@intentius/behold 0.10.1 → 0.12.0

package/example-carve/README.md

@@ -49,7 +49,8 @@ end of the walkthrough has somewhere to land.
 
 ## Bands
 
-Real output, from `chant carve advise` at chant 0.44.7. Reproduce it with:
+Real output, from `chant carve advise` (first cut at chant 0.44.7, verified
+identical at 0.52.1). Reproduce it with:
 
 ```sh
 npm install -D @cdktf/hcl2json          # once, anywhere on your PATH resolution
@@ -119,8 +120,8 @@ chant carve advise --from example-carve/legacy-tf \
 
 from the repository root, so the `from` field stays a relative path.
 
-`app/` pins chant ^0.44.7 and that floor is load-bearing, not housekeeping, in
-two layers. The advisor only publishes a top-level `version: 1` and
+`app/` pins chant ^0.52.1, and the 0.44.7 floor it grew from was load-bearing,
+not housekeeping, in two layers. The advisor only publishes a top-level `version: 1` and
 per-resource `boundary` edge lists from 0.44.6 (chant#1636) — run the same
 command on 0.44.4 and every score is identical but no resource carries a
 `boundary` field at all, so the Pick step falls back to naming inbound/outbound
@@ -131,8 +132,8 @@ bucket scores 84 instead of 88 and the report's `patchOnCarve` list names
 fold is applied, not just reported (chant#1637), so the emitted bucket actually
 carries `VersioningConfiguration` and `PublicAccessBlockConfiguration` instead
 of leaving them in an "unmapped attributes" comment. The committed report above
-is byte-identical to what 0.44.7 regenerates, which is why the demo's fallback
-path and its fresh-run path show the same picture.
+is byte-identical to what 0.44.7 regenerates — re-verified at 0.52.1 — which is
+why the demo's fallback path and its fresh-run path show the same picture.
 
 ## The six beats
 
@@ -162,6 +163,26 @@ Then the box slides out of the Terraform half and into `app/`, beside the log
 group and the SSM parameter that made the same trip last month. Around two
 minutes end to end.
 
+## What the copy remembers
+
+Every beat above writes to `app/carveout/aws_s3_bucket-assets.carve.json` —
+chant's carve state manifest (chant ≥ 0.52.2). `carve emit` creates it, `carve
+bridge` adds its record, `carve apply` adds the ownership marker, and behold
+reads it back on every request without ever writing to it.
+
+That is why the walkthrough survives a reload. After Emit, the bucket's card
+stays in its band but repaints in the in-flight blue and reads `emitted — not
+bridged`; after Bridge, `bridged — apply is yours`. Restart the server and it
+still says so. Run `chant carve apply` yourself in the copy and the card leaves
+the Terraform bands for the `app — chant` box, keeping its Terraform address,
+and the panel counts `carved so far — 1 of 12 carved`.
+
+`carve apply` is the one beat that has no button — not in the stepper, not on
+the API. It resolves the marker that makes chant the owner of a live resource,
+which is a decision that stays with the person at the terminal. The Handoff
+step echoes the command beside the two `terraform` ones, for the same reason
+and in the same shape.
+
 ## Two tiers
 
 **Offline is the default.** The synthetic `terraform.tfstate` is committed, so
@@ -180,11 +201,13 @@ it the carved bucket is simply gone from Terraform's world — `0 to destroy`.
 The line the tier exists for is "Terraform forgot it, chant adopted it, and it
 never blinked."
 
-One beat stays caption rather than footage for now: `chant lifecycle diff
---live` reading the bucket clean while Terraform still owns it. chant's AWS
-observe is CFN-stack-scoped by logical id, so a Terraform-owned resource reads
-confirmed-missing regardless of its existence — chant#1647 tracks the
-physical-identity read path that unlocks it.
+The observe beat is footage now, not caption: after Emit, "▶ watch chant read
+it live" runs `chant lifecycle diff prod --live` in the carveout with the
+endpoint pointed at the scratch Floci, and the bucket reads OBSERVED —
+`EXTERNAL`, ownership `foreign` — while Terraform still owns it. That is
+chant#1647's physical-identity read path (chant ≥ 0.44.12): stack-absent no
+longer means confirmed-absent when the declared `BucketName` names the
+resource precisely.
 
 The live tier needs `docker` and `terraform` on PATH, boots its own throwaway
 Floci and deletes it after, and never touches an existing `floci*` container.