@intentius/chant 0.44.1 → 0.44.3

package/src/cli/commands/lint.ts

@@ -1,4 +1,5 @@
 import { resolve, join, relative } from "path";
+import type { BuildParamProvenance } from "../../provenance";
 import { readFileSync, writeFileSync, readdirSync, statSync } from "fs";
 import { execFileSync } from "child_process";
 import { runLint, parseDisableComments } from "../../lint/engine";
@@ -152,6 +153,15 @@ async function loadAllPluginRules(
 export interface LintOptions {
   /** Path to lint */
   path: string;
+  /**
+   * This invocation's resolved build parameters (#1490).
+   *
+   * The COMP* checks import `*.component.ts`, and an ES module evaluates once
+   * per path — so the values in effect during the lint gate are the values
+   * every later reader observes. A caller that lints before it graphs must
+   * pass the same parameters to both or the later resolution has no effect.
+   */
+  buildParams?: BuildParamProvenance[];
   /** Apply auto-fixes */
   fix?: boolean;
   /** Output format */
@@ -334,6 +344,7 @@ async function resolveRegistryContext(
 async function runComponentCheckDiagnostics(
   infraPath: string,
   sandbox?: boolean,
+  buildParams?: BuildParamProvenance[],
 ): Promise<{ diagnostics: LintDiagnostic[]; suppressed: Array<LintDiagnostic & { reason?: string }> }> {
   // Discovery stays scoped to the lint arg; COMP* severity overrides come from
   // the project-root config, same as the AST-rule pass.
@@ -342,7 +353,7 @@ async function runComponentCheckDiagnostics(
   const allCheckIds = new Set(checks.map((c) => c.id));
 
   const registryContext = await resolveRegistryContext(infraPath);
-  const raw = await runComponentChecks(infraPath, checks, registryContext, sandbox);
+  const raw = await runComponentChecks(infraPath, checks, registryContext, sandbox, buildParams);
 
   const fileDirectivesCache = new Map<string, ReturnType<typeof parseDisableComments>>();
   const fileLevelDisable = (
@@ -483,7 +494,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   // structurally distinct check family (whole-project, post-discovery,
   // see ../../lint/component-checks.ts) but the same `chant lint` output and
   // the same error-severity gating as every COR/EVL diagnostic.
-  const componentResult = await runComponentCheckDiagnostics(infraPath, options.sandbox);
+  const componentResult = await runComponentCheckDiagnostics(infraPath, options.sandbox, options.buildParams);
   diagnostics.push(...componentResult.diagnostics);
   suppressed.push(...componentResult.suppressed);
 
@@ -531,7 +542,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
     // `*.component.ts` file on their behalf), but a fix applied to another
     // rule could still be in the same file a component was discovered from —
     // re-run for consistency with the AST re-lint above.
-    const postComponentResult = await runComponentCheckDiagnostics(infraPath, options.sandbox);
+    const postComponentResult = await runComponentCheckDiagnostics(infraPath, options.sandbox, options.buildParams);
     diagnostics.push(...postComponentResult.diagnostics);
     suppressed.push(...postComponentResult.suppressed);
   }

package/src/cli/handlers/components.ts

@@ -430,7 +430,7 @@ export async function runComponentsStatus(ctx: CommandContext): Promise<number>
             // rather than "stale" (recorded, and nothing live).
             const message = err instanceof Error ? err.message : String(err);
             console.error(formatWarning({ message: `${plugin.name}: describeResources failed — ${message} (components in this lexicon report unknown, not stale)` }));
-            observed = { resources: {}, unobserved: unobservedAll(declared, "read-failed", message, entities) };
+            observed = { resources: {}, unobserved: unobservedAll(declared, "read-failed", message, entities), queried: {} };
           }
           const cs = buildChangeSet(environment, {
             declared,

package/src/cli/handlers/graph.test.ts

@@ -52,10 +52,16 @@ vi.mock("../../graph-layout", () => ({
 // hit the Op-graph and source-view modes, so these mocks don't touch them).
 const loadPluginsMock = vi.fn();
 const resolveLexMock = vi.fn();
-vi.mock("../plugins", () => ({
-  loadPlugins: (...a: unknown[]) => loadPluginsMock(...a),
-  resolveProjectLexicons: (...a: unknown[]) => resolveLexMock(...a),
-}));
+vi.mock("../plugins", async () => {
+  // Real `collectBuildRootContributors` (#1626): it is pure binding — the
+  // handler's build-root plumbing is exactly what the tests below assert.
+  const actual = await vi.importActual<typeof import("../plugins")>("../plugins");
+  return {
+    ...actual,
+    loadPlugins: (...a: unknown[]) => loadPluginsMock(...a),
+    resolveProjectLexicons: (...a: unknown[]) => resolveLexMock(...a),
+  };
+});
 const observeMock = vi.fn();
 const replayMock = vi.fn();
 const hasSnapshotMock = vi.fn((..._a: unknown[]) => Promise.resolve(false));
@@ -86,17 +92,22 @@ vi.mock("../../config", async () => {
   };
 });
 const buildMock = vi.fn();
-vi.mock("../../build", () => ({
-  // Forwards its arguments so a test can assert what the live path passed —
-  // `buildParams` in particular (#1483), the same reason `discover` above
-  // forwards for #1359.
-  build: (...a: unknown[]) => {
-    buildMock(...a);
-    return Promise.resolve({ errors: [] });
-  },
-  partitionByLexicon: () => ({}),
-  computeStackGraph: () => ({}),
-}));
+vi.mock("../../build", async () => {
+  // Real `mergeBuildRootEntities` (#1626): the graph paths reuse build's one
+  // merge implementation, so the tests exercise the real merge rules
+  // (collision → error) rather than a re-stubbed copy of them.
+  const actual = await vi.importActual<typeof import("../../build")>("../../build");
+  return {
+    ...actual,
+    // Forwards its arguments so a test can assert what the live path passed —
+    // `buildParams` in particular (#1483), the same reason `discover` above
+    // forwards for #1359.
+    build: (...a: unknown[]) => {
+      buildMock(...a);
+      return Promise.resolve({ errors: [] });
+    },
+  };
+});
 
 const { runGraph } = await import("./graph");
 
@@ -812,4 +823,169 @@ describe("runGraph", () => {
       });
     });
   });
+
+  // #1626 — #1612's `buildRoots` seam reached `chant build` and the lifecycle
+  // handlers but none of the graph command's four entity-collection sites, so
+  // a `k8s.kustomize.roots` estate graphed only its typed source: the rendered
+  // Deployment/Service existed in the build output and on the cluster, and
+  // nowhere in any graph. The shapes here mirror the kustomize-root fixture
+  // (lexicons/k8s/src/testdata/kustomize-root, rendered as `overlays/prod`):
+  // the contributor below returns exactly what `renderKustomizeRoots` returns
+  // for it — rendered-manifest entities keyed `overlays/prod/<kindName>`,
+  // props = the verbatim document, provenance annotation stamped.
+  describe("build-root contributions reach the graph (#1626)", () => {
+    const KUSTOMIZE_ROOT_ANNOTATION = "chant.intentius.io/kustomize-root";
+
+    /** A rendered kustomize document as `renderedManifestEntity` shapes it. */
+    const rendered = (group: string, kind: string, name: string, spec: Record<string, unknown>): Declarable =>
+      ({
+        lexicon: "k8s",
+        entityType: `K8s::${group}::${kind}`,
+        kind: "resource",
+        props: {
+          apiVersion: group === "Core" ? "v1" : `${group.toLowerCase()}/v1`,
+          kind,
+          metadata: { name, annotations: { [KUSTOMIZE_ROOT_ANNOTATION]: "overlays/prod" } },
+          spec,
+        },
+        [DECLARABLE_MARKER]: true,
+        [Symbol.for("chant.k8s.renderedManifest")]: true,
+      }) as unknown as Declarable;
+
+    const fixtureContribution = () => ({
+      entities: new Map<string, Declarable>([
+        ["overlays/prod/serviceProdWeb", rendered("Core", "Service", "prod-web", { selector: { app: "web" } })],
+        ["overlays/prod/deploymentProdWeb", rendered("Apps", "Deployment", "prod-web", { replicas: 3 })],
+      ]),
+    });
+
+    /** A k8s-shaped plugin whose `buildRoots` hook renders the fixture. */
+    const k8sPluginStub = (hook = async () => fixtureContribution()) => ({
+      name: "k8s",
+      serializer: {},
+      describeResources: () => Promise.resolve({}),
+      buildRoots: hook,
+    });
+
+    const declaredNamespace = (): void => {
+      discoverMock.mockResolvedValue({
+        entities: new Map<string, Declarable>([["ns", decl({ lexicon: "k8s", entityType: "K8s::Core::Namespace", kind: "resource", props: { metadata: { name: "web" } } })]]),
+        errors: [], dependencies: new Map(), sourceFiles: [],
+      });
+    };
+
+    const staticWithFixtureRoot = (hook?: () => Promise<{ entities: Map<string, Declarable> }>): void => {
+      lintMock.mockResolvedValue({ success: true });
+      declaredNamespace();
+      resolveLexMock.mockResolvedValue(["k8s"]);
+      loadPluginsMock.mockResolvedValue([k8sPluginStub(hook)]);
+    };
+
+    test("static --format ir emits the rendered nodes alongside the typed ones", async () => {
+      staticWithFixtureRoot();
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      const ir = JSON.parse(stdoutBuf.join("\n"));
+      expect(ir.nodes.map((n: { id: string }) => n.id).sort()).toEqual([
+        "ns",
+        "overlays/prod/deploymentProdWeb",
+        "overlays/prod/serviceProdWeb",
+      ]);
+      const deployment = ir.nodes.find((n: { id: string }) => n.id === "overlays/prod/deploymentProdWeb");
+      expect(deployment.kind).toBe("K8s::Apps::Deployment");
+      expect(deployment.lexicon).toBe("k8s");
+    });
+
+    // #1624 made attrs projection monotonic; the provenance annotation is a
+    // nested `metadata` tree, so it belongs to the full-property tier and only
+    // that tier — present at --detail 3, absent from --detail 1's topology view.
+    test("--detail 3 carries the provenance annotation in the rendered node's attrs; --detail 1 does not", async () => {
+      staticWithFixtureRoot();
+      expect(await runGraph({ args: makeArgs({ format: "ir", detail: 3 }), plugins: [], serializers: [] })).toBe(0);
+      const detailed = JSON.parse(stdoutBuf.join("\n"));
+      const at3 = detailed.nodes.find((n: { id: string }) => n.id === "overlays/prod/deploymentProdWeb");
+      expect(at3.attrs.metadata.annotations[KUSTOMIZE_ROOT_ANNOTATION]).toBe("overlays/prod");
+
+      stdoutBuf.length = 0;
+      staticWithFixtureRoot();
+      expect(await runGraph({ args: makeArgs({ format: "ir", detail: 1 }), plugins: [], serializers: [] })).toBe(0);
+      const coarse = JSON.parse(stdoutBuf.join("\n"));
+      const at1 = coarse.nodes.find((n: { id: string }) => n.id === "overlays/prod/deploymentProdWeb");
+      expect(at1).toBeDefined(); // the node survives the tier —
+      expect(at1.attrs.metadata).toBeUndefined(); // its property tree does not
+    });
+
+    test("a contributed name colliding with a discovered entity fails the graph like a discovery error", async () => {
+      staticWithFixtureRoot(async () => ({
+        entities: new Map<string, Declarable>([["ns", rendered("Core", "Namespace", "web", {})]]),
+      }));
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(1);
+      expect(stdoutBuf.join("\n")).toBe("");
+      expect(stderrBuf.join("\n")).toContain('"ns" collides');
+    });
+
+    test("--stacks joins the rendered entities into the stack partitions", async () => {
+      declaredNamespace();
+      resolveLexMock.mockResolvedValue(["k8s"]);
+      loadPluginsMock.mockResolvedValue([k8sPluginStub()]);
+      const exit = await runGraph({ args: makeArgs({ stacks: true, json: true }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      // partitionByLexicon/computeStackGraph are stubbed above; what matters is
+      // that the merge ran before them without erroring. The collision case
+      // proves the same merge is live on this path:
+      stderrBuf.length = 0;
+      declaredNamespace();
+      loadPluginsMock.mockResolvedValue([
+        k8sPluginStub(async () => ({ entities: new Map<string, Declarable>([["ns", rendered("Core", "Namespace", "web", {})]]) })),
+      ]);
+      expect(await runGraph({ args: makeArgs({ stacks: true, json: true }), plugins: [], serializers: [] })).toBe(1);
+      expect(stderrBuf.join("\n")).toContain('"ns" collides');
+    });
+
+    test("--live passes the contributors through to build(), like lifecycle does", async () => {
+      resolveLexMock.mockResolvedValue(["k8s"]);
+      loadPluginsMock.mockResolvedValue([k8sPluginStub()]);
+      observeMock.mockResolvedValue({ observations: [], errors: [], warnings: [] });
+      const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, env: "kcheck" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      const [, , , options] = buildMock.mock.calls[0] as [string, unknown, unknown, { buildRoots?: unknown[] }];
+      expect(options.buildRoots).toHaveLength(1);
+    });
+
+    test("--live --overlay classifies an observed rendered node as managed, not foreign", async () => {
+      resolveLexMock.mockResolvedValue(["k8s"]);
+      loadPluginsMock.mockResolvedValue([k8sPluginStub()]);
+      declaredNamespace();
+      // The cluster has the namespace and the rendered Deployment — the
+      // latter observed through the same entityType/props flow as any
+      // declared entity (its props carry metadata.name like typed ones).
+      observeMock.mockResolvedValue({
+        observations: [{
+          lexicon: "k8s",
+          resources: {
+            ns: { type: "K8s::Core::Namespace", status: "OBSERVED", physicalId: "uid-ns", ownership: "owned" },
+            "overlays/prod/deploymentProdWeb": { type: "K8s::Apps::Deployment", status: "OBSERVED", physicalId: "uid-deploy", ownership: "owned" },
+          },
+        }],
+        errors: [], warnings: [],
+      });
+      const exit = await runGraph({
+        args: makeArgs({ format: "ir", live: true, overlay: true, env: "kcheck" }),
+        plugins: [], serializers: [],
+      });
+      expect(exit).toBe(0);
+      const ir = JSON.parse(stdoutBuf.join("\n"));
+      const deployment = ir.nodes.find((n: { id: string }) => n.id === "overlays/prod/deploymentProdWeb");
+      // Declared (via the merged contribution) + observed = managed. Before
+      // #1626 the declared canvas lacked the rendered node, so it read as
+      // foreign (`warn`) despite being chant's own build output.
+      expect(deployment.attrs._status).toBe("good");
+      expect(deployment.physicalId).toBe("uid-deploy");
+      // The rendered Service was declared but not observed — pending, the
+      // same verdict a typed entity would get.
+      const service = ir.nodes.find((n: { id: string }) => n.id === "overlays/prod/serviceProdWeb");
+      expect(service.attrs._status).toBe("accent");
+    });
+  });
 });

package/src/cli/handlers/graph.ts

@@ -1,7 +1,7 @@
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
 import { discover } from "../../discovery/index";
-import { partitionByLexicon, computeStackGraph, build } from "../../build";
+import { partitionByLexicon, computeStackGraph, build, mergeBuildRootEntities } from "../../build";
 import { buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, type GraphIR, type IRPipeline, type LiveObservation } from "../../graph-ir";
 import { buildDeclaredPerStack } from "../../graph-declared";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
@@ -15,7 +15,7 @@ import { toMermaid } from "../../graph-mermaid";
 import { toDot } from "../../graph-dot";
 import { getLayoutEngine, toLayoutInput, type NodeSize } from "../../graph-layout";
 import { lintCommand } from "../commands/lint";
-import { loadPlugins, resolveProjectLexicons } from "../plugins";
+import { loadPlugins, resolveProjectLexicons, collectBuildRootContributors } from "../plugins";
 import { readFileSync } from "node:fs";
 import { formatError, formatWarning, formatBold } from "../format";
 import type { CommandContext } from "../registry";
@@ -56,6 +56,69 @@ async function graphBuildParams(
   return resolution.provenance;
 }
 
+/**
+ * The build-root contributors this invocation's project configures (#1626) —
+ * the same closures `chant build` and the lifecycle handlers hand to
+ * `BuildOptions.buildRoots`, bound here for the graph command's
+ * discover-based paths, which never run `build()` and so never ran the hook:
+ * a `k8s.kustomize.roots` estate graphed only its typed source while its
+ * built (and deployed) output carried the rendered manifests too.
+ *
+ * `graph` is not `requiresPlugins` (Op/source-graph modes must work without a
+ * lexicon), so plugins are loaded here when `ctx.plugins` is empty, mirroring
+ * `runGraphLive`. Rooted at the config's own directory, like
+ * `cli/commands/build.ts` — a relative kustomize root resolves against where
+ * it was declared, not against a sourceDir-scoped graph path. A project that
+ * fails to load plugins degrades to no contributors with a warning rather
+ * than failing modes that never needed plugins at all.
+ */
+async function graphBuildRootContributors(
+  ctx: CommandContext,
+  projectPath: string,
+): Promise<Array<() => Promise<import("../../lexicon").BuildRootContribution>>> {
+  const { config, configPath } = await loadChantConfigUpward(projectPath).catch(
+    () => ({ config: {} as ChantConfig, configPath: undefined }),
+  );
+  let plugins = ctx.plugins;
+  if (plugins.length === 0) {
+    try {
+      plugins = await loadPlugins(await resolveProjectLexicons(projectPath));
+    } catch (err) {
+      console.error(formatWarning({
+        message: `could not load the project's lexicons — build-root entities (kustomize roots) will be missing from the graph (${err instanceof Error ? err.message : String(err)})`,
+      }));
+      return [];
+    }
+  }
+  return collectBuildRootContributors(
+    plugins,
+    config as unknown as Record<string, unknown>,
+    configPath ? dirname(configPath) : projectPath,
+  );
+}
+
+/**
+ * Merge build-root contributions into a discovered entity set — the exact
+ * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
+ * ../../build.ts), surfaced in the graph command's error style. Returns false
+ * when a contributor failed or a name collided; the caller stops, matching
+ * how the discover-based paths treat discovery errors — a graph missing the
+ * entities the build would refuse over must not be emitted as if complete.
+ */
+async function mergeGraphBuildRoots(
+  entities: Map<string, import("../../declarable").Declarable>,
+  contributors: Array<() => Promise<import("../../lexicon").BuildRootContribution>>,
+): Promise<boolean> {
+  if (contributors.length === 0) return true;
+  const merged = await mergeBuildRootEntities(entities, contributors);
+  for (const w of merged.warnings) console.error(formatWarning({ message: w }));
+  if (merged.errors.length > 0) {
+    for (const message of merged.errors) console.error(formatError({ message }));
+    return false;
+  }
+  return true;
+}
+
 /**
  * `chant graph` — the Op dependency graph by default; `--stacks` renders the
  * cross-stack apply-ordering graph (edges, order, waves) chant computes from
@@ -154,11 +217,17 @@ async function runGraphLive(
   // a confidently wrong overlay rather than an empty one.
   const liveBuildParams = await graphBuildParams(ctx, projectPath);
   if (!liveBuildParams) return 1;
+  // #1626 — the same build-root contributors `chant build` runs (kustomize
+  // roots rendered into entities), so the scope handed to describeResources
+  // includes the rendered objects and the live read observes them like any
+  // declared entity. Without this the built estate carried them but the graph
+  // build here didn't, and the overlay called every one of them foreign.
+  const buildRoots = collectBuildRootContributors(plugins, config as unknown as Record<string, unknown>, projectPath);
   const buildResult = await build(
     resolve(args.src ?? config.sourceDir ?? "."),
     plugins.map((p) => p.serializer),
     undefined,
-    { buildParams: liveBuildParams },
+    { buildParams: liveBuildParams, buildRoots },
   );
   if (buildResult.errors.length > 0) {
     console.error(formatError({ message: "Build failed — fix errors before graphing live state" }));
@@ -323,14 +392,23 @@ async function runGraphLive(
       const declared = await discover(resolve(args.src ?? config.sourceDir ?? "."), {
         ...(declaredParams ? { buildParams: declaredParams } : {}),
       });
-      if (declared.errors.length === 0) {
+      // #1626 — the declared canvas must include what the build declares, and
+      // that is discovery PLUS build-root contributions (rendered kustomize
+      // objects). Same contributors, same merge as the `build()` above — so
+      // the rendered nodes classify `good`/`accent` like typed ones instead
+      // of reading as foreign. A merge that fails here (it just succeeded in
+      // the build above, so only a non-deterministic render gets this far)
+      // degrades exactly like discovery errors: overlay skipped, said once.
+      if (declared.errors.length > 0) {
+        console.error(formatWarning({ message: "overlay: source has discovery errors — showing the provisioned graph without the declared overlay" }));
+      } else if (!(await mergeGraphBuildRoots(declared.entities, buildRoots))) {
+        console.error(formatWarning({ message: "overlay: a build root failed to render — showing the provisioned graph without the declared overlay" }));
+      } else {
         const declaredIr = buildGraphIr(declared.entities, projectPath);
         ir =
           args.overlayAnchor === "live"
             ? overlayGraphs(ir, declaredIr, overlayOpts)
             : sourceOverlayGraphs(declaredIr, ir, overlayOpts);
-      } else {
-        console.error(formatWarning({ message: "overlay: source has discovery errors — showing the provisioned graph without the declared overlay" }));
       }
     }
   }
@@ -378,7 +456,11 @@ async function runGraphLive(
  */
 async function runComponentGraph(ctx: CommandContext): Promise<number> {
   const projectPath = resolve(ctx.args.path === "." ? "." : ctx.args.path);
-  const graph = await computeComponentGraph(projectPath, ctx.args.sandbox);
+  // #1490 — as in runComponentGraphView: the text/--json mode reads the same
+  // source and must not disagree with the --format modes about it.
+  const componentParams = await graphBuildParams(ctx, projectPath);
+  if (!componentParams) return 1;
+  const graph = await computeComponentGraph(projectPath, ctx.args.sandbox, componentParams);
 
   if (!graph.success) {
     console.error(formatError({ message: graph.error ?? "Failed to compute component graph" }));
@@ -434,7 +516,20 @@ async function runComponentGraphView(
 ): Promise<number> {
   const projectPath = resolve(ctx.args.path === "." ? "." : ctx.args.path);
 
-  const lint = await lintCommand({ path: ctx.args.path, format: "stylish", sandbox: ctx.args.sandbox });
+  // #1490 — resolved BEFORE the lint gate, not after. The COMP* checks import
+  // every `*.component.ts`, an ES module evaluates once per path, and the
+  // values in effect at that first import are the ones the graph below will
+  // read no matter what it resolves for itself. Ordering is the fix; passing
+  // them to `computeComponentGraph` alone did nothing.
+  const componentParams = await graphBuildParams(ctx, projectPath);
+  if (!componentParams) return 1;
+
+  const lint = await lintCommand({
+    path: ctx.args.path,
+    format: "stylish",
+    sandbox: ctx.args.sandbox,
+    buildParams: componentParams,
+  });
   if (!lint.success) {
     console.error(
       formatError({
@@ -444,7 +539,7 @@ async function runComponentGraphView(
     return 1;
   }
 
-  const graph = await computeComponentGraph(projectPath, ctx.args.sandbox);
+  const graph = await computeComponentGraph(projectPath, ctx.args.sandbox, componentParams);
   if (!graph.success) {
     console.error(formatError({ message: graph.error ?? "Failed to compute component graph" }));
     return 1;
@@ -538,8 +633,19 @@ async function runGraphView(
     return 1;
   }
 
+  // Resolved before the gate for the reason in runComponentGraphView: the
+  // lint pass imports project source, and the first import of a module is the
+  // one that binds its parameter-derived values (#1490).
+  const buildParams = await graphBuildParams(ctx, projectPath);
+  if (!buildParams) return 1;
+
   // Gate: only emit for lint-clean source.
-  const lint = await lintCommand({ path: ctx.args.path, format: "stylish", sandbox: ctx.args.sandbox });
+  const lint = await lintCommand({
+    path: ctx.args.path,
+    format: "stylish",
+    sandbox: ctx.args.sandbox,
+    buildParams,
+  });
   if (!lint.success) {
     console.error(
       formatError({
@@ -550,15 +656,20 @@ async function runGraphView(
     return 1;
   }
 
-  const buildParams = await graphBuildParams(ctx, projectPath);
-  if (!buildParams) return 1;
-
   const result = await discover(projectPath, { buildParams });
   if (result.errors.length > 0) {
     for (const e of result.errors) console.error(formatError({ message: e.message }));
     return 1;
   }
 
+  // #1626 — join the build-root contributions (rendered kustomize objects) to
+  // the discovered set, the way `build()` does before partitioning, so the
+  // static graph shows the same estate the build emits. Fatal on failure,
+  // like discovery errors: this graph stands for what would build.
+  if (!(await mergeGraphBuildRoots(result.entities, await graphBuildRootContributors(ctx, projectPath)))) {
+    return 1;
+  }
+
   // Build the base IR, focus with a lens (declarable-level, most precise), then
   // apply the detail tier — so e.g. blast:<resource> works before any collapse.
   let ir: GraphIR = buildGraphIr(result.entities, projectPath);
@@ -678,6 +789,12 @@ async function runStackGraph(ctx: CommandContext): Promise<number> {
     return 1;
   }
 
+  // #1626 — same join as runGraphView: contributed entities are part of the
+  // built estate, so they belong in its stack partitions too.
+  if (!(await mergeGraphBuildRoots(result.entities, await graphBuildRootContributors(ctx, projectPath)))) {
+    return 1;
+  }
+
   const lexicons = [...partitionByLexicon(result.entities).keys()];
   const graph = computeStackGraph(result.entities, lexicons);
 

package/src/cli/handlers/lifecycle.ts

@@ -737,6 +737,7 @@ async function observeLexicon(
     return {
       resources: {},
       unobserved: unobservedAll(entityNames, "read-failed", message, opts.entities),
+      queried: {},
     };
   }
 }
@@ -806,7 +807,7 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
       });
       const observedNow = observed.resources;
       const observedThen = prevSnapshot?.resources;
-      const diff = diffLive({ declared, observedNow, observedThen, unobserved: observed.unobserved });
+      const diff = diffLive({ declared, observedNow, observedThen, unobserved: observed.unobserved, queried: observed.queried });
       // Unobserved entities are deliberately NOT drift: a hole in the read is
       // not a change in the cloud. They are reported separately (#1089) so a
       // "no drift detected" line can never be built on top of a failed read.
@@ -962,7 +963,12 @@ function renderLiveDiff(lexiconName: string, environment: string, diff: LiveDiff
   }
   if (diff.missing.length > 0) {
     console.log(formatBold("\nMISSING (declared, provider reports not in cloud):"));
-    for (const name of diff.missing) console.log(`  - ${name}`);
+    for (const name of diff.missing) {
+      // The address the read actually went to (#1620) — the line between "not
+      // there" and "looked in the wrong place" (a defaulted namespace, say).
+      const queried = diff.queried?.[name];
+      console.log(`  - ${name}${queried ? ` [queried ${queried}]` : ""}`);
+    }
   }
   if (diff.orphan.length > 0) {
     console.log(formatBold("\nORPHAN (in cloud, not declared):"));

package/src/codegen/publish-order.test.ts

@@ -48,7 +48,7 @@ describe("publish order", () => {
     // same stranding by a different route.
     const all = execFileSync(
       "bash",
-      ["-c", 'for d in packages/*/ lexicons/*/ wardens/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
+      ["-c", 'for d in packages/*/ lexicons/*/; do [ -f "$d/package.json" ] && echo "${d%/}"; done'],
       { cwd: REPO, encoding: "utf8" },
     )
       .split("\n")

package/src/codegen/release-wiring.test.ts

@@ -118,10 +118,9 @@ function recipeBody(name: string): string {
  */
 describe("release wiring: peer ranges stay in lockstep (#1255)", () => {
   it("the whole-repo release rewrites every @intentius peer range", () => {
-    // Since #788 the rewrite is generic (`with_entries` over every
-    // `@intentius/*` peer) rather than two named keys: the wardens added
-    // `@intentius/warden-core` as a third in-repo peer, and a hand-listed
-    // rewrite goes stale the same way the hand-listed publish steps did.
+    // The rewrite is generic (`with_entries` over every `@intentius/*`
+    // peer) rather than named keys — a hand-listed rewrite goes stale the
+    // same way the hand-listed publish steps did.
     const body = recipeBody("release");
     expect(body).toMatch(/\.peerDependencies\s*\|=\s*with_entries/);
     expect(body).toMatch(/startswith\("@intentius\/"\)/);

package/src/components/cli-support.test.ts

@@ -229,6 +229,58 @@ describe("computeComponentGraph", () => {
     expect(result.edges).toEqual([]);
   });
 
+  // #1490 — `discoverComponents` has honoured buildParams since #1108, but
+  // every caller stopped short of passing them, so the component graph was
+  // always the default-parameter graph. A component conditioned on a parameter
+  // survived `--param` that removed the resources it describes, and `chant
+  // build` and `chant graph --components` disagreed about the same source.
+  //
+  // The fixture imports the params module by absolute path rather than by the
+  // `@intentius/chant/params` specifier: it is written to a temp dir with no
+  // node_modules, so the bare specifier would resolve elsewhere (or nowhere)
+  // and the fixture would read a DIFFERENT params object than the one
+  // discovery mutates — passing the test for the wrong reason.
+  const paramsModule = new URL("../params.ts", import.meta.url).pathname;
+  const conditionalComponent = `import { params } from ${JSON.stringify(paramsModule)};
+export const backup =
+  params.backups === "omit"
+    ? undefined
+    : { name: "backup", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell", reason: "t" }] }] };`;
+
+  // A fresh directory per call: the ESM loader caches a module by path, so
+  // re-importing the same fixture would replay the FIRST call's parameter
+  // binding and the assertion would pass or fail for the wrong reason.
+  async function graphWith(
+    dir: string,
+    provenance?: Array<{ name: string; value: string; source: "cli" }>,
+  ) {
+    await mkdir(dir, { recursive: true });
+    await writeFile(join(dir, "backup.component.ts"), conditionalComponent);
+    return computeComponentGraph(dir, undefined, provenance);
+  }
+
+  test("a component conditioned on a build parameter follows the parameter", async () => {
+    const omitted = await graphWith(join(testDir, "omit"), [
+      { name: "backups", value: "omit", source: "cli" },
+    ]);
+    expect(omitted.success).toBe(true);
+    expect(omitted.order).toEqual([]);
+
+    const kept = await graphWith(join(testDir, "keep"), [
+      { name: "backups", value: "pg-dump", source: "cli" },
+    ]);
+    expect(kept.success).toBe(true);
+    expect(kept.order).toEqual(["backup"]);
+  });
+
+  // Supplying none must not inherit whatever a previous call set — the same
+  // leak `discoverComponents`'s unconditional setBuildParams guards against.
+  test("passing no parameters does not inherit the previous call's", async () => {
+    await graphWith(join(testDir, "first"), [{ name: "backups", value: "omit", source: "cli" }]);
+    const fresh = await graphWith(join(testDir, "second"));
+    expect(fresh.order).toEqual(["backup"]);
+  });
+
   test("orders a consumer after its producer, with a consumer → producer edge", async () => {
     await writeFile(
       join(testDir, "alb.component.ts"),