort(),
     orphan: orphan.sort(),
+    runtimeChildren: runtimeChildren.sort((a, b) => a.name.localeCompare(b.name)),
     disappeared: disappeared.sort(),
     newlyObserved: newlyObserved.sort(),
     driftedSinceSnapshot: driftedSinceSnapshot.sort((a, b) => a.name.localeCompare(b.name)),

package/src/managed-fields.test.ts

@@ -0,0 +1,179 @@
+import { describe, test, expect } from "vitest";
+import {
+  K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS,
+  k8sListMapOrderKey,
+  buildOwnershipSets,
+  pruneByOwnership,
+  type OwnershipSets,
+} from "./managed-fields";
+import { normalizeDeepProperties, type DeepNode } from "./deep-observation";
+
+/** The naming scheme both the k8s lexicon (via `@intentius/chant-k8s-client`'s `isChantFieldManager`) and gcp restate use in their own tests. */
+function isChantManager(manager: string | undefined): boolean {
+  return !!manager && (manager === "chant" || manager.startsWith("chant:"));
+}
+
+function node(partial: Partial<DeepNode> & Pick<DeepNode, "path" | "pattern">): DeepNode {
+  return {
+    entityType: "Test::Entity",
+    key: partial.pattern,
+    value: undefined,
+    side: "live",
+    counterpart: "unknown",
+    ...partial,
+  };
+}
+
+describe("K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS — the generic Kubernetes object envelope", () => {
+  test("covers status and the server-minted metadata fields", () => {
+    for (const p of [
+      "status",
+      "metadata.uid",
+      "metadata.resourceVersion",
+      "metadata.generation",
+      "metadata.creationTimestamp",
+      "metadata.managedFields",
+      "metadata.selfLink",
+    ]) {
+      expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has(p)).toBe(true);
+    }
+  });
+
+  test("does not cover a declared field with a similar name", () => {
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("metadata.labels")).toBe(false);
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("spec.status")).toBe(false);
+  });
+});
+
+describe("k8sListMapOrderKey — Kubernetes' own list-map-key conventions", () => {
+  test("orders containers, env and volumes by name", () => {
+    const out = normalizeDeepProperties(
+      {
+        containers: [{ name: "sidecar" }, { name: "app" }],
+        env: [{ name: "Z" }, { name: "A" }],
+      },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((out.containers as Array<{ name: string }>).map((c) => c.name)).toEqual(["app", "sidecar"]);
+    expect((out.env as Array<{ name: string }>).map((e) => e.name)).toEqual(["A", "Z"]);
+  });
+
+  test("orders container ports by containerPort+protocol and service ports by port+protocol", () => {
+    const containerPorts = normalizeDeepProperties(
+      { ports: [{ containerPort: 9090, protocol: "TCP" }, { containerPort: 8080, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((containerPorts.ports as Array<{ containerPort: number }>).map((p) => p.containerPort)).toEqual([8080, 9090]);
+
+    const servicePorts = normalizeDeepProperties(
+      { ports: [{ port: 443, protocol: "TCP" }, { port: 80, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((servicePorts.ports as Array<{ port: number }>).map((p) => p.port)).toEqual([80, 443]);
+  });
+
+  test("leaves an unrecognized array's order alone", () => {
+    expect(k8sListMapOrderKey({ entityType: "Any", path: "widgets", pattern: "widgets", element: { z: 1 }, index: 0, side: "live" })).toBeUndefined();
+  });
+});
+
+describe("buildOwnershipSets — resolving managedFields against live and declared trees", () => {
+  test("a scalar owned by chant is chant-owned regardless of the declared tree", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "chant:web", operation: "Apply", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager and undeclared is foreign-owned, not contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 7 } },
+      { spec: {} },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager AND declared is contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kubectl-client-side-apply", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 9 } },
+      { spec: { replicas: 5 } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(true);
+  });
+
+  test("a keyed list item resolves to its live index, independent of position in the declared array", () => {
+    const sets = buildOwnershipSets(
+      [
+        {
+          manager: "istio-sidecar-injector",
+          operation: "Update",
+          fieldsV1: { "f:spec": { "f:containers": { 'k:{"name":"istio-proxy"}': { ".": {}, "f:name": {} } } } },
+        },
+      ],
+      { spec: { containers: [{ name: "istio-proxy" }, { name: "app" }] } },
+      { spec: { containers: [{ name: "app" }] } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.containers[0]")).toBe(true);
+    expect(sets.foreignContested.has("spec.containers[0]")).toBe(false);
+  });
+
+  test("a subresource entry (status) is excluded", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", subresource: "status", fieldsV1: { "f:status": { "f:readyReplicas": {} } } }],
+      { status: { readyReplicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+
+  test("an entry with no manager name is skipped", () => {
+    const sets = buildOwnershipSets(
+      [{ operation: "Update", fieldsV1: { "f:spec": {} } }],
+      { spec: {} },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.size).toBe(0);
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+});
+
+describe("pruneByOwnership — the shared three-question rule", () => {
+  const sets: OwnershipSets = {
+    chantOwned: new Set(["metadata.labels.tier"]),
+    foreignOwned: new Set(["spec.replicas", "metadata.annotations.noise"]),
+    foreignContested: new Set(["spec.replicas"]),
+  };
+
+  test("never prunes the declared side", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas", side: "declared" }), sets)).toBe(false);
+  });
+
+  test("never prunes a chant-owned path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.labels.tier", pattern: "metadata.labels.tier" }), sets)).toBe(false);
+  });
+
+  test("prunes a foreign-owned, uncontested (undeclared) path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.annotations.noise", pattern: "metadata.annotations.noise" }), sets)).toBe(true);
+  });
+
+  test("keeps a foreign-owned, contested (declared) path", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas" }), sets)).toBe(false);
+  });
+
+  test("leaves a path with no ownership information alone (never pruned by this rule)", () => {
+    expect(pruneByOwnership(node({ path: "spec.selector", pattern: "spec.selector" }), sets)).toBe(false);
+  });
+});