@intentius/chant 0.57.0 → 0.59.0

package/dist/lifecycle/deep-diff.d.ts

@@ -20,8 +20,20 @@
  * {@link UNRESOLVED} — an unevaluated intrinsic (`Fn::Sub`, `Ref`) has no
  * source-side value to compare, and reporting one as drift would light up every
  * interpolated property forever.
+ *
+ * ## The claim decides what counts as drift (#2160)
+ *
+ * The declared tree is not only one side of a comparison, it is a statement of
+ * which fields chant ever set — the claimed-field set (../claimed-fields.ts).
+ * A live value on a path outside it is somebody else's field: an autoscaler's
+ * replica count, a controller's annotation, a value a person typed into a
+ * console. It is reported in {@link DeepDiffResult.unclaimed}, with the
+ * manager's name where the substrate records one, and it is not drift. Only a
+ * claimed path that moved is, and drift is the only thing that may become an
+ * update.
  */
 import { type DeepNormalizationHooks, type NormalizedDeepObservation } from "../deep-observation.js";
+import { type FieldClaimSource } from "../claimed-fields.js";
 import { type PathOrigin } from "../provenance.js";
 import type { UnobservedResource } from "./live-diff.js";
 import { type BaselineLexicon } from "./observation-baseline.js";
@@ -29,19 +41,29 @@ import { type BaselineLexicon } from "./observation-baseline.js";
  * How a property differs.
  *
  * - `changed` — declared and live both have the path, with different values.
- * - `undeclared` — live has it, source never did. cdk-real-drift's whole reason
- *   to exist: the console-added property CloudFormation itself will not report.
+ *   The only kind that may become an update.
  * - `absent` — source declares it and the live tree does not carry it. Weaker
- *   than the other two: a provider that omits a property it considers unset is
+ *   than `changed`: a provider that omits a property it considers unset is
  *   common, which is what the lexicon's pruning hook is for.
+ *
+ * A live value on a path source never declared used to be a third kind,
+ * `undeclared`. It is no longer drift at all (#2160): chant never set that
+ * field, so somebody else holds it, and it is reported in
+ * {@link DeepDiffResult.unclaimed} instead. It is still reported — pruning
+ * what chant cannot attribute is how #1191 lost a console-added label — it just
+ * stopped being a difference chant proposes to close.
  */
-export type PropertyDriftKind = "changed" | "undeclared" | "absent";
+export type PropertyDriftKind = "changed" | "absent";
 /** One property-level difference. */
 export interface PropertyDrift {
     /** Path within the normalized property tree (`Tags[0].Value`). */
     path: string;
     kind: PropertyDriftKind;
-    /** Value in source. Absent for `undeclared`. */
+    /**
+     * Value in source. Always present since #2160 — a drift row is only ever
+     * raised for a path the declaration claims — and kept optional for the wire
+     * shape consumers already branch on.
+     */
     declared?: unknown;
     /** Value in the cloud. Absent for `absent`. */
     live?: unknown;
@@ -55,7 +77,8 @@ export interface PropertyDrift {
      * The field manager that owns this path live, where the substrate records one
      * (#1189) — Kubernetes' `managedFields`, and nowhere else today.
      *
-     * `kind` says a path is `undeclared` or `changed`; this says who did it.
+     * `kind` says whether a claimed path changed or went missing; this says who
+     * holds it live.
      * "Owned by `kubectl-client-side-apply`" and "owned by `hpa-controller`" are
      * the same `kind` and mean opposite things: one is somebody bypassing the
      * pipeline, the other is a controller doing its job. Absent on a substrate
@@ -81,6 +104,72 @@ export interface DeepEntityDrift {
     type: string;
     changes: PropertyDrift[];
 }
+/**
+ * One live property value on a path this declaration never claimed (#2160) —
+ * a field that exists and that chant did not set.
+ *
+ * Reported, never proposed. The interesting column is {@link source}: on
+ * Kubernetes the API server names the manager and this row says
+ * `hpa-controller`; everywhere else the declaration is the only witness and the
+ * row says "not mine" without saying whose.
+ */
+export interface PropertyUnclaimed {
+    /** Path within the normalized property tree (`spec.replicas`). */
+    path: string;
+    /** The value the cloud is carrying. */
+    live: unknown;
+    /**
+     * The field manager holding it, where the substrate records one. Absent on
+     * every substrate but Kubernetes, and absent on Kubernetes for a path no
+     * `managedFields` entry covers.
+     */
+    heldBy?: string;
+    /** Which source answered: the substrate's manager, or the claimed-field set. */
+    source: FieldClaimSource;
+    /**
+     * The accepted value from the baseline, when this path has one. An unclaimed
+     * field needs no acceptance to stay quiet, so this is carried for continuity with
+     * baselines recorded before #2160 rather than because it changes anything.
+     */
+    baseline?: unknown;
+}
+/** Live property values one declared entity is not claiming. */
+export interface DeepEntityUnclaimed {
+    name: string;
+    type: string;
+    fields: PropertyUnclaimed[];
+}
+/**
+ * One property declared `heldElsewhere()` (#2162) — a fact about who owns the
+ * field at runtime, reported beside drift rather than folded into it. Never a
+ * {@link PropertyDrift}: a held property is never `changed`, `undeclared`, or
+ * `absent`, and is never proposed for update.
+ */
+export interface PropertyHeld {
+    /** Path within the normalized property tree, same addressing as {@link PropertyDrift.path}. */
+    path: string;
+    /** Who holds it — the marker's `by`. */
+    by: string;
+    /** Why chant does not reconcile it — the marker's `reason`. */
+    reason: string;
+    /** The live value, when the deep read found one at this path. */
+    live?: unknown;
+    /**
+     * True when this path carried no live value at all — the deep read found
+     * nothing here, not even a provider default. A declared hand-over with no
+     * evidence anything was ever written is itself worth a look: either the
+     * holder never ran, or this is not the field it actually writes.
+     */
+    suspicious: boolean;
+    /** The field manager that owns this path live, where the substrate records one (#1189). See {@link PropertyDrift.owner}. */
+    owner?: string;
+}
+/** Held properties (#2162) for one declared entity. */
+export interface DeepEntityHeld {
+    name: string;
+    type: string;
+    held: PropertyHeld[];
+}
 export interface DeepDiffResult {
     /** Entities with at least one reportable property difference. Sorted by name. */
     drifted: DeepEntityDrift[];
@@ -90,6 +179,28 @@ export interface DeepDiffResult {
      * being held back and the count never silently changes meaning.
      */
     accepted: DeepEntityDrift[];
+    /**
+     * Live values on paths nobody declared (#2160), per entity. Sorted by name.
+     *
+     * Not drift, and deliberately a sibling of `drifted` rather than a kind
+     * inside it: `countPropertyDrift` does not see this list, `--update-baseline`
+     * does not record it, and nothing downstream may turn one of these into an
+     * update. It exists so the report can still say the field is there and who
+     * has it.
+     *
+     * Not `held`, which is the opposite fact: `held` is a field source declared
+     * and then handed over with `heldElsewhere()`, and this is a field source
+     * never declared at all.
+     */
+    unclaimed: DeepEntityUnclaimed[];
+    /**
+     * Properties declared `heldElsewhere()` (#2162) — reported here instead of
+     * in `drifted`/`accepted`, whatever the live value is. Not a suppression:
+     * every held property is listed, with its holder and reason, so a reader of
+     * the plan sees which fields are not being managed and by whom. Sorted by
+     * name.
+     */
+    held: DeepEntityHeld[];
     /** Entities whose property trees matched. Sorted. */
     unchanged: string[];
     /** Declared entities whose *properties* could not be read (#1089). Sorted. */
@@ -129,4 +240,20 @@ export interface DiffDeepInput {
 export declare function diffDeep(input: DiffDeepInput): DeepDiffResult;
 /** Total reported property differences across every entity. */
 export declare function countPropertyDrift(result: DeepDiffResult): number;
+/** Total live values on paths no declaration claimed, across every entity (#2160). Never added to the drift count. */
+export declare function countUnclaimed(result: DeepDiffResult): number;
+/** Total held properties (#2162) across every entity. */
+export declare function countHeld(result: DeepDiffResult): number;
+/** One held property flagged suspicious (#2162), with its entity attached. */
+export interface SuspiciousHeld extends PropertyHeld {
+    name: string;
+    type: string;
+}
+/**
+ * Every held property whose declaration looks like a hand-over that never
+ * happened — no live value ever showed up for it. Worth a look: either the
+ * named holder never ran, or this is not the field it actually writes.
+ * Sorted by entity name, then path.
+ */
+export declare function suspiciousHeld(result: DeepDiffResult): SuspiciousHeld[];
 //# sourceMappingURL=deep-diff.d.ts.map

package/dist/lifecycle/deep-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEpE,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,qDAAqD;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAwG7D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEjE"}
+{"version":3,"file":"deep-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA6C,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErG,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,qDAAqD;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,IAAI,EAAE,yBAAyB,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CA+J7D;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEjE;AAED,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAE7D;AAED,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAQvE"}

package/dist/lifecycle/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAIL,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAChC,MAAM,EACN;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAE,CACjG,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;4CAEwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,CAAC,yBAAyB,CAAC,GACzC,yBAAyB,CAS3B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA+BpC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,yBAAyB,EAC/B,KAAK,CAAC,EAAE,sBAAsB,EAC9B,QAAQ,CAAC,EAAE,eAAe,GACzB,cAAc,CAoDhB;AAED,oFAAoF;AACpF,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,kBAAkB,GAAG;IAAE,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GACxD,OAAO,CAAC,cAAc,CAAC,CAGzB"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../../src/lifecycle/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAIL,KAAK,sBAAsB,EAE3B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAChC,MAAM,EACN;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAE,CACjG,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;4CAEwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,QAAQ,CAAC,yBAAyB,CAAC,GACzC,yBAAyB,CAS3B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA+BpC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,yBAAyB,EAC/B,KAAK,CAAC,EAAE,sBAAsB,EAC9B,QAAQ,CAAC,EAAE,eAAe,GACzB,cAAc,CA6DhB;AAED,oFAAoF;AACpF,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,kBAAkB,GAAG;IAAE,QAAQ,CAAC,EAAE,eAAe,CAAA;CAAE,GACxD,OAAO,CAAC,cAAc,CAAC,CAGzB"}

package/dist/lifecycle/gate-ledger.d.ts

@@ -33,11 +33,13 @@ export declare function isApprovalUrl(raw: string): boolean;
 export interface GateResolutionRecord {
     /** Schema version, so an incompatible future shape is detected before being misread. */
     version: 1;
+    /** Discriminator against {@link PendingGateRecord}, which shares this file. Absent on every line written before #2119, so a reader must treat "no kind" as `"resolution"`. */
+    kind?: "resolution";
     /** The dispatched op the gate belongs to. */
     op: string;
     /** The gate's signal name (matches `ConvergeRuleOutcome.gateName`). */
     gate: string;
-    /** Who resolved it — an actor name, the same convention `components release --actor` and `run signal --approver` use. */
+    /** Who resolved it — an actor name, the same convention `components release --actor` and `run approve --approver` use. */
     resolvedBy: string;
     /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
     timestamp: string;
@@ -55,7 +57,54 @@ export interface GateResolutionRecord {
      */
     url?: string;
 }
-export type GateResolutionInput = Omit<GateResolutionRecord, "version">;
+export type GateResolutionInput = Omit<GateResolutionRecord, "version" | "kind">;
+/**
+ * One immutable pending-gate record (#2119) — what an executor writes when a
+ * run reaches a `gate` step with no resolution standing against it. The run
+ * ends here with status `gated`; this line is the durable trace of that, and
+ * the anchor a later {@link GateResolutionRecord} has to be newer than to
+ * count as its answer.
+ *
+ * Idempotent by design: a run that finds a live (unexpired) pending fact for
+ * the same gate reuses it rather than appending a second one, so a converge
+ * loop ticking every minute against an unapproved gate does not grow the
+ * ledger by a line a minute. Once `expiresAt` passes, the fact is stale and
+ * the next run records a fresh one.
+ */
+export interface PendingGateRecord {
+    /** Schema version, so an incompatible future shape is detected before being misread. */
+    version: 1;
+    kind: "pending";
+    /** The op (or, on the component driver, the component) the gate belongs to. */
+    op: string;
+    /** The gate's name (matches `GateStep.gate`). */
+    gate: string;
+    /** The gate's human-readable description, when it declared one — what `chant operator status` shows a reader who wasn't there for the run. */
+    description?: string;
+    /** The run that reached the gate, when the caller identifies its runs. */
+    runId?: string;
+    /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
+    timestamp: string;
+    /** ISO-8601 expiry, from the gate's `timeout` (default {@link DEFAULT_GATE_EXPIRY}). Past it, the fact is stale and a run re-records it. */
+    expiresAt: string;
+    /** The address approval happens at, when the run knew one — see {@link resolveApprovalUrl}. */
+    url?: string;
+}
+export type PendingGateInput = Omit<PendingGateRecord, "version" | "kind">;
+/** Either kind of line in `_gates/<op>.jsonl`. */
+export type GateLedgerRecord = GateResolutionRecord | PendingGateRecord;
+/** The default a gate's pending fact expires after when its `GateStep` declares no `timeout` — the same 48h `GateStep.timeout` documents as its own default. */
+export declare const DEFAULT_GATE_EXPIRY = "48h";
+/** Whether a pending fact has aged out of relevance at `nowIso`. */
+export declare function isPendingGateExpired(record: PendingGateRecord, nowIso: string): boolean;
+/**
+ * Where an Op's gate ledger lives, as a path a human can go and read:
+ * `_gates/<op>.jsonl` on the `chant/lifecycle` orphan branch. Exported so a
+ * renderer that tells someone a gate is pending can name the file the pending
+ * fact was appended to (#2243) rather than describing it in prose that drifts
+ * from `DIR`.
+ */
+export declare function gateLedgerPath(op: string): string;
 /** Append one immutable gate-resolution record. Does not push to the remote — call `pushLifecycle` (./git.ts) afterward, same two-step shape every other ledger write here uses. Retries on `RefCASConflictError` the same way `appendConvergeRecord` does (./converge-ledger.ts) — a concurrent writer to a different op's/env's file on the same orphan branch is the ordinary case, not an edge case. The baseline read must be `readPathSha` + `readBlobBySha` rather than `readBlobFromPath`, so the exact sha `existing` came from can be passed as `expectPriorPathSha` — see `writeBlobToPath` (./git.ts) for the race that closes. */
 export declare function appendGateResolution(input: GateResolutionInput, opts?: {
     cwd?: string;
@@ -63,13 +112,40 @@ export declare function appendGateResolution(input: GateResolutionInput, opts?:
     commit: string;
     record: GateResolutionRecord;
 }>;
-/** Read every gate-resolution record for `op`, oldest first. Malformed lines are skipped, not thrown on, the same graceful-degradation stance `readConvergeLedger` takes. Returns `[]` (never throws) when `op` has no resolutions recorded yet. */
+/**
+ * Append one immutable pending-gate record (#2119) — the fact a run leaves
+ * behind when it reaches a gate nobody has approved. Same file, same
+ * append-and-retry discipline, same "does not push" contract as
+ * {@link appendGateResolution}.
+ */
+export declare function appendPendingGate(input: PendingGateInput, opts?: {
+    cwd?: string;
+}): Promise<{
+    commit: string;
+    record: PendingGateRecord;
+}>;
+/**
+ * Read every line of `op`'s gate file, oldest first, split into the two kinds
+ * (#2119). Malformed lines are skipped and counted, not thrown on — the same
+ * graceful-degradation stance `readConvergeLedger` takes. Returns empty arrays
+ * (never throws) when `op` has nothing recorded yet.
+ */
+export declare function readGateLedger(op: string, opts?: {
+    cwd?: string;
+}): Promise<{
+    resolutions: GateResolutionRecord[];
+    pending: PendingGateRecord[];
+    malformed: number;
+}>;
+/** Read every gate-*resolution* record for `op`, oldest first — {@link readGateLedger} narrowed to the half every caller before #2119 wanted. Pending facts are not malformed lines and are not counted as such. */
 export declare function readGateResolutions(op: string, opts?: {
     cwd?: string;
 }): Promise<{
     records: GateResolutionRecord[];
     malformed: number;
 }>;
+/** The most recent pending fact for `gate`, expired or not — the anchor {@link latestResolutionSince} measures a resolution against. `undefined` when the gate has never been recorded pending. */
+export declare function latestPendingGate(records: PendingGateRecord[], gate: string): PendingGateRecord | undefined;
 /** The most recent resolution for `gate` recorded after `sinceIso` (a gated tick's own timestamp) — what `chant operator status` uses to tell a resolved gate from a still-pending one. `undefined` when no such resolution exists. */
 export declare function latestResolutionSince(records: GateResolutionRecord[], gate: string, sinceIso: string): GateResolutionRecord | undefined;
 //# sourceMappingURL=gate-ledger.d.ts.map

package/dist/lifecycle/gate-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA0CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,8KAA8K;IAC9K,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0HAA0H;IAC1H,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,8IAA8I;IAC9I,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAE3E,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAExE,gKAAgK;AAChK,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEvF;AAMD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAI3D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAIxD;AA2BD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCnG;AAED,oNAAoN;AACpN,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGjE;AAED,mMAAmM;AACnM,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAO/B;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/lifecycle/index.d.ts

@@ -20,6 +20,7 @@ export * from "./teardown.js";
 export * from "./assert-live.js";
 export * from "./symptoms.js";
 export * from "./converge-ledger.js";
+export * from "./run-ledger.js";
 export * from "./scenario.js";
 export * from "./scenario-eval.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lifecycle/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lifecycle/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/lifecycle/release-ledger.d.ts

@@ -93,8 +93,8 @@ export interface ReleaseRecord {
     /**
      * Who approved the change at its durable approval gate (#1035). Populated for
      * a gated change — the same identity the approver supplied when they cleared
-     * the Temporal gate (`chant run signal ... --approver`, carried in the gate
-     * signal payload and thus the workflow history). Optional and omitted for an
+     * the gate (`chant approve <op> <gate> --approver`, recorded on the gate
+     * resolution fact). Optional and omitted for an
      * ungated change (nothing to approve), so `actor` alone answers "who made
      * it" while `approver` answers "who approved it" only where a gate exists.
      * Distinct from `actor`: the approver is deliberately a different person than

package/dist/lifecycle/run-ledger.d.ts

@@ -0,0 +1,53 @@
+import type { OpConfig } from "../op/types.js";
+import type { StepRecord } from "../op/local-executor.js";
+import type { OpRunRecord, OpRunRecordInput } from "../op/runtime.js";
+/** The env a run records against when its Op declares no `labels.Env`. */
+export declare const DEFAULT_RUN_ENV = "local";
+/** The env a run records against: the Op's own `labels.Env`, else {@link DEFAULT_RUN_ENV}. */
+export declare function runEnvOf(config: Pick<OpConfig, "labels">): string;
+/**
+ * Fold a run's step records into the ledger shape, pure — no clock, no git.
+ * `started`/`ended` are supplied by the caller for the same reason
+ * `ConvergeTickRecord.timestamp` is: library code here never calls
+ * `Date.now()` itself.
+ *
+ * Phases are grouped by `StepRecord.phase` in first-seen order, which is
+ * execution order for the sequential path and the authored order for a
+ * parallel one. A compensation (`onFailure`) phase appears after the phase
+ * that failed, exactly where the executor emitted its records.
+ */
+export declare function buildRunRecord(config: Pick<OpConfig, "name" | "labels">, records: readonly StepRecord[], times: {
+    started: string;
+    ended: string;
+    status: OpRunRecord["status"];
+    id?: string;
+    gate?: OpRunRecord["gate"];
+}): OpRunRecordInput;
+/**
+ * Append one immutable run record. Does not push to the remote — call
+ * `pushLifecycle` (./git.ts) afterward, the two-step shape every ledger here
+ * uses.
+ *
+ * Mints `record.id` when the input carries none, and retries the whole
+ * read-modify-write on `RefCASConflictError` re-reading fresh each attempt —
+ * see `appendConvergeRecord`'s doc for why both of those live in the append
+ * function rather than in its callers.
+ */
+export declare function appendRunRecord(input: OpRunRecordInput, opts?: {
+    cwd?: string;
+}): Promise<{
+    commit: string;
+    record: OpRunRecord;
+}>;
+/**
+ * Read every run record for `op` in `environment`, oldest first. Malformed
+ * lines are skipped and counted, never thrown on — a hand-edited or truncated
+ * ledger degrades to a shorter history, the stance every ledger here takes.
+ */
+export declare function readRunLedger(environment: string, op: string, opts?: {
+    cwd?: string;
+}): Promise<{
+    records: OpRunRecord[];
+    malformed: number;
+}>;
+//# sourceMappingURL=run-ledger.d.ts.map

package/dist/lifecycle/run-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5B,GACA,gBAAgB,CAoClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}

package/dist/lifecycle/symptoms.d.ts

@@ -8,8 +8,8 @@
  * `LexiconPlugin.symptoms?()` interface in v1 — everything here is a pure
  * projection of structures chant already computes (`ChangeSet`,
  * `ComponentStatusRow[]`). No I/O in this module; a caller (the `convergeTick`
- * activity, lexicons/temporal/src/op/activities/converge.ts) gathers those
- * inputs and hands them here.
+ * activity, ../op/activities/converge.ts) gathers those inputs and hands them
+ * here.
  *
  * One record per tick, not per component: the issue's own rule sketch reads
  * `s.status`/`s.backupVerifiedAge` as a single symptom `s` a rule closes
@@ -58,6 +58,6 @@ export interface ConvergeSymptom {
  * `ConvergeSymptom`. Pure — no I/O.
  */
 export declare function deriveSymptoms(env: string, cs: ChangeSet, statusRows: ComponentStatusRow[]): ConvergeSymptom;
-/** Every field name a `ConvergeSymptom` produces — the runtime whitelist `TMP014` (lexicons/temporal) re-validates a serialized rule table's predicates against. Kept in sync with {@link ConvergeSymptom} by hand (deliberately small, changes rarely). */
+/** Every field name a `ConvergeSymptom` produces — the runtime whitelist `OPS014` (packages/core/src/lint/rules/op/ops014-converge-rule-refusals.ts) re-validates a serialized rule table's predicates against. Kept in sync with {@link ConvergeSymptom} by hand (deliberately small, changes rarely). */
 export declare const CONVERGE_SYMPTOM_FIELDS: ReadonlySet<string>;
 //# sourceMappingURL=symptoms.d.ts.map

package/dist/lifecycle/symptoms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symptoms.d.ts","sourceRoot":"","sources":["../../src/lifecycle/symptoms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkB7E,qKAAqK;AACrK,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gHAAgH;IAChH,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,wIAAwI;IACxI,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wLAAwL;IACxL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAwB5G;AAED,4PAA4P;AAC5P,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAatD,CAAC"}
+{"version":3,"file":"symptoms.d.ts","sourceRoot":"","sources":["../../src/lifecycle/symptoms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkB7E,qKAAqK;AACrK,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gHAAgH;IAChH,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,wIAAwI;IACxI,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wLAAwL;IACxL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAwB5G;AAED,2SAA2S;AAC3S,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAatD,CAAC"}

package/dist/lint/config.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { Severity, RuleConfig } from "./rule.js";
 import type { PostSynthDiagnostic } from "./post-synth.js";
+import { type RuleMeta } from "../audit/catalog.js";
 export { findProjectRoot } from "../project-root.js";
 export declare const LintConfigSchema: z.ZodObject<{
     rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
@@ -31,6 +32,7 @@ export declare const LintConfigSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     plugins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     policies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 /**
  * Per-file rule override
@@ -61,6 +63,23 @@ export interface LintConfig {
      * phase; same engine.
      */
     policies?: string[];
+    /**
+     * Lexicon name mapped to a preset name (chant #2113), e.g.
+     * `{ terraform: "recommended" }`. A preset is a lexicon's own bundle of
+     * post-synth check ids. tflint ships `recommended` (a subset) and `all`
+     * for its Terraform-language rules the same way, and a lexicon that ships
+     * one exposes it through its plugin's `lintPresets()` (`../lexicon.ts`).
+     * Naming a preset here changes which of that lexicon's post-synth findings
+     * are reported at all, distinct from `rules`, which changes an
+     * already-reported finding's severity. A rule a preset excludes is not
+     * suppressed (it never runs the severity-override gauntlet in the first
+     * place), but an explicit `rules` entry for it always wins and re-enables
+     * it regardless of the active preset, see `resolvePresetIds`/
+     * `applyConfiguredPreset` below. Unset, or naming a preset the lexicon
+     * does not export, falls back to `"recommended"`. A lexicon that ships no
+     * presets at all is unaffected by this field, same as today.
+     */
+    presets?: Record<string, string>;
 }
 /**
  * Parsed rule configuration with severity and optional options
@@ -96,8 +115,17 @@ export declare function parseRuleConfig(value: RuleConfig): ParsedRuleConfig;
  * checks have no per-file scope to begin with (see {@link
  * ./post-synth.ts!PostSynthDiagnostic}'s doc for why), so they always pass
  * `config.rules` directly.
+ *
+ * `catalog` (chant #2113) is optional and off by default: pass a resolved
+ * audit catalog to also honor a `rules` key that names one of `id`'s
+ * `RuleMeta.aliases` rather than `id` itself. A project's
+ * `lint.rules: { OLD_ID: "off" }` then keeps suppressing the rule after it
+ * is renamed/renumbered, instead of silently starting to match nothing. Every
+ * existing call site omits `catalog` and is unaffected; a caller that has one
+ * handy (an audit-shaped consumer, not `chant build`'s post-synth loop, which
+ * has no catalog readily resolved at that point) opts in by passing it.
  */
-export declare function resolveConfiguredSeverity(rules: Record<string, RuleConfig> | undefined, id: string, defaultSeverity: Severity): ParsedRuleConfig;
+export declare function resolveConfiguredSeverity(rules: Record<string, RuleConfig> | undefined, id: string, defaultSeverity: Severity, catalog?: Record<string, RuleMeta>): ParsedRuleConfig;
 /**
  * Default configuration with all rules enabled at strict preset severities
  */
@@ -182,6 +210,57 @@ export interface PostSynthSeverityResult {
  * remove. Config severity (`"off"`) is the one suppression surface this can
  * offer uniformly; a check that wants a per-instance escape hatch can read
  * `ctx.env`/its own options to decide not to emit a diagnostic at all.
+ *
+ * chant #2111 adds a second, narrower surface next to this one:
+ * `./suppressions.ts`'s `applyInlineSuppressions` matches `diag.entity`
+ * against `ctx.entities` (a source-level map key every `PostSynthContext`
+ * carries) instead of a name in the synthesized output, so it sidesteps the
+ * exact mismatch this comment describes. It is opt-in per lexicon (an entity
+ * has to carry a `suppressions` field) and runs as its own pass, right after
+ * this one, in both `chant build` and `chant audit`. See that module's doc
+ * for the full reasoning.
+ *
+ * `catalog` (chant #2113, optional) passes straight through to
+ * `resolveConfiguredSeverity` above for alias resolution; see its doc for
+ * what that buys and why it's opt-in.
+ */
+export declare function applyConfiguredSeverity(diagnostics: readonly PostSynthDiagnostic[], rules: Record<string, RuleConfig> | undefined, catalog?: Record<string, RuleMeta>): PostSynthSeverityResult;
+/**
+ * Result of applying a lexicon preset to a set of post-synth diagnostics.
+ * Shaped like {@link PostSynthSeverityResult} so a caller threading both
+ * through (a preset filter, then a severity override) handles them the same
+ * way. See `applyConfiguredPreset` below.
+ */
+export interface PostSynthPresetResult {
+    /** Diagnostics whose check id the active preset enables (or that `rules` explicitly configures, see below). */
+    diagnostics: PostSynthDiagnostic[];
+    /** Diagnostics the active preset excluded, unaltered. Countable rather than silently dropped, mirroring `PostSynthSeverityResult.suppressed`. */
+    suppressed: PostSynthDiagnostic[];
+}
+/**
+ * Resolve `lint.presets`' name for one lexicon into the set of check ids that
+ * preset enables (chant #2113). `presets` is what a lexicon plugin's
+ * `lintPresets()` returns (`../lexicon.ts`). A lexicon that ships none
+ * passes `undefined` here, in which case this returns `undefined` and
+ * `applyConfiguredPreset` below becomes a no-op (every rule reports, exactly
+ * today's behavior for a lexicon this feature doesn't touch).
+ *
+ * An unrecognized preset name (a typo, or a name the lexicon doesn't define)
+ * also returns `undefined` rather than an empty set. Falling back to
+ * unfiltered is the safe failure direction; silently reporting nothing would
+ * not be.
+ */
+export declare function resolvePresetIds(presets: Record<string, string[]> | undefined, presetName: string): Set<string> | undefined;
+/**
+ * Filter post-synth diagnostics down to an active preset's ids (chant
+ * #2113). `presetIds` is `resolvePresetIds`'s output. `undefined` disables
+ * filtering entirely (a lexicon with no presets, or an unresolved preset
+ * name), matching tflint's own precedence chain (`--only` / rule config,
+ * then preset, then `disabled_by_default`, `tflint-ruleset-terraform`'s
+ * config docs): an explicit `lint.rules` entry for a check id always keeps
+ * that id's findings, whether or not the active preset includes it, so a
+ * project can opt a single report-only rule back in under `recommended`
+ * without switching its whole lexicon to `all`.
  */
-export declare function applyConfiguredSeverity(diagnostics: readonly PostSynthDiagnostic[], rules: Record<string, RuleConfig> | undefined): PostSynthSeverityResult;
+export declare function applyConfiguredPreset(diagnostics: readonly PostSynthDiagnostic[], presetIds: Set<string> | undefined, rules: Record<string, RuleConfig> | undefined): PostSynthPresetResult;
 //# sourceMappingURL=config.d.ts.map

package/dist/lint/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AASxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,QAAQ,GACxB,gBAAgB,CAIlB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,GAC5C,uBAAuB,CAczB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAQlE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,QAAQ,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GACjC,gBAAgB,CASlB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GACjC,uBAAuB,CAczB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,+GAA+G;IAC/G,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,iJAAiJ;IACjJ,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,EAC7C,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAGzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,GAC5C,qBAAqB,CAUvB"}