@intentius/chant 0.44.1 → 0.44.2

package/src/cli/handlers/lifecycle.ts

@@ -737,6 +737,7 @@ async function observeLexicon(
     return {
       resources: {},
       unobserved: unobservedAll(entityNames, "read-failed", message, opts.entities),
+      queried: {},
     };
   }
 }
@@ -806,7 +807,7 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
       });
       const observedNow = observed.resources;
       const observedThen = prevSnapshot?.resources;
-      const diff = diffLive({ declared, observedNow, observedThen, unobserved: observed.unobserved });
+      const diff = diffLive({ declared, observedNow, observedThen, unobserved: observed.unobserved, queried: observed.queried });
       // Unobserved entities are deliberately NOT drift: a hole in the read is
       // not a change in the cloud. They are reported separately (#1089) so a
       // "no drift detected" line can never be built on top of a failed read.
@@ -962,7 +963,12 @@ function renderLiveDiff(lexiconName: string, environment: string, diff: LiveDiff
   }
   if (diff.missing.length > 0) {
     console.log(formatBold("\nMISSING (declared, provider reports not in cloud):"));
-    for (const name of diff.missing) console.log(`  - ${name}`);
+    for (const name of diff.missing) {
+      // The address the read actually went to (#1620) — the line between "not
+      // there" and "looked in the wrong place" (a defaulted namespace, say).
+      const queried = diff.queried?.[name];
+      console.log(`  - ${name}${queried ? ` [queried ${queried}]` : ""}`);
+    }
   }
   if (diff.orphan.length > 0) {
     console.log(formatBold("\nORPHAN (in cloud, not declared):"));

package/src/codegen/publish-order.test.ts

@@ -48,7 +48,7 @@ describe("publish order", () => {
     // same stranding by a different route.
     const all = execFileSync(
       "bash",
-      ["-c", 'for d in packages/*/ lexicons/*/ wardens/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
+      ["-c", 'for d in packages/*/ lexicons/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
       { cwd: REPO, encoding: "utf8" },
     )
       .split("\n")

package/src/codegen/release-wiring.test.ts

@@ -118,10 +118,9 @@ function recipeBody(name: string): string {
  */
 describe("release wiring: peer ranges stay in lockstep (#1255)", () => {
   it("the whole-repo release rewrites every @intentius peer range", () => {
-    // Since #788 the rewrite is generic (`with_entries` over every
-    // `@intentius/*` peer) rather than two named keys: the wardens added
-    // `@intentius/warden-core` as a third in-repo peer, and a hand-listed
-    // rewrite goes stale the same way the hand-listed publish steps did.
+    // The rewrite is generic (`with_entries` over every `@intentius/*`
+    // peer) rather than named keys — a hand-listed rewrite goes stale the
+    // same way the hand-listed publish steps did.
     const body = recipeBody("release");
     expect(body).toMatch(/\.peerDependencies\s*\|=\s*with_entries/);
     expect(body).toMatch(/startswith\("@intentius\/"\)/);

package/src/components/cli-support.test.ts

@@ -229,6 +229,58 @@ describe("computeComponentGraph", () => {
     expect(result.edges).toEqual([]);
   });
 
+  // #1490 — `discoverComponents` has honoured buildParams since #1108, but
+  // every caller stopped short of passing them, so the component graph was
+  // always the default-parameter graph. A component conditioned on a parameter
+  // survived `--param` that removed the resources it describes, and `chant
+  // build` and `chant graph --components` disagreed about the same source.
+  //
+  // The fixture imports the params module by absolute path rather than by the
+  // `@intentius/chant/params` specifier: it is written to a temp dir with no
+  // node_modules, so the bare specifier would resolve elsewhere (or nowhere)
+  // and the fixture would read a DIFFERENT params object than the one
+  // discovery mutates — passing the test for the wrong reason.
+  const paramsModule = new URL("../params.ts", import.meta.url).pathname;
+  const conditionalComponent = `import { params } from ${JSON.stringify(paramsModule)};
+export const backup =
+  params.backups === "omit"
+    ? undefined
+    : { name: "backup", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell", reason: "t" }] }] };`;
+
+  // A fresh directory per call: the ESM loader caches a module by path, so
+  // re-importing the same fixture would replay the FIRST call's parameter
+  // binding and the assertion would pass or fail for the wrong reason.
+  async function graphWith(
+    dir: string,
+    provenance?: Array<{ name: string; value: string; source: "cli" }>,
+  ) {
+    await mkdir(dir, { recursive: true });
+    await writeFile(join(dir, "backup.component.ts"), conditionalComponent);
+    return computeComponentGraph(dir, undefined, provenance);
+  }
+
+  test("a component conditioned on a build parameter follows the parameter", async () => {
+    const omitted = await graphWith(join(testDir, "omit"), [
+      { name: "backups", value: "omit", source: "cli" },
+    ]);
+    expect(omitted.success).toBe(true);
+    expect(omitted.order).toEqual([]);
+
+    const kept = await graphWith(join(testDir, "keep"), [
+      { name: "backups", value: "pg-dump", source: "cli" },
+    ]);
+    expect(kept.success).toBe(true);
+    expect(kept.order).toEqual(["backup"]);
+  });
+
+  // Supplying none must not inherit whatever a previous call set — the same
+  // leak `discoverComponents`'s unconditional setBuildParams guards against.
+  test("passing no parameters does not inherit the previous call's", async () => {
+    await graphWith(join(testDir, "first"), [{ name: "backups", value: "omit", source: "cli" }]);
+    const fresh = await graphWith(join(testDir, "second"));
+    expect(fresh.order).toEqual(["backup"]);
+  });
+
   test("orders a consumer after its producer, with a consumer → producer edge", async () => {
     await writeFile(
       join(testDir, "alb.component.ts"),

package/src/components/cli-support.ts

@@ -145,8 +145,19 @@ export interface ComponentGraphResult {
 }
 
 /** Compute the components' dependency graph under `path`, for `chant graph --components`. */
-export async function computeComponentGraph(path: string, sandbox?: boolean): Promise<ComponentGraphResult> {
-  const result = await discoverComponents(path, { sandbox });
+export async function computeComponentGraph(
+  path: string,
+  sandbox?: boolean,
+  buildParams?: BuildParamProvenance[],
+): Promise<ComponentGraphResult> {
+  // #1490 — without this the component graph is always the DEFAULT-parameter
+  // graph. `discoverComponents` has honoured `buildParams` since #1108; every
+  // caller simply stopped short of passing them, so `--param backups=omit`
+  // dropped the CronJob from `chant build` and left the component that
+  // describes it in `chant graph --components`. Two commands disagreeing about
+  // what the source says, which is the thing #1064 and #1108 each fixed one
+  // layer of.
+  const result = await discoverComponents(path, { sandbox, buildParams });
   if (result.errors.length > 0) {
     return { success: false, order: [], waves: [], edges: [], error: result.errors.map((e) => e.message).join("\n") };
   }

package/src/governance.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, it } from "vitest";
 import { GOVERNANCE_VERBS, isGovernanceVerb, type GovernanceVerb } from "./governance.js";
 import { renderChangeSet, runReconcile, type ChangeSet, type Cycle } from "./reconcile.js";
 
-describe("governance verbs (#790)", () => {
+describe("governance verbs", () => {
   it("the runtime list and the type stay in sync", () => {
     // Compile-time: assigning the list's element type to GovernanceVerb and
     // back fails if either side gains a member the other lacks.

package/src/governance.ts

@@ -1,5 +1,5 @@
 /**
- * Governance verb vocabulary (#790, epic #787).
+ * Governance verb vocabulary .
  *
  * `resourceType` on a change-set entry is a free provider-specific string
  * ("team", "branch-protection", "protected-tag", …) chosen per cycle. That is

package/src/graph-detail.test.ts

@@ -34,8 +34,12 @@ const base: GraphIR = {
 };
 
 describe("applyDetail", () => {
-  test("T2 (declarables) is the identity", () => {
-    expect(applyDetail(base, DETAIL.DECLARABLES)).toBe(base);
+  test("T2 (declarables) keeps every node and its scalar/reference attrs", () => {
+    const ir = applyDetail(base, DETAIL.DECLARABLES);
+    expect(ir.nodes.map((n) => n.id)).toEqual(base.nodes.map((n) => n.id));
+    expect(ir.edges).toEqual(base.edges);
+    // Top-level reference envelopes are part of the resource view.
+    expect(ir.nodes.find((n) => n.id === "subnet")!.attrs).toEqual({ network: { $ref: "vpc.id" } });
   });
 
   test("T0 (stacks) collapses to one node per lexicon with cross-lexicon edges", () => {
@@ -55,6 +59,19 @@ describe("applyDetail", () => {
     expect(ir.edges).toContainEqual({ from: "db", to: "subnet", kind: "ref" });
     // The intra-gcp edge survives with its label.
     expect(ir.edges).toContainEqual({ from: "subnet", to: "vpc", kind: "ref", viaAttr: "network" });
+    // Topology view: a surviving plain node sheds its properties.
+    expect(ir.nodes.find((n) => n.id === "subnet")!.attrs).toEqual({});
+  });
+
+  test("T1 keeps overlay paint on surviving plain nodes", () => {
+    const painted: GraphIR = {
+      ...base,
+      nodes: base.nodes.map((n) =>
+        n.id === "subnet" ? { ...n, attrs: { ...n.attrs, _status: "warn" } } : n,
+      ),
+    };
+    const ir = applyDetail(painted, DETAIL.COMPOSITES);
+    expect(ir.nodes.find((n) => n.id === "subnet")!.attrs).toEqual({ _status: "warn" });
   });
 
   test("T1 (composites) carries the cross-stack imports forward (survive the collapse as plain nodes)", () => {
@@ -91,16 +108,96 @@ describe("applyDetail", () => {
   });
 });
 
+// #1489 — the k8s collapse: a convention-linked graph whose nodes carry nested
+// property trees (every real k8s resource) must still differentiate across the
+// dial. Modelled on the fountain-ops estate the issue measured: no composites,
+// no `$ref` edges, full `metadata`/`spec` trees on every node.
+describe("detail monotonicity (#1489)", () => {
+  const k8sish: GraphIR = {
+    nodes: [
+      {
+        id: "web",
+        kind: "K8s::Apps::Deployment",
+        lexicon: "k8s",
+        attrs: {
+          name: "web",
+          namespace: "prod",
+          uid: "u-1",
+          metadata: { labels: { app: "web" } },
+          spec: {
+            replicas: 3,
+            selector: { matchLabels: { app: "web" } },
+            template: { spec: { containers: [{ name: "web", image: "nginx:1.27" }] } },
+          },
+        },
+      },
+      {
+        id: "webSvc",
+        kind: "K8s::Core::Service",
+        lexicon: "k8s",
+        attrs: {
+          name: "web",
+          namespace: "prod",
+          metadata: {},
+          spec: { selector: { app: "web" }, ports: [{ port: 80 }] },
+        },
+      },
+      { id: "prodNs", kind: "K8s::Core::Namespace", lexicon: "k8s", attrs: { name: "prod", metadata: {} } },
+    ],
+    // Label-convention edges — no producer attribute anywhere.
+    edges: [{ from: "webSvc", to: "web", kind: "ref", viaAttr: "spec.selector" }],
+    groups: { byLexicon: { k8s: ["prodNs", "web", "webSvc"] } },
+  };
+
+  const attrKeys = (ir: GraphIR, id: string): string[] =>
+    Object.keys(ir.nodes.find((n) => n.id === id)!.attrs).sort();
+
+  test("attrs at level n are a subset of attrs at level n+1, strictly growing for a nested spec", () => {
+    const t1 = applyDetail(k8sish, DETAIL.COMPOSITES);
+    const t2 = applyDetail(k8sish, DETAIL.DECLARABLES);
+    const t3 = applyDetail(k8sish, DETAIL.ATTRIBUTES);
+    for (const id of ["web", "webSvc", "prodNs"]) {
+      const k1 = attrKeys(t1, id);
+      const k2 = attrKeys(t2, id);
+      const k3 = attrKeys(t3, id);
+      // subset at every step…
+      expect(k2).toEqual(expect.arrayContaining(k1));
+      expect(k3).toEqual(expect.arrayContaining(k2));
+      // …and strictly growing: every node here has a nested tree beyond its scalars.
+      expect(k1.length).toBeLessThan(k2.length);
+      expect(k2.length).toBeLessThan(k3.length);
+    }
+    // The resource view is identity scalars; the attribute view adds the trees.
+    expect(attrKeys(t2, "web")).toEqual(["name", "namespace", "uid"]);
+    expect(attrKeys(t3, "web")).toEqual(["metadata", "name", "namespace", "spec", "uid"]);
+    expect(t3.nodes.find((n) => n.id === "web")!.attrs.spec).toEqual(
+      k8sish.nodes.find((n) => n.id === "web")!.attrs.spec,
+    );
+  });
+
+  test("regression: levels 2 and 3 are not byte-identical for a convention-linked k8s graph", () => {
+    const t2 = JSON.stringify(applyDetail(k8sish, DETAIL.DECLARABLES));
+    const t3 = JSON.stringify(applyDetail(k8sish, DETAIL.ATTRIBUTES));
+    expect(t3).not.toEqual(t2);
+    expect(t3.length).toBeGreaterThan(t2.length);
+    // …and 1 vs 2 differ too: three genuinely distinct zoom stops.
+    const t1 = JSON.stringify(applyDetail(k8sish, DETAIL.COMPOSITES));
+    expect(t2).not.toEqual(t1);
+    expect(t2.length).toBeGreaterThan(t1.length);
+  });
+});
+
 // #1489 — an inert --detail 3 names itself instead of silently emitting the
-// same bytes as --detail 2 (the k8s lexicon links by name/label convention, so
-// its graphs never have a producer attribute to annotate).
+// same bytes as --detail 2. Since the attrs projection landed, T3 adds the
+// property tree as well as edge annotations, so the notice only fires for a
+// graph that has neither: flat attrs AND convention-linked edges.
 describe("detailInertNotice (#1489)", () => {
   test("detail 3 that added toAttr annotations: no notice", () => {
     const detailed = applyDetail(base, DETAIL.ATTRIBUTES);
     expect(detailInertNotice(base, detailed)).toBeUndefined();
   });
 
-  test("edges without producer attributes: notice names the convention-linking cause", () => {
+  test("nested property trees make detail 3 real even without producer attrs: no notice", () => {
     const labelLinked: GraphIR = {
       nodes: [
         { id: "svc", kind: "Service", lexicon: "k8s", attrs: { spec: { selector: { app: "web" } } } },
@@ -110,9 +207,23 @@ describe("detailInertNotice (#1489)", () => {
       groups: {},
     };
     const detailed = applyDetail(labelLinked, DETAIL.ATTRIBUTES);
-    const notice = detailInertNotice(labelLinked, detailed);
+    expect(detailInertNotice(labelLinked, detailed)).toBeUndefined();
+  });
+
+  test("flat attrs + convention-linked edges: notice names both causes", () => {
+    const flat: GraphIR = {
+      nodes: [
+        { id: "svc", kind: "Service", lexicon: "k8s", attrs: { name: "svc" } },
+        { id: "web", kind: "Deployment", lexicon: "k8s", attrs: { name: "web" } },
+      ],
+      edges: [{ from: "svc", to: "web", kind: "ref", viaAttr: "spec.selector" }],
+      groups: {},
+    };
+    const detailed = applyDetail(flat, DETAIL.ATTRIBUTES);
+    const notice = detailInertNotice(flat, detailed);
     expect(notice).toContain("--detail 3");
     expect(notice).toContain("1 edge(s)");
+    expect(notice).toContain("resource view");
     expect(notice).toContain("identical to --detail 2");
   });
 

package/src/graph-detail.ts

@@ -5,10 +5,27 @@ import type { GraphIR, IRNode, IREdge } from "./graph-ir";
  * transform over the base graph IR (no re-discovery), so every emitter and the
  * painter get them for free. See issue #494 / epic #492.
  *
- * - 0 STACKS      — one node per lexicon; edges are cross-lexicon dependencies
- * - 1 COMPOSITES  — composite instances collapsed to a single node each
- * - 2 DECLARABLES — every resource (the base produced by buildGraphIr)
- * - 3 ATTRIBUTES  — declarables plus the producer attribute on each edge
+ * The dial moves two things: the graph's shape (what collapses) and each
+ * node's attribute payload (how much of the resource reaches the node). The
+ * payload is monotonic — a node's attrs at level n are a subset of its attrs
+ * at level n+1 — so a consumer stepping through the levels always sees the
+ * graph grow (#1489):
+ *
+ * - 0 STACKS      — one node per lexicon; edges are cross-lexicon deps; no attrs
+ * - 1 COMPOSITES  — composite instances collapsed to a single node each;
+ *                   topology view — attrs carry only overlay paint (`_*`)
+ *                   and composite membership
+ * - 2 DECLARABLES — every resource; the resource view of its attrs — scalar
+ *                   fields and reference envelopes, not nested property trees
+ * - 3 ATTRIBUTES  — declarables carrying the full property tree, plus the
+ *                   producer attribute on each reference edge
+ *
+ * Before #1489 the dial never touched attrs: every level carried the full
+ * projected config, and T3's only delta over T2 (the producer attribute on
+ * `$ref`-derived edges) is empty for a lexicon whose resources link by
+ * name/label convention — the k8s lexicon end to end — so levels 2 and 3 came
+ * out byte-identical and a zoom picker mapped onto them rendered the same
+ * graph twice (behold#131).
  */
 export type DetailLevel = 0 | 1 | 2 | 3;
 
@@ -30,8 +47,40 @@ export function applyDetail(ir: GraphIR, level: DetailLevel): GraphIR {
       return toAttributes(ir);
     case 2:
     default:
-      return ir;
+      return toDeclarables(ir);
+  }
+}
+
+/** Overlay paint (`_status`, `_unobserved`, …) is a verdict about the node,
+ * not a property of the resource — it survives every tier above STACKS so a
+ * zoomed-out drift view keeps its colours. */
+function paintAttrs(attrs: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(attrs)) if (k.startsWith("_")) out[k] = v;
+  return out;
+}
+
+/** A `{ $ref: "producer.attribute" }` envelope — a reference, not a property tree. */
+function isRefEnvelope(v: unknown): boolean {
+  return (
+    typeof v === "object" &&
+    v !== null &&
+    !Array.isArray(v) &&
+    typeof (v as { $ref?: unknown }).$ref === "string"
+  );
+}
+
+/** T2's resource view of a node's attrs: overlay paint, scalar fields
+ * (identity, status-relevant values), and top-level reference envelopes.
+ * Nested property trees — a k8s `spec`/`metadata`, a Tags list — wait for T3. */
+function resourceAttrs(attrs: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(attrs)) {
+    if (k.startsWith("_") || v === null || typeof v !== "object" || isRefEnvelope(v)) {
+      out[k] = v;
+    }
   }
+  return out;
 }
 
 function edgeSortKey(e: IREdge): string {
@@ -67,7 +116,14 @@ function toStacks(ir: GraphIR): GraphIR {
   return { nodes, edges: sortEdges([...seen.values()]), groups: {} };
 }
 
-/** T1 — collapse each composite instance to one node; internal edges disappear. */
+/** T2 — every resource, each carrying the resource view of its attrs (the
+ * scalar/reference projection; the full property tree is T3's addition). */
+function toDeclarables(ir: GraphIR): GraphIR {
+  return { ...ir, nodes: ir.nodes.map((n) => ({ ...n, attrs: resourceAttrs(n.attrs) })) };
+}
+
+/** T1 — collapse each composite instance to one node; internal edges disappear.
+ * Topology view: surviving plain nodes keep only overlay paint, not properties. */
 function toComposites(ir: GraphIR): GraphIR {
   const idMap = new Map<string, string>();
   for (const n of ir.nodes) idMap.set(n.id, n.compositeInstance ?? n.id);
@@ -80,7 +136,7 @@ function toComposites(ir: GraphIR): GraphIR {
       arr.push(n);
       instances.set(n.compositeInstance, arr);
     } else {
-      plain.push({ ...n });
+      plain.push({ ...n, attrs: paintAttrs(n.attrs) });
     }
   }
 
@@ -162,27 +218,29 @@ function findRefAttr(attrs: Record<string, unknown>, producer: string): string |
 /**
  * chant #1489 — the message to print when `--detail 3` changed nothing.
  *
- * T3's only addition over T2 is the producer attribute on `$ref`-derived
- * edges. A graph whose resources link by name or label convention instead of
- * attribute references (the k8s lexicon end to end) has nothing to annotate,
- * so levels 2 and 3 come out byte-identical — which reads as a broken dial
- * from any consumer stepping through the levels (behold#131 was filed over
- * exactly this). Accepting a value that changes nothing without saying so is
- * the bug; this names it.
+ * T3 adds two things over T2: the full property tree on each node and the
+ * producer attribute on `$ref`-derived edges. A graph whose nodes carry no
+ * properties beyond the resource view AND whose edges reference nothing (they
+ * link by name or label convention) gains neither, so levels 2 and 3 come out
+ * byte-identical — which reads as a broken dial from any consumer stepping
+ * through the levels (behold#131 was filed over exactly this). Accepting a
+ * value that changes nothing without saying so is the bug; this names it.
  *
  * Returns the warning text, or undefined when detail 3 did add something.
- * Callers print it through their own sink; the compare is over the two IRs
- * the caller already holds, so this stays a pure function.
+ * `base` is the pre-detail IR the caller already holds (the same one it fed
+ * `applyDetail`); the T2 view to compare against is derived here, so callers
+ * don't run the projection twice for a message. Pure — no I/O.
  */
 export function detailInertNotice(base: GraphIR, detailed: GraphIR): string | undefined {
-  if (JSON.stringify(detailed) !== JSON.stringify(base)) return undefined;
+  if (JSON.stringify(detailed) !== JSON.stringify(toDeclarables(base))) return undefined;
   const edges = base.edges.length;
   const why =
     edges === 0
       ? "this graph has no edges at all"
       : `none of this graph's ${edges} edge(s) reference a producer attribute — they link by name or label convention`;
   return (
-    `--detail 3 adds the producer attribute to reference edges, but ${why}, ` +
+    `--detail 3 adds each node's full property tree and the producer attribute on reference edges, ` +
+    `but every node's properties already fit the resource view and ${why}, ` +
     `so the output is identical to --detail 2.`
   );
 }

package/src/lifecycle/change-set.test.ts

@@ -320,6 +320,32 @@ describe("buildChangeSet: not-observed is not absent (#1089)", () => {
     expect(cs.entries.find((x) => x.name === "crd-widget")!.action).toBe("create");
   });
 
+  test("a create carries the address the provider confirmed absent, when the lexicon reported one (#1620)", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["web"]),
+      observedNow: {},
+      observedThen: undefined,
+      queried: { web: "/apis/apps/v1/namespaces/default/deployments/web" },
+    });
+    const e = cs.entries.find((x) => x.name === "web")!;
+    // The verdict is unchanged — the address is diagnostic, never load-bearing.
+    expect(e.action).toBe("create");
+    expect(e.queried).toBe("/apis/apps/v1/namespaces/default/deployments/web");
+  });
+
+  test("an unobserved entry's own queried address wins over the map (#1620)", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["web"]),
+      observedNow: {},
+      observedThen: undefined,
+      unobserved: { web: { reason: "read-failed", queried: "from-entry" } },
+      queried: { web: "from-map" },
+    });
+    const e = cs.entries.find((x) => x.name === "web")!;
+    expect(e.action).toBe("unobserved");
+    expect(e.queried).toBe("from-entry");
+  });
+
   test("a returned resource wins over an unobserved claim for the same name", () => {
     const cs = buildChangeSet("prod", {
       declared: new Set(["queue"]),

package/src/lifecycle/change-set.ts

@@ -74,6 +74,13 @@ export interface ChangeSetEntry {
   unobservedReason?: UnobservedReason;
   /** Human-readable backing for `unobservedReason` (the failing command, the missing binding). */
   unobservedDetail?: string;
+  /**
+   * The resolved address the live read was issued against (#1620), when the
+   * lexicon reported one. On a `create` it says which address the provider
+   * confirmed absent — the line between "not there" and "looked in the wrong
+   * place" (a defaulted namespace, an endpoint override, the wrong region).
+   */
+  queried?: string;
   /** The declared entity this resource's owner chain resolves to, for `action: "runtime"` (#1077). */
   runtimeOwner?: string;
 }
@@ -172,6 +179,11 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
       action = "noop";
     }
 
+    // The address the read went to (#1620) — from the unobserved entry when
+    // there is one, else the observation's queried map. Diagnostic only; the
+    // classification above never reads it.
+    const queried = unobservedEntry?.queried ?? input.queried?.[name];
+
     entries.push({
       name,
       type,
@@ -185,6 +197,7 @@ export function buildChangeSet(env: string, input: DiffLiveInput): ChangeSet {
             ...(unobservedEntry.detail ? { unobservedDetail: unobservedEntry.detail } : {}),
           }
         : {}),
+      ...(queried ? { queried } : {}),
       ...(runtimeOwner ? { runtimeOwner } : {}),
     });
   }

package/src/lifecycle/live-diff.test.ts

@@ -229,6 +229,41 @@ describe("diffLive", () => {
     expect(result.unobserved.map((u) => u.name)).toEqual(["crd"]);
   });
 
+  test("the queried addresses pass through, and a missing entity's address is readable off the result (#1620)", () => {
+    const result = diffLive({
+      declared: new Set(["web"]),
+      observedNow: {},
+      observedThen: undefined,
+      queried: { web: "/apis/apps/v1/namespaces/default/deployments/web" },
+    });
+    // The verdict itself does not move: still a confirmed absence.
+    expect(result.missing).toEqual(["web"]);
+    // But the row can explain itself — behold renders `queried: <path> → 404`.
+    expect(result.queried).toEqual({ web: "/apis/apps/v1/namespaces/default/deployments/web" });
+  });
+
+  test("no queried input → no queried key on the result — other lexicons omitting it stays valid (#1620)", () => {
+    const result = diffLive({ declared: new Set(["web"]), observedNow: {}, observedThen: undefined });
+    expect("queried" in result).toBe(false);
+  });
+
+  test("an unobserved row carries the address of the failed read, from the entry or the map (#1620)", () => {
+    const result = diffLive({
+      declared: new Set(["a", "b"]),
+      observedNow: {},
+      observedThen: undefined,
+      unobserved: {
+        a: { reason: "read-failed", detail: "HTTP 500", queried: "/api/v1/namespaces/default/services/a" },
+        b: { reason: "no-credentials" },
+      },
+      queried: { b: "/api/v1/namespaces/default/services/b" },
+    });
+    expect(result.unobserved).toEqual([
+      { name: "a", reason: "read-failed", detail: "HTTP 500", queried: "/api/v1/namespaces/default/services/a" },
+      { name: "b", reason: "no-credentials", queried: "/api/v1/namespaces/default/services/b" },
+    ]);
+  });
+
   test("a resource that was returned is never also unobserved", () => {
     const result = diffLive({
       declared: new Set(["a"]),

package/src/lifecycle/live-diff.ts

@@ -34,6 +34,8 @@ export interface UnobservedResource {
   type?: string;
   reason: UnobservedReason;
   detail?: string;
+  /** The resolved address the failed read was issued against (#1620), when the lexicon reported one. */
+  queried?: string;
 }
 
 /**
@@ -84,6 +86,16 @@ export interface LiveDiffResult {
    * in the observation. Sorted by name.
    */
   unobserved: UnobservedResource[];
+  /**
+   * The resolved query address per entity name (#1620) — what the live read
+   * was actually issued against, as the lexicon reported it. Present only when
+   * the lexicon supplied addresses; other lexicons omitting it stays valid.
+   * This is where a `missing` entry explains itself: `missing` is a bare name
+   * list, and `queried[name]` says which address the provider answered 404
+   * for — a declared k8s object with no namespace reads from the *defaulted*
+   * namespace, and only this field makes that visible.
+   */
+  queried?: Record<string, string>;
 }
 
 export interface DiffLiveInput {
@@ -99,6 +111,12 @@ export interface DiffLiveInput {
    * at, so absence from `observedNow` is a confirmed absence.
    */
   unobserved?: Record<string, UnobservedEntity>;
+  /**
+   * Resolved query address per entity name (#1620), as the observation
+   * reported it. Passed through to the result and joined onto unobserved rows;
+   * never consulted for classification.
+   */
+  queried?: Record<string, string>;
 }
 
 const TRACKED_FIELDS: Array<keyof ResourceMetadata> = [
@@ -223,11 +241,13 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
 
   for (const name of unobservedNames) {
     const entry = unobservedMap[name];
+    const queriedAddress = entry.queried ?? input.queried?.[name];
     unobserved.push({
       name,
       ...(entry.type ? { type: entry.type } : {}),
       reason: entry.reason,
       ...(entry.detail ? { detail: entry.detail } : {}),
+      ...(queriedAddress ? { queried: queriedAddress } : {}),
     });
   }
 
@@ -330,6 +350,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
     driftedSinceSnapshot: driftedSinceSnapshot.sort((a, b) => a.name.localeCompare(b.name)),
     unchanged: unchanged.sort(),
     unobserved: unobserved.sort((a, b) => a.name.localeCompare(b.name)),
+    ...(input.queried && Object.keys(input.queried).length > 0 ? { queried: input.queried } : {}),
   };
 }
 

package/src/lifecycle/observe.ts

@@ -43,7 +43,7 @@ export interface ObserveResult {
 function qualifyObservation(obs: NormalizedObservation, stackName: string): NormalizedObservation {
   const q = <T>(m: Record<string, T>): Record<string, T> =>
     Object.fromEntries(Object.entries(m).map(([k, v]) => [`${stackName}::${k}`, v]));
-  return { resources: q(obs.resources), unobserved: q(obs.unobserved) };
+  return { resources: q(obs.resources), unobserved: q(obs.unobserved), queried: q(obs.queried) };
 }
 
 /**
@@ -253,6 +253,7 @@ export async function observeResources(
         {
           resources: {},
           unobserved: unobservedAll(entityNames, "read-failed", message, entities),
+          queried: {},
         },
         environment,
         entityNames.length,