@neat.is/core 0.9.13-dev.20260901 → 0.9.14

package/dist/cli.cjs

@@ -1292,13 +1292,19 @@ function resolveOwningService(graph, nodeId) {
   }
   return null;
 }
+function isFrontierEdge(e) {
+  return e.provenance === import_types.Provenance.FRONTIER;
+}
+function rankOf(p) {
+  return p === import_types.Provenance.FRONTIER ? -1 : import_types.PROV_RANK[p];
+}
 function bestEdgeBySource(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.source)) continue;
+    if (isFrontierNode(graph, e.source) || isFrontierEdge(e)) continue;
     const cur = best.get(e.source);
-    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+    if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
       best.set(e.source, e);
     }
   }
@@ -1308,9 +1314,9 @@ function bestEdgeByTarget(graph, edgeIds) {
   const best = /* @__PURE__ */ new Map();
   for (const id of edgeIds) {
     const e = graph.getEdgeAttributes(id);
-    if (isFrontierNode(graph, e.target)) continue;
+    if (isFrontierNode(graph, e.target) || isFrontierEdge(e)) continue;
     const cur = best.get(e.target);
-    if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+    if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
       best.set(e.target, e);
     }
   }
@@ -1320,7 +1326,10 @@ var PROVENANCE_CEILING = {
   OBSERVED: 1,
   INFERRED: 0.7,
   EXTRACTED: 0.5,
-  STALE: 0.3
+  STALE: 0.3,
+  // A FRONTIER surface (ADR-226) is a proposal about a cause NEAT could not observe
+  // — the least-trusted claim it makes, below STALE (which was at least once seen).
+  FRONTIER: 0.2
 };
 function volumeWeight(spanCount) {
   if (!spanCount || spanCount <= 0) return 0.5;
@@ -1555,7 +1564,7 @@ function rootCauseFromIncidents(nodeId, incidents, errorEvent) {
   });
 }
 function isFailingCallEdge(e) {
-  return e.type === import_types.EdgeType.CALLS && (e.signal?.errorCount ?? 0) > 0;
+  return e.type === import_types.EdgeType.CALLS && !isFrontierEdge(e) && (e.signal?.errorCount ?? 0) > 0;
 }
 function callSourcesForService(graph, serviceId17) {
   const ids = [serviceId17];
@@ -1578,8 +1587,8 @@ function failingCallDominates(e, id, curEdge, curId) {
   const ec = e.signal?.errorCount ?? 0;
   const cc = curEdge.signal?.errorCount ?? 0;
   if (ec !== cc) return ec > cc;
-  if (import_types.PROV_RANK[e.provenance] !== import_types.PROV_RANK[curEdge.provenance]) {
-    return import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[curEdge.provenance];
+  if (rankOf(e.provenance) !== rankOf(curEdge.provenance)) {
+    return rankOf(e.provenance) > rankOf(curEdge.provenance);
   }
   return id < curId;
 }
@@ -1630,11 +1639,11 @@ function dominantStaleCall(graph, serviceId17, visited) {
     for (const edgeId of graph.outboundEdges(src)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type !== import_types.EdgeType.CALLS) continue;
-      if (isFrontierNode(graph, e.target)) continue;
+      if (isFrontierNode(graph, e.target) || isFrontierEdge(e)) continue;
       const owner = resolveOwningService(graph, e.target);
       if (!owner || visited.has(owner.id)) continue;
       const cur = bestByCallee.get(owner.id);
-      if (!cur || import_types.PROV_RANK[e.provenance] > import_types.PROV_RANK[cur.provenance]) {
+      if (!cur || rankOf(e.provenance) > rankOf(cur.provenance)) {
         bestByCallee.set(owner.id, e);
       }
     }
@@ -1907,6 +1916,7 @@ function nodeContext(graph, nodeId, incidents, now = Date.now()) {
     for (const edgeId of graph.inboundEdges(n)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (isFrontierEdge(e)) continue;
       errorsFromCallers += e.signal?.errorCount ?? 0;
       inboundVolume += e.callCount ?? e.signal?.spanCount ?? 0;
       if (e.provenance === import_types.Provenance.STALE) stale = true;
@@ -1920,6 +1930,7 @@ function nodeContext(graph, nodeId, incidents, now = Date.now()) {
     for (const edgeId of graph.outboundEdges(n)) {
       const e = graph.getEdgeAttributes(edgeId);
       if (e.type === import_types.EdgeType.CONTAINS) continue;
+      if (isFrontierEdge(e)) continue;
       outboundVolume += e.callCount ?? e.signal?.spanCount ?? 0;
       if (e.type === import_types.EdgeType.CALLS) outboundErrors += e.signal?.errorCount ?? 0;
       if (e.provenance === import_types.Provenance.STALE) stale = true;
@@ -1953,6 +1964,11 @@ function isSaturated(ctx) {
 function isBoundaryTimeoutSymptom(ctx) {
   return ctx.errorsEmittedHere > 0 && ctx.boundaryTimeout === true && ctx.errorsFromCallers === 0 && ctx.hasOutboundDeps === true && ctx.observedErroringDownstream !== true;
 }
+var UNREACHABLE_INBOUND_ERROR_RATE = 0.5;
+var UNREACHABLE_MIN_INBOUND = 3;
+function isUnreachableSeed(ctx) {
+  return ctx.callCount >= UNREACHABLE_MIN_INBOUND && ctx.errorsFromCallers > 0 && ctx.errorsFromCallers >= UNREACHABLE_INBOUND_ERROR_RATE * ctx.callCount && ctx.errorsEmittedHere === 0 && ctx.outboundVolume === 0;
+}
 function classifyNode(ctx) {
   if (ctx.errorsEmittedHere > 0) {
     if ((ctx.stale || isSaturated(ctx)) && ctx.errorsFromCallers >= ctx.errorsEmittedHere) {
@@ -1961,6 +1977,7 @@ function classifyNode(ctx) {
     if (isBoundaryTimeoutSymptom(ctx)) return "symptom-only";
     return "primary-failure";
   }
+  if (isUnreachableSeed(ctx)) return "unreachable";
   if (ctx.errorsFromCallers > 0) return "symptom-only";
   return "unrelated";
 }
@@ -2197,22 +2214,44 @@ function routeMatches(declared, incident) {
   const b = normalizeRoute(incident);
   return a === b || a.startsWith(b) || b.startsWith(a);
 }
-function structuralUpstreamPointer(graph, boundaryNode, incidents) {
-  const route = boundaryIncidentRoute(boundaryNode, incidents);
-  const callees = declaredOutboundCallees(graph, boundaryNode);
+function firstDeclaredCallee(graph, node, route) {
+  const callees = declaredOutboundCallees(graph, node);
   if (callees.length === 0) return null;
   const narrowed = route !== void 0 ? callees.filter((c) => c.route !== void 0 && routeMatches(c.route, route)) : callees;
   const chosen = narrowed.length === 1 ? narrowed[0] : callees.length === 1 ? callees[0] : null;
-  if (!chosen) return null;
-  let node = chosen.target;
-  const seen = /* @__PURE__ */ new Set([boundaryNode, node]);
-  for (let depth = 0; depth < ROOT_CAUSE_MAX_DEPTH; depth++) {
-    const next = declaredOutboundCallees(graph, node);
-    if (next.length !== 1 || seen.has(next[0].target)) break;
-    node = next[0].target;
-    seen.add(node);
+  return chosen ? chosen.target : null;
+}
+function observedOutboundNextServices(graph, nodeId) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const n of nodeScope(graph, nodeId)) {
+    if (!graph.hasNode(n)) continue;
+    for (const edgeId of graph.outboundEdges(n)) {
+      const e = graph.getEdgeAttributes(edgeId);
+      if (!DEP_EDGE_TYPES.has(e.type)) continue;
+      if (e.provenance !== import_types.Provenance.OBSERVED) continue;
+      if (e.target !== nodeId) targets.add(e.target);
+    }
   }
-  return route !== void 0 ? { node, route } : { node };
+  return [...targets];
+}
+function resolveHangHop(graph, boundaryNode, incidents) {
+  const route = boundaryIncidentRoute(boundaryNode, incidents);
+  const own = firstDeclaredCallee(graph, boundaryNode, route);
+  if (own) {
+    return route !== void 0 ? { source: boundaryNode, target: own, route } : { source: boundaryNode, target: own };
+  }
+  const resolved = observedOutboundNextServices(graph, boundaryNode).map((n) => ({ source: n, target: firstDeclaredCallee(graph, n, route) })).filter((r) => r.target !== null);
+  if (resolved.length === 1) {
+    const hop = resolved[0];
+    return route !== void 0 ? { ...hop, route } : hop;
+  }
+  return null;
+}
+function stagedHangProposal(graph, boundaryNode, incidents) {
+  const hop = resolveHangHop(graph, boundaryNode, incidents);
+  if (!hop) return null;
+  if (!graph.hasEdge((0, import_types.frontierEdgeId)(hop.source, hop.target, import_types.EdgeType.CALLS))) return null;
+  return hop.route !== void 0 ? { node: hop.target, route: hop.route } : { node: hop.target };
 }
 function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
   const legacy = tagged.result;
@@ -2247,29 +2286,39 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
       confidence: Math.min(legacy.confidence, 0.4),
       ...lastProv ? { provenance: lastProv } : {}
     });
+  } else if (seedCtx && isUnreachableSeed(seedCtx)) {
+    const name = displayNameOf(seedNode);
+    candidates.push({
+      node: seedNode,
+      classification: "unreachable",
+      reason: `${name} is unreachable: its callers' requests fail (${seedCtx.errorsFromCallers} erroring inbound calls) and it produced no telemetry of its own \u2014 no server spans, no outbound calls \u2014 so it never served. The failure is observed, but its cause is not in the trace: a startup failure, a crash before the first span, or an unschedulable / unhealthy pod. Inspect ${name}'s deploy state and logs \u2014 there is no code fault to find in the graph here.`,
+      context: seedCtx,
+      confidence: legacy.confidence,
+      provenance: import_types.Provenance.OBSERVED
+    });
   } else if (seedCtx && isBoundaryTimeoutSymptom(seedCtx)) {
-    const pointer = structuralUpstreamPointer(graph, seedNode, incidents);
     const seedName = displayNameOf(seedNode);
-    const routeNote = pointer?.route ? ` serving ${pointer.route}` : "";
-    if (pointer) {
-      const causeName = displayNameOf(pointer.node);
-      candidates.push({
-        node: pointer.node,
-        classification: "primary-failure",
-        reason: `${causeName} is the likely root cause (structural, INFERRED \u2014 not observed): the boundary ${seedName} only timed out waiting, and the actual culprit hung without exporting a span, so this is walked from the declared call graph${routeNote}, not from runtime signal. Restore instrumentation / inspect ${causeName} to confirm.`,
-        context: nodeContext(graph, pointer.node, incidents, now),
-        confidence: Math.min(legacy.confidence, PROVENANCE_CEILING.EXTRACTED),
-        provenance: import_types.Provenance.INFERRED
-      });
-    }
+    const proposal = stagedHangProposal(graph, seedNode, incidents);
+    const routeNote = proposal?.route ? ` serving ${proposal.route}` : "";
     candidates.push({
       node: seedNode,
       classification: "symptom-only",
-      reason: pointer ? `${seedName} timed out waiting on a downstream that hung and exported nothing \u2014 a boundary reporting an upstream fault, not the fault itself.` : `${seedName} timed out but nothing it can see downstream is erroring \u2014 the cause is downstream and unobserved (the culprit hung and exported no span). No single declared callee${routeNote} resolves, so no confident cause is named; inspect ${seedName}'s declared downstream.`,
+      reason: proposal ? `${seedName} timed out waiting on a downstream that hung and exported no span \u2014 a boundary reporting an upstream fault, not the fault itself. The cause is unobservable; NEAT proposes the staged FRONTIER surface below, a hypothesis to confirm, not an observed cause.` : `${seedName} timed out but nothing it can see downstream is erroring \u2014 the cause is downstream and unobserved (the culprit hung and exported no span). No FRONTIER surface${routeNote} is staged, so no cause is proposed; inspect ${seedName}'s declared downstream and restore instrumentation.`,
       context: seedCtx,
       confidence: Math.min(legacy.confidence, 0.3),
       ...lastProv ? { provenance: lastProv } : {}
     });
+    if (proposal) {
+      const causeName = displayNameOf(proposal.node);
+      candidates.push({
+        node: proposal.node,
+        classification: "primary-failure",
+        reason: `${causeName} is the proposed hang cause (FRONTIER \u2014 a hypothesis, not observed): the boundary ${seedName} only timed out waiting and the culprit hung without exporting a span, so NEAT staged a FRONTIER surface on the unobservable hop${routeNote}. It graduates to OBSERVED when ${causeName} comes back; until then, inspect it / restore instrumentation to confirm, or it is culled.`,
+        context: nodeContext(graph, proposal.node, incidents, now),
+        confidence: Math.min(legacy.confidence, PROVENANCE_CEILING.FRONTIER),
+        provenance: import_types.Provenance.FRONTIER
+      });
+    }
   } else if (staleChain) {
     const culprit = staleChain.culprit;
     const culpritName = displayNameOf(culprit);
@@ -2333,6 +2382,9 @@ function fixRecommendationForTop(top, seedNode, legacy) {
     return legacy.fixRecommendation;
   }
   const name = top.node.replace(/^service:/, "");
+  if (top.classification === "symptom-only" && top.context.boundaryTimeout === true) {
+    return `${name} timed out waiting on a downstream that hung and exported no span \u2014 the cause is unobservable from traces. Inspect the FRONTIER surface NEAT staged on the unobservable hop (see candidates); it graduates to OBSERVED when that service recovers. Restore instrumentation on that path to confirm, rather than treating ${name} as the fault.`;
+  }
   if (top.provenance === import_types.Provenance.STALE) {
     return `Live telemetry for this path has gone quiet; the last-observed topology traces the failure downstream to ${name}. Restore instrumentation (or re-run with live traces) to confirm, then inspect ${name}.`;
   }
@@ -6045,8 +6097,8 @@ function pickContainingSymbol(candidates, fn) {
     return b.symbol.span.startLine - a.symbol.span.startLine;
   };
   if (fn) {
-    const named = candidates.filter((c) => terminalName(c.symbol.qualname) === fn);
-    if (named.length > 0) return [...named].sort(bySpan)[0].id;
+    const named2 = candidates.filter((c) => terminalName(c.symbol.qualname) === fn);
+    if (named2.length > 0) return [...named2].sort(bySpan)[0].id;
   }
   return [...candidates].sort(bySpan)[0].id;
 }
@@ -6306,6 +6358,14 @@ function mergeColumnsAt(graph, tableNodeId, columns, provenance, confidence) {
 function mergeObservedColumns(graph, tableNodeId, columns) {
   mergeColumnsAt(graph, tableNodeId, columns, import_types8.Provenance.OBSERVED, OBSERVED_COLUMN_CONFIDENCE);
 }
+function mergeObservedDeployState(graph, serviceNodeId, state) {
+  if (!graph.hasNode(serviceNodeId)) return;
+  const attrs = {};
+  if (typeof state.image === "string" && state.image.length > 0) attrs["observedImage"] = state.image;
+  if (typeof state.readyReplicas === "number") attrs["observedReadyReplicas"] = state.readyReplicas;
+  if (Object.keys(attrs).length === 0) return;
+  graph.mergeNodeAttributes(serviceNodeId, attrs);
+}
 function ensureDatabaseNode(graph, host, engine) {
   const id = (0, import_types8.databaseId)(host);
   if (graph.hasNode(id)) return id;
@@ -7002,6 +7062,32 @@ function promoteFrontierNodes(graph, opts = {}) {
   }
   return promoted;
 }
+function stageFrontierEdge(graph, source, target, type) {
+  if (!graph.hasNode(source) || !graph.hasNode(target)) return false;
+  if (graph.hasEdge((0, import_types8.observedEdgeId)(source, target, type))) return false;
+  const key = (0, import_types8.frontierEdgeId)(source, target, type);
+  if (graph.hasEdge(key)) return false;
+  graph.addEdgeWithKey(key, source, target, {
+    id: key,
+    source,
+    target,
+    type,
+    provenance: import_types8.Provenance.FRONTIER
+  });
+  return true;
+}
+function promoteFrontierEdges(graph) {
+  const graduated = [];
+  graph.forEachEdge((edgeId, attrs) => {
+    const e = attrs;
+    if (e.provenance !== import_types8.Provenance.FRONTIER) return;
+    if (graph.hasEdge((0, import_types8.observedEdgeId)(e.source, e.target, e.type))) {
+      graduated.push(edgeId);
+    }
+  });
+  for (const edgeId of graduated) graph.dropEdge(edgeId);
+  return graduated.length;
+}
 function rewireFrontierEdges(graph, frontierId2, serviceId17) {
   const inbound = [...graph.inboundEdges(frontierId2)];
   const outbound = [...graph.outboundEdges(frontierId2)];
@@ -7110,6 +7196,7 @@ function startStalenessLoop(graph, options = {}) {
           project: options.project
         });
         if (options.onPolicyTrigger) await options.onPolicyTrigger(graph);
+        if (options.onReconcile) await options.onReconcile(graph);
       } catch (err) {
         console.error("staleness tick failed", err);
       }
@@ -9465,10 +9552,10 @@ function collectNamedImports(root) {
           const clause = node.namedChild(i);
           if (clause?.type !== "import_clause") continue;
           for (let j = 0; j < clause.namedChildCount; j++) {
-            const named = clause.namedChild(j);
-            if (named?.type !== "named_imports") continue;
-            for (let k = 0; k < named.namedChildCount; k++) {
-              const spec = named.namedChild(k);
+            const named2 = clause.namedChild(j);
+            if (named2?.type !== "named_imports") continue;
+            for (let k = 0; k < named2.namedChildCount; k++) {
+              const spec = named2.namedChild(k);
               if (spec?.type !== "import_specifier") continue;
               let isType = false;
               for (let t = 0; t < spec.childCount; t++) {
@@ -12102,8 +12189,8 @@ function parseImportBindings(content) {
       out.push({ local: ns[1], kind: "namespace", specifier: spec });
       continue;
     }
-    const named = /\{([^}]*)\}/.exec(clause);
-    if (named) parseDestructure(named[1], spec, out);
+    const named2 = /\{([^}]*)\}/.exec(clause);
+    if (named2) parseDestructure(named2[1], spec, out);
     const def = /^(\w+)\s*(?:,|$)/.exec(clause);
     if (def && !clause.startsWith("{")) out.push({ local: def[1], kind: "default", specifier: spec });
   }
@@ -12123,8 +12210,8 @@ function fileExportsOf(content, pluralizeOn) {
   for (const d of defs) if (d.varName) byVar.set(d.varName, d.resolved.name);
   const byName = new Map(byVar);
   let def;
-  const named = /(?:module\.exports|export\s+default)\s*=\s*(\w+)\b/.exec(content);
-  if (named && byVar.has(named[1])) def = byVar.get(named[1]);
+  const named2 = /(?:module\.exports|export\s+default)\s*=\s*(\w+)\b/.exec(content);
+  if (named2 && byVar.has(named2[1])) def = byVar.get(named2[1]);
   if (!def) {
     const inline = /(?:module\.exports|export\s+default)\s*=\s*(?:await\s+)?(?:\w+\s*\.\s*)?model\s*\(\s*['"`]([\w$]+)['"`]/.exec(content);
     if (inline) def = pluralizeOn ? pluralizeCollection(inline[1]) : inline[1];
@@ -16494,6 +16581,25 @@ function detectColumnDrift(node) {
   }
   return out;
 }
+var RECOMMENDATION_DEPLOY_IMAGE_MISMATCH = "The running image differs from the manifest-declared image \u2014 the rollout has not taken (the old ReplicaSet is still serving). Re-apply the deployment or investigate why the new image failed to roll out.";
+var DEPLOY_DIVERGENCE_CONFIDENCE = 0.9;
+function detectDeployDivergence(svc) {
+  const out = [];
+  if (typeof svc.declaredImage === "string" && typeof svc.observedImage === "string" && svc.declaredImage !== svc.observedImage) {
+    out.push({
+      type: "deploy-mismatch",
+      kind: "image",
+      source: svc.id,
+      target: svc.id,
+      declaredImage: svc.declaredImage,
+      observedImage: svc.observedImage,
+      confidence: DEPLOY_DIVERGENCE_CONFIDENCE,
+      reason: `Service ${svc.name} declares image ${svc.declaredImage} but its running pods report ${svc.observedImage} \u2014 the deploy has not taken (the old version is still serving), so no incident fires.`,
+      recommendation: RECOMMENDATION_DEPLOY_IMAGE_MISMATCH
+    });
+  }
+  return out;
+}
 var SYMBOL_MISMATCH_PATTERNS = [
   {
     // "'ListProductsResponse' object has no attribute 'products_list'" and kin.
@@ -16821,6 +16927,7 @@ function computeDivergences(graph, opts = {}) {
       const svc = n;
       for (const d of detectHostMismatch(graph, nodeId, svc)) all.push(d);
       for (const d of detectCompatDivergences(graph, nodeId, svc)) all.push(d);
+      for (const d of detectDeployDivergence(svc)) all.push(d);
       return;
     }
     if (n.type === import_types59.NodeType.InfraNode && n.kind === "sql-table") {
@@ -16861,7 +16968,12 @@ function computeDivergences(graph, opts = {}) {
     // orders last so at equal confidence the structural and symbol divergences
     // lead, per the contract ("rank below the definitive structural and symbol
     // divergences").
-    "observed-failing": 6
+    "observed-failing": 6,
+    // Deploy mismatch (ADR-225) is a definitive structural declared-vs-observed
+    // divergence carrying high confidence (0.9), so the confidence sort already
+    // places it among the structural leaders; this slot only breaks an exact
+    // confidence tie and sits last as a stable tiebreaker.
+    "deploy-mismatch": 7
   };
   filtered.sort((a, b) => {
     if (b.confidence !== a.confidence) return b.confidence - a.confidence;
@@ -17956,11 +18068,11 @@ async function resolveEntities(graph, question, searchIndex, maxNodes) {
     if (labelTokens.size === 0) return;
     let matched = 0;
     for (const t of qTokens) if (labelTokens.has(t)) matched += 1;
-    const named = body.length >= 2 && normalized.includes(body.toLowerCase()) || name.length >= 2 && normalized.includes(name.toLowerCase());
-    if (matched === 0 && !named) return;
+    const named2 = body.length >= 2 && normalized.includes(body.toLowerCase()) || name.length >= 2 && normalized.includes(name.toLowerCase());
+    if (matched === 0 && !named2) return;
     const coverage = qTokens.length > 0 ? matched / qTokens.length : 0;
-    const via = named ? "id" : matched > 0 && tokens(name).some((t) => qTokens.includes(t)) ? "label" : "token";
-    const score = named ? Math.max(0.9, coverage) : Math.min(0.85, 0.3 + 0.7 * coverage);
+    const via = named2 ? "id" : matched > 0 && tokens(name).some((t) => qTokens.includes(t)) ? "label" : "token";
+    const score = named2 ? Math.max(0.9, coverage) : Math.min(0.85, 0.3 + 0.7 * coverage);
     consider({ nodeId: id, label: name, via, score: Math.min(1, score) });
   });
   if (searchIndex) {
@@ -19300,6 +19412,11 @@ async function runConnectorPoll(connector, ctx, graph, resolveTarget) {
       unresolved++;
       continue;
     }
+    if (signal.deployState) {
+      ensureServiceNode(graph, resolved.serviceName, NO_ENV);
+      mergeObservedDeployState(graph, resolved.targetNodeId, signal.deployState);
+      continue;
+    }
     if (signal.incident) {
       ensureServiceNode(graph, resolved.serviceName, NO_ENV);
       if (!ctx.errorsPath || !graph.hasNode(resolved.targetNodeId)) {
@@ -19833,7 +19950,7 @@ function tableNameFromQueryText(query) {
   if (SYSTEM_SCHEMA_PREFIXES.some((prefix) => lower.startsWith(prefix))) return null;
   return name;
 }
-function diffPgStatStatementsToSignals(rows, previous, nowIso2) {
+function diffPgStatStatementsToSignals(rows, previous, nowIso3) {
   const signals = [];
   const seen = /* @__PURE__ */ new Set();
   if (!Array.isArray(rows)) return signals;
@@ -19855,7 +19972,7 @@ function diffPgStatStatementsToSignals(rows, previous, nowIso2) {
       targetName: table,
       callCount: delta,
       errorCount: 0,
-      lastObservedIso: nowIso2,
+      lastObservedIso: nowIso3,
       ...columns.length > 0 ? { columns } : {}
     });
   }
@@ -22751,11 +22868,11 @@ function serializeGraph(graph) {
 }
 function projectFromReq(req, singleProject) {
   const params = req.params;
-  const named = params.project;
+  const named2 = params.project;
   if (singleProject) {
-    return named === void 0 || named === DEFAULT_PROJECT ? singleProject : named;
+    return named2 === void 0 || named2 === DEFAULT_PROJECT ? singleProject : named2;
   }
-  return named ?? DEFAULT_PROJECT;
+  return named2 ?? DEFAULT_PROJECT;
 }
 function resolveProject(registry, req, reply, bootstrap, singleProject) {
   const name = projectFromReq(req, singleProject);
@@ -23652,13 +23769,38 @@ async function buildApi(opts) {
 
 // src/watch.ts
 init_auth();
-init_otel();
 
-// src/daemon.ts
+// src/hang-sensor.ts
 init_cjs_shims();
-var import_node_fs43 = require("fs");
-var import_node_path79 = __toESM(require("path"), 1);
-var import_node_module = require("module");
+var import_types102 = require("@neat.is/types");
+var RECONCILE_INCIDENT_LIMIT = 500;
+function stageHangSurfaces(graph, incidents) {
+  const boundaries = /* @__PURE__ */ new Set();
+  for (const ev of incidents) {
+    if (ev.affectedNode && graph.hasNode(ev.affectedNode)) boundaries.add(ev.affectedNode);
+  }
+  let staged = 0;
+  for (const boundary of boundaries) {
+    const ctx = nodeContext(graph, boundary, incidents);
+    if (!isBoundaryTimeoutSymptom(ctx)) continue;
+    const hop = resolveHangHop(graph, boundary, incidents);
+    if (!hop) continue;
+    if (stageFrontierEdge(graph, hop.source, hop.target, import_types102.EdgeType.CALLS)) staged++;
+  }
+  return staged;
+}
+async function reconcileFrontierSurfaces(graph, errorsPath) {
+  promoteFrontierEdges(graph);
+  let incidents = [];
+  try {
+    incidents = await readErrorEvents(errorsPath, { limit: RECONCILE_INCIDENT_LIMIT });
+  } catch {
+    incidents = [];
+  }
+  stageHangSurfaces(graph, incidents);
+}
+
+// src/watch.ts
 init_otel();
 
 // src/connectors/kubernetes/index.ts
@@ -23667,29 +23809,476 @@ init_cjs_shims();
 // src/connectors/kubernetes/client.ts
 init_cjs_shims();
 var import_node_https = require("https");
+function deploymentsPath(namespace) {
+  return `/apis/apps/v1/namespaces/${namespace}/deployments`;
+}
+function podsPath(namespace) {
+  return `/api/v1/namespaces/${namespace}/pods`;
+}
+function makeK8sFetchImpl(transport) {
+  const agent = new import_node_https.Agent({
+    ...transport.ca ? { ca: transport.ca } : {},
+    ...transport.clientCert ? { cert: transport.clientCert } : {},
+    ...transport.clientKey ? { key: transport.clientKey } : {},
+    rejectUnauthorized: !transport.insecureSkipTlsVerify
+  });
+  return ((url, init) => new Promise((resolve, reject) => {
+    const u = new URL(String(url));
+    const req = (0, import_node_https.request)(
+      u,
+      {
+        method: (init?.method ?? "GET").toUpperCase(),
+        headers: init?.headers ?? {},
+        agent
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const body = Buffer.concat(chunks).toString("utf8");
+          const status2 = res.statusCode ?? 0;
+          resolve({
+            ok: status2 >= 200 && status2 < 300,
+            status: status2,
+            statusText: res.statusMessage ?? "",
+            json: async () => JSON.parse(body),
+            text: async () => body
+          });
+        });
+      }
+    );
+    req.on("error", reject);
+    const signal = init?.signal;
+    if (signal) {
+      if (signal.aborted) req.destroy(new Error("aborted"));
+      else signal.addEventListener("abort", () => req.destroy(new Error("aborted")), { once: true });
+    }
+    req.end();
+  }));
+}
+async function listResource(transport, namespace, path96, opts = {}) {
+  const base = opts.apiUrl ?? transport.server;
+  const url = `${base.replace(/\/$/, "")}${path96}`;
+  const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
+  const res = await junctionFetch(
+    url,
+    { method: "GET", headers: { ...transport.token ? bearerAuthHeader(transport.token) : {}, Accept: "application/json" } },
+    // accountKey: the (cluster, namespace) pair — an identifier, safe to log, the
+    // rate-limit bucket for one namespace on one cluster (ADR-131).
+    { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
+  );
+  if (!res.ok) {
+    throw new Error(`kubernetes ${path96} failed: ${res.status} ${res.statusText}`);
+  }
+  const json = await res.json();
+  return Array.isArray(json.items) ? json.items : [];
+}
+function safeHost(server) {
+  try {
+    return new URL(server).host;
+  } catch {
+    return "cluster";
+  }
+}
+async function fetchDeployments(transport, namespace, opts = {}) {
+  return listResource(transport, namespace, deploymentsPath(namespace), opts);
+}
+async function fetchPods(transport, namespace, opts = {}) {
+  return listResource(transport, namespace, podsPath(namespace), opts);
+}
 
 // src/connectors/kubernetes/kubeconfig.ts
 init_cjs_shims();
 var import_node_fs41 = require("fs");
 var import_yaml4 = require("yaml");
+function pemFrom(dataField, pathField) {
+  if (typeof dataField === "string" && dataField.length > 0) {
+    return Buffer.from(dataField, "base64").toString("utf8");
+  }
+  if (typeof pathField === "string" && pathField.length > 0) {
+    return (0, import_node_fs41.readFileSync)(pathField, "utf8");
+  }
+  return void 0;
+}
+function named(list, name) {
+  if (!Array.isArray(list)) return void 0;
+  const hit = list.find((e) => e && e.name === name);
+  return hit;
+}
+function parseKubeconfig(kubeconfig) {
+  const looksInline = /\n/.test(kubeconfig) || /(^|\s)clusters\s*:/.test(kubeconfig);
+  const text = looksInline ? kubeconfig : (0, import_node_fs41.readFileSync)(kubeconfig, "utf8");
+  let doc;
+  try {
+    doc = (0, import_yaml4.parse)(text);
+  } catch {
+    throw new Error("kubernetes connector: kubeconfig is not valid YAML");
+  }
+  if (!doc || typeof doc !== "object") {
+    throw new Error("kubernetes connector: kubeconfig is empty or malformed");
+  }
+  const currentContext = doc["current-context"];
+  if (typeof currentContext !== "string" || currentContext.length === 0) {
+    throw new Error("kubernetes connector: kubeconfig has no current-context");
+  }
+  const ctxEntry = named(doc["contexts"], currentContext);
+  const ctx = ctxEntry?.context;
+  if (!ctx) {
+    throw new Error(`kubernetes connector: kubeconfig context "${currentContext}" not found`);
+  }
+  const clusterEntry = named(doc["clusters"], String(ctx["cluster"] ?? ""));
+  const cluster = clusterEntry?.cluster;
+  if (!cluster || typeof cluster["server"] !== "string") {
+    throw new Error("kubernetes connector: kubeconfig current context has no cluster server");
+  }
+  const userEntry = named(doc["users"], String(ctx["user"] ?? ""));
+  const user = userEntry?.user ?? {};
+  const transport = {
+    server: cluster["server"],
+    insecureSkipTlsVerify: cluster["insecure-skip-tls-verify"] === true
+  };
+  const ca = pemFrom(cluster["certificate-authority-data"], cluster["certificate-authority"]);
+  if (ca) transport.ca = ca;
+  if (typeof user["token"] === "string" && user["token"].length > 0) transport.token = user["token"];
+  const clientCert = pemFrom(user["client-certificate-data"], user["client-certificate"]);
+  const clientKey = pemFrom(user["client-key-data"], user["client-key"]);
+  if (clientCert) transport.clientCert = clientCert;
+  if (clientKey) transport.clientKey = clientKey;
+  return transport;
+}
+function resolveK8sTransport(creds, config) {
+  if (creds.kubeconfig) return parseKubeconfig(creds.kubeconfig);
+  if (!config.apiServerUrl) {
+    throw new Error("kubernetes connector: options.apiServerUrl is required with a token credential");
+  }
+  const transport = {
+    server: config.apiServerUrl,
+    insecureSkipTlsVerify: config.insecureSkipTlsVerify === true
+  };
+  if (creds.token) transport.token = creds.token;
+  if (config.caCert) transport.ca = config.caCert;
+  return transport;
+}
 
 // src/connectors/kubernetes/map.ts
 init_cjs_shims();
 
 // src/connectors/kubernetes/types.ts
 init_cjs_shims();
+function readK8sCredentials(raw) {
+  const token = typeof raw["token"] === "string" && raw["token"].length > 0 ? raw["token"] : void 0;
+  const kubeconfig = typeof raw["kubeconfig"] === "string" && raw["kubeconfig"].length > 0 ? raw["kubeconfig"] : void 0;
+  if (!token && !kubeconfig) {
+    throw new Error("kubernetes connector: credentials must carry a token or a kubeconfig");
+  }
+  const out = {};
+  if (token) out.token = token;
+  if (kubeconfig) out.kubeconfig = kubeconfig;
+  return out;
+}
+var IMAGE_PULL_REASONS = /* @__PURE__ */ new Set(["ImagePullBackOff", "ErrImagePull", "InvalidImageName"]);
+var CRASH_LOOP_REASON = "CrashLoopBackOff";
+var FIELD_SEP5 = "\0";
+var K8S_TARGET_KIND = "k8s-workload";
+var K8S_DEPLOY_STATE = "deploy-state";
+function packK8sTargetName(identity) {
+  return [identity.serviceName, identity.fault].join(FIELD_SEP5);
+}
+function parseK8sTargetName(targetName) {
+  const sep = targetName.indexOf(FIELD_SEP5);
+  if (sep === -1) return null;
+  const serviceName = targetName.slice(0, sep);
+  const fault = targetName.slice(sep + 1);
+  if (!serviceName || !fault) return null;
+  return { serviceName, fault };
+}
+
+// src/connectors/kubernetes/map.ts
+function serviceNameFor(deployment, config) {
+  const name = deployment.metadata?.name ?? "";
+  return config.serviceMap?.[name] ?? name;
+}
+function podMatchesSelector(pod, selector) {
+  if (!selector || Object.keys(selector).length === 0) return false;
+  const labels = pod.metadata?.labels ?? {};
+  return Object.entries(selector).every(([k, v]) => labels[k] === v);
+}
+function podsForDeployment(deployment, pods) {
+  const selector = deployment.spec?.selector?.matchLabels;
+  return pods.filter((p) => podMatchesSelector(p, selector));
+}
+function nowIso2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function podLevelFault(deployment, pods) {
+  const name = deployment.metadata?.name ?? "";
+  const owned = podsForDeployment(deployment, pods);
+  let crash = null;
+  for (const pod of owned) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      const reason = cs.state?.waiting?.reason;
+      if (typeof reason !== "string") continue;
+      if (IMAGE_PULL_REASONS.has(reason)) {
+        const image = typeof cs.image === "string" ? cs.image : "unknown image";
+        const attrs = { "k8s.image": image, "k8s.waitingReason": reason };
+        const wm = cs.state?.waiting?.message;
+        if (typeof wm === "string" && wm.length > 0) attrs["k8s.waitingMessage"] = wm;
+        return {
+          fault: "image-pull",
+          message: `Deployment ${name} cannot pull image ${image} (${reason})`,
+          timestamp: pod.status?.startTime ?? nowIso2(),
+          attributes: attrs
+        };
+      }
+      if (reason === CRASH_LOOP_REASON && !crash) crash = { cs, pod };
+    }
+  }
+  if (crash) {
+    const { cs, pod } = crash;
+    const term = cs.lastState?.terminated;
+    const termReason = typeof term?.reason === "string" ? term.reason : void 0;
+    const termMsg = typeof term?.message === "string" ? term.message.trim() : void 0;
+    const restarts = typeof cs.restartCount === "number" ? cs.restartCount : 0;
+    const detail = termReason ? `last terminated: ${termReason}${termMsg ? ` \u2014 ${termMsg}` : ""}${typeof term?.exitCode === "number" ? ` (exit ${term.exitCode})` : ""}` : "no last-termination detail reported";
+    const attrs = { "k8s.waitingReason": CRASH_LOOP_REASON, "k8s.restartCount": restarts };
+    if (termReason) attrs["k8s.terminatedReason"] = termReason;
+    if (termMsg) attrs["k8s.terminatedMessage"] = termMsg;
+    if (typeof term?.exitCode === "number") attrs["k8s.exitCode"] = term.exitCode;
+    if (typeof cs.image === "string") attrs["k8s.image"] = cs.image;
+    return {
+      fault: "crash-loop",
+      message: `Deployment ${name} is crashlooping (restarts: ${restarts}); ${detail}`,
+      timestamp: term?.finishedAt ?? pod.status?.startTime ?? nowIso2(),
+      attributes: attrs
+    };
+  }
+  return null;
+}
+function classifyDeployment(deployment, pods, expectedZero) {
+  const name = deployment.metadata?.name ?? "";
+  const desired = typeof deployment.spec?.replicas === "number" ? deployment.spec.replicas : 1;
+  const ready = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  if (desired === 0) {
+    if (expectedZero?.has(name)) return null;
+    return {
+      fault: "scaled-to-zero",
+      message: `Deployment ${name} is scaled to 0 \u2014 no running pods (desired 0)`,
+      timestamp: nowIso2(),
+      attributes: { "k8s.desiredReplicas": 0, "k8s.readyReplicas": ready }
+    };
+  }
+  if (ready >= desired) return null;
+  const podFault = podLevelFault(deployment, pods);
+  if (podFault) {
+    podFault.attributes["k8s.desiredReplicas"] = desired;
+    podFault.attributes["k8s.readyReplicas"] = ready;
+    return podFault;
+  }
+  return {
+    fault: "no-ready-replicas",
+    message: `Deployment ${name} has no ready replicas (desired ${desired}, ready ${ready})`,
+    timestamp: nowIso2(),
+    attributes: { "k8s.desiredReplicas": desired, "k8s.readyReplicas": ready }
+  };
+}
+function mapDeploymentToSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const expectedZero = config.expectedZero ? new Set(config.expectedZero) : void 0;
+  const finding = classifyDeployment(deployment, pods, expectedZero);
+  if (!finding) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  const namespace = deployment.metadata?.namespace ?? config.namespace;
+  const attributes = {
+    "k8s.namespace": namespace,
+    "k8s.deployment": name,
+    "k8s.fault": finding.fault,
+    ...finding.attributes
+  };
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: finding.fault }),
+    // Incident-only — no edge, so no call/error count to replay.
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: finding.timestamp,
+    incident: {
+      id: `k8s:deploy:${namespace}:${name}:${finding.fault}`,
+      timestamp: finding.timestamp,
+      service: serviceName,
+      errorType: "k8s-deploy-failure",
+      errorMessage: finding.message,
+      attributes
+    }
+  };
+}
+function observedDeployState(deployment, pods) {
+  const readyReplicas = typeof deployment.status?.readyReplicas === "number" ? deployment.status.readyReplicas : 0;
+  let image;
+  for (const pod of podsForDeployment(deployment, pods)) {
+    for (const cs of pod.status?.containerStatuses ?? []) {
+      if (cs.state?.running && typeof cs.image === "string" && cs.image.length > 0) {
+        image = cs.image;
+        break;
+      }
+    }
+    if (image) break;
+  }
+  return image !== void 0 ? { image, readyReplicas } : { readyReplicas };
+}
+function deployStateSignal(deployment, pods, config) {
+  const name = deployment.metadata?.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  const serviceName = serviceNameFor(deployment, config);
+  return {
+    targetKind: K8S_TARGET_KIND,
+    targetName: packK8sTargetName({ serviceName, fault: K8S_DEPLOY_STATE }),
+    callCount: 0,
+    errorCount: 0,
+    lastObservedIso: nowIso2(),
+    deployState: observedDeployState(deployment, pods)
+  };
+}
+function mapWorkloadsToSignals(deployments, pods, config) {
+  const out = [];
+  for (const deployment of deployments) {
+    const deployState = deployStateSignal(deployment, pods, config);
+    if (deployState) out.push(deployState);
+    const incident = mapDeploymentToSignal(deployment, pods, config);
+    if (incident) out.push(incident);
+  }
+  return out;
+}
 
 // src/connectors/kubernetes/resolve.ts
 init_cjs_shims();
-var import_types103 = require("@neat.is/types");
+var import_types104 = require("@neat.is/types");
+var NO_ENV3 = "unknown";
+function createK8sResolveTarget(graph) {
+  return (signal) => {
+    if (signal.targetKind !== K8S_TARGET_KIND) return null;
+    const identity = parseK8sTargetName(signal.targetName);
+    if (!identity) return null;
+    const { serviceName } = identity;
+    return {
+      targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV3),
+      serviceName,
+      edgeType: import_types104.EdgeType.CALLS
+    };
+  };
+}
 
 // src/connectors/kubernetes/substrate.ts
 init_cjs_shims();
 var import_promises = require("fs/promises");
 var import_node_os5 = __toESM(require("os"), 1);
 var import_node_path77 = __toESM(require("path"), 1);
+function defaultHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path77.default.resolve(override);
+  return import_node_path77.default.join(import_node_os5.default.homedir(), ".neat");
+}
+function k8sSubstrateConfigPath(home = defaultHome()) {
+  return import_node_path77.default.join(home, "k8s.json");
+}
+async function readK8sSubstrateConfig(home = defaultHome()) {
+  let raw;
+  try {
+    raw = await (0, import_promises.readFile)(k8sSubstrateConfigPath(home), "utf8");
+  } catch {
+    return { version: 1, deployments: [] };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || !Array.isArray(parsed.deployments)) return { version: 1, deployments: [] };
+    return parsed;
+  } catch {
+    return { version: 1, deployments: [] };
+  }
+}
+async function startK8sSubstratePolling(input) {
+  const config = await readK8sSubstrateConfig(input.home);
+  const env = input.env ?? process.env;
+  const stops = [];
+  for (const entry2 of config.deployments) {
+    if (entry2.project !== void 0 && entry2.project !== input.project) continue;
+    if (typeof entry2.namespace !== "string" || entry2.namespace.length === 0) {
+      input.onSkip?.(entry2, "missing namespace");
+      continue;
+    }
+    let credentials;
+    try {
+      const resolved = resolveCredential(entry2.credential, env);
+      credentials = resolved.kind === "fields" ? { ...resolved.fields } : { token: resolved.value };
+    } catch (err) {
+      input.onSkip?.(entry2, err.message);
+      continue;
+    }
+    const cfg = {
+      namespace: entry2.namespace,
+      ...entry2.apiServerUrl ? { apiServerUrl: entry2.apiServerUrl } : {},
+      ...entry2.caCert ? { caCert: entry2.caCert } : {},
+      ...entry2.insecureSkipTlsVerify ? { insecureSkipTlsVerify: true } : {},
+      ...entry2.serviceMap ? { serviceMap: entry2.serviceMap } : {},
+      ...entry2.expectedZero ? { expectedZero: entry2.expectedZero } : {}
+    };
+    const { connector, resolveTarget } = createKubernetesConnector(input.graph, cfg, input.fetchImpl);
+    const stop = startConnectorPollLoop(
+      connector,
+      {
+        projectDir: input.projectDir,
+        project: input.project,
+        credentials,
+        ...input.errorsPath ? { errorsPath: input.errorsPath } : {}
+      },
+      input.graph,
+      resolveTarget,
+      { connectorId: `k8s:${entry2.id}`, ...entry2.intervalMs ? { intervalMs: entry2.intervalMs } : {} }
+    );
+    stops.push(stop);
+  }
+  return () => {
+    for (const stop of stops) stop();
+  };
+}
+
+// src/connectors/kubernetes/index.ts
+var KubernetesConnector = class {
+  constructor(config, fetchImpl) {
+    this.config = config;
+    this.fetchImpl = fetchImpl;
+  }
+  config;
+  fetchImpl;
+  provider = "kubernetes";
+  async poll(ctx) {
+    const creds = readK8sCredentials(ctx.credentials);
+    const transport = resolveK8sTransport(creds, this.config);
+    const namespace = this.config.namespace;
+    const opts = {
+      ...this.config.apiUrl ? { apiUrl: this.config.apiUrl } : {},
+      ...this.fetchImpl ? { fetchImpl: this.fetchImpl } : {}
+    };
+    const [deployments, pods] = await Promise.all([
+      fetchDeployments(transport, namespace, opts),
+      fetchPods(transport, namespace, opts)
+    ]);
+    return mapWorkloadsToSignals(deployments, pods, this.config);
+  }
+};
+function createKubernetesConnector(graph, config, fetchImpl) {
+  return {
+    connector: new KubernetesConnector(config, fetchImpl),
+    resolveTarget: createK8sResolveTarget(graph)
+  };
+}
 
 // src/daemon.ts
+init_cjs_shims();
+var import_node_fs43 = require("fs");
+var import_node_path79 = __toESM(require("path"), 1);
+var import_node_module = require("module");
+init_otel();
 init_auth();
 
 // src/unrouted.ts
@@ -23698,7 +24287,7 @@ var import_node_fs42 = require("fs");
 var import_node_path78 = __toESM(require("path"), 1);
 
 // src/daemon.ts
-var import_types106 = require("@neat.is/types");
+var import_types107 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path79.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -24350,7 +24939,10 @@ async function startWatch(graph, opts) {
   const stopStaleness = startStalenessLoop(graph, {
     staleEventsPath: opts.staleEventsPath,
     project: projectName,
-    onPolicyTrigger
+    onPolicyTrigger,
+    // Graduate FRONTIER surfaces whose twin arrived + stage surfaces for current
+    // hangs (ADR-226), each post-ingest tick.
+    onReconcile: (g) => reconcileFrontierSurfaces(g, opts.errorsPath)
   });
   const stopConnectors = await startConnectorPolling({
     project: projectName,
@@ -24364,6 +24956,14 @@ async function startWatch(graph, opts) {
       `neat watch: connector "${skipped.id}" (${skipped.provider}) skipped for project "${projectName}" \u2014 ${reason}`
     )
   });
+  const stopK8sSubstrate = await startK8sSubstratePolling({
+    project: projectName,
+    graph,
+    projectDir: opts.scanPath,
+    errorsPath: opts.errorsPath,
+    ...opts.neatHome ? { home: opts.neatHome } : {},
+    onSkip: (skipped, reason) => console.warn(`neat watch: k8s substrate "${skipped.id}" skipped for project "${projectName}" \u2014 ${reason}`)
+  });
   const auth = readAuthEnv();
   const host = opts.host ?? (auth.authToken ? "0.0.0.0" : "127.0.0.1");
   assertBindAuthority(host, auth.authToken);
@@ -24550,6 +25150,7 @@ async function startWatch(graph, opts) {
     }
     await watcher.close();
     stopConnectors();
+    stopK8sSubstrate();
     stopStaleness();
     stopPersist();
     detachEventBus();
@@ -28008,8 +28609,8 @@ async function waitForPeerDaemon(restPort, project, timeoutMs) {
 async function healthIsForProject(restPort, project) {
   const body = await fetchDaemonHealth(restPort);
   if (body === null) return false;
-  const named = body.project;
-  if (typeof named === "string") return named === project;
+  const named2 = body.project;
+  if (typeof named2 === "string") return named2 === project;
   if (Array.isArray(body.projects)) {
     return body.projects.some((p) => p.name === project);
   }
@@ -28715,7 +29316,7 @@ var import_node_path89 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
-var import_types107 = require("@neat.is/types");
+var import_types108 = require("@neat.is/types");
 var HttpError = class extends Error {
   constructor(status2, message, responseBody = "") {
     super(message);
@@ -28857,7 +29458,7 @@ async function runBlastRadius(client, input) {
   }
 }
 function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types107.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  const tag = n.edgeProvenance === import_types108.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
   return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
 }
 async function runDependencies(client, input) {
@@ -28914,7 +29515,7 @@ async function runObservedDependencies(client, input) {
       if (result.observed) {
         return {
           summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: import_types107.Provenance.OBSERVED
+          provenance: import_types108.Provenance.OBSERVED
         };
       }
       const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
@@ -28924,7 +29525,7 @@ async function runObservedDependencies(client, input) {
     return {
       summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
       block: blockLines.join("\n"),
-      provenance: import_types107.Provenance.OBSERVED
+      provenance: import_types108.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -28978,7 +29579,7 @@ async function runIncidents(client, input) {
     return {
       summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
       block: blockLines.join("\n"),
-      provenance: import_types107.Provenance.OBSERVED
+      provenance: import_types108.Provenance.OBSERVED
     };
   } catch (err) {
     if (err instanceof HttpError && err.status === 404) {
@@ -29087,7 +29688,7 @@ async function runStaleEdges(client, input) {
   return {
     summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
     block: blockLines.join("\n"),
-    provenance: import_types107.Provenance.STALE
+    provenance: import_types108.Provenance.STALE
   };
 }
 async function runPolicies(client, input) {
@@ -29178,6 +29779,12 @@ function formatDivergenceLine(d) {
       const at = d.location ? ` at ${d.location}` : "";
       return `  \u2022 [${d.type}] ${d.source}${at} (${d.failureKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
     }
+    case "deploy-mismatch": {
+      if (d.kind === "image") {
+        return `  \u2022 [${d.type}] ${d.source} \u2014 declared image ${d.declaredImage ?? "?"}, running ${d.observedImage ?? "?"} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      return `  \u2022 [${d.type}] ${d.source} \u2014 declared ${d.declaredReplicas ?? "?"} replicas, ${d.observedReplicas ?? "?"} ready \u2014 confidence ${d.confidence.toFixed(2)}`;
+    }
   }
 }
 async function runDivergences(client, input) {
@@ -30378,12 +30985,12 @@ async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
 
 // src/monitor.ts
 init_cjs_shims();
-var import_types108 = require("@neat.is/types");
+var import_types109 = require("@neat.is/types");
 var OBSERVED_DEP_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types108.EdgeType.CALLS,
-  import_types108.EdgeType.CONNECTS_TO,
-  import_types108.EdgeType.PUBLISHES_TO,
-  import_types108.EdgeType.CONSUMES_FROM
+  import_types109.EdgeType.CALLS,
+  import_types109.EdgeType.CONNECTS_TO,
+  import_types109.EdgeType.PUBLISHES_TO,
+  import_types109.EdgeType.CONSUMES_FROM
 ]);
 function divergenceKey(d) {
   const column = "column" in d && d.column ? d.column : "";
@@ -30444,7 +31051,7 @@ function formatDivergenceLine2(d) {
   }
 }
 function formatStaleLine(edgeId) {
-  const parsed = (0, import_types108.parseEdgeId)(edgeId);
+  const parsed = (0, import_types109.parseEdgeId)(edgeId);
   if (parsed) {
     return `\u22EF stale  ${parsed.source} \u2192 ${parsed.target}  (observed edge went quiet)`;
   }
@@ -30457,7 +31064,7 @@ function divergenceJson(d) {
   return JSON.stringify({ kind: "divergence", ...d });
 }
 function staleJson(edgeId) {
-  const parsed = (0, import_types108.parseEdgeId)(edgeId);
+  const parsed = (0, import_types109.parseEdgeId)(edgeId);
   return JSON.stringify({
     kind: "stale",
     edgeId,
@@ -30540,7 +31147,7 @@ var MonitorEmitter = class {
   // ignores non-OBSERVED edges and non-dependency edge types (structural
   // ownership), so only real runtime dependencies reach stdout.
   emitObservedEdge(edge) {
-    if (edge.provenance !== import_types108.Provenance.OBSERVED) return false;
+    if (edge.provenance !== import_types109.Provenance.OBSERVED) return false;
     if (!OBSERVED_DEP_EDGE_TYPES.has(edge.type)) return false;
     const key = `edge|${edge.id}`;
     if (this.seen.has(key)) return false;
@@ -30721,7 +31328,7 @@ async function runMonitor(opts) {
       case "edge-added": {
         const payload = safeParse(frame.data);
         const edge = payload?.edge;
-        if (edge && edge.provenance === import_types108.Provenance.OBSERVED) {
+        if (edge && edge.provenance === import_types109.Provenance.OBSERVED) {
           emitter.emitObservedEdge(edge);
           divergences.schedule();
         }
@@ -30971,7 +31578,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types109 = require("@neat.is/types");
+var import_types110 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -32055,10 +32662,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types109.DivergenceTypeSchema.safeParse(p);
+          const r = import_types110.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types109.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types110.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }