@intentius/behold 0.11.0 → 0.12.0

package/dist/cli.js

@@ -716,11 +716,11 @@ async function createK8sClient(options = {}) {
     }
     return void 0;
   }
-  async function resolve8(selector, signal) {
+  async function resolve9(selector, signal) {
     return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
   }
   async function resolveOrThrow(selector, signal) {
-    const info = await resolve8(selector, signal);
+    const info = await resolve9(selector, signal);
     if (!info) throw new UnknownResourceError(selectorText(selector));
     return info;
   }
@@ -732,7 +732,7 @@ async function createK8sClient(options = {}) {
     return parts.join("/");
   }
   async function pathFor(ref, signal) {
-    const info = await resolve8({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    const info = await resolve9({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
     if (!info) return void 0;
     return objectPath(info, ref.name, ref.namespace);
   }
@@ -847,7 +847,7 @@ async function createK8sClient(options = {}) {
   return {
     provenance,
     defaultNamespace,
-    resolve: resolve8,
+    resolve: resolve9,
     read,
     pathFor,
     readIfPresent,
@@ -1038,8 +1038,8 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve7, dirname as dirname6, join as join18 } from "node:path";
-import { realpathSync, existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync2 } from "node:fs";
+import { resolve as resolve8, dirname as dirname7, join as join20 } from "node:path";
+import { realpathSync, existsSync as existsSync14, readFileSync as readFileSync16, rmSync as rmSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
 
@@ -1120,8 +1120,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "node:fs";
-import { basename, dirname as dirname4, join as join16, relative as relative3, resolve as resolve5, sep as sep4 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { basename, dirname as dirname5, join as join18, relative as relative4, resolve as resolve6, sep as sep4 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -1310,6 +1310,8 @@ function detectProjectShape(projectDir) {
 }
 
 // node_modules/@intentius/chant/src/yaml.ts
+var KEY_LINE = /^(\s*)([^\s:][^:]*?):(?=\s|$)\s*(.*)$/;
+var ITEM_KEY = /^([^\s:][^:]*?):(?=\s|$)\s*(.*)$/;
 function parseYAML(content) {
   try {
     return JSON.parse(content);
@@ -1385,7 +1387,7 @@ function parseYAMLLines(lines, startIndex, baseIndent) {
     const indent = line.search(/\S/);
     if (indent < baseIndent) break;
     if (indent > baseIndent && startIndex > 0) break;
-    const keyMatch = line.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
+    const keyMatch = line.match(KEY_LINE);
     if (keyMatch) {
       const key = keyMatch[2].trim();
       const inlineValue = keyMatch[3].trim();
@@ -1518,7 +1520,7 @@ function parseYAMLArray(lines, startIndex, baseIndent) {
     if (itemMatch && indent === baseIndent) {
       const itemValue = itemMatch[2].trim();
       const isQuotedScalar = itemValue.startsWith('"') && itemValue.endsWith('"') || itemValue.startsWith("'") && itemValue.endsWith("'");
-      const kvMatch = !isQuotedScalar && itemValue.match(/^([^\s:][^:]*?):\s*(.*)$/);
+      const kvMatch = !isQuotedScalar && itemValue.match(ITEM_KEY);
       if (kvMatch) {
         const obj = {};
         obj[kvMatch[1].trim()] = parseArrayItemValue(kvMatch[2].trim(), lines, i, indent + 2);
@@ -1534,7 +1536,7 @@ function parseYAMLArray(lines, startIndex, baseIndent) {
           const ni = nextLine.search(/\S/);
           if (ni < nextIndent) break;
           if (ni > nextIndent) break;
-          const nextKV = nextLine.match(/^(\s*)([^\s:][^:]*?):\s*(.*)$/);
+          const nextKV = nextLine.match(KEY_LINE);
           if (nextKV) {
             const nextVal = nextKV[3].trim();
             obj[nextKV[2].trim()] = parseArrayItemValue(nextVal, lines, j, ni);
@@ -1572,13 +1574,68 @@ function parseScalar(value) {
   if (value === "" || value === "~" || value === "null") return null;
   if (value === "true" || value === "yes") return true;
   if (value === "false" || value === "no") return false;
-  if (value.startsWith("'") && value.endsWith("'") || value.startsWith('"') && value.endsWith('"')) {
-    return value.slice(1, -1);
+  if (value.length >= 2) {
+    if (value.startsWith('"') && value.endsWith('"')) {
+      const unescaped = unescapeDoubleQuoted(value.slice(1, -1));
+      return unescaped ?? value.slice(1, -1);
+    }
+    if (value.startsWith("'") && value.endsWith("'")) {
+      return value.slice(1, -1).replace(/''/g, "'");
+    }
   }
   const num = Number(value);
   if (!isNaN(num) && value !== "") return num;
   return value;
 }
+var DQ_ESCAPES = {
+  "0": "\0",
+  a: "\x07",
+  b: "\b",
+  t: "	",
+  "	": "	",
+  n: "\n",
+  v: "\v",
+  f: "\f",
+  r: "\r",
+  e: "\x1B",
+  " ": " ",
+  '"': '"',
+  "/": "/",
+  "\\": "\\",
+  N: "\x85",
+  _: "\xA0",
+  L: "\u2028",
+  P: "\u2029"
+};
+function unescapeDoubleQuoted(body) {
+  let out = "";
+  for (let i = 0; i < body.length; i++) {
+    const ch = body[i];
+    if (ch === '"') return null;
+    if (ch !== "\\") {
+      out += ch;
+      continue;
+    }
+    const esc = body[++i];
+    if (esc === void 0) return null;
+    const width = esc === "x" ? 2 : esc === "u" ? 4 : esc === "U" ? 8 : 0;
+    if (width > 0) {
+      const hex = body.slice(i + 1, i + 1 + width);
+      if (hex.length < width || !/^[0-9a-fA-F]+$/.test(hex)) return null;
+      out += String.fromCodePoint(parseInt(hex, 16));
+      i += width;
+      continue;
+    }
+    if (esc === "\n") {
+      while (body[i + 1] === " " || body[i + 1] === "	") i++;
+      continue;
+    }
+    const mapped = DQ_ESCAPES[esc];
+    if (mapped === void 0) return null;
+    out += mapped;
+  }
+  return out;
+}
 
 // src/chant.ts
 function envOverridesFor(opts) {
@@ -1836,6 +1893,25 @@ function lifecycleDiffArgs(env) {
 function lifecycleDiffLive(projectDir, env, opts = {}) {
   return runChantJson(lifecycleDiffArgs(env), projectDir, envOverridesFor(opts));
 }
+function helmRendersArgs() {
+  return ["helm", "renders", "--json"];
+}
+function helmRenders(projectDir, opts = {}) {
+  return runChantJson(helmRendersArgs(), projectDir, envOverridesFor(opts));
+}
+function helmRenderDiffArgs(contentDigest, env) {
+  return ["helm", "diff", contentDigest, env, "--live", "--json"];
+}
+async function helmRenderDiffLive(projectDir, contentDigest, env, opts = {}) {
+  const args = helmRenderDiffArgs(contentDigest, env);
+  const { code, stdout } = await runChantRaw(args, projectDir, envOverridesFor(opts));
+  if (code !== 0) return void 0;
+  try {
+    return JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+}
 function applyArgs(target, env) {
   return ["run", target, "--components", "--env", env, "--progress-json"];
 }
@@ -2042,19 +2118,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve8) => {
+var defaultGhExec = (args) => new Promise((resolve9) => {
   let out = "";
   let proc;
   try {
     proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve8({ code: 127, out: "" });
+    resolve9({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve8({ code: 127, out }));
-  proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
+  proc.on("error", () => resolve9({ code: 127, out }));
+  proc.on("close", (code) => resolve9({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -2598,181 +2674,602 @@ function applyHelmArtifacts(ir, observed) {
   return { charts, installed };
 }
 
-// src/cluster-anchor.ts
-var MANAGED_CLUSTER_KINDS = /* @__PURE__ */ new Set([
-  "AWS::EKS::Cluster",
-  "GCP::Container::Cluster",
-  "Microsoft.ContainerService/managedClusters",
-  "K3d::Cluster"
-]);
-var ANCHOR_VIA = "runs-on";
-function metadata(node) {
-  const m = node.attrs?.metadata;
-  return m && typeof m === "object" && !Array.isArray(m) ? m : void 0;
-}
-function metaString(node, key) {
-  const v = metadata(node)?.[key];
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function isK8s(node) {
-  return node.lexicon === "k8s";
-}
-function isNamespace(node) {
-  return node.kind === "K8s::Core::Namespace";
-}
-function managedClusterName(node) {
-  const metaName = metaString(node, "name");
-  if (metaName) return metaName;
-  for (const key of ["name", "clusterName"]) {
-    const v = node.attrs?.[key];
-    if (typeof v === "string" && v.length > 0) return v;
+// src/estate.ts
+import { statSync as statSync3 } from "node:fs";
+import { availableParallelism } from "node:os";
+import { join as join7, resolve as resolve3, sep } from "node:path";
+import { composeStacks, shortStackNames } from "@intentius/pinhole";
+
+// src/member-ir.ts
+import { createHash } from "node:crypto";
+import { readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { join as join6, relative, resolve as resolve2 } from "node:path";
+var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+function memberIrCacheSize(env = process.env) {
+  const override = Number.parseInt(env.BEHOLD_ESTATE_IR_CACHE ?? "", 10);
+  return Number.isInteger(override) && override >= 0 ? override : 64;
+}
+function memberSourceStamp(dir) {
+  const root = resolve2(dir);
+  const h = createHash("sha1");
+  let any = false;
+  const walk = (at) => {
+    const entries = readdirSync3(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
+    for (const e of entries) {
+      if (SKIP.has(e.name)) continue;
+      const path = join6(at, e.name);
+      if (e.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      const st = statSync2(path);
+      h.update(`${relative(root, path)}\0${st.mtimeMs}\0${st.size}
+`);
+      any = true;
+    }
+  };
+  try {
+    walk(root);
+  } catch {
+    return void 0;
   }
-  return node.id;
+  return any ? h.digest("hex") : void 0;
 }
-function boundManagedCluster(nodes, boundContext) {
-  const clusters = nodes.filter((n) => MANAGED_CLUSTER_KINDS.has(n.kind));
-  if (clusters.length === 1) return clusters[0];
-  if (clusters.length === 0 || !boundContext) return void 0;
-  const bound = clusters.filter((n) => contextBindsCluster(boundContext, managedClusterName(n)));
-  return bound.length === 1 ? bound[0] : void 0;
+function cacheKey(dir, opts) {
+  const chant = resolveChant(dir);
+  const canonical = JSON.stringify(opts, Object.keys(opts).sort());
+  return `${resolve2(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
 }
-function addClusterAnchorEdges(ir, boundContext) {
-  const nodes = ir.nodes;
-  const cluster = boundManagedCluster(ir.nodes, boundContext);
-  if (!cluster) return ir;
-  const k8sNodes = nodes.filter(isK8s);
-  if (k8sNodes.length === 0) return ir;
-  const namespaceByName = /* @__PURE__ */ new Map();
-  for (const n of k8sNodes) {
-    if (!isNamespace(n)) continue;
-    const name = metaString(n, "name");
-    if (name && !namespaceByName.has(name)) namespaceByName.set(name, n.id);
-  }
-  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
-  const add = (from, to) => {
-    if (from === to) return;
-    const key = `${from}\0${to}`;
-    if (existing.has(key)) return;
-    existing.add(key);
-    ir.edges.push({ from, to, kind: "ref", viaAttr: ANCHOR_VIA, inferred: true });
-  };
-  for (const n of k8sNodes) {
-    if (isNamespace(n)) {
-      add(cluster.id, n.id);
-      continue;
-    }
-    const ns = metaString(n, "namespace");
-    const nsNode = ns ? namespaceByName.get(ns) : void 0;
-    add(nsNode ?? cluster.id, n.id);
+var cache = /* @__PURE__ */ new Map();
+var hits = 0;
+var misses = 0;
+function invalidateMember(dir) {
+  if (dir === void 0) {
+    cache.clear();
+    return;
   }
-  return ir;
+  const root = resolve2(dir);
+  for (const [key, entry] of cache) if (entry.dir === root) cache.delete(key);
+}
+async function memberIr(dir, opts = {}) {
+  const size = memberIrCacheSize();
+  if (opts.live || opts.overlay || size === 0) return graphIr(dir, opts);
+  const stamp = memberSourceStamp(dir);
+  const key = cacheKey(dir, opts);
+  const hit = stamp !== void 0 ? cache.get(key) : void 0;
+  if (hit && hit.stamp === stamp) {
+    hits++;
+    cache.delete(key);
+    cache.set(key, hit);
+    return structuredClone(hit.ir);
+  }
+  misses++;
+  const ir = await graphIr(dir, opts);
+  if (stamp === void 0 || memberSourceStamp(dir) !== stamp) return ir;
+  cache.delete(key);
+  cache.set(key, { dir: resolve2(dir), stamp, ir });
+  for (const oldest of cache.keys()) {
+    if (cache.size <= size) break;
+    cache.delete(oldest);
+  }
+  return structuredClone(ir);
 }
 
-// src/logical-azure.ts
-var AZURE_HEADLINE_KINDS = /* @__PURE__ */ new Set([
-  // compute / workloads
-  "Microsoft.Compute/virtualMachines",
-  "Microsoft.Compute/virtualMachineScaleSets",
-  "Microsoft.ContainerService/managedClusters",
-  "Microsoft.ContainerInstance/containerGroups",
-  "Microsoft.Web/sites",
-  // network edge
-  "Microsoft.Network/publicIPAddresses",
-  "Microsoft.Network/loadBalancers",
-  "Microsoft.Network/applicationGateways",
-  "Microsoft.Network/natGateways",
-  "Microsoft.Network/dnsZones",
-  // data stores
-  "Microsoft.Storage/storageAccounts",
-  "Microsoft.Sql/servers",
-  "Microsoft.DocumentDB/databaseAccounts",
-  "Microsoft.Cache/redis",
-  "Microsoft.DBforPostgreSQL/flexibleServers",
-  // registry / identity edge
-  "Microsoft.ContainerRegistry/registries"
-]);
-var AZURE_FABRIC_KINDS = /* @__PURE__ */ new Set([
-  "Microsoft.Network/virtualNetworks",
-  "Microsoft.Network/virtualNetworks_subnets",
-  "Microsoft.Network/networkSecurityGroups",
-  "Microsoft.Network/routeTables",
-  "Microsoft.Network/networkInterfaces",
-  // identity/authorization hubs — a role assignment or managed identity is
-  // referenced by half the estate, so contracting through one invents edges
-  // between unrelated resources.
-  "Microsoft.Authorization/roleAssignments",
-  "Microsoft.ManagedIdentity/userAssignedIdentities",
-  "Microsoft.KeyVault/vaults"
-]);
-var VNET_KIND = "Microsoft.Network/virtualNetworks";
-var SUBNET_KIND = "Microsoft.Network/virtualNetworks_subnets";
-var NSG_KIND = "Microsoft.Network/networkSecurityGroups";
-var RESOURCE_ID_RE = /resourceId\(\s*([^)]*)\)/g;
-var QUOTED_RE = /'([^']*)'/g;
-function resourceIdNames(value) {
-  if (typeof value !== "string" || !value.includes("resourceId(")) return [];
-  const out = [];
-  for (const call of value.matchAll(RESOURCE_ID_RE)) {
-    const args = [...call[1].matchAll(QUOTED_RE)].map((m) => m[1]);
-    if (args.length >= 2) out.push(args[args.length - 1]);
+// src/zoom-notes.ts
+function zoomNote(zoom, ir, compositeEdgesAttached) {
+  const empty = ir.nodes.length === 0;
+  if (zoom === "components") {
+    return empty ? "no components discovered \u2014 nothing declares one in this project" : void 0;
   }
-  return out;
-}
-function collectAzureRefs(value, out) {
-  if (value === null || typeof value !== "object") {
-    for (const name of resourceIdNames(value)) out.add(name);
-    return;
+  if (zoom === "logical") {
+    return empty ? "logical is an AWS projection \u2014 no AWS resources in this estate" : void 0;
   }
-  const ref = value.$ref;
-  if (typeof ref === "string") out.add(ref.split(".")[0]);
-  for (const v of Object.values(value)) collectAzureRefs(v, out);
+  if (zoom === "composites") {
+    return compositeEdgesAttached === 0 ? "no component ownership to join \u2014 showing the resource graph unchanged" : void 0;
+  }
+  if (zoom === "runtime") {
+    const children = ir.nodes.filter((n) => n.runtimeOwner).length;
+    return children === 0 ? "nothing below the declaration boundary \u2014 no owner-referenced children on this substrate" : void 0;
+  }
+  return void 0;
 }
-function strAttr(node, key) {
-  const v = node.attrs?.[key];
-  return typeof v === "string" ? v : void 0;
+function logicalKept(before, after) {
+  if (after > 0 && after * 3 >= before) return void 0;
+  return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
 }
-function resourceName(node) {
-  return strAttr(node, "name");
+function edgelessNote(zoom, ir, detail) {
+  if (zoom === "components" || zoom === "logical") return void 0;
+  if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
+  if (detail !== void 0 && detail < 3) {
+    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
+  }
+  return "no edges \u2014 nothing in this estate references anything else";
 }
-function subnetVnetName(node) {
-  const name = resourceName(node);
-  if (!name || !name.includes("/")) return void 0;
-  return name.split("/")[0];
+var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
+  "K8s::Core::Namespace",
+  "K8s::Rbac::ClusterRole",
+  "K8s::Rbac::ClusterRoleBinding",
+  "K8s::Storage::StorageClass",
+  "K8s::Apiextensions::CustomResourceDefinition"
+]);
+function namespaceMismatchNote(nodes) {
+  const k8s = nodes.filter((n) => n?.lexicon === "k8s");
+  if (k8s.length === 0) return void 0;
+  const pending = k8s.filter((n) => n.attrs?._status === "accent" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (pending.length < 2) return void 0;
+  if (pending.some((n) => typeof n.attrs?.metadata?.namespace === "string" && n.attrs.metadata.namespace)) return void 0;
+  if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
+  return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
 }
-function subnetShortName(node) {
-  const name = resourceName(node);
-  return name?.includes("/") ? name.split("/").slice(1).join("/") : name;
+function namespaceJoinNote(joined) {
+  if (joined.length === 0) return void 0;
+  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
+  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
 }
-function vnetCidr(node) {
-  const space = node.attrs?.addressSpace;
-  const prefixes = space?.addressPrefixes;
-  return Array.isArray(prefixes) && typeof prefixes[0] === "string" ? prefixes[0] : void 0;
+function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
+  const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
+  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
+  return notes.length ? notes.join(" \xB7 ") : void 0;
 }
-function projectAzureLogical(ir, env) {
-  const azure = ir.nodes.filter((n) => n.lexicon === "azure");
-  if (azure.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
-  const componentOf = componentNamer(azure);
-  const byId = new Map(azure.map((n) => [n.id, n]));
-  const byName = /* @__PURE__ */ new Map();
-  for (const n of azure) {
-    const name = resourceName(n);
-    if (name && !byName.has(name)) byName.set(name, n);
-  }
-  const vnets = azure.filter((n) => n.kind === VNET_KIND);
-  const subnets = azure.filter((n) => n.kind === SUBNET_KIND);
-  const vnetByName = new Map(vnets.map((v) => [resourceName(v) ?? v.id, v]));
-  const refOut = /* @__PURE__ */ new Map();
-  for (const n of azure) {
-    const names = /* @__PURE__ */ new Set();
-    collectAzureRefs(n.attrs, names);
-    const targets = /* @__PURE__ */ new Set();
-    for (const name of names) {
-      const target = byName.get(name) ?? byId.get(name);
-      if (target && target.id !== n.id) targets.add(target.id);
-    }
-    if (targets.size) refOut.set(n.id, targets);
+function tierMismatchNote(ir, tiers, currentTier) {
+  const values = tiers?.values ?? [];
+  if (values.length < 2) return void 0;
+  const byLexicon = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    const status = n.attrs?._status;
+    if (status !== "good" && status !== "accent") continue;
+    const lexicon = n.lexicon ?? "?";
+    const c = byLexicon.get(lexicon) ?? { good: 0, accent: 0 };
+    c[status === "good" ? "good" : "accent"]++;
+    byLexicon.set(lexicon, c);
   }
-  for (const e of ir.edges) {
+  for (const [lexicon, { good, accent }] of [...byLexicon].sort()) {
+    if (accent < 2 || accent * 2 < good + accent) continue;
+    const here = currentTier ? `tier "${currentTier}"` : "the default tier";
+    const others = values.filter((v) => v !== currentTier).join(", ");
+    return `${accent} of ${good + accent} ${lexicon} resources read "declared, not deployed" at ${here} \u2014 if the estate runs another declared tier (${others}), pick it (\u2318K \u2192 tier)`;
+  }
+  return void 0;
+}
+
+// src/estate.ts
+function estateReadPool(members, env = process.env) {
+  const override = Number.parseInt(env.BEHOLD_ESTATE_CONCURRENCY ?? "", 10);
+  const cap = Number.isInteger(override) && override >= 1 ? override : Math.min(4, availableParallelism());
+  return Math.max(1, Math.min(cap, members));
+}
+async function mapPool(items, width, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    for (let i = next++; i < items.length; i = next++) {
+      results[i] = await fn(items[i], i);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(width, items.length)) }, () => worker()));
+  return results;
+}
+async function composeEstate(projectDirs, opts = {}) {
+  const names = shortStackNames(projectDirs);
+  const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
+    name: names[i],
+    ir: await memberIr(dir, opts)
+  }));
+  return composeStacks(stacks);
+}
+var firstLine2 = (e) => {
+  const msg = e instanceof Error ? e.message : String(e);
+  const m = msg.match(/exited \d+:\s*([\s\S]*)/);
+  return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
+};
+function namespaceRuntimeOwners(name, ir) {
+  const own = new Set(ir.nodes.map((n) => n.id));
+  for (const n of ir.nodes) {
+    if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
+  }
+  return ir;
+}
+var NAMESPACE_JOIN_FLOOR = "0.44.5";
+var rec2 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+var str2 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+var realIsDir = (p) => {
+  try {
+    return statSync3(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+function declaredNamespaceBindings(ir) {
+  const out = [];
+  for (const n of ir.nodes) {
+    if (n.kind !== "K8s::Flux::Kustomization") continue;
+    const spec = rec2(n.attrs?.spec);
+    const namespace = str2(spec?.targetNamespace);
+    const path = str2(spec?.path);
+    if (namespace && path) out.push({ path, namespace });
+  }
+  return out;
+}
+function awaitsNamespaceBinding(ir) {
+  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (namespaced.length === 0) return false;
+  return namespaced.every((n) => !str2(rec2(n.attrs?.metadata)?.namespace));
+}
+function declaredSegments(path) {
+  if (path.startsWith("/")) return void 0;
+  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
+  if (segs.length === 0 || segs.includes("..")) return void 0;
+  return segs;
+}
+function pathAlignment(declared, dir, isDir = realIsDir) {
+  const want = declaredSegments(declared);
+  if (!want) return 0;
+  const root = resolve3(dir);
+  const have = root.split(sep).filter(Boolean);
+  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
+    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
+    if (!isDir(join7(root, ...want.slice(k)))) continue;
+    return k;
+  }
+  return 0;
+}
+function joinNamespaceBindings(members, isDir = realIsDir) {
+  const bindings = members.flatMap(
+    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
+  );
+  if (bindings.length === 0) return [];
+  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
+  if (awaiting.length === 0) return [];
+  const best = /* @__PURE__ */ new Map();
+  for (const b of bindings) {
+    let winner;
+    let tied = false;
+    for (const m of awaiting) {
+      if (m.dir === b.declaredBy) continue;
+      const score = pathAlignment(b.path, m.dir, isDir);
+      if (score === 0) continue;
+      if (!winner || score > winner.score) {
+        winner = { dir: m.dir, score };
+        tied = false;
+      } else if (score === winner.score) {
+        tied = true;
+      }
+    }
+    if (!winner || tied) continue;
+    const prev = best.get(winner.dir);
+    if (prev === "ambiguous") continue;
+    const join21 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join21 });
+    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join21 });
+  }
+  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
+}
+async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
+  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
+  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
+  const irs = await mapPool(
+    projectDirs,
+    estateReadPool(projectDirs.length),
+    (dir) => memberIr(dir, { ...src, detail: 3 }).catch(() => void 0)
+  );
+  const scopes = /* @__PURE__ */ new Map();
+  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
+    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
+    scopes.set(j.dir, j.namespace);
+  }
+  return scopes;
+}
+function withoutJoinedMembers(nodes, joined) {
+  if (joined.length === 0) return [...nodes];
+  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
+}
+async function composeEstateOverlay(projectDirs, opts, classify) {
+  const names = shortStackNames(projectDirs);
+  const unobserved = [];
+  const dropped = [];
+  const joined = [];
+  const stacks = new Array(projectDirs.length);
+  const scopes = await estateNamespaceScopes(projectDirs, opts);
+  await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => {
+    const name = names[i];
+    const namespace = scopes.get(dir);
+    try {
+      const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
+      stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
+      if (namespace) joined.push({ name, namespace });
+    } catch (err) {
+      const reason = firstLine2(err);
+      try {
+        const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
+        const src = await memberIr(dir, srcOpts);
+        for (const n of src.nodes) n.attrs = { ...n.attrs, _status: "neutral", _unobserved: reason };
+        stacks[i] = { name, ir: src };
+        unobserved.push({ name, reason });
+      } catch (err2) {
+        dropped.push({ name, reason: firstLine2(err2) });
+      }
+    }
+  });
+  const present = stacks.filter((s) => !!s);
+  return {
+    ir: composeStacks(present),
+    observed: present.length - unobserved.length,
+    total: projectDirs.length,
+    unobserved,
+    dropped,
+    // Concurrent reads finish in whatever order the clusters answer; the note
+    // this feeds should read the same twice.
+    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
+  };
+}
+
+// src/helm-drift.ts
+function countChanges(docs) {
+  return docs.reduce((n, d) => n + d.changes.length, 0);
+}
+function provenanceOf(live) {
+  const m = live.manifest;
+  return {
+    contentDigest: m.contentDigest,
+    inputDigest: m.inputDigest,
+    valuesDigest: m.valuesDigest,
+    chart: m.chart,
+    chartVersion: m.chartVersion,
+    repo: m.repo,
+    releaseName: m.releaseName,
+    namespace: m.namespace,
+    profile: m.capabilityProfile?.cluster ?? "",
+    kubeVersion: m.capabilityProfile?.kubeVersion ?? "",
+    renderedAt: m.renderedAt,
+    helmVersion: m.helmVersion,
+    chantVersion: m.chantVersion,
+    sourceRef: m.sourceRef
+  };
+}
+function helmRenderReport(record, live) {
+  const base = { render: record.name, chart: record.chart };
+  if (!live) {
+    return { ...base, verdict: "unobserved", reason: record.contentDigest ? "no-stored-render" : "unpinned" };
+  }
+  const d = live.diff;
+  const counts = {
+    drifted: d.drifted.length,
+    changes: countChanges(d.drifted),
+    unchanged: d.unchanged.length,
+    unobserved: d.unobserved.length,
+    undeclared: d.undeclaredEntities.length
+  };
+  const provenance = provenanceOf(live);
+  if (d.drifted.length > 0) {
+    return { ...base, verdict: "drifted", counts, provenance, drifted: d.drifted };
+  }
+  if (d.drifted.length + d.accepted.length + d.unchanged.length === 0) {
+    return { ...base, verdict: "unobserved", reason: "nothing-observed", counts, provenance };
+  }
+  if (d.unobserved.length > 0) {
+    return { ...base, verdict: "unobserved", reason: "partly-observed", counts, provenance };
+  }
+  return { ...base, verdict: "in-sync", counts, provenance };
+}
+async function readHelmRenderDrift(projectDir, env, opts = {}) {
+  const report = await helmRenders(projectDir, opts).catch(() => void 0);
+  const records = report?.records ?? [];
+  if (records.length === 0) return [];
+  return mapPool(records, estateReadPool(records.length), async (record) => {
+    if (!record.contentDigest) return helmRenderReport(record, void 0);
+    const live = await helmRenderDiffLive(projectDir, record.contentDigest, env, opts).catch(() => void 0);
+    return helmRenderReport(record, live);
+  });
+}
+function chartNameOf2(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+var SEVERITY = { drifted: 2, unobserved: 1, "in-sync": 0 };
+function applyHelmRenderDrift(ir, reports) {
+  if (reports.length === 0) return { charts: 0, drifted: 0 };
+  const byChart = /* @__PURE__ */ new Map();
+  for (const r of reports) {
+    const list3 = byChart.get(r.chart);
+    if (list3) list3.push(r);
+    else byChart.set(r.chart, [r]);
+  }
+  let charts = 0;
+  let drifted = 0;
+  for (const node of ir.nodes) {
+    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
+    const chartName = chartNameOf2(node);
+    const matched = chartName ? byChart.get(chartName) : void 0;
+    if (!matched || matched.length === 0) continue;
+    const worst = matched.reduce((a, b) => SEVERITY[b.verdict] > SEVERITY[a.verdict] ? b : a);
+    const attrs = node.attrs ??= {};
+    attrs._renderDrift = matched.length === 1 ? worst : { ...worst, renders: matched };
+    charts++;
+    if (worst.verdict === "drifted") {
+      attrs._status = "warn";
+      drifted++;
+    }
+  }
+  return { charts, drifted };
+}
+
+// src/cluster-anchor.ts
+var MANAGED_CLUSTER_KINDS = /* @__PURE__ */ new Set([
+  "AWS::EKS::Cluster",
+  "GCP::Container::Cluster",
+  "Microsoft.ContainerService/managedClusters",
+  "K3d::Cluster"
+]);
+var ANCHOR_VIA = "runs-on";
+function metadata(node) {
+  const m = node.attrs?.metadata;
+  return m && typeof m === "object" && !Array.isArray(m) ? m : void 0;
+}
+function metaString(node, key) {
+  const v = metadata(node)?.[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isK8s(node) {
+  return node.lexicon === "k8s";
+}
+function isNamespace(node) {
+  return node.kind === "K8s::Core::Namespace";
+}
+function managedClusterName(node) {
+  const metaName = metaString(node, "name");
+  if (metaName) return metaName;
+  for (const key of ["name", "clusterName"]) {
+    const v = node.attrs?.[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return node.id;
+}
+function boundManagedCluster(nodes, boundContext) {
+  const clusters = nodes.filter((n) => MANAGED_CLUSTER_KINDS.has(n.kind));
+  if (clusters.length === 1) return clusters[0];
+  if (clusters.length === 0 || !boundContext) return void 0;
+  const bound = clusters.filter((n) => contextBindsCluster(boundContext, managedClusterName(n)));
+  return bound.length === 1 ? bound[0] : void 0;
+}
+function addClusterAnchorEdges(ir, boundContext) {
+  const nodes = ir.nodes;
+  const cluster = boundManagedCluster(ir.nodes, boundContext);
+  if (!cluster) return ir;
+  const k8sNodes = nodes.filter(isK8s);
+  if (k8sNodes.length === 0) return ir;
+  const namespaceByName = /* @__PURE__ */ new Map();
+  for (const n of k8sNodes) {
+    if (!isNamespace(n)) continue;
+    const name = metaString(n, "name");
+    if (name && !namespaceByName.has(name)) namespaceByName.set(name, n.id);
+  }
+  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  const add = (from, to) => {
+    if (from === to) return;
+    const key = `${from}\0${to}`;
+    if (existing.has(key)) return;
+    existing.add(key);
+    ir.edges.push({ from, to, kind: "ref", viaAttr: ANCHOR_VIA, inferred: true });
+  };
+  for (const n of k8sNodes) {
+    if (isNamespace(n)) {
+      add(cluster.id, n.id);
+      continue;
+    }
+    const ns = metaString(n, "namespace");
+    const nsNode = ns ? namespaceByName.get(ns) : void 0;
+    add(nsNode ?? cluster.id, n.id);
+  }
+  return ir;
+}
+
+// src/logical-azure.ts
+var AZURE_HEADLINE_KINDS = /* @__PURE__ */ new Set([
+  // compute / workloads
+  "Microsoft.Compute/virtualMachines",
+  "Microsoft.Compute/virtualMachineScaleSets",
+  "Microsoft.ContainerService/managedClusters",
+  "Microsoft.ContainerInstance/containerGroups",
+  "Microsoft.Web/sites",
+  // network edge
+  "Microsoft.Network/publicIPAddresses",
+  "Microsoft.Network/loadBalancers",
+  "Microsoft.Network/applicationGateways",
+  "Microsoft.Network/natGateways",
+  "Microsoft.Network/dnsZones",
+  // data stores
+  "Microsoft.Storage/storageAccounts",
+  "Microsoft.Sql/servers",
+  "Microsoft.DocumentDB/databaseAccounts",
+  "Microsoft.Cache/redis",
+  "Microsoft.DBforPostgreSQL/flexibleServers",
+  // registry / identity edge
+  "Microsoft.ContainerRegistry/registries"
+]);
+var AZURE_FABRIC_KINDS = /* @__PURE__ */ new Set([
+  "Microsoft.Network/virtualNetworks",
+  "Microsoft.Network/virtualNetworks_subnets",
+  "Microsoft.Network/networkSecurityGroups",
+  "Microsoft.Network/routeTables",
+  "Microsoft.Network/networkInterfaces",
+  // identity/authorization hubs — a role assignment or managed identity is
+  // referenced by half the estate, so contracting through one invents edges
+  // between unrelated resources.
+  "Microsoft.Authorization/roleAssignments",
+  "Microsoft.ManagedIdentity/userAssignedIdentities",
+  "Microsoft.KeyVault/vaults"
+]);
+var VNET_KIND = "Microsoft.Network/virtualNetworks";
+var SUBNET_KIND = "Microsoft.Network/virtualNetworks_subnets";
+var NSG_KIND = "Microsoft.Network/networkSecurityGroups";
+var RESOURCE_ID_RE = /resourceId\(\s*([^)]*)\)/g;
+var QUOTED_RE = /'([^']*)'/g;
+function resourceIdNames(value) {
+  if (typeof value !== "string" || !value.includes("resourceId(")) return [];
+  const out = [];
+  for (const call of value.matchAll(RESOURCE_ID_RE)) {
+    const args = [...call[1].matchAll(QUOTED_RE)].map((m) => m[1]);
+    if (args.length >= 2) out.push(args[args.length - 1]);
+  }
+  return out;
+}
+function collectAzureRefs(value, out) {
+  if (value === null || typeof value !== "object") {
+    for (const name of resourceIdNames(value)) out.add(name);
+    return;
+  }
+  const ref = value.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const v of Object.values(value)) collectAzureRefs(v, out);
+}
+function strAttr(node, key) {
+  const v = node.attrs?.[key];
+  return typeof v === "string" ? v : void 0;
+}
+function resourceName(node) {
+  return strAttr(node, "name");
+}
+function subnetVnetName(node) {
+  const name = resourceName(node);
+  if (!name || !name.includes("/")) return void 0;
+  return name.split("/")[0];
+}
+function subnetShortName(node) {
+  const name = resourceName(node);
+  return name?.includes("/") ? name.split("/").slice(1).join("/") : name;
+}
+function vnetCidr(node) {
+  const space = node.attrs?.addressSpace;
+  const prefixes = space?.addressPrefixes;
+  return Array.isArray(prefixes) && typeof prefixes[0] === "string" ? prefixes[0] : void 0;
+}
+function projectAzureLogical(ir, env) {
+  const azure = ir.nodes.filter((n) => n.lexicon === "azure");
+  if (azure.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const componentOf = componentNamer(azure);
+  const byId = new Map(azure.map((n) => [n.id, n]));
+  const byName = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const name = resourceName(n);
+    if (name && !byName.has(name)) byName.set(name, n);
+  }
+  const vnets = azure.filter((n) => n.kind === VNET_KIND);
+  const subnets = azure.filter((n) => n.kind === SUBNET_KIND);
+  const vnetByName = new Map(vnets.map((v) => [resourceName(v) ?? v.id, v]));
+  const refOut = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const names = /* @__PURE__ */ new Set();
+    collectAzureRefs(n.attrs, names);
+    const targets = /* @__PURE__ */ new Set();
+    for (const name of names) {
+      const target = byName.get(name) ?? byId.get(name);
+      if (target && target.id !== n.id) targets.add(target.id);
+    }
+    if (targets.size) refOut.set(n.id, targets);
+  }
+  for (const e of ir.edges) {
     if (!byId.has(e.from) || !byId.has(e.to)) continue;
     (refOut.get(e.from) ?? refOut.set(e.from, /* @__PURE__ */ new Set()).get(e.from)).add(e.to);
   }
@@ -3088,7 +3585,7 @@ function projectK8sLogical(ir, env, boundContext) {
 function releaseBoxTitle(chartName) {
   return `release ${chartName}`;
 }
-function chartNameOf2(node) {
+function chartNameOf3(node) {
   const name = node.attrs?.name;
   return typeof name === "string" && name.length > 0 ? name : node.id;
 }
@@ -3109,7 +3606,7 @@ function projectHelmLogical(ir) {
   };
   const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
   for (const chart of charts) {
-    const box = releaseBoxTitle(chartNameOf2(chart));
+    const box = releaseBoxTitle(chartNameOf3(chart));
     child(box, chart.id);
     const chartDir = dirOf(chart);
     if (chartDir === "") continue;
@@ -3126,7 +3623,7 @@ function projectHelmLogical(ir) {
 
 // src/logical-kustomize.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
 function overlayBoxTitle(name) {
   return `overlay ${name}`;
 }
@@ -3146,7 +3643,7 @@ function kustomizationRoot(bases, dir, exists) {
   let current = dir;
   for (let i = 0; i < 4 && current; i++) {
     for (const base of bases) {
-      if (exists(join6(base, current, "kustomization.yaml")) || exists(join6(base, current, "kustomization.yml"))) {
+      if (exists(join8(base, current, "kustomization.yaml")) || exists(join8(base, current, "kustomization.yml"))) {
         return current;
       }
     }
@@ -3722,83 +4219,6 @@ function addCompositeDepsCounted(ir, dag) {
   return { ir: out, attached: out.edges.length - before };
 }
 
-// src/zoom-notes.ts
-function zoomNote(zoom, ir, compositeEdgesAttached) {
-  const empty = ir.nodes.length === 0;
-  if (zoom === "components") {
-    return empty ? "no components discovered \u2014 nothing declares one in this project" : void 0;
-  }
-  if (zoom === "logical") {
-    return empty ? "logical is an AWS projection \u2014 no AWS resources in this estate" : void 0;
-  }
-  if (zoom === "composites") {
-    return compositeEdgesAttached === 0 ? "no component ownership to join \u2014 showing the resource graph unchanged" : void 0;
-  }
-  if (zoom === "runtime") {
-    const children = ir.nodes.filter((n) => n.runtimeOwner).length;
-    return children === 0 ? "nothing below the declaration boundary \u2014 no owner-referenced children on this substrate" : void 0;
-  }
-  return void 0;
-}
-function logicalKept(before, after) {
-  if (after > 0 && after * 3 >= before) return void 0;
-  return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
-}
-function edgelessNote(zoom, ir, detail) {
-  if (zoom === "components" || zoom === "logical") return void 0;
-  if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
-  if (detail !== void 0 && detail < 3) {
-    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
-  }
-  return "no edges \u2014 nothing in this estate references anything else";
-}
-var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
-  "K8s::Core::Namespace",
-  "K8s::Rbac::ClusterRole",
-  "K8s::Rbac::ClusterRoleBinding",
-  "K8s::Storage::StorageClass",
-  "K8s::Apiextensions::CustomResourceDefinition"
-]);
-function namespaceMismatchNote(nodes) {
-  const k8s = nodes.filter((n) => n?.lexicon === "k8s");
-  if (k8s.length === 0) return void 0;
-  const pending = k8s.filter((n) => n.attrs?._status === "accent" && !CLUSTER_SCOPED.has(n.kind ?? ""));
-  if (pending.length < 2) return void 0;
-  if (pending.some((n) => typeof n.attrs?.metadata?.namespace === "string" && n.attrs.metadata.namespace)) return void 0;
-  if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
-  return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
-}
-function namespaceJoinNote(joined) {
-  if (joined.length === 0) return void 0;
-  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
-  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
-}
-function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
-  const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
-  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
-  return notes.length ? notes.join(" \xB7 ") : void 0;
-}
-function tierMismatchNote(ir, tiers, currentTier) {
-  const values = tiers?.values ?? [];
-  if (values.length < 2) return void 0;
-  const byLexicon = /* @__PURE__ */ new Map();
-  for (const n of ir.nodes) {
-    const status = n.attrs?._status;
-    if (status !== "good" && status !== "accent") continue;
-    const lexicon = n.lexicon ?? "?";
-    const c = byLexicon.get(lexicon) ?? { good: 0, accent: 0 };
-    c[status === "good" ? "good" : "accent"]++;
-    byLexicon.set(lexicon, c);
-  }
-  for (const [lexicon, { good, accent }] of [...byLexicon].sort()) {
-    if (accent < 2 || accent * 2 < good + accent) continue;
-    const here = currentTier ? `tier "${currentTier}"` : "the default tier";
-    const others = values.filter((v) => v !== currentTier).join(", ");
-    return `${accent} of ${good + accent} ${lexicon} resources read "declared, not deployed" at ${here} \u2014 if the estate runs another declared tier (${others}), pick it (\u2318K \u2192 tier)`;
-  }
-  return void 0;
-}
-
 // src/resources.ts
 var NON_RESOURCE_KINDS = /* @__PURE__ */ new Set(["AWS::CloudFormation::Parameter", "chant:output"]);
 function nonResourceEntities(ir) {
@@ -3830,6 +4250,19 @@ function resourcesByComponent(ir, known) {
 }
 
 // src/reconcile.ts
+var DISRUPTION_SEVERITY = {
+  "in-place": 0,
+  rolling: 1,
+  unknown: 1,
+  replace: 2,
+  destroy: 3
+};
+var DISRUPTION_LEVELS = ["in-place", "rolling", "replace", "destroy", "unknown"];
+function worstDisruption(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return DISRUPTION_SEVERITY[b] > DISRUPTION_SEVERITY[a] ? b : a;
+}
 function summarizePlan(plan, byComponent, nonResource) {
   const componentByEntity = /* @__PURE__ */ new Map();
   for (const [component, resources] of Object.entries(byComponent)) {
@@ -3838,6 +4271,9 @@ function summarizePlan(plan, byComponent, nonResource) {
   const counts = {};
   const unobservedCounts = {};
   const runtimeCounts = {};
+  const disruption = Object.fromEntries(DISRUPTION_LEVELS.map((l) => [l, 0]));
+  const disruptionByComponent = {};
+  let disruptionUncorrelated;
   let uncorrelated = 0;
   let unobservedUncorrelated = 0;
   let runtimeUncorrelated = 0;
@@ -3863,6 +4299,12 @@ function summarizePlan(plan, byComponent, nonResource) {
     total++;
     if (component) counts[component] = (counts[component] ?? 0) + 1;
     else uncorrelated++;
+    const level = entry.disruption;
+    if (!level) continue;
+    if (!DISRUPTION_LEVELS.includes(level)) continue;
+    disruption[level]++;
+    if (component) disruptionByComponent[component] = worstDisruption(disruptionByComponent[component], level);
+    else disruptionUncorrelated = worstDisruption(disruptionUncorrelated, level);
   }
   return {
     env: plan.env,
@@ -3874,7 +4316,10 @@ function summarizePlan(plan, byComponent, nonResource) {
     unobservedUncorrelated,
     runtime,
     runtimeByComponent: runtimeCounts,
-    runtimeUncorrelated
+    runtimeUncorrelated,
+    disruption,
+    disruptionByComponent,
+    ...disruptionUncorrelated ? { disruptionUncorrelated } : {}
   };
 }
 
@@ -3890,10 +4335,10 @@ import {
 
 // src/icon-packs.ts
 import { readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var ICON_ROOT = join7(dirname3(fileURLToPath2(import.meta.url)), "..", "web", "icons");
-var cache = /* @__PURE__ */ new Map();
+var ICON_ROOT = join9(dirname3(fileURLToPath2(import.meta.url)), "..", "web", "icons");
+var cache2 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
 }
@@ -3912,9 +4357,9 @@ function plate(glyph) {
   return { ...glyph, body: `${ground}<g transform="${inset}">${glyph.body}</g>` };
 }
 function loadIcon(rel) {
-  const hit = cache.get(rel);
+  const hit = cache2.get(rel);
   if (hit) return hit;
-  const raw = readFileSync6(join7(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync6(join9(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -3923,7 +4368,7 @@ function loadIcon(rel) {
   if (!viewBox) throw new Error(`vendored icon has no viewBox: ${rel}.svg`);
   const bare = { body: unprefix(raw.slice(openEnd + 1, close).trim()), colored: true, viewBox };
   const glyph = PLATED.has(rel) ? plate(bare) : bare;
-  cache.set(rel, glyph);
+  cache2.set(rel, glyph);
   return glyph;
 }
 var K8S_ICON_BY_KIND = {
@@ -4133,45 +4578,681 @@ function carveReportToIr(report) {
         ...inputs.length ? { deferredInputs: inputs.join(", ") } : {}
       }
     };
-  });
-  const seen = /* @__PURE__ */ new Set();
-  const edges = [];
-  for (const r of resources) {
-    for (const e of boundaryEdgesOf(r)) {
-      const direction = directionOf(e);
-      const from = direction === "inbound" ? e.survivor : e.carved;
-      const to = direction === "inbound" ? e.carved : e.survivor;
-      if (!known.has(from) || !known.has(to)) continue;
-      const key = `${from}|${to}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      edges.push({
-        from,
-        to,
-        kind: "ref",
-        viaAttr: direction,
-        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
-      });
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const edges = [];
+  for (const r of resources) {
+    for (const e of boundaryEdgesOf(r)) {
+      const direction = directionOf(e);
+      const from = direction === "inbound" ? e.survivor : e.carved;
+      const to = direction === "inbound" ? e.carved : e.survivor;
+      if (!known.has(from) || !known.has(to)) continue;
+      const key = `${from}|${to}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      edges.push({
+        from,
+        to,
+        kind: "ref",
+        viaAttr: direction,
+        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
+      });
+    }
+  }
+  const byStack = {};
+  for (const order of ["good", "warn", "neutral"]) {
+    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
+    if (members.length) byStack[verdictForStatus(order)] = members;
+  }
+  return { nodes, edges, groups: { byStack } };
+}
+function carveNote(report, ir) {
+  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
+  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
+  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
+  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
+}
+
+// src/carve-manifest.ts
+import { readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
+import { dirname as dirname4, join as join10 } from "node:path";
+var CARVE_MANIFEST_SUFFIX = ".carve.json";
+var APPLY_IS_HUMAN = "`chant carve apply` graduates ownership \u2014 it resolves the marker that makes chant the owner of a live resource. behold shows what the manifest records and echoes the command; it has no apply endpoint and no apply button, by design. Read the graduation plan, then run it yourself.";
+var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+function parseCarveManifest(value) {
+  if (!isRecord2(value)) return null;
+  if (value.version !== 1) return null;
+  if (typeof value.target !== "string" || !value.target) return null;
+  return value;
+}
+function readCarveManifest(path, readFile = (p) => readFileSync7(p, "utf8")) {
+  let text;
+  try {
+    text = readFile(path);
+  } catch {
+    return null;
+  }
+  try {
+    return parseCarveManifest(JSON.parse(text));
+  } catch {
+    return null;
+  }
+}
+function carveStageOf(m) {
+  if (m.apply) return "applied";
+  if (m.bridge) return "bridged";
+  return "emitted";
+}
+function carveWordFor(stage) {
+  switch (stage) {
+    case "applied":
+      return "carved \u2192 chant";
+    case "bridged":
+      return "bridged \u2014 apply is yours";
+    default:
+      return "emitted \u2014 not bridged";
+  }
+}
+function carveToneFor(stage) {
+  return stage === "applied" ? "good" : "accent";
+}
+function carveStageNote(state) {
+  switch (state.stage) {
+    case "applied":
+      return `graduated \u2014 \`carve apply\` recorded the ownership marker` + (state.ownership?.stack ? ` (stack ${state.ownership.stack}${state.ownership.env ? `, env ${state.ownership.env}` : ""})` : "") + ". chant owns it.";
+    case "bridged":
+      return "emitted and bridged \u2014 the survivor patch is proposed. Terraform still owns the resource until `carve apply`.";
+    default:
+      return "emitted \u2014 typed chant source exists, and the surviving Terraform still reads the resource directly. `carve bridge` is next.";
+  }
+}
+function carveStateOf(m, path) {
+  const stage = carveStageOf(m);
+  const deferred = Object.entries(m.emit?.params ?? {}).map(([name, p]) => `${name} \u2190 ${p?.survivor ?? "a survivor"}`);
+  return {
+    target: m.target,
+    ...m.tfType ? { tfType: m.tfType } : {},
+    stage,
+    graduated: stage === "applied",
+    // The last stamped step wins — that is the age of the state, not the age
+    // of the carve.
+    ...m.apply?.at || m.bridge?.at || m.emit?.at ? { at: m.apply?.at ?? m.bridge?.at ?? m.emit?.at } : {},
+    files: strings(m.emit?.files),
+    excised: strings(m.bridge?.excised),
+    deferredInputs: deferred,
+    ...m.apply ? {
+      ownership: {
+        ...m.apply.marker?.stack ? { stack: m.apply.marker.stack } : {},
+        ...m.apply.marker?.env ? { env: m.apply.marker.env } : {},
+        ...m.apply.ownershipTags ? { tags: m.apply.ownershipTags } : {}
+      }
+    } : {},
+    ...m.from ? { from: m.from } : {},
+    outDir: dirname4(path),
+    path
+  };
+}
+var nodeCarveIo = {
+  readdir: (dir) => readdirSync4(dir),
+  isDirectory: (p) => {
+    try {
+      return statSync4(p).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  readFile: (p) => readFileSync7(p, "utf8")
+};
+var MANIFEST_SCAN_DEPTH = 2;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "cdk.out", ".terraform", ".git"]);
+function listCarveManifests(dir, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
+  const out = [];
+  const walk = (d, level) => {
+    let entries;
+    try {
+      entries = io.readdir(d).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const full = join10(d, name);
+      if (name.endsWith(CARVE_MANIFEST_SUFFIX)) {
+        out.push(full);
+        continue;
+      }
+      if (level >= depth) continue;
+      if (name.startsWith(".") || SKIP_DIRS.has(name)) continue;
+      if (io.isDirectory(full)) walk(full, level + 1);
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+function readCarveStates(dirs, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
+  const rank = { emitted: 0, bridged: 1, applied: 2 };
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const dir of dirs) {
+    for (const path of listCarveManifests(dir, io, depth)) {
+      const manifest = readCarveManifest(path, io.readFile);
+      if (!manifest) continue;
+      const state = carveStateOf(manifest, path);
+      const held = byTarget.get(state.target);
+      if (!held || rank[state.stage] > rank[held.stage]) byTarget.set(state.target, state);
+    }
+  }
+  return byTarget;
+}
+function carveProgress(states, total) {
+  let applied = 0;
+  let bridged = 0;
+  let emitted = 0;
+  for (const s of states) {
+    if (s.stage === "applied") applied++;
+    else if (s.stage === "bridged") bridged++;
+    else emitted++;
+  }
+  const inFlight = bridged + emitted;
+  const parts = [];
+  if (emitted) parts.push(`${emitted} emitted`);
+  if (bridged) parts.push(`${bridged} bridged`);
+  return {
+    applied,
+    bridged,
+    emitted,
+    inFlight,
+    total: typeof total === "number" ? total : null,
+    label: typeof total === "number" ? `${applied} of ${total} carved` : `${applied} carved`,
+    detail: parts.length ? `${parts.join(", ")} \u2014 apply is yours` : ""
+  };
+}
+function applyCommandFor(state, labels = {}) {
+  const env = state.ownership?.env ?? "<env>";
+  const stack = state.ownership?.stack ?? "<stack>";
+  const from = labels.from ?? state.from ?? "<terraform-dir>";
+  const out = labels.out ?? state.outDir;
+  return `chant carve apply --from ${from} --output ${out} --env ${env} --stack ${stack} --write-source`;
+}
+function carveStatePayload(states, total, labels = () => ({})) {
+  const list3 = [...states.values()].sort((a, b) => a.target.localeCompare(b.target));
+  return {
+    manifests: list3.length,
+    progress: carveProgress(list3, total),
+    states: list3.map((s) => ({ ...s, note: carveStageNote(s), applyCommand: applyCommandFor(s, labels(s)) })),
+    apply: { human: true, note: APPLY_IS_HUMAN }
+  };
+}
+function splitCarveState(tfIr, states, opts = {}) {
+  if (states.size === 0) return { tf: tfIr, graduated: [] };
+  const shorten = opts.shorten ?? ((p) => p);
+  const source = (files) => files.map(shorten).join(", ");
+  const gone = /* @__PURE__ */ new Set();
+  const graduated = [];
+  const nodes = [];
+  for (const node of tfIr.nodes) {
+    const state = states.get(node.id);
+    if (!state) {
+      nodes.push(node);
+      continue;
+    }
+    if (state.graduated) {
+      gone.add(node.id);
+      graduated.push({
+        ...node,
+        attrs: {
+          ...node.attrs,
+          _status: "good",
+          carve: carveWordFor(state.stage),
+          carveState: state.stage,
+          ...state.ownership?.stack ? { ownedStack: state.ownership.stack } : {},
+          ...state.ownership?.env ? { ownedEnv: state.ownership.env } : {},
+          ...state.at ? { carvedAt: state.at } : {},
+          ...state.files.length ? { chantSource: source(state.files) } : {}
+        }
+      });
+      continue;
+    }
+    nodes.push({
+      ...node,
+      attrs: {
+        ...node.attrs,
+        _status: carveToneFor(state.stage),
+        carve: carveWordFor(state.stage),
+        carveState: state.stage,
+        ...state.at ? { carvedAt: state.at } : {},
+        ...state.files.length ? { chantSource: source(state.files) } : {},
+        ...state.excised.length ? { excisesOnApply: state.excised.join(", ") } : {},
+        ...state.deferredInputs.length ? { deferredInputs: state.deferredInputs.join(", ") } : {}
+      }
+    });
+  }
+  const byStack = {};
+  for (const [band, members] of Object.entries(tfIr.groups?.byStack ?? {})) {
+    const left = members.filter((id) => !gone.has(id));
+    if (left.length) byStack[band] = left;
+  }
+  return {
+    tf: {
+      nodes,
+      edges: tfIr.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
+      groups: { ...tfIr.groups, byStack }
+    },
+    graduated
+  };
+}
+var GRADUATED_BAND = "carved \u2192 chant";
+function bandGraduated(tf, graduated) {
+  if (graduated.length === 0) return tf;
+  return {
+    nodes: [...graduated, ...tf.nodes],
+    edges: tf.edges,
+    groups: {
+      ...tf.groups,
+      byStack: {
+        [GRADUATED_BAND]: graduated.map((n) => n.id),
+        ...tf.groups?.byStack ?? {}
+      }
+    }
+  };
+}
+function carveStateNote(progress, states) {
+  if (states.size === 0) return "";
+  const head = ` Carve state (from ${states.size} manifest${states.size === 1 ? "" : "s"}): ${progress.label}`;
+  return progress.detail ? `${head}, ${progress.detail}.` : `${head}.`;
+}
+
+// src/ops-lens.ts
+var SUPPORTED_MAJOR2 = 1;
+var refuse2 = (error, remedy) => ({ ok: false, refusal: { error, code: "op-ir", remedy } });
+var HOW_TO_EMIT = "Build the project with a chant >= 0.50 (`chant build --lexicon temporal`), which writes `dist/ops/<name>/op.json` beside each Op's generated workflow.";
+var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseOpIr(value) {
+  if (!isRecord3(value)) {
+    return refuse2("That file isn't an op.json \u2014 its top level isn't a JSON object.", HOW_TO_EMIT);
+  }
+  if (typeof value.name !== "string" || !Array.isArray(value.phases)) {
+    return refuse2(
+      "That JSON doesn't look like an op.json \u2014 it needs a string `name` and a `phases` array.",
+      HOW_TO_EMIT
+    );
+  }
+  const bad = value.phases.findIndex((p) => !isRecord3(p) || typeof p.name !== "string" || !Array.isArray(p.steps));
+  if (bad >= 0) {
+    return refuse2(
+      `That JSON has a \`phases\` array, but entry ${bad} isn't a phase (needs a string \`name\` and a \`steps\` array).`,
+      HOW_TO_EMIT
+    );
+  }
+  const version = value.formatVersion;
+  if (version !== void 0) {
+    const major = Number(String(version).split(".")[0]);
+    if (!Number.isFinite(major) || major !== SUPPORTED_MAJOR2) {
+      return refuse2(
+        `This op.json declares format version ${String(version)}; behold reads version ${SUPPORTED_MAJOR2}.`,
+        "Upgrade behold, or render the Op with a behold that speaks its version."
+      );
+    }
+  }
+  return { ok: true, ir: value };
+}
+function readOpIr(path, readFile) {
+  let text;
+  try {
+    text = readFile(path);
+  } catch (err) {
+    return refuse2(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch (err) {
+    return refuse2(`${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
+  }
+  return parseOpIr(json);
+}
+function receiptName(step) {
+  const r = step.receipt;
+  if (typeof r === "string") return r;
+  return r && typeof r.name === "string" && r.name || "effect";
+}
+function stepLabel(step) {
+  if (step.kind === "gate") return `gate:${step.signalName}`;
+  if (step.kind === "effect") return `effect:${receiptName(step)}`;
+  return step.fn;
+}
+function stepKind(step) {
+  if (step.kind === "gate") return "Gate";
+  if (step.kind === "effect") return "Effect";
+  return step.fn;
+}
+function stepStatus(step) {
+  return step.kind === "gate" ? "warn" : step.kind === "effect" ? "accent" : "neutral";
+}
+function argsLine(args) {
+  const entries = Object.entries(args ?? {});
+  if (!entries.length) return void 0;
+  return entries.map(([k, v]) => `${k}=${typeof v === "object" && v !== null ? JSON.stringify(v) : String(v)}`).join(", ");
+}
+function profileLine(p) {
+  if (!p) return void 0;
+  const parts = [];
+  if (p.startToCloseTimeout) parts.push(`${p.startToCloseTimeout} start-to-close`);
+  if (p.heartbeatTimeout) parts.push(`${p.heartbeatTimeout} heartbeat`);
+  if (p.retry?.maximumAttempts) parts.push(`${p.retry.maximumAttempts} attempts`);
+  if (p.retry?.initialInterval) parts.push(`from ${p.retry.initialInterval}`);
+  return parts.length ? parts.join(", ") : void 0;
+}
+function placeSteps(op) {
+  const out = [];
+  const lists = [
+    [op.phases ?? [], "phases"],
+    [op.onFailure ?? [], "onFailure"]
+  ];
+  const used = /* @__PURE__ */ new Set();
+  for (const [phases, when] of lists) {
+    for (const phase of phases) {
+      const box = when === "onFailure" ? `${op.name} \xB7 onFailure: ${phase.name}` : `${op.name} \xB7 ${phase.name}`;
+      for (const step of phase.steps ?? []) {
+        let id = `${op.name}/${phase.name}/${stepLabel(step)}`;
+        for (let n = 2; used.has(id); n += 1) id = `${op.name}/${phase.name}/${stepLabel(step)}#${n}`;
+        used.add(id);
+        out.push({ id, step, phase, when, box });
+      }
+    }
+  }
+  return out;
+}
+function opPlacedSteps(op) {
+  return placeSteps(op).map((p) => ({
+    id: p.id,
+    step: p.step,
+    phase: p.phase.name,
+    parallel: Boolean(p.phase.parallel),
+    when: p.when
+  }));
+}
+var RULE_BOX = (opName) => `${opName} \xB7 rule table`;
+var ruleId = (opName, rule) => `${opName}/rules/${rule.id}`;
+var isPredicate = (v) => isRecord3(v) && typeof v.kind === "string";
+function isConvergeRule(v) {
+  if (!isRecord3(v)) return false;
+  if (typeof v.id !== "string" || !v.id) return false;
+  if (typeof v.why !== "string" || !v.why) return false;
+  if (!isPredicate(v.when)) return false;
+  const then = v.then;
+  if (!isRecord3(then)) return false;
+  return then.kind === "run" && typeof then.op === "string" || then.kind === "report" && typeof then.reason === "string";
+}
+function convergeTable(op) {
+  for (const placed of placeSteps(op)) {
+    const { step } = placed;
+    if (step.kind !== "activity" || step.fn !== "convergeTick") continue;
+    const rules = step.args?.rules;
+    if (!Array.isArray(rules)) return void 0;
+    const kept = rules.filter(isConvergeRule);
+    if (!kept.length) return void 0;
+    return {
+      tickStepId: placed.id,
+      phase: placed.phase.name,
+      rules: kept,
+      ...typeof step.args?.dial === "string" ? { dial: step.args.dial } : {},
+      ...typeof step.args?.budget === "number" ? { budget: step.args.budget } : {},
+      ...typeof step.args?.env === "string" ? { env: step.args.env } : {}
+    };
+  }
+  return void 0;
+}
+var COMPARISON_TEXT = {
+  eq: "=",
+  neq: "!=",
+  gt: ">",
+  gte: ">=",
+  lt: "<",
+  lte: "<="
+};
+function predicateText(predicate) {
+  switch (predicate.kind) {
+    case "field-comparison": {
+      const op = COMPARISON_TEXT[predicate.op];
+      if (!op) return `(unreadable comparison on ${predicate.field})`;
+      const value = typeof predicate.value === "string" ? JSON.stringify(predicate.value) : String(predicate.value);
+      return `${predicate.field} ${op} ${value}`;
+    }
+    case "field-truthiness":
+      return `${predicate.field} is ${predicate.op}`;
+    case "all-of":
+    case "any-of": {
+      const joiner = predicate.kind === "all-of" ? " and " : " or ";
+      const parts = (predicate.predicates ?? []).filter(isPredicate);
+      if (!parts.length) return predicate.kind === "all-of" ? "(always)" : "(never)";
+      return parts.map((p) => p.kind === "all-of" || p.kind === "any-of" ? `(${predicateText(p)})` : predicateText(p)).join(joiner);
+    }
+    default:
+      return "(predicate outside the kinds behold reads)";
+  }
+}
+function actionText(action) {
+  return action.kind === "run" ? `run(${action.op})` : `report: ${action.reason}`;
+}
+function ruleStatus(rule, declared) {
+  if (rule.then.kind !== "run") return "neutral";
+  return declared.has(rule.then.op) ? "accent" : "warn";
+}
+function ruleNode(op, table, rule, declared) {
+  const dispatches = rule.then.kind === "run" && declared.has(rule.then.op) ? rule.then.op : void 0;
+  const dangling = rule.then.kind === "run" && !declared.has(rule.then.op) ? rule.then.op : void 0;
+  return {
+    id: ruleId(op.name, rule),
+    // The card's kind, as an activity's is its `fn`: a converge rule is what
+    // this is, and the whole table reads as one kind of thing in the track.
+    kind: "ConvergeRule",
+    lexicon: "op",
+    attrs: {
+      _status: ruleStatus(rule, declared),
+      _step: "rule",
+      rule: rule.id,
+      op: op.name,
+      phase: table.phase,
+      // The condition, the action, and the rationale — the three columns a rule
+      // table has. `why` is chant's required field, verbatim: the accessible-ops
+      // promise is that the answer to "why did it do that" is already written
+      // down, so behold's job is to show it, not to summarise it.
+      when: predicateText(rule.when),
+      then: actionText(rule.then),
+      why: rule.why,
+      ...dispatches ? { dispatches } : {},
+      // A `then` naming an Op that isn't in this set: stated, not guessed at.
+      // chant's TMP014 refuses a run() naming an Op the PROJECT doesn't declare,
+      // so this is behold's own composition boundary showing through, and saying
+      // which one it is beats an edge into nowhere.
+      ...dangling ? { dangling: `${dangling} \u2014 not among the Ops rendered here, so no edge is drawn` } : {},
+      // `flapThreshold` absent means chant's own default applies. Named the way
+      // a gate's unset timeout is, rather than restating a number chant owns.
+      flap: rule.flapThreshold !== void 0 ? `${rule.flapThreshold} consecutive ticks` : "(chant default)",
+      ...table.dial ? { dial: table.dial } : {}
+    }
+  };
+}
+function nodeFor(op, placed, guards) {
+  const { step, phase, when } = placed;
+  const common = {
+    op: op.name,
+    phase: phase.name,
+    ...phase.parallel ? { parallel: true } : {},
+    ...when === "onFailure" ? { when: "onFailure" } : {}
+  };
+  if (step.kind === "gate") {
+    return {
+      id: placed.id,
+      kind: stepKind(step),
+      lexicon: "op",
+      attrs: {
+        _status: stepStatus(step),
+        _step: "gate",
+        gate: step.signalName,
+        timeout: step.timeout ?? "(chant default)",
+        ...common,
+        ...step.description ? { description: step.description } : {},
+        // "gates drawn as their own marks on the step they guard" (#284): the
+        // gate names what it holds back, so the pause reads from the gate card
+        // without hunting for the next one in the track.
+        ...guards ? { guards } : {}
+      }
+    };
+  }
+  if (step.kind === "effect") {
+    return {
+      id: placed.id,
+      kind: stepKind(step),
+      lexicon: "op",
+      attrs: {
+        _status: stepStatus(step),
+        _step: "effect",
+        effect: receiptName(step),
+        ...common,
+        ...step.expectation !== void 0 ? { expectation: String(step.expectation) } : {},
+        ...step.description ? { description: step.description } : {},
+        // The nested steps, named but not drawn — see OpIrEffectStep's doc.
+        ...step.steps?.length ? { runs: step.steps.map(stepLabel).join(" \u2192 ") } : {}
+      }
+    };
+  }
+  const profile = step.profile;
+  const policy = profileLine(profile ? op.activityProfiles?.[profile] : void 0);
+  const args = argsLine(step.args);
+  return {
+    id: placed.id,
+    kind: stepKind(step),
+    lexicon: "op",
+    attrs: {
+      _status: stepStatus(step),
+      _step: "activity",
+      fn: step.fn,
+      ...common,
+      ...profile ? { profile } : {},
+      ...policy ? { policy } : {},
+      // The resolved args, verbatim from the IR. They carry the Op's SCOPE
+      // (env, stack, template path) and never an estate entity id — see the
+      // module doc on why no edge is drawn from them.
+      ...args ? { args } : {},
+      ...step.outcomeAttribute ? { outcome: step.outcomeAttribute.from ? `${step.outcomeAttribute.name} \u2190 ${step.outcomeAttribute.from}` : step.outcomeAttribute.name } : {},
+      ...op.activityContracts?.[step.fn] ? { contract: "declared (args/returns JSON Schema in op.json)" } : {}
     }
+  };
+}
+function chainPhases(placed, when) {
+  const byPhase = [];
+  for (const p of placed) {
+    if (p.when !== when) continue;
+    const last = byPhase[byPhase.length - 1];
+    if (last && last.phase === p.phase) last.ids.push(p.id);
+    else byPhase.push({ phase: p.phase, ids: [p.id] });
   }
+  return byPhase.map(
+    ({ phase, ids }) => phase.parallel ? { heads: ids, tails: ids } : { heads: ids.slice(0, 1), tails: ids.slice(-1) }
+  );
+}
+function opsToIr(ops) {
+  const nodes = [];
+  const edges = [];
   const byStack = {};
-  for (const order of ["good", "warn", "neutral"]) {
-    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
-    if (members.length) byStack[verdictForStatus(order)] = members;
+  const endpoints = /* @__PURE__ */ new Map();
+  const declared = new Set(ops.map((o) => o.name));
+  const dispatches = [];
+  for (const op of ops) {
+    const placed = placeSteps(op);
+    for (let i = 0; i < placed.length; i += 1) {
+      const p = placed[i];
+      const next = placed[i + 1];
+      const guards = p.step.kind === "gate" && next && next.when === p.when ? stepLabel(next.step) : void 0;
+      nodes.push(nodeFor(op, p, guards));
+      (byStack[p.box] ??= []).push(p.id);
+    }
+    for (const when of ["phases", "onFailure"]) {
+      const track = chainPhases(placed, when);
+      for (let i = 0; i + 1 < track.length; i += 1) {
+        for (const from of track[i].tails) {
+          for (const to of track[i + 1].heads) edges.push({ from, to, kind: "ref", viaAttr: "then" });
+        }
+      }
+      if (when === "phases" && track.length) {
+        endpoints.set(op.name, { first: track[0].heads, last: track[track.length - 1].tails });
+      }
+    }
+    const table = convergeTable(op);
+    if (!table) continue;
+    for (const rule of table.rules) {
+      const node = ruleNode(op, table, rule, declared);
+      nodes.push(node);
+      (byStack[RULE_BOX(op.name)] ??= []).push(node.id);
+      edges.push({ from: table.tickStepId, to: node.id, kind: "ref", viaAttr: "rule" });
+      if (rule.then.kind === "run") dispatches.push({ from: node.id, op: rule.then.op });
+    }
+  }
+  for (const op of ops) {
+    const mine = endpoints.get(op.name);
+    if (!mine) continue;
+    for (const dep of op.depends ?? []) {
+      const theirs = endpoints.get(dep);
+      if (!theirs) continue;
+      for (const from of theirs.last) {
+        for (const to of mine.first) edges.push({ from, to, kind: "ref", viaAttr: "depends" });
+      }
+    }
+  }
+  for (const { from, op } of dispatches) {
+    const target = endpoints.get(op);
+    if (!target) continue;
+    for (const to of target.first) edges.push({ from, to, kind: "ref", viaAttr: "run" });
   }
   return { nodes, edges, groups: { byStack } };
 }
-function carveNote(report, ir) {
-  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
-  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
-  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
-  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
+function opCardFields(node) {
+  const step = node.attrs._step;
+  const phase = typeof node.attrs.phase === "string" ? node.attrs.phase : void 0;
+  const declared = step === "gate" ? [
+    { label: "gate", value: String(node.attrs.gate ?? "") },
+    { label: "timeout", value: String(node.attrs.timeout ?? "") }
+  ] : step === "effect" ? [
+    { label: "effect", value: String(node.attrs.effect ?? "") },
+    ...phase ? [{ label: "phase", value: phase }] : []
+  ] : step === "activity" ? [
+    ...phase ? [{ label: "phase", value: phase }] : [],
+    ...typeof node.attrs.profile === "string" ? [{ label: "profile", value: node.attrs.profile }] : []
+  ] : (
+    // A converge rule card leads with the two columns that make it a
+    // rule — the condition and what it does about it. `why` is the long
+    // one and belongs in the inspect pane, where it reads in full
+    // rather than being cut to fit a card.
+    step === "rule" ? [
+      { label: "when", value: String(node.attrs.when ?? "") },
+      { label: "then", value: String(node.attrs.then ?? "") }
+    ] : void 0
+  );
+  if (!declared) return void 0;
+  const run3 = typeof node.attrs.run === "string" ? node.attrs.run : void 0;
+  return run3 ? [{ label: "run", value: run3 }, ...declared.slice(0, 1)] : declared;
+}
+function opsNote(ops, ir) {
+  const gates = ir.nodes.filter((n) => n.attrs._step === "gate").length;
+  const rules = ir.nodes.filter((n) => n.attrs._step === "rule");
+  const steps = ir.nodes.length - rules.length;
+  const dangling = rules.filter((n) => n.attrs.dangling !== void 0).length;
+  const counts = [
+    `${ops.length} declared Op${ops.length === 1 ? "" : "s"}`,
+    `${steps} step${steps === 1 ? "" : "s"}`,
+    ...gates ? [`${gates} gate${gates === 1 ? "" : "s"}`] : [],
+    ...rules.length ? [`${rules.length} converge rule${rules.length === 1 ? "" : "s"}`] : []
+  ].join(" \xB7 ");
+  const ruleNote = rules.length ? ` Each converge rule carries the why chant requires of it, verbatim, and a rule whose then is run(<op>) is drawn as an edge to that Op's first step.` + (dangling ? ` ${dangling} rule${dangling === 1 ? " names an Op" : "s name Ops"} not in this set \u2014 stated on the card, not drawn.` : "") : "";
+  return `${counts}, from each Op's emitted dist/ops/<name>/op.json.${ruleNote} No estate cross-links: op.json names an Op's env and stack but never an estate entity id, so nothing here is joined to the graph's nodes (chant ask). Read-only: this renders the declared Op \u2014 nothing is started, signalled, or applied.`;
 }
 
 // src/render.ts
 registerPack({ lexicon: "k8s", iconFor: k8sIconFor });
 registerPack({ lexicon: "helm", iconFor: helmIconFor });
 registerPack({ lexicon: "terraform", iconFor: () => void 0, fields: carveCardFields });
+registerPack({ lexicon: "op", iconFor: () => void 0, fields: opCardFields });
 function renderArchitecture(ir, byContainer, opts = {}) {
   const spread = Math.min(1.5, ir.edges.length / Math.max(ir.nodes.length, 1));
   const layout = layoutArchitecture(ir, byContainer, {
@@ -4261,7 +5342,8 @@ function bandedPlan(ir, bands) {
   return { placed, boxes, width: panelW, height: Math.max(1, top - BAND_GAP) };
 }
 function renderCarveEstate(tfIr, appIr, opts) {
-  const comp = composeCarveEstate(tfIr, namespaceAppIr(appIr, opts.appTitle), opts);
+  const staged = withCarveState(tfIr, appIr, opts);
+  const comp = composeCarveEstate(staged.tf, staged.appNs, { ...opts, carvedTitle: staged.carvedTitle });
   const svg = renderSvg(comp.ir, comp.layout, {
     fit: true,
     hideTitle: true,
@@ -4270,6 +5352,17 @@ function renderCarveEstate(tfIr, appIr, opts) {
   });
   return { svg, ir: comp.ir };
 }
+function withCarveState(tfIr, appIr, opts) {
+  const states = opts.carved ?? /* @__PURE__ */ new Map();
+  const { tf, graduated } = splitCarveState(tfIr, states, { ...opts.shorten ? { shorten: opts.shorten } : {} });
+  const ns = namespaceAppIr(appIr, opts.appTitle);
+  const progress = carveProgress(states.values(), tfIr.nodes.length);
+  return {
+    tf,
+    appNs: { ...ns, nodes: [...ns.nodes, ...graduated] },
+    carvedTitle: states.size ? `carved so far \u2014 ${progress.label}` : "carved so far"
+  };
+}
 function namespaceAppIr(appIr, appTitle) {
   const prefix = `${appTitle.split(" ")[0]}/`;
   const appId = (id) => `${prefix}${id}`;
@@ -4282,7 +5375,7 @@ function namespaceAppIr(appIr, appTitle) {
 }
 function composeCarveEstate(tfIr, appNs, opts) {
   const tfPlan = bandedPlan(tfIr, tfIr.groups.byStack ?? {});
-  const appPlan = bandedPlan(appNs, { "carved so far": appNs.nodes.map((n) => n.id) });
+  const appPlan = bandedPlan(appNs, { [opts.carvedTitle ?? "carved so far"]: appNs.nodes.map((n) => n.id) });
   const memberH = (plan) => TITLE + PAD + plan.height + PAD;
   const memberW = (plan) => plan.width + PAD * 2;
   const appX0 = memberW(tfPlan) + MEMBER_GAP;
@@ -4321,23 +5414,25 @@ function composeCarveEstate(tfIr, appNs, opts) {
   };
 }
 function renderCarveMorph(tfIr, appIr, carved, opts) {
-  const appNs = namespaceAppIr(appIr, opts.appTitle);
-  const before = composeCarveEstate(tfIr, appNs, opts);
+  const staged = withCarveState(tfIr, appIr, opts);
+  const appNs = staged.appNs;
+  const morphOpts = { ...opts, carvedTitle: "carved so far" };
+  const before = composeCarveEstate(staged.tf, appNs, morphOpts);
   const gone = new Set(carved);
-  const bands = tfIr.groups.byStack ?? {};
+  const bands = staged.tf.groups.byStack ?? {};
   const bandsAfter = {};
   for (const [band, members] of Object.entries(bands)) {
     const left = members.filter((id) => !gone.has(id));
     if (left.length) bandsAfter[band] = left;
   }
   const tfAfter = {
-    nodes: tfIr.nodes.filter((n) => !gone.has(n.id)),
-    edges: tfIr.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
+    nodes: staged.tf.nodes.filter((n) => !gone.has(n.id)),
+    edges: staged.tf.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
     groups: { byStack: bandsAfter }
   };
-  const carvedNodes = tfIr.nodes.filter((n) => gone.has(n.id)).map((n) => ({ ...n, attrs: { ...n.attrs, _status: "good", carve: "carved \u2192 chant" } }));
+  const carvedNodes = staged.tf.nodes.filter((n) => gone.has(n.id)).map((n) => ({ ...n, attrs: { ...n.attrs, _status: "good", carve: "carved \u2192 chant" } }));
   const appAfter = { ...appNs, nodes: [...appNs.nodes, ...carvedNodes] };
-  const after = composeCarveEstate(tfAfter, appAfter, opts);
+  const after = composeCarveEstate(tfAfter, appAfter, morphOpts);
   const view = (name, comp) => ({
     name,
     ir: comp.ir,
@@ -4599,12 +5694,12 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
 }
 
 // src/carve-actions.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { isAbsolute, join as join10, relative, resolve as resolve2, sep } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
+import { isAbsolute, join as join13, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
 
 // src/layout.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
+import { join as join11 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -4645,7 +5740,7 @@ function lensFromQuery(params) {
   return [slug(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join8(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join11(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
   if (!projectDir || !existsSync6(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
@@ -4661,7 +5756,7 @@ function readLayoutFile(projectDir) {
   const file = layoutPath(projectDir);
   try {
     if (!existsSync6(file)) return empty;
-    const raw = readFileSync7(file, "utf8");
+    const raw = readFileSync8(file, "utf8");
     if (raw.length > MAX_FILE_BYTES) return empty;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
@@ -4701,7 +5796,7 @@ function writeLens(projectDir, lens, deltas) {
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync2(join8(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync2(join11(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
   writeFileSync2(tmp, body, "utf8");
   renameSync(tmp, file);
@@ -4786,8 +5881,8 @@ function reanchorEdges(svg, moved) {
 
 // src/carve-live.ts
 import { spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
+import { join as join12 } from "node:path";
 var LIVE_CONTAINER = "behold-carve-floci";
 var LIVE_PORT = 4602;
 var LIVE_IMAGE = "floci/floci:1.5.34";
@@ -4846,9 +5941,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join9(fromDir, "floci-override.tf.disabled");
+  const template = join12(fromDir, "floci-override.tf.disabled");
   if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync3(join9(fromDir, "floci_override.tf"), armOverride(readFileSync8(template, "utf8"), LIVE_PORT));
+  writeFileSync3(join12(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -4872,7 +5967,7 @@ ${tail}`, exitCode: r.code };
 // src/carve-actions.ts
 async function runCarvePlan(demo) {
   if (!demo?.live) {
-    return refuse2(
+    return refuse3(
       "carve-action",
       "terraform plan is the live tier's beat, and this server isn't serving one",
       "run `behold demo carve --live` (needs docker + terraform)"
@@ -4880,7 +5975,7 @@ async function runCarvePlan(demo) {
   }
   const r = await runLivePlan(demo.from);
   if ("error" in r) {
-    return refuse2("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
+    return refuse3("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
   }
   return {
     ok: true,
@@ -4892,14 +5987,14 @@ async function runCarvePlan(demo) {
 }
 async function runCarveObserve(demo, select) {
   if (!demo.live) {
-    return refuse2(
+    return refuse3(
       "carve-action",
       "the observe beat reads the scratch Floci, and this server isn't serving one",
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync8(join10(demo.out, "src"))) {
-    return refuse2("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
+  if (!existsSync8(join13(demo.out, "src"))) {
+    return refuse3("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
   const run3 = await runChantRaw(args, demo.out, { AWS_ENDPOINT_URL: demo.live.endpoint }).catch((err) => ({
@@ -4908,18 +6003,26 @@ async function runCarveObserve(demo, select) {
     stderr: err instanceof Error ? err.message : String(err)
   }));
   if (run3.code !== 0) {
-    return refuse2(
+    return refuse3(
       "carve-action",
       `chant lifecycle diff exited ${run3.code}: ${merge(run3, demo.root) || "(no output)"}`,
       "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + "."
     );
   }
-  let aws;
+  let parsed;
   try {
-    aws = JSON.parse(run3.stdout).lexicons?.aws ?? {};
+    parsed = JSON.parse(run3.stdout);
   } catch {
-    return refuse2("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
+    return refuse3("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
+  }
+  if (parsed.stacks && !parsed.lexicons) {
+    return refuse3(
+      "carve-action",
+      "chant lifecycle diff answered a stacked shape ({stacks}) \u2014 observe only reads the stack-less {lexicons} shape",
+      "point the target at a stack-less carveout, or file a shape-read gap against observe for the stacked case"
+    );
   }
+  const aws = parsed.lexicons?.aws ?? {};
   const entity = select.split(".").pop() ?? select;
   const command = `AWS_ENDPOINT_URL=${demo.live.endpoint} chant ${args.join(" ")}  # in ${shortenIn(demo.out, demo.root)}`;
   const queried = aws.resources?.queried?.[entity];
@@ -4954,13 +6057,13 @@ async function runCarveObserve(demo, select) {
 var MAX_ARTIFACT_BYTES = 64 * 1024;
 var MAX_ARTIFACTS = 24;
 var MAX_OUTPUT_BYTES = 32 * 1024;
-var refuse2 = (code, error, remedy) => ({
+var refuse3 = (code, error, remedy) => ({
   ok: false,
   refusal: { error, code, remedy }
 });
 var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
 function insideDemo(root, p) {
-  const rel = relative(resolve2(root), resolve2(p));
+  const rel = relative2(resolve4(root), resolve4(p));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
 function selectFromReport(report, raw) {
@@ -4981,17 +6084,17 @@ function readArtifacts(demo, dir, filter) {
     if (out.length >= MAX_ARTIFACTS || depth > 2) return;
     let entries;
     try {
-      entries = readdirSync3(d).sort();
+      entries = readdirSync5(d).sort();
     } catch {
       return;
     }
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join10(d, name);
+      const full = join13(d, name);
       let st;
       try {
-        st = statSync2(full);
+        st = statSync5(full);
       } catch {
         continue;
       }
@@ -4999,11 +6102,11 @@ function readArtifacts(demo, dir, filter) {
         walk(full, depth + 1);
         continue;
       }
-      const rel = relative(demo.root, full).split(sep).join("/");
+      const rel = relative2(demo.root, full).split(sep2).join("/");
       if (!filter(rel)) continue;
       let text = "";
       try {
-        text = readFileSync9(full, "utf8");
+        text = readFileSync10(full, "utf8");
       } catch {
         continue;
       }
@@ -5025,17 +6128,17 @@ function carveSlug(select) {
 }
 var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
 function shortenIn(arg, root) {
-  return arg.startsWith(root + sep) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+  return arg.startsWith(root + sep2) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
 }
 function merge(r, root) {
   const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
-  return clip(joined.split(root + sep).join("").split(root).join("."));
+  return clip(joined.split(root + sep2).join("").split(root).join("."));
 }
 async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
-  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync3(demo.out, { recursive: true });
-  const reportFile = join10(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join13(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -5056,7 +6159,7 @@ async function runCarveEmit(demo, select) {
   }));
   const output = merge(run3, demo.root);
   if (run3.code !== 0) {
-    return refuse2(
+    return refuse3(
       "carve-action",
       `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
       "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
@@ -5064,10 +6167,10 @@ async function runCarveEmit(demo, select) {
   }
   let boundary = null;
   try {
-    boundary = JSON.parse(readFileSync9(reportFile, "utf8"));
+    boundary = JSON.parse(readFileSync10(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative(demo.project, join10(demo.out, "src")).split(sep).join("/");
+  const lintPath = relative2(demo.project, join13(demo.out, "src")).split(sep2).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -5091,7 +6194,7 @@ async function runCarveEmit(demo, select) {
 }
 async function runCarveBridge(demo, select) {
   const block = carveWriteBlock(demo);
-  if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync3(demo.out, { recursive: true });
   const args = [
     "carve",
@@ -5111,7 +6214,7 @@ async function runCarveBridge(demo, select) {
   }));
   const output = merge(run3, demo.root);
   if (run3.code !== 0) {
-    return refuse2(
+    return refuse3(
       "carve-action",
       `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
       "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
@@ -5130,8 +6233,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync10, existsSync as existsSync9 } from "node:fs";
-import { join as join11 } from "node:path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
+import { join as join14 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -5149,45 +6252,623 @@ function kindOf(content) {
   if (/AuditOp\b/.test(content)) return "audit";
   return "op";
 }
-function discoverOps(projectDir) {
-  const seen = /* @__PURE__ */ new Set();
+function discoverOps(projectDir) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sub of ["ops", "src", "."]) {
+    const dir = join14(projectDir, sub);
+    if (!existsSync9(dir)) continue;
+    for (const f of readdirSync6(dir)) {
+      if (!f.endsWith(".op.ts")) continue;
+      const content = readFileSync11(join14(dir, f), "utf8");
+      const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      const gate = content.match(/signalName:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const env = content.match(/\benv:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const target = content.match(/\btarget:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const substrate = target ? APPLY_TARGET_LEXICON[target] : void 0;
+      const irPath = opIrPath(projectDir, name);
+      out.push({
+        name,
+        kind: kindOf(content),
+        dir: projectDir,
+        ...gate ? { gate } : {},
+        ...env ? { env } : {},
+        ...substrate ? { substrate } : {},
+        ...existsSync9(irPath) ? { irPath } : {}
+      });
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function opIrPath(projectDir, name) {
+  return join14(projectDir, "dist", "ops", name, "op.json");
+}
+function discoverOpIrs(projectDirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const dir of projectDirs) {
+    const root = join14(dir, "dist", "ops");
+    if (!existsSync9(root)) continue;
+    for (const name of readdirSync6(root)) {
+      if (seen.has(name)) continue;
+      const path = opIrPath(dir, name);
+      if (!existsSync9(path)) continue;
+      seen.add(name);
+      out.push({ name, dir, path });
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function discoverEstateOps(projectDirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const dir of projectDirs) {
+    for (const op of discoverOps(dir)) {
+      if (seen.has(op.name)) continue;
+      seen.add(op.name);
+      out.push(op);
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/run-playhead.ts
+var RECEIPT_READ_FN = "receiptRead";
+var RECEIPT_WRITE_FN = "receiptWrite";
+var STEP_STATUSES = /* @__PURE__ */ new Set(["ok", "fail", "skipped"]);
+var isRecord4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function asStepRecord(value) {
+  if (!isRecord4(value)) return null;
+  if (typeof value.phase !== "string" || typeof value.fn !== "string") return null;
+  if (typeof value.status !== "string" || !STEP_STATUSES.has(value.status)) return null;
+  if (typeof value.durationMs !== "number") return null;
+  return value;
+}
+function parseRunProgressLine(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  const one = asStepRecord(parsed);
+  if (one) return [one];
+  if (isRecord4(parsed) && typeof parsed.op === "string" && Array.isArray(parsed.records)) {
+    const records = parsed.records.map(asStepRecord).filter((r) => r !== null);
+    return records.length ? records : null;
+  }
+  return null;
+}
+function recordLine(record) {
+  const mark = record.status === "ok" ? "\u2713" : record.status === "fail" ? "\u2717" : "\u2022";
+  const took = record.status === "skipped" ? "skipped" : record.durationMs < 1e3 ? `${record.durationMs}ms` : `${(record.durationMs / 1e3).toFixed(1)}s`;
+  return `${mark} ${record.phase} \xB7 ${record.fn} \u2014 ${took}${record.error ? ` \u2014 ${record.error}` : ""}`;
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+var strip = (s) => s.replace(ANSI, "");
+function statusFields(stdout) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of strip(stdout).split("\n")) {
+    const m = /^\s{2,}([A-Za-z][A-Za-z ]*?)\s*:\s*(.*)$/.exec(raw);
+    if (m) out.set(m[1].trim(), m[2].trim());
+  }
+  return out;
+}
+function parseGateLine(line) {
+  const m = /^(.*?)(?: — (.*?))? \(waiting since (.+)\)$/.exec(line.trim());
+  if (!m) return null;
+  const signalName = m[1].trim();
+  if (!signalName) return null;
+  return { signalName, ...m[2] ? { description: m[2].trim() } : {}, since: m[3].trim() };
+}
+function readRunStatus(op, run3) {
+  if (run3.code !== 0) {
+    const message = strip(run3.stderr).trim() || strip(run3.stdout).trim() || `chant run status exited ${run3.code}`;
+    if (/not available in local mode|@temporalio\/client is not installed/.test(message)) {
+      return {
+        ok: false,
+        refusal: {
+          error: `No Temporal run state for "${op}" \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          code: "no-temporal",
+          remedy: "Gate state and per-step run records come from a durable run. Configure a Temporal profile in chant.config.ts (and `npm install @temporalio/client`), then run the Op with --temporal."
+        }
+      };
+    }
+    if (/not found|NotFound/.test(message)) {
+      return {
+        ok: false,
+        refusal: {
+          error: `No run of "${op}" to report \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          code: "no-run",
+          remedy: "Start the Op (Run) and the playhead fills in as each step settles."
+        }
+      };
+    }
+    return {
+      ok: false,
+      refusal: {
+        error: `chant run status ${op} failed: ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+        code: "run-status",
+        remedy: "Run `chant run status " + op + " --temporal` in the project to see the whole error."
+      }
+    };
+  }
+  const f = statusFields(run3.stdout);
+  const activities = /^(\d+)\/(\d+)/.exec(f.get("Activities") ?? "");
+  const gateLine = f.get("Gate");
+  return {
+    ok: true,
+    read: {
+      op,
+      ...f.get("Workflow ID") ? { workflowId: f.get("Workflow ID") } : {},
+      ...f.get("Run ID") ? { runId: f.get("Run ID") } : {},
+      ...f.get("Status") ? { status: f.get("Status") } : {},
+      ...f.get("Started") ? { startedAt: f.get("Started") } : {},
+      ...f.get("Closed") ? { closedAt: f.get("Closed") } : {},
+      ...activities ? { activities: { completed: Number(activities[1]), scheduled: Number(activities[2]) } } : {},
+      // No Gate line means chant printed none, which it does both when the
+      // query says "nothing pending" and when the Op registers no handler.
+      // Either way: no gate is waiting on a human right now.
+      gate: gateLine ? parseGateLine(gateLine) : null
+    }
+  };
+}
+var initialRunState = {
+  op: null,
+  mode: null,
+  status: "idle",
+  records: [],
+  gate: null,
+  gateNote: null,
+  startedAt: null,
+  endedAt: null,
+  lost: null
+};
+function runStarted(op, mode, at) {
+  return { ...initialRunState, op, mode, status: "running", startedAt: at };
+}
+function runRecord(state, record) {
+  return { ...state, records: [...state.records, record] };
+}
+function runGate(state, result) {
+  return result.ok ? { ...state, gate: result.read.gate, gateNote: null } : { ...state, gate: null, gateNote: result.refusal.error };
+}
+function runEnded(state, exitCode, at) {
+  if (state.status !== "running") return state;
+  if (exitCode === 0) return { ...state, status: "ok", endedAt: at };
+  if (state.records.some((r) => r.status === "fail")) return { ...state, status: "failed", endedAt: at };
+  return {
+    ...state,
+    status: "lost",
+    endedAt: at,
+    lost: `the progress stream ended (exit ${exitCode}) after ${state.records.length} settled step${state.records.length === 1 ? "" : "s"} without a failed step \u2014 behold does not know whether the Op failed or the stream broke, so the playhead stays at the last settled step.`
+  };
+}
+function slotsFor(placed) {
+  const out = [];
+  for (const p of placed) {
+    if (p.step.kind === "activity") {
+      out.push({ id: p.id, phase: p.phase, fn: p.step.fn });
+    } else if (p.step.kind === "effect") {
+      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_READ_FN });
+      for (const nested of p.step.steps ?? []) {
+        if (nested.kind === "activity") out.push({ id: p.id, phase: p.phase, fn: nested.fn });
+      }
+      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_WRITE_FN });
+    }
+  }
+  return out;
+}
+function mergeRun(prev, record) {
+  const rank = { fail: 3, ok: 2, skipped: 1 };
+  const keepPrev = prev && rank[prev.status] >= rank[record.status];
+  return {
+    status: keepPrev ? prev.status : record.status,
+    durationMs: (prev?.durationMs ?? 0) + record.durationMs,
+    ...keepPrev && prev.error ? { error: prev.error } : record.error ? { error: record.error } : {},
+    ...keepPrev && prev.outcome ? { outcome: prev.outcome } : record.outcome ? { outcome: `${record.outcome.name}=${String(record.outcome.value)}` } : {},
+    records: (prev?.records ?? 0) + 1
+  };
+}
+function joinRun(op, records, gate) {
+  const placed = opPlacedSteps(op);
+  const slots = slotsFor(placed);
+  const byKey = /* @__PURE__ */ new Map();
+  for (const s of slots) {
+    const key = `${s.phase}\0${s.fn}`;
+    if (!byKey.has(key)) byKey.set(key, []);
+    byKey.get(key).push({ id: s.id });
+  }
+  const cursor = /* @__PURE__ */ new Map();
+  const byNode = /* @__PURE__ */ new Map();
+  const unplaced = [];
+  let lastSettledIndex = -1;
+  const indexOf = new Map(placed.map((p, i) => [p.id, i]));
+  for (const record of records) {
+    const key = `${record.phase}\0${record.fn}`;
+    const list3 = byKey.get(key);
+    const i = cursor.get(key) ?? 0;
+    const slot = list3?.[i];
+    if (!slot) {
+      unplaced.push(record);
+      continue;
+    }
+    cursor.set(key, i + 1);
+    byNode.set(slot.id, mergeRun(byNode.get(slot.id), record));
+    if (record.status !== "skipped") {
+      lastSettledIndex = Math.max(lastSettledIndex, indexOf.get(slot.id) ?? -1);
+    }
+  }
+  if (gate) {
+    const gateNode = placed.find((p) => p.step.kind === "gate" && p.step.signalName === gate.signalName);
+    if (gateNode) {
+      return {
+        byNode,
+        at: gateNode.id,
+        atReason: `waiting for ${gate.signalName} since ${gate.since}`,
+        unplaced
+      };
+    }
+  }
+  const next = placed.find((p, i) => i > lastSettledIndex && p.when === "phases");
+  return {
+    byNode,
+    at: lastSettledIndex >= 0 && next ? next.id : null,
+    atReason: lastSettledIndex >= 0 && next ? "reached \u2014 not settled yet" : null,
+    unplaced
+  };
+}
+var TONE = {
+  ok: "good",
+  fail: "warn",
+  skipped: "neutral"
+};
+var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
+function tookLabel(ms) {
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+function paintPlayhead(ir, join21, gate) {
+  if (!join21.byNode.size && !join21.at) return ir;
+  const nodes = ir.nodes.map((node) => {
+    const run3 = join21.byNode.get(node.id);
+    const here = join21.at === node.id;
+    if (!run3 && !here) return node;
+    const isGate = node.attrs?._step === "gate";
+    const attrs = { ...node.attrs };
+    if (run3) {
+      attrs._status = TONE[run3.status];
+      attrs.run = run3.status === "skipped" ? "skipped" : `${RAN[run3.status]} \xB7 ${tookLabel(run3.durationMs)}`;
+      attrs.ran = tookLabel(run3.durationMs);
+      if (run3.error) attrs.error = run3.error;
+      if (run3.outcome) attrs.outcome = run3.outcome;
+      if (run3.records > 1) attrs.runRecords = run3.records;
+    }
+    if (here) {
+      attrs._playhead = true;
+      attrs._status = isGate && gate ? "warn" : "accent";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join21.atReason ?? "here";
+      if (isGate && gate?.description) attrs.gateDescription = gate.description;
+    }
+    return { ...node, attrs };
+  });
+  return { ...ir, nodes };
+}
+function pendingGateCard(op, gate, ir) {
+  const node = ir.nodes.find((n) => n.attrs?._step === "gate" && n.attrs?.gate === gate.signalName && n.attrs?.op === op);
+  return {
+    op,
+    signalName: gate.signalName,
+    ...gate.description ? { description: gate.description } : {},
+    since: gate.since,
+    ...node ? { node: node.id } : {},
+    ...node && typeof node.attrs?.guards === "string" ? { guards: node.attrs.guards } : {},
+    approve: {
+      method: "POST",
+      path: `/api/ops/${encodeURIComponent(op)}/signal/${encodeURIComponent(gate.signalName)}`
+    }
+  };
+}
+function playheadNote(state, join21) {
+  if (!state.op) {
+    return "No run state: nothing has been run from this behold session, so every step paints as declared.";
+  }
+  const settled = join21 ? join21.byNode.size : state.records.length;
+  const bits = [];
+  const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
+  if (state.status === "running") {
+    bits.push(
+      state.mode === "local" ? "still running; the local executor reports every step at once when it ends, so the track fills in on completion" : "still running; only settled steps are painted"
+    );
+  }
+  if (state.status === "ok") bits.push("the run exited cleanly");
+  if (state.status === "failed") bits.push("a step failed");
+  if (state.status === "lost") bits.push(`stream lost \u2014 ${state.lost ?? "the progress stream ended without a verdict"}`);
+  if (state.gate) {
+    bits.push(`waiting on gate ${state.gate.signalName} since ${state.gate.since} \u2014 approve is a delegated signal, behold never signals on its own`);
+  } else if (state.gateNote) {
+    bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
+  }
+  if (join21?.unplaced.length) {
+    bits.push(
+      `${join21.unplaced.length} record${join21.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join21.unplaced.length === 1 ? "is" : "are"} not painted`
+    );
+  }
+  if (!bits.length) return `${head}.`;
+  const rest = bits.join("; ");
+  return `${head} \u2014 ${rest}.`;
+}
+
+// src/operator.ts
+var ANSI2 = /\x1b\[[0-9;]*m/g;
+var strip2 = (s) => s.replace(ANSI2, "");
+var isRecord5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var HOW_TO_DECLARE = "An operating loop is a ConvergeOp: declare one in a `*.op.ts` (`ConvergeOp({ name, env, dial, rules })` from @intentius/chant-lexicon-temporal), build the project, and tick it with `chant operator` (or a cron / CronJob invoking it).";
+function readRow(value) {
+  if (!isRecord5(value)) return null;
+  if (typeof value.op !== "string" || typeof value.env !== "string") return null;
+  if (!Array.isArray(value.pendingGates)) return null;
+  const gates = [];
+  for (const g of value.pendingGates) {
+    if (!isRecord5(g) || typeof g.rule !== "string" || typeof g.gate !== "string") return null;
+    gates.push({ rule: g.rule, gate: g.gate, ...typeof g.op === "string" ? { op: g.op } : {} });
+  }
+  const tick = isRecord5(value.lastTick) ? value.lastTick : void 0;
+  const usable = tick && typeof tick.timestamp === "string" && typeof tick.log === "string";
+  const lease = isRecord5(value.lease) ? value.lease : void 0;
+  return {
+    op: value.op,
+    env: value.env,
+    ...usable ? { lastTick: tick } : {},
+    pendingGates: gates,
+    ...lease && typeof lease.holder === "string" && typeof lease.expiresAt === "string" ? { lease: { holder: lease.holder, expiresAt: lease.expiresAt } } : {}
+  };
+}
+function readOperatorStatus(run3) {
+  const err = strip2(run3.stderr);
+  const out = strip2(run3.stdout).trim();
+  if (run3.code !== 0) {
+    const message = err.trim() || out || `chant operator status exited ${run3.code}`;
+    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
+    if (/Unknown command|Unknown operator subcommand/i.test(message)) {
+      return {
+        ok: false,
+        refusal: {
+          error: `This chant has no \`operator status\` \u2014 ${first}`,
+          code: "no-operator-cli",
+          remedy: "The operating loop's status surface landed in chant 0.52 (chant#1485). Upgrade chant to read it."
+        }
+      };
+    }
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator status failed: ${first}`,
+        code: "operator-status",
+        remedy: "Run `chant operator status --json` in the project to see the whole error."
+      }
+    };
+  }
+  if (!out) {
+    return {
+      ok: false,
+      refusal: {
+        error: "This project declares no operating loop \u2014 chant found no ConvergeOp.",
+        code: "no-operator",
+        remedy: HOW_TO_DECLARE
+      }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch (e) {
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator status --json didn't print JSON: ${e instanceof Error ? e.message : String(e)}`,
+        code: "operator-status",
+        remedy: "Run `chant operator status --json` in the project and check what it printed."
+      }
+    };
+  }
+  if (!Array.isArray(parsed)) {
+    return {
+      ok: false,
+      refusal: {
+        error: "chant operator status --json answered with something that isn't an array of ConvergeOp rows.",
+        code: "operator-status",
+        remedy: "behold reads one row per ConvergeOp: `{op, env, lastTick?, pendingGates[], lease?}`."
+      }
+    };
+  }
+  const rows = [];
+  for (const value of parsed) {
+    const row = readRow(value);
+    if (!row) {
+      return {
+        ok: false,
+        refusal: {
+          error: "chant operator status --json answered with a row behold couldn't read (needs `op`, `env`, `pendingGates[]`).",
+          code: "operator-status",
+          remedy: "Check `chant operator status --json` in the project \u2014 and file the shape change if chant's is the newer one."
+        }
+      };
+    }
+    rows.push(row);
+  }
+  return { ok: true, rows };
+}
+function declaredConvergeOps(ops) {
+  return ops.filter((o) => o.searchAttributes?.Converge === "true").map((o) => ({
+    name: o.name,
+    ...o.searchAttributes?.Env ? { env: o.searchAttributes.Env } : {},
+    ...o.searchAttributes?.Dial ? { dial: o.searchAttributes.Dial } : {}
+  }));
+}
+var MANAGED_BY = "app.kubernetes.io/managed-by";
+var COMPONENT = "app.kubernetes.io/component";
+var NAME_LABEL = "app.kubernetes.io/name";
+var CHANT = "chant";
+var CONVERGE_TICK = "converge-tick";
+var CRONJOB_KIND = "K8s::Batch::CronJob";
+var NAMESPACE_KIND = "K8s::Core::Namespace";
+var rec3 = (v) => isRecord5(v) ? v : void 0;
+var str3 = (v) => typeof v === "string" && v ? v : void 0;
+var labelsOf = (n) => rec3(rec3(n.attrs?.metadata)?.labels) ?? {};
+function operatorHomes(ir) {
+  const byNamespace = /* @__PURE__ */ new Map();
+  const conflicted = /* @__PURE__ */ new Set();
+  for (const n of ir.nodes) {
+    if (n.kind !== CRONJOB_KIND) continue;
+    const labels = labelsOf(n);
+    if (labels[MANAGED_BY] !== CHANT || labels[COMPONENT] !== CONVERGE_TICK) continue;
+    const meta = rec3(n.attrs?.metadata);
+    const ns = str3(meta?.namespace);
+    const op = str3(meta?.name);
+    if (!ns || !op) continue;
+    const home = byNamespace.get(ns) ?? { namespace: ns, ticks: [] };
+    const stack = str3(labels[NAME_LABEL]);
+    if (stack && !conflicted.has(ns)) {
+      if (home.stack === void 0) home.stack = stack;
+      else if (home.stack !== stack) {
+        conflicted.add(ns);
+        delete home.stack;
+      }
+    }
+    const schedule = str3(rec3(n.attrs?.spec)?.schedule);
+    home.ticks.push({ node: n.id, op, ...schedule ? { schedule } : {} });
+    byNamespace.set(ns, home);
+  }
+  if (!byNamespace.size) return [];
+  for (const n of ir.nodes) {
+    if (n.kind !== NAMESPACE_KIND) continue;
+    const name = str3(rec3(n.attrs?.metadata)?.name);
+    const home = name ? byNamespace.get(name) : void 0;
+    if (home && !home.node) home.node = n.id;
+  }
+  for (const home of byNamespace.values()) home.ticks.sort((a, b) => a.op.localeCompare(b.op));
+  return [...byNamespace.values()].sort((a, b) => a.namespace.localeCompare(b.namespace));
+}
+function markOperatorHome(ir) {
+  const homes = operatorHomes(ir);
+  if (!homes.length) return ir;
+  const marks = /* @__PURE__ */ new Map();
+  for (const home of homes) {
+    if (home.node) {
+      marks.set(home.node, {
+        role: "home",
+        namespace: home.namespace,
+        ...home.stack ? { stack: home.stack } : {},
+        ticks: home.ticks.map((t) => t.op)
+      });
+    }
+    for (const tick of home.ticks) {
+      marks.set(tick.node, {
+        role: "tick",
+        namespace: home.namespace,
+        ...home.stack ? { stack: home.stack } : {},
+        op: tick.op,
+        ...tick.schedule ? { schedule: tick.schedule } : {}
+      });
+    }
+  }
+  return {
+    ...ir,
+    nodes: ir.nodes.map((n) => {
+      const mark = marks.get(n.id);
+      return mark ? { ...n, attrs: { ...n.attrs, _operator: mark } } : n;
+    })
+  };
+}
+function operatorStrip(rows, now = Date.now()) {
+  const out = rows.map((r) => {
+    const expiresAt = r.lease ? Date.parse(r.lease.expiresAt) : NaN;
+    const lease = !r.lease ? "free" : Number.isFinite(expiresAt) && expiresAt <= now ? "expired" : "held";
+    return {
+      op: r.op,
+      env: r.env,
+      log: r.lastTick?.log ?? null,
+      at: r.lastTick?.timestamp ?? null,
+      lease,
+      leaseHolder: r.lease?.holder ?? null,
+      leaseExpiresAt: r.lease?.expiresAt ?? null,
+      pendingGates: r.pendingGates.length
+    };
+  });
+  return { rows: out, pendingGates: out.reduce((n, r) => n + r.pendingGates, 0) };
+}
+var CONVERGE_GATE_LOOP = "converge";
+var APPROVE_SEMANTICS = "Approving records a fact in the gate ledger; it does not unblock the dispatch. The next tick reads it.";
+function convergeGateCards(rows) {
   const out = [];
-  for (const sub of ["ops", "src", "."]) {
-    const dir = join11(projectDir, sub);
-    if (!existsSync9(dir)) continue;
-    for (const f of readdirSync4(dir)) {
-      if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync10(join11(dir, f), "utf8");
-      const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      if (!name || seen.has(name)) continue;
-      seen.add(name);
-      const gate = content.match(/signalName:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const env = content.match(/\benv:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const target = content.match(/\btarget:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const substrate = target ? APPLY_TARGET_LEXICON[target] : void 0;
+  for (const row of rows) {
+    for (const g of row.pendingGates) {
+      if (!g.op) continue;
       out.push({
-        name,
-        kind: kindOf(content),
-        dir: projectDir,
-        ...gate ? { gate } : {},
-        ...env ? { env } : {},
-        ...substrate ? { substrate } : {}
+        loop: CONVERGE_GATE_LOOP,
+        rule: g.rule,
+        op: g.op,
+        gate: g.gate,
+        convergeOp: row.op,
+        env: row.env,
+        since: row.lastTick?.timestamp ?? null,
+        semantics: APPROVE_SEMANTICS,
+        approve: {
+          method: "POST",
+          path: `/api/operator/approve/${encodeURIComponent(g.op)}/${encodeURIComponent(g.gate)}`,
+          command: `chant approve ${g.op} ${g.gate}`
+        }
       });
     }
   }
-  return out.sort((a, b) => a.name.localeCompare(b.name));
+  return out;
 }
-function discoverEstateOps(projectDirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const dir of projectDirs) {
-    for (const op of discoverOps(dir)) {
-      if (seen.has(op.name)) continue;
-      seen.add(op.name);
-      out.push(op);
-    }
+var initialOperatorState = {
+  declared: [],
+  strip: null,
+  gates: [],
+  note: null,
+  code: null,
+  readAt: null
+};
+function operatorRead(state, result, at, now = Date.now()) {
+  if (!result.ok) {
+    return { ...state, strip: null, gates: [], note: result.refusal.error, code: result.refusal.code, readAt: at };
   }
-  return out.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    ...state,
+    strip: operatorStrip(result.rows, now),
+    gates: convergeGateCards(result.rows),
+    note: null,
+    code: null,
+    readAt: at
+  };
+}
+function operatorNote(state) {
+  if (!state.declared.length) {
+    return "No operating loop: this project declares no ConvergeOp, so there is no operator strip.";
+  }
+  const loops = `${state.declared.length} ConvergeOp${state.declared.length === 1 ? "" : "s"}`;
+  if (!state.strip) {
+    return state.note ? `Operating loop: ${loops} declared \u2014 status unavailable: ${state.note}` : `Operating loop: ${loops} declared \u2014 not read yet.`;
+  }
+  const bits = [];
+  const ticked = state.strip.rows.filter((r) => r.at).length;
+  bits.push(
+    ticked ? `last tick only \u2014 chant's status surface exposes one tick per loop, not the history (chant#2029), so this is a strip and not a timeline` : `no tick recorded yet on any loop`
+  );
+  const held = state.strip.rows.filter((r) => r.lease === "held").length;
+  if (held) bits.push(`${held} lease${held === 1 ? "" : "s"} held`);
+  const expired = state.strip.rows.filter((r) => r.lease === "expired").length;
+  if (expired) bits.push(`${expired} lease${expired === 1 ? "" : "s"} expired \u2014 the next round reclaims it`);
+  if (state.strip.pendingGates) {
+    bits.push(
+      `${state.strip.pendingGates} converge gate${state.strip.pendingGates === 1 ? "" : "s"} pending \u2014 approving one records a fact for the next tick, it does not release a workflow (that is the run gate, a different card), and a gate fact carries no URL yet (chant#2028)`
+    );
+  }
+  return `Operating loop: ${loops} \u2014 ${bits.join("; ")}.`;
 }
 
 // src/adopt.ts
@@ -5270,21 +6951,21 @@ function classifyHealth(status) {
   if (HEALTHY.test(text)) return "healthy";
   return "unknown";
 }
-function rec2(v) {
+function rec4(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 }
-function str2(v) {
+function str4(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
 function statusTree(o) {
-  const attrs = rec2(o.attributes);
+  const attrs = rec4(o.attributes);
   if (!attrs) return void 0;
-  return rec2(attrs.status) ?? attrs;
+  return rec4(attrs.status) ?? attrs;
 }
 function specTree(o) {
-  const attrs = rec2(o.attributes);
+  const attrs = rec4(o.attributes);
   if (!attrs) return void 0;
-  return rec2(attrs.spec) ?? attrs;
+  return rec4(attrs.spec) ?? attrs;
 }
 var ARGO_HEALTH = {
   Healthy: "healthy",
@@ -5310,9 +6991,9 @@ function argoErrorMessage(tree) {
       if (m) return m[2];
       continue;
     }
-    const type = str2(rec2(c)?.type);
+    const type = str4(rec4(c)?.type);
     if (!type || !ARGO_ERROR_CONDITION.test(type)) continue;
-    const message = str2(rec2(c)?.message);
+    const message = str4(rec4(c)?.message);
     if (message) return message;
   }
   return void 0;
@@ -5320,10 +7001,10 @@ function argoErrorMessage(tree) {
 function argoVerdict(o) {
   if (o.type !== "K8s::Argo::Application") return void 0;
   const tree = statusTree(o);
-  let health = str2(rec2(tree?.health)?.status);
-  let sync = str2(rec2(tree?.sync)?.status);
+  let health = str4(rec4(tree?.health)?.status);
+  let sync = str4(rec4(tree?.sync)?.status);
   if (!health && !sync) {
-    const word = str2(o.status);
+    const word = str4(o.status);
     if (word === "READY") {
       health = "Healthy";
       sync = "Synced";
@@ -5349,16 +7030,16 @@ function readyFromConditions(tree) {
   const conditions = tree?.conditions;
   if (!Array.isArray(conditions)) return void 0;
   for (const c of conditions) {
-    const cond = rec2(c);
+    const cond = rec4(c);
     if (!cond || cond.type !== "Ready") continue;
-    const status = str2(cond.status);
+    const status = str4(cond.status);
     if (status !== "True" && status !== "False" && status !== "Unknown") continue;
-    return { status, reason: str2(cond.reason) };
+    return { status, reason: str4(cond.reason) };
   }
   return void 0;
 }
 function readyFromChantConditions(o) {
-  const conditions = rec2(o.attributes)?.conditions;
+  const conditions = rec4(o.attributes)?.conditions;
   if (!Array.isArray(conditions)) return void 0;
   for (const c of conditions) {
     if (typeof c !== "string") continue;
@@ -5370,7 +7051,7 @@ function readyFromChantConditions(o) {
   return void 0;
 }
 function readyFromStatusWord(o) {
-  const word = str2(o.status);
+  const word = str4(o.status);
   if (!word || word === "PRESENT") return void 0;
   if (word === "READY") return { status: "True" };
   if (word === "NOT-READY") return { status: "False" };
@@ -5380,8 +7061,8 @@ function describeReady(ready) {
   return `Ready=${ready.status}${ready.reason ? ` (${ready.reason})` : ""}`;
 }
 function revisionVerdict(tree) {
-  const applied = str2(tree?.lastAppliedRevision);
-  const attempted = str2(tree?.lastAttemptedRevision);
+  const applied = str4(tree?.lastAppliedRevision);
+  const attempted = str4(tree?.lastAttemptedRevision);
   if (!applied || !attempted || applied === attempted) return void 0;
   return { health: "progressing", detail: `applied ${applied}, attempted ${attempted}` };
 }
@@ -5394,23 +7075,23 @@ function fluxVerdict(o) {
   if (ready?.status === "False") return { health: "degraded", detail: describeReady(ready) };
   if (ready?.status === "Unknown") return { health: "progressing", detail: describeReady(ready) };
   if (ready?.status === "True") return revisionVerdict(tree) ?? { health: "healthy", detail: describeReady(ready) };
-  if (o.type === FLUX_HELMREPOSITORY_TYPE && str2(specTree(o)?.type) === "oci") {
+  if (o.type === FLUX_HELMREPOSITORY_TYPE && str4(specTree(o)?.type) === "oci") {
     return { health: "healthy", detail: "spec.type=oci (nothing to reconcile)" };
   }
   const conditions = tree?.conditions;
   const reconciling = Array.isArray(conditions) && conditions.some((c) => {
-    const cond = rec2(c);
+    const cond = rec4(c);
     return cond?.type === "Reconciling" && cond.status === "True";
   });
   if (reconciling) return { health: "progressing", detail: "Reconciling=True" };
-  if (!str2(o.status) || o.status === "PRESENT") {
+  if (!str4(o.status) || o.status === "PRESENT") {
     return { health: "progressing", detail: "no Ready condition yet" };
   }
   return void 0;
 }
 var DEPLOYMENT_TYPE = "K8s::Apps::Deployment";
 function unhappyCondition(o, type) {
-  const fromStrings = rec2(o.attributes)?.conditions;
+  const fromStrings = rec4(o.attributes)?.conditions;
   if (Array.isArray(fromStrings)) {
     for (const c of fromStrings) {
       if (typeof c === "string" && c.startsWith(type)) return c;
@@ -5420,13 +7101,13 @@ function unhappyCondition(o, type) {
   const raw = tree?.conditions;
   if (Array.isArray(raw)) {
     for (const c of raw) {
-      const cond = rec2(c);
+      const cond = rec4(c);
       if (!cond || cond.type !== type) continue;
-      const status = str2(cond.status);
+      const status = str4(cond.status);
       const unhappy = type === "ReplicaFailure" ? status === "True" : status === "False";
       if (!unhappy) continue;
-      const reason = str2(cond.reason);
-      const message = str2(cond.message);
+      const reason = str4(cond.reason);
+      const message = str4(cond.message);
       return `${type}${reason ? `=${reason}` : ""}${message ? `: ${message}` : ""}`;
     }
   }
@@ -5555,6 +7236,19 @@ var OpRunner = class {
    * before the first event lands so a reload between trigger and first event
    * doesn't show the PREVIOUS run's stale terminal state). */
   lastApplyProgress = initialApplyProgress;
+  /** The run playhead (#284 item 2): the settled StepRecords of the last Op
+   * `trigger()` started, plus the last `gateState` answer. Kept after the run
+   * ends and across renders for the same reason `lastApplyProgress` is — a
+   * client opening the ops lens mid-run (or after a reload) hydrates the
+   * playhead instead of starting blank. In-process only: a run started
+   * elsewhere is invisible here, and `chant run status` (src/server.ts's
+   * `/api/ops/:name/status`) is what answers for one. */
+  lastRunState = initialRunState;
+  /** The operator strip (#234 join 3): the last `chant operator status --json`
+   * read, plus the ConvergeOps the built project declares. Held here for the
+   * reason `lastRunState` is — it is a durable status read, not a run, and a
+   * client opening the ops lens hydrates from it instead of starting blank. */
+  lastOperatorState = initialOperatorState;
   /** #195: re-point delegated writes at a switched project. The runner reads
    * `deps.projectDir` at trigger time, so this is the whole retarget. */
   retarget(projectDir) {
@@ -5569,6 +7263,32 @@ var OpRunner = class {
   get applyProgress() {
     return this.lastApplyProgress;
   }
+  /** The run playhead's model (#284 item 2) — `initialRunState` until an Op has
+   * been triggered this session. */
+  get runState() {
+    return this.lastRunState;
+  }
+  /**
+   * Fold a `chant run status <name>` read (src/run-playhead.ts's
+   * `readRunStatus`) into the playhead, and broadcast it.
+   *
+   * The gate is a workflow QUERY, not part of the record stream, so it can only
+   * arrive this way. A read for an Op other than the one being watched is
+   * returned to the caller but not folded — one playhead, one Op, and silently
+   * re-pointing it at whatever was last polled would make the picture lie about
+   * which run it shows. A read arriving before anything has run this session
+   * adopts the Op: a gate pending on a run behold didn't start is exactly the
+   * case the pending card exists for.
+   */
+  noteGate(op, result) {
+    if (this.lastRunState.op !== null && this.lastRunState.op !== op) return this.lastRunState;
+    const base = this.lastRunState.op === op ? this.lastRunState : { ...initialRunState, op, mode: "temporal" };
+    const next = runGate(base, result);
+    const changed = JSON.stringify(next) !== JSON.stringify(this.lastRunState);
+    this.lastRunState = next;
+    if (changed) this.emitRun();
+    return this.lastRunState;
+  }
   /**
    * Start `chant run <name>` unless one is already running (the Sync/Adopt/auto-
    * sync path). `cwd` is the Op's own project dir (#31 multi-estate); defaults to
@@ -5578,9 +7298,78 @@ var OpRunner = class {
    * set it from the Op's declared gate: chant refuses a gated Op outright in
    * local mode ("gates and schedules need a durable runtime"), so without the
    * flag a gated Op could never run from behold at all.
+   *
+   * Either way the run is asked for structured per-step records (#284 item 2,
+   * chant#1676) — `--progress-json` streams one NDJSON `StepRecord` per settled
+   * step on the durable path; `--json` prints the whole `OpRunResult` at the end
+   * on the local one. Same record shape, which is what lets one playhead render
+   * both. `--json` replaces chant's own human per-step summary on the local
+   * path, so each parsed record is re-emitted to the `op` now-line
+   * ({@link recordLine}) and the operator loses no narration.
    */
   trigger(name, opEnv, cwd, temporal) {
-    return this.start(temporal ? ["run", name, "--temporal"] : ["run", name], name, opEnv, cwd);
+    if (this.current) return false;
+    const mode = temporal ? "temporal" : "local";
+    const args = temporal ? ["run", name, "--temporal", "--progress-json"] : ["run", name, "--json"];
+    this.lastRunState = runStarted(name, mode, (/* @__PURE__ */ new Date()).toISOString());
+    this.emitRun();
+    return this.start(
+      args,
+      name,
+      opEnv,
+      cwd,
+      (line) => {
+        const records = parseRunProgressLine(line);
+        if (!records) return false;
+        for (const record of records) {
+          this.lastRunState = runRecord(this.lastRunState, record);
+          this.deps.broadcaster.emit("op", recordLine(record));
+        }
+        this.emitRun();
+        return true;
+      },
+      (code) => {
+        this.lastRunState = runEnded(this.lastRunState, code, (/* @__PURE__ */ new Date()).toISOString());
+        this.emitRun();
+      }
+    );
+  }
+  emitRun() {
+    this.deps.broadcaster.emit("run", JSON.stringify(this.lastRunState));
+  }
+  /** The operator strip's model (#234 join 3) — `initialOperatorState` until the
+   * ops lens has been opened once. */
+  get operatorState() {
+    return this.lastOperatorState;
+  }
+  /**
+   * Record which ConvergeOps the built project declares, read from the emitted
+   * op.json (src/operator.ts's `declaredConvergeOps`) — no subprocess, and the
+   * thing that gates the strip. Broadcast on a change so a project rebuilt (or
+   * switched, #195) under an open tab grows or loses its strip without a reload.
+   */
+  noteDeclaredConvergeOps(declared) {
+    return this.foldOperator({ ...this.lastOperatorState, declared });
+  }
+  /**
+   * Fold a `chant operator status --json` read (src/operator.ts's
+   * `readOperatorStatus`) into the strip, and broadcast it.
+   *
+   * Broadcast only a CHANGED answer, for `noteGate`'s reason: a client asks when
+   * it opens the ops lens and re-pulls the lens on the broadcast, so an
+   * unchanged answer that still broadcast would have the two chasing each other.
+   */
+  noteOperator(result, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    return this.foldOperator(operatorRead(this.lastOperatorState, result, at));
+  }
+  /** Compare-and-broadcast, ignoring `readAt` — the instant behold asked changes
+   * on every poll and is not itself news; broadcasting on it would make the
+   * interval a repaint loop. */
+  foldOperator(next) {
+    const same = JSON.stringify({ ...next, readAt: null }) === JSON.stringify({ ...this.lastOperatorState, readAt: null });
+    this.lastOperatorState = next;
+    if (!same) this.deps.broadcaster.emit("operator", JSON.stringify(next));
+    return this.lastOperatorState;
   }
   /**
    * Run an arbitrary `chant` invocation through the same guard/stream/PR/capture
@@ -5712,8 +7501,12 @@ var OpRunner = class {
    * fully handled that line (apply()'s progress-JSON parsing) — `start()` then
    * skips its own `op`/`pr` broadcast for that one line, leaving every other
    * line's raw-log fallback untouched.
+   *
+   * `onExit` (the run playhead, #284 item 2) sees the exit code the moment the
+   * process ends — the only signal that separates "the run finished" from "the
+   * stream stopped", and the reason the playhead never has to infer completion.
    */
-  start(args, label, opEnv, cwd, onLine) {
+  start(args, label, opEnv, cwd, onLine, onExit) {
     if (this.current) return false;
     const { projectDir, broadcaster } = this.deps;
     broadcaster.emit("op", `\u25B6 chant ${args.join(" ")}`);
@@ -5726,6 +7519,7 @@ var OpRunner = class {
     this.current = label;
     void op.done.then((code) => {
       broadcaster.emit("op", `\u25A0 ${label} exited ${code}`);
+      onExit?.(code);
       this.current = null;
       Promise.resolve(this.deps.onDone(opEnv)).then(() => broadcaster.emit("changed")).catch((err) => broadcaster.emit("op", `\u26A0 post-op capture: ${err instanceof Error ? err.message : String(err)}`));
     });
@@ -5735,24 +7529,24 @@ var OpRunner = class {
 
 // src/substrates.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
+import { join as join15 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let out = "";
     let proc;
     try {
       proc = spawn4(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve8({ code: 127, out: "" });
+      resolve9({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve8({ code: 127, out }));
-    proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
+    proc.on("error", () => resolve9({ code: 127, out }));
+    proc.on("close", (code) => resolve9({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable(run3) {
@@ -5765,11 +7559,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync10(join12(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync10(join15(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync11(join12(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync12(join15(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -5821,7 +7615,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync10(join12(projectDir, marker))) continue;
+    if (!existsSync10(join15(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -5855,7 +7649,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync10(join12(projectDir, ".github", "workflows"))) {
+  if (existsSync10(join15(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -5868,7 +7662,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync11(join12(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync12(join15(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -5971,185 +7765,9 @@ async function openRollbackBranches(projectDir, env) {
   }
 }
 
-// src/estate.ts
-import { statSync as statSync3 } from "node:fs";
-import { availableParallelism } from "node:os";
-import { join as join13, resolve as resolve3, sep as sep2 } from "node:path";
-import { composeStacks, shortStackNames } from "@intentius/pinhole";
-function estateReadPool(members, env = process.env) {
-  const override = Number.parseInt(env.BEHOLD_ESTATE_CONCURRENCY ?? "", 10);
-  const cap = Number.isInteger(override) && override >= 1 ? override : Math.min(4, availableParallelism());
-  return Math.max(1, Math.min(cap, members));
-}
-async function mapPool(items, width, fn) {
-  const results = new Array(items.length);
-  let next = 0;
-  const worker = async () => {
-    for (let i = next++; i < items.length; i = next++) {
-      results[i] = await fn(items[i], i);
-    }
-  };
-  await Promise.all(Array.from({ length: Math.max(1, Math.min(width, items.length)) }, () => worker()));
-  return results;
-}
-async function composeEstate(projectDirs, opts = {}) {
-  const names = shortStackNames(projectDirs);
-  const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
-    name: names[i],
-    ir: await graphIr(dir, opts)
-  }));
-  return composeStacks(stacks);
-}
-var firstLine2 = (e) => {
-  const msg = e instanceof Error ? e.message : String(e);
-  const m = msg.match(/exited \d+:\s*([\s\S]*)/);
-  return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
-};
-function namespaceRuntimeOwners(name, ir) {
-  const own = new Set(ir.nodes.map((n) => n.id));
-  for (const n of ir.nodes) {
-    if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
-  }
-  return ir;
-}
-var NAMESPACE_JOIN_FLOOR = "0.44.5";
-var rec3 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-var str3 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
-var realIsDir = (p) => {
-  try {
-    return statSync3(p).isDirectory();
-  } catch {
-    return false;
-  }
-};
-function declaredNamespaceBindings(ir) {
-  const out = [];
-  for (const n of ir.nodes) {
-    if (n.kind !== "K8s::Flux::Kustomization") continue;
-    const spec = rec3(n.attrs?.spec);
-    const namespace = str3(spec?.targetNamespace);
-    const path = str3(spec?.path);
-    if (namespace && path) out.push({ path, namespace });
-  }
-  return out;
-}
-function awaitsNamespaceBinding(ir) {
-  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
-  if (namespaced.length === 0) return false;
-  return namespaced.every((n) => !str3(rec3(n.attrs?.metadata)?.namespace));
-}
-function declaredSegments(path) {
-  if (path.startsWith("/")) return void 0;
-  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
-  if (segs.length === 0 || segs.includes("..")) return void 0;
-  return segs;
-}
-function pathAlignment(declared, dir, isDir = realIsDir) {
-  const want = declaredSegments(declared);
-  if (!want) return 0;
-  const root = resolve3(dir);
-  const have = root.split(sep2).filter(Boolean);
-  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
-    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join13(root, ...want.slice(k)))) continue;
-    return k;
-  }
-  return 0;
-}
-function joinNamespaceBindings(members, isDir = realIsDir) {
-  const bindings = members.flatMap(
-    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
-  );
-  if (bindings.length === 0) return [];
-  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
-  if (awaiting.length === 0) return [];
-  const best = /* @__PURE__ */ new Map();
-  for (const b of bindings) {
-    let winner;
-    let tied = false;
-    for (const m of awaiting) {
-      if (m.dir === b.declaredBy) continue;
-      const score = pathAlignment(b.path, m.dir, isDir);
-      if (score === 0) continue;
-      if (!winner || score > winner.score) {
-        winner = { dir: m.dir, score };
-        tied = false;
-      } else if (score === winner.score) {
-        tied = true;
-      }
-    }
-    if (!winner || tied) continue;
-    const prev = best.get(winner.dir);
-    if (prev === "ambiguous") continue;
-    const join19 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join19 });
-    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join19 });
-  }
-  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
-}
-async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
-  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
-  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
-  const irs = await mapPool(
-    projectDirs,
-    estateReadPool(projectDirs.length),
-    (dir) => graphIr(dir, { ...src, detail: 3 }).catch(() => void 0)
-  );
-  const scopes = /* @__PURE__ */ new Map();
-  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
-    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
-    scopes.set(j.dir, j.namespace);
-  }
-  return scopes;
-}
-function withoutJoinedMembers(nodes, joined) {
-  if (joined.length === 0) return [...nodes];
-  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
-}
-async function composeEstateOverlay(projectDirs, opts, classify) {
-  const names = shortStackNames(projectDirs);
-  const unobserved = [];
-  const dropped = [];
-  const joined = [];
-  const stacks = new Array(projectDirs.length);
-  const scopes = await estateNamespaceScopes(projectDirs, opts);
-  await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => {
-    const name = names[i];
-    const namespace = scopes.get(dir);
-    try {
-      const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
-      stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
-      if (namespace) joined.push({ name, namespace });
-    } catch (err) {
-      const reason = firstLine2(err);
-      try {
-        const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
-        const src = await graphIr(dir, srcOpts);
-        for (const n of src.nodes) n.attrs = { ...n.attrs, _status: "neutral", _unobserved: reason };
-        stacks[i] = { name, ir: src };
-        unobserved.push({ name, reason });
-      } catch (err2) {
-        dropped.push({ name, reason: firstLine2(err2) });
-      }
-    }
-  });
-  const present = stacks.filter((s) => !!s);
-  return {
-    ir: composeStacks(present),
-    observed: present.length - unobserved.length,
-    total: projectDirs.length,
-    unobserved,
-    dropped,
-    // Concurrent reads finish in whatever order the clusters answer; the note
-    // this feeds should read the same twice.
-    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
-  };
-}
-
 // src/events.ts
 import { watch, existsSync as existsSync11 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -6167,7 +7785,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync11(join14(projectDir, "src")) ? join14(projectDir, "src") : projectDir;
+  const dir = existsSync11(join16(projectDir, "src")) ? join16(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -6416,8 +8034,8 @@ function renderLanes(frames, summaries) {
     status: Object.fromEntries(f.ir.nodes.map((n) => [n.id, n.attrs?._status ?? ""])),
     lexicon: Object.fromEntries(f.ir.nodes.map((n) => [n.id, n.lexicon]))
   }));
-  const strip = `<style>${LANES_CSS}</style>` + THEME_BOOT + `<div id="behold-diff"></div><div id="behold-lanes"><div class="hd"><span>deployment lanes</span><span id="behold-lanes-meta"></span><span class="rt" id="behold-lanes-rt" style="display:none">offset \u2014 graph shows real time</span><a href="/">\u2190 graph</a><span id="behold-lanes-pickers"></span></div><canvas id="behold-lanes-canvas"></canvas></div>` + laneStripScript(laneFrames);
-  return doc.includes("</body>") ? doc.replace("</body>", `${strip}</body>`) : doc + strip;
+  const strip3 = `<style>${LANES_CSS}</style>` + THEME_BOOT + `<div id="behold-diff"></div><div id="behold-lanes"><div class="hd"><span>deployment lanes</span><span id="behold-lanes-meta"></span><span class="rt" id="behold-lanes-rt" style="display:none">offset \u2014 graph shows real time</span><a href="/">\u2190 graph</a><span id="behold-lanes-pickers"></span></div><canvas id="behold-lanes-canvas"></canvas></div>` + laneStripScript(laneFrames);
+  return doc.includes("</body>") ? doc.replace("</body>", `${strip3}</body>`) : doc + strip3;
 }
 
 // src/emulator.ts
@@ -6455,13 +8073,13 @@ async function emulatorDown(projectDir) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync12, existsSync as existsSync12, cpSync } from "node:fs";
-import { join as join15, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
+import { readFileSync as readFileSync13, existsSync as existsSync12, cpSync } from "node:fs";
+import { join as join17, relative as relative3, resolve as resolve5, sep as sep3 } from "node:path";
 import { spawn as spawn5, spawnSync } from "node:child_process";
 function loadDemoRegistry(pkgRoot2) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync12(join15(pkgRoot2, "demos.json"), "utf8"));
+    raw = JSON.parse(readFileSync13(join17(pkgRoot2, "demos.json"), "utf8"));
   } catch {
     return [];
   }
@@ -6501,22 +8119,22 @@ function fetchesFromNetwork(entry) {
   return entry.source === "git";
 }
 function demoTargetDir(entry, cwd = process.cwd()) {
-  const legacy = resolve4(cwd, "behold-demo");
+  const legacy = resolve5(cwd, "behold-demo");
   if (entry.name === "writes" && existsSync12(legacy)) return legacy;
-  return resolve4(cwd, "behold-demos", entry.name);
+  return resolve5(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot2, target } = opts;
   const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
   if (!existsSync12(target)) {
     if (entry.source === "bundled") {
-      const bundled = join15(pkgRoot2, entry.dir);
+      const bundled = join17(pkgRoot2, entry.dir);
       if (!existsSync12(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(bundled, target, {
           recursive: true,
-          filter: (src) => !relative2(bundled, src).split(sep3).includes("node_modules")
+          filter: (src) => !relative3(bundled, src).split(sep3).includes("node_modules")
         });
       } catch (err) {
         return { ok: false, error: `copy failed: ${err instanceof Error ? err.message : String(err)}` };
@@ -6530,7 +8148,7 @@ async function loadDemo(entry, opts) {
   } else {
     say(`reusing ${target}`);
   }
-  if (existsSync12(join15(target, "package.json")) && !existsSync12(join15(target, "node_modules"))) {
+  if (existsSync12(join17(target, "package.json")) && !existsSync12(join17(target, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${target}` };
@@ -6542,7 +8160,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join15(target, d)) : [target] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join17(target, d)) : [target] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -6553,8 +8171,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join16(dirname4(fileURLToPath3(import.meta.url)), "..");
-var webRoot = join16(pkgRoot, "web");
+var pkgRoot = join18(dirname5(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join18(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -6603,8 +8221,8 @@ function tierFailure(tier, message) {
 }
 function beholdVersion() {
   try {
-    const here = dirname4(fileURLToPath3(import.meta.url));
-    return JSON.parse(readFileSync13(join16(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    const here = dirname5(fileURLToPath3(import.meta.url));
+    return JSON.parse(readFileSync14(join18(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -6649,7 +8267,9 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load = () => readCarveReport(reportPath, (p) => readFileSync13(p, "utf8"));
+  const load = () => readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
+  const carveDirs = [dirname5(reportPath), ...demo ? [demo.out] : []];
+  const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const demoBlock = () => carveWriteBlock(demo);
   const demoInfo = () => {
     if (!demo) return null;
@@ -6661,8 +8281,8 @@ function carveRoutes(app, reportPath, demo) {
       project: demo.project,
       out: demo.out,
       // Paths the UI can print without leaking the operator's whole home dir.
-      outLabel: relative3(demo.root, demo.out).split(sep4).join("/"),
-      fromLabel: relative3(demo.root, demo.from).split(sep4).join("/"),
+      outLabel: relative4(demo.root, demo.out).split(sep4).join("/"),
+      fromLabel: relative4(demo.root, demo.from).split(sep4).join("/"),
       runnable: !block,
       ...block ? { reason: block } : {},
       // The live tier, when this boot armed it: the scratch endpoint the
@@ -6679,7 +8299,7 @@ function carveRoutes(app, reportPath, demo) {
   let appGraph;
   const appGraphOnce = () => {
     if (!demo) return Promise.resolve(null);
-    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative3(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
+    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative4(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
     return appGraph;
   };
   app.get("/api/graph", async (c) => {
@@ -6687,10 +8307,21 @@ function carveRoutes(app, reportPath, demo) {
     if (!parsed.ok) return c.json(parsed.refusal, 422);
     const tfIr = carveReportToIr(parsed.report);
     const appSide = await appGraphOnce();
+    const states = carveStates();
+    const shorten = demo ? (p) => shortenIn(p, demo.root) : (p) => p;
+    const single = () => {
+      const split = splitCarveState(tfIr, states, { shorten });
+      return bandGraduated(split.tf, split.graduated);
+    };
     const { svg, ir } = appSide ? renderCarveEstate(tfIr, appSide.ir, {
-      tfTitle: `${relative3(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
-      appTitle: `${appSide.label} \u2014 chant`
-    }) : { ...renderBanded(tfIr), ir: tfIr };
+      tfTitle: `${relative4(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      appTitle: `${appSide.label} \u2014 chant`,
+      carved: states,
+      shorten
+    }) : (() => {
+      const banded = single();
+      return { ...renderBanded(banded), ir: banded };
+    })();
     return c.json({
       ir,
       svg,
@@ -6702,7 +8333,7 @@ function carveRoutes(app, reportPath, demo) {
         carve: true,
         // A demo whose own advisor run failed says so on the statusbar, not
         // only in the terminal the viewer isn't looking at.
-        note: carveNote(parsed.report, tfIr) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
+        note: carveNote(parsed.report, tfIr) + carveStateNote(carveProgress(states.values(), tfIr.nodes.length), states) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
       }
     });
   });
@@ -6734,14 +8365,22 @@ function carveRoutes(app, reportPath, demo) {
     }
     const tfIr = carveReportToIr(parsed.report);
     const html = renderCarveMorph(tfIr, appSide.ir, [select], {
-      tfTitle: `${relative3(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      tfTitle: `${relative4(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
       appTitle: `${appSide.label} \u2014 chant`,
-      title: `carve \u2014 ${select}`
+      title: `carve \u2014 ${select}`,
+      carved: carveStates(),
+      shorten: (p) => shortenIn(p, demo.root)
     });
     return c.html(html);
   });
   app.get("/api/project", (c) => {
     const parsed = load();
+    const total = parsed.ok ? parsed.report.count ?? parsed.report.resources.length : null;
+    const state = carveStatePayload(
+      carveStates(),
+      total,
+      () => demo ? { from: shortenIn(demo.from, demo.root), out: shortenIn(demo.out, demo.root) } : {}
+    );
     return c.json({
       projectDir: reportPath,
       recents: [],
@@ -6755,11 +8394,12 @@ function carveRoutes(app, reportPath, demo) {
       carve: parsed.ok ? {
         report: reportPath,
         from: parsed.report.from ?? null,
-        count: parsed.report.count ?? parsed.report.resources.length,
+        count: total,
         bands: parsed.report.bands ?? {},
         advisory: parsed.report.advisory ?? null,
-        demo: demoInfo()
-      } : { report: reportPath, demo: demoInfo() }
+        demo: demoInfo(),
+        state
+      } : { report: reportPath, demo: demoInfo(), state }
     });
   });
   const runStep2 = async (c, run3) => {
@@ -6869,7 +8509,17 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       // of starting blank — the `apply` SSE event (below) carries every update
       // after that. `status: "idle"` (initialApplyProgress) when nothing has
       // applied yet this session.
-      applyProgress: runner.applyProgress
+      applyProgress: runner.applyProgress,
+      // The run playhead (#284 item 2): the settled StepRecords of the Op this
+      // session last triggered, so a client opening (or reloading) mid-run
+      // hydrates the playhead instead of starting blank — the `run` SSE event
+      // carries every update after that. `status: "idle"` when nothing has run.
+      runState: runner.runState,
+      // #234 join 3: the operator strip's last known model, so a client that
+      // opens (or reloads) hydrates the strip instead of starting blank — same
+      // reason `runState` is here. `declared: []` until the ops lens has been
+      // opened once, since that is where the op.json read happens.
+      operatorState: runner.operatorState
     })
   );
   app.post("/api/ops/:name/run", (c) => {
@@ -6910,8 +8560,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join16(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join16(cfg.projectDir, "scripts/local/local-up.sh");
+    const down = join18(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join18(cfg.projectDir, "scripts/local/local-up.sh");
     if (!existsSync13(down) || !existsSync13(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
@@ -6920,6 +8570,62 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     return c.json({ started: true, ran: "local-down + local-up" });
   });
+  app.get("/api/ops/:name/status", async (c) => {
+    const name = c.req.param("name");
+    const info = estateOps().find((o) => o.name === name);
+    const run3 = await runChantRaw(["run", "status", name, "--temporal"], info?.dir ?? cfg.projectDir);
+    const result = readRunStatus(name, run3);
+    const runState = runner.noteGate(name, result);
+    if (!result.ok) return c.json({ ...result.refusal, runState }, 422);
+    return c.json({ ...result.read, runState });
+  });
+  const convergeDirs = () => {
+    const dirs = [];
+    const declared = [];
+    for (const f of discoverOpIrs(estateDirs)) {
+      const parsed = readOpIr(f.path, (p) => readFileSync14(p, "utf8"));
+      if (!parsed.ok) continue;
+      const mine = declaredConvergeOps([parsed.ir]);
+      if (!mine.length) continue;
+      declared.push(...mine);
+      if (!dirs.includes(f.dir)) dirs.push(f.dir);
+    }
+    return { dirs, declared };
+  };
+  app.get("/api/operator/status", async (c) => {
+    const { dirs, declared } = convergeDirs();
+    runner.noteDeclaredConvergeOps(declared);
+    if (!dirs.length) {
+      const state2 = runner.noteOperator({
+        ok: false,
+        refusal: {
+          error: "This project declares no operating loop \u2014 no emitted Op carries chant's `Converge` search attribute.",
+          code: "no-operator",
+          remedy: HOW_TO_DECLARE
+        }
+      });
+      return c.json({ ...state2, operator: state2 }, 200);
+    }
+    const rows = [];
+    for (const dir of dirs) {
+      const run3 = await runChantRaw(["operator", "status", "--json"], dir);
+      const result = readOperatorStatus(run3);
+      if (!result.ok) return c.json({ ...result.refusal, operator: runner.noteOperator(result) }, 422);
+      rows.push(...result.rows);
+    }
+    const state = runner.noteOperator({ ok: true, rows });
+    return c.json({ ...state, operator: state });
+  });
+  app.post("/api/operator/approve/:op/:gate", async (c) => {
+    const { op, gate } = c.req.param();
+    const info = estateOps().find((o) => o.name === op);
+    broadcaster.emit("op", `\u270E approve ${op} ${gate} \u2014 records a fact; the next tick acts on it`);
+    const { code, stderr, stdout } = await runChantRaw(["approve", op, gate], info?.dir ?? cfg.projectDir);
+    if (code !== 0) {
+      return c.json({ error: stderr.trim() || stdout.trim() || `approve exited ${code}`, code: "approve" }, 500);
+    }
+    return c.json({ recorded: true, op, gate, semantics: APPROVE_SEMANTICS });
+  });
   app.post("/api/ops/:name/signal/:gate", async (c) => {
     const { name, gate } = c.req.param();
     const info = estateOps().find((o) => o.name === name);
@@ -6946,8 +8652,11 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const { environments, lexicons, stacks, k8sProfiles } = await detectProject(cfg.projectDir);
     const k8sTarget = lexicons.includes("k8s") ? resolveK8sTarget(k8sProfiles, cfg.env, await loadKubeconfig()) : void 0;
     const axes = deployAxes(tierEnvVar, lexicons, k8sTarget);
+    const emittedOps = discoverOpIrs(estateDirs).length;
+    const carveState = carveStatePayload(readCarveStates(estateDirs));
     return c.json({
       projectDir: cfg.projectDir,
+      ...carveState.manifests ? { carve: { state: carveState } } : {},
       // #195: the full estate composition (multi-project serves) and the
       // switcher's recents, so the SPA's project section can show what's
       // loaded and offer where to go. Recents exclude nothing here — the SPA
@@ -6978,6 +8687,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       // the names — `graphPath` (chant.ts) resolves a picked name to its `src`
       // server-side; the SPA never needs the path.
       ...stacks?.length ? { stacks: stacks.map((s) => s.name) } : {},
+      // The ops lens stop (#284), gated exactly like `tiers`/`stacks` above:
+      // present only when the estate has actually emitted Ops, so a project on
+      // a chant < 0.50, or one that has never been built, grows no dead zoom
+      // stop and no dead ⌘K entry. The count, not a bare flag — the SPA shows
+      // it, and "ops: 0" is not a thing this can ever say.
+      ...emittedOps ? { ops: emittedOps } : {},
       targets: deployTargets(lexicons, k8sTarget),
       // Where the k8s binding came from, so the SPA never implies behold chose
       // it (#106). Absent for a project with no k8s lexicon or no resolvable
@@ -6989,9 +8704,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : "";
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve6(body.dir.trim()) : "";
     if (!dir || !existsSync13(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync13(join16(dir, "chant.config.ts"))) {
+    if (!existsSync13(join18(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -7011,7 +8726,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve6(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -7079,7 +8794,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
       if (!loaded.ok) return c.json({ error: loaded.error }, 500);
       const dirs = loaded.serveDirs;
-      if (!existsSync13(join16(dirs[0], "chant.config.ts"))) {
+      if (!existsSync13(join18(dirs[0], "chant.config.ts"))) {
         return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
       }
       if (entry.serve.local) {
@@ -7177,7 +8892,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           path: "/api/demos/open",
           desc: "load a demo and serve it: JSON body {name} (a catalog name, never a path) \u2014 copies/clones, installs, runs its setup, then switches (preview-locked)"
         },
-        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
+        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, ops=1, env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
         ...cfg.carveReport ? [
           { method: "GET", path: "/api/carve", desc: "carve mode: the raw `chant carve advise --json` peelability report this server is rendering" },
           {
@@ -7199,14 +8914,17 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "GET", path: "/api/resources", desc: "component \u2192 declared resources" },
         { method: "GET", path: "/api/ci", desc: "generated CI pipeline projection {stages, jobs, forge}" },
         { method: "GET", path: "/api/substrates", desc: "substrate readiness {substrates: [{name, label, status, detail, bringUp?}]}" },
-        { method: "GET", path: "/api/ops", desc: "committed Ops + adopt lexicons + apply progress" },
+        { method: "GET", path: "/api/ops", desc: "committed Ops + adopt lexicons + apply progress + run playhead" },
+        { method: "GET", path: "/api/ops/:name/status", desc: "an Op's durable run status + pending gate (chant run status)" },
+        { method: "GET", path: "/api/operator/status", desc: "the operating loop's strip: last tick per ConvergeOp + lease + pending converge gates" },
         { method: "GET", path: "/api/history", desc: "recent source commits (rollback targets)" },
         { method: "GET", path: "/api/frames", desc: "captured lanes frames" },
-        { method: "GET", path: "/api/events", desc: "SSE: changed / op / apply / pr" },
+        { method: "GET", path: "/api/events", desc: "SSE: changed / op / apply / run / pr" },
         { method: "POST", path: "/api/refresh", desc: "re-observe live now (?env=) \u2014 returns the fresh graph" },
         { method: "POST", path: "/api/apply", desc: "delegated apply: ?env=&component=<name|all> (guarded, preview-locked)" },
         { method: "POST", path: "/api/ops/:name/run", desc: "run a committed Op (delegated write)" },
-        { method: "POST", path: "/api/ops/:name/signal/:gate", desc: "approve an Op's gate" },
+        { method: "POST", path: "/api/ops/:name/signal/:gate", desc: "approve an Op's gate (releases the waiting run)" },
+        { method: "POST", path: "/api/operator/approve/:op/:gate", desc: "record a converge gate's resolution (chant approve \u2014 a fact for the next tick, not an unblock)" },
         { method: "POST", path: "/api/rollback", desc: "open a rollback PR: ?to=<sha>" },
         { method: "POST", path: "/api/substrates/:name/up", desc: "bring a substrate up" },
         { method: "POST", path: "/api/local/reset", desc: "reset the local emulator" },
@@ -7218,6 +8936,58 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const url = new URL(c.req.url);
     const opts = optsFromQuery(url, tierEnvVar, cfg.projectDir);
     try {
+      if (url.searchParams.get("ops") === "1") {
+        const files = discoverOpIrs(estateDirs);
+        if (!files.length) {
+          return c.json(
+            {
+              error: "this project has no emitted Ops \u2014 nothing under dist/ops/<name>/op.json",
+              code: "op-ir",
+              remedy: HOW_TO_EMIT
+            },
+            422
+          );
+        }
+        const parsedOps = [];
+        for (const f of files) {
+          const parsed = readOpIr(f.path, (p) => readFileSync14(p, "utf8"));
+          if (!parsed.ok) return c.json(parsed.refusal, 422);
+          parsedOps.push(parsed.ir);
+        }
+        const declaredIr = opsToIr(parsedOps);
+        const runState = runner.runState;
+        const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
+        const join21 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join21 ? paintPlayhead(declaredIr, join21, runState.gate) : declaredIr;
+        const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
+        const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
+        return c.json({
+          ir: opsIr,
+          svg: svg2,
+          meta: {
+            projectDir: cfg.projectDir,
+            env: cfg.env ?? null,
+            tier: null,
+            target: null,
+            mode: "ops",
+            ops: parsedOps.length,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join21)} ${operatorNote(operator)}`,
+            // The operator strip's own model: the ConvergeOps this project
+            // declares, plus whatever the last status read said. `declared`
+            // without a `strip` is the honest starting state — a loop exists and
+            // behold hasn't asked about it yet.
+            operator,
+            // The playhead's own model, so the SPA renders the pending card and
+            // the run legend from the same answer that painted the graph.
+            run: runState,
+            // #234's pending-approval card, whole: the gate, when it started
+            // waiting, the step it holds back, and the delegated write its
+            // approve button performs. Present only when `gateState` NAMED a
+            // pending gate — never inferred from a stalled track.
+            gate: runState.gate && runState.op ? pendingGateCard(runState.op, runState.gate, opsIr) : null
+          }
+        });
+      }
       const components = url.searchParams.get("components") === "1";
       const logical = url.searchParams.get("logical") === "1";
       const multi = cfg.projectDirs && cfg.projectDirs.length > 1;
@@ -7228,6 +8998,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         ir = await composeEstate(cfg.projectDirs, logical ? { ...opts, detail: 3 } : opts);
         ir = addValueMatchEdges(ir);
         ir = addK8sDeclaredEdges(ir);
+        ir = markOperatorHome(ir);
         const estateContext = await boundK8sContext(metaEnv ?? void 0);
         ir = addClusterAnchorEdges(ir, estateContext);
         if (logical) {
@@ -7272,6 +9043,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         if ((opts.detail ?? 2) < 3) ir = pruneImports(ir);
         ir = addValueMatchEdges(ir);
         ir = addK8sDeclaredEdges(ir);
+        ir = markOperatorHome(ir);
         ir = addClusterAnchorEdges(ir, await boundK8sContext(metaEnv ?? void 0));
       }
       let srcCompositeEdgesAttached;
@@ -7285,7 +9057,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join16(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join18(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -7403,6 +9175,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         if ((detail ?? 2) < 3) ir2 = pruneImports(ir2);
         ir2 = addValueMatchEdges(ir2);
         ir2 = addK8sDeclaredEdges(ir2);
+        ir2 = markOperatorHome(ir2);
         const boundContext2 = await boundK8sContext(env);
         ir2 = addClusterAnchorEdges(ir2, boundContext2);
         const coverNote = est.unobserved.length || est.dropped.length ? `live observe covered ${est.observed} of ${est.total} projects \u2014 ` + [
@@ -7448,6 +9221,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const observed = await lifecycleDiffLive(cfg.projectDir, env, query).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
         applyHelmArtifacts(ir, observed);
         synthesizeHelmReleases(ir, observed, discoverReleaseUnits(cfg.projectDir));
+        applyHelmRenderDrift(ir, await readHelmRenderDrift(cfg.projectDir, env, query));
       }
       ir = runtime ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
       if (logical) {
@@ -7461,6 +9235,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       if ((query.detail ?? 2) < 3) ir = pruneImports(ir);
       ir = addValueMatchEdges(ir);
       ir = addK8sDeclaredEdges(ir);
+      ir = markOperatorHome(ir);
       ir = addClusterAnchorEdges(ir, boundContext);
       let compositeEdgesAttached;
       if (query.detail === 1) {
@@ -7496,6 +9271,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const observed = await lifecycleDiffLive(cfg.projectDir, env).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
         applyHelmArtifacts(result.ir, observed);
         synthesizeHelmReleases(result.ir, observed, discoverReleaseUnits(cfg.projectDir));
+        applyHelmRenderDrift(result.ir, await readHelmRenderDrift(cfg.projectDir, env));
       }
     }
     if (env) {
@@ -7623,9 +9399,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     return c.json({ started: true, component, env });
   });
-  const rel = relative3(process.cwd(), webRoot) || ".";
+  const rel = relative4(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join16(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join18(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -7654,7 +9430,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync13(join16(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync13(join18(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -7670,6 +9446,10 @@ async function startServer(cfg) {
     broadcaster.emit("changed", memberDir ?? "");
     void capture2();
   };
+  const onMemberSourceChange = (memberDir) => {
+    invalidateMember(memberDir);
+    onEstateChange(memberDir);
+  };
   const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename(dir)}]` : "";
   const onPollDrift = (dir, movedLexicons) => {
     onEstateChange(dir);
@@ -7699,7 +9479,7 @@ async function startServer(cfg) {
   };
   const carve = !!cfg.carveReport;
   let stopWatch = carve ? () => {
-  } : watchSources(cfg.projectDirs ?? [cfg.projectDir], onEstateChange);
+  } : watchSources(cfg.projectDirs ?? [cfg.projectDir], onMemberSourceChange);
   let stopPoll = !carve && cfg.env && cfg.pollSecs ? startDriftPoll({
     intervalMs: cfg.pollSecs * 1e3,
     // Per-member queries, swept sequentially inside the poll (#297): a
@@ -7716,7 +9496,7 @@ async function startServer(cfg) {
   };
   cfg.onProjectSwitch = (dir) => {
     stopWatch();
-    stopWatch = watchSources(cfg.projectDirs ?? [dir], onEstateChange);
+    stopWatch = watchSources(cfg.projectDirs ?? [dir], onMemberSourceChange);
     stopPoll();
     stopPoll = () => {
     };
@@ -7789,12 +9569,12 @@ async function startServer(cfg) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "node:fs";
-import { join as join17, dirname as dirname5, basename as basename2 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "node:fs";
+import { join as join19, dirname as dirname6, basename as basename2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-var LENS_PARAMS = ["components", "detail", "env", "logical", "radial", "tier"];
+var LENS_PARAMS = ["components", "detail", "env", "logical", "ops", "radial", "tier"];
 function canonicalKey(path, params) {
-  const flat = params.get("components") === "1" || params.get("logical") === "1";
+  const flat = params.get("components") === "1" || params.get("logical") === "1" || params.get("ops") === "1";
   const q = LENS_PARAMS.filter((k) => params.has(k) && !(flat && (k === "detail" || k === "radial"))).map((k) => `${k}=${params.get(k)}`).join("&");
   return q ? `${path}?${q}` : path;
 }
@@ -7808,6 +9588,7 @@ function captureKeys(axes) {
   add("/api/project", {});
   add("/api/substrates", {});
   add("/api/ops", {});
+  if (axes.ops) add("/api/graph", { ops: "1" });
   const tiers = axes.tiers && axes.tiers.length ? axes.tiers : [""];
   const envs = ["", ...axes.environments];
   for (const env of envs) {
@@ -7838,7 +9619,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join17(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
+  return join19(dirname6(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename2(project)}`;
@@ -7848,8 +9629,8 @@ function workerName(project, override) {
 async function runExport(cfg, outDir, opts = {}) {
   const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
-  const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [] };
-  const snapDir = join17(outDir, "snapshots");
+  const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [], ...proj.ops ? { ops: proj.ops } : {} };
+  const snapDir = join19(outDir, "snapshots");
   mkdirSync4(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -7858,7 +9639,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
     const file = slug2(key);
-    writeFileSync4(join17(snapDir, file), body);
+    writeFileSync4(join19(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -7870,21 +9651,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync4(join17(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync14(join17(webDir(), "index.html"), "utf8").replace(
+  writeFileSync4(join19(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync15(join19(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync4(join17(outDir, "index.html"), html);
-  for (const f of readdirSync5(webDir())) {
+  writeFileSync4(join19(outDir, "index.html"), html);
+  for (const f of readdirSync7(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join17(webDir(), f), join17(outDir, f));
+    copyFileSync(join19(webDir(), f), join19(outDir, f));
   }
-  writeFileSync4(join17(outDir, "README.md"), BUNDLE_README);
+  writeFileSync4(join19(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync4(
-    join17(outDir, "wrangler.jsonc"),
+    join19(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -7932,7 +9713,7 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 `;
 
 // src/doctor.ts
-import { relative as relative4, resolve as resolve6 } from "node:path";
+import { relative as relative5, resolve as resolve7 } from "node:path";
 var list2 = (xs) => xs.join(", ");
 var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
 function summarize(xs, max = 4) {
@@ -7940,7 +9721,7 @@ function summarize(xs, max = 4) {
 }
 function labelFor(root, target, estate) {
   if (!estate) return "";
-  const rel = relative4(root, target);
+  const rel = relative5(root, target);
   return `${rel || "."}: `;
 }
 function chantCheck(root, targets, estate) {
@@ -7953,7 +9734,7 @@ function chantCheck(root, targets, estate) {
       name: "chant",
       status: "fail",
       detail: `${list2(resolutions.map(describe))} \u2014 behold shells the project's own chant`,
-      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative4(root, target) || target))}`
+      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative5(root, target) || target))}`
     };
   }
   const stale = resolutions.filter(({ res }) => !meetsFloor(res.version, floor));
@@ -8081,7 +9862,7 @@ function opsCheck(root, ops, chantSource, estate) {
   return { name: "ops", status: "pass", detail: `${ops.length} committed: ${list2(names)}; ${mcp}` };
 }
 async function diagnose(dir, probes = {}) {
-  const root = resolve6(dir);
+  const root = resolve7(dir);
   const shape = detectProjectShape(root);
   const behold = beholdVersion();
   if (shape.kind === "none") {
@@ -8101,16 +9882,16 @@ async function diagnose(dir, probes = {}) {
     };
   }
   const estate = shape.kind === "estate";
-  const members = (shape.members ?? []).map((m) => resolve6(root, m));
+  const members = (shape.members ?? []).map((m) => resolve7(root, m));
   const targets = estate ? members : [root];
   const primary = targets[0];
   const projectCheck = estate ? {
     name: "project",
     status: "pass",
     detail: `estate of ${members.length} projects (${shape.membersFrom === "behold-config" ? ".behold.json members" : "npm workspaces"}): ${list2(
-      members.map((m) => relative4(root, m))
+      members.map((m) => relative5(root, m))
     )}`
-  } : { name: "project", status: "pass", detail: `chant project (${relative4(root, shape.configFile)})` };
+  } : { name: "project", status: "pass", detail: `chant project (${relative5(root, shape.configFile)})` };
   const infos = await Promise.all(targets.map(async (t) => ({ target: t, info: await detectProject(t) })));
   const declared = new Map(infos.map(({ target, info }) => [target, info.lexicons]));
   const lexicons = [...new Set(infos.flatMap(({ info }) => info.lexicons))];
@@ -8335,7 +10116,7 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve7(d));
+  const dirs = projectDirs.map((d) => resolve8(d));
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -8354,7 +10135,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join18(dir, m)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join20(dir, m)).join(" ")}
 `
     );
     return;
@@ -8389,8 +10170,8 @@ async function runCarve(rest) {
     );
     process.exit(2);
   }
-  const reportPath = resolve7(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync15(p, "utf8"));
+  const reportPath = resolve8(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync16(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -8401,7 +10182,7 @@ async function runCarve(rest) {
     `behold carve \u2014 ${parsed.report.resources.length} resource(s)/module(s) ranked${parsed.report.from ? ` from ${parsed.report.from}` : ""}
 `
   );
-  await startServer({ projectDir: dirname6(reportPath), carveReport: reportPath, port });
+  await startServer({ projectDir: dirname7(reportPath), carveReport: reportPath, port });
 }
 async function runDoctor(rest) {
   let json = false;
@@ -8417,8 +10198,8 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync14(resolve7(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve7(dir)}
+  if (!existsSync14(resolve8(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve8(dir)}
 `);
     process.exit(2);
   }
@@ -8427,7 +10208,7 @@ async function runDoctor(rest) {
   if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot2 = join18(dirname6(fileURLToPath5(import.meta.url)), "..");
+  const pkgRoot2 = join20(dirname7(fileURLToPath5(import.meta.url)), "..");
   const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
   let live = false;
@@ -8481,7 +10262,7 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = dirArg ? resolve7(dirArg) : demoTargetDir(entry);
+  const target = dirArg ? resolve8(dirArg) : demoTargetDir(entry);
   const loaded = await loadDemo(entry, { pkgRoot: pkgRoot2, target, log: (line) => process.stdout.write(line + "\n") });
   if (!loaded.ok) {
     process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
@@ -8512,7 +10293,7 @@ function spawnStep(cmd, args, cwd) {
   });
 }
 async function serveCarveDemo(target, carve, port, live = false) {
-  const at = (rel) => resolve7(target, rel);
+  const at = (rel) => resolve8(target, rel);
   const project = at(carve.project);
   const from = at(carve.from);
   const state = carve.state ? at(carve.state) : void 0;
@@ -8552,7 +10333,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync14(join18(project, "package.json")) && !existsSync14(join18(project, "node_modules"))) {
+  if (existsSync14(join20(project, "package.json")) && !existsSync14(join20(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -8563,7 +10344,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     }
   }
   let degraded;
-  if (!existsSync14(join18(target, "node_modules", "@cdktf", "hcl2json"))) {
+  if (!existsSync14(join20(target, "node_modules", "@cdktf", "hcl2json"))) {
     process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
     if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
@@ -8632,7 +10413,7 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve7(dirArg ?? process.cwd());
+  const projectDir = resolve8(dirArg ?? process.cwd());
   if (!existsSync14(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
@@ -8653,21 +10434,21 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve7("behold-export");
+  let outDir = resolve8("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve7(rest[++i]);
+    if (a === "--out") outDir = resolve8(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve7(dirArg ?? process.cwd());
+  const projectDir = resolve8(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";