fix(aws): a subnet's occupants are traversable

[lex00]

reconstructEdges treats a containment rule as a boundary hint and emits no edge — unless the rule declares a traversal name. That carve-out is #1275's, added because "a fold's first hop is sometimes exactly a containment".

AWS::EC2::Instance -> Subnet was given a name. The network interface, which is the same relationship for the same reason, was not:

{ from: "AWS::EC2::Instance",         path: "SubnetId", …, viaAttr: "SubnetId" }   // traversable
{ from: "AWS::EC2::NetworkInterface", path: "SubnetId", … }                        // not

So kind:EC2::Subnet !<-kind:EC2::NetworkInterface — the query the grammar exists to express, and the first thing an agent reaches for — matched 23 of 23 subnets on an estate where 8 of 13 are empty. The negation was inert, and an inert negation is indistinguishable from one that searched and found nothing.

How it presented

--explain printed the tell and nothing read it:

— 23 of 23 AWS::EC2::Subnet/AWS::EC2::SubnetRouteTableAssociation matched
  (query: kind:EC2::Subnet !<-kind:EC2::NetworkInterface)

A negation term that excludes zero of everything is worth suspecting. (That line also shows kind:EC2::Subnet substring-matching SubnetRouteTableAssociation, which is documented behaviour and a separate conversation.)

On the aws-bench negative question set, two of three trials asked this query, believed it, and answered with every subnet including the occupied ones. The trial that passed did not believe it — it cross-checked with kind:EC2::NetworkInterface --show SubnetId, dumped graph --format ir to a file, and did the join in Python. A query language that is only right when the caller distrusts it is worse than one that cannot answer at all.

Scope, and what I deliberately did not do

Scoped to "occupies a subnet" — network interface and NAT gateway — matching the exception that already existed for the instance.

Containment into a VPC stays a boundary hint. My first patch made those traversable too and reference-catalog.test.ts caught it:

// containment is never an edge
expect(edges.some((e) => e.to === "vpc")).toBe(false);

That is an explicit, deliberate invariant. Flipping it to improve a benchmark number is not a change I should make as a side effect, so I reverted it. The cost is that vpcs-with-no-running-instances stays unanswerable by the same route — worth settling on its own terms, and I have left it in the issue rather than quietly deciding it here.

The same omission exists on the ELB, ECS and RDS containments. No estate here exercises them, so I left them rather than change what I cannot test.

Verification

Four tests: the ENI reaches its subnet, the NAT gateway does too, an empty subnet is still reached by nothing, and the containment boundary is still recorded — the traversal is added, not traded for.

Full suite: 10467 passed, 5 skipped, 0 failed. Lint clean.

Closes #1432

🤖 Generated with Claude Code

https://claude.ai/code/session_014KoduiMJRyLqjFYBUbMskE

[lex00]

Superseded by the branch above — containment is now traversable by construction rather than by a per-rule viaAttr someone has to remember, which is what made NetworkInterface -> Subnet differ from Instance -> Subnet in the first place. Closing in favour of that.

[lex00]

Superseded by #1452, now merged — containment is traversable by construction rather than by a per-rule viaAttr, which is what made NetworkInterface -> Subnet differ from Instance -> Subnet in the first place.