@intentius/chant 0.44.14 → 0.45.0

package/src/cli/handlers/lifecycle.ts

@@ -416,6 +416,7 @@ export async function runLifecycleDiff(ctx: CommandContext): Promise<number> {
           buildResult,
           json,
           stack: target.stack,
+          region: target.region,
           componentStacks,
           baseline,
           updateBaseline: args.updateBaseline,
@@ -650,6 +651,11 @@ interface LiveDiffArgs {
   /** Deployed stack name for a multi-stack project (#932); scopes the live
    * observation (which CloudFormation stack to query) and the snapshot read. */
   stack?: string;
+  /** Region that stack is deployed in, from `stacks[].region` (#1264). Same
+   * contract as snapshot (#1261): without it every stack is read against the
+   * ambient region, so a multi-region estate reports its out-of-region stacks
+   * as absent rather than unobserved. */
+  region?: string;
   /** Component projects deploy one CFN stack per component; observe them all and
    * union (the same fix graph/plan use), else every deployed resource reads as
    * "missing". Empty → the single-stack observe path. */
@@ -710,6 +716,9 @@ async function observeLexicon(
     declared: Set<string>;
     entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
     stack?: string;
+    /** Region the stack is deployed in (#1264); the read targets it instead of
+     * the ambient region. */
+    region?: string;
     componentStacks?: string[];
     owned?: boolean;
     /** `--namespace <ns>` (#1629): where to read an entity that declares no
@@ -723,6 +732,7 @@ async function observeLexicon(
     buildOutput: opts.buildOutput,
     entityNames,
     entities: opts.entities,
+    ...(opts.region ? { region: opts.region } : {}),
     ...(opts.owned !== undefined ? { owned: opts.owned } : {}),
     ...(opts.namespace ? { namespace: opts.namespace } : {}),
   };
@@ -746,6 +756,7 @@ async function observeLexicon(
       resources: {},
       unobserved: unobservedAll(entityNames, "read-failed", message, opts.entities),
       queried: {},
+      notes: [],
     };
   }
 }
@@ -811,6 +822,7 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
         declared,
         entities,
         stack: args.stack,
+        region: args.region,
         componentStacks: args.componentStacks,
         ...(args.namespace ? { namespace: args.namespace } : {}),
       });
@@ -839,6 +851,7 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
           buildOutput,
           entities,
           stack: args.stack,
+          region: args.region,
           componentStacks: args.componentStacks,
           baseline: baselineForLexicon(args.baseline, lexiconName),
         });
@@ -1181,6 +1194,9 @@ export async function runLifecyclePlan(ctx: CommandContext): Promise<number> {
         // The resolved read address rides every entry, not just unobserved
         // ones — the diff path already passes it (#1620); plan lost it.
         queried: observed.queried,
+      }, {
+        // Attribution survives the flat merge below (#1674).
+        lexicon: lexiconName,
       });
       merged.entries.push(...cs.entries);
       checked++;

package/src/cli/handlers/run.test.ts

@@ -101,7 +101,7 @@ function makeOp(name: string, depends: string[] = []): [string, { config: { name
 function setupTemporalClient(mock: ReturnType<typeof createMockTemporalClient>) {
   loadTemporalClientMock.mockResolvedValue({
     Connection: { connect: vi.fn(async () => ({})) },
-    Client: vi.fn(() => mock.client) as unknown as new () => unknown,
+    Client: vi.fn(function () { return mock.client; }) as unknown as new () => unknown,
   });
   loadChantConfigMock.mockResolvedValue({ config: {} });
   resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
@@ -951,9 +951,9 @@ describe("runOpComponents", () => {
       expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", expect.objectContaining({
         buildParams: [{ name: "tier", value: "light", source: "default" }],
       }));
-      // A parameter at its default collapses into the count line now; the
-      // provenance forwarded above is where its value is asserted.
-      expect(stderr.join("\n")).toContain("at their defaults");
+      // The echo is a one-line count (#1424); the provenance forwarded above
+      // is where the value is asserted.
+      expect(stderr.join("\n")).toContain("1 build parameter resolved (1 default)");
     });
 
     test("--param overrides a declared default and is threaded through to runComponents", async () => {
@@ -978,7 +978,7 @@ describe("runOpComponents", () => {
       expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", expect.objectContaining({
         buildParams: [{ name: "tier", value: "production", source: "cli" }],
       }));
-      expect(stderr.join("\n")).toContain("[param] tier");
+      expect(stderr.join("\n")).toContain("1 build parameter resolved (1 from cli)");
       vi.restoreAllMocks();
     });
 

package/src/cli/handlers/run.ts

@@ -714,6 +714,7 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
   const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: parseParamFlags(ctx.args.param),
     paramsFile: ctx.args.paramsFile,
+    verbose: ctx.args.verbose,
   });
   if (!paramsResolution.success) {
     for (const message of paramsResolution.errors) console.error(message);

package/src/cli/handlers/search-live.test.ts

@@ -0,0 +1,217 @@
+import { describe, test, expect, vi, beforeEach } from "vitest";
+import type { ParsedArgs } from "../registry";
+import { DECLARABLE_MARKER, type Declarable } from "../../declarable";
+import { createMockPlugin } from "../../../../test-utils/src/mock-plugin";
+
+// #1263 — `chant search --live` against an unreachable endpoint returned the
+// declared rows, exit 0, and a footer naming derived facts it never computed.
+// The observe layer already records a thrown read as NOT-OBSERVED
+// (`read-failed`, #1089); these tests pin that the handler carries it through
+// to the rows, the footer, stderr, and the exit code. `observeResources` is
+// real here so the plumbing from a throwing `describeResources` is exercised.
+
+const discoverMock = vi.fn();
+vi.mock("../../discovery/index", () => ({
+  discover: (...a: unknown[]) => discoverMock(...a),
+}));
+const loadPluginsMock = vi.fn();
+const resolveLexMock = vi.fn();
+vi.mock("../plugins", async () => {
+  const actual = await vi.importActual<typeof import("../plugins")>("../plugins");
+  return {
+    ...actual,
+    loadPlugins: (...a: unknown[]) => loadPluginsMock(...a),
+    resolveProjectLexicons: (...a: unknown[]) => resolveLexMock(...a),
+  };
+});
+const hasSnapshotMock = vi.fn((..._a: unknown[]) => Promise.resolve(false));
+vi.mock("../../lifecycle/replay", () => ({
+  replaySnapshots: vi.fn(),
+  hasSnapshot: (...a: unknown[]) => hasSnapshotMock(...a),
+}));
+const loadChantConfigMock = vi.fn();
+vi.mock("../../config", async () => {
+  const actual = await vi.importActual<typeof import("../../config")>("../../config");
+  return { ...actual, loadChantConfig: (...a: unknown[]) => loadChantConfigMock(...a) };
+});
+const buildResultMock = vi.fn();
+vi.mock("../../build", async () => {
+  const actual = await vi.importActual<typeof import("../../build")>("../../build");
+  return {
+    ...actual,
+    build: (...a: unknown[]) => Promise.resolve(buildResultMock(...a)),
+    buildProject: (...a: unknown[]) => Promise.resolve(buildResultMock(...a)),
+  };
+});
+
+const { runSearch } = await import("./search");
+
+function decl<T extends object>(base: T): Declarable & T {
+  return { [DECLARABLE_MARKER]: true, ...base } as Declarable & T;
+}
+
+function makeArgs(overrides: Partial<ParsedArgs> = {}): ParsedArgs {
+  return {
+    command: "search", path: "kind:Instance",
+    format: "", fix: false, watch: false, verbose: false, help: false, live: true, env: "dev",
+    ...overrides,
+  };
+}
+
+describe("search --live when the live read fails (#1263)", () => {
+  let out: string[];
+  let err: string[];
+  const entities = new Map<string, Declarable>([
+    ["webServer", decl({ lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} })],
+    ["privateServer", decl({ lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} })],
+  ]);
+
+  beforeEach(() => {
+    out = [];
+    err = [];
+    vi.spyOn(console, "log").mockImplementation((s: string) => { out.push(s); });
+    vi.spyOn(console, "error").mockImplementation((s: string) => { err.push(s); });
+    discoverMock.mockReset();
+    discoverMock.mockResolvedValue({ entities, errors: [], sourceFiles: [] });
+    buildResultMock.mockReset();
+    buildResultMock.mockReturnValue({ errors: [], entities, outputs: new Map([["aws", ""]]), warnings: [] });
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({ config: {} });
+    resolveLexMock.mockReset();
+    resolveLexMock.mockResolvedValue(["aws"]);
+    hasSnapshotMock.mockReset();
+    hasSnapshotMock.mockResolvedValue(false);
+  });
+
+  const deadEndpoint = createMockPlugin({
+    name: "aws",
+    describeResources: async () => {
+      throw new Error("connect ECONNREFUSED 127.0.0.1:9999");
+    },
+  });
+
+  test("exits non-zero, names the lexicon and cause, and marks every row unobserved", async () => {
+    loadPluginsMock.mockResolvedValue([deadEndpoint]);
+    const exit = await runSearch({ args: makeArgs(), plugins: [], serializers: [] });
+    expect(exit).toBe(1);
+    const stderr = err.join("\n");
+    expect(stderr).toContain("aws");
+    expect(stderr).toContain("ECONNREFUSED 127.0.0.1:9999");
+    expect(stderr).toContain("declared-only");
+    const stdout = out.join("\n");
+    expect(stdout).toContain("webServer  AWS::EC2::Instance  (unobserved: read-failed)");
+    expect(stdout).toContain("privateServer  AWS::EC2::Instance  (unobserved: read-failed)");
+    expect(stdout).toContain("live read failed (aws) · 2/2 rows unobserved");
+    // Nothing was read, so no fold over live topology could have run.
+    expect(stdout).not.toContain("also derived");
+  });
+
+  test("points at a recorded snapshot when one exists", async () => {
+    loadPluginsMock.mockResolvedValue([deadEndpoint]);
+    hasSnapshotMock.mockResolvedValue(true);
+    const exit = await runSearch({ args: makeArgs(), plugins: [], serializers: [] });
+    expect(exit).toBe(1);
+    expect(out.join("\n")).toContain("--at latest");
+    expect(err.join("\n")).toContain("--at latest");
+  });
+
+  test("a working live read still exits 0 with bound rows", async () => {
+    loadPluginsMock.mockResolvedValue([
+      createMockPlugin({
+        name: "aws",
+        describeResources: async () => ({
+          webServer: { type: "AWS::EC2::Instance", physicalId: "i-1", status: "OK", owned: true },
+          privateServer: { type: "AWS::EC2::Instance", physicalId: "i-2", status: "OK", owned: true },
+        }),
+      }),
+    ]);
+    const exit = await runSearch({ args: makeArgs(), plugins: [], serializers: [] });
+    expect(exit).toBe(0);
+    const stdout = out.join("\n");
+    expect(stdout).toContain("webServer  AWS::EC2::Instance  i-1");
+    expect(stdout).toContain("observed live · bound 2/2");
+    expect(err.join("\n")).not.toContain("live read failed");
+  });
+});
+
+// #1265 — a lexicon's run-level note ("ownership filter unavailable on this
+// path") printed once per stack, ahead of the rows. It is one fact about the
+// read, so it is said once, and it qualifies the answer, so it follows it.
+describe("search --live run-level notes (#1265)", () => {
+  const NOTE =
+    "ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export";
+  let out: string[];
+  let err: string[];
+  // One log of everything, in the order it was written, so the test can see
+  // whether the note came before or after the rows.
+  let all: string[];
+  const entities = new Map<string, Declarable>([
+    ["webServer", decl({ lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} })],
+    ["privateServer", decl({ lexicon: "aws", entityType: "AWS::EC2::Instance", props: {} })],
+  ]);
+  const calls: string[] = [];
+
+  beforeEach(() => {
+    out = [];
+    err = [];
+    all = [];
+    calls.length = 0;
+    vi.spyOn(console, "log").mockImplementation((s: string) => { out.push(s); all.push(s); });
+    vi.spyOn(console, "error").mockImplementation((s: string) => { err.push(s); all.push(s); });
+    vi.spyOn(console, "warn").mockImplementation((s: string) => { all.push(s); });
+    discoverMock.mockReset();
+    discoverMock.mockResolvedValue({ entities, errors: [], sourceFiles: [] });
+    buildResultMock.mockReset();
+    buildResultMock.mockReturnValue({ errors: [], entities, outputs: new Map([["aws", ""]]), warnings: [] });
+    loadChantConfigMock.mockReset();
+    loadChantConfigMock.mockResolvedValue({
+      config: { stacks: [{ name: "net" }, { name: "data" }, { name: "app" }, { name: "edge" }] },
+    });
+    resolveLexMock.mockReset();
+    resolveLexMock.mockResolvedValue(["aws"]);
+    hasSnapshotMock.mockReset();
+    hasSnapshotMock.mockResolvedValue(false);
+    loadPluginsMock.mockResolvedValue([
+      createMockPlugin({
+        name: "aws",
+        describeResources: async (opts: { stack?: string }) => {
+          calls.push(opts.stack ?? "");
+          return {
+            observation: "v1" as const,
+            resources: {
+              webServer: { type: "AWS::EC2::Instance", physicalId: "i-1", status: "OK", ownership: "unknown" as const },
+              privateServer: { type: "AWS::EC2::Instance", physicalId: "i-2", status: "OK", ownership: "unknown" as const },
+            },
+            notes: [NOTE],
+          };
+        },
+      }),
+    ]);
+  });
+
+  test("four stacks, one note, after the rows and the provenance line", async () => {
+    const exit = await runSearch({ args: makeArgs(), plugins: [], serializers: [] });
+    expect(exit).toBe(0);
+    expect(calls).toEqual(["net", "data", "app", "edge"]);
+    const notes = all.filter((line) => line.includes("ownership filter unavailable"));
+    expect(notes).toHaveLength(1);
+    expect(notes[0]).toContain(`[aws] ${NOTE}`);
+    const noteAt = all.findIndex((line) => line.includes("ownership filter unavailable"));
+    const lastRow = all.findIndex((line) => line.startsWith("privateServer  AWS::EC2::Instance  i-2"));
+    const footer = all.findIndex((line) => line.includes("observed live · bound 2/2"));
+    expect(lastRow).toBeGreaterThanOrEqual(0);
+    expect(footer).toBeGreaterThan(lastRow);
+    expect(noteAt).toBeGreaterThan(footer);
+    // stderr, like every other warning; the rows stay clean on stdout.
+    expect(out.join("\n")).not.toContain("ownership filter unavailable");
+    expect(err.join("\n")).toContain("ownership filter unavailable");
+  });
+
+  test("a miss still says the note, after the miss", async () => {
+    const exit = await runSearch({ args: makeArgs({ path: "kind:Nope" }), plugins: [], serializers: [] });
+    expect(exit).toBe(0);
+    const notes = all.filter((line) => line.includes("ownership filter unavailable"));
+    expect(notes).toHaveLength(1);
+    expect(all.indexOf("(no matches)")).toBeLessThan(all.findIndex((l) => l.includes("ownership filter unavailable")));
+  });
+});

package/src/cli/handlers/search.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect, vi } from "vitest";
 import { __searchInternals } from "./search";
 
-const { parseQuery, matchTerm, formatRow, explain, describeTerm, derivedSurface, availableAttrs, ambientHint, regionSpread, showMiss } = __searchInternals;
+const { parseQuery, matchTerm, formatRow, explain, describeTerm, derivedSurface, availableAttrs, ambientHint, regionSpread, showMiss, provenance } = __searchInternals;
 
 function node(id: string, kind: string, attrs: Record<string, unknown> = {}) {
   return { id, kind, lexicon: "aws", attrs } as never;
@@ -53,6 +53,13 @@ describe("search formatting", () => {
   test("compact row with live physical id, skipping object placeholders", () => {
     const live = node("webServer", "AWS::EC2::Instance", { physicalId: "i-abc" });
     expect(formatRow(live, [])).toBe("webServer  AWS::EC2::Instance  i-abc");
+  });
+
+  // #1263 — a row nobody could read printed blank where the physical id goes,
+  // which reads as "declared, not provisioned".
+  test("a row the live read could not observe says so in place of the physical id", () => {
+    const n = node("webServer", "AWS::EC2::Instance", { _status: "neutral", _unobserved: "read-failed" });
+    expect(formatRow(n, [])).toBe("webServer  AWS::EC2::Instance  (unobserved: read-failed)");
     const src = node("webServer", "AWS::EC2::Instance", { InstanceId: { $ref: "webServer.InstanceId" } });
     expect(formatRow(src, [])).toBe("webServer  AWS::EC2::Instance");
   });
@@ -353,3 +360,36 @@ describe("--show name matching", () => {
     expect(capture(() => showMiss([n] as never, ["Region"]))).toBe("");
   });
 });
+
+// #1263 — a `--live` read that failed entirely returned the declared rows with
+// the same footer as a working answer and exit 0.
+describe("provenance of a failed live read", () => {
+  const capture = (fn: () => void): string => {
+    const lines: string[] = [];
+    const spy = vi.spyOn(console, "log").mockImplementation((s: string) => { lines.push(s); });
+    fn();
+    spy.mockRestore();
+    return lines.join("\n");
+  };
+  const rows = [
+    node("a", "AWS::EC2::Instance", { _unobserved: "read-failed" }),
+    node("b", "AWS::EC2::Instance", { _unobserved: "read-failed" }),
+  ] as never;
+
+  test("names the lexicon and counts the unobserved rows", () => {
+    const out = capture(() => provenance(rows, { kind: "live" }, undefined, ["aws: connect ECONNREFUSED 127.0.0.1:9999"]));
+    expect(out).toContain("live read failed (aws)");
+    expect(out).toContain("2/2 rows unobserved");
+    expect(out).toContain("physical ids unavailable");
+  });
+
+  test("points at a recorded snapshot when one exists", () => {
+    const out = capture(() => provenance(rows, { kind: "live" }, "yes", ["aws: connect ECONNREFUSED"]));
+    expect(out).toContain("--at latest");
+  });
+
+  test("a working live read is unchanged", () => {
+    const bound = [{ id: "a", kind: "AWS::EC2::Instance", lexicon: "aws", attrs: {}, physicalId: "i-1" }] as never;
+    expect(capture(() => provenance(bound, { kind: "live" }))).toBe("— observed live · bound 1/1");
+  });
+});

package/src/cli/handlers/search.ts

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
 import { build } from "../../build";
-import { buildGraphIr, buildLiveGraphIr, sourceOverlayGraphs, type GraphIR, type IRNode, type IREdge } from "../../graph-ir";
+import { buildGraphIr, buildLiveGraphIr, collectUnobserved, sourceOverlayGraphs, type GraphIR, type IRNode, type IREdge } from "../../graph-ir";
 import { buildDeclaredPerStack } from "../../graph-declared";
 import { enrichEffectiveTopology } from "../../graph-effective";
 import { reconstructEdges, mergeCatalogs, type ReferenceCatalog } from "../../graph-refs";
@@ -61,6 +61,13 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
 
   let ir: GraphIR;
   let source: AnswerSource = { kind: "declared" };
+  // Lexicons whose live read threw (#1263). "Nothing observed" and "could not
+  // observe" are different claims; this is what carries the second one.
+  const liveFailures: string[] = [];
+  // Run-level notes from the read (#1265) — "ownership could not be filtered
+  // on this path" — printed with the provenance footer, after the rows, so the
+  // answer is not preceded by what qualifies it.
+  let liveNotes: string[] = [];
   // Kinds that can exist in the account without being declared (#1278). Known
   // without a scan, so it costs nothing to mention.
   let ambientKinds: string[] = [];
@@ -122,8 +129,15 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
         stacks,
         ambient: args.ambient === true,
       });
-      for (const e of observed.errors) console.error(formatWarning({ message: e }));
+      // A thrown read is not a warning. Printed as one, it sat between the
+      // ownership-filter notices that also print on a working run and carried
+      // no signal (#1263). Name the lexicon and the cause, as an error.
+      for (const e of observed.errors) {
+        liveFailures.push(e);
+        console.error(formatError({ message: `live read failed — ${e}` }));
+      }
       observations = observed.observations;
+      liveNotes = observed.notes ?? [];
       source = { kind: "live" };
     }
     let live = buildLiveGraphIr(observations);
@@ -189,7 +203,10 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
       stacks.length > 0
         ? await buildDeclaredPerStack(stacks, projectPath)
         : buildGraphIr((await discover(resolve(args.src ?? config.sourceDir ?? "."))).entities, projectPath);
-    ir = sourceOverlayGraphs(declared, live);
+    // Carry the NOT-OBSERVED half of the tri-state (#1089) onto the rows, so a
+    // declared entity nobody could read is painted `_unobserved` and a row can
+    // say so instead of printing blank where a physical id would go (#1263).
+    ir = sourceOverlayGraphs(declared, live, { unobserved: collectUnobserved(observations) });
     // Containment goes on AFTER the overlay, not through it.
     //
     // `sourceOverlayGraphs` admits a live edge only when one end is foreign,
@@ -242,6 +259,7 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
     console.log("(no matches)");
     availableAttrs(terms, ir);
     if (args.explain) explain(terms, matches, ir, nodeById, query);
+    for (const n of liveNotes) console.error(formatWarning({ message: n }));
     return 0;
   }
   for (const n of matches) {
@@ -254,12 +272,28 @@ export async function runSearch(ctx: CommandContext): Promise<number> {
     source.kind === "live" && !matches.some((n) => n.physicalId) && args.env
       ? (await hasSnapshot(String(args.env))) ? "yes" : undefined
       : undefined;
-  provenance(matches, source, recorded);
+  provenance(matches, source, recorded, liveFailures);
+  // Qualifies the provenance line, so it sits with it: one line per distinct
+  // note for the whole run, not one per stack, and after the rows (#1265).
+  for (const n of liveNotes) console.error(formatWarning({ message: n }));
   ambientHint(matches, ambientKinds, args.ambient === true, replayAmbient);
   showMiss(matches, show);
   regionSpread(terms, matches, show);
   derivedSurface(terms, matches, ir, backed);
   if (args.explain) explain(terms, matches, ir, nodeById, query);
+  // The caller asked for a live answer and at least one lexicon could not be
+  // read. The rows above are still printed — they are what the source declares,
+  // labelled as such — but the command did not do what it was asked, and a
+  // script or agent needs to see that without parsing the footer (#1263).
+  if (liveFailures.length > 0) {
+    console.error(formatError({
+      message: `live read failed for ${liveFailures.length} lexicon${liveFailures.length === 1 ? "" : "s"} — answer is declared-only`,
+      hint: recorded
+        ? "answer from the recorded snapshot with --at latest, or drop --live for a declared-only query"
+        : "drop --live for a declared-only query, or record a snapshot with chant lifecycle snapshot",
+    }));
+    return 1;
+  }
   return 0;
 }
 
@@ -379,13 +413,24 @@ function ambientHint(
  * already done. That is a fact about the query, printed for every query, and it
  * encodes no expected answer.
  */
-function provenance(matches: IRNode[], source: AnswerSource, recorded?: string): void {
+function provenance(matches: IRNode[], source: AnswerSource, recorded?: string, liveFailures: string[] = []): void {
   if (source.kind === "declared") {
     console.log("— declared only · no observation · physical ids unavailable");
     return;
   }
   const bound = matches.filter((n) => n.physicalId).length;
   const what = source.kind === "live" ? "live read" : "snapshot";
+  if (liveFailures.length > 0) {
+    // Could not observe, as distinct from observed nothing. The rows carry the
+    // per-entity verdict; this names the lexicons that failed in one line.
+    const lexicons = liveFailures.map((e) => e.split(":")[0]).join(", ");
+    const unobserved = matches.filter((n) => (n.attrs as Record<string, unknown> | undefined)?._unobserved).length;
+    const rest = recorded
+      ? "a snapshot of this environment is recorded — answer from it with --at latest"
+      : "answered from the declared graph · physical ids unavailable";
+    console.log(`— live read failed (${lexicons}) · ${unobserved}/${matches.length} rows unobserved · ${rest}`);
+    return;
+  }
   if (bound === 0) {
     // The estate was asked for and nothing came back bound. Naming it is the
     // difference between "these do not exist" and "nobody could see them".
@@ -742,6 +787,10 @@ function formatRow(n: IRNode, show: string[]): string {
   // skip source-mode AttrRef placeholders (objects).
   const physical = (n as { physicalId?: unknown }).physicalId ?? attrs["physicalId"] ?? attrs["InstanceId"] ?? attrs["Id"];
   if (physical != null && typeof physical !== "object") parts.push(String(physical));
+  // A row nobody could read says so where its physical id would go (#1263). A
+  // blank there reads as "declared, not provisioned", which the read never
+  // established; the reason is the tri-state's (#1089).
+  else if (typeof attrs["_unobserved"] === "string") parts.push(`(unobserved: ${attrs["_unobserved"]})`);
   for (const key of show) {
     // Match the name case-insensitively, and report what was actually found.
     // AWS attribute names are PascalCase and chant's derived ones are not, so a
@@ -763,4 +812,4 @@ function formatRow(n: IRNode, show: string[]): string {
 }
 
 /** Internals exposed for unit tests. */
-export const __searchInternals = { parseQuery, matchTerm, formatRow, explain, describeTerm, derivedSurface, availableAttrs, ambientHint, regionSpread, showMiss };
+export const __searchInternals = { parseQuery, matchTerm, formatRow, explain, describeTerm, derivedSurface, availableAttrs, ambientHint, regionSpread, showMiss, provenance };

package/src/cli/main.ts

@@ -542,7 +542,9 @@ Options:
   --fix                 Auto-fix fixable issues (lint command)
   --force               Force overwrite existing files (import command)
   -w, --watch           Watch for changes and rebuild/re-lint (build, lint)
-  -v, --verbose         Show stack traces on errors
+  -v, --verbose         Show stack traces on errors; (build) list every
+                        resolved build parameter and per-file fold decision
+                        instead of the one-line summaries
   -h, --help            Show this help message
   -p, --profile <name>  Temporal worker profile to use (run command)
   --local               Run an Op with the local in-process executor (default)
@@ -572,8 +574,8 @@ Options:
                         composite factory calls (#1022/#1023), falling back
                         to run per-file for anything else outside the fold
                         subset (a cross-file-only reference, a re-export,
-                        \`export default\`, ...). Logs which path each file
-                        took. DEFAULT since #1134 — this flag forces it on
+                        \`export default\`, ...). Logs a fold/run count
+                        (per-file lines under --verbose). DEFAULT since #1134 — this flag forces it on
                         over a chant.config.ts \`build.fold: false\`.
   --no-fold             (build) Opt out of folding for this invocation: every
                         source module is imported and run, the pre-#1134

package/src/cli/security-boundary.test.ts

@@ -99,7 +99,8 @@ describe("CLI end-to-end — resolveProjectLexicons must not execute project sou
   }
 
   test("`chant build --fold` on a project with no `lexicons` config does not execute the hostile file", () => {
-    const { status, stdout, stderr } = runCli(["build", testDir, "--fold"]);
+    // --verbose: the per-file fold decision lines are behind it (#1424).
+    const { status, stdout, stderr } = runCli(["build", testDir, "--fold", "--verbose"]);
 
     expect(stderr).not.toMatch(/EXFIL/);
     expect(stdout).not.toMatch(/EXFIL/);