# Drift-detection field-coverage gap — does cub-scout catch every drift?

**UNOFFICIAL/EXPERIMENTAL.** Live receipt generated by `scripts/run-drift-detection-gap.mjs`; do not hand-edit. Regenerate with `npm run drift-gap:proof`.

**Claim.** cub-scout `compare three-way --dry-from` detects desired-vs-live drift (replicas/image, with cause attribution manual-edit) — but it MISSES a container env-var change. A Deployment whose env is drifted on the live cluster is reported as AGREED / 0 mismatches. Drift detection works but has incomplete field coverage: a real drift can pass as no-drift.

The day-1 drift claim: `cub-scout compare three-way --dry-from <renderedDir>` flags desired-vs-live drift. It works — but field coverage matters. Proven live on a throwaway kind cluster with two Deployments, each drifted a different way:

| Drift | Confirmed live | cub-scout detected? | Expected |
| --- | --- | --- | --- |
| `spec.replicas` 1→3 | — | **yes** | detected |
| container env `FOO` bar→DRIFTED | yes | **no** | detected |

Overall: **watch**. Confirmed: cub-scout detected the replicas drift but MISSED the env-var drift (live env change verified). Drift detection has a field-coverage hole — extend it to container env (and audit other pod-spec fields), or a drifted env passes as no-drift.

- **Positive:** cub-scout *does* detect drift — replicas/image, with cause attribution (`drift-cause: manual-edit`). The mechanism works.
- **Gap:** it **misses container env-var drift** (verified: the live env really changed, and cub-scout reported 0 mismatches). A real drift passes as no-drift.
- **Fix:** extend `--dry-from` field comparison to container env (and audit other pod-spec fields — resources, command, volumeMounts). Until then, drift detection is partial.
- Receipt: `runs/drift-detection-gap/receipt.yaml`.