@intentius/chant 0.38.0 → 0.41.0

package/src/lifecycle/replay.test.ts

@@ -0,0 +1,251 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import type { LifecycleSnapshot } from "./types";
+
+// `replaySnapshots` reads the orphan branch through this one function, so the
+// stored set is the whole input surface.
+const stored = new Map<string, string>();
+vi.mock("./git", () => ({
+  readEnvironmentSnapshots: async (): Promise<Map<string, string>> => stored,
+}));
+
+const { replaySnapshots } = await import("./replay");
+
+/** One region's recorded stack: an instance it manages, plus ambient resources. */
+function snapshot(
+  stack: string,
+  region: string,
+  opts: {
+    ambient?: Record<string, { type: string; physicalId?: string }>;
+    managed?: Record<string, string>;
+    edges?: Array<{ from: string; to: string; kind: "ref" }>;
+  } = {},
+): string {
+  const snap: LifecycleSnapshot = {
+    lexicon: "aws",
+    environment: "prod",
+    stack,
+    commit: "abc123",
+    timestamp: "2026-08-03T00:00:00.000Z",
+    resources: {
+      ...Object.fromEntries(
+        Object.entries(opts.managed ?? {}).map(([name, physicalId]) => [
+          name,
+          { type: "AWS::EC2::Instance", status: "OBSERVED", physicalId },
+        ]),
+      ),
+      ...Object.fromEntries(
+        Object.entries(opts.ambient ?? {}).map(([id, meta]) => [
+          id,
+          {
+            type: meta.type,
+            status: "OBSERVED",
+            physicalId: meta.physicalId ?? id,
+            ambient: true,
+            ownership: "foreign" as const,
+            // What `stampRegion` puts there on the real path (#1279).
+            attributes: { region },
+          },
+        ]),
+      ),
+    },
+    ...(opts.edges ? { edges: opts.edges } : {}),
+  };
+  return JSON.stringify(snap);
+}
+
+function keys(observations: Array<{ resources: Record<string, unknown> }>): string[] {
+  return observations.flatMap((o) => Object.keys(o.resources)).sort();
+}
+
+beforeEach(() => {
+  stored.clear();
+});
+
+describe("replaySnapshots — ambient identity across regions (#1416)", () => {
+  it("keeps each region's copy when the ids collide", async () => {
+    // What Floci does (lex00/floci#21): the default VPC and its subnets carry
+    // the same id strings in every region. Real AWS ids are globally unique, so
+    // this is only observable against the emulator — but the merge is the same
+    // merge either way.
+    for (const region of ["us-east-1", "us-west-1", "us-west-2"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, {
+        ambient: {
+          "vpc-default": { type: "AWS::EC2::VPC" },
+          "subnet-default-a": { type: "AWS::EC2::Subnet" },
+          "subnet-default-b": { type: "AWS::EC2::Subnet" },
+        },
+      }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+
+    // Nine ambient resources went in; before this fix three came out.
+    expect(keys(result.observations)).toEqual([
+      "us-east-1::subnet-default-a",
+      "us-east-1::subnet-default-b",
+      "us-east-1::vpc-default",
+      "us-west-1::subnet-default-a",
+      "us-west-1::subnet-default-b",
+      "us-west-1::vpc-default",
+      "us-west-2::subnet-default-a",
+      "us-west-2::subnet-default-b",
+      "us-west-2::vpc-default",
+    ]);
+  });
+
+  it("still merges one region's resource seen from two stacks", async () => {
+    // The case the account-level rule was written for: two stacks in the same
+    // region each recorded the region's default security group. That is one
+    // group, and counting it twice would inflate every count over it.
+    stored.set("web__aws", snapshot("web", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+    }));
+    stored.set("api__aws", snapshot("api", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+    }));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["us-east-1::sg-default"]);
+  });
+
+  it("leaves a single recorded stack's ids exactly as recorded", async () => {
+    // One stack is one region: nothing to merge, so nothing to disambiguate.
+    // A single-region project's ids must not move.
+    stored.set("main__aws", snapshot("main", "us-east-1", {
+      ambient: { "sg-default": { type: "AWS::EC2::SecurityGroup" } },
+      managed: { web: "i-123" },
+    }));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["sg-default", "web"]);
+  });
+
+  it("does not region-qualify a managed resource", async () => {
+    // Managed ids join the declared canvas, which qualifies by stack or not at
+    // all. Region-qualifying `web` would unjoin it from its own declaration.
+    for (const region of ["us-east-1", "us-west-1"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, { managed: { web: `i-${region}` } }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set(["us-east-1", "us-west-1"]));
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["us-east-1::web", "us-west-1::web"]);
+  });
+
+  it("leaves an ambient resource with no recorded region alone", async () => {
+    // A resource carrying no region is account-level as far as anything here
+    // can tell, and account-level is what the original merge assumed. IAM is
+    // the shape: one policy, seen from every region's stack.
+    const global = (stack: string): string =>
+      JSON.stringify({
+        lexicon: "aws",
+        environment: "prod",
+        stack,
+        commit: "abc123",
+        timestamp: "2026-08-03T00:00:00.000Z",
+        resources: {
+          "arn:aws:iam::1:policy/p": {
+            type: "AWS::IAM::Policy",
+            status: "OBSERVED",
+            physicalId: "arn:aws:iam::1:policy/p",
+            ambient: true,
+          },
+        },
+      } satisfies LifecycleSnapshot);
+    stored.set("us-east-1__aws", global("us-east-1"));
+    stored.set("us-west-1__aws", global("us-west-1"));
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["arn:aws:iam::1:policy/p"]);
+  });
+
+  it("re-points edges at the keys the resources ended up under", async () => {
+    // An edge naming `subnet-default-a` has to reach the copy in ITS region,
+    // not whichever region sorted first. A dangling edge is worse than the
+    // collision it replaced: the node is present and simply unreachable.
+    for (const region of ["us-east-1", "us-west-1"]) {
+      stored.set(`${region}__aws`, snapshot(region, region, {
+        ambient: {
+          "subnet-default-a": { type: "AWS::EC2::Subnet" },
+          "eni-1": { type: "AWS::EC2::NetworkInterface" },
+        },
+        edges: [{ from: "eni-1", to: "subnet-default-a", kind: "ref" }],
+      }));
+    }
+
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    const edges = result.observations.flatMap((o) => o.edges ?? []);
+    expect(edges).toEqual([
+      { from: "us-east-1::eni-1", to: "us-east-1::subnet-default-a", kind: "ref" },
+      { from: "us-west-1::eni-1", to: "us-west-1::subnet-default-a", kind: "ref" },
+    ]);
+    // Every endpoint resolves to a node that exists.
+    const nodes = new Set(keys(result.observations));
+    for (const edge of edges) {
+      expect(nodes.has(edge.from)).toBe(true);
+      expect(nodes.has(edge.to)).toBe(true);
+    }
+  });
+});
+
+describe("a resource recorded twice is one node (#1432 follow-up)", () => {
+  // A subnet its stack declares, ALSO recorded as a dependency because
+  // instances reference it. Same physical subnet, two entries.
+  function snap(stack: string): string {
+    return JSON.stringify({
+      lexicon: "aws", environment: "prod", stack,
+      commit: "abc", timestamp: "2026-08-03T00:00:00.000Z",
+      resources: {
+        publicSubnet: { type: "AWS::EC2::Subnet", status: "OBSERVED", physicalId: "subnet-9af06b90" },
+        "subnet-9af06b90": {
+          type: "AWS::EC2::Subnet", status: "OBSERVED", physicalId: "subnet-9af06b90",
+          referencedBy: ["webServer"],
+        },
+        webServer: { type: "AWS::EC2::Instance", status: "OBSERVED", physicalId: "i-1" },
+      },
+      edges: [{ from: "webServer", to: "subnet-9af06b90", kind: "ref", viaAttr: "SubnetId" }],
+    });
+  }
+
+  it("drops the duplicate rather than counting the subnet twice", async () => {
+    stored.set("main__aws", snap("main"));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["publicSubnet", "webServer"]);
+  });
+
+  it("re-points the dropped duplicate's edges at the survivor", async () => {
+    // Dropping the node alone would take this edge with it: buildLiveGraphIr
+    // discards an edge whose endpoints were not both observed, so the instance
+    // would stop being in any subnet at all.
+    stored.set("main__aws", snap("main"));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(result.observations.flatMap((o) => o.edges ?? [])).toEqual([
+      { from: "webServer", to: "publicSubnet", kind: "ref", viaAttr: "SubnetId" },
+    ]);
+  });
+
+  it("keeps a dependency nothing manages", async () => {
+    // The account's default route table: referenced, managed by nobody. It is
+    // not a duplicate and must survive.
+    stored.set("main__aws", JSON.stringify({
+      lexicon: "aws", environment: "prod", stack: "main",
+      commit: "abc", timestamp: "2026-08-03T00:00:00.000Z",
+      resources: {
+        "rtb-default": {
+          type: "AWS::EC2::RouteTable", status: "OBSERVED", physicalId: "rtb-default",
+          referencedBy: ["webServer"],
+        },
+      },
+    }));
+    const result = await replaySnapshots("prod", "latest", new Set());
+    if ("error" in result) throw new Error(result.error);
+    expect(keys(result.observations)).toEqual(["rtb-default"]);
+  });
+});

package/src/lifecycle/replay.ts

@@ -15,6 +15,7 @@
  */
 
 import { readEnvironmentSnapshots } from "./git";
+import { unqualifiedKey } from "./identity";
 import type { LiveObservation } from "../graph-ir";
 import type { LifecycleSnapshot } from "./types";
 
@@ -72,16 +73,35 @@ export async function replaySnapshots(
   // account-level: the default security group three stacks each recorded is one
   // group, not three. Managed resources are stack-qualified below and cannot
   // collide, so only the unqualified ones need this.
+  //
+  // "Account-level" is the part that needed qualifying (#1416): a resource that
+  // records a region is regional, and two regions' copies are two resources
+  // however equal their ids look. `unqualifiedKey` keys those by region, so the
+  // set below still collapses one region's resource seen from two stacks and no
+  // longer collapses two regions'.
   const seenUnqualified = new Set<string>();
+  // One recorded stack is one region, so there is nothing to merge and nothing
+  // to disambiguate — its ids stay exactly what they were recorded as, which is
+  // also what `chant search --live` gives that project.
+  const merging = stored.size > 1;
   // A stack's snapshot could only exclude what THAT stack manages, so a stack
   // declaring no security groups reported the neighbouring stack's as ambient.
   // The union is only knowable here, with every snapshot in hand.
   const managedPhysicalIds = new Set<string>();
+  // Where a managed resource ends up, by physical id. A duplicate is dropped
+  // below rather than rendered twice, and anything that pointed at the
+  // duplicate has to be re-pointed at the survivor — dropping the node alone
+  // would take its edges with it, since `buildLiveGraphIr` discards an edge
+  // whose endpoints were not both observed.
+  const managedKeyOf = new Map<string, string>();
   for (const content of stored.values()) {
     const snap = JSON.parse(content) as LifecycleSnapshot;
-    for (const meta of Object.values(snap.resources ?? {})) {
+    const snapStack = snap.stack;
+    const snapQualifies = snapStack !== undefined && scopedStacks.has(snapStack);
+    for (const [id, meta] of Object.entries(snap.resources ?? {})) {
       if (!meta.ambient && !meta.referencedBy?.length && meta.physicalId) {
         managedPhysicalIds.add(meta.physicalId);
+        managedKeyOf.set(meta.physicalId, snapQualifies ? `${snapStack}::${id}` : id);
       }
     }
   }
@@ -97,32 +117,60 @@ export async function replaySnapshots(
     // collide, and none of them join the declared canvas, which qualifies.
     const stack = snapshot.stack;
     const qualify = stack !== undefined && scopedStacks.has(stack);
-    // Dependencies (#1273) are keyed by physical id and are account-level: the
-    // default VPC's route table is one resource however many stacks route
-    // through it. Qualifying those would split it per stack and break the
-    // edges into it.
-    const managed = (id: string, meta: { referencedBy?: string[]; ambient?: boolean }): string =>
-      qualify && !meta.ambient && !(meta.referencedBy && meta.referencedBy.length > 0)
-        ? `${stack}::${id}`
-        : id;
+    // Dependencies (#1273) and ambient resources (#1278) are keyed by physical
+    // id and are NOT stack-qualified: the default VPC's route table is one
+    // resource however many stacks route through it, and qualifying it would
+    // split it per stack and break the edges into it.
+    const unqualifiedByNature = (meta: { referencedBy?: string[]; ambient?: boolean }): boolean =>
+      Boolean(meta.ambient) || Boolean(meta.referencedBy && meta.referencedBy.length > 0);
+    // Region qualification (#1416) applies to exactly those, and never to a
+    // managed resource: an unscoped project's declared canvas joins on bare
+    // ids, so re-keying `web` to `us-east-1::web` would unjoin it from its own
+    // declaration.
+    const keyOf = (id: string, meta: { referencedBy?: string[]; ambient?: boolean; attributes?: Record<string, unknown> }): string => {
+      if (unqualifiedByNature(meta)) return merging ? unqualifiedKey(id, meta) : id;
+      return qualify ? `${stack}::${id}` : id;
+    };
     const resources: Record<string, (typeof snapshot.resources)[string]> = {};
+    // Duplicates dropped here, and where they went, so edges can follow.
+    const merged = new Map<string, string>();
     for (const [id, meta] of Object.entries(snapshot.resources ?? {})) {
-      const key = managed(id, meta);
-      if (key === id) {
-        // Ambient means "nothing manages this". Another stack managing it makes
-        // that false, and reporting it twice would inflate any count over it.
-        if (meta.ambient && meta.physicalId && managedPhysicalIds.has(meta.physicalId)) continue;
-        // Unqualified: account-level, so first sighting wins and the rest are
-        // the same resource seen again from another stack's snapshot.
-        if (seenUnqualified.has(id)) continue;
-        seenUnqualified.add(id);
+      const key = keyOf(id, meta);
+      if (!qualify || unqualifiedByNature(meta)) {
+        // Ambient means "nothing manages this", and being referenced means "the
+        // estate reaches this" — neither stops it being managed. When a stack
+        // manages the same physical resource, this entry is that resource seen
+        // from outside, and rendering both inflates any count over it.
+        //
+        // The dependency half of that was missing, and it was not cosmetic: a
+        // subnet declared by its stack was also recorded as `subnet-9af06b90`
+        // with `referencedBy`, so an estate with 13 subnets replayed as 16 and
+        // "which subnets have no network interfaces" answered 11 where the
+        // truth was 8. The three extra were occupied subnets whose second copy
+        // had no interface pointing at it — a duplicate reads as empty, because
+        // the edges resolved to the other one.
+        const duplicate = Boolean(meta.ambient) || Boolean(meta.referencedBy && meta.referencedBy.length > 0);
+        if (duplicate && meta.physicalId && managedPhysicalIds.has(meta.physicalId)) {
+          const survivor = managedKeyOf.get(meta.physicalId);
+          if (survivor && survivor !== key) merged.set(id, survivor);
+          continue;
+        }
+        // Unqualified: one resource per key, so first sighting wins and the
+        // rest are the same resource seen again from another stack's snapshot.
+        // The key carries the region when there is one, so "the same resource"
+        // no longer spans regions.
+        if (seenUnqualified.has(key)) continue;
+        seenUnqualified.add(key);
       }
       resources[key] = meta;
     }
     const known = new Set(Object.keys(snapshot.resources ?? {}));
     const requalify = (id: string): string => {
+      // A dropped duplicate's edges belong to the resource that survived it.
+      const survivor = merged.get(id);
+      if (survivor) return survivor;
       const meta = (snapshot.resources ?? {})[id];
-      return known.has(id) && meta ? managed(id, meta) : id;
+      return known.has(id) && meta ? keyOf(id, meta) : id;
     };
     const edges = (snapshot.edges ?? []).map((e) => ({ ...e, from: requalify(e.from), to: requalify(e.to) }));
     observations.push({

package/src/lifecycle/types.ts

@@ -97,6 +97,18 @@ export interface ResourceDigest {
 export interface BuildDigest {
   /** Per-resource digest keyed by logical name */
   resources: Record<string, ResourceDigest>;
+  /**
+   * chant #1442 — lexicon name → version that produced this build.
+   *
+   * Recorded once per lexicon rather than on every {@link ResourceDigest},
+   * which would repeat one string across every resource of a stack for no
+   * added information.
+   *
+   * Optional because a digest read back from an older snapshot will not have
+   * it. Absent and empty are different: absent means "recorded before this
+   * existed", empty means "recorded, and no plugins were loaded".
+   */
+  lexiconVersions?: Record<string, string>;
   /** Resource-level dependency graph */
   dependencies: Record<string, string[]>;
   /** Cross-lexicon output bridges from BuildManifest */
@@ -117,4 +129,18 @@ export interface DigestDiff {
   changed: string[];
   /** Resources where propsHash matches */
   unchanged: string[];
+  /**
+   * chant #1442 — lexicons whose VERSION moved between the two digests, even
+   * where every resource is unchanged.
+   *
+   * A build whose only difference is the lexicon that emitted it is a real
+   * difference: the lexicon is a generated artifact pinned to an upstream
+   * spec, so a bump can change output with no source change. Reported
+   * separately from `changed` because no resource's declaration moved — the
+   * interpreter did.
+   *
+   * Empty when neither digest recorded versions, so a comparison against a
+   * pre-#1442 snapshot reports nothing rather than inventing a change.
+   */
+  lexiconVersionChanges: Array<{ lexicon: string; previous?: string; current?: string }>;
 }

package/src/managed-fields.test.ts

@@ -155,6 +155,11 @@ describe("pruneByOwnership — the shared three-question rule", () => {
     chantOwned: new Set(["metadata.labels.tier"]),
     foreignOwned: new Set(["spec.replicas", "metadata.annotations.noise"]),
     foreignContested: new Set(["spec.replicas"]),
+    owners: new Map([
+      ["metadata.labels.tier", "chant"],
+      ["spec.replicas", "hpa-controller"],
+      ["metadata.annotations.noise", "kube-controller-manager"],
+    ]),
   };
 
   test("never prunes the declared side", () => {
@@ -177,3 +182,48 @@ describe("pruneByOwnership — the shared three-question rule", () => {
     expect(pruneByOwnership(node({ path: "spec.selector", pattern: "spec.selector" }), sets)).toBe(false);
   });
 });
+
+// #1189 — the three sets answer "which category owns this path". A reader needs
+// the other question: `hpa-controller` and `kubectl-client-side-apply` are the
+// same category and mean opposite things to an operator.
+describe("buildOwnershipSets — owning manager per path (#1189)", () => {
+  const entries = [
+    { manager: "chant", operation: "Apply", fieldsV1: { "f:metadata": { "f:labels": { "f:tier": {} } } } },
+    { manager: "hpa-controller", operation: "Apply", fieldsV1: { "f:spec": { "f:replicas": {} } } },
+    {
+      manager: "kubectl-client-side-apply",
+      operation: "Update",
+      fieldsV1: { "f:spec": { "f:template": { "f:spec": { "f:containers": {} } } } },
+    },
+  ];
+
+  test("records which manager owns each path", () => {
+    const sets = buildOwnershipSets(
+      entries,
+      { metadata: { labels: { tier: "web" } }, spec: { replicas: 3, template: { spec: { containers: [] } } } },
+      { metadata: { labels: { tier: "web" } }, spec: { replicas: 2 } },
+      (m) => m === "chant",
+    );
+    expect(sets.owners.get("metadata.labels.tier")).toBe("chant");
+    expect(sets.owners.get("spec.replicas")).toBe("hpa-controller");
+    expect(sets.owners.get("spec.template.spec.containers")).toBe("kubectl-client-side-apply");
+  });
+
+  test("the categories are unchanged by recording owners", () => {
+    const sets = buildOwnershipSets(
+      entries,
+      { metadata: { labels: { tier: "web" } }, spec: { replicas: 3, template: { spec: { containers: [] } } } },
+      { metadata: { labels: { tier: "web" } }, spec: { replicas: 2 } },
+      (m) => m === "chant",
+    );
+    expect(sets.chantOwned.has("metadata.labels.tier")).toBe(true);
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    // Declared AND foreign-owned — contested, so still diffable.
+    expect(sets.foreignContested.has("spec.replicas")).toBe(true);
+  });
+
+  test("is empty when the object carries no managedFields at all", () => {
+    const sets = buildOwnershipSets([], { spec: {} }, { spec: {} }, (m) => m === "chant");
+    expect(sets.owners.size).toBe(0);
+  });
+});

package/src/managed-fields.ts

@@ -144,6 +144,17 @@ export interface OwnershipSets {
   foreignOwned: ReadonlySet<string>;
   /** The subset of `foreignOwned` where the declared manifest also sets the path — drift-relevant despite foreign ownership. */
   foreignContested: ReadonlySet<string>;
+  /**
+   * Path → the name of the manager that owns it (#1189).
+   *
+   * The three sets above answer *which category* owns a path, which is all the
+   * prune rule needs. A reader needs the other question — "owned by
+   * `kubectl-client-side-apply`" and "owned by `hpa-controller`" are the same
+   * category and mean very different things to an operator. Last writer wins
+   * where several managers touch one path, matching what the API server itself
+   * reports.
+   */
+  owners: ReadonlyMap<string, string>;
 }
 
 function sameJson(a: unknown, b: unknown): boolean {
@@ -188,6 +199,9 @@ function walkOwnership(
   path: string,
   owned: Set<string>,
   contested: Set<string>,
+  /** Records path → manager as it walks (#1189); omitted by callers that only need the sets. */
+  owners?: Map<string, string>,
+  manager?: string,
 ): void {
   if (fieldsNode === null || typeof fieldsNode !== "object" || Array.isArray(fieldsNode)) return;
 
@@ -196,6 +210,7 @@ function walkOwnership(
       if (path !== "") {
         owned.add(path);
         if (declaredNode !== undefined) contested.add(path);
+        if (owners && manager) owners.set(path, manager);
       }
       continue;
     }
@@ -208,7 +223,8 @@ function walkOwnership(
       const childPath = joinField(path, name);
       owned.add(childPath);
       if (childDeclared !== undefined) contested.add(childPath);
-      walkOwnership(child, childLive, childDeclared, childPath, owned, contested);
+      if (owners && manager) owners.set(childPath, manager);
+      walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
       continue;
     }
 
@@ -220,7 +236,8 @@ function walkOwnership(
       const childPath = joinIndex(path, idx);
       owned.add(childPath);
       if (childDeclared !== undefined) contested.add(childPath);
-      walkOwnership(child, childLive, childDeclared, childPath, owned, contested);
+      if (owners && manager) owners.set(childPath, manager);
+      walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
       continue;
     }
 
@@ -255,7 +272,8 @@ function walkOwnership(
       const childPath = joinIndex(path, liveIdx);
       owned.add(childPath);
       if (childDeclared !== undefined) contested.add(childPath);
-      walkOwnership(child, childLive, childDeclared, childPath, owned, contested);
+      if (owners && manager) owners.set(childPath, manager);
+      walkOwnership(child, childLive, childDeclared, childPath, owned, contested, owners, manager);
       continue;
     }
     // An unrecognized prefix (a future fieldsV1 encoding) — skip.
@@ -286,6 +304,7 @@ export function buildOwnershipSets(
   const chantOwned = new Set<string>();
   const foreignOwned = new Set<string>();
   const foreignContested = new Set<string>();
+  const owners = new Map<string, string>();
 
   for (const entry of entries) {
     if (typeof entry.manager !== "string" || entry.manager.length === 0) continue;
@@ -294,13 +313,13 @@ export function buildOwnershipSets(
     if (isChantManager(entry.manager)) {
       // Chant-owned paths are always diffable, regardless of who else is
       // involved — "contested" only matters for a *foreign* owner.
-      walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", chantOwned, new Set());
+      walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", chantOwned, new Set(), owners, entry.manager);
     } else {
-      walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", foreignOwned, foreignContested);
+      walkOwnership(entry.fieldsV1, liveRoot, declaredRoot, "", foreignOwned, foreignContested, owners, entry.manager);
     }
   }
 
-  return { chantOwned, foreignOwned, foreignContested };
+  return { chantOwned, foreignOwned, foreignContested, owners };
 }
 
 /**