@intentius/chant 0.34.0 → 0.37.0

package/src/deep-observation.test.ts

@@ -84,6 +84,54 @@ describe("normalizeDeepProperties", () => {
     expect(out).toEqual({ Name: "n" });
   });
 
+  // A container the rules emptied is not a container the source declared empty.
+  // Keeping the husk turns a suppressed default into drift-shaped noise —
+  // `SecurityGroupEgress[#{}]: <undeclared> → {}` was the case that found this.
+  test("an object whose every field was pruned is dropped, not left as {}", () => {
+    const hooks: DeepNormalizationHooks = { prune: (n) => n.key === "CidrIp" || n.key === "IpProtocol" };
+    const out = normalizeDeepProperties(
+      { Egress: [{ CidrIp: "0.0.0.0/0", IpProtocol: "-1" }], Name: "n" },
+      { entityType: "T", side: "live", hooks },
+    );
+    expect(out).toEqual({ Name: "n" });
+  });
+
+  test("an object the source declared empty survives", () => {
+    const hooks: DeepNormalizationHooks = { prune: () => false };
+    const out = normalizeDeepProperties(
+      { Spec: {}, Items: [], Name: "n" },
+      { entityType: "T", side: "live", hooks },
+    );
+    expect(out).toEqual({ Spec: {}, Items: [], Name: "n" });
+  });
+
+  test("a partly pruned object keeps what survived", () => {
+    const hooks: DeepNormalizationHooks = { prune: (n) => n.key === "Arn" };
+    const out = normalizeDeepProperties(
+      { Role: { Arn: "arn:…", Path: "/" } },
+      { entityType: "T", side: "live", hooks },
+    );
+    expect(out).toEqual({ Role: { Path: "/" } });
+  });
+
+  test("emptiness propagates up as far as the pruning reaches", () => {
+    const hooks: DeepNormalizationHooks = { prune: (n) => n.key === "Gone" };
+    const out = normalizeDeepProperties(
+      { Outer: { Inner: { Gone: 1 } }, Name: "n" },
+      { entityType: "T", side: "live", hooks },
+    );
+    expect(out).toEqual({ Name: "n" });
+  });
+
+  test("an array keeps the elements pruning did not empty", () => {
+    const hooks: DeepNormalizationHooks = { prune: (n) => n.key === "Default" };
+    const out = normalizeDeepProperties(
+      { Rules: [{ Default: true }, { Port: 443 }] },
+      { entityType: "T", side: "live", hooks },
+    );
+    expect(out).toEqual({ Rules: [{ Port: 443 }] });
+  });
+
   test("hooks see an index-erased pattern alongside the exact path", () => {
     const seen: Array<[string, string]> = [];
     const hooks: DeepNormalizationHooks = {
@@ -232,3 +280,106 @@ describe("deepValueEqual", () => {
     expect(deepValueEqual(1, 1)).toBe(true);
   });
 });
+
+// #1314 — a nested property authored through a lexicon's generated constructor
+// is authored data, not an opaque class instance. Collapsing it to UNRESOLVED
+// left the declared side empty while the live side held the real value, so
+// every field of it reported `<undeclared>` on a clean apply.
+describe("normalizeDeepProperties — property-kind declarables (#1314)", () => {
+  /** Shaped like a generated property constructor's instance. */
+  const propertyDeclarable = (entityType: string, props: Record<string, unknown>) => ({
+    entityType,
+    kind: "property",
+    props,
+  });
+
+  test("unwraps a property-kind declarable to its authored props", () => {
+    const out = normalizeDeepProperties(
+      {
+        GroupDescription: "sg",
+        SecurityGroupIngress: [
+          propertyDeclarable("AWS::EC2::SecurityGroup.Ingress", {
+            IpProtocol: "tcp",
+            FromPort: 443,
+            ToPort: 443,
+            CidrIp: "10.42.0.0/16",
+          }),
+        ],
+      },
+      { entityType: "AWS::EC2::SecurityGroup", side: "declared" },
+    );
+    expect(out).toEqual({
+      GroupDescription: "sg",
+      SecurityGroupIngress: [{ CidrIp: "10.42.0.0/16", FromPort: 443, IpProtocol: "tcp", ToPort: 443 }],
+    });
+  });
+
+  test("produces the same tree as the equivalent plain object — the two authoring forms must not differ", () => {
+    const viaConstructor = normalizeDeepProperties(
+      { Ingress: [propertyDeclarable("T.Ingress", { IpProtocol: "tcp", FromPort: 443 })] },
+      { entityType: "T", side: "declared" },
+    );
+    const viaLiteral = normalizeDeepProperties(
+      { Ingress: [{ IpProtocol: "tcp", FromPort: 443 }] },
+      { entityType: "T", side: "declared" },
+    );
+    expect(viaConstructor).toEqual(viaLiteral);
+  });
+
+  test("unwraps nested property declarables all the way down", () => {
+    const out = normalizeDeepProperties(
+      {
+        Logging: propertyDeclarable("T.Logging", {
+          CloudWatch: propertyDeclarable("T.CloudWatch", { Enabled: true, LogGroup: "g" }),
+        }),
+      },
+      { entityType: "T", side: "declared" },
+    );
+    expect(out).toEqual({ Logging: { CloudWatch: { Enabled: true, LogGroup: "g" } } });
+  });
+
+  test("still collapses a RESOURCE-kind declarable — it is a reference with no source-side value", () => {
+    // A class instance, as a lexicon actually constructs one: a resource-kind
+    // declarable in another resource's props is a Ref, and there is nothing on
+    // the source side to compare a live value against.
+    class VpcDeclarable {
+      readonly entityType = "AWS::EC2::VPC";
+      readonly kind = "resource";
+      readonly props = { CidrBlock: "10.0.0.0/16" };
+    }
+    const out = normalizeDeepProperties(
+      { VpcId: new VpcDeclarable() },
+      { entityType: "AWS::EC2::SecurityGroup", side: "declared" },
+    );
+    expect(out).toEqual({ VpcId: UNRESOLVED });
+  });
+
+  test("unwraps a property-kind declarable that is a class instance, which is how a lexicon builds one", () => {
+    class IngressDeclarable {
+      readonly entityType = "AWS::EC2::SecurityGroup.Ingress";
+      readonly kind = "property";
+      constructor(readonly props: Record<string, unknown>) {}
+    }
+    const out = normalizeDeepProperties(
+      { Ingress: [new IngressDeclarable({ IpProtocol: "tcp", FromPort: 443 })] },
+      { entityType: "AWS::EC2::SecurityGroup", side: "declared" },
+    );
+    expect(out).toEqual({ Ingress: [{ FromPort: 443, IpProtocol: "tcp" }] });
+  });
+
+  test("still collapses a genuine class instance, which is what the branch is for", () => {
+    class Sub {
+      constructor(readonly template: string) {}
+    }
+    const out = normalizeDeepProperties({ Name: new Sub("${AWS::StackName}-x") }, { entityType: "T", side: "declared" });
+    expect(out).toEqual({ Name: UNRESOLVED });
+  });
+
+  test("masks a secret inside an unwrapped property declarable, same as in a plain object", () => {
+    const out = normalizeDeepProperties(
+      { Auth: propertyDeclarable("T.Auth", { Username: "u", Password: "hunter2" }) },
+      { entityType: "T", side: "declared" },
+    );
+    expect(out).toEqual({ Auth: { Password: MASKED, Username: "u" } });
+  });
+});

package/src/deep-observation.ts

@@ -324,6 +324,36 @@ export function deepPathSet(tree: Record<string, unknown>): Set<string> {
  * on every read; array order is canonicalized only where the lexicon says the
  * array is a set, because list order often *is* semantic.
  */
+/**
+ * A container whose every member the rules pruned.
+ *
+ * The distinction it carries is between a value that was empty in the source
+ * and one this pass emptied: `{}` a lexicon actually declared is a fact worth
+ * diffing, while `{}` left behind after both of a rule's fields were subtracted
+ * as provider defaults is a husk. Reporting the husk turns a suppressed default
+ * into `SecurityGroupEgress[#{}]: <undeclared> → {}` — noise wearing the shape
+ * of drift, which is the one thing the noise rules exist to prevent.
+ *
+ * Module-private: it never leaves this function's recursion.
+ */
+const EMPTIED = Symbol("emptied-by-pruning");
+
+/**
+ * A property-kind Declarable — a nested property authored through a lexicon's
+ * generated constructor rather than as a plain object (#1314).
+ *
+ * Duck-typed on the same three facts `declarable.ts` defines it by
+ * (`entityType`, `kind === "property"`, `props`) rather than imported, keeping
+ * this module free of a dependency on the authoring types it only ever
+ * inspects. A resource-kind Declarable deliberately does not match.
+ */
+function isPropertyDeclarableValue(value: unknown): boolean {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as { entityType?: unknown; kind?: unknown; props?: unknown };
+  return typeof v.entityType === "string" && v.kind === "property" && typeof v.props === "object" && v.props !== null;
+}
+
+
 export function normalizeDeepProperties(
   tree: Record<string, unknown>,
   options: NormalizeDeepOptions,
@@ -351,27 +381,61 @@ export function normalizeDeepProperties(
     if (isSensitiveKey(key)) return MASKED;
     if (isJsonPrimitive(value)) return value;
 
+    // A PROPERTY-kind Declarable is authored data wearing a class, not an
+    // opaque instance (#1314). The generated property constructors —
+    // `SecurityGroup_Ingress`, `Role_Policy`, `MicrovmImage_Logging` — are the
+    // typed way to write a nested property, and the serializer inlines their
+    // `.props` (serializer-walker.ts `visitor.propertyDeclarable`). The
+    // declared tree has to do the same, or the two sides disagree about a
+    // property the author did write: without this the declared side held
+    // UNRESOLVED while the live side held the real rule, so every one of its
+    // fields reported `<undeclared> → <value>` on a clean apply, and the noise
+    // scaled with how strictly a project typed its properties.
+    //
+    // Checked ahead of the array/object branches rather than in the non-JSON
+    // fallback below, so it holds whether the declarable arrives as a class
+    // instance (what a lexicon constructs) or as an equivalent plain object.
+    //
+    // Deliberately property-kind only. A RESOURCE-kind Declarable in another
+    // resource's props is a reference, which has no source-side value to
+    // compare against a live one, so UNRESOLVED stays correct for it — and a
+    // resource-kind instance falls through to that fallback unchanged.
+    if (isPropertyDeclarableValue(value)) {
+      return normalizeValue((value as { props?: unknown }).props ?? {}, path, pattern, key);
+    }
+
     if (Array.isArray(value)) {
       const elements: unknown[] = [];
       for (let i = 0; i < value.length; i++) {
         const elPath = joinIndex(path, i);
         const elPattern = joinPattern(pattern);
         if (prune(elPath, elPattern, String(i), value[i])) continue;
-        elements.push(normalizeValue(value[i], elPath, elPattern, String(i)));
+        const element = normalizeValue(value[i], elPath, elPattern, String(i));
+        if (element === EMPTIED) continue;
+        elements.push(element);
       }
+      // An array that had elements and has none left was emptied by pruning,
+      // not declared empty. Reporting `[]` for it is reporting the husk of a
+      // value the rules just decided was noise.
+      if (elements.length === 0 && value.length > 0) return EMPTIED;
       return orderElements(elements, path, pattern);
     }
 
     if (isPlainObject(value)) {
       const out: Record<string, unknown> = {};
+      let had = 0;
       for (const childKey of Object.keys(value).sort()) {
         const childPath = joinPath(path, childKey);
         const childPattern = joinPath(pattern, childKey);
         const childValue = value[childKey];
         if (childValue === undefined) continue;
+        had += 1;
         if (prune(childPath, childPattern, childKey, childValue)) continue;
-        out[childKey] = normalizeValue(childValue, childPath, childPattern, childKey);
+        const child = normalizeValue(childValue, childPath, childPattern, childKey);
+        if (child === EMPTIED) continue;
+        out[childKey] = child;
       }
+      if (Object.keys(out).length === 0 && had > 0) return EMPTIED;
       return out;
     }
 

package/src/lifecycle/rollback.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { rollbackBranchName, rollbackTitle, rollbackBody } from "./rollback";
+import { rollbackBranchName, rollbackTitle, rollbackBody, rollbackToRevision } from "./rollback";
 
 describe("rollback helpers (#873)", () => {
   test("branch name includes env and short ref", () => {
@@ -23,3 +23,80 @@ describe("rollback helpers (#873)", () => {
     expect(body).toMatch(/approval gate|Sync|apply/i);
   });
 });
+
+// A dry run has to work where the PR path cannot: no remote, no `gh`, and the
+// repository left exactly as it was found. That is what makes chant#1208's
+// round-trip demonstrable offline instead of only asserting the noop case.
+describe("rollbackToRevision --dry-run", () => {
+  const git = async (args: string[], cwd: string) => {
+    const { promisify } = await import("node:util");
+    const { execFile } = await import("node:child_process");
+    return promisify(execFile)("git", args, { cwd });
+  };
+
+  /** A throwaway repo with two commits and NO remote configured. */
+  async function repoWithTwoCommits(): Promise<{ dir: string; base: string }> {
+    const { mkdtempSync, mkdirSync, writeFileSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const dir = mkdtempSync(join(tmpdir(), "chant-rollback-test-"));
+    mkdirSync(join(dir, "src"));
+    await git(["init", "-q"], dir);
+    await git(["config", "user.email", "t@example.com"], dir);
+    await git(["config", "user.name", "t"], dir);
+    writeFileSync(join(dir, "src", "main.ts"), "export const a = 1;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "v1"], dir);
+    const base = (await git(["rev-parse", "HEAD"], dir)).stdout.trim();
+    writeFileSync(join(dir, "src", "main.ts"), "export const a = 2;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "v2"], dir);
+    return { dir, base };
+  }
+
+  test("returns the delta without a remote, and leaves no branch behind", async () => {
+    const { dir, base } = await repoWithTwoCommits();
+    const before = (await git(["branch", "--format=%(refname:short)"], dir)).stdout.trim();
+
+    const result = await rollbackToRevision({ ref: base, env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+
+    expect(result.noop).toBe(false);
+    expect(result.prUrl).toBeUndefined();
+    expect(result.diff).toContain("-export const a = 2;");
+    expect(result.diff).toContain("+export const a = 1;");
+
+    // Nothing persisted: same branches as before, and the working tree still
+    // holds the NEW content — a dry run reports, it does not roll back.
+    const after = (await git(["branch", "--format=%(refname:short)"], dir)).stdout.trim();
+    expect(after).toBe(before);
+    const { readFileSync } = await import("node:fs");
+    const { join } = await import("node:path");
+    expect(readFileSync(join(dir, "src", "main.ts"), "utf8")).toContain("a = 2");
+  });
+
+  test("removes a file added since the ref — a per-path checkout leaves it, and that read as noop (#1327)", async () => {
+    // The shape a reconcile produces: `chant import --from <env>` writes NEW
+    // files rather than editing the authored ones, so the whole difference from
+    // the pre-reconcile revision is additions. `git checkout <ref> -- <dir>`
+    // never touches those, so rollback used to report "nothing to roll back".
+    const { dir, base } = await repoWithTwoCommits();
+    const { writeFileSync } = await import("node:fs");
+    const { join } = await import("node:path");
+    writeFileSync(join(dir, "src", "generated.ts"), "export const added = true;\n");
+    await git(["add", "-A"], dir);
+    await git(["commit", "-qm", "reconciled: a new file"], dir);
+
+    const result = await rollbackToRevision({ ref: base, env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+
+    expect(result.noop).toBe(false);
+    expect(result.diff).toContain("src/generated.ts");
+    expect(result.diff).toContain("deleted file");
+  });
+
+  test("still reports noop when the source already matches the ref", async () => {
+    const { dir } = await repoWithTwoCommits();
+    const result = await rollbackToRevision({ ref: "HEAD", env: "local", sourceDir: "src", cwd: dir, dryRun: true });
+    expect(result.noop).toBe(true);
+    expect(result.diff).toBeUndefined();
+  });
+});

package/src/lifecycle/rollback.ts

@@ -40,19 +40,37 @@ export interface RollbackResult {
   noop: boolean;
   branch?: string;
   prUrl?: string;
+  /**
+   * The rollback delta as a unified diff — present only for a `dryRun`, where
+   * it is the whole point: the PR body's diff is what a reviewer would act on,
+   * so producing it without a PR is what makes the delta inspectable offline.
+   */
+  diff?: string;
 }
 
 /**
  * Open a rollback PR restoring `sourceDir` to `ref`. Isolated worktree; the
  * caller's branch is untouched. Throws on an unknown ref or a git/gh failure.
+ *
+ * `dryRun` computes the same delta and returns it as a diff without pushing a
+ * branch or opening a PR, leaving the repository exactly as it found it.
+ *
+ * That mode exists because the PR path needs a GitHub remote and an
+ * authenticated `gh` — reasonable for the operator flow this was built for
+ * (#873), and impossible for a hermetic acceptance run. chant#1208's CC
+ * round-trip has to demonstrate rollback offline, on an emulator, with no
+ * remote in the picture; without this it could only assert the `noop` case,
+ * which exercises none of the interesting work.
  */
 export async function rollbackToRevision(opts: {
   ref: string;
   env: string | undefined;
   sourceDir: string;
   cwd: string;
+  /** Compute and return the delta; open no PR, push nothing, leave no branch. */
+  dryRun?: boolean;
 }): Promise<RollbackResult> {
-  const { ref, env, sourceDir, cwd } = opts;
+  const { ref, env, sourceDir, cwd, dryRun } = opts;
   const git = (args: string[], wd: string): Promise<{ stdout: string }> => execFileAsync("git", args, { cwd: wd });
 
   const repoRoot = (await git(["rev-parse", "--show-toplevel"], cwd)).stdout.trim();
@@ -64,11 +82,28 @@ export async function rollbackToRevision(opts: {
 
   await git(["worktree", "add", wt, "-b", branch, "HEAD"], repoRoot);
   try {
-    // Restore just the source tree to the target revision (stages the changes).
+    // Restore the source tree to the target revision (stages the changes).
+    //
+    // `git checkout <ref> -- <dir>` alone is a PER-PATH checkout, not a tree
+    // replacement: it restores the paths that exist at `ref` and leaves
+    // everything else untouched, so a file added since `ref` survives. That
+    // made rollback report "nothing to roll back" whenever the only difference
+    // was added files (#1327) — which is exactly what a reconcile produces,
+    // since `chant import --from <env>` writes NEW files rather than editing
+    // the authored ones. Clearing the directory first makes this a real
+    // restore, so the deletions show up in the delta.
+    await git(["rm", "-rq", "--ignore-unmatch", "--", sourceDir], wt);
     await git(["checkout", ref, "--", sourceDir], wt);
     const staged = (await git(["status", "--porcelain", "--", sourceDir], wt)).stdout.trim();
     if (!staged) return { noop: true };
 
+    // The delta, before committing: `git diff` against the index shows exactly
+    // what restoring the source to `ref` changes. A dry run stops here.
+    if (dryRun) {
+      const { stdout } = await git(["diff", "--cached", "--", sourceDir], wt);
+      return { noop: false, branch, diff: stdout };
+    }
+
     await git(["commit", "-m", rollbackTitle(env, ref)], wt);
     await git(["push", "-u", "origin", branch], wt);
     const { stdout } = await execFileAsync(
@@ -79,5 +114,9 @@ export async function rollbackToRevision(opts: {
     return { noop: false, branch, prUrl: stdout.trim() };
   } finally {
     await git(["worktree", "remove", "--force", wt], repoRoot).catch(() => {});
+    // Removing the worktree leaves its branch behind. For the PR path that is
+    // correct — the branch is the PR. A dry run must leave nothing, or a repo
+    // accumulates a `chant/rollback-*` branch per inspection.
+    if (dryRun) await git(["branch", "-D", branch], repoRoot).catch(() => {});
   }
 }

package/src/lifecycle/status.test.ts

@@ -37,8 +37,18 @@ describe("status", () => {
         ],
       };
       const evidence = liveEvidenceFromChangeSet(cs);
-      expect(evidence.get("search-service")).toEqual({ live: true, action: "noop", ownership: "owned" });
-      expect(evidence.get("orphan-thing")).toEqual({ live: true, action: "adopt", ownership: "foreign" });
+      expect(evidence.get("search-service")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
+      expect(evidence.get("orphan-thing")).toEqual({
+        live: true,
+        action: "adopt",
+        ownership: "foreign",
+        rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+      });
     });
 
     // #598: a component's name need not equal the live entity/resource name
@@ -54,7 +64,15 @@ describe("status", () => {
         };
         const mapping: LiveNameMapping = new Map([["search-svc", ["search-service-v2"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
-        expect(evidence.get("search-svc")).toEqual({ live: true, action: "noop", ownership: "owned" });
+        // The merged verdict, plus the per-resource counts it collapsed
+        // (behold#98) — a consumer with no deploy object to read paints from
+        // those rather than from a CloudFormation stack.
+        expect(evidence.get("search-svc")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
         // The live entity's own name is no longer a separate top-level key once
         // it's claimed by an explicit mapping's component.
       });
@@ -68,7 +86,14 @@ describe("status", () => {
         };
         const mapping: LiveNameMapping = new Map([["some-other-component", ["renamed-thing"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
-        expect(evidence.get("search-service")).toEqual({ live: true, action: "noop", ownership: "owned" });
+        // A rollup of one: the identity join still reports the shape, so a
+        // consumer never branches on whether a mapping was configured.
+        expect(evidence.get("search-service")).toEqual({
+          live: true,
+          action: "noop",
+          ownership: "owned",
+          rollup: { total: 1, present: 1, absent: 0, unobserved: 0 },
+        });
       });
 
       test("aggregates evidence across several live names owned by one component", () => {
@@ -82,7 +107,12 @@ describe("status", () => {
         const mapping: LiveNameMapping = new Map([["neo4j-cluster", ["cluster-node-1", "cluster-node-2"]]]);
         const evidence = liveEvidenceFromChangeSet(cs, mapping);
         // Drift on any owned entity surfaces as drift for the component.
-        expect(evidence.get("neo4j-cluster")).toEqual({ live: true, action: "update", ownership: "owned" });
+        expect(evidence.get("neo4j-cluster")).toEqual({
+          live: true,
+          action: "update",
+          ownership: "owned",
+          rollup: { total: 2, present: 2, absent: 0, unobserved: 0 },
+        });
       });
 
       test("a mapped component with none of its live names observed has no evidence entry", () => {
@@ -135,6 +165,39 @@ describe("status", () => {
       expect(rows[0].reconciliation).toBe("drifted");
     });
 
+    // behold#98 — floci-az and floci-gcp have no deploy object, so `stack` is
+    // absent and a renderer has nothing provider-native to colour from. The
+    // rollup is the substrate-neutral source for the same job.
+    test("surfaces a resource rollup for a component with no deploy object", () => {
+      const liveEvidence = new Map<string, LiveComponentEvidence>([
+        [
+          "search-service",
+          { live: true, ownership: "owned", rollup: { total: 4, present: 3, absent: 0, unobserved: 1 } },
+        ],
+      ]);
+      const rows = reconcileStatus("prod", [record()], { liveEvidence });
+      expect(rows[0].resources).toEqual({ total: 4, present: 3, absent: 0, unobserved: 1 });
+      // No CloudFormation stack to enrich from, and the row is still paintable.
+      expect(rows[0].stack).toBeUndefined();
+    });
+
+    test("a rollup and a stack coexist — the stack stays the richer enrichment where it exists", () => {
+      const liveEvidence = new Map<string, LiveComponentEvidence>([
+        [
+          "search-service",
+          {
+            live: true,
+            ownership: "owned",
+            stack: { name: "app-prod-search", status: "CREATE_COMPLETE", healthy: true },
+            rollup: { total: 2, present: 2, absent: 0, unobserved: 0 },
+          },
+        ],
+      ]);
+      const rows = reconcileStatus("prod", [record()], { liveEvidence });
+      expect(rows[0].resources).toEqual({ total: 2, present: 2, absent: 0, unobserved: 0 });
+      expect(rows[0].stack?.healthy).toBe(true);
+    });
+
     test("surfaces machine-readable live + stack status when observed (#57 hardening)", () => {
       const liveEvidence = new Map<string, LiveComponentEvidence>([
         ["search-service", { live: true, ownership: "owned", stack: { name: "app-prod-search", status: "CREATE_COMPLETE", healthy: true } }],
@@ -395,6 +458,28 @@ describe("status", () => {
       expect(merged.get("a")!.unobserved).toBeUndefined();
       expect(merged.get("b")!.unobserved?.reason).toBe("read-failed");
     });
+
+    test("the change-set rollup survives the stack overlay (behold#100)", () => {
+      // The merge rebuilds the evidence object field by field, so a field it
+      // does not name is dropped. `describeStackStatus` reports a stack, not
+      // per-resource counts, so the supplement never carries a rollup — and
+      // dropping the base's meant AWS, the only substrate with a stack
+      // observer, was the one substrate whose rows lost the #1300 counts.
+      const rollup = { total: 10, present: 10, absent: 0, unobserved: 0 };
+      const base = new Map<string, LiveComponentEvidence>([["cc-canonical", { live: true, ownership: "owned", rollup }]]);
+      const supplement = new Map<string, LiveComponentEvidence>([
+        ["cc-canonical", { live: true, ownership: "owned", stack: { name: "cc-canonical", status: "CREATE_COMPLETE", healthy: true } }],
+      ]);
+      const merged = mergeLiveEvidence(base, supplement);
+      expect(merged.get("cc-canonical")!.rollup).toEqual(rollup);
+      expect(merged.get("cc-canonical")!.stack?.status).toBe("CREATE_COMPLETE");
+    });
+
+    test("no rollup on either side leaves the field absent rather than undefined", () => {
+      const base = new Map<string, LiveComponentEvidence>([["c", { live: true }]]);
+      const supplement = new Map<string, LiveComponentEvidence>([["c", { live: true, ownership: "owned" }]]);
+      expect(mergeLiveEvidence(base, supplement).get("c")).not.toHaveProperty("rollup");
+    });
   });
 
   // ── The observation tri-state reaches the status join (#1089) ─────────────