@intentius/chant 0.39.0 → 0.41.1

package/src/apply.test.ts

@@ -0,0 +1,169 @@
+import { describe, test, expect } from "vitest";
+import {
+  NOT_ATTEMPTED_REASONS,
+  isNotAttemptedReason,
+  isApplyResult,
+  applyResult,
+  normalizeApply,
+  notAttemptedAll,
+  applyRefKey,
+  overlappingRefs,
+  unaccountedRefs,
+  type ApplyRef,
+} from "./apply";
+
+const ref = (kind: string, name: string): ApplyRef => ({ kind, name });
+
+describe("NotAttemptedReason is total (#1446)", () => {
+  test("every reason is recognised, and nothing else is", () => {
+    for (const r of NOT_ATTEMPTED_REASONS) expect(isNotAttemptedReason(r)).toBe(true);
+    expect(isNotAttemptedReason("skipped")).toBe(false);
+    expect(isNotAttemptedReason("")).toBe(false);
+    expect(isNotAttemptedReason(undefined)).toBe(false);
+  });
+
+  // The write-side peer of UnobservedReason. Free-form strings are what let the
+  // gcp skip say "no mapper for kind X" to stdout and nothing to the caller.
+  test("the prune-side reason exists, because it is a different fact", () => {
+    expect(NOT_ATTEMPTED_REASONS).toContain("not-prunable");
+    expect(NOT_ATTEMPTED_REASONS).toContain("unsupported-kind");
+  });
+});
+
+describe("the envelope discriminates itself (#1446)", () => {
+  test("isApplyResult recognises the versioned shape only", () => {
+    expect(isApplyResult(applyResult([]))).toBe(true);
+    expect(isApplyResult({ applied: [], pruned: [] })).toBe(false);
+    expect(isApplyResult({ apply: "v2" })).toBe(false);
+    expect(isApplyResult(null)).toBe(false);
+  });
+
+  test("applyResult omits empty buckets rather than emitting empty arrays", () => {
+    expect(applyResult([{ ...ref("Bucket", "a"), action: "created" }])).toEqual({
+      apply: "v1",
+      applied: [{ kind: "Bucket", name: "a", action: "created" }],
+    });
+  });
+});
+
+describe("normalizeApply (#1446)", () => {
+  test("an un-migrated applier's shape means 'everything I was handed, I attempted'", () => {
+    // The compatibility path. Nothing is invented on its behalf — an empty
+    // notAttempted is exactly the claim that shape implicitly makes.
+    const n = normalizeApply({ applied: [{ ...ref("K", "a"), action: "created" }] });
+    expect(n.notAttempted).toEqual([]);
+    expect(n.pruned).toEqual([]);
+    expect(n.applied).toHaveLength(1);
+  });
+
+  test("the envelope's notAttempted survives normalization", () => {
+    const n = normalizeApply(
+      applyResult([], [], [{ ...ref("SQLInstance", "db"), reason: "unsupported-kind" }]),
+    );
+    expect(n.notAttempted).toEqual([{ kind: "SQLInstance", name: "db", reason: "unsupported-kind" }]);
+  });
+
+  // The read side has the same rule for the same reason: returning nothing must
+  // not be a way to claim success over work that never happened.
+  test("undefined normalizes to empty, so 'I could not' must be said explicitly", () => {
+    expect(normalizeApply(undefined)).toEqual({ applied: [], pruned: [], notAttempted: [] });
+  });
+});
+
+describe("notAttemptedAll (#1446)", () => {
+  test("marks a whole plan with one reason, for the run-level failure", () => {
+    const out = notAttemptedAll([ref("K", "a"), ref("K", "b")], "no-credentials", "no token");
+    expect(out).toEqual([
+      { kind: "K", name: "a", reason: "no-credentials", detail: "no token" },
+      { kind: "K", name: "b", reason: "no-credentials", detail: "no token" },
+    ]);
+  });
+
+  test("omits detail when none is given", () => {
+    expect(notAttemptedAll([ref("K", "a")], "no-binding")).toEqual([
+      { kind: "K", name: "a", reason: "no-binding" },
+    ]);
+  });
+});
+
+describe("the three buckets are disjoint (#1446)", () => {
+  test("no overlap is the contract", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("K", "a"), action: "created" }],
+        pruned: [{ ...ref("K", "b"), deleted: true }],
+        notAttempted: [{ ...ref("K", "c"), reason: "unsupported-kind" }],
+      }),
+    ).toEqual([]);
+  });
+
+  // A resource cannot be both written and skipped. An applier reporting that has
+  // a bug the return shape would otherwise hide.
+  test("the same resource in two buckets is reported", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("K", "a"), action: "created" }],
+        pruned: [],
+        notAttempted: [{ ...ref("K", "a"), reason: "filtered" }],
+      }),
+    ).toEqual(["K/a"]);
+  });
+
+  test("same name, different kind, is not an overlap", () => {
+    expect(
+      overlappingRefs({
+        applied: [{ ...ref("Bucket", "x"), action: "created" }],
+        pruned: [{ ...ref("Topic", "x"), deleted: true }],
+        notAttempted: [],
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe("nothing in the plan is dropped (#1446)", () => {
+  // The suite's central assertion, and the one gcp failed before #1447: the
+  // unmapped kind was in the plan, in no bucket, and the result looked complete.
+  test("a plan entry in no bucket is reported", () => {
+    const plan = [ref("Bucket", "mapped"), ref("SQLInstance", "unmapped")];
+    const dropped = unaccountedRefs(plan, {
+      applied: [{ ...ref("Bucket", "mapped"), action: "created" }],
+      pruned: [],
+      notAttempted: [],
+    });
+    expect(dropped).toEqual(["SQLInstance/unmapped"]);
+  });
+
+  test("the same plan accounted for in notAttempted passes", () => {
+    const plan = [ref("Bucket", "mapped"), ref("SQLInstance", "unmapped")];
+    expect(
+      unaccountedRefs(plan, {
+        applied: [{ ...ref("Bucket", "mapped"), action: "created" }],
+        pruned: [],
+        notAttempted: [{ ...ref("SQLInstance", "unmapped"), reason: "unsupported-kind" }],
+      }),
+    ).toEqual([]);
+  });
+
+  test("an empty plan is trivially accounted for", () => {
+    expect(unaccountedRefs([], { applied: [], pruned: [], notAttempted: [] })).toEqual([]);
+  });
+
+  // Prune deletes things the plan does not contain, by definition — so a pruned
+  // resource being outside the plan is correct, not a drop.
+  test("a pruned resource outside the plan is not a drop", () => {
+    expect(
+      unaccountedRefs([ref("Bucket", "keep")], {
+        applied: [{ ...ref("Bucket", "keep"), action: "unchanged" }],
+        pruned: [{ ...ref("Bucket", "orphan"), deleted: true }],
+        notAttempted: [],
+      }),
+    ).toEqual([]);
+  });
+});
+
+describe("applyRefKey", () => {
+  test("separates resources by kind and name", () => {
+    expect(applyRefKey(ref("Bucket", "x"))).toBe("Bucket/x");
+    expect(applyRefKey(ref("Topic", "x"))).not.toBe(applyRefKey(ref("Bucket", "x")));
+  });
+});

package/src/apply.ts

@@ -0,0 +1,249 @@
+/**
+ * The apply contract (#1446) — what a lexicon's applier is allowed to mean.
+ *
+ * The peer of `./observation.ts`, and it exists for the same reason on the other
+ * side of the lifecycle.
+ *
+ * The read path had two ways to return nothing for a declared entity and no way
+ * to tell them apart — "the provider says it is absent" versus "I never looked"
+ * — and the second was classifying as `create`. #1089 made that a tri-state and
+ * #1201 built a conformance suite so a lexicon could not pass by returning a
+ * well-shaped result that still proposed a create.
+ *
+ * The write path had the identical hole. An applier could skip a resource and
+ * report nothing:
+ *
+ *     const mapper = MAPPERS[r.kind];
+ *     if (!mapper) {
+ *       console.log(`skip: no mapper for kind ${r.kind}`);
+ *       continue;                    // never appears in `applied`, or anywhere
+ *     }
+ *
+ * A caller receiving `{ applied: [...] }` could not distinguish a complete apply
+ * from one that dropped half the manifest, and `ApplyOp` had nothing to gate on.
+ * A `console.log` on stdout is not a signal in a result, the same way a warn on
+ * stderr was not a signal in a change set (#1447 was the concrete bug; #1457
+ * found the same shape in two more appliers).
+ *
+ * The contract is a tri-state, per resource in the plan:
+ *
+ *   - **APPLIED** — the provider was called and converged. Carries the action
+ *     (`created` / `updated` / `unchanged`) and the physical id when resolved.
+ *   - **PRUNED** — owned, no longer declared, deleted.
+ *   - **NOT-ATTEMPTED** — carrying a total {@link NotAttemptedReason}. Never
+ *     silent, never inferred from absence.
+ *
+ * The three are **disjoint and total**: every resource the applier was given
+ * appears in exactly one. That is the assertion the conformance suite exists to
+ * make, and the one the gcp skip failed.
+ *
+ * Compatibility: an applier may keep returning its own shape. The envelope is
+ * discriminated by its literal `apply: "v1"` field, the same mechanism
+ * `observation: "v1"` uses, so an un-migrated applier normalizes to "everything
+ * I was handed, I attempted" and nothing breaks. Reporting NOT-ATTEMPTED
+ * requires the envelope — which is the point: you cannot claim the guarantee
+ * without adopting the shape that can express its absence.
+ */
+
+/**
+ * Why a resource in the plan was not attempted. Total: an applier that skips a
+ * resource must pick one of these, and consumers may switch exhaustively.
+ *
+ * - `unsupported-kind` — the lexicon has no mapper/writer for this type. The
+ *   resource is declared and simply was not written.
+ * - `no-credentials` — no usable credentials/authorization for the target.
+ * - `no-binding` — the environment resolves to no concrete target (no cluster
+ *   context, no subscription, no resource group, no endpoint).
+ * - `dependency-failed` — an upstream resource in the same run failed, so this
+ *   one was never reached. Distinct from a failure of its own.
+ * - `filtered` — reached but deliberately withheld by a caller-requested scope.
+ * - `not-prunable` — an owned orphan of a kind the applier cannot enumerate or
+ *   delete. The prune-side shape: not "there was nothing to prune" but "I could
+ *   not look for anything to prune here".
+ */
+export type NotAttemptedReason =
+  | "unsupported-kind"
+  | "no-credentials"
+  | "no-binding"
+  | "dependency-failed"
+  | "filtered"
+  | "not-prunable";
+
+/** Every legal {@link NotAttemptedReason}, for validation and conformance checks. */
+export const NOT_ATTEMPTED_REASONS: readonly NotAttemptedReason[] = [
+  "unsupported-kind",
+  "no-credentials",
+  "no-binding",
+  "dependency-failed",
+  "filtered",
+  "not-prunable",
+];
+
+/** True when `value` is a legal {@link NotAttemptedReason}. */
+export function isNotAttemptedReason(value: unknown): value is NotAttemptedReason {
+  return typeof value === "string" && (NOT_ATTEMPTED_REASONS as readonly string[]).includes(value);
+}
+
+/** What an apply did to a resource that it did reach. */
+export type AppliedAction = "created" | "updated" | "unchanged";
+
+/** Every legal {@link AppliedAction}. */
+export const APPLIED_ACTIONS: readonly AppliedAction[] = ["created", "updated", "unchanged"];
+
+/** How a resource is named across appliers whose native vocabularies differ. */
+export interface ApplyRef {
+  /**
+   * The provider's own type name — a CNRM `kind`, an ARM `type`, a
+   * CloudFormation resource type, a Fly entity class. Kept verbatim rather than
+   * normalized into a chant vocabulary, so an applier stays true to its target.
+   */
+  kind: string;
+  /** The resource's name within its scope. */
+  name: string;
+}
+
+/** APPLIED — the provider was called and the resource converged. */
+export interface AppliedResource extends ApplyRef {
+  action: AppliedAction;
+  /** Provider-assigned identifier, when the response carried one. */
+  physicalId?: string;
+}
+
+/** PRUNED — owned, no longer declared, deleted. */
+export interface PrunedResource extends ApplyRef {
+  /**
+   * False when the delete was a no-op because the resource was already gone.
+   * Still PRUNED: the applier looked, decided, and acted.
+   */
+  deleted: boolean;
+}
+
+/** NOT-ATTEMPTED — no provider call was made, and why. */
+export interface NotAttemptedResource extends ApplyRef {
+  reason: NotAttemptedReason;
+  /** Detail for the operator: the status and body, the missing binding, the unsupported kind. */
+  detail?: string;
+}
+
+/**
+ * The apply envelope. Explicitly versioned: `apply: "v1"`, which discriminates
+ * it from an applier's own return shape.
+ */
+export interface ApplyResult {
+  /** Discriminant + wire version. */
+  readonly apply: "v1";
+  applied: AppliedResource[];
+  pruned?: PrunedResource[];
+  /** Omit or leave empty when everything in the plan was attempted. */
+  notAttempted?: NotAttemptedResource[];
+}
+
+/** Normalized form every consumer works with. All three arrays always present. */
+export interface NormalizedApply {
+  applied: AppliedResource[];
+  pruned: PrunedResource[];
+  notAttempted: NotAttemptedResource[];
+}
+
+/** True when `value` is the versioned {@link ApplyResult} envelope. */
+export function isApplyResult(value: unknown): value is ApplyResult {
+  return typeof value === "object" && value !== null && (value as { apply?: unknown }).apply === "v1";
+}
+
+/**
+ * Build an {@link ApplyResult}. Appliers use this rather than writing the
+ * discriminant by hand.
+ */
+export function applyResult(
+  applied: AppliedResource[],
+  pruned?: PrunedResource[],
+  notAttempted?: NotAttemptedResource[],
+): ApplyResult {
+  return {
+    apply: "v1",
+    applied,
+    ...(pruned && pruned.length > 0 ? { pruned } : {}),
+    ...(notAttempted && notAttempted.length > 0 ? { notAttempted } : {}),
+  };
+}
+
+/**
+ * Normalize an applier's return value.
+ *
+ * A non-envelope value normalizes to "everything I was handed, I attempted" —
+ * an empty `notAttempted`. That is the compatibility path, and it is also
+ * exactly the claim an un-migrated applier is implicitly making, so nothing is
+ * invented on its behalf.
+ *
+ * `undefined` normalizes to three empty arrays. An applier that means "I applied
+ * nothing because I could not" must say so with {@link notAttemptedAll} rather
+ * than returning nothing, for the same reason `unobservedAll` exists on the read
+ * side.
+ */
+export function normalizeApply(value: ApplyResult | Partial<NormalizedApply> | undefined): NormalizedApply {
+  if (!value) return { applied: [], pruned: [], notAttempted: [] };
+  return {
+    applied: value.applied ?? [],
+    pruned: value.pruned ?? [],
+    notAttempted: value.notAttempted ?? [],
+  };
+}
+
+/**
+ * Mark every named resource NOT-ATTEMPTED with one reason — the whole-run
+ * failure case (no credentials, no binding, the transport never came up). Core
+ * applies this when an applier throws, so a thrown apply degrades to an honest
+ * "did not attempt" per resource instead of an empty result that reads as a
+ * successful no-op.
+ */
+export function notAttemptedAll(
+  refs: Iterable<ApplyRef>,
+  reason: NotAttemptedReason,
+  detail?: string,
+): NotAttemptedResource[] {
+  return [...refs].map((ref) => ({ ...ref, reason, ...(detail ? { detail } : {}) }));
+}
+
+/** A resource's identity within one apply, for disjointness checks. */
+export function applyRefKey(ref: ApplyRef): string {
+  return `${ref.kind}/${ref.name}`;
+}
+
+/**
+ * Every resource that appears in more than one bucket. Empty is the contract;
+ * a non-empty result means the applier both wrote and skipped the same
+ * resource, which is not a state that can be true.
+ *
+ * Pruned is checked against the other two but not against itself: an applier
+ * may legitimately apply a resource and prune a different, same-named one only
+ * if their kinds differ, and {@link applyRefKey} already separates those.
+ */
+export function overlappingRefs(result: NormalizedApply): string[] {
+  const seen = new Map<string, Set<string>>();
+  const note = (bucket: string, refs: ApplyRef[]): void => {
+    for (const ref of refs) {
+      const key = applyRefKey(ref);
+      (seen.get(key) ?? seen.set(key, new Set()).get(key)!).add(bucket);
+    }
+  };
+  note("applied", result.applied);
+  note("pruned", result.pruned);
+  note("notAttempted", result.notAttempted);
+  return [...seen.entries()].filter(([, buckets]) => buckets.size > 1).map(([key]) => key);
+}
+
+/**
+ * Resources in `plan` that the result accounts for in no bucket — the silent
+ * drop this contract exists to make impossible.
+ *
+ * The conformance suite's central assertion. Before #1447, gcp's applier failed
+ * exactly this: an unmapped kind was in the plan, in no bucket, and the result
+ * looked complete.
+ */
+export function unaccountedRefs(plan: Iterable<ApplyRef>, result: NormalizedApply): string[] {
+  const accounted = new Set<string>();
+  for (const bucket of [result.applied, result.pruned, result.notAttempted]) {
+    for (const ref of bucket) accounted.add(applyRefKey(ref));
+  }
+  return [...plan].map(applyRefKey).filter((key) => !accounted.has(key));
+}

package/src/cli/build-params-cli.ts

@@ -105,3 +105,38 @@ export function resolveCliBuildParams(
 
   return { success: true, provenance: resolution.provenance, errors: [] };
 }
+
+/**
+ * Resolve a command's declared build-time parameters, the same way `chant
+ * build` does, so a `build()`/`discover()` on the declared side sees the values
+ * the source will actually read.
+ *
+ * Every command that reads declared source needs this and only `chant build`
+ * had it. `chant graph` was fixed in #1483; the lifecycle family — `diff`,
+ * `snapshot`, `plan`, and `components status --live` — built the declared side
+ * on parameter *defaults* while the live side was whatever is really deployed.
+ *
+ * For a project whose parameters choose which resources *exist* that is not a
+ * near miss. `chant lifecycle diff dev --live` on kubemicrovm-ops returned
+ * byte-identical output at `KMV_TIER=minimal` and `KMV_TIER=prod-ha`, and
+ * reported the tier label itself as drift — `minimal → prod-ha`, declared
+ * against live — which is the comparison announcing it is against the wrong
+ * declaration.
+ *
+ * Returns `undefined` when resolution failed, having printed why: the caller
+ * should stop rather than compare against source that will not build.
+ */
+export async function commandBuildParams(
+  buildParamsConfig: BuildParamsConfig | undefined,
+  args: { param?: string[]; paramsFile?: string },
+): Promise<BuildParamProvenance[] | undefined> {
+  const resolution = resolveCliBuildParams(buildParamsConfig, {
+    cli: parseParamFlags(args.param),
+    paramsFile: args.paramsFile,
+  });
+  if (!resolution.success) {
+    for (const message of resolution.errors) console.error(message);
+    return undefined;
+  }
+  return resolution.provenance;
+}

package/src/cli/commands/doctor.test.ts

@@ -351,3 +351,48 @@ describe("doctorCommand", () => {
     });
   });
 });
+
+/**
+ * #1421 — the sibling of the `tsconfig-paths` check. Both are project settings
+ * that silently break runtime module resolution; this one makes build
+ * parameters read as empty in project source on the run path, so declarations
+ * conditioned on them take their default branch while chant reports success.
+ */
+describe("package-type-module (#1421)", () => {
+  const withPkg = async (pkg: object | undefined, assert: (check: { status: string; message?: string } | undefined) => void): Promise<void> => {
+    await withTestDir(async (testDir) => {
+      if (pkg) writeFileSync(join(testDir, "package.json"), JSON.stringify(pkg));
+      const report = await doctorCommand(testDir);
+      assert(report.checks.find((c) => c.name === "package-type-module"));
+    });
+  };
+
+  test('passes for "type": "module"', async () => {
+    await withPkg({ name: "p", type: "module" }, (check) => {
+      expect(check?.status).toBe("pass");
+    });
+  });
+
+  test('warns for "type": "commonjs", saying what breaks', async () => {
+    await withPkg({ name: "p", type: "commonjs" }, (check) => {
+      expect(check?.status).toBe("warn");
+      expect(check?.message).toContain('"type": "commonjs"');
+      expect(check?.message).toContain("build parameters");
+      expect(check?.message).toContain('Set "type": "module"');
+    });
+  });
+
+  // The easier one to miss: no `type` field is CommonJS too.
+  test("warns when no type field is declared at all", async () => {
+    await withPkg({ name: "p" }, (check) => {
+      expect(check?.status).toBe("warn");
+      expect(check?.message).toContain("no `type` field");
+    });
+  });
+
+  test("says nothing when there is no package.json to judge", async () => {
+    await withPkg(undefined, (check) => {
+      expect(check).toBeUndefined();
+    });
+  });
+});

package/src/cli/commands/doctor.ts

@@ -169,6 +169,46 @@ export async function doctorCommand(path: string): Promise<DoctorReport> {
     }
   }
 
+  // Check 8b: package.json declares "type": "module" (#1421)
+  //
+  // Sibling of the tsconfig-paths check above, and filed for the same reason:
+  // both are project settings that silently break runtime module resolution.
+  //
+  // chant's core is ESM. When the project is CJS — `"type": "commonjs"`, or no
+  // `type` field at all — tsx loads project source through the CommonJS
+  // transform, so the project's `require` of `params.ts` and core's `import` of
+  // it produce two separate module records. `setBuildParams` mutates one object
+  // in place; project source reads the other, and sees `{}`.
+  //
+  // The result is a silent wrong answer, not a failure: chant prints
+  // `[param] tier = "prod" (cli)` and then emits the graph for the default. It
+  // hits `chant graph` (always the run path) and `chant build --no-fold`; plain
+  // `chant build` escapes only because folding substitutes parameters
+  // statically and never reads the shared object.
+  const projectPkgPath = join(projectPath, "package.json");
+  if (existsSync(projectPkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync(projectPkgPath, "utf-8")) as { type?: string };
+      if (pkg.type === "module") {
+        checks.push({ name: "package-type-module", status: "pass" });
+      } else {
+        const found = pkg.type ? `"type": "${pkg.type}"` : "no `type` field";
+        checks.push({
+          name: "package-type-module",
+          status: "warn",
+          message:
+            `package.json has ${found} — chant is ESM, and a CommonJS project reads build ` +
+            `parameters as empty on the run path (\`chant graph\`, \`chant build --no-fold\`). ` +
+            `Declarations conditioned on \`params.<name>\` silently take their default branch. ` +
+            `Set "type": "module".`,
+        });
+      }
+    } catch (e) {
+      debug("project package.json parse failed:", e);
+      checks.push({ name: "package-type-module", status: "warn", message: "Could not parse package.json" });
+    }
+  }
+
   // Check 9: .mcp.json exists and has chant entry
   const mcpPath = join(projectPath, ".mcp.json");
   if (!existsSync(mcpPath)) {

package/src/cli/handlers/components.ts

@@ -35,6 +35,7 @@ import {
   InvalidReleaseRecordError,
 } from "../../lifecycle/release-ledger";
 import { reconcileStatus, liveEvidenceFromChangeSet, compareAcrossEnvironments, mergeLiveEvidence, type LiveComponentEvidence } from "../../lifecycle/status";
+import { commandBuildParams } from "../build-params-cli";
 import { buildChangeSet } from "../../lifecycle/change-set";
 import { buildLedgerEntries, componentBomSummary, type BuildLedgerEntry } from "../../lifecycle/build-ledger";
 import { findBuildManifestByArtifactDigest } from "../../lifecycle/build-ledger-store";
@@ -48,6 +49,7 @@ import type { CommandContext } from "../registry";
 import type { LexiconPlugin } from "../../lexicon";
 import { normalizeObservation, mergeObservations, unobservedAll, type NormalizedObservation } from "../../observation";
 import type { Phase, Component } from "../../components/component";
+import { deployUnits } from "../../components/deploy-units";
 
 /**
  * chant components release <env> --component <name> --digest <sha256:...>
@@ -228,22 +230,11 @@ interface StatusJsonRow {
  * observe on a multi-stack, per-component project (`describeResources`'s
  * single-stack-named-after-the-environment convention never matches one). */
 export function cfnDeployStacks(deploy: Phase[]): string[] {
-  const stacks = new Set<string>();
-  const walkSteps = (steps: Phase["steps"]): void => {
-    for (const step of steps) {
-      // A step may itself be a nested Phase (it carries its own `steps`). Step is
-      // open-typed (capability inputs), so discriminate structurally on `steps`.
-      const nested = (step as { steps?: unknown }).steps;
-      if (Array.isArray(nested)) {
-        walkSteps(nested as Phase["steps"]);
-        continue;
-      }
-      const s = step as { kind?: string; stack?: unknown };
-      if (s.kind === "cfn-deploy" && typeof s.stack === "string") stacks.add(s.stack);
-    }
-  };
-  for (const phase of deploy) walkSteps(phase.steps);
-  return [...stacks];
+  // The CloudFormation slice of the generic deploy-unit walk (#1495) — kept
+  // because `chant graph --live`'s stack enrichment is genuinely CFN-shaped.
+  return deployUnits(deploy)
+    .filter((u) => u.lexicon === "aws")
+    .map((u) => u.unit);
 }
 
 /**
@@ -258,15 +249,22 @@ export function cfnDeployStacks(deploy: Phase[]): string[] {
  */
 async function observeComponentStacks(
   components: Map<string, { component: Component }>,
-  observer: LexiconPlugin,
+  plugins: LexiconPlugin[],
   environment: string,
 ): Promise<Map<string, LiveComponentEvidence>> {
+  // Observer per unit's own lexicon (#1495): a component's kubectl-apply unit
+  // is read by the k8s lexicon, its cfn-deploy stack by aws. A unit whose
+  // lexicon ships no describeStackStatus is skipped — the same absent-observer
+  // degradation as before, per unit instead of per project.
+  const observerFor = (lexicon: string) =>
+    plugins.find((p) => p.name === lexicon && p.describeStackStatus);
   const evidence = new Map<string, LiveComponentEvidence>();
   for (const [name, { component }] of components) {
-    const stacks = cfnDeployStacks(component.deploy);
+    const units = deployUnits(component.deploy).filter((u) => observerFor(u.lexicon));
+    const stacks = units.map((u) => u.unit);
     if (stacks.length === 0) continue;
     const observed = await Promise.all(
-      stacks.map((stack) => observer.describeStackStatus!({ environment, stack }).catch(() => null)),
+      units.map((u) => observerFor(u.lexicon)!.describeStackStatus!({ environment, stack: u.unit }).catch(() => null)),
     );
     const determinate = observed.filter((o): o is NonNullable<typeof o> => o !== null);
     if (determinate.length === 0) {
@@ -355,7 +353,15 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
       if (endpointResult.notice) console.error(formatWarning({ message: endpointResult.notice }));
       try {
         const targetSerializers = serializers;
-        const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers);
+        // With this invocation's parameters (#1483). Built on defaults, the
+        // declared half of the comparison is a different estate from the one
+        // deployed, and every resource the real parameter declares reads as
+        // absent.
+        const statusParams = await commandBuildParams(config.buildParams, args);
+        if (!statusParams) return 1;
+        const buildResult = await build(resolve(args.src ?? config.sourceDir ?? "."), targetSerializers, undefined, {
+          buildParams: statusParams,
+        });
         // Which deployed stack(s) to read the change set from (behold#100).
         //
         // `describeResources` defaults to the single-stack convention — the
@@ -431,9 +437,9 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
         // invisible to the entity-keyed, single-stack `describeResources` above —
         // observe each component's own cfn-deploy stack directly and overlay it as
         // the authoritative presence signal (#57).
-        const stackObserver = plugins.find((p) => p.describeStackStatus);
-        if (stackObserver) {
-          const stackEvidence = await observeComponentStacks(discovery.components, stackObserver, environment);
+        const anyObserver = plugins.some((p) => p.describeStackStatus);
+        if (anyObserver) {
+          const stackEvidence = await observeComponentStacks(discovery.components, plugins, environment);
           liveEvidence = mergeLiveEvidence(liveEvidence, stackEvidence);
         }
       } finally {