@intentius/chant 0.37.2 → 0.39.0

package/src/lifecycle/deep-diff.ts

@@ -59,6 +59,17 @@ export interface PropertyDrift {
    * accepted value there would lose the most useful column in the report.
    */
   baseline?: unknown;
+  /**
+   * The field manager that owns this path live, where the substrate records one
+   * (#1189) — Kubernetes' `managedFields`, and nowhere else today.
+   *
+   * `kind` says a path is `undeclared` or `changed`; this says who did it.
+   * "Owned by `kubectl-client-side-apply`" and "owned by `hpa-controller`" are
+   * the same `kind` and mean opposite things: one is somebody bypassing the
+   * pipeline, the other is a controller doing its job. Absent on a substrate
+   * with no per-field ownership, which is every substrate but k8s.
+   */
+  owner?: string;
 }
 
 /** Property-level drift for one declared entity. */
@@ -173,11 +184,16 @@ export function diffDeep(input: DiffDeepInput): DeepDiffResult {
       if (hasDeclared && hasLive && deepValueEqual(declaredValue, liveValue)) continue;
 
       const kind: PropertyDriftKind = !hasDeclared ? "undeclared" : !hasLive ? "absent" : "changed";
+      // Who owns the path live, where the substrate records it (#1189). Only
+      // meaningful for a path that exists live — an `absent` drift has no live
+      // field for anyone to own.
+      const owner = hasLive ? liveEntity.fieldOwners?.[path] : undefined;
       const drift: PropertyDrift = {
         path,
         kind,
         ...(hasDeclared ? { declared: declaredValue } : {}),
         ...(hasLive ? { live: liveValue } : {}),
+        ...(owner ? { owner } : {}),
       };
 
       const acceptedEntry = acceptedDeviation(baseline, name, path);

package/src/lifecycle/digest.test.ts

@@ -115,3 +115,84 @@ describe("diffDigests", () => {
     expect(result.removed.sort()).toEqual(["c"]);
   });
 });
+
+/**
+ * chant #1442 — a digest records what interpreted the declarations, not only
+ * what was declared.
+ */
+function withVersions(versions: Record<string, string> | undefined): BuildResult {
+  const result = makeBuildResult({ k8s: [{ name: "app", type: "K8s::Apps::Deployment", props: { replicas: 2 } }] });
+  return { ...result, lexiconVersions: versions } as unknown as BuildResult;
+}
+
+describe("computeBuildDigest — lexicon versions (#1442)", () => {
+  test("records the version of each lexicon that served the build", () => {
+    expect(computeBuildDigest(withVersions({ k8s: "0.38.0" })).lexiconVersions).toEqual({ k8s: "0.38.0" });
+  });
+
+  test("records once per lexicon, not once per resource", () => {
+    const many = makeBuildResult({
+      k8s: [
+        { name: "a", type: "K8s::Apps::Deployment", props: {} },
+        { name: "b", type: "K8s::Core::Service", props: {} },
+      ],
+    });
+    const digest = computeBuildDigest({ ...many, lexiconVersions: { k8s: "0.38.0" } } as unknown as BuildResult);
+    expect(Object.keys(digest.resources)).toHaveLength(2);
+    expect(digest.lexiconVersions).toEqual({ k8s: "0.38.0" });
+  });
+
+  test("a build with no plugins records an empty map, not absence", () => {
+    // Absent and empty mean different things when read back: absent is
+    // "recorded before #1442", empty is "recorded, nothing loaded".
+    expect(computeBuildDigest(withVersions(undefined)).lexiconVersions).toEqual({});
+  });
+
+  test("the recorded map is a copy, so later mutation cannot rewrite history", () => {
+    const versions = { k8s: "0.38.0" };
+    const digest = computeBuildDigest(withVersions(versions));
+    versions.k8s = "0.39.0";
+    expect(digest.lexiconVersions).toEqual({ k8s: "0.38.0" });
+  });
+});
+
+describe("diffDigests — lexicon version changes (#1442)", () => {
+  const resources = { app: { type: "K8s::Apps::Deployment", lexicon: "k8s", propsHash: "same" } };
+  const digest = (lexiconVersions?: Record<string, string>): BuildDigest =>
+    ({ resources, dependencies: {}, outputs: {}, deployOrder: ["k8s"], lexiconVersions }) as BuildDigest;
+
+  test("reports a bump even when every resource is unchanged", () => {
+    const diff = diffDigests(digest({ k8s: "0.39.0" }), digest({ k8s: "0.38.0" }));
+    expect(diff.changed).toEqual([]);
+    expect(diff.unchanged).toEqual(["app"]);
+    expect(diff.lexiconVersionChanges).toEqual([{ lexicon: "k8s", previous: "0.38.0", current: "0.39.0" }]);
+  });
+
+  test("reports nothing when versions match", () => {
+    expect(diffDigests(digest({ k8s: "0.38.0" }), digest({ k8s: "0.38.0" })).lexiconVersionChanges).toEqual([]);
+  });
+
+  test("reports a lexicon added to or dropped from the build", () => {
+    const added = diffDigests(digest({ k8s: "0.38.0", aws: "0.38.0" }), digest({ k8s: "0.38.0" }));
+    expect(added.lexiconVersionChanges).toEqual([{ lexicon: "aws", previous: undefined, current: "0.38.0" }]);
+
+    const dropped = diffDigests(digest({ k8s: "0.38.0" }), digest({ k8s: "0.38.0", aws: "0.38.0" }));
+    expect(dropped.lexiconVersionChanges).toEqual([{ lexicon: "aws", previous: "0.38.0", current: undefined }]);
+  });
+
+  test("a pre-#1442 snapshot reports no change rather than inventing one", () => {
+    // The older digest never recorded versions. Every lexicon would otherwise
+    // look newly-added on the first comparison after upgrading chant.
+    expect(diffDigests(digest({ k8s: "0.38.0" }), digest(undefined)).lexiconVersionChanges).toEqual([]);
+    expect(diffDigests(digest(undefined), digest({ k8s: "0.38.0" })).lexiconVersionChanges).toEqual([]);
+  });
+
+  test("with no previous digest at all, there is no version change", () => {
+    expect(diffDigests(digest({ k8s: "0.38.0" }), undefined).lexiconVersionChanges).toEqual([]);
+  });
+
+  test("changes are ordered by lexicon name, so output is stable", () => {
+    const diff = diffDigests(digest({ k8s: "2", aws: "2", gcp: "2" }), digest({ k8s: "1", aws: "1", gcp: "1" }));
+    expect(diff.lexiconVersionChanges.map((c) => c.lexicon)).toEqual(["aws", "gcp", "k8s"]);
+  });
+});

package/src/lifecycle/digest.ts

@@ -41,6 +41,10 @@ export function computeBuildDigest(buildResult: BuildResult): BuildDigest {
 
   return {
     resources,
+    // chant #1442 — what interpreted the declarations, alongside what was
+    // declared. Always present on a freshly computed digest, so "absent"
+    // unambiguously means "recorded before #1442".
+    lexiconVersions: { ...buildResult.lexiconVersions },
     dependencies,
     outputs: buildResult.manifest.outputs,
     deployOrder: buildResult.manifest.deployOrder,
@@ -60,9 +64,10 @@ export function diffDigests(
   const unchanged: string[] = [];
 
   if (!previous) {
-    // No previous digest — everything is added
+    // No previous digest — everything is added, and there is no version to
+    // have moved away from.
     added.push(...Object.keys(current.resources));
-    return { added, removed, changed, unchanged };
+    return { added, removed, changed, unchanged, lexiconVersionChanges: [] };
   }
 
   // Check current resources against previous
@@ -84,5 +89,31 @@ export function diffDigests(
     }
   }
 
-  return { added, removed, changed, unchanged };
+  return { added, removed, changed, unchanged, lexiconVersionChanges: diffLexiconVersions(current, previous) };
+}
+
+/**
+ * Lexicons whose version moved between two digests (chant #1442).
+ *
+ * A digest recorded before this existed has no `lexiconVersions` at all. That
+ * is reported as no change rather than as every lexicon appearing — comparing
+ * against an older snapshot must not manufacture a difference that the older
+ * build simply never recorded.
+ */
+function diffLexiconVersions(
+  current: BuildDigest,
+  previous: BuildDigest,
+): Array<{ lexicon: string; previous?: string; current?: string }> {
+  if (!current.lexiconVersions || !previous.lexiconVersions) return [];
+
+  const changes: Array<{ lexicon: string; previous?: string; current?: string }> = [];
+  for (const lexicon of new Set([
+    ...Object.keys(current.lexiconVersions),
+    ...Object.keys(previous.lexiconVersions),
+  ])) {
+    const now = current.lexiconVersions[lexicon];
+    const before = previous.lexiconVersions[lexicon];
+    if (now !== before) changes.push({ lexicon, previous: before, current: now });
+  }
+  return changes.sort((a, b) => a.lexicon.localeCompare(b.lexicon));
 }

package/src/lifecycle/identity.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from "vitest";
+import { regionOf, unqualifiedKey } from "./identity";
+
+describe("regionOf", () => {
+  it("reads the region a lexicon stamped", () => {
+    expect(regionOf({ attributes: { region: "us-west-1" } })).toBe("us-west-1");
+  });
+
+  it("treats a missing, empty or non-string region as none", () => {
+    expect(regionOf({})).toBeUndefined();
+    expect(regionOf({ attributes: {} })).toBeUndefined();
+    expect(regionOf({ attributes: { region: "" } })).toBeUndefined();
+    expect(regionOf({ attributes: { region: 1 } })).toBeUndefined();
+  });
+});
+
+describe("unqualifiedKey", () => {
+  it("carries the region when there is one", () => {
+    expect(unqualifiedKey("sg-1", { attributes: { region: "us-east-1" } })).toBe("us-east-1::sg-1");
+  });
+
+  it("leaves an id with no region bare", () => {
+    expect(unqualifiedKey("arn:aws:iam::1:policy/p", {})).toBe("arn:aws:iam::1:policy/p");
+  });
+
+  it("is idempotent, so a second pass does not double-qualify", () => {
+    const meta = { attributes: { region: "us-east-1" } };
+    expect(unqualifiedKey(unqualifiedKey("sg-1", meta), meta)).toBe("us-east-1::sg-1");
+  });
+
+  it("qualifies an id that already carries a DIFFERENT region", () => {
+    // Not a case the readers produce, but the guard is a prefix test and it
+    // should not silently accept `us-west-1::sg-1` as already being in
+    // us-east-1.
+    expect(unqualifiedKey("us-west-1::sg-1", { attributes: { region: "us-east-1" } })).toBe(
+      "us-east-1::us-west-1::sg-1",
+    );
+  });
+});

package/src/lifecycle/identity.ts

@@ -0,0 +1,61 @@
+/**
+ * What makes an unqualified resource one resource (#1416).
+ *
+ * Managed resources are stack-qualified (`${stack}::${id}`, #1162) and cannot
+ * collide. Everything else — dependencies (#1273) and ambient resources (#1278)
+ * — is keyed by physical id and merged across stacks, because the account's
+ * default VPC route table is one resource however many stacks route through it.
+ *
+ * That is right for a resource that really is account-level, and wrong for a
+ * regional one. A VPC, subnet or security group in `us-west-1` is a different
+ * resource from one in `us-east-1`, and merging them by id drops all but the
+ * first sighting.
+ *
+ * On AWS the difference is invisible: VPC, subnet and security-group ids are
+ * globally unique, so keying by id and keying by (region, id) give the same
+ * answer. It shows up against an emulator that reuses ids across regions
+ * (lex00/floci#21), where a three-region estate's nine default subnets merged
+ * to three and "how many subnets are empty" came back 2 instead of 8.
+ *
+ * The rule is deliberately not a table of regional kinds. A lexicon stamps a
+ * region on a resource when region is part of that resource's identity — the
+ * AWS lexicon does it in `stampRegion` for ambient resources and its own
+ * property reads — and this reads that stamp back. A genuinely account-level
+ * resource carries no region and keeps merging as it always did, which is why
+ * dependencies (never stamped) are untouched by this.
+ */
+
+import type { ResourceMetadata } from "../lexicon";
+
+/**
+ * The region a resource records itself as being in, if it records one.
+ *
+ * Read from `attributes.region`, which is where a lexicon stamps it. Absent
+ * means the resource is account-level, or the lexicon has no region to give —
+ * both of which are read the same way, as "region is not part of this id".
+ */
+export function regionOf(meta: Pick<ResourceMetadata, "attributes">): string | undefined {
+  const region = meta.attributes?.region;
+  return typeof region === "string" && region.length > 0 ? region : undefined;
+}
+
+/**
+ * The key an unqualified resource merges under.
+ *
+ * `${region}::${id}` for a resource that carries a region, matching the shape
+ * stack qualification already uses, and the bare id for one that does not.
+ *
+ * Applied only where results from more than one region are actually merged —
+ * `collectAmbient` across stacks, `replaySnapshots` across recorded stacks.
+ * Recording one region's observation qualifies nothing, so a stored snapshot
+ * keeps the keys it has always had and the first snapshot taken after this
+ * lands does not diff as "every ambient resource replaced".
+ *
+ * Idempotent, so an id that already carries this region survives a second pass
+ * unchanged rather than becoming `us-east-1::us-east-1::sg-1`.
+ */
+export function unqualifiedKey(id: string, meta: Pick<ResourceMetadata, "attributes">): string {
+  const region = regionOf(meta);
+  if (!region) return id;
+  return id.startsWith(`${region}::`) ? id : `${region}::${id}`;
+}

package/src/lifecycle/observe.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi } from "vitest";
-import { observeResources } from "./observe";
+import { observeResources, collectAmbient } from "./observe";
 import { observation } from "../observation";
 import type { ObservationLexicon, ResourceMetadata } from "../lexicon";
 import type { BuildResult } from "../build";
@@ -246,3 +246,77 @@ describe("observeResources", () => {
     expect(calls[0]).not.toHaveProperty("stack");
   });
 });
+
+describe("collectAmbient — one resource per region, not per account (#1416)", () => {
+  const subnets = (region: string): Record<string, ResourceMetadata> =>
+    Object.fromEntries(
+      ["subnet-default-a", "subnet-default-b"].map((id) => [
+        id,
+        {
+          type: "AWS::EC2::Subnet",
+          status: "OBSERVED",
+          physicalId: id,
+          ambient: true,
+          attributes: { region },
+        } as ResourceMetadata,
+      ]),
+    );
+
+  function ambientPlugin(): ObservationLexicon {
+    return {
+      name: "aws",
+      describeResources: async () => ({}),
+      observeAmbient: async (opts: { region?: string }) => subnets(opts.region ?? "us-east-1"),
+    } as unknown as ObservationLexicon;
+  }
+
+  it("keeps every region's copy when the ids collide across regions", async () => {
+    const found = await collectAmbient(ambientPlugin(), {
+      environment: "prod",
+      kinds: ["AWS::EC2::Subnet"],
+      observed: {},
+      stacks: [
+        { name: "east", region: "us-east-1" },
+        { name: "west1", region: "us-west-1" },
+        { name: "west2", region: "us-west-2" },
+      ],
+      warnings: [],
+    });
+    expect(Object.keys(found).sort()).toEqual([
+      "us-east-1::subnet-default-a",
+      "us-east-1::subnet-default-b",
+      "us-west-1::subnet-default-a",
+      "us-west-1::subnet-default-b",
+      "us-west-2::subnet-default-a",
+      "us-west-2::subnet-default-b",
+    ]);
+  });
+
+  it("still merges two stacks in the same region to one resource each", async () => {
+    const found = await collectAmbient(ambientPlugin(), {
+      environment: "prod",
+      kinds: ["AWS::EC2::Subnet"],
+      observed: {},
+      stacks: [
+        { name: "web", region: "us-east-1" },
+        { name: "api", region: "us-east-1" },
+      ],
+      warnings: [],
+    });
+    expect(Object.keys(found).sort()).toEqual([
+      "us-east-1::subnet-default-a",
+      "us-east-1::subnet-default-b",
+    ]);
+  });
+
+  it("leaves a single stack's ids bare — one region is not a merge", async () => {
+    const found = await collectAmbient(ambientPlugin(), {
+      environment: "prod",
+      kinds: ["AWS::EC2::Subnet"],
+      observed: {},
+      stacks: [{ name: "main", region: "us-east-1" }],
+      warnings: [],
+    });
+    expect(Object.keys(found).sort()).toEqual(["subnet-default-a", "subnet-default-b"]);
+  });
+});

package/src/lifecycle/observe.ts

@@ -24,6 +24,7 @@ import {
   type NormalizedObservation,
 } from "../observation";
 import { zeroResourcesWarning } from "../live-endpoint";
+import { unqualifiedKey } from "./identity";
 
 export interface ObserveResult {
   observations: LiveObservation[];
@@ -208,7 +209,21 @@ export async function observeResources(
             warnings,
           })
         : {};
-      for (const [id, meta] of Object.entries(ambient)) dependencies.resources[id] ??= meta;
+      // A resource can be reached as a dependency AND enumerated as ambient —
+      // the default VPC an instance sits in is both. It is one resource, and
+      // the dependency entry is the one carrying `referencedBy`, so it wins.
+      // Matched on physical id rather than on key, because ambient keys carry a
+      // region (#1416) and dependency keys do not, so the keys no longer
+      // collide even when the resource is the same one.
+      const dependedOn = new Set(
+        Object.values(dependencies.resources)
+          .map((m) => m.physicalId)
+          .filter((id): id is string => typeof id === "string"),
+      );
+      for (const [id, meta] of Object.entries(ambient)) {
+        if (meta.physicalId && dependedOn.has(meta.physicalId)) continue;
+        dependencies.resources[id] ??= meta;
+      }
       pushObservation(
         observations,
         warnings,
@@ -268,6 +283,11 @@ function scopeToStack(
  * Ask a lexicon what exists of the kinds it manages, beyond what is declared
  * (#1278). Once per stack for the region, merged by physical id — the same
  * ambient resource seen from two stacks is one resource.
+ *
+ * "The same" is per region (#1416). Two stacks in one region reporting the
+ * account's default security group is one group; two regions' default security
+ * groups are two, whatever their ids look like, so the merge key carries the
+ * region a resource records itself in.
  */
 export async function collectAmbient(
   plugin: ObservationLexicon,
@@ -282,6 +302,10 @@ export async function collectAmbient(
   if (!plugin.observeAmbient || opts.kinds.length === 0) return {};
   const found: Record<string, ResourceMetadata> = {};
   const refs = opts.stacks.length > 0 ? opts.stacks : [{ name: undefined, region: undefined }];
+  // Only a merge needs region-qualified keys, and one ref is not a merge. This
+  // is what keeps a single-region project's ids exactly what they were, and a
+  // recorded snapshot — always one stack, so always one ref — bare.
+  const merging = refs.length > 1;
   for (const ref of refs) {
     try {
       const part = await plugin.observeAmbient({
@@ -291,7 +315,9 @@ export async function collectAmbient(
         ...(ref.name ? { stack: ref.name } : {}),
         ...(ref.region ? { region: ref.region } : {}),
       });
-      for (const [id, meta] of Object.entries(part)) found[id] ??= meta;
+      for (const [id, meta] of Object.entries(part)) {
+        found[merging ? unqualifiedKey(id, meta) : id] ??= meta;
+      }
     } catch (err) {
       opts.warnings.push(
         `${plugin.name}: ambient resources not read${ref.name ? ` for stack "${ref.name}"` : ""} — ${err instanceof Error ? err.message : String(err)}`,

package/src/lifecycle/replay.test.ts

@@ -0,0 +1,251 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import type { LifecycleSnapshot } from "./types";
+
+// `replaySnapshots` reads the orphan branch through this one function, so the
+// stored set is the whole input surface.
+const stored = new Map<string, string>();
+vi.mock("./git", () => ({
+  readEnvironmentSnapshots: async (): Promise<Map<string, string>> => stored,
+}));
+
+const { replaySnapshots } = await import("./replay");
+
+/** One region's recorded stack: an instance it manages, plus ambient resources. */
+function snapshot(
+  stack: string,
+  region: string,
+  opts: {
+    ambient?: Record<string, { type: string; physicalId?: string }>;
+    managed?: Record<string, string>;
+    edges?: Array<{ from: string; to: string; kind: "ref" }>;
+  } = {},
+): string {
+  const snap: LifecycleSnapshot = {
+    lexicon: "aws",
+    environment: "prod",
+    stack,
+    commit: "abc123",
+    timestamp: "2026-08-03T00:00:00.000Z",
+    resources: {
+      ...Object.fromEntries(
+        Object.entries(opts.managed ?? {}).map(([name, physicalId]) => [
+          name,
+          { type: "AWS::EC2::Instance", status: "OBSERVED", physicalId },
+        ]),
+      ),
+      ...Object.fromEntries(
+        Object.entries(opts.ambient ?? {}).map(([id, meta]) => [
+          id,
+          {
+            type: meta.type,
+            status: "OBSERVED",
+            physicalId: meta.physicalId ?? id,
+            ambient: true,
+            ownership: "foreign" as const,
+            // What `stampRegion` puts there on the real path (#1279).
+            attributes: { region },
+          },
+        ]),
+      ),
+    },
+    ...(opts.edges ? { edges: opts.edges } : {}),
+  };
+  return JSON.stringify(snap);
+}
+
+function keys(observations: Array<{ resources: Record<string, unknown> }>): string[] {
+  return observations.flatMap((o) => Object.keys(o.resources)).sort();
+}
+
+beforeEach(() => {
+  stored.clear();
+});
+
+describe("replaySnapshots — ambient identity across regions (#1416)", () => {
+  it("keeps each region's copy when the ids collide", async () => {
+    // What Floci does (lex00/floci#21): the default VPC and its subnets carry
+    // the same id strings in every region. Real AWS ids are globally unique, so
+    // this is only observable against the emulator — but the merge is the same
+    // merge either way.
+    for (const region of ["us-east-1", "us-west-1", "us-west-2"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, {
+        ambient: {
+          "vpc-default": { type: "AWS::EC2::VPC" },
+          "subnet-default-a": { type: "AWS::EC2::Subnet" },
+          "subnet-default-b": { type: "AWS::EC2::Subnet" },
+        },
+      }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+
+    // Nine ambient resources went in; before this fix three came out.
+    expect(keys(result.observations)).toEqual([
+      "us-east-1::subnet-default-a",
+      "us-east-1::subnet-default-b",
+      "us-east-1::vpc-default",
+      "us-west-1::subnet-default-a",
+      "us-west-1::subnet-default-b",
+      "us-west-1::vpc-default",
+      "us-west-2::subnet-default-a",
+      "us-west-2::subnet-default-b",
+      "us-west-2::vpc-default",
+    ]);
+  });
+
+  it("still merges one region's resource seen from two stacks", async () => {
+    // The case the account-level rule was written for: two stacks in the same
+    // region each recorded the region's default security group. That is one
+    // group, and counting it twice would inflate every count over it.
+    stored.set("web__aws", snapshot("web", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+    }));
+    stored.set("api__aws", snapshot("api", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+    }));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["us-east-1::sg-default"]);
+  });
+
+  it("leaves a single recorded stack's ids exactly as recorded", async () => {
+    // One stack is one region: nothing to merge, so nothing to disambiguate.
+    // A single-region project's ids must not move.
+    stored.set("main__aws", snapshot("main", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+      managed: { web: "i-123" },
+    }));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["sg-default", "web"]);
+  });
+
+  it("does not region-qualify a managed resource", async () => {
+    // Managed ids join the declared canvas, which qualifies by stack or not at
+    // all. Region-qualifying `web` would unjoin it from its own declaration.
+    for (const region of ["us-east-1", "us-west-1"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, { managed: { web: `i-${region}` } }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set(["us-east-1", "us-west-1"]));
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["us-east-1::web", "us-west-1::web"]);
+  });
+
+  it("leaves an ambient resource with no recorded region alone", async () => {
+    // A resource carrying no region is account-level as far as anything here
+    // can tell, and account-level is what the original merge assumed. IAM is
+    // the shape: one policy, seen from every region's stack.
+    const global = (stack: string): string =>
+      JSON.stringify({
+        lexicon: "aws",
+        environment: "prod",
+        stack,
+        commit: "abc123",
+        timestamp: "2026-08-03T00:00:00.000Z",
+        resources: {
+          "arn:aws:iam::1:policy/p": {
+            type: "AWS::IAM::Policy",
+            status: "OBSERVED",
+            physicalId: "arn:aws:iam::1:policy/p",
+            ambient: true,
+          },
+        },
+      } satisfies LifecycleSnapshot);
+    stored.set("us-east-1__aws", global("us-east-1"));
+    stored.set("us-west-1__aws", global("us-west-1"));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["arn:aws:iam::1:policy/p"]);
+  });
+
+  it("re-points edges at the keys the resources ended up under", async () => {
+    // An edge naming `subnet-default-a` has to reach the copy in ITS region,
+    // not whichever region sorted first. A dangling edge is worse than the
+    // collision it replaced: the node is present and simply unreachable.
+    for (const region of ["us-east-1", "us-west-1"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, {
+        ambient: {
+          "subnet-default-a": { type: "AWS::EC2::Subnet" },
+          "eni-1": { type: "AWS::EC2::NetworkInterface" },
+        },
+        edges: [{ from: "eni-1", to: "subnet-default-a", kind: "ref" }],
+      }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    const edges = result.observations.flatMap((o) => o.edges ?? []);
+    expect(edges).toEqual([
+      { from: "us-east-1::eni-1", to: "us-east-1::subnet-default-a", kind: "ref" },
+      { from: "us-west-1::eni-1", to: "us-west-1::subnet-default-a", kind: "ref" },
+    ]);
+    // Every endpoint resolves to a node that exists.
+    const nodes = new Set(keys(result.observations));
+    for (const edge of edges) {
+      expect(nodes.has(edge.from)).toBe(true);
+      expect(nodes.has(edge.to)).toBe(true);
+    }
+  });
+});
+
+describe("a resource recorded twice is one node (#1432 follow-up)", () => {
+  // A subnet its stack declares, ALSO recorded as a dependency because
+  // instances reference it. Same physical subnet, two entries.
+  function snap(stack: string): string {
+    return JSON.stringify({
+      lexicon: "aws", environment: "prod", stack,
+      commit: "abc", timestamp: "2026-08-03T00:00:00.000Z",
+      resources: {
+        publicSubnet: { type: "AWS::EC2::Subnet", status: "OBSERVED", physicalId: "subnet-9af06b90" },
+        "subnet-9af06b90": {
+          type: "AWS::EC2::Subnet", status: "OBSERVED", physicalId: "subnet-9af06b90",
+          referencedBy: ["webServer"],
+        },
+        webServer: { type: "AWS::EC2::Instance", status: "OBSERVED", physicalId: "i-1" },
+      },
+      edges: [{ from: "webServer", to: "subnet-9af06b90", kind: "ref", viaAttr: "SubnetId" }],
+    });
+  }
+
+  it("drops the duplicate rather than counting the subnet twice", async () => {
+    stored.set("main__aws", snap("main"));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["publicSubnet", "webServer"]);
+  });
+
+  it("re-points the dropped duplicate's edges at the survivor", async () => {
+    // Dropping the node alone would take this edge with it: buildLiveGraphIr
+    // discards an edge whose endpoints were not both observed, so the instance
+    // would stop being in any subnet at all.
+    stored.set("main__aws", snap("main"));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(result.observations.flatMap((o) => o.edges ?? [])).toEqual([
+      { from: "webServer", to: "publicSubnet", kind: "ref", viaAttr: "SubnetId" },
+    ]);
+  });
+
+  it("keeps a dependency nothing manages", async () => {
+    // The account's default route table: referenced, managed by nobody. It is
+    // not a duplicate and must survive.
+    stored.set("main__aws", JSON.stringify({
+      lexicon: "aws", environment: "prod", stack: "main",
+      commit: "abc", timestamp: "2026-08-03T00:00:00.000Z",
+      resources: {
+        "rtb-default": {
+          type: "AWS::EC2::RouteTable", status: "OBSERVED", physicalId: "rtb-default",
+          referencedBy: ["webServer"],
+        },
+      },
+    }));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["rtb-default"]);
+  });
+});