@neat.is/core 0.9.13-dev.20260901 → 0.9.13

package/dist/index.cjs

@@ -1945,6 +1945,11 @@ function isSaturated(ctx) {
 function isBoundaryTimeoutSymptom(ctx) {
   return ctx.errorsEmittedHere > 0 && ctx.boundaryTimeout === true && ctx.errorsFromCallers === 0 && ctx.hasOutboundDeps === true && ctx.observedErroringDownstream !== true;
 }
+var UNREACHABLE_INBOUND_ERROR_RATE = 0.5;
+var UNREACHABLE_MIN_INBOUND = 3;
+function isUnreachableSeed(ctx) {
+  return ctx.callCount >= UNREACHABLE_MIN_INBOUND && ctx.errorsFromCallers > 0 && ctx.errorsFromCallers >= UNREACHABLE_INBOUND_ERROR_RATE * ctx.callCount && ctx.errorsEmittedHere === 0 && ctx.outboundVolume === 0;
+}
 function classifyNode(ctx) {
   if (ctx.errorsEmittedHere > 0) {
     if ((ctx.stale || isSaturated(ctx)) && ctx.errorsFromCallers >= ctx.errorsEmittedHere) {
@@ -1953,6 +1958,7 @@ function classifyNode(ctx) {
     if (isBoundaryTimeoutSymptom(ctx)) return "symptom-only";
     return "primary-failure";
   }
+  if (isUnreachableSeed(ctx)) return "unreachable";
   if (ctx.errorsFromCallers > 0) return "symptom-only";
   return "unrelated";
 }
@@ -2239,6 +2245,16 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
       confidence: Math.min(legacy.confidence, 0.4),
       ...lastProv ? { provenance: lastProv } : {}
     });
+  } else if (seedCtx && isUnreachableSeed(seedCtx)) {
+    const name = displayNameOf(seedNode);
+    candidates.push({
+      node: seedNode,
+      classification: "unreachable",
+      reason: `${name} is unreachable: its callers' requests fail (${seedCtx.errorsFromCallers} erroring inbound calls) and it produced no telemetry of its own \u2014 no server spans, no outbound calls \u2014 so it never served. The failure is observed, but its cause is not in the trace: a startup failure, a crash before the first span, or an unschedulable / unhealthy pod. Inspect ${name}'s deploy state and logs \u2014 there is no code fault to find in the graph here.`,
+      context: seedCtx,
+      confidence: legacy.confidence,
+      provenance: import_types.Provenance.OBSERVED
+    });
   } else if (seedCtx && isBoundaryTimeoutSymptom(seedCtx)) {
     const pointer = structuralUpstreamPointer(graph, seedNode, incidents);
     const seedName = displayNameOf(seedNode);
@@ -6286,6 +6302,14 @@ function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
 function mergeObservedColumns(graph, tableNodeId, columns) {
   mergeColumnsAt(graph, tableNodeId, columns, import_types8.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
 }
+function mergeObservedDeployState(graph, serviceNodeId, state) {
+  if (!graph.hasNode(serviceNodeId)) return;
+  const attrs = {};
+  if (typeof state.image === "string" && state.image.length > 0) attrs["observedImage"] = state.image;
+  if (typeof state.readyReplicas === "number") attrs["observedReadyReplicas"] = state.readyReplicas;
+  if (Object.keys(attrs).length === 0) return;
+  graph.mergeNodeAttributes(serviceNodeId, attrs);
+}
 function ensureDatabaseNode(graph, host, engine) {
   const id = (0, import_types8.databaseId)(host);
   if (graph.hasNode(id)) return id;
@@ -16956,6 +16980,25 @@ function detectColumnDrift(node) {
   }
   return out;
 }
+var RECOMMENDATION_DEPLOY_IMAGE_MISMATCH = "The running image differs from the manifest-declared image \u2014 the rollout has not taken (the old ReplicaSet is still serving). Re-apply the deployment or investigate why the new image failed to roll out.";
+var DEPLOY_DIVERGENCE_CONFIDENCE = 0.9;
+function detectDeployDivergence(svc) {
+  const out = [];
+  if (typeof svc.declaredImage === "string" && typeof svc.observedImage === "string" && svc.declaredImage !== svc.observedImage) {
+    out.push({
+      type: "deploy-mismatch",
+      kind: "image",
+      source: svc.id,
+      target: svc.id,
+      declaredImage: svc.declaredImage,
+      observedImage: svc.observedImage,
+      confidence: DEPLOY_DIVERGENCE_CONFIDENCE,
+      reason: `Service ${svc.name} declares image ${svc.declaredImage} but its running pods report ${svc.observedImage} \u2014 the deploy has not taken (the old version is still serving), so no incident fires.`,
+      recommendation: RECOMMENDATION_DEPLOY_IMAGE_MISMATCH
+    });
+  }
+  return out;
+}
 var SYMBOL_MISMATCH_PATTERNS = [
   {
     // "'ListProductsResponse' object has no attribute 'products_list'" and kin.
@@ -17283,6 +17326,7 @@ function computeDivergences(graph, opts = {}) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+      for (const d of detectDeployDivergence(svc)) all.push(d);
       return;
     }
     if (n.type === import_types60.NodeType.InfraNode && n.kind === "sql-table") {
@@ -17323,7 +17367,12 @@ function computeDivergences(graph, opts = {}) {
     // orders last so at equal confidence the structural and symbol divergences
     // lead, per the contract ("rank below the definitive structural and symbol
     // divergences").
-    "observed-failing": 6
+    "observed-failing": 6,
+    // Deploy mismatch (ADR-225) is a definitive structural declared-vs-observed
+    // divergence carrying high confidence (0.9), so the confidence sort already
+    // places it among the structural leaders; this slot only breaks an exact
+    // confidence tie and sits last as a stable tiebreaker.
+    "deploy-mismatch": 7
   };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
@@ -18973,6 +19022,11 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
       unresolved++;
       continue;
     }
+    if (signal.deployState) {
+      ensureServiceNode(graph, resolved.serviceName, NO_ENV);
+      mergeObservedDeployState(graph, resolved.targetNodeId, signal.deployState);
+      continue;
+    }
     if (signal.incident) {
       ensureServiceNode(graph, resolved.serviceName, NO_ENV);
       if (!ctx.errorsPath || !graph.hasNode(resolved.targetNodeId)) {
@@ -23432,6 +23486,7 @@ var IMAGE_PULL_REASONS = /* @__PURE__ */ new Set(["ImagePullBackOff", "ErrImageP
 var CRASH_LOOP_REASON = "CrashLoopBackOff";
 var FIELD_SEP5 = "\0";
 var K8S_TARGET_KIND = "k8s-workload";
+var K8S_DEPLOY_STATE = "deploy-state";
 function packK8sTargetName(identity) {
   return [identity.serviceName, identity.fault].join(FIELD_SEP5);
 }
@@ -23563,11 +23618,40 @@ function mapDeploymentToSignal(deployment, pods, config) {
     }
   };
 }
+function observedDeployState(deployment, pods) {
+  const readyReplicas = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  let image;
+  for (const pod of podsForDeployment(deployment, pods)) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      if (cs.state?.running && typeof cs.image === "string" && cs.image.length > 0) {
+        image = cs.image;
+        break;
+      }
+    }
+    if (image) break;
+  }
+  return image !== void 0 ? { image, readyReplicas } : { readyReplicas };
+}
+function deployStateSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: K8S_DEPLOY_STATE }),
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: nowIso2(),
+    deployState: observedDeployState(deployment, pods)
+  };
+}
 function mapWorkloadsToSignals(deployments, pods, config) {
   const out = [];
   for (const deployment of deployments) {
-    const signal = mapDeploymentToSignal(deployment, pods, config);
-    if (signal) out.push(signal);
+    const deployState = deployStateSignal(deployment, pods, config);
+    if (deployState) out.push(deployState);
+    const incident = mapDeploymentToSignal(deployment, pods, config);
+    if (incident) out.push(incident);
   }
   return out;
 }