@intentius/chant 0.31.0 → 0.33.0

package/src/lifecycle/live-diff.test.ts

@@ -19,6 +19,7 @@ describe("diffLive", () => {
     expect(result).toEqual({
       missing: [],
       orphan: [],
+      runtimeChildren: [],
       disappeared: [],
       newlyObserved: [],
       driftedSinceSnapshot: [],
@@ -114,6 +115,93 @@ describe("diffLive", () => {
     expect(result.unchanged).toEqual(["b"]);
   });
 
+  // ── Owner-reference chain classification (#1077) ──────────────────────────
+
+  describe("runtime children vs orphans", () => {
+    test("undeclared, chain reaches a declared entity → runtimeChildren, never orphan", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-abc123": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-abc123", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("undeclared, no owner reference at all → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/standalone": meta({ ownerChain: { root: "unowned" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/standalone"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain resolves to a foreign (non-declared) root → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/other-app-pod": meta({ ownerChain: { root: "foreign" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/other-app-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain could not be resolved (unreadable owner/cycle/depth) → conservative orphan, not runtime", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/mystery-pod": meta({ ownerChain: { root: "unknown" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/mystery-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a lexicon that never sets ownerChain is unaffected — undeclared stays orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { legacy: meta() }, // no ownerChain at all
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["legacy"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a runtime child rolling to a new name between snapshots is not `disappeared`", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-newname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: { "prod/web-oldname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }) },
+      });
+      expect(result.disappeared).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-newname", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("a runtime child's own status change between snapshots is not driftedSinceSnapshot", () => {
+      const podThen = meta({ type: "K8s::Core::Pod", status: "PROGRESSING", ownerChain: { root: "declared", entity: "web" } });
+      const podNow = meta({ type: "K8s::Core::Pod", status: "READY", ownerChain: { root: "declared", entity: "web" } });
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: { web: meta({ type: "K8s::Apps::Deployment" }), "prod/web-stable-0": podNow },
+        observedThen: { "prod/web-stable-0": podThen },
+      });
+      expect(result.driftedSinceSnapshot).toEqual([]);
+      expect(result.unchanged).not.toContain("prod/web-stable-0");
+      expect(result.runtimeChildren.map((r) => r.name)).toEqual(["prod/web-stable-0"]);
+    });
+  });
+
   // ── The observation tri-state (#1089) ─────────────────────────────────────
 
   test("declared and not observed → unobserved, not missing", () => {

package/src/lifecycle/live-diff.ts

@@ -36,6 +36,19 @@ export interface UnobservedResource {
   detail?: string;
 }
 
+/**
+ * A live, undeclared resource whose owner-reference chain reaches a declared
+ * entity (#1077) — a Pod a declared Deployment's controller created, for
+ * instance. Reported separately from `orphan`: it is expected runtime, not a
+ * delete/adopt candidate, and is never counted as drift.
+ */
+export interface RuntimeChildResource {
+  name: string;
+  type: string;
+  /** The declared chant entity this resource's owner chain resolves to. */
+  owner: string;
+}
+
 export interface LiveDiffResult {
   /**
    * Declared in current build, and the provider reported it absent. Entities
@@ -43,8 +56,20 @@ export interface LiveDiffResult {
    * (#1089), so "missing" keeps meaning "confirmed not there".
    */
   missing: string[];
-  /** Observed in cloud right now, but not declared. */
+  /**
+   * Observed in cloud right now, not declared, and either carries no owner
+   * chain, or the chain does not reach a declared entity (unowned, foreign,
+   * or unresolvable — #1077 never escalates an incomplete chain read to
+   * `runtimeChildren`). A resource whose chain *does* reach a declared entity
+   * is in `runtimeChildren` instead.
+   */
   orphan: string[];
+  /**
+   * Observed in cloud right now, not declared, whose owner-reference chain
+   * reaches a declared entity (#1077) — expected runtime, not drift. Never a
+   * delete/adopt candidate; excluded from `orphan` and from drift counts.
+   */
+  runtimeChildren: RuntimeChildResource[];
   /** Was in last snapshot but isn't observed now. */
   disappeared: string[];
   /** Observed now and declared, but not in the previous snapshot. */
@@ -169,6 +194,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
 
   const missing: string[] = [];
   const orphan: string[] = [];
+  const runtimeChildren: RuntimeChildResource[] = [];
   const disappeared: string[] = [];
   const newlyObserved: string[] = [];
   const driftedSinceSnapshot: ResourceDrift[] = [];
@@ -194,23 +220,43 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
     }
   }
 
-  // In cloud right now but not declared → orphan
+  // In cloud right now but not declared → orphan, unless its owner-reference
+  // chain reaches a declared entity (#1077), in which case it is expected
+  // runtime rather than drift. An `unknown` chain (unreadable hop, cycle, or
+  // depth bound) is deliberately NOT escalated to runtime — it stays orphan,
+  // same as `unowned`/`foreign` — composing with #1168's tri-state precedent:
+  // an incomplete read never earns the more confident classification.
+  const runtimeChildNames = new Set<string>();
   for (const name of observedNowNames) {
-    if (!declared.has(name)) {
+    if (declared.has(name)) continue;
+    const chain = observedNow[name]?.ownerChain;
+    if (chain?.root === "declared") {
+      runtimeChildNames.add(name);
+      runtimeChildren.push({ name, type: observedNow[name].type, owner: chain.entity });
+    } else {
       orphan.push(name);
     }
   }
 
   // In previous snapshot but not observed now → disappeared. An entity nobody
-  // could look at has not disappeared; it is unobserved.
+  // could look at has not disappeared; it is unobserved. A resource the
+  // *previous* snapshot recorded as a runtime child (#1077) rolling to a new
+  // name (a Pod replaced by its controller) is not disappearance either — it
+  // is the same expected churn `runtimeChildren` excludes above, and counting
+  // it here would recreate the drift noise this module exists to remove.
   for (const name of observedThenNames) {
-    if (!observedNowNames.has(name) && !unobservedNames.has(name)) {
-      disappeared.push(name);
-    }
+    if (observedNowNames.has(name) || unobservedNames.has(name)) continue;
+    if (!declared.has(name) && observedThenMap[name]?.ownerChain?.root === "declared") continue;
+    disappeared.push(name);
   }
 
-  // Observed now: classify drift relative to previous snapshot
+  // Observed now: classify drift relative to previous snapshot. Runtime
+  // children (#1077) are excluded entirely — a controller-owned object's
+  // transient status is not drift chant should surface, and a snapshot that
+  // happened to record the same name (e.g. a StatefulSet's stable pod
+  // identity) must not turn its ordinary churn into `driftedSinceSnapshot`.
   for (const name of observedNowNames) {
+    if (runtimeChildNames.has(name)) continue;
     const now = observedNow[name];
     const then = observedThenMap[name];
     if (!then) {
@@ -235,6 +281,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
   return {
     missing: missing.sort(),
     orphan: orphan.sort(),
+    runtimeChildren: runtimeChildren.sort((a, b) => a.name.localeCompare(b.name)),
     disappeared: disappeared.sort(),
     newlyObserved: newlyObserved.sort(),
     driftedSinceSnapshot: driftedSinceSnapshot.sort((a, b) => a.name.localeCompare(b.name)),

package/src/lifecycle/observe.test.ts

@@ -1,9 +1,25 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi } from "vitest";
 import { observeResources } from "./observe";
 import { observation } from "../observation";
 import type { ObservationLexicon, ResourceMetadata } from "../lexicon";
 import type { BuildResult } from "../build";
 
+// The per-stack scoped build (#1162) resolves each stack's `src` through the
+// real `build`. Mock it so the test controls what each src yields — a stack
+// whose src is scoped reports BARE entity names, matching the deployed
+// LogicalResourceIds, not the whole-project build's disambiguated names.
+const scopedBuilds: Record<string, string[]> = {};
+vi.mock("../build", () => ({
+  build: async (src: string): Promise<BuildResult> => {
+    const names = scopedBuilds[src] ?? [];
+    return {
+      outputs: new Map<string, string>([["aws", "{}"]]),
+      entities: new Map(names.map((n) => [n, { lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} }])),
+      errors: [],
+    } as unknown as BuildResult;
+  },
+}));
+
 function mockBuild(): BuildResult {
   return {
     outputs: new Map<string, string>([["aws", "{}"]]),
@@ -154,7 +170,11 @@ describe("observeResources", () => {
       awsPlugin((opts) => {
         const stack = (opts as { stack?: string }).stack;
         calls.push(stack);
-        // Different resources per stack — the multi-stack, per-component case.
+        // Different resources per stack — the multi-stack, per-component case
+        // (#57 loomster). Bare-string stacks keep BARE ids (no `src` scope), so
+        // the union is `db-a`+`db-b`, not stack-qualified: per-component ids are
+        // already unique and behold reads them bare. Qualification is a scoped
+        // (`src`) feature — see the per-stack src test below.
         const resources: Record<string, ResourceMetadata> =
           stack === "s1"
             ? { "db-a": { type: "AWS::RDS::DBInstance", status: "AVAILABLE" } }
@@ -169,6 +189,50 @@ describe("observeResources", () => {
     expect(Object.keys(observations[0].resources).sort()).toEqual(["db-a", "db-b"]);
   });
 
+  it("with per-stack src (#1162): describeResources gets each stack's SCOPED bare names, not the whole-project build's names", async () => {
+    const { resolve } = await import("node:path");
+    // The whole-project build disambiguates colliding names by module path;
+    // each stack's scoped src reports the bare names it actually deploys.
+    scopedBuilds[resolve("east/src")] = ["server", "vpc"];
+    scopedBuilds[resolve("west/src")] = ["server", "vpc"];
+
+    const seen: Record<string, string[]> = {};
+    const plugins = [
+      awsPlugin((opts) => {
+        const o = opts as { stack?: string; entityNames: string[] };
+        seen[o.stack ?? "?"] = o.entityNames;
+        // Echo one resource keyed by a bare name the deployed stack owns.
+        return { server: { type: "AWS::EC2::Instance", status: "AVAILABLE", physicalId: `i-${o.stack}` } };
+      }),
+    ];
+    // The whole-project buildResult carries DISAMBIGUATED names — proving the
+    // scoped path overrides them rather than falling through to these.
+    const wholeProject = {
+      outputs: new Map<string, string>([["aws", "{}"]]),
+      entities: new Map([
+        ["EastServer", { lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} }],
+        ["WestServer", { lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} }],
+      ]),
+      errors: [],
+    } as unknown as BuildResult;
+
+    const { observations } = await observeResources("floci", plugins, wholeProject, {
+      stacks: [
+        { name: "east", src: "east/src" },
+        { name: "west", src: "west/src" },
+      ],
+    });
+
+    // Each stack saw its own scoped bare names (matching deployed ids).
+    expect(seen["east"]).toEqual(["server", "vpc"]);
+    expect(seen["west"]).toEqual(["server", "vpc"]);
+    // Observed nodes are stack-qualified, so the colliding `server` id is
+    // distinct per stack and each carries its own physical id.
+    expect(Object.keys(observations[0].resources).sort()).toEqual(["east::server", "west::server"]);
+    expect(observations[0].resources["east::server"].physicalId).toBe("i-east");
+    expect(observations[0].resources["west::server"].physicalId).toBe("i-west");
+  });
+
   it("with an empty stacks array — falls back to the single unstacked call", async () => {
     const calls: Array<{ stack?: string }> = [];
     const plugins = [

package/src/lifecycle/observe.ts

@@ -11,6 +11,8 @@
  */
 import type { ObservationLexicon } from "../lexicon";
 import type { BuildResult } from "../build";
+import { build as buildProject } from "../build";
+import { resolve as resolvePath } from "node:path";
 import type { SerializerResult } from "../serializer";
 import type { LiveObservation } from "../graph-ir";
 import {
@@ -28,6 +30,19 @@ export interface ObserveResult {
   errors: string[];
 }
 
+/**
+ * Re-key a normalized observation's entities by `${stack}::${id}` (#1162) so a
+ * bare LogicalResourceId shared across stacks (e.g. `vpc`) stays unambiguous
+ * once the per-stack results are merged. The declared canvas qualifies the same
+ * way (`buildDeclaredPerStack`), so the overlay join lines up. Applies to both
+ * the OBSERVED-PRESENT and NOT-OBSERVED maps of the tri-state (#1089).
+ */
+function qualifyObservation(obs: NormalizedObservation, stackName: string): NormalizedObservation {
+  const q = <T>(m: Record<string, T>): Record<string, T> =>
+    Object.fromEntries(Object.entries(m).map(([k, v]) => [`${stackName}::${k}`, v]));
+  return { resources: q(obs.resources), unobserved: q(obs.unobserved) };
+}
+
 /**
  * Query every plugin that implements `describeResources` for its resources in
  * `environment`. `owned` (default true for the managed-only diagram, epic #776)
@@ -44,20 +59,39 @@ export interface ObserveResult {
  * absent an explicit `stack`) queries a stack that simply doesn't exist there,
  * so the single-call path always observes zero nodes. When `stacks` is
  * present and non-empty, each observing plugin's `describeResources` is
- * called once per stack (same `environment`/`entities`/`entityNames`, only
- * `stack` varies) and the returned resource maps are unioned — a resource
- * appears under whichever stack contains its logical id. When `stacks` is
- * absent or empty, behavior is exactly the single call of before (no `stack`
- * key at all), so a single-stack project is unaffected.
+ * called once per stack and the returned observations are merged. A stack entry
+ * may be a bare name or `{ name, region?, src? }` (#1162): `src` is built
+ * SCOPED so the deployed BARE LogicalResourceIds match (the whole-project build
+ * disambiguates colliding names to `UsWest1Src…`, which the live ids never
+ * carry), and a scoped stack's observed ids are qualified `${stack}::${id}` so
+ * the same bare id in two stacks stays distinct. A bare-string stack keeps its
+ * bare ids and the tri-state merge (#57). When `stacks` is absent or empty, behavior is
+ * exactly the single call of before (no `stack` key at all), so a single-stack
+ * project is unaffected.
  */
 export async function observeResources(
   environment: string,
   plugins: ObservationLexicon[],
   buildResult: BuildResult,
-  opts?: { owned?: boolean; stacks?: string[] },
+  opts?: { owned?: boolean; stacks?: Array<string | { name: string; region?: string; src?: string }> },
 ): Promise<ObserveResult> {
   const owned = opts?.owned ?? true;
-  const stacks = opts?.stacks ?? [];
+  const stacks = (opts?.stacks ?? []).map((st) => (typeof st === "string" ? { name: st } : st));
+  // A stack's `src` (multi-stack, #1162) is built SCOPED to recover that stack's
+  // BARE entity names — the names it actually deploys. Matching deployed bare
+  // LogicalResourceIds against the whole-project build's DISAMBIGUATED names
+  // (UsWest1Src…) misses every colliding resource. Cached per src.
+  const serializers = plugins.map((p) => p.serializer);
+  const scopedBuildCache = new Map<string, BuildResult>();
+  const scopedBuild = async (src: string): Promise<BuildResult> => {
+    const key = resolvePath(src);
+    let r = scopedBuildCache.get(key);
+    if (!r) {
+      r = await buildProject(key, serializers);
+      scopedBuildCache.set(key, r);
+    }
+    return r;
+  };
   const observations: LiveObservation[] = [];
   const warnings: string[] = [];
   const errors: string[] = [];
@@ -91,18 +125,45 @@ export async function observeResources(
       if (stacks.length > 0) {
         const parts: NormalizedObservation[] = [];
         for (const stack of stacks) {
-          parts.push(
-            normalizeObservation(
-              await plugin.describeResources({
-                environment,
-                buildOutput,
-                entityNames,
-                entities,
-                owned,
-                stack,
-              }),
-            ),
+          // Use this stack's scoped build (bare entity names) when it has a src,
+          // so describeResources matches the deployed bare LogicalResourceIds.
+          let stackEntityNames = entityNames;
+          let stackBuildOutput = buildOutput;
+          let stackEntities = entities;
+          if (stack.src) {
+            const sb = await scopedBuild(stack.src);
+            stackEntityNames = [];
+            stackEntities = new Map();
+            for (const [name, entity] of sb.entities) {
+              if (entity.lexicon !== plugin.name) continue;
+              stackEntityNames.push(name);
+              stackEntities.set(name, {
+                entityType: entity.entityType,
+                props: ("props" in entity && entity.props != null ? entity.props : {}) as Record<string, unknown>,
+              });
+            }
+            const raw = sb.outputs.get(plugin.name);
+            stackBuildOutput = raw === undefined ? "" : typeof raw === "string" ? raw : (raw as SerializerResult).primary;
+          }
+          const norm = normalizeObservation(
+            await plugin.describeResources({
+              environment,
+              buildOutput: stackBuildOutput,
+              entityNames: stackEntityNames,
+              entities: stackEntities,
+              owned,
+              stack: stack.name,
+              region: stack.region,
+            }),
           );
+          // Qualify ids by stack ONLY for a scoped (`src`) stack (#1162): that
+          // is the multi-region case where the SAME bare LogicalResourceId
+          // (e.g. `vpc`) exists in every stack, so a bare union would collide.
+          // A bare-string stack (#57 loomster) has unique per-component ids and
+          // is asked the whole-project entity set, so it keeps the bare-id
+          // tri-state merge (present > not-observed > absent) that behold and
+          // other consumers read.
+          parts.push(stack.src ? qualifyObservation(norm, stack.name) : norm);
         }
         observed = mergeObservations(parts);
       } else {

package/src/managed-fields.test.ts

@@ -0,0 +1,179 @@
+import { describe, test, expect } from "vitest";
+import {
+  K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS,
+  k8sListMapOrderKey,
+  buildOwnershipSets,
+  pruneByOwnership,
+  type OwnershipSets,
+} from "./managed-fields";
+import { normalizeDeepProperties, type DeepNode } from "./deep-observation";
+
+/** The naming scheme both the k8s lexicon (via `@intentius/chant-k8s-client`'s `isChantFieldManager`) and gcp restate use in their own tests. */
+function isChantManager(manager: string | undefined): boolean {
+  return !!manager && (manager === "chant" || manager.startsWith("chant:"));
+}
+
+function node(partial: Partial<DeepNode> & Pick<DeepNode, "path" | "pattern">): DeepNode {
+  return {
+    entityType: "Test::Entity",
+    key: partial.pattern,
+    value: undefined,
+    side: "live",
+    counterpart: "unknown",
+    ...partial,
+  };
+}
+
+describe("K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS — the generic Kubernetes object envelope", () => {
+  test("covers status and the server-minted metadata fields", () => {
+    for (const p of [
+      "status",
+      "metadata.uid",
+      "metadata.resourceVersion",
+      "metadata.generation",
+      "metadata.creationTimestamp",
+      "metadata.managedFields",
+      "metadata.selfLink",
+    ]) {
+      expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has(p)).toBe(true);
+    }
+  });
+
+  test("does not cover a declared field with a similar name", () => {
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("metadata.labels")).toBe(false);
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("spec.status")).toBe(false);
+  });
+});
+
+describe("k8sListMapOrderKey — Kubernetes' own list-map-key conventions", () => {
+  test("orders containers, env and volumes by name", () => {
+    const out = normalizeDeepProperties(
+      {
+        containers: [{ name: "sidecar" }, { name: "app" }],
+        env: [{ name: "Z" }, { name: "A" }],
+      },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((out.containers as Array<{ name: string }>).map((c) => c.name)).toEqual(["app", "sidecar"]);
+    expect((out.env as Array<{ name: string }>).map((e) => e.name)).toEqual(["A", "Z"]);
+  });
+
+  test("orders container ports by containerPort+protocol and service ports by port+protocol", () => {
+    const containerPorts = normalizeDeepProperties(
+      { ports: [{ containerPort: 9090, protocol: "TCP" }, { containerPort: 8080, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((containerPorts.ports as Array<{ containerPort: number }>).map((p) => p.containerPort)).toEqual([8080, 9090]);
+
+    const servicePorts = normalizeDeepProperties(
+      { ports: [{ port: 443, protocol: "TCP" }, { port: 80, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((servicePorts.ports as Array<{ port: number }>).map((p) => p.port)).toEqual([80, 443]);
+  });
+
+  test("leaves an unrecognized array's order alone", () => {
+    expect(k8sListMapOrderKey({ entityType: "Any", path: "widgets", pattern: "widgets", element: { z: 1 }, index: 0, side: "live" })).toBeUndefined();
+  });
+});
+
+describe("buildOwnershipSets — resolving managedFields against live and declared trees", () => {
+  test("a scalar owned by chant is chant-owned regardless of the declared tree", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "chant:web", operation: "Apply", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager and undeclared is foreign-owned, not contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 7 } },
+      { spec: {} },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager AND declared is contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kubectl-client-side-apply", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 9 } },
+      { spec: { replicas: 5 } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(true);
+  });
+
+  test("a keyed list item resolves to its live index, independent of position in the declared array", () => {
+    const sets = buildOwnershipSets(
+      [
+        {
+          manager: "istio-sidecar-injector",
+          operation: "Update",
+          fieldsV1: { "f:spec": { "f:containers": { 'k:{"name":"istio-proxy"}': { ".": {}, "f:name": {} } } } },
+        },
+      ],
+      { spec: { containers: [{ name: "istio-proxy" }, { name: "app" }] } },
+      { spec: { containers: [{ name: "app" }] } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.containers[0]")).toBe(true);
+    expect(sets.foreignContested.has("spec.containers[0]")).toBe(false);
+  });
+
+  test("a subresource entry (status) is excluded", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", subresource: "status", fieldsV1: { "f:status": { "f:readyReplicas": {} } } }],
+      { status: { readyReplicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+
+  test("an entry with no manager name is skipped", () => {
+    const sets = buildOwnershipSets(
+      [{ operation: "Update", fieldsV1: { "f:spec": {} } }],
+      { spec: {} },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.size).toBe(0);
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+});
+
+describe("pruneByOwnership — the shared three-question rule", () => {
+  const sets: OwnershipSets = {
+    chantOwned: new Set(["metadata.labels.tier"]),
+    foreignOwned: new Set(["spec.replicas", "metadata.annotations.noise"]),
+    foreignContested: new Set(["spec.replicas"]),
+  };
+
+  test("never prunes the declared side", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas", side: "declared" }), sets)).toBe(false);
+  });
+
+  test("never prunes a chant-owned path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.labels.tier", pattern: "metadata.labels.tier" }), sets)).toBe(false);
+  });
+
+  test("prunes a foreign-owned, uncontested (undeclared) path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.annotations.noise", pattern: "metadata.annotations.noise" }), sets)).toBe(true);
+  });
+
+  test("keeps a foreign-owned, contested (declared) path", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas" }), sets)).toBe(false);
+  });
+
+  test("leaves a path with no ownership information alone (never pruned by this rule)", () => {
+    expect(pruneByOwnership(node({ path: "spec.selector", pattern: "spec.selector" }), sets)).toBe(false);
+  });
+});