A drift detection system built as a composition layer over existing AWS observation models, making zero additional API calls. Five independent observers (VPC/networking, resource inventory, config compliance, DNS, and event topology) each store typed versioned snapshots. A drift-state model normalizes outputs from all sources into a canonical shape, then diffs current snapshots against a stored baseline to classify resources as in_sync, drifted, or unknown. Tested against real AWS infrastructure with intentional changes (Lambda timeout, security group ingress rule, EventBridge target), the system correctly detected all three drift events. Key lessons: normalizer determinism is critical (non-deterministic normalizers measure their own instability, not infrastructure change), layer contracts must be explicitly verified, and the reserved 'latest' instance name in the Swamp datastore can cause silent failures.
