@intentius/behold 0.13.1 → 0.15.0

package/dist/cli.js

@@ -839,6 +839,31 @@ async function createK8sClient(options = {}) {
       target: refText(ref)
     });
   }
+  async function selfSubjectReview(signal) {
+    for (const version of SELF_SUBJECT_REVIEW_VERSIONS) {
+      const path = `/apis/authentication.k8s.io/${version}/selfsubjectreviews`;
+      let response;
+      try {
+        response = await sendJson(path, "POST", {
+          body: JSON.stringify({ apiVersion: `authentication.k8s.io/${version}`, kind: "SelfSubjectReview" }),
+          signal,
+          target: `self subject review (${version})`
+        });
+      } catch (err) {
+        if (err instanceof K8sApiError && err.notFound) continue;
+        throw err;
+      }
+      const user2 = response.status?.userInfo;
+      if (user2?.username) {
+        return {
+          username: user2.username,
+          ...user2.uid ? { uid: user2.uid } : {},
+          ...user2.groups && user2.groups.length > 0 ? { groups: user2.groups } : {}
+        };
+      }
+    }
+    return void 0;
+  }
   async function resourcesOf(apiVersion, signal) {
     const list4 = await apiResourceList(apiVersion, signal);
     if (!list4) return [];
@@ -858,6 +883,7 @@ async function createK8sClient(options = {}) {
     concurrently: (items, fn) => mapConcurrent(items, fn, concurrency),
     resources: resourcesOf,
     preferredGroupVersions,
+    selfSubjectReview,
     discoveryCacheKeys: () => [...discoveryCache.keys()].sort()
   };
 }
@@ -874,7 +900,7 @@ function selectorText(selector) {
 function refText(ref) {
   return `${ref.apiVersion} ${ref.kind} ${ref.namespace ? `${ref.namespace}/` : ""}${ref.name}`;
 }
-var clientNodeModule;
+var clientNodeModule, SELF_SUBJECT_REVIEW_VERSIONS;
 var init_client = __esm({
   "node_modules/@intentius/chant-k8s-client/src/client.ts"() {
     init_errors();
@@ -883,6 +909,7 @@ var init_client = __esm({
     init_field_manager();
     init_concurrency();
     init_kubeconfig();
+    SELF_SUBJECT_REVIEW_VERSIONS = ["v1", "v1beta1", "v1alpha1"];
   }
 });
 
@@ -2283,1098 +2310,1713 @@ function joinCiProgress(ir, state) {
   return ir;
 }
 
-// src/component-status.ts
-function componentStatusColor(row) {
-  if (row.stack && row.stack.healthy === false) {
-    if (row.stack.status && /ROLLBACK|FAILED/i.test(row.stack.status)) return "warn";
-    return "accent";
-  }
-  const rollup = row.resources;
-  if (rollup && rollup.total > 0) {
-    if (rollup.unobserved > 0) return "accent";
-    if (rollup.present === rollup.total) return "good";
-    if (rollup.present === 0) return "neutral";
-    return "warn";
-  }
-  if (row.live !== void 0) return row.live ? "good" : "neutral";
-  switch (row.reconciliation) {
-    case "reconciled":
-      return "good";
-    case "unrecorded":
-      return row.detail.startsWith("live") ? "good" : "neutral";
-    case "stale":
-    case "drifted":
-      return "warn";
-    case "unknown":
-    default:
-      return "neutral";
+// src/operator.ts
+var ANSI = /\x1b\[[0-9;]*m/g;
+var strip = (s) => s.replace(ANSI, "");
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var HOW_TO_DECLARE = "An operating loop is a ConvergeOp: declare one in a `*.op.ts` (`ConvergeOp({ name, env, dial, rules })` from @intentius/chant-lexicon-temporal), build the project, and tick it with `chant operator` (or a cron / CronJob invoking it).";
+function readRow(value) {
+  if (!isRecord(value)) return null;
+  if (typeof value.op !== "string" || typeof value.env !== "string") return null;
+  if (!Array.isArray(value.pendingGates)) return null;
+  const gates = [];
+  for (const g of value.pendingGates) {
+    if (!isRecord(g) || typeof g.rule !== "string" || typeof g.gate !== "string") return null;
+    gates.push({
+      rule: g.rule,
+      gate: g.gate,
+      ...typeof g.op === "string" ? { op: g.op } : {},
+      // chant#2028's address, carried through verbatim and only when chant sent
+      // one. The scheme check happens where the link is MINTED
+      // ({@link approvalLink}), not here, so a row whose url behold won't link
+      // still parses rather than refusing the whole strip.
+      ...typeof g.url === "string" && g.url ? { url: g.url } : {}
+    });
   }
-}
-function joinComponentStatus(ir, rows) {
-  const byComponent = new Map(rows.map((r) => [r.component, r]));
+  const tick = isRecord(value.lastTick) ? value.lastTick : void 0;
+  const usable = tick && typeof tick.timestamp === "string" && typeof tick.log === "string";
+  const lease = isRecord(value.lease) ? value.lease : void 0;
   return {
-    ...ir,
-    nodes: ir.nodes.map((n) => {
-      const row = byComponent.get(n.id);
-      if (!row) return n;
+    op: value.op,
+    env: value.env,
+    ...usable ? { lastTick: tick } : {},
+    pendingGates: gates,
+    ...lease && typeof lease.holder === "string" && typeof lease.expiresAt === "string" ? { lease: { holder: lease.holder, expiresAt: lease.expiresAt } } : {}
+  };
+}
+function readOperatorStatus(run3) {
+  const err = strip(run3.stderr);
+  const out = strip(run3.stdout).trim();
+  if (run3.code !== 0) {
+    const message = err.trim() || out || `chant operator status exited ${run3.code}`;
+    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
+    if (/Unknown command|Unknown operator subcommand/i.test(message)) {
       return {
-        ...n,
-        attrs: {
-          ...n.attrs,
-          _status: componentStatusColor(row),
-          _liveStatus: {
-            reconciliation: row.reconciliation,
-            detail: row.detail,
-            ...row.live !== void 0 ? { live: row.live } : {},
-            ...row.stack ? { stack: row.stack } : {},
-            ...row.resources ? { resources: row.resources } : {}
-          }
+        ok: false,
+        refusal: {
+          error: `This chant has no \`operator status\` \u2014 ${first}`,
+          code: "no-operator-cli",
+          remedy: "The operating loop's status surface landed in chant 0.52 (chant#1485). Upgrade chant to read it."
         }
       };
-    })
-  };
-}
-
-// src/overlay.ts
-function pruneImports(ir) {
-  const drop = new Set((ir.imports ?? []).map((i) => i.node));
-  if (drop.size === 0) return ir;
-  ir.nodes = ir.nodes.filter((n) => !drop.has(n.id));
-  if (ir.edges) ir.edges = ir.edges.filter((e) => !drop.has(e.from) && !drop.has(e.to));
-  return ir;
-}
-function componentDir(node) {
-  const parts = node.sourceLoc?.file?.split("/") ?? [];
-  if (parts[0] !== "src" || parts[1] === "examples" || parts.length < 3) return void 0;
-  return parts[1];
-}
-function reclassifyOverlay(ir) {
-  const deployedComponents = /* @__PURE__ */ new Set();
-  for (const n of ir.nodes) {
-    if (n.attrs?._status === "good") {
-      const c = componentDir(n);
-      if (c) deployedComponents.add(c);
     }
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator status failed: ${first}`,
+        code: "operator-status",
+        remedy: "Run `chant operator status --json` in the project to see the whole error."
+      }
+    };
   }
-  for (const n of ir.nodes) {
-    const file = n.sourceLoc?.file ?? "";
-    if (file.startsWith("src/examples/")) {
-      n.attrs = { ...n.attrs, _byo: true };
-      delete n.attrs._status;
-    } else if (n.kind === "AWS::CloudFormation::Parameter") {
-      const c = componentDir(n);
-      if (c && deployedComponents.has(c)) {
-        n.attrs = { ...n.attrs, _status: "good" };
+  if (!out) {
+    return {
+      ok: false,
+      refusal: {
+        error: "This project declares no operating loop \u2014 chant found no ConvergeOp.",
+        code: "no-operator",
+        remedy: HOW_TO_DECLARE
+      }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch (e) {
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator status --json didn't print JSON: ${e instanceof Error ? e.message : String(e)}`,
+        code: "operator-status",
+        remedy: "Run `chant operator status --json` in the project and check what it printed."
+      }
+    };
+  }
+  if (!Array.isArray(parsed)) {
+    return {
+      ok: false,
+      refusal: {
+        error: "chant operator status --json answered with something that isn't an array of ConvergeOp rows.",
+        code: "operator-status",
+        remedy: "behold reads one row per ConvergeOp: `{op, env, lastTick?, pendingGates[], lease?}`."
       }
+    };
+  }
+  const rows = [];
+  for (const value of parsed) {
+    const row = readRow(value);
+    if (!row) {
+      return {
+        ok: false,
+        refusal: {
+          error: "chant operator status --json answered with a row behold couldn't read (needs `op`, `env`, `pendingGates[]`).",
+          code: "operator-status",
+          remedy: "Check `chant operator status --json` in the project \u2014 and file the shape change if chant's is the newer one."
+        }
+      };
     }
+    rows.push(row);
   }
-  return ir;
+  return { ok: true, rows };
 }
-function pruneRuntimeChildren(ir) {
-  const runtime = new Set(ir.nodes.filter((n) => n.runtimeOwner).map((n) => n.id));
-  if (runtime.size === 0) return ir;
-  ir.nodes = ir.nodes.filter((n) => !runtime.has(n.id));
-  ir.edges = ir.edges.filter((e) => !runtime.has(e.from) && !runtime.has(e.to));
-  return ir;
+function declaredConvergeOps(ops) {
+  return ops.filter((o) => o.searchAttributes?.Converge === "true").map((o) => ({
+    name: o.name,
+    ...o.searchAttributes?.Env ? { env: o.searchAttributes.Env } : {},
+    ...o.searchAttributes?.Dial ? { dial: o.searchAttributes.Dial } : {}
+  }));
 }
-function attachRuntimeContainment(ir) {
-  const byOwner = /* @__PURE__ */ new Map();
+var MANAGED_BY = "app.kubernetes.io/managed-by";
+var COMPONENT = "app.kubernetes.io/component";
+var NAME_LABEL = "app.kubernetes.io/name";
+var CHANT = "chant";
+var CONVERGE_TICK = "converge-tick";
+var CRONJOB_KIND = "K8s::Batch::CronJob";
+var NAMESPACE_KIND = "K8s::Core::Namespace";
+var rec = (v) => isRecord(v) ? v : void 0;
+var str = (v) => typeof v === "string" && v ? v : void 0;
+var labelsOf = (n) => rec(rec(n.attrs?.metadata)?.labels) ?? {};
+function operatorHomes(ir) {
+  const byNamespace = /* @__PURE__ */ new Map();
+  const conflicted = /* @__PURE__ */ new Set();
   for (const n of ir.nodes) {
-    if (!n.runtimeOwner) continue;
-    if (!byOwner.has(n.runtimeOwner)) byOwner.set(n.runtimeOwner, /* @__PURE__ */ new Set());
-    byOwner.get(n.runtimeOwner).add(n.id);
+    if (n.kind !== CRONJOB_KIND) continue;
+    const labels = labelsOf(n);
+    if (labels[MANAGED_BY] !== CHANT || labels[COMPONENT] !== CONVERGE_TICK) continue;
+    const meta = rec(n.attrs?.metadata);
+    const ns = str(meta?.namespace);
+    const op = str(meta?.name);
+    if (!ns || !op) continue;
+    const home = byNamespace.get(ns) ?? { namespace: ns, ticks: [] };
+    const stack = str(labels[NAME_LABEL]);
+    if (stack && !conflicted.has(ns)) {
+      if (home.stack === void 0) home.stack = stack;
+      else if (home.stack !== stack) {
+        conflicted.add(ns);
+        delete home.stack;
+      }
+    }
+    const schedule = str(rec(n.attrs?.spec)?.schedule);
+    home.ticks.push({ node: n.id, op, ...schedule ? { schedule } : {} });
+    byNamespace.set(ns, home);
   }
-  if (byOwner.size === 0) return ir;
-  const byContainer = { ...ir.groups.byContainer ?? {} };
-  for (const [owner, children] of byOwner) {
-    byContainer[owner] = [.../* @__PURE__ */ new Set([owner, ...byContainer[owner] ?? [], ...children])].sort();
+  if (!byNamespace.size) return [];
+  for (const n of ir.nodes) {
+    if (n.kind !== NAMESPACE_KIND) continue;
+    const name = str(rec(n.attrs?.metadata)?.name);
+    const home = name ? byNamespace.get(name) : void 0;
+    if (home && !home.node) home.node = n.id;
   }
-  ir.groups.byContainer = byContainer;
-  return ir;
-}
-
-// src/value-match.ts
-function typeSegment(kind) {
-  const parts = kind.split(kind.includes("::") ? "::" : "/");
-  return parts[parts.length - 1] ?? kind;
-}
-function isOwnNameAttr(kind, key) {
-  if (!/name$/i.test(key)) return false;
-  const prefix = key.slice(0, -4).toLowerCase();
-  if (prefix === "") return true;
-  return typeSegment(kind).toLowerCase().includes(prefix);
-}
-var MIN_NAME_LEN = 6;
-var MAX_NAME_LEN = 200;
-var MAX_DEPTH = 12;
-var SKIP_KEYS = /* @__PURE__ */ new Set([
-  "status",
-  "annotations",
-  "labels",
-  "matchLabels",
-  "managedFields",
-  "ownerReferences",
-  "creationTimestamp",
-  "resourceVersion",
-  "uid",
-  "selfLink",
-  "generation",
-  "finalizers"
-]);
-function joinable(v) {
-  return v.length >= MIN_NAME_LEN && v.length <= MAX_NAME_LEN && !/\s/.test(v);
+  for (const home of byNamespace.values()) home.ticks.sort((a, b) => a.op.localeCompare(b.op));
+  return [...byNamespace.values()].sort((a, b) => a.namespace.localeCompare(b.namespace));
 }
-function stringLeaves(attrs) {
-  const out = [];
-  const onPath = /* @__PURE__ */ new Set();
-  const step = (v, key, path, depth) => {
-    if (typeof v === "string") {
-      out.push({ path, key, value: v });
-      return;
+function markOperatorHome(ir) {
+  const homes = operatorHomes(ir);
+  if (!homes.length) return ir;
+  const marks = /* @__PURE__ */ new Map();
+  for (const home of homes) {
+    if (home.node) {
+      marks.set(home.node, {
+        role: "home",
+        namespace: home.namespace,
+        ...home.stack ? { stack: home.stack } : {},
+        ticks: home.ticks.map((t) => t.op)
+      });
     }
-    if (depth >= MAX_DEPTH || !v || typeof v !== "object") return;
-    if (onPath.has(v)) return;
-    onPath.add(v);
-    if (Array.isArray(v)) {
-      for (const item of v) step(item, key, path, depth + 1);
-    } else {
-      for (const [k, val] of Object.entries(v)) {
-        if (k.startsWith("_") || SKIP_KEYS.has(k)) continue;
-        step(val, k, path ? `${path}.${k}` : k, depth + 1);
-      }
+    for (const tick of home.ticks) {
+      marks.set(tick.node, {
+        role: "tick",
+        namespace: home.namespace,
+        ...home.stack ? { stack: home.stack } : {},
+        op: tick.op,
+        ...tick.schedule ? { schedule: tick.schedule } : {}
+      });
     }
-    onPath.delete(v);
-  };
-  for (const [k, v] of Object.entries(attrs ?? {})) {
-    if (k.startsWith("_") || SKIP_KEYS.has(k)) continue;
-    step(v, k, k, 0);
   }
-  return out;
+  return {
+    ...ir,
+    nodes: ir.nodes.map((n) => {
+      const mark = marks.get(n.id);
+      return mark ? { ...n, attrs: { ...n.attrs, _operator: mark } } : n;
+    })
+  };
 }
-function addValueMatchEdges(ir) {
-  const nodes = ir.nodes;
-  const owner = /* @__PURE__ */ new Map();
-  for (const n of nodes) {
-    for (const { path, key, value } of stringLeaves(n.attrs)) {
-      if (path !== key && path !== `metadata.${key}`) continue;
-      if (!joinable(value) || !isOwnNameAttr(n.kind, key)) continue;
-      owner.set(value, owner.has(value) ? null : n.id);
-    }
-  }
-  if (owner.size === 0) return ir;
-  const declared = /* @__PURE__ */ new Set();
-  for (const e of ir.edges) declared.add(`${e.from}\0${e.to}`);
-  const added = /* @__PURE__ */ new Set();
-  for (const a of nodes) {
-    for (const { path, value } of stringLeaves(a.attrs)) {
-      if (!joinable(value)) continue;
-      const b = owner.get(value);
-      if (!b || b === a.id) continue;
-      const key = `${a.id}\0${b}`;
-      if (declared.has(key) || added.has(key)) continue;
-      added.add(key);
-      ir.edges.push({ from: a.id, to: b, kind: "ref", viaAttr: path, inferred: true });
-    }
+var OPERATOR_HOME_GLYPH = {
+  body: '<path d="M16.5 6.63A7 7 0 1 1 6.64 7.5"/><path d="M16.5 6.63 14.3 5.9M16.5 6.63 15.9 8.1"/>'
+};
+function operatorHomeBoxMarks(ir, namespaceBoxes) {
+  const out = {};
+  for (const home of operatorHomes(ir)) {
+    const box = namespaceBoxes[home.namespace];
+    if (box) out[box] = OPERATOR_HOME_GLYPH;
   }
-  return ir;
-}
-
-// src/k8s-edges.ts
-var WORKLOAD_KINDS = /* @__PURE__ */ new Set([
-  "K8s::Apps::Deployment",
-  "K8s::Apps::StatefulSet",
-  "K8s::Apps::DaemonSet",
-  "K8s::Apps::ReplicaSet"
-]);
-var SELECTOR_CARRIERS = [
-  { kind: "K8s::Core::Service", read: (spec) => spec?.selector, viaAttr: "selector" },
-  { kind: "K8s::Policy::PodDisruptionBudget", read: (spec) => labelSelector(spec?.selector), viaAttr: "selector" },
-  { kind: "K8s::Networking::NetworkPolicy", read: (spec) => labelSelector(spec?.podSelector), viaAttr: "podSelector" }
-];
-function rec(v) {
-  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-}
-function str(v) {
-  return typeof v === "string" && v.length > 0 ? v : void 0;
+  return out;
 }
-function namespaceOf(n) {
-  return str(rec(n.attrs?.metadata)?.namespace) ?? "default";
+function operatorStrip(rows, now = Date.now()) {
+  const out = rows.map((r) => {
+    const expiresAt = r.lease ? Date.parse(r.lease.expiresAt) : NaN;
+    const lease = !r.lease ? "free" : Number.isFinite(expiresAt) && expiresAt <= now ? "expired" : "held";
+    return {
+      op: r.op,
+      env: r.env,
+      log: r.lastTick?.log ?? null,
+      at: r.lastTick?.timestamp ?? null,
+      tickId: typeof r.lastTick?.id === "string" && r.lastTick.id ? r.lastTick.id : null,
+      lease,
+      leaseHolder: r.lease?.holder ?? null,
+      leaseExpiresAt: r.lease?.expiresAt ?? null,
+      pendingGates: r.pendingGates.length
+    };
+  });
+  return { rows: out, pendingGates: out.reduce((n, r) => n + r.pendingGates, 0) };
 }
-function nameOf(n) {
-  return str(rec(n.attrs?.metadata)?.name);
+var OPERATOR_INTERVAL_MS = 6e4;
+var TICK_VERDICT_TTL_MS = 15 * OPERATOR_INTERVAL_MS;
+function tickFreshness(at, now = Date.now()) {
+  const t = at ? Date.parse(at) : NaN;
+  if (!Number.isFinite(t)) return { ageMs: null, fresh: false };
+  const age = now - t;
+  if (age < 0) return { ageMs: null, fresh: false };
+  return { ageMs: age, fresh: age <= TICK_VERDICT_TTL_MS };
+}
+var RECONCILIATIONS = /* @__PURE__ */ new Set(["reconciled", "unrecorded", "stale", "drifted", "unknown"]);
+function readVerdict(value) {
+  if (!isRecord(value)) return null;
+  if (typeof value.component !== "string" || !value.component) return null;
+  if (typeof value.reconciliation !== "string" || !RECONCILIATIONS.has(value.reconciliation)) return null;
+  const unobserved = isRecord(value.unobserved) && typeof value.unobserved.reason === "string" ? value.unobserved : void 0;
+  return {
+    component: value.component,
+    reconciliation: value.reconciliation,
+    detail: typeof value.detail === "string" ? value.detail : "",
+    ...typeof value.live === "boolean" ? { live: value.live } : {},
+    ...unobserved ? {
+      unobserved: {
+        reason: unobserved.reason,
+        ...typeof unobserved.detail === "string" ? { detail: unobserved.detail } : {}
+      }
+    } : {}
+  };
 }
-function labelRecord(v) {
-  const r = rec(v);
-  if (!r) return void 0;
-  const out = {};
-  for (const [k, val] of Object.entries(r)) {
-    if (typeof val !== "string") return void 0;
-    out[k] = val;
+function tickComponentVerdicts(rows) {
+  const out = [];
+  for (const row of rows) {
+    const tick = row.lastTick;
+    if (!tick || !Array.isArray(tick.components)) continue;
+    const verdicts = [];
+    for (const value of tick.components) {
+      const verdict = readVerdict(value);
+      if (verdict) verdicts.push(verdict);
+    }
+    out.push({
+      op: row.op,
+      env: tick.env || row.env,
+      at: tick.timestamp,
+      tickId: typeof tick.id === "string" && tick.id ? tick.id : null,
+      verdicts
+    });
   }
-  return Object.keys(out).length > 0 ? out : void 0;
+  return out;
 }
-function labelSelector(v) {
-  const sel = rec(v);
-  if (!sel) return void 0;
-  const expressions = sel.matchExpressions;
-  if (Array.isArray(expressions) && expressions.length > 0) return void 0;
-  return sel.matchLabels;
+function verdictsForEnv(all, env) {
+  const when = (t) => {
+    const ms = Date.parse(t.at);
+    return Number.isFinite(ms) ? ms : -Infinity;
+  };
+  let best = null;
+  for (const t of all) {
+    if (t.env !== env) continue;
+    if (!best || when(t) > when(best)) best = t;
+  }
+  return best;
 }
-function selects(selector, labels) {
-  return Object.entries(selector).every(([k, v]) => labels[k] === v);
+var CONVERGE_GATE_LOOP = "converge";
+var APPROVE_SEMANTICS = "Approving records a fact in the gate ledger; it does not unblock the dispatch. The next tick reads it.";
+function approvalLink(url) {
+  if (!url) return void 0;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
 }
-function templateLabels(n) {
-  const template = rec(rec(n.attrs?.spec)?.template);
-  return labelRecord(rec(template?.metadata)?.labels);
+function convergeGateCards(rows) {
+  const out = [];
+  for (const row of rows) {
+    for (const g of row.pendingGates) {
+      if (!g.op) continue;
+      out.push({
+        loop: CONVERGE_GATE_LOOP,
+        rule: g.rule,
+        op: g.op,
+        gate: g.gate,
+        convergeOp: row.op,
+        env: row.env,
+        since: row.lastTick?.timestamp ?? null,
+        semantics: APPROVE_SEMANTICS,
+        approve: {
+          method: "POST",
+          path: `/api/operator/approve/${encodeURIComponent(g.op)}/${encodeURIComponent(g.gate)}`,
+          command: `chant approve ${g.op} ${g.gate}`
+        },
+        ...approvalLink(g.url) ? { url: g.url } : {}
+      });
+    }
+  }
+  return out;
 }
-function shortKind(kind) {
-  const parts = kind.split("::");
-  return parts[parts.length - 1] ?? kind;
+var OPERATOR_LOG_FLOOR = "0.53.1";
+var OPERATOR_LOG_LIMIT = 50;
+var OPERATOR_LOG_MAX_LIMIT = 200;
+function operatorLogWindow(raw) {
+  let limit = OPERATOR_LOG_LIMIT;
+  if (raw.limit !== void 0 && raw.limit !== null && raw.limit !== "") {
+    const n = Number(raw.limit);
+    if (!Number.isInteger(n) || n < 1) return { error: `limit must be a positive integer (got "${raw.limit}")` };
+    limit = Math.min(n, OPERATOR_LOG_MAX_LIMIT);
+  }
+  if (raw.since !== void 0 && raw.since !== null && raw.since !== "") {
+    if (Number.isNaN(new Date(raw.since).getTime())) {
+      return { error: `since must be an ISO-8601 timestamp (got "${raw.since}")` };
+    }
+    return { limit, since: raw.since };
+  }
+  return { limit };
 }
-var FLUX_SOURCE_KINDS = /* @__PURE__ */ new Set([
-  "K8s::Flux::GitRepository",
-  "K8s::Flux::OCIRepository",
-  "K8s::Flux::HelmRepository",
-  "K8s::Flux::HelmChart",
-  "K8s::Flux::Bucket"
-]);
-function sourceRefOf(refObj, referrer, defaultKind) {
-  const ref = rec(refObj);
-  const kind = str(ref?.kind) ?? defaultKind;
-  const name = str(ref?.name);
-  if (!kind || !name) return void 0;
-  return { kind, name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
+function operatorLogArgs(window) {
+  return [
+    "operator",
+    "log",
+    "--json",
+    "--limit",
+    String(window.limit),
+    ...window.since ? ["--since", window.since] : []
+  ];
 }
-function namedRefOf(refObj, referrer) {
-  const ref = rec(refObj);
-  const name = str(ref?.name);
-  if (!name) return void 0;
-  return { name, namespace: str(ref?.namespace) ?? namespaceOf(referrer) };
+function readTickRecord(value) {
+  if (!isRecord(value)) return null;
+  if (typeof value.op !== "string" || typeof value.timestamp !== "string" || typeof value.log !== "string") return null;
+  return value;
 }
-function list(v) {
-  return Array.isArray(v) ? v : [];
+function readResolutionRecord(value) {
+  if (!isRecord(value)) return null;
+  const needed = ["op", "gate", "resolvedBy", "timestamp"];
+  if (needed.some((k) => typeof value[k] !== "string")) return null;
+  return value;
 }
-function helmReleaseSourceRef(n) {
-  return rec(rec(rec(n.attrs?.spec)?.chart)?.spec)?.sourceRef;
+function readOperatorLog(run3) {
+  const err = strip(run3.stderr);
+  const out = strip(run3.stdout).trim();
+  if (run3.code !== 0) {
+    const message = err.trim() || out || `chant operator log exited ${run3.code}`;
+    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
+    if (/Unknown command|Unknown operator subcommand|Unknown flag/i.test(message)) {
+      return {
+        ok: false,
+        refusal: {
+          error: `This chant has no \`operator log\` \u2014 ${first}`,
+          code: "no-operator-log-cli",
+          remedy: `The converge tick history landed in chant ${OPERATOR_LOG_FLOOR} (chant#2029). Upgrade chant to read it; the strip above needs only 0.52.`
+        }
+      };
+    }
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator log failed: ${first}`,
+        code: "operator-log",
+        remedy: "Run `chant operator log --json` in the project to see the whole error."
+      }
+    };
+  }
+  if (!out) {
+    return {
+      ok: false,
+      refusal: {
+        error: "This project declares no operating loop \u2014 chant found no ConvergeOp.",
+        code: "no-operator",
+        remedy: HOW_TO_DECLARE
+      }
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch (e) {
+    return {
+      ok: false,
+      refusal: {
+        error: `chant operator log --json didn't print JSON: ${e instanceof Error ? e.message : String(e)}`,
+        code: "operator-log",
+        remedy: "Run `chant operator log --json` in the project and check what it printed."
+      }
+    };
+  }
+  const unreadable = (why) => ({
+    ok: false,
+    refusal: {
+      error: `chant operator log --json answered with something behold couldn't read: ${why}`,
+      code: "operator-log",
+      remedy: "behold reads `{entries: [{kind, timestamp, record}], malformed: {converge, gates}}`."
+    }
+  });
+  if (!isRecord(parsed) || !Array.isArray(parsed.entries)) return unreadable("no `entries` array");
+  const entries = [];
+  for (const value of parsed.entries) {
+    if (!isRecord(value) || typeof value.timestamp !== "string") return unreadable("an entry with no timestamp");
+    if (value.kind === "tick") {
+      const record = readTickRecord(value.record);
+      if (!record) return unreadable("a tick entry with no `op`/`timestamp`/`log`");
+      entries.push({ kind: "tick", timestamp: value.timestamp, record });
+    } else if (value.kind === "gate-resolution") {
+      const record = readResolutionRecord(value.record);
+      if (!record) return unreadable("a gate-resolution entry with no `op`/`gate`/`resolvedBy`/`timestamp`");
+      entries.push({ kind: "gate-resolution", timestamp: value.timestamp, record });
+    } else {
+      return unreadable(`an entry of an unknown kind "${String(value.kind)}"`);
+    }
+  }
+  const counts = isRecord(parsed.malformed) ? parsed.malformed : {};
+  const count = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+  return { ok: true, entries, malformed: { converge: count(counts.converge), gates: count(counts.gates) } };
 }
-function ingressBackendServices(n) {
-  const spec = rec(n.attrs?.spec);
-  const out = [];
-  const backendName = (b) => str(rec(rec(b)?.service)?.name);
-  const fromDefault = backendName(spec?.defaultBackend);
-  if (fromDefault) out.push(fromDefault);
-  const rules = Array.isArray(spec?.rules) ? spec.rules : [];
-  for (const rule of rules) {
-    const paths = rec(rec(rule)?.http)?.paths;
-    for (const p of Array.isArray(paths) ? paths : []) {
-      const name = backendName(rec(p)?.backend);
-      if (name) out.push(name);
+function operatorTimeline(entries) {
+  return entries.map((entry) => {
+    if (entry.kind === "gate-resolution") {
+      const r = entry.record;
+      return {
+        kind: "gate-resolution",
+        at: r.timestamp,
+        op: r.op,
+        gate: r.gate,
+        resolvedBy: r.resolvedBy,
+        note: r.note ?? null,
+        url: approvalLink(r.url) ?? null
+      };
     }
+    const t = entry.record;
+    return {
+      kind: "tick",
+      at: t.timestamp,
+      op: t.op,
+      env: typeof t.env === "string" ? t.env : null,
+      id: typeof t.id === "string" && t.id ? t.id : null,
+      log: t.log,
+      gated: (Array.isArray(t.outcomes) ? t.outcomes : []).filter((o) => o && o.action === "gated" && typeof o.gateName === "string").map((o) => ({
+        rule: o.ruleId,
+        op: typeof o.op === "string" ? o.op : null,
+        gate: o.gateName,
+        url: approvalLink(o.url) ?? null
+      }))
+    };
+  });
+}
+function mergeOperatorLogs(answers, limit) {
+  const malformed = answers.reduce(
+    (acc, a) => ({ converge: acc.converge + a.malformed.converge, gates: acc.gates + a.malformed.gates }),
+    { converge: 0, gates: 0 }
+  );
+  if (answers.length === 1) {
+    const only = answers[0].entries;
+    return { entries: only.length > limit ? only.slice(-limit) : only, malformed };
   }
-  return out;
+  const all = answers.flatMap((a) => a.entries).sort((a, b) => {
+    const delta = new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime();
+    return delta !== 0 ? delta : a.kind === b.kind ? 0 : a.kind === "tick" ? -1 : 1;
+  });
+  return { entries: all.length > limit ? all.slice(-limit) : all, malformed };
 }
-function deriveK8sEdges(nodes) {
-  const k8s = nodes.filter((n) => n.lexicon === "k8s");
-  if (k8s.length === 0) return [];
-  const out = [];
-  const add = (from, to, viaAttr) => {
-    if (from !== to) out.push({ from, to, kind: "ref", viaAttr, inferred: true });
-  };
-  const workloads = k8s.filter((n) => WORKLOAD_KINDS.has(n.kind));
-  const byKindNsName = /* @__PURE__ */ new Map();
-  const appProjectsByName = /* @__PURE__ */ new Map();
-  for (const n of k8s) {
-    const name = nameOf(n);
-    if (!name) continue;
-    byKindNsName.set(`${n.kind}\0${namespaceOf(n)}\0${name}`, n);
-    if (n.kind === "K8s::Argo::AppProject") {
-      const same = appProjectsByName.get(name) ?? [];
-      same.push(n);
-      appProjectsByName.set(name, same);
-    }
+var initialOperatorState = {
+  declared: [],
+  strip: null,
+  gates: [],
+  verdicts: [],
+  note: null,
+  code: null,
+  readAt: null
+};
+function operatorRead(state, result, at, now = Date.now()) {
+  if (!result.ok) {
+    return { ...state, strip: null, gates: [], verdicts: [], note: result.refusal.error, code: result.refusal.code, readAt: at };
   }
-  const lookup = (kind, namespace, name) => byKindNsName.get(`${kind}\0${namespace}\0${name}`);
-  const addFluxRef = (n, refObj, viaAttr, allowed, defaultKind) => {
-    const ref = sourceRefOf(refObj, n, defaultKind);
-    if (!ref || ref.name === "*") return;
-    const kind = `K8s::Flux::${ref.kind}`;
-    if (allowed && !allowed.has(kind)) return;
-    const target = lookup(kind, ref.namespace, ref.name);
-    if (target) add(n.id, target.id, viaAttr);
-  };
-  const addSourceRef = (n, refObj, viaAttr, defaultKind) => addFluxRef(n, refObj, viaAttr, FLUX_SOURCE_KINDS, defaultKind);
-  const addNamedRef = (n, refObj, kind, viaAttr) => {
-    const ref = namedRefOf(refObj, n);
-    if (!ref) return;
-    const target = lookup(kind, ref.namespace, ref.name);
-    if (target) add(n.id, target.id, viaAttr);
-  };
-  const addProject = (n, project, viaAttr) => {
-    const candidates = project ? appProjectsByName.get(project) ?? [] : [];
-    const target = candidates.length === 1 ? candidates[0] : candidates.find((p) => namespaceOf(p) === namespaceOf(n));
-    if (target) add(n.id, target.id, viaAttr);
-  };
-  const addSelector = (n, raw, viaAttr) => {
-    const selector = labelRecord(raw);
-    if (!selector) return;
-    for (const w of workloads) {
-      if (namespaceOf(w) !== namespaceOf(n)) continue;
-      const labels = templateLabels(w);
-      if (labels && selects(selector, labels)) add(n.id, w.id, viaAttr);
-    }
+  return {
+    ...state,
+    strip: operatorStrip(result.rows, now),
+    gates: convergeGateCards(result.rows),
+    verdicts: tickComponentVerdicts(result.rows),
+    note: null,
+    code: null,
+    readAt: at
   };
-  for (const n of k8s) {
-    const carrier = SELECTOR_CARRIERS.find((c) => c.kind === n.kind);
-    if (carrier) {
-      addSelector(n, carrier.read(rec(n.attrs?.spec)), carrier.viaAttr);
-      continue;
-    }
-    if (n.kind === "K8s::Networking::Ingress") {
-      for (const svcName of ingressBackendServices(n)) {
-        const svc = lookup("K8s::Core::Service", namespaceOf(n), svcName);
-        if (svc) add(n.id, svc.id, "ingress backend");
-      }
-      continue;
-    }
-    if (n.kind === "K8s::Autoscaling::HorizontalPodAutoscaler") {
-      const ref = rec(rec(n.attrs?.spec)?.scaleTargetRef);
-      const refKind = str(ref?.kind);
-      const refName = str(ref?.name);
-      if (!refKind || !refName) continue;
-      for (const w of workloads) {
-        if (namespaceOf(w) !== namespaceOf(n)) continue;
-        if (shortKind(w.kind) === refKind && nameOf(w) === refName) add(n.id, w.id, "scaleTargetRef");
-      }
-      continue;
-    }
-    if (n.kind === "K8s::Flux::Kustomization") {
-      addSourceRef(n, rec(n.attrs?.spec)?.sourceRef, "sourceRef");
-      for (const dep of list(rec(n.attrs?.spec)?.dependsOn)) {
-        addNamedRef(n, dep, "K8s::Flux::Kustomization", "dependsOn");
-      }
-      continue;
-    }
-    if (n.kind === "K8s::Flux::HelmRelease") {
-      addSourceRef(n, helmReleaseSourceRef(n), "chart sourceRef");
-      continue;
-    }
-    if (n.kind === "K8s::Flux::ImagePolicy") {
-      addNamedRef(n, rec(n.attrs?.spec)?.imageRepositoryRef, "K8s::Flux::ImageRepository", "imageRepositoryRef");
-      continue;
-    }
-    if (n.kind === "K8s::Flux::ImageUpdateAutomation") {
-      addSourceRef(n, rec(n.attrs?.spec)?.sourceRef, "sourceRef", "GitRepository");
-      continue;
-    }
-    if (n.kind === "K8s::Flux::Alert") {
-      addNamedRef(n, rec(n.attrs?.spec)?.providerRef, "K8s::Flux::Provider", "providerRef");
-      for (const src of list(rec(n.attrs?.spec)?.eventSources)) {
-        addFluxRef(n, src, "eventSource");
-      }
-      continue;
-    }
-    if (n.kind === "K8s::Argo::Application") {
-      addProject(n, str(rec(n.attrs?.spec)?.project), "project");
-      continue;
-    }
-    if (n.kind === "K8s::Argo::ApplicationSet") {
-      addProject(n, str(rec(rec(rec(n.attrs?.spec)?.template)?.spec)?.project), "template project");
-    }
-  }
-  return out;
 }
-function addK8sDeclaredEdges(ir) {
-  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
-  for (const e of deriveK8sEdges(ir.nodes)) {
-    const key = `${e.from}\0${e.to}`;
-    if (existing.has(key)) continue;
-    existing.add(key);
-    ir.edges.push(e);
+function operatorNote(state, now = Date.now()) {
+  if (!state.declared.length) {
+    return "No operating loop: this project declares no ConvergeOp, so there is no operator strip.";
   }
-  return ir;
-}
-
-// src/helm-artifacts.ts
-function chartNameOf(node) {
-  const name = node.attrs?.name;
-  return typeof name === "string" && name.length > 0 ? name : void 0;
-}
-function releaseMatchesChart(observed, chartName) {
-  const chart = observed.attributes?.chart;
-  if (typeof chart !== "string") return false;
-  return chart === chartName || chart.startsWith(`${chartName}-`);
-}
-function applyHelmArtifacts(ir, observed) {
-  let charts = 0;
-  let installed = 0;
-  for (const node of ir.nodes) {
-    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
-    charts++;
-    const attrs = node.attrs ??= {};
-    if (observed === void 0) {
-      attrs._status = "neutral";
-      attrs._unobserved = "artifact-observation-unavailable";
-      continue;
-    }
-    const chartName = chartNameOf(node);
-    const entry = chartName ? Object.entries(observed).find(([key2, o2]) => key2.startsWith("release/") && releaseMatchesChart(o2, chartName)) : void 0;
-    if (!entry) {
-      attrs._status = "accent";
-      continue;
-    }
-    const [key, o] = entry;
-    const match = {
-      release: key.replace(/^release\//, ""),
-      ...o.status ? { status: o.status } : {},
-      ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
-      ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {}
-    };
-    attrs._artifact = match;
-    attrs._status = o.status === "deployed" ? "good" : "warn";
-    if (o.status === "deployed") installed++;
+  const loops = `${state.declared.length} ConvergeOp${state.declared.length === 1 ? "" : "s"}`;
+  if (!state.strip) {
+    return state.note ? `Operating loop: ${loops} declared \u2014 status unavailable: ${state.note}` : `Operating loop: ${loops} declared \u2014 not read yet.`;
   }
-  return { charts, installed };
+  const bits = [];
+  const ticked = state.strip.rows.filter((r) => r.at).length;
+  bits.push(
+    ticked ? `last tick per loop \u2014 the status surface answers with one tick each, and the history is its own read (chant#2029) reached from the strip` : `no tick recorded yet on any loop`
+  );
+  const named = state.verdicts.reduce((n, t) => n + t.verdicts.length, 0);
+  if (named) {
+    const stale = state.verdicts.filter((t) => t.verdicts.length && !tickFreshness(t.at, now).fresh);
+    const painted = named - stale.reduce((n, t) => n + t.verdicts.length, 0);
+    bits.push(
+      painted ? `${painted} component verdict${painted === 1 ? "" : "s"} from that tick \u2014 joined onto the component DAG by component name, under the live read (never over it) and only while the tick is younger than ${Math.round(TICK_VERDICT_TTL_MS / 6e4)}m` : `${named} component verdict${named === 1 ? "" : "s"} from that tick, all older than ${Math.round(TICK_VERDICT_TTL_MS / 6e4)}m \u2014 named on the node, not painted: a colour would read as the estate's state now`
+    );
+  }
+  const held = state.strip.rows.filter((r) => r.lease === "held").length;
+  if (held) bits.push(`${held} lease${held === 1 ? "" : "s"} held`);
+  const expired = state.strip.rows.filter((r) => r.lease === "expired").length;
+  if (expired) bits.push(`${expired} lease${expired === 1 ? "" : "s"} expired \u2014 the next round reclaims it`);
+  if (state.strip.pendingGates) {
+    const addressed = state.gates.filter((g) => g.url).length;
+    bits.push(
+      `${state.strip.pendingGates} converge gate${state.strip.pendingGates === 1 ? "" : "s"} pending \u2014 approving one records a fact for the next tick, it does not release a workflow (that is the run gate, a different card)` + (addressed ? `, and ${addressed} name${addressed === 1 ? "s" : ""} where approval happens (chant#2028)` : "")
+    );
+  }
+  return `Operating loop: ${loops} \u2014 ${bits.join("; ")}.`;
 }
 
-// src/estate.ts
-import { statSync as statSync3 } from "node:fs";
-import { availableParallelism } from "node:os";
-import { join as join7, resolve as resolve3, sep } from "node:path";
-import { composeStacks, shortStackNames } from "@intentius/pinhole";
-
-// src/member-ir.ts
-import { createHash } from "node:crypto";
-import { readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { join as join6, relative, resolve as resolve2 } from "node:path";
-var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
-function memberIrCacheSize(env = process.env) {
-  const override = Number.parseInt(env.BEHOLD_ESTATE_IR_CACHE ?? "", 10);
-  return Number.isInteger(override) && override >= 0 ? override : 64;
+// src/component-status.ts
+function componentStatusColor(row) {
+  if (row.stack && row.stack.healthy === false) {
+    if (row.stack.status && /ROLLBACK|FAILED/i.test(row.stack.status)) return "warn";
+    return "accent";
+  }
+  const rollup = row.resources;
+  if (rollup && rollup.total > 0) {
+    if (rollup.unobserved > 0) return "accent";
+    if (rollup.present === rollup.total) return "good";
+    if (rollup.present === 0) return "neutral";
+    return "warn";
+  }
+  if (row.live !== void 0) return row.live ? "good" : "neutral";
+  switch (row.reconciliation) {
+    case "reconciled":
+      return "good";
+    case "unrecorded":
+      return row.detail.startsWith("live") ? "good" : "neutral";
+    case "stale":
+    case "drifted":
+      return "warn";
+    case "unknown":
+    default:
+      return "neutral";
+  }
 }
-function memberSourceStamp(dir) {
-  const root = resolve2(dir);
-  const h = createHash("sha1");
-  let any = false;
-  const walk = (at) => {
-    const entries = readdirSync3(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
-    for (const e of entries) {
-      if (SKIP.has(e.name)) continue;
-      const path = join6(at, e.name);
-      if (e.isDirectory()) {
-        walk(path);
-        continue;
-      }
-      if (!e.isFile()) continue;
-      const st = statSync2(path);
-      h.update(`${relative(root, path)}\0${st.mtimeMs}\0${st.size}
-`);
-      any = true;
-    }
-  };
+function httpUrl(url) {
+  if (typeof url !== "string" || !url) return void 0;
   try {
-    walk(root);
+    const p = new URL(url);
+    return p.protocol === "http:" || p.protocol === "https:" ? url : void 0;
   } catch {
     return void 0;
   }
-  return any ? h.digest("hex") : void 0;
-}
-function cacheKey(dir, opts) {
-  const chant = resolveChant(dir);
-  const canonical = JSON.stringify(opts, Object.keys(opts).sort());
-  return `${resolve2(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
 }
-var cache = /* @__PURE__ */ new Map();
-var hits = 0;
-var misses = 0;
-function invalidateMember(dir) {
-  if (dir === void 0) {
-    cache.clear();
-    return;
+function releaseOrigin(rec6) {
+  const origin = rec6.runOrigin;
+  if (origin && typeof origin.forge === "string") {
+    const url = httpUrl(origin.url);
+    return {
+      forge: origin.forge,
+      originSource: "record",
+      ...origin.repo ? { repo: origin.repo } : {},
+      ...url ? { url } : {}
+    };
   }
-  const root = resolve2(dir);
-  for (const [key, entry] of cache) if (entry.dir === root) cache.delete(key);
-}
-async function memberIr(dir, opts = {}) {
-  const size = memberIrCacheSize();
-  if (opts.live || opts.overlay || size === 0) return graphIr(dir, opts);
-  const stamp = memberSourceStamp(dir);
-  const key = cacheKey(dir, opts);
-  const hit = stamp !== void 0 ? cache.get(key) : void 0;
-  if (hit && hit.stamp === stamp) {
-    hits++;
-    cache.delete(key);
-    cache.set(key, hit);
-    return structuredClone(hit.ir);
-  }
-  misses++;
-  const ir = await graphIr(dir, opts);
-  if (stamp === void 0 || memberSourceStamp(dir) !== stamp) return ir;
-  cache.delete(key);
-  cache.set(key, { dir: resolve2(dir), stamp, ir });
-  for (const oldest of cache.keys()) {
-    if (cache.size <= size) break;
-    cache.delete(oldest);
-  }
-  return structuredClone(ir);
+  return { forge: rec6.runId.startsWith("local-") ? "local" : "unknown", originSource: "inferred" };
 }
-
-// src/zoom-notes.ts
-function zoomNote(zoom, ir, compositeEdgesAttached) {
-  const empty = ir.nodes.length === 0;
-  if (zoom === "components") {
-    return empty ? "no components discovered \u2014 nothing declares one in this project" : void 0;
-  }
-  if (zoom === "logical") {
-    return empty ? "logical is an AWS projection \u2014 no AWS resources in this estate" : void 0;
-  }
-  if (zoom === "composites") {
-    return compositeEdgesAttached === 0 ? "no component ownership to join \u2014 showing the resource graph unchanged" : void 0;
-  }
-  if (zoom === "runtime") {
-    const children = ir.nodes.filter((n) => n.runtimeOwner).length;
-    return children === 0 ? "nothing below the declaration boundary \u2014 no owner-referenced children on this substrate" : void 0;
-  }
-  return void 0;
+var FORGE_WORD = {
+  github: "github",
+  gitlab: "gitlab",
+  op: "op",
+  local: "laptop",
+  unknown: "?"
+};
+function releaseChip(status) {
+  return `${status.gitSha.slice(0, 7)} via ${FORGE_WORD[status.forge]}`;
 }
-function logicalKept(before, after) {
-  if (after > 0 && after * 3 >= before) return void 0;
-  return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
+function releaseStatus(rec6) {
+  if (!rec6) return void 0;
+  return {
+    runId: rec6.runId,
+    ...releaseOrigin(rec6),
+    gitSha: rec6.gitSha,
+    digest: rec6.digest,
+    timestamp: rec6.timestamp,
+    actor: rec6.actor,
+    ...rec6.approver ? { approver: rec6.approver } : {}
+  };
 }
-function edgelessNote(zoom, ir, detail) {
-  if (zoom === "components" || zoom === "logical") return void 0;
-  if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
-  if (detail !== void 0 && detail < 3) {
-    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
-  }
-  return "no edges \u2014 nothing in this estate references anything else";
+function joinComponentStatus(ir, rows) {
+  const byComponent = new Map(rows.map((r) => [r.component, r]));
+  return {
+    ...ir,
+    nodes: ir.nodes.map((n) => {
+      const row = byComponent.get(n.id);
+      if (!row) return n;
+      const release = releaseStatus(row.recorded);
+      return {
+        ...n,
+        attrs: {
+          ...n.attrs,
+          ...release ? { release: releaseChip(release), _release: release } : {},
+          _status: componentStatusColor(row),
+          _liveStatus: {
+            reconciliation: row.reconciliation,
+            detail: row.detail,
+            ...row.live !== void 0 ? { live: row.live } : {},
+            ...row.stack ? { stack: row.stack } : {},
+            ...row.resources ? { resources: row.resources } : {}
+          }
+        }
+      };
+    })
+  };
 }
-var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
-  "K8s::Core::Namespace",
-  "K8s::Rbac::ClusterRole",
-  "K8s::Rbac::ClusterRoleBinding",
-  "K8s::Storage::StorageClass",
-  "K8s::Apiextensions::CustomResourceDefinition"
-]);
-function namespaceMismatchNote(nodes) {
-  const k8s = nodes.filter((n) => n?.lexicon === "k8s");
-  if (k8s.length === 0) return void 0;
-  const pending = k8s.filter((n) => n.attrs?._status === "accent" && !CLUSTER_SCOPED.has(n.kind ?? ""));
-  if (pending.length < 2) return void 0;
-  if (pending.some((n) => typeof n.attrs?.metadata?.namespace === "string" && n.attrs.metadata.namespace)) return void 0;
-  if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
-  return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
+function joinTickVerdicts(ir, tick, now = Date.now()) {
+  if (!tick || !tick.verdicts.length) return ir;
+  const { fresh } = tickFreshness(tick.at, now);
+  const byComponent = new Map(tick.verdicts.map((v) => [v.component, v]));
+  let joined = false;
+  const nodes = ir.nodes.map((n) => {
+    const v = byComponent.get(n.id);
+    if (!v) return n;
+    joined = true;
+    const status = {
+      reconciliation: v.reconciliation,
+      detail: v.detail,
+      ...v.live !== void 0 ? { live: v.live } : {},
+      ...v.unobserved ? { unobserved: v.unobserved } : {},
+      op: tick.op,
+      env: tick.env,
+      at: tick.at,
+      ...tick.tickId ? { tickId: tick.tickId } : {},
+      stale: !fresh
+    };
+    const paint = fresh && n.attrs?._status === void 0;
+    return {
+      ...n,
+      attrs: {
+        ...n.attrs,
+        // The reconciliation tier and nothing else — `live`/`stack`/`resources`
+        // are deliberately not passed, so this can only ever reach
+        // `componentStatusColor`'s last branch.
+        ...paint ? { _status: componentStatusColor({ reconciliation: v.reconciliation, detail: v.detail }) } : {},
+        _tickStatus: status
+      }
+    };
+  });
+  return joined ? { ...ir, nodes } : ir;
 }
-function namespaceJoinNote(joined) {
-  if (joined.length === 0) return void 0;
-  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
-  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
+
+// src/overlay.ts
+function pruneImports(ir) {
+  const drop = new Set((ir.imports ?? []).map((i) => i.node));
+  if (drop.size === 0) return ir;
+  ir.nodes = ir.nodes.filter((n) => !drop.has(n.id));
+  if (ir.edges) ir.edges = ir.edges.filter((e) => !drop.has(e.from) && !drop.has(e.to));
+  return ir;
 }
-function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
-  const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
-  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
-  return notes.length ? notes.join(" \xB7 ") : void 0;
+function componentDir(node) {
+  const parts = node.sourceLoc?.file?.split("/") ?? [];
+  if (parts[0] !== "src" || parts[1] === "examples" || parts.length < 3) return void 0;
+  return parts[1];
 }
-function tierMismatchNote(ir, tiers, currentTier) {
-  const values = tiers?.values ?? [];
-  if (values.length < 2) return void 0;
-  const byLexicon = /* @__PURE__ */ new Map();
+function reclassifyOverlay(ir) {
+  const deployedComponents = /* @__PURE__ */ new Set();
   for (const n of ir.nodes) {
-    const status = n.attrs?._status;
-    if (status !== "good" && status !== "accent") continue;
-    const lexicon = n.lexicon ?? "?";
-    const c = byLexicon.get(lexicon) ?? { good: 0, accent: 0 };
-    c[status === "good" ? "good" : "accent"]++;
-    byLexicon.set(lexicon, c);
-  }
-  for (const [lexicon, { good, accent }] of [...byLexicon].sort()) {
-    if (accent < 2 || accent * 2 < good + accent) continue;
-    const here = currentTier ? `tier "${currentTier}"` : "the default tier";
-    const others = values.filter((v) => v !== currentTier).join(", ");
-    return `${accent} of ${good + accent} ${lexicon} resources read "declared, not deployed" at ${here} \u2014 if the estate runs another declared tier (${others}), pick it (\u2318K \u2192 tier)`;
-  }
-  return void 0;
-}
-
-// src/estate.ts
-function estateReadPool(members, env = process.env) {
-  const override = Number.parseInt(env.BEHOLD_ESTATE_CONCURRENCY ?? "", 10);
-  const cap = Number.isInteger(override) && override >= 1 ? override : Math.min(4, availableParallelism());
-  return Math.max(1, Math.min(cap, members));
-}
-async function mapPool(items, width, fn) {
-  const results = new Array(items.length);
-  let next = 0;
-  const worker = async () => {
-    for (let i = next++; i < items.length; i = next++) {
-      results[i] = await fn(items[i], i);
+    if (n.attrs?._status === "good") {
+      const c = componentDir(n);
+      if (c) deployedComponents.add(c);
     }
-  };
-  await Promise.all(Array.from({ length: Math.max(1, Math.min(width, items.length)) }, () => worker()));
-  return results;
-}
-function estateMembers(projectDirs) {
-  const names = shortStackNames([...projectDirs]);
-  return projectDirs.map((dir, i) => ({ name: names[i], dir }));
-}
-async function composeEstate(projectDirs, opts = {}) {
-  const names = shortStackNames(projectDirs);
-  const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
-    name: names[i],
-    ir: await memberIr(dir, opts)
-  }));
-  return composeStacks(stacks);
-}
-var firstLine2 = (e) => {
-  const msg = e instanceof Error ? e.message : String(e);
-  const m = msg.match(/exited \d+:\s*([\s\S]*)/);
-  return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
-};
-function namespaceRuntimeOwners(name, ir) {
-  const own = new Set(ir.nodes.map((n) => n.id));
+  }
   for (const n of ir.nodes) {
-    if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
+    const file = n.sourceLoc?.file ?? "";
+    if (file.startsWith("src/examples/")) {
+      n.attrs = { ...n.attrs, _byo: true };
+      delete n.attrs._status;
+    } else if (n.kind === "AWS::CloudFormation::Parameter") {
+      const c = componentDir(n);
+      if (c && deployedComponents.has(c)) {
+        n.attrs = { ...n.attrs, _status: "good" };
+      }
+    }
   }
   return ir;
 }
-var NAMESPACE_JOIN_FLOOR = "0.44.5";
-var rec2 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
-var str2 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
-var realIsDir = (p) => {
-  try {
-    return statSync3(p).isDirectory();
-  } catch {
-    return false;
-  }
-};
-function declaredNamespaceBindings(ir) {
-  const out = [];
+function pruneRuntimeChildren(ir) {
+  const runtime = new Set(ir.nodes.filter((n) => n.runtimeOwner).map((n) => n.id));
+  if (runtime.size === 0) return ir;
+  ir.nodes = ir.nodes.filter((n) => !runtime.has(n.id));
+  ir.edges = ir.edges.filter((e) => !runtime.has(e.from) && !runtime.has(e.to));
+  return ir;
+}
+function attachRuntimeContainment(ir) {
+  const byOwner = /* @__PURE__ */ new Map();
   for (const n of ir.nodes) {
-    if (n.kind !== "K8s::Flux::Kustomization") continue;
-    const spec = rec2(n.attrs?.spec);
-    const namespace = str2(spec?.targetNamespace);
-    const path = str2(spec?.path);
-    if (namespace && path) out.push({ path, namespace });
+    if (!n.runtimeOwner) continue;
+    if (!byOwner.has(n.runtimeOwner)) byOwner.set(n.runtimeOwner, /* @__PURE__ */ new Set());
+    byOwner.get(n.runtimeOwner).add(n.id);
   }
-  return out;
-}
-function awaitsNamespaceBinding(ir) {
-  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
-  if (namespaced.length === 0) return false;
-  return namespaced.every((n) => !str2(rec2(n.attrs?.metadata)?.namespace));
+  if (byOwner.size === 0) return ir;
+  const byContainer = { ...ir.groups.byContainer ?? {} };
+  for (const [owner, children] of byOwner) {
+    byContainer[owner] = [.../* @__PURE__ */ new Set([owner, ...byContainer[owner] ?? [], ...children])].sort();
+  }
+  ir.groups.byContainer = byContainer;
+  return ir;
 }
-function declaredSegments(path) {
-  if (path.startsWith("/")) return void 0;
-  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
-  if (segs.length === 0 || segs.includes("..")) return void 0;
-  return segs;
+
+// src/value-match.ts
+function typeSegment(kind) {
+  const parts = kind.split(kind.includes("::") ? "::" : "/");
+  return parts[parts.length - 1] ?? kind;
 }
-function pathAlignment(declared, dir, isDir = realIsDir) {
-  const want = declaredSegments(declared);
-  if (!want) return 0;
-  const root = resolve3(dir);
-  const have = root.split(sep).filter(Boolean);
-  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
-    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join7(root, ...want.slice(k)))) continue;
-    return k;
-  }
-  return 0;
+function isOwnNameAttr(kind, key) {
+  if (!/name$/i.test(key)) return false;
+  const prefix = key.slice(0, -4).toLowerCase();
+  if (prefix === "") return true;
+  return typeSegment(kind).toLowerCase().includes(prefix);
 }
-function joinNamespaceBindings(members, isDir = realIsDir) {
-  const bindings = members.flatMap(
-    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
-  );
-  if (bindings.length === 0) return [];
-  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
-  if (awaiting.length === 0) return [];
-  const best = /* @__PURE__ */ new Map();
-  for (const b of bindings) {
-    let winner;
-    let tied = false;
-    for (const m of awaiting) {
-      if (m.dir === b.declaredBy) continue;
-      const score = pathAlignment(b.path, m.dir, isDir);
-      if (score === 0) continue;
-      if (!winner || score > winner.score) {
-        winner = { dir: m.dir, score };
-        tied = false;
-      } else if (score === winner.score) {
-        tied = true;
-      }
-    }
-    if (!winner || tied) continue;
-    const prev = best.get(winner.dir);
-    if (prev === "ambiguous") continue;
-    const join21 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join21 });
-    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join21 });
-  }
-  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
-}
-async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
-  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
-  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
-  const irs = await mapPool(
-    projectDirs,
-    estateReadPool(projectDirs.length),
-    (dir) => memberIr(dir, { ...src, detail: 3 }).catch(() => void 0)
-  );
-  const scopes = /* @__PURE__ */ new Map();
-  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
-    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
-    scopes.set(j.dir, j.namespace);
-  }
-  return scopes;
-}
-function withoutJoinedMembers(nodes, joined) {
-  if (joined.length === 0) return [...nodes];
-  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
+var MIN_NAME_LEN = 6;
+var MAX_NAME_LEN = 200;
+var MAX_DEPTH = 12;
+var SKIP_KEYS = /* @__PURE__ */ new Set([
+  "status",
+  "annotations",
+  "labels",
+  "matchLabels",
+  "managedFields",
+  "ownerReferences",
+  "creationTimestamp",
+  "resourceVersion",
+  "uid",
+  "selfLink",
+  "generation",
+  "finalizers"
+]);
+function joinable(v) {
+  return v.length >= MIN_NAME_LEN && v.length <= MAX_NAME_LEN && !/\s/.test(v);
 }
-async function composeEstateOverlay(projectDirs, opts, classify) {
-  const names = shortStackNames(projectDirs);
-  const unobserved = [];
-  const dropped = [];
-  const joined = [];
-  const stacks = new Array(projectDirs.length);
-  const scopes = await estateNamespaceScopes(projectDirs, opts);
-  await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => {
-    const name = names[i];
-    const namespace = scopes.get(dir);
-    try {
-      const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
-      stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
-      if (namespace) joined.push({ name, namespace });
-    } catch (err) {
-      const reason = firstLine2(err);
-      try {
-        const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
-        const src = await memberIr(dir, srcOpts);
-        for (const n of src.nodes) n.attrs = { ...n.attrs, _status: "neutral", _unobserved: reason };
-        stacks[i] = { name, ir: src };
-        unobserved.push({ name, reason });
-      } catch (err2) {
-        dropped.push({ name, reason: firstLine2(err2) });
+function stringLeaves(attrs) {
+  const out = [];
+  const onPath = /* @__PURE__ */ new Set();
+  const step = (v, key, path, depth) => {
+    if (typeof v === "string") {
+      out.push({ path, key, value: v });
+      return;
+    }
+    if (depth >= MAX_DEPTH || !v || typeof v !== "object") return;
+    if (onPath.has(v)) return;
+    onPath.add(v);
+    if (Array.isArray(v)) {
+      for (const item of v) step(item, key, path, depth + 1);
+    } else {
+      for (const [k, val] of Object.entries(v)) {
+        if (k.startsWith("_") || SKIP_KEYS.has(k)) continue;
+        step(val, k, path ? `${path}.${k}` : k, depth + 1);
       }
     }
-  });
-  const present = stacks.filter((s) => !!s);
-  return {
-    ir: composeStacks(present),
-    observed: present.length - unobserved.length,
-    total: projectDirs.length,
-    unobserved,
-    dropped,
-    // Concurrent reads finish in whatever order the clusters answer; the note
-    // this feeds should read the same twice.
-    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
-  };
-}
-
-// src/helm-drift.ts
-function countChanges(docs) {
-  return docs.reduce((n, d) => n + d.changes.length, 0);
-}
-function provenanceOf(live) {
-  const m = live.manifest;
-  return {
-    contentDigest: m.contentDigest,
-    inputDigest: m.inputDigest,
-    valuesDigest: m.valuesDigest,
-    chart: m.chart,
-    chartVersion: m.chartVersion,
-    repo: m.repo,
-    releaseName: m.releaseName,
-    namespace: m.namespace,
-    profile: m.capabilityProfile?.cluster ?? "",
-    kubeVersion: m.capabilityProfile?.kubeVersion ?? "",
-    renderedAt: m.renderedAt,
-    helmVersion: m.helmVersion,
-    chantVersion: m.chantVersion,
-    sourceRef: m.sourceRef
-  };
-}
-function helmRenderReport(record, live) {
-  const base = { render: record.name, chart: record.chart };
-  if (!live) {
-    return { ...base, verdict: "unobserved", reason: record.contentDigest ? "no-stored-render" : "unpinned" };
-  }
-  const d = live.diff;
-  const counts = {
-    drifted: d.drifted.length,
-    changes: countChanges(d.drifted),
-    unchanged: d.unchanged.length,
-    unobserved: d.unobserved.length,
-    undeclared: d.undeclaredEntities.length
+    onPath.delete(v);
   };
-  const provenance = provenanceOf(live);
-  if (d.drifted.length > 0) {
-    return { ...base, verdict: "drifted", counts, provenance, drifted: d.drifted };
-  }
-  if (d.drifted.length + d.accepted.length + d.unchanged.length === 0) {
-    return { ...base, verdict: "unobserved", reason: "nothing-observed", counts, provenance };
-  }
-  if (d.unobserved.length > 0) {
-    return { ...base, verdict: "unobserved", reason: "partly-observed", counts, provenance };
+  for (const [k, v] of Object.entries(attrs ?? {})) {
+    if (k.startsWith("_") || SKIP_KEYS.has(k)) continue;
+    step(v, k, k, 0);
   }
-  return { ...base, verdict: "in-sync", counts, provenance };
-}
-async function readHelmRenderDrift(projectDir, env, opts = {}) {
-  const report = await helmRenders(projectDir, opts).catch(() => void 0);
-  const records = report?.records ?? [];
-  if (records.length === 0) return [];
-  return mapPool(records, estateReadPool(records.length), async (record) => {
-    if (!record.contentDigest) return helmRenderReport(record, void 0);
-    const live = await helmRenderDiffLive(projectDir, record.contentDigest, env, opts).catch(() => void 0);
-    return helmRenderReport(record, live);
-  });
-}
-function chartNameOf2(node) {
-  const name = node.attrs?.name;
-  return typeof name === "string" && name.length > 0 ? name : void 0;
+  return out;
 }
-var SEVERITY = { drifted: 2, unobserved: 1, "in-sync": 0 };
-function applyHelmRenderDrift(ir, reports) {
-  if (reports.length === 0) return { charts: 0, drifted: 0 };
-  const byChart = /* @__PURE__ */ new Map();
-  for (const r of reports) {
-    const list3 = byChart.get(r.chart);
-    if (list3) list3.push(r);
-    else byChart.set(r.chart, [r]);
+function addValueMatchEdges(ir) {
+  const nodes = ir.nodes;
+  const owner = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    for (const { path, key, value } of stringLeaves(n.attrs)) {
+      if (path !== key && path !== `metadata.${key}`) continue;
+      if (!joinable(value) || !isOwnNameAttr(n.kind, key)) continue;
+      owner.set(value, owner.has(value) ? null : n.id);
+    }
   }
-  let charts = 0;
-  let drifted = 0;
-  for (const node of ir.nodes) {
-    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
-    const chartName = chartNameOf2(node);
-    const matched = chartName ? byChart.get(chartName) : void 0;
-    if (!matched || matched.length === 0) continue;
-    const worst = matched.reduce((a, b) => SEVERITY[b.verdict] > SEVERITY[a.verdict] ? b : a);
-    const attrs = node.attrs ??= {};
-    attrs._renderDrift = matched.length === 1 ? worst : { ...worst, renders: matched };
-    charts++;
-    if (worst.verdict === "drifted") {
-      attrs._status = "warn";
-      drifted++;
+  if (owner.size === 0) return ir;
+  const declared = /* @__PURE__ */ new Set();
+  for (const e of ir.edges) declared.add(`${e.from}\0${e.to}`);
+  const added = /* @__PURE__ */ new Set();
+  for (const a of nodes) {
+    for (const { path, value } of stringLeaves(a.attrs)) {
+      if (!joinable(value)) continue;
+      const b = owner.get(value);
+      if (!b || b === a.id) continue;
+      const key = `${a.id}\0${b}`;
+      if (declared.has(key) || added.has(key)) continue;
+      added.add(key);
+      ir.edges.push({ from: a.id, to: b, kind: "ref", viaAttr: path, inferred: true });
     }
   }
-  return { charts, drifted };
+  return ir;
 }
 
-// src/cluster-anchor.ts
-var MANAGED_CLUSTER_KINDS = /* @__PURE__ */ new Set([
-  "AWS::EKS::Cluster",
-  "GCP::Container::Cluster",
-  "Microsoft.ContainerService/managedClusters",
-  "K3d::Cluster"
+// src/k8s-edges.ts
+var WORKLOAD_KINDS = /* @__PURE__ */ new Set([
+  "K8s::Apps::Deployment",
+  "K8s::Apps::StatefulSet",
+  "K8s::Apps::DaemonSet",
+  "K8s::Apps::ReplicaSet"
 ]);
-var ANCHOR_VIA = "runs-on";
-function metadata(node) {
-  const m = node.attrs?.metadata;
-  return m && typeof m === "object" && !Array.isArray(m) ? m : void 0;
+var SELECTOR_CARRIERS = [
+  { kind: "K8s::Core::Service", read: (spec) => spec?.selector, viaAttr: "selector" },
+  { kind: "K8s::Policy::PodDisruptionBudget", read: (spec) => labelSelector(spec?.selector), viaAttr: "selector" },
+  { kind: "K8s::Networking::NetworkPolicy", read: (spec) => labelSelector(spec?.podSelector), viaAttr: "podSelector" }
+];
+function rec2(v) {
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 }
-function metaString(node, key) {
-  const v = metadata(node)?.[key];
+function str2(v) {
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
-function isK8s(node) {
-  return node.lexicon === "k8s";
+function namespaceOf(n) {
+  return str2(rec2(n.attrs?.metadata)?.namespace) ?? "default";
 }
-function isNamespace(node) {
-  return node.kind === "K8s::Core::Namespace";
+function nameOf(n) {
+  return str2(rec2(n.attrs?.metadata)?.name);
 }
-function managedClusterName(node) {
-  const metaName = metaString(node, "name");
-  if (metaName) return metaName;
-  for (const key of ["name", "clusterName"]) {
-    const v = node.attrs?.[key];
-    if (typeof v === "string" && v.length > 0) return v;
+function labelRecord(v) {
+  const r = rec2(v);
+  if (!r) return void 0;
+  const out = {};
+  for (const [k, val] of Object.entries(r)) {
+    if (typeof val !== "string") return void 0;
+    out[k] = val;
   }
-  return node.id;
-}
-function boundManagedCluster(nodes, boundContext) {
-  const clusters = nodes.filter((n) => MANAGED_CLUSTER_KINDS.has(n.kind));
-  if (clusters.length === 1) return clusters[0];
-  if (clusters.length === 0 || !boundContext) return void 0;
-  const bound = clusters.filter((n) => contextBindsCluster(boundContext, managedClusterName(n)));
-  return bound.length === 1 ? bound[0] : void 0;
+  return Object.keys(out).length > 0 ? out : void 0;
 }
-function addClusterAnchorEdges(ir, boundContext) {
-  const nodes = ir.nodes;
-  const cluster = boundManagedCluster(ir.nodes, boundContext);
-  if (!cluster) return ir;
-  const k8sNodes = nodes.filter(isK8s);
-  if (k8sNodes.length === 0) return ir;
-  const namespaceByName = /* @__PURE__ */ new Map();
-  for (const n of k8sNodes) {
-    if (!isNamespace(n)) continue;
-    const name = metaString(n, "name");
-    if (name && !namespaceByName.has(name)) namespaceByName.set(name, n.id);
-  }
-  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
-  const add = (from, to) => {
-    if (from === to) return;
-    const key = `${from}\0${to}`;
-    if (existing.has(key)) return;
-    existing.add(key);
-    ir.edges.push({ from, to, kind: "ref", viaAttr: ANCHOR_VIA, inferred: true });
-  };
-  for (const n of k8sNodes) {
-    if (isNamespace(n)) {
-      add(cluster.id, n.id);
-      continue;
-    }
-    const ns = metaString(n, "namespace");
-    const nsNode = ns ? namespaceByName.get(ns) : void 0;
-    add(nsNode ?? cluster.id, n.id);
-  }
-  return ir;
+function labelSelector(v) {
+  const sel = rec2(v);
+  if (!sel) return void 0;
+  const expressions = sel.matchExpressions;
+  if (Array.isArray(expressions) && expressions.length > 0) return void 0;
+  return sel.matchLabels;
 }
-
-// src/logical-azure.ts
-var AZURE_HEADLINE_KINDS = /* @__PURE__ */ new Set([
-  // compute / workloads
-  "Microsoft.Compute/virtualMachines",
-  "Microsoft.Compute/virtualMachineScaleSets",
-  "Microsoft.ContainerService/managedClusters",
-  "Microsoft.ContainerInstance/containerGroups",
-  "Microsoft.Web/sites",
-  // network edge
-  "Microsoft.Network/publicIPAddresses",
-  "Microsoft.Network/loadBalancers",
-  "Microsoft.Network/applicationGateways",
-  "Microsoft.Network/natGateways",
-  "Microsoft.Network/dnsZones",
-  // data stores
-  "Microsoft.Storage/storageAccounts",
-  "Microsoft.Sql/servers",
-  "Microsoft.DocumentDB/databaseAccounts",
-  "Microsoft.Cache/redis",
-  "Microsoft.DBforPostgreSQL/flexibleServers",
-  // registry / identity edge
-  "Microsoft.ContainerRegistry/registries"
-]);
-var AZURE_FABRIC_KINDS = /* @__PURE__ */ new Set([
-  "Microsoft.Network/virtualNetworks",
-  "Microsoft.Network/virtualNetworks_subnets",
-  "Microsoft.Network/networkSecurityGroups",
-  "Microsoft.Network/routeTables",
-  "Microsoft.Network/networkInterfaces",
-  // identity/authorization hubs — a role assignment or managed identity is
-  // referenced by half the estate, so contracting through one invents edges
-  // between unrelated resources.
-  "Microsoft.Authorization/roleAssignments",
-  "Microsoft.ManagedIdentity/userAssignedIdentities",
-  "Microsoft.KeyVault/vaults"
-]);
-var VNET_KIND = "Microsoft.Network/virtualNetworks";
-var SUBNET_KIND = "Microsoft.Network/virtualNetworks_subnets";
-var NSG_KIND = "Microsoft.Network/networkSecurityGroups";
-var RESOURCE_ID_RE = /resourceId\(\s*([^)]*)\)/g;
-var QUOTED_RE = /'([^']*)'/g;
-function resourceIdNames(value) {
-  if (typeof value !== "string" || !value.includes("resourceId(")) return [];
-  const out = [];
-  for (const call of value.matchAll(RESOURCE_ID_RE)) {
-    const args = [...call[1].matchAll(QUOTED_RE)].map((m) => m[1]);
-    if (args.length >= 2) out.push(args[args.length - 1]);
-  }
-  return out;
+function selects(selector, labels) {
+  return Object.entries(selector).every(([k, v]) => labels[k] === v);
 }
-function collectAzureRefs(value, out) {
-  if (value === null || typeof value !== "object") {
-    for (const name of resourceIdNames(value)) out.add(name);
-    return;
-  }
-  const ref = value.$ref;
-  if (typeof ref === "string") out.add(ref.split(".")[0]);
-  for (const v of Object.values(value)) collectAzureRefs(v, out);
+function templateLabels(n) {
+  const template = rec2(rec2(n.attrs?.spec)?.template);
+  return labelRecord(rec2(template?.metadata)?.labels);
 }
-function strAttr(node, key) {
-  const v = node.attrs?.[key];
-  return typeof v === "string" ? v : void 0;
+function shortKind(kind) {
+  const parts = kind.split("::");
+  return parts[parts.length - 1] ?? kind;
 }
-function resourceName(node) {
-  return strAttr(node, "name");
+var FLUX_SOURCE_KINDS = /* @__PURE__ */ new Set([
+  "K8s::Flux::GitRepository",
+  "K8s::Flux::OCIRepository",
+  "K8s::Flux::HelmRepository",
+  "K8s::Flux::HelmChart",
+  "K8s::Flux::Bucket"
+]);
+function sourceRefOf(refObj, referrer, defaultKind) {
+  const ref = rec2(refObj);
+  const kind = str2(ref?.kind) ?? defaultKind;
+  const name = str2(ref?.name);
+  if (!kind || !name) return void 0;
+  return { kind, name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
 }
-function subnetVnetName(node) {
-  const name = resourceName(node);
-  if (!name || !name.includes("/")) return void 0;
-  return name.split("/")[0];
+function namedRefOf(refObj, referrer) {
+  const ref = rec2(refObj);
+  const name = str2(ref?.name);
+  if (!name) return void 0;
+  return { name, namespace: str2(ref?.namespace) ?? namespaceOf(referrer) };
 }
-function subnetShortName(node) {
-  const name = resourceName(node);
-  return name?.includes("/") ? name.split("/").slice(1).join("/") : name;
+function list(v) {
+  return Array.isArray(v) ? v : [];
 }
-function vnetCidr(node) {
-  const space = node.attrs?.addressSpace;
-  const prefixes = space?.addressPrefixes;
-  return Array.isArray(prefixes) && typeof prefixes[0] === "string" ? prefixes[0] : void 0;
+function helmReleaseSourceRef(n) {
+  return rec2(rec2(rec2(n.attrs?.spec)?.chart)?.spec)?.sourceRef;
 }
-function projectAzureLogical(ir, env) {
-  const azure = ir.nodes.filter((n) => n.lexicon === "azure");
-  if (azure.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
-  const componentOf = componentNamer(azure);
-  const byId = new Map(azure.map((n) => [n.id, n]));
-  const byName = /* @__PURE__ */ new Map();
-  for (const n of azure) {
-    const name = resourceName(n);
-    if (name && !byName.has(name)) byName.set(name, n);
-  }
-  const vnets = azure.filter((n) => n.kind === VNET_KIND);
-  const subnets = azure.filter((n) => n.kind === SUBNET_KIND);
-  const vnetByName = new Map(vnets.map((v) => [resourceName(v) ?? v.id, v]));
-  const refOut = /* @__PURE__ */ new Map();
-  for (const n of azure) {
-    const names = /* @__PURE__ */ new Set();
-    collectAzureRefs(n.attrs, names);
-    const targets = /* @__PURE__ */ new Set();
-    for (const name of names) {
-      const target = byName.get(name) ?? byId.get(name);
-      if (target && target.id !== n.id) targets.add(target.id);
+function ingressBackendServices(n) {
+  const spec = rec2(n.attrs?.spec);
+  const out = [];
+  const backendName = (b) => str2(rec2(rec2(b)?.service)?.name);
+  const fromDefault = backendName(spec?.defaultBackend);
+  if (fromDefault) out.push(fromDefault);
+  const rules = Array.isArray(spec?.rules) ? spec.rules : [];
+  for (const rule of rules) {
+    const paths = rec2(rec2(rule)?.http)?.paths;
+    for (const p of Array.isArray(paths) ? paths : []) {
+      const name = backendName(rec2(p)?.backend);
+      if (name) out.push(name);
     }
-    if (targets.size) refOut.set(n.id, targets);
-  }
-  for (const e of ir.edges) {
-    if (!byId.has(e.from) || !byId.has(e.to)) continue;
-    (refOut.get(e.from) ?? refOut.set(e.from, /* @__PURE__ */ new Set()).get(e.from)).add(e.to);
   }
-  const RG_TITLE = env ? `resource group ${env}` : "resource group";
-  const vnetTitle = (v) => `VNet ${vnetCidr(v) ?? resourceName(v) ?? v.id}`;
-  const subnetTitle = (s) => `subnet ${strAttr(s, "addressPrefix") ?? subnetShortName(s) ?? s.id}`;
-  const guardedBy = /* @__PURE__ */ new Map();
-  for (const s of subnets) {
-    const names = /* @__PURE__ */ new Set();
-    collectAzureRefs(s.attrs?.networkSecurityGroup, names);
-    for (const name of names) {
-      if (byName.get(name)?.kind === NSG_KIND) guardedBy.set(s.id, name);
+  return out;
+}
+function deriveK8sEdges(nodes) {
+  const k8s = nodes.filter((n) => n.lexicon === "k8s");
+  if (k8s.length === 0) return [];
+  const out = [];
+  const add = (from, to, viaAttr) => {
+    if (from !== to) out.push({ from, to, kind: "ref", viaAttr, inferred: true });
+  };
+  const workloads = k8s.filter((n) => WORKLOAD_KINDS.has(n.kind));
+  const byKindNsName = /* @__PURE__ */ new Map();
+  const appProjectsByName = /* @__PURE__ */ new Map();
+  for (const n of k8s) {
+    const name = nameOf(n);
+    if (!name) continue;
+    byKindNsName.set(`${n.kind}\0${namespaceOf(n)}\0${name}`, n);
+    if (n.kind === "K8s::Argo::AppProject") {
+      const same = appProjectsByName.get(name) ?? [];
+      same.push(n);
+      appProjectsByName.set(name, same);
     }
   }
-  const headline = azure.filter((n) => AZURE_HEADLINE_KINDS.has(n.kind));
-  const subnetIds = new Set(subnets.map((s) => s.id));
-  const vnetIds = new Set(vnets.map((v) => v.id));
-  const nearest = (start, want, maxDepth = 6) => {
-    const seen = /* @__PURE__ */ new Set([start]);
-    let frontier = [...refOut.get(start) ?? []];
-    for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
-      const next = [];
-      for (const id of frontier) {
-        if (seen.has(id)) continue;
-        seen.add(id);
-        if (want.has(id)) return id;
-        for (const r of refOut.get(id) ?? []) if (!seen.has(r)) next.push(r);
-      }
-      frontier = next;
-    }
-    return void 0;
+  const lookup = (kind, namespace, name) => byKindNsName.get(`${kind}\0${namespace}\0${name}`);
+  const addFluxRef = (n, refObj, viaAttr, allowed, defaultKind) => {
+    const ref = sourceRefOf(refObj, n, defaultKind);
+    if (!ref || ref.name === "*") return;
+    const kind = `K8s::Flux::${ref.kind}`;
+    if (allowed && !allowed.has(kind)) return;
+    const target = lookup(kind, ref.namespace, ref.name);
+    if (target) add(n.id, target.id, viaAttr);
   };
-  const byContainer = {};
-  const child = (parent, c) => {
-    const arr = byContainer[parent] ?? (byContainer[parent] = []);
-    if (!arr.includes(c)) arr.push(c);
+  const addSourceRef = (n, refObj, viaAttr, defaultKind) => addFluxRef(n, refObj, viaAttr, FLUX_SOURCE_KINDS, defaultKind);
+  const addNamedRef = (n, refObj, kind, viaAttr) => {
+    const ref = namedRefOf(refObj, n);
+    if (!ref) return;
+    const target = lookup(kind, ref.namespace, ref.name);
+    if (target) add(n.id, target.id, viaAttr);
   };
-  for (const v of vnets) child(RG_TITLE, vnetTitle(v));
-  for (const s of subnets) {
+  const addProject = (n, project, viaAttr) => {
+    const candidates = project ? appProjectsByName.get(project) ?? [] : [];
+    const target = candidates.length === 1 ? candidates[0] : candidates.find((p) => namespaceOf(p) === namespaceOf(n));
+    if (target) add(n.id, target.id, viaAttr);
+  };
+  const addSelector = (n, raw, viaAttr) => {
+    const selector = labelRecord(raw);
+    if (!selector) return;
+    for (const w of workloads) {
+      if (namespaceOf(w) !== namespaceOf(n)) continue;
+      const labels = templateLabels(w);
+      if (labels && selects(selector, labels)) add(n.id, w.id, viaAttr);
+    }
+  };
+  for (const n of k8s) {
+    const carrier = SELECTOR_CARRIERS.find((c) => c.kind === n.kind);
+    if (carrier) {
+      addSelector(n, carrier.read(rec2(n.attrs?.spec)), carrier.viaAttr);
+      continue;
+    }
+    if (n.kind === "K8s::Networking::Ingress") {
+      for (const svcName of ingressBackendServices(n)) {
+        const svc = lookup("K8s::Core::Service", namespaceOf(n), svcName);
+        if (svc) add(n.id, svc.id, "ingress backend");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Autoscaling::HorizontalPodAutoscaler") {
+      const ref = rec2(rec2(n.attrs?.spec)?.scaleTargetRef);
+      const refKind = str2(ref?.kind);
+      const refName = str2(ref?.name);
+      if (!refKind || !refName) continue;
+      for (const w of workloads) {
+        if (namespaceOf(w) !== namespaceOf(n)) continue;
+        if (shortKind(w.kind) === refKind && nameOf(w) === refName) add(n.id, w.id, "scaleTargetRef");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Flux::Kustomization") {
+      addSourceRef(n, rec2(n.attrs?.spec)?.sourceRef, "sourceRef");
+      for (const dep of list(rec2(n.attrs?.spec)?.dependsOn)) {
+        addNamedRef(n, dep, "K8s::Flux::Kustomization", "dependsOn");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Flux::HelmRelease") {
+      addSourceRef(n, helmReleaseSourceRef(n), "chart sourceRef");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::ImagePolicy") {
+      addNamedRef(n, rec2(n.attrs?.spec)?.imageRepositoryRef, "K8s::Flux::ImageRepository", "imageRepositoryRef");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::ImageUpdateAutomation") {
+      addSourceRef(n, rec2(n.attrs?.spec)?.sourceRef, "sourceRef", "GitRepository");
+      continue;
+    }
+    if (n.kind === "K8s::Flux::Alert") {
+      addNamedRef(n, rec2(n.attrs?.spec)?.providerRef, "K8s::Flux::Provider", "providerRef");
+      for (const src of list(rec2(n.attrs?.spec)?.eventSources)) {
+        addFluxRef(n, src, "eventSource");
+      }
+      continue;
+    }
+    if (n.kind === "K8s::Argo::Application") {
+      addProject(n, str2(rec2(n.attrs?.spec)?.project), "project");
+      continue;
+    }
+    if (n.kind === "K8s::Argo::ApplicationSet") {
+      addProject(n, str2(rec2(rec2(rec2(n.attrs?.spec)?.template)?.spec)?.project), "template project");
+    }
+  }
+  return out;
+}
+function addK8sDeclaredEdges(ir) {
+  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  for (const e of deriveK8sEdges(ir.nodes)) {
+    const key = `${e.from}\0${e.to}`;
+    if (existing.has(key)) continue;
+    existing.add(key);
+    ir.edges.push(e);
+  }
+  return ir;
+}
+
+// src/helm-artifacts.ts
+function chartNameOf(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+function releaseMatchesChart(observed, chartName) {
+  const chart = observed.attributes?.chart;
+  if (typeof chart !== "string") return false;
+  return chart === chartName || chart.startsWith(`${chartName}-`);
+}
+function applyHelmArtifacts(ir, observed) {
+  let charts = 0;
+  let installed = 0;
+  for (const node of ir.nodes) {
+    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
+    charts++;
+    const attrs = node.attrs ??= {};
+    if (observed === void 0) {
+      attrs._status = "neutral";
+      attrs._unobserved = "artifact-observation-unavailable";
+      continue;
+    }
+    const chartName = chartNameOf(node);
+    const entry = chartName ? Object.entries(observed).find(([key2, o2]) => key2.startsWith("release/") && releaseMatchesChart(o2, chartName)) : void 0;
+    if (!entry) {
+      attrs._status = "accent";
+      continue;
+    }
+    const [key, o] = entry;
+    const match = {
+      release: key.replace(/^release\//, ""),
+      ...o.status ? { status: o.status } : {},
+      ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
+      ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {}
+    };
+    attrs._artifact = match;
+    attrs._status = o.status === "deployed" ? "good" : "warn";
+    if (o.status === "deployed") installed++;
+  }
+  return { charts, installed };
+}
+
+// src/estate.ts
+import { statSync as statSync3 } from "node:fs";
+import { availableParallelism } from "node:os";
+import { join as join7, resolve as resolve3, sep } from "node:path";
+import { composeStacks, shortStackNames } from "@intentius/pinhole";
+
+// src/member-ir.ts
+import { createHash } from "node:crypto";
+import { readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { join as join6, relative, resolve as resolve2 } from "node:path";
+var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+function memberIrCacheSize(env = process.env) {
+  const override = Number.parseInt(env.BEHOLD_ESTATE_IR_CACHE ?? "", 10);
+  return Number.isInteger(override) && override >= 0 ? override : 64;
+}
+function memberSourceStamp(dir) {
+  const root = resolve2(dir);
+  const h = createHash("sha1");
+  let any = false;
+  const walk = (at) => {
+    const entries = readdirSync3(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
+    for (const e of entries) {
+      if (SKIP.has(e.name)) continue;
+      const path = join6(at, e.name);
+      if (e.isDirectory()) {
+        walk(path);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      const st = statSync2(path);
+      h.update(`${relative(root, path)}\0${st.mtimeMs}\0${st.size}
+`);
+      any = true;
+    }
+  };
+  try {
+    walk(root);
+  } catch {
+    return void 0;
+  }
+  return any ? h.digest("hex") : void 0;
+}
+function cacheKey(dir, opts) {
+  const chant = resolveChant(dir);
+  const canonical = JSON.stringify(opts, Object.keys(opts).sort());
+  return `${resolve2(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
+}
+var cache = /* @__PURE__ */ new Map();
+var hits = 0;
+var misses = 0;
+function invalidateMember(dir) {
+  if (dir === void 0) {
+    cache.clear();
+    return;
+  }
+  const root = resolve2(dir);
+  for (const [key, entry] of cache) if (entry.dir === root) cache.delete(key);
+}
+async function memberIr(dir, opts = {}) {
+  const size = memberIrCacheSize();
+  if (opts.live || opts.overlay || size === 0) return graphIr(dir, opts);
+  const stamp = memberSourceStamp(dir);
+  const key = cacheKey(dir, opts);
+  const hit = stamp !== void 0 ? cache.get(key) : void 0;
+  if (hit && hit.stamp === stamp) {
+    hits++;
+    cache.delete(key);
+    cache.set(key, hit);
+    return structuredClone(hit.ir);
+  }
+  misses++;
+  const ir = await graphIr(dir, opts);
+  if (stamp === void 0 || memberSourceStamp(dir) !== stamp) return ir;
+  cache.delete(key);
+  cache.set(key, { dir: resolve2(dir), stamp, ir });
+  for (const oldest of cache.keys()) {
+    if (cache.size <= size) break;
+    cache.delete(oldest);
+  }
+  return structuredClone(ir);
+}
+
+// src/zoom-notes.ts
+function zoomNote(zoom, ir, compositeEdgesAttached) {
+  const empty = ir.nodes.length === 0;
+  if (zoom === "components") {
+    return empty ? "no components discovered \u2014 nothing declares one in this project" : void 0;
+  }
+  if (zoom === "logical") {
+    return empty ? "logical is an AWS projection \u2014 no AWS resources in this estate" : void 0;
+  }
+  if (zoom === "composites") {
+    return compositeEdgesAttached === 0 ? "no component ownership to join \u2014 showing the resource graph unchanged" : void 0;
+  }
+  if (zoom === "runtime") {
+    const children = ir.nodes.filter((n) => n.runtimeOwner).length;
+    return children === 0 ? "nothing below the declaration boundary \u2014 no owner-referenced children on this substrate" : void 0;
+  }
+  return void 0;
+}
+function logicalKept(before, after) {
+  if (after > 0 && after * 3 >= before) return void 0;
+  return after === 0 ? `logical projected nothing from ${before} resources \u2014 it is a cloud-topology lens, and this estate declares none of the kinds it nests (behold#74)` : `logical kept ${after} of ${before} resources \u2014 it is a cloud-topology lens, and the rest are kinds it does not nest (behold#74)`;
+}
+function edgelessNote(zoom, ir, detail) {
+  if (zoom === "components" || zoom === "logical") return void 0;
+  if (ir.nodes.length === 0 || ir.edges.length > 0) return void 0;
+  if (detail !== void 0 && detail < 3) {
+    return "no edges at this detail \u2014 sourceRef/dependsOn and other attrs-derived references only appear at detail 3 (\u2318K \u2192 attributes, or add &detail=3)";
+  }
+  return "no edges \u2014 nothing in this estate references anything else";
+}
+var CLUSTER_SCOPED = /* @__PURE__ */ new Set([
+  "K8s::Core::Namespace",
+  "K8s::Rbac::ClusterRole",
+  "K8s::Rbac::ClusterRoleBinding",
+  "K8s::Storage::StorageClass",
+  "K8s::Apiextensions::CustomResourceDefinition"
+]);
+function namespaceMismatchNote(nodes) {
+  const k8s = nodes.filter((n) => n?.lexicon === "k8s");
+  if (k8s.length === 0) return void 0;
+  const pending = k8s.filter((n) => n.attrs?._status === "accent" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (pending.length < 2) return void 0;
+  if (pending.some((n) => typeof n.attrs?.metadata?.namespace === "string" && n.attrs.metadata.namespace)) return void 0;
+  if (!k8s.some((n) => n.attrs?._status === "good")) return void 0;
+  return `${pending.length} pending k8s objects declare no metadata.namespace \u2014 if a controller stamps it at apply time (e.g. Flux's targetNamespace), the live read looked in "default", not where they run`;
+}
+function namespaceJoinNote(joined) {
+  if (joined.length === 0) return void 0;
+  const each = joined.map((j) => `${j.name} in "${j.namespace}"`).join(", ");
+  return `read ${each} \u2014 the namespace the estate's own Kustomization targetNamespace binds, not the app project's own declaration`;
+}
+function notesFor(zoom, ir, compositeEdgesAttached, logicalBefore, detail) {
+  const primary = zoom === "logical" && logicalBefore !== void 0 ? logicalKept(logicalBefore, ir.nodes.length) : zoomNote(zoom, ir, compositeEdgesAttached);
+  const notes = [primary, edgelessNote(zoom, ir, detail)].filter((n) => n !== void 0);
+  return notes.length ? notes.join(" \xB7 ") : void 0;
+}
+function tierMismatchNote(ir, tiers, currentTier) {
+  const values = tiers?.values ?? [];
+  if (values.length < 2) return void 0;
+  const byLexicon = /* @__PURE__ */ new Map();
+  for (const n of ir.nodes) {
+    const status = n.attrs?._status;
+    if (status !== "good" && status !== "accent") continue;
+    const lexicon = n.lexicon ?? "?";
+    const c = byLexicon.get(lexicon) ?? { good: 0, accent: 0 };
+    c[status === "good" ? "good" : "accent"]++;
+    byLexicon.set(lexicon, c);
+  }
+  for (const [lexicon, { good, accent }] of [...byLexicon].sort()) {
+    if (accent < 2 || accent * 2 < good + accent) continue;
+    const here = currentTier ? `tier "${currentTier}"` : "the default tier";
+    const others = values.filter((v) => v !== currentTier).join(", ");
+    return `${accent} of ${good + accent} ${lexicon} resources read "declared, not deployed" at ${here} \u2014 if the estate runs another declared tier (${others}), pick it (\u2318K \u2192 tier)`;
+  }
+  return void 0;
+}
+
+// src/estate.ts
+function estateReadPool(members, env = process.env) {
+  const override = Number.parseInt(env.BEHOLD_ESTATE_CONCURRENCY ?? "", 10);
+  const cap = Number.isInteger(override) && override >= 1 ? override : Math.min(4, availableParallelism());
+  return Math.max(1, Math.min(cap, members));
+}
+async function mapPool(items, width, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    for (let i = next++; i < items.length; i = next++) {
+      results[i] = await fn(items[i], i);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, Math.min(width, items.length)) }, () => worker()));
+  return results;
+}
+function estateMembers(projectDirs) {
+  const names = shortStackNames([...projectDirs]);
+  return projectDirs.map((dir, i) => ({ name: names[i], dir }));
+}
+async function composeEstate(projectDirs, opts = {}) {
+  const names = shortStackNames(projectDirs);
+  const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
+    name: names[i],
+    ir: await memberIr(dir, opts)
+  }));
+  return composeStacks(stacks);
+}
+var firstLine2 = (e) => {
+  const msg = e instanceof Error ? e.message : String(e);
+  const m = msg.match(/exited \d+:\s*([\s\S]*)/);
+  return (m ? m[1] : msg).split("\n")[0].trim().slice(0, 160);
+};
+function namespaceRuntimeOwners(name, ir) {
+  const own = new Set(ir.nodes.map((n) => n.id));
+  for (const n of ir.nodes) {
+    if (n.runtimeOwner && own.has(n.runtimeOwner)) n.runtimeOwner = `${name}/${n.runtimeOwner}`;
+  }
+  return ir;
+}
+var NAMESPACE_JOIN_FLOOR = "0.44.5";
+var rec3 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+var str3 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
+var realIsDir = (p) => {
+  try {
+    return statSync3(p).isDirectory();
+  } catch {
+    return false;
+  }
+};
+function declaredNamespaceBindings(ir) {
+  const out = [];
+  for (const n of ir.nodes) {
+    if (n.kind !== "K8s::Flux::Kustomization") continue;
+    const spec = rec3(n.attrs?.spec);
+    const namespace = str3(spec?.targetNamespace);
+    const path = str3(spec?.path);
+    if (namespace && path) out.push({ path, namespace });
+  }
+  return out;
+}
+function awaitsNamespaceBinding(ir) {
+  const namespaced = ir.nodes.filter((n) => n.lexicon === "k8s" && !CLUSTER_SCOPED.has(n.kind ?? ""));
+  if (namespaced.length === 0) return false;
+  return namespaced.every((n) => !str3(rec3(n.attrs?.metadata)?.namespace));
+}
+function declaredSegments(path) {
+  if (path.startsWith("/")) return void 0;
+  const segs = path.split("/").filter((s) => s !== "" && s !== ".");
+  if (segs.length === 0 || segs.includes("..")) return void 0;
+  return segs;
+}
+function pathAlignment(declared, dir, isDir = realIsDir) {
+  const want = declaredSegments(declared);
+  if (!want) return 0;
+  const root = resolve3(dir);
+  const have = root.split(sep).filter(Boolean);
+  for (let k = Math.min(want.length, have.length); k >= 1; k--) {
+    if (!have.slice(-k).every((s, i) => s === want[i])) continue;
+    if (!isDir(join7(root, ...want.slice(k)))) continue;
+    return k;
+  }
+  return 0;
+}
+function joinNamespaceBindings(members, isDir = realIsDir) {
+  const bindings = members.flatMap(
+    (m) => m.ir ? declaredNamespaceBindings(m.ir).map((b) => ({ ...b, declaredBy: m.dir })) : []
+  );
+  if (bindings.length === 0) return [];
+  const awaiting = members.filter((m) => m.ir && awaitsNamespaceBinding(m.ir));
+  if (awaiting.length === 0) return [];
+  const best = /* @__PURE__ */ new Map();
+  for (const b of bindings) {
+    let winner;
+    let tied = false;
+    for (const m of awaiting) {
+      if (m.dir === b.declaredBy) continue;
+      const score = pathAlignment(b.path, m.dir, isDir);
+      if (score === 0) continue;
+      if (!winner || score > winner.score) {
+        winner = { dir: m.dir, score };
+        tied = false;
+      } else if (score === winner.score) {
+        tied = true;
+      }
+    }
+    if (!winner || tied) continue;
+    const prev = best.get(winner.dir);
+    if (prev === "ambiguous") continue;
+    const join21 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join21 });
+    else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join21 });
+  }
+  return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
+}
+async function estateNamespaceScopes(projectDirs, opts, isDir = realIsDir) {
+  if (projectDirs.length < 2) return /* @__PURE__ */ new Map();
+  const { live: _live, overlay: _overlay, namespace: _namespace, ...src } = opts;
+  const irs = await mapPool(
+    projectDirs,
+    estateReadPool(projectDirs.length),
+    (dir) => memberIr(dir, { ...src, detail: 3 }).catch(() => void 0)
+  );
+  const scopes = /* @__PURE__ */ new Map();
+  for (const j of joinNamespaceBindings(projectDirs.map((dir, i) => ({ dir, ir: irs[i] })), isDir)) {
+    if (!meetsFloor(resolveChant(j.dir).version, NAMESPACE_JOIN_FLOOR)) continue;
+    scopes.set(j.dir, j.namespace);
+  }
+  return scopes;
+}
+function withoutJoinedMembers(nodes, joined) {
+  if (joined.length === 0) return [...nodes];
+  return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
+}
+async function composeEstateOverlay(projectDirs, opts, classify) {
+  const names = shortStackNames(projectDirs);
+  const unobserved = [];
+  const dropped = [];
+  const joined = [];
+  const stacks = new Array(projectDirs.length);
+  const scopes = await estateNamespaceScopes(projectDirs, opts);
+  await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => {
+    const name = names[i];
+    const namespace = scopes.get(dir);
+    try {
+      const live = { ...opts, live: true, overlay: true, ...namespace ? { namespace } : {} };
+      stacks[i] = { name, ir: namespaceRuntimeOwners(name, classify(await graphIr(dir, live))) };
+      if (namespace) joined.push({ name, namespace });
+    } catch (err) {
+      const reason = firstLine2(err);
+      try {
+        const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
+        const src = await memberIr(dir, srcOpts);
+        for (const n of src.nodes) n.attrs = { ...n.attrs, _status: "neutral", _unobserved: reason };
+        stacks[i] = { name, ir: src };
+        unobserved.push({ name, reason });
+      } catch (err2) {
+        dropped.push({ name, reason: firstLine2(err2) });
+      }
+    }
+  });
+  const present = stacks.filter((s) => !!s);
+  return {
+    ir: composeStacks(present),
+    observed: present.length - unobserved.length,
+    total: projectDirs.length,
+    unobserved,
+    dropped,
+    // Concurrent reads finish in whatever order the clusters answer; the note
+    // this feeds should read the same twice.
+    joined: joined.sort((a, b) => a.name.localeCompare(b.name))
+  };
+}
+
+// src/helm-drift.ts
+function countChanges(docs) {
+  return docs.reduce((n, d) => n + d.changes.length, 0);
+}
+function provenanceOf(live) {
+  const m = live.manifest;
+  return {
+    contentDigest: m.contentDigest,
+    inputDigest: m.inputDigest,
+    valuesDigest: m.valuesDigest,
+    chart: m.chart,
+    chartVersion: m.chartVersion,
+    repo: m.repo,
+    releaseName: m.releaseName,
+    namespace: m.namespace,
+    profile: m.capabilityProfile?.cluster ?? "",
+    kubeVersion: m.capabilityProfile?.kubeVersion ?? "",
+    renderedAt: m.renderedAt,
+    helmVersion: m.helmVersion,
+    chantVersion: m.chantVersion,
+    sourceRef: m.sourceRef
+  };
+}
+function helmRenderReport(record, live) {
+  const base = { render: record.name, chart: record.chart };
+  if (!live) {
+    return { ...base, verdict: "unobserved", reason: record.contentDigest ? "no-stored-render" : "unpinned" };
+  }
+  const d = live.diff;
+  const counts = {
+    drifted: d.drifted.length,
+    changes: countChanges(d.drifted),
+    unchanged: d.unchanged.length,
+    unobserved: d.unobserved.length,
+    undeclared: d.undeclaredEntities.length
+  };
+  const provenance = provenanceOf(live);
+  if (d.drifted.length > 0) {
+    return { ...base, verdict: "drifted", counts, provenance, drifted: d.drifted };
+  }
+  if (d.drifted.length + d.accepted.length + d.unchanged.length === 0) {
+    return { ...base, verdict: "unobserved", reason: "nothing-observed", counts, provenance };
+  }
+  if (d.unobserved.length > 0) {
+    return { ...base, verdict: "unobserved", reason: "partly-observed", counts, provenance };
+  }
+  return { ...base, verdict: "in-sync", counts, provenance };
+}
+async function readHelmRenderDrift(projectDir, env, opts = {}) {
+  const report = await helmRenders(projectDir, opts).catch(() => void 0);
+  const records = report?.records ?? [];
+  if (records.length === 0) return [];
+  return mapPool(records, estateReadPool(records.length), async (record) => {
+    if (!record.contentDigest) return helmRenderReport(record, void 0);
+    const live = await helmRenderDiffLive(projectDir, record.contentDigest, env, opts).catch(() => void 0);
+    return helmRenderReport(record, live);
+  });
+}
+function chartNameOf2(node) {
+  const name = node.attrs?.name;
+  return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+var SEVERITY = { drifted: 2, unobserved: 1, "in-sync": 0 };
+function applyHelmRenderDrift(ir, reports) {
+  if (reports.length === 0) return { charts: 0, drifted: 0 };
+  const byChart = /* @__PURE__ */ new Map();
+  for (const r of reports) {
+    const list3 = byChart.get(r.chart);
+    if (list3) list3.push(r);
+    else byChart.set(r.chart, [r]);
+  }
+  let charts = 0;
+  let drifted = 0;
+  for (const node of ir.nodes) {
+    if (node.lexicon !== "helm" || node.kind !== "Helm::Chart") continue;
+    const chartName = chartNameOf2(node);
+    const matched = chartName ? byChart.get(chartName) : void 0;
+    if (!matched || matched.length === 0) continue;
+    const worst = matched.reduce((a, b) => SEVERITY[b.verdict] > SEVERITY[a.verdict] ? b : a);
+    const attrs = node.attrs ??= {};
+    attrs._renderDrift = matched.length === 1 ? worst : { ...worst, renders: matched };
+    charts++;
+    if (worst.verdict === "drifted") {
+      attrs._status = "warn";
+      drifted++;
+    }
+  }
+  return { charts, drifted };
+}
+
+// src/cluster-anchor.ts
+var MANAGED_CLUSTER_KINDS = /* @__PURE__ */ new Set([
+  "AWS::EKS::Cluster",
+  "GCP::Container::Cluster",
+  "Microsoft.ContainerService/managedClusters",
+  "K3d::Cluster"
+]);
+var ANCHOR_VIA = "runs-on";
+function metadata(node) {
+  const m = node.attrs?.metadata;
+  return m && typeof m === "object" && !Array.isArray(m) ? m : void 0;
+}
+function metaString(node, key) {
+  const v = metadata(node)?.[key];
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+function isK8s(node) {
+  return node.lexicon === "k8s";
+}
+function isNamespace(node) {
+  return node.kind === "K8s::Core::Namespace";
+}
+function managedClusterName(node) {
+  const metaName = metaString(node, "name");
+  if (metaName) return metaName;
+  for (const key of ["name", "clusterName"]) {
+    const v = node.attrs?.[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return node.id;
+}
+function boundManagedCluster(nodes, boundContext) {
+  const clusters = nodes.filter((n) => MANAGED_CLUSTER_KINDS.has(n.kind));
+  if (clusters.length === 1) return clusters[0];
+  if (clusters.length === 0 || !boundContext) return void 0;
+  const bound = clusters.filter((n) => contextBindsCluster(boundContext, managedClusterName(n)));
+  return bound.length === 1 ? bound[0] : void 0;
+}
+function addClusterAnchorEdges(ir, boundContext) {
+  const nodes = ir.nodes;
+  const cluster = boundManagedCluster(ir.nodes, boundContext);
+  if (!cluster) return ir;
+  const k8sNodes = nodes.filter(isK8s);
+  if (k8sNodes.length === 0) return ir;
+  const namespaceByName = /* @__PURE__ */ new Map();
+  for (const n of k8sNodes) {
+    if (!isNamespace(n)) continue;
+    const name = metaString(n, "name");
+    if (name && !namespaceByName.has(name)) namespaceByName.set(name, n.id);
+  }
+  const existing = new Set(ir.edges.map((e) => `${e.from}\0${e.to}`));
+  const add = (from, to) => {
+    if (from === to) return;
+    const key = `${from}\0${to}`;
+    if (existing.has(key)) return;
+    existing.add(key);
+    ir.edges.push({ from, to, kind: "ref", viaAttr: ANCHOR_VIA, inferred: true });
+  };
+  for (const n of k8sNodes) {
+    if (isNamespace(n)) {
+      add(cluster.id, n.id);
+      continue;
+    }
+    const ns = metaString(n, "namespace");
+    const nsNode = ns ? namespaceByName.get(ns) : void 0;
+    add(nsNode ?? cluster.id, n.id);
+  }
+  return ir;
+}
+
+// src/logical-azure.ts
+var AZURE_HEADLINE_KINDS = /* @__PURE__ */ new Set([
+  // compute / workloads
+  "Microsoft.Compute/virtualMachines",
+  "Microsoft.Compute/virtualMachineScaleSets",
+  "Microsoft.ContainerService/managedClusters",
+  "Microsoft.ContainerInstance/containerGroups",
+  "Microsoft.Web/sites",
+  // network edge
+  "Microsoft.Network/publicIPAddresses",
+  "Microsoft.Network/loadBalancers",
+  "Microsoft.Network/applicationGateways",
+  "Microsoft.Network/natGateways",
+  "Microsoft.Network/dnsZones",
+  // data stores
+  "Microsoft.Storage/storageAccounts",
+  "Microsoft.Sql/servers",
+  "Microsoft.DocumentDB/databaseAccounts",
+  "Microsoft.Cache/redis",
+  "Microsoft.DBforPostgreSQL/flexibleServers",
+  // registry / identity edge
+  "Microsoft.ContainerRegistry/registries"
+]);
+var AZURE_FABRIC_KINDS = /* @__PURE__ */ new Set([
+  "Microsoft.Network/virtualNetworks",
+  "Microsoft.Network/virtualNetworks_subnets",
+  "Microsoft.Network/networkSecurityGroups",
+  "Microsoft.Network/routeTables",
+  "Microsoft.Network/networkInterfaces",
+  // identity/authorization hubs — a role assignment or managed identity is
+  // referenced by half the estate, so contracting through one invents edges
+  // between unrelated resources.
+  "Microsoft.Authorization/roleAssignments",
+  "Microsoft.ManagedIdentity/userAssignedIdentities",
+  "Microsoft.KeyVault/vaults"
+]);
+var VNET_KIND = "Microsoft.Network/virtualNetworks";
+var SUBNET_KIND = "Microsoft.Network/virtualNetworks_subnets";
+var NSG_KIND = "Microsoft.Network/networkSecurityGroups";
+var RESOURCE_ID_RE = /resourceId\(\s*([^)]*)\)/g;
+var QUOTED_RE = /'([^']*)'/g;
+function resourceIdNames(value) {
+  if (typeof value !== "string" || !value.includes("resourceId(")) return [];
+  const out = [];
+  for (const call of value.matchAll(RESOURCE_ID_RE)) {
+    const args = [...call[1].matchAll(QUOTED_RE)].map((m) => m[1]);
+    if (args.length >= 2) out.push(args[args.length - 1]);
+  }
+  return out;
+}
+function collectAzureRefs(value, out) {
+  if (value === null || typeof value !== "object") {
+    for (const name of resourceIdNames(value)) out.add(name);
+    return;
+  }
+  const ref = value.$ref;
+  if (typeof ref === "string") out.add(ref.split(".")[0]);
+  for (const v of Object.values(value)) collectAzureRefs(v, out);
+}
+function strAttr(node, key) {
+  const v = node.attrs?.[key];
+  return typeof v === "string" ? v : void 0;
+}
+function resourceName(node) {
+  return strAttr(node, "name");
+}
+function subnetVnetName(node) {
+  const name = resourceName(node);
+  if (!name || !name.includes("/")) return void 0;
+  return name.split("/")[0];
+}
+function subnetShortName(node) {
+  const name = resourceName(node);
+  return name?.includes("/") ? name.split("/").slice(1).join("/") : name;
+}
+function vnetCidr(node) {
+  const space = node.attrs?.addressSpace;
+  const prefixes = space?.addressPrefixes;
+  return Array.isArray(prefixes) && typeof prefixes[0] === "string" ? prefixes[0] : void 0;
+}
+function projectAzureLogical(ir, env) {
+  const azure = ir.nodes.filter((n) => n.lexicon === "azure");
+  if (azure.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
+  const componentOf = componentNamer(azure);
+  const byId = new Map(azure.map((n) => [n.id, n]));
+  const byName = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const name = resourceName(n);
+    if (name && !byName.has(name)) byName.set(name, n);
+  }
+  const vnets = azure.filter((n) => n.kind === VNET_KIND);
+  const subnets = azure.filter((n) => n.kind === SUBNET_KIND);
+  const vnetByName = new Map(vnets.map((v) => [resourceName(v) ?? v.id, v]));
+  const refOut = /* @__PURE__ */ new Map();
+  for (const n of azure) {
+    const names = /* @__PURE__ */ new Set();
+    collectAzureRefs(n.attrs, names);
+    const targets = /* @__PURE__ */ new Set();
+    for (const name of names) {
+      const target = byName.get(name) ?? byId.get(name);
+      if (target && target.id !== n.id) targets.add(target.id);
+    }
+    if (targets.size) refOut.set(n.id, targets);
+  }
+  for (const e of ir.edges) {
+    if (!byId.has(e.from) || !byId.has(e.to)) continue;
+    (refOut.get(e.from) ?? refOut.set(e.from, /* @__PURE__ */ new Set()).get(e.from)).add(e.to);
+  }
+  const RG_TITLE = env ? `resource group ${env}` : "resource group";
+  const vnetTitle = (v) => `VNet ${vnetCidr(v) ?? resourceName(v) ?? v.id}`;
+  const subnetTitle = (s) => `subnet ${strAttr(s, "addressPrefix") ?? subnetShortName(s) ?? s.id}`;
+  const guardedBy = /* @__PURE__ */ new Map();
+  for (const s of subnets) {
+    const names = /* @__PURE__ */ new Set();
+    collectAzureRefs(s.attrs?.networkSecurityGroup, names);
+    for (const name of names) {
+      if (byName.get(name)?.kind === NSG_KIND) guardedBy.set(s.id, name);
+    }
+  }
+  const headline = azure.filter((n) => AZURE_HEADLINE_KINDS.has(n.kind));
+  const subnetIds = new Set(subnets.map((s) => s.id));
+  const vnetIds = new Set(vnets.map((v) => v.id));
+  const nearest = (start, want, maxDepth = 6) => {
+    const seen = /* @__PURE__ */ new Set([start]);
+    let frontier = [...refOut.get(start) ?? []];
+    for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
+      const next = [];
+      for (const id of frontier) {
+        if (seen.has(id)) continue;
+        seen.add(id);
+        if (want.has(id)) return id;
+        for (const r of refOut.get(id) ?? []) if (!seen.has(r)) next.push(r);
+      }
+      frontier = next;
+    }
+    return void 0;
+  };
+  const byContainer = {};
+  const child = (parent, c) => {
+    const arr = byContainer[parent] ?? (byContainer[parent] = []);
+    if (!arr.includes(c)) arr.push(c);
+  };
+  for (const v of vnets) child(RG_TITLE, vnetTitle(v));
+  for (const s of subnets) {
     const parentVnet = subnetVnetName(s);
     const v = parentVnet ? vnetByName.get(parentVnet) : void 0;
     child(v ? vnetTitle(v) : RG_TITLE, subnetTitle(s));
@@ -4534,9 +5176,9 @@ function helmIconFor(kind) {
 var SUPPORTED_MAJOR = 1;
 var refuse = (error, remedy) => ({ ok: false, refusal: { error, code: "carve-report", remedy } });
 var HOW_TO_GET_ONE = "Generate one with `chant carve advise --from <terraform-dir> --report report.json` (chant's read-only Terraform peelability advisor), then `behold carve report.json`.";
-var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function parseCarveReport(value) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     return refuse("That file isn't a carve report \u2014 its top level isn't a JSON object.", HOW_TO_GET_ONE);
   }
   if (!Array.isArray(value.resources)) {
@@ -4546,7 +5188,7 @@ function parseCarveReport(value) {
     );
   }
   const bad = value.resources.findIndex(
-    (r) => !isRecord(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
+    (r) => !isRecord2(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
   );
   if (bad >= 0) {
     return refuse(
@@ -4612,7 +5254,7 @@ function boundaryEdgesOf(r) {
   const b = r.boundary;
   if (!b) return [];
   const list3 = Array.isArray(b) ? b : [...b.inbound ?? [], ...b.outbound ?? []];
-  return list3.filter((e) => isRecord(e) && typeof e.survivor === "string" && typeof e.carved === "string");
+  return list3.filter((e) => isRecord2(e) && typeof e.survivor === "string" && typeof e.carved === "string");
 }
 function scoreArithmetic(r) {
   const b = r.breakdown;
@@ -4728,10 +5370,10 @@ import { readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as
 import { dirname as dirname4, join as join10 } from "node:path";
 var CARVE_MANIFEST_SUFFIX = ".carve.json";
 var APPLY_IS_HUMAN = "`chant carve apply` graduates ownership \u2014 it resolves the marker that makes chant the owner of a live resource. behold shows what the manifest records and echoes the command; it has no apply endpoint and no apply button, by design. Read the graduation plan, then run it yourself.";
-var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 function parseCarveManifest(value) {
-  if (!isRecord2(value)) return null;
+  if (!isRecord3(value)) return null;
   if (value.version !== 1) return null;
   if (typeof value.target !== "string" || !value.target) return null;
   return value;
@@ -4975,9 +5617,9 @@ function carveStateNote(progress, states) {
 var SUPPORTED_MAJOR2 = 1;
 var refuse2 = (error, remedy) => ({ ok: false, refusal: { error, code: "op-ir", remedy } });
 var HOW_TO_EMIT = "Build the project with a chant >= 0.50 (`chant build --lexicon temporal`), which writes `dist/ops/<name>/op.json` beside each Op's generated workflow.";
-var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function parseOpIr(value) {
-  if (!isRecord3(value)) {
+  if (!isRecord4(value)) {
     return refuse2("That file isn't an op.json \u2014 its top level isn't a JSON object.", HOW_TO_EMIT);
   }
   if (typeof value.name !== "string" || !Array.isArray(value.phases)) {
@@ -4986,7 +5628,7 @@ function parseOpIr(value) {
       HOW_TO_EMIT
     );
   }
-  const bad = value.phases.findIndex((p) => !isRecord3(p) || typeof p.name !== "string" || !Array.isArray(p.steps));
+  const bad = value.phases.findIndex((p) => !isRecord4(p) || typeof p.name !== "string" || !Array.isArray(p.steps));
   if (bad >= 0) {
     return refuse2(
       `That JSON has a \`phases\` array, but entry ${bad} isn't a phase (needs a string \`name\` and a \`steps\` array).`,
@@ -5083,14 +5725,14 @@ function opPlacedSteps(op) {
 }
 var RULE_BOX = (opName) => `${opName} \xB7 rule table`;
 var ruleId = (opName, rule) => `${opName}/rules/${rule.id}`;
-var isPredicate = (v) => isRecord3(v) && typeof v.kind === "string";
+var isPredicate = (v) => isRecord4(v) && typeof v.kind === "string";
 function isConvergeRule(v) {
-  if (!isRecord3(v)) return false;
+  if (!isRecord4(v)) return false;
   if (typeof v.id !== "string" || !v.id) return false;
   if (typeof v.why !== "string" || !v.why) return false;
   if (!isPredicate(v.when)) return false;
   const then = v.then;
-  if (!isRecord3(then)) return false;
+  if (!isRecord4(then)) return false;
   return then.kind === "run" && typeof then.op === "string" || then.kind === "report" && typeof then.reason === "string";
 }
 function convergeTable(op) {
@@ -5999,6 +6641,34 @@ function reanchorEdges(svg, moved) {
 import { spawn as spawn3 } from "node:child_process";
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
 import { join as join12 } from "node:path";
+
+// src/scratch.ts
+var PROTECTED_INFRA = [
+  /^floci(-|$)/,
+  /^chant-floci(-|$)/,
+  /^k3d-kubemicrovm-local$/,
+  /^k3d-fountain-local$/,
+  /^kubemicrovm-local$/,
+  /^fountain-local$/
+];
+var PROTECTED_PORTS = [4566, 4577, 4588];
+var SCRATCH_PREFIX = "behold-";
+function scratchNameProblem(name) {
+  if (!name.startsWith(SCRATCH_PREFIX)) return `scratch infra must be named ${SCRATCH_PREFIX}*, got ${JSON.stringify(name)}`;
+  const hit = PROTECTED_INFRA.find((re) => re.test(name));
+  if (hit) return `${JSON.stringify(name)} is protected infrastructure (${hit}) \u2014 behold never touches it`;
+  return void 0;
+}
+function scratchPortProblem(port) {
+  if (PROTECTED_PORTS.includes(port)) return `port ${port} belongs to a shared emulator \u2014 a scratch substrate gets its own`;
+  return void 0;
+}
+function assertScratch(name, port) {
+  const p = scratchNameProblem(name) ?? (port === void 0 ? void 0 : scratchPortProblem(port));
+  if (p) throw new Error(`scratch discipline: ${p}`);
+}
+
+// src/carve-live.ts
 var LIVE_CONTAINER = "behold-carve-floci";
 var LIVE_PORT = 4602;
 var LIVE_IMAGE = "floci/floci:1.5.34";
@@ -6029,973 +6699,692 @@ function capture(cmd, args, cwd) {
     child.on("error", () => res({ code: -1, stdout: out }));
     child.on("close", (code) => res({ code: code ?? 1, stdout: out }));
   });
-}
-async function bootScratchFloci() {
-  const ps = await capture("docker", ["ps", "-a", "--format", "{{.Names}}"], process.cwd());
-  if (ps.code !== 0) return "docker isn't answering \u2014 is the daemon up?";
-  if (ps.stdout.split("\n").includes(LIVE_CONTAINER)) {
-    return `container ${LIVE_CONTAINER} already exists \u2014 a previous run didn't tear down. \`docker rm -f ${LIVE_CONTAINER}\` and re-run.`;
-  }
-  const run3 = await capture(
-    "docker",
-    ["run", "-d", "--rm", "-p", `${LIVE_PORT}:4566`, "--name", LIVE_CONTAINER, LIVE_IMAGE],
-    process.cwd()
-  );
-  if (run3.code !== 0) return `docker run ${LIVE_IMAGE} failed (${run3.code})`;
-  for (let i = 0; i < 30; i++) {
-    try {
-      const health = await fetch(`http://localhost:${LIVE_PORT}/_localstack/health`);
-      if (health.ok && (await health.text()).includes("cloudformation")) return void 0;
-    } catch {
-    }
-    await new Promise((r) => setTimeout(r, 1e3));
-  }
-  await teardownScratchFloci();
-  return `Floci never reported healthy on :${LIVE_PORT} after 30s`;
-}
-async function teardownScratchFloci() {
-  await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
-}
-async function applyIntoFloci(fromDir, step) {
-  const template = join12(fromDir, "floci-override.tf.disabled");
-  if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync3(join12(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
-  const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
-  if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
-  const apply = await step(
-    "terraform",
-    ["apply", "-input=false", "-auto-approve", "-no-color", ...LIVE_TARGETS.map((t) => `-target=${t}`)],
-    fromDir
-  );
-  if (apply !== 0) return `terraform apply exited ${apply}`;
-  return void 0;
-}
-async function runLivePlan(fromDir) {
-  const r = await capture("terraform", ["plan", "-input=false", "-no-color", "-detailed-exitcode", ...LIVE_TARGETS.map((t) => `-target=${t}`)], fromDir);
-  if (r.code !== 0 && r.code !== 2) {
-    const tail = r.stdout.trim().split("\n").slice(-8).join("\n");
-    return { error: `terraform plan failed (exit ${r.code}):
-${tail}`, exitCode: r.code };
-  }
-  return { ...parsePlanOutput(r.stdout, r.code), exitCode: r.code };
-}
-
-// src/carve-actions.ts
-async function runCarvePlan(demo) {
-  if (!demo?.live) {
-    return refuse3(
-      "carve-action",
-      "terraform plan is the live tier's beat, and this server isn't serving one",
-      "run `behold demo carve --live` (needs docker + terraform)"
-    );
-  }
-  const r = await runLivePlan(demo.from);
-  if ("error" in r) {
-    return refuse3("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
-  }
-  return {
-    ok: true,
-    command: "terraform plan -detailed-exitcode (targeted, in the demo copy)",
-    planLine: r.planLine,
-    changes: r.changes,
-    noDestroy: r.noDestroy
-  };
-}
-async function runCarveObserve(demo, select) {
-  if (!demo.live) {
-    return refuse3(
-      "carve-action",
-      "the observe beat reads the scratch Floci, and this server isn't serving one",
-      "run `behold demo carve --live` (needs docker + terraform)"
-    );
-  }
-  if (!existsSync8(join13(demo.out, "src"))) {
-    return refuse3("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
-  }
-  const args = ["lifecycle", "diff", "prod", "--live", "--json"];
-  const run3 = await runChantRaw(args, demo.out, { AWS_ENDPOINT_URL: demo.live.endpoint }).catch((err) => ({
-    code: 127,
-    stdout: "",
-    stderr: err instanceof Error ? err.message : String(err)
-  }));
-  if (run3.code !== 0) {
-    return refuse3(
-      "carve-action",
-      `chant lifecycle diff exited ${run3.code}: ${merge(run3, demo.root) || "(no output)"}`,
-      "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + "."
-    );
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(run3.stdout);
-  } catch {
-    return refuse3("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
-  }
-  if (parsed.stacks && !parsed.lexicons) {
-    return refuse3(
-      "carve-action",
-      "chant lifecycle diff answered a stacked shape ({stacks}) \u2014 observe only reads the stack-less {lexicons} shape",
-      "point the target at a stack-less carveout, or file a shape-read gap against observe for the stacked case"
-    );
-  }
-  const aws = parsed.lexicons?.aws ?? {};
-  const entity = select.split(".").pop() ?? select;
-  const command = `AWS_ENDPOINT_URL=${demo.live.endpoint} chant ${args.join(" ")}  # in ${shortenIn(demo.out, demo.root)}`;
-  const queried = aws.resources?.queried?.[entity];
-  const meta = aws.observed?.[entity];
-  if (meta) {
-    return {
-      ok: true,
-      select,
-      command,
-      entity,
-      verdict: "observed",
-      ...meta.status ? { status: meta.status } : {},
-      ...meta.ownership ? { ownership: meta.ownership } : {},
-      ...meta.physicalId ? { physicalId: meta.physicalId } : {},
-      ...queried ? { queried } : {}
-    };
-  }
-  const hole = aws.resources?.unobserved?.find((u) => u.name === entity);
-  if (hole) {
-    return {
-      ok: true,
-      select,
-      command,
-      entity,
-      verdict: "unobserved",
-      ...hole.detail || hole.reason ? { detail: [hole.reason, hole.detail].filter(Boolean).join(": ") } : {},
-      ...queried ? { queried } : {}
-    };
-  }
-  return { ok: true, select, command, entity, verdict: "missing", ...queried ? { queried } : {} };
-}
-var MAX_ARTIFACT_BYTES = 64 * 1024;
-var MAX_ARTIFACTS = 24;
-var MAX_OUTPUT_BYTES = 32 * 1024;
-var refuse3 = (code, error, remedy) => ({
-  ok: false,
-  refusal: { error, code, remedy }
-});
-var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
-function insideDemo(root, p) {
-  const rel = relative2(resolve4(root), resolve4(p));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
-function selectFromReport(report, raw) {
-  if (typeof raw !== "string" || !raw || raw.length > 512) return null;
-  return (report?.resources ?? []).some((r) => r.address === raw) ? raw : null;
-}
-function carveWriteBlock(demo) {
-  if (!demo) {
-    return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
-  }
-  if (!existsSync8(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
-  if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
-  return unwritableReason(demo.root);
-}
-function readArtifacts(demo, dir, filter) {
-  const out = [];
-  const walk = (d, depth) => {
-    if (out.length >= MAX_ARTIFACTS || depth > 2) return;
-    let entries;
+}
+async function bootScratchFloci() {
+  assertScratch(LIVE_CONTAINER, LIVE_PORT);
+  const ps = await capture("docker", ["ps", "-a", "--format", "{{.Names}}"], process.cwd());
+  if (ps.code !== 0) return "docker isn't answering \u2014 is the daemon up?";
+  if (ps.stdout.split("\n").includes(LIVE_CONTAINER)) {
+    return `container ${LIVE_CONTAINER} already exists \u2014 a previous run didn't tear down. \`docker rm -f ${LIVE_CONTAINER}\` and re-run.`;
+  }
+  const run3 = await capture(
+    "docker",
+    ["run", "-d", "--rm", "-p", `${LIVE_PORT}:4566`, "--name", LIVE_CONTAINER, LIVE_IMAGE],
+    process.cwd()
+  );
+  if (run3.code !== 0) return `docker run ${LIVE_IMAGE} failed (${run3.code})`;
+  for (let i = 0; i < 30; i++) {
     try {
-      entries = readdirSync5(d).sort();
+      const health = await fetch(`http://localhost:${LIVE_PORT}/_localstack/health`);
+      if (health.ok && (await health.text()).includes("cloudformation")) return void 0;
     } catch {
-      return;
-    }
-    for (const name of entries) {
-      if (out.length >= MAX_ARTIFACTS) return;
-      if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join13(d, name);
-      let st;
-      try {
-        st = statSync5(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(full, depth + 1);
-        continue;
-      }
-      const rel = relative2(demo.root, full).split(sep2).join("/");
-      if (!filter(rel)) continue;
-      let text = "";
-      try {
-        text = readFileSync10(full, "utf8");
-      } catch {
-        continue;
-      }
-      const truncated = text.length > MAX_ARTIFACT_BYTES;
-      out.push({
-        path: rel,
-        kind: (name.split(".").pop() ?? "").toLowerCase(),
-        bytes: st.size,
-        text: truncated ? text.slice(0, MAX_ARTIFACT_BYTES) : text,
-        truncated
-      });
     }
-  };
-  walk(dir, 0);
-  return out;
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  await teardownScratchFloci();
+  return `Floci never reported healthy on :${LIVE_PORT} after 30s`;
 }
-function carveSlug(select) {
-  return select.replace(/[^A-Za-z0-9_]+/g, "-");
+async function teardownScratchFloci() {
+  await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
-var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
-function shortenIn(arg, root) {
-  return arg.startsWith(root + sep2) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+async function applyIntoFloci(fromDir, step) {
+  const template = join12(fromDir, "floci-override.tf.disabled");
+  if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
+  writeFileSync3(join12(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
+  const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
+  if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
+  const apply = await step(
+    "terraform",
+    ["apply", "-input=false", "-auto-approve", "-no-color", ...LIVE_TARGETS.map((t) => `-target=${t}`)],
+    fromDir
+  );
+  if (apply !== 0) return `terraform apply exited ${apply}`;
+  return void 0;
 }
-function merge(r, root) {
-  const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
-  return clip(joined.split(root + sep2).join("").split(root).join("."));
+async function runLivePlan(fromDir) {
+  const r = await capture("terraform", ["plan", "-input=false", "-no-color", "-detailed-exitcode", ...LIVE_TARGETS.map((t) => `-target=${t}`)], fromDir);
+  if (r.code !== 0 && r.code !== 2) {
+    const tail = r.stdout.trim().split("\n").slice(-8).join("\n");
+    return { error: `terraform plan failed (exit ${r.code}):
+${tail}`, exitCode: r.code };
+  }
+  return { ...parsePlanOutput(r.stdout, r.code), exitCode: r.code };
 }
-async function runCarveEmit(demo, select) {
-  const block = carveWriteBlock(demo);
-  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
-  mkdirSync3(demo.out, { recursive: true });
-  const reportFile = join13(demo.out, `${carveSlug(select)}-boundary.json`);
-  const args = [
-    "carve",
-    "emit",
-    "--from",
-    demo.from,
-    ...demo.state ? ["--state", demo.state] : [],
-    "--select",
-    select,
-    "--output",
-    demo.out,
-    "--report",
-    reportFile
-  ];
-  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
-    code: 127,
-    stdout: "",
-    stderr: err instanceof Error ? err.message : String(err)
-  }));
-  const output = merge(run3, demo.root);
-  if (run3.code !== 0) {
+
+// src/carve-actions.ts
+async function runCarvePlan(demo) {
+  if (!demo?.live) {
     return refuse3(
       "carve-action",
-      `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
-      "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
+      "terraform plan is the live tier's beat, and this server isn't serving one",
+      "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  let boundary = null;
-  try {
-    boundary = JSON.parse(readFileSync10(reportFile, "utf8"));
-  } catch {
+  const r = await runLivePlan(demo.from);
+  if ("error" in r) {
+    return refuse3("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
   }
-  const lintPath = relative2(demo.project, join13(demo.out, "src")).split(sep2).join("/");
-  const lintArgs = ["lint", lintPath];
-  const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
-    code: 127,
-    stdout: "",
-    stderr: err instanceof Error ? err.message : String(err)
-  }));
   return {
     ok: true,
-    select,
-    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
-    output,
-    // Emitted source first, scaffolding after: `src/assets.ts` is the thing the
-    // step is about, and a package.json sorting above it buries the answer.
-    artifacts: readArtifacts(demo, demo.out, (rel) => /\.(ts|json)$/.test(rel) && !rel.endsWith("tsconfig.json")).sort(
-      (a, b) => Number(!/\/src\//.test(a.path)) - Number(!/\/src\//.test(b.path))
-    ),
-    boundary,
-    lint: { ok: lint.code === 0, code: lint.code, command: `chant ${lintArgs.join(" ")}`, output: merge(lint, demo.root) },
-    buildCaveat: BUILD_CAVEAT
+    command: "terraform plan -detailed-exitcode (targeted, in the demo copy)",
+    planLine: r.planLine,
+    changes: r.changes,
+    noDestroy: r.noDestroy
   };
 }
-async function runCarveBridge(demo, select) {
-  const block = carveWriteBlock(demo);
-  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
-  mkdirSync3(demo.out, { recursive: true });
-  const args = [
-    "carve",
-    "bridge",
-    "--from",
-    demo.from,
-    ...demo.state ? ["--state", demo.state] : [],
-    "--select",
-    select,
-    "--output",
-    demo.out
-  ];
-  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
-    code: 127,
-    stdout: "",
-    stderr: err instanceof Error ? err.message : String(err)
-  }));
-  const output = merge(run3, demo.root);
-  if (run3.code !== 0) {
+async function runCarveObserve(demo, select) {
+  if (!demo.live) {
     return refuse3(
       "carve-action",
-      `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
-      "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
+      "the observe beat reads the scratch Floci, and this server isn't serving one",
+      "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  const slug3 = carveSlug(select);
-  const all = readArtifacts(demo, demo.out, (rel) => /\.(tf|md|patch)$/.test(rel));
-  return {
-    ok: true,
-    select,
-    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
-    output,
-    runbook: all.find((a) => a.path.endsWith(`${slug3}-runbook.md`)) ?? null,
-    proposals: all.filter((a) => !a.path.endsWith(`${slug3}-runbook.md`))
-  };
-}
-
-// src/ops.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
-import { join as join14 } from "node:path";
-var APPLY_TARGET_LEXICON = {
-  cloudformation: "aws",
-  kubectl: "k8s",
-  // kustomize renders then applies through the same k8s pipeline
-  // (chant#1548), so it scopes to the same lexicon. Note the auto-sync
-  // wrinkle this creates on purpose: a kustomize Op AND a kubectl Op in one
-  // project both exact-match `k8s`, and two exact matches decline — two Ops
-  // claiming the k8s half genuinely is ambiguous.
-  kustomize: "k8s",
-  arm: "azure"
-};
-function kindOf(content) {
-  if (/\bApplyOp\b/.test(content)) return "apply";
-  if (/\bReconcileOp\b/.test(content)) return "reconcile";
-  if (/AuditOp\b/.test(content)) return "audit";
-  return "op";
-}
-function discoverOps(projectDir) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const sub of ["ops", "src", "."]) {
-    const dir = join14(projectDir, sub);
-    if (!existsSync9(dir)) continue;
-    for (const f of readdirSync6(dir)) {
-      if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync11(join14(dir, f), "utf8");
-      const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      if (!name || seen.has(name)) continue;
-      seen.add(name);
-      const gate = content.match(/signalName:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const env = content.match(/\benv:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const target = content.match(/\btarget:\s*["'`]([^"'`]+)["'`]/)?.[1];
-      const substrate = target ? APPLY_TARGET_LEXICON[target] : void 0;
-      const irPath = opIrPath(projectDir, name);
-      out.push({
-        name,
-        kind: kindOf(content),
-        dir: projectDir,
-        ...gate ? { gate } : {},
-        ...env ? { env } : {},
-        ...substrate ? { substrate } : {},
-        ...existsSync9(irPath) ? { irPath } : {}
-      });
-    }
-  }
-  return out.sort((a, b) => a.name.localeCompare(b.name));
-}
-function opIrPath(projectDir, name) {
-  return join14(projectDir, "dist", "ops", name, "op.json");
-}
-function discoverOpIrs(projectDirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const dir of projectDirs) {
-    const root = join14(dir, "dist", "ops");
-    if (!existsSync9(root)) continue;
-    for (const name of readdirSync6(root)) {
-      if (seen.has(name)) continue;
-      const path = opIrPath(dir, name);
-      if (!existsSync9(path)) continue;
-      seen.add(name);
-      out.push({ name, dir, path });
-    }
-  }
-  return out.sort((a, b) => a.name.localeCompare(b.name));
-}
-function discoverEstateOps(projectDirs) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const dir of projectDirs) {
-    for (const op of discoverOps(dir)) {
-      if (seen.has(op.name)) continue;
-      seen.add(op.name);
-      out.push(op);
-    }
+  if (!existsSync8(join13(demo.out, "src"))) {
+    return refuse3("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
+  }
+  const args = ["lifecycle", "diff", "prod", "--live", "--json"];
+  const run3 = await runChantRaw(args, demo.out, { AWS_ENDPOINT_URL: demo.live.endpoint }).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  if (run3.code !== 0) {
+    return refuse3(
+      "carve-action",
+      `chant lifecycle diff exited ${run3.code}: ${merge(run3, demo.root) || "(no output)"}`,
+      "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + "."
+    );
   }
-  return out.sort((a, b) => a.name.localeCompare(b.name));
-}
-
-// src/run-playhead.ts
-var RECEIPT_READ_FN = "receiptRead";
-var RECEIPT_WRITE_FN = "receiptWrite";
-var STEP_STATUSES = /* @__PURE__ */ new Set(["ok", "fail", "skipped"]);
-var isRecord4 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-function asStepRecord(value) {
-  if (!isRecord4(value)) return null;
-  if (typeof value.phase !== "string" || typeof value.fn !== "string") return null;
-  if (typeof value.status !== "string" || !STEP_STATUSES.has(value.status)) return null;
-  if (typeof value.durationMs !== "number") return null;
-  return value;
-}
-function parseRunProgressLine(line) {
   let parsed;
   try {
-    parsed = JSON.parse(line);
+    parsed = JSON.parse(run3.stdout);
   } catch {
-    return null;
+    return refuse3("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
   }
-  const one = asStepRecord(parsed);
-  if (one) return [one];
-  if (isRecord4(parsed) && typeof parsed.op === "string" && Array.isArray(parsed.records)) {
-    const records = parsed.records.map(asStepRecord).filter((r) => r !== null);
-    return records.length ? records : null;
+  if (parsed.stacks && !parsed.lexicons) {
+    return refuse3(
+      "carve-action",
+      "chant lifecycle diff answered a stacked shape ({stacks}) \u2014 observe only reads the stack-less {lexicons} shape",
+      "point the target at a stack-less carveout, or file a shape-read gap against observe for the stacked case"
+    );
   }
-  return null;
-}
-function recordLine(record) {
-  const mark = record.status === "ok" ? "\u2713" : record.status === "fail" ? "\u2717" : "\u2022";
-  const took = record.status === "skipped" ? "skipped" : record.durationMs < 1e3 ? `${record.durationMs}ms` : `${(record.durationMs / 1e3).toFixed(1)}s`;
-  return `${mark} ${record.phase} \xB7 ${record.fn} \u2014 ${took}${record.error ? ` \u2014 ${record.error}` : ""}`;
-}
-var ANSI = /\x1b\[[0-9;]*m/g;
-var strip = (s) => s.replace(ANSI, "");
-function statusFields(stdout) {
-  const out = /* @__PURE__ */ new Map();
-  for (const raw of strip(stdout).split("\n")) {
-    const m = /^\s{2,}([A-Za-z][A-Za-z ]*?)\s*:\s*(.*)$/.exec(raw);
-    if (m) out.set(m[1].trim(), m[2].trim());
+  const aws = parsed.lexicons?.aws ?? {};
+  const entity = select.split(".").pop() ?? select;
+  const command = `AWS_ENDPOINT_URL=${demo.live.endpoint} chant ${args.join(" ")}  # in ${shortenIn(demo.out, demo.root)}`;
+  const queried = aws.resources?.queried?.[entity];
+  const meta = aws.observed?.[entity];
+  if (meta) {
+    return {
+      ok: true,
+      select,
+      command,
+      entity,
+      verdict: "observed",
+      ...meta.status ? { status: meta.status } : {},
+      ...meta.ownership ? { ownership: meta.ownership } : {},
+      ...meta.physicalId ? { physicalId: meta.physicalId } : {},
+      ...queried ? { queried } : {}
+    };
   }
-  return out;
-}
-function parseGateLine(line) {
-  const m = /^(.*?)(?: — (.*?))? \(waiting since (.+)\)$/.exec(line.trim());
-  if (!m) return null;
-  const signalName = m[1].trim();
-  if (!signalName) return null;
-  return { signalName, ...m[2] ? { description: m[2].trim() } : {}, since: m[3].trim() };
-}
-function readRunStatus(op, run3) {
-  if (run3.code !== 0) {
-    const message = strip(run3.stderr).trim() || strip(run3.stdout).trim() || `chant run status exited ${run3.code}`;
-    if (/not available in local mode|@temporalio\/client is not installed/.test(message)) {
-      return {
-        ok: false,
-        refusal: {
-          error: `No Temporal run state for "${op}" \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
-          code: "no-temporal",
-          remedy: "Gate state and per-step run records come from a durable run. Configure a Temporal profile in chant.config.ts (and `npm install @temporalio/client`), then run the Op with --temporal."
-        }
-      };
-    }
-    if (/not found|NotFound/.test(message)) {
-      return {
-        ok: false,
-        refusal: {
-          error: `No run of "${op}" to report \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
-          code: "no-run",
-          remedy: "Start the Op (Run) and the playhead fills in as each step settles."
-        }
-      };
-    }
+  const hole = aws.resources?.unobserved?.find((u) => u.name === entity);
+  if (hole) {
     return {
-      ok: false,
-      refusal: {
-        error: `chant run status ${op} failed: ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
-        code: "run-status",
-        remedy: "Run `chant run status " + op + " --temporal` in the project to see the whole error."
-      }
+      ok: true,
+      select,
+      command,
+      entity,
+      verdict: "unobserved",
+      ...hole.detail || hole.reason ? { detail: [hole.reason, hole.detail].filter(Boolean).join(": ") } : {},
+      ...queried ? { queried } : {}
     };
   }
-  const f = statusFields(run3.stdout);
-  const activities = /^(\d+)\/(\d+)/.exec(f.get("Activities") ?? "");
-  const gateLine = f.get("Gate");
-  return {
-    ok: true,
-    read: {
-      op,
-      ...f.get("Workflow ID") ? { workflowId: f.get("Workflow ID") } : {},
-      ...f.get("Run ID") ? { runId: f.get("Run ID") } : {},
-      ...f.get("Status") ? { status: f.get("Status") } : {},
-      ...f.get("Started") ? { startedAt: f.get("Started") } : {},
-      ...f.get("Closed") ? { closedAt: f.get("Closed") } : {},
-      ...activities ? { activities: { completed: Number(activities[1]), scheduled: Number(activities[2]) } } : {},
-      // No Gate line means chant printed none, which it does both when the
-      // query says "nothing pending" and when the Op registers no handler.
-      // Either way: no gate is waiting on a human right now.
-      gate: gateLine ? parseGateLine(gateLine) : null
-    }
-  };
-}
-var initialRunState = {
-  op: null,
-  mode: null,
-  status: "idle",
-  records: [],
-  gate: null,
-  gateNote: null,
-  startedAt: null,
-  endedAt: null,
-  lost: null
-};
-function runStarted(op, mode, at) {
-  return { ...initialRunState, op, mode, status: "running", startedAt: at };
+  return { ok: true, select, command, entity, verdict: "missing", ...queried ? { queried } : {} };
 }
-function runRecord(state, record) {
-  return { ...state, records: [...state.records, record] };
+var MAX_ARTIFACT_BYTES = 64 * 1024;
+var MAX_ARTIFACTS = 24;
+var MAX_OUTPUT_BYTES = 32 * 1024;
+var refuse3 = (code, error, remedy) => ({
+  ok: false,
+  refusal: { error, code, remedy }
+});
+var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
+function insideDemo(root, p) {
+  const rel = relative2(resolve4(root), resolve4(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
 }
-function runGate(state, result) {
-  return result.ok ? { ...state, gate: result.read.gate, gateNote: null } : { ...state, gate: null, gateNote: result.refusal.error };
+function selectFromReport(report, raw) {
+  if (typeof raw !== "string" || !raw || raw.length > 512) return null;
+  return (report?.resources ?? []).some((r) => r.address === raw) ? raw : null;
 }
-function runEnded(state, exitCode, at) {
-  if (state.status !== "running") return state;
-  if (exitCode === 0) return { ...state, status: "ok", endedAt: at };
-  if (state.records.some((r) => r.status === "fail")) return { ...state, status: "failed", endedAt: at };
-  return {
-    ...state,
-    status: "lost",
-    endedAt: at,
-    lost: `the progress stream ended (exit ${exitCode}) after ${state.records.length} settled step${state.records.length === 1 ? "" : "s"} without a failed step \u2014 behold does not know whether the Op failed or the stream broke, so the playhead stays at the last settled step.`
-  };
+function carveWriteBlock(demo) {
+  if (!demo) {
+    return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
+  }
+  if (!existsSync8(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
+  return unwritableReason(demo.root);
 }
-function slotsFor(placed) {
+function readArtifacts(demo, dir, filter) {
   const out = [];
-  for (const p of placed) {
-    if (p.step.kind === "activity") {
-      out.push({ id: p.id, phase: p.phase, fn: p.step.fn });
-    } else if (p.step.kind === "effect") {
-      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_READ_FN });
-      for (const nested of p.step.steps ?? []) {
-        if (nested.kind === "activity") out.push({ id: p.id, phase: p.phase, fn: nested.fn });
-      }
-      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_WRITE_FN });
+  const walk = (d, depth) => {
+    if (out.length >= MAX_ARTIFACTS || depth > 2) return;
+    let entries;
+    try {
+      entries = readdirSync5(d).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= MAX_ARTIFACTS) return;
+      if (name === "node_modules" || name.startsWith(".")) continue;
+      const full = join13(d, name);
+      let st;
+      try {
+        st = statSync5(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(full, depth + 1);
+        continue;
+      }
+      const rel = relative2(demo.root, full).split(sep2).join("/");
+      if (!filter(rel)) continue;
+      let text = "";
+      try {
+        text = readFileSync10(full, "utf8");
+      } catch {
+        continue;
+      }
+      const truncated = text.length > MAX_ARTIFACT_BYTES;
+      out.push({
+        path: rel,
+        kind: (name.split(".").pop() ?? "").toLowerCase(),
+        bytes: st.size,
+        text: truncated ? text.slice(0, MAX_ARTIFACT_BYTES) : text,
+        truncated
+      });
     }
-  }
-  return out;
-}
-function mergeRun(prev, record) {
-  const rank = { fail: 3, ok: 2, skipped: 1 };
-  const keepPrev = prev && rank[prev.status] >= rank[record.status];
-  return {
-    status: keepPrev ? prev.status : record.status,
-    durationMs: (prev?.durationMs ?? 0) + record.durationMs,
-    ...keepPrev && prev.error ? { error: prev.error } : record.error ? { error: record.error } : {},
-    ...keepPrev && prev.outcome ? { outcome: prev.outcome } : record.outcome ? { outcome: `${record.outcome.name}=${String(record.outcome.value)}` } : {},
-    records: (prev?.records ?? 0) + 1
   };
+  walk(dir, 0);
+  return out;
 }
-function joinRun(op, records, gate) {
-  const placed = opPlacedSteps(op);
-  const slots = slotsFor(placed);
-  const byKey = /* @__PURE__ */ new Map();
-  for (const s of slots) {
-    const key = `${s.phase}\0${s.fn}`;
-    if (!byKey.has(key)) byKey.set(key, []);
-    byKey.get(key).push({ id: s.id });
+function carveSlug(select) {
+  return select.replace(/[^A-Za-z0-9_]+/g, "-");
+}
+var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
+function shortenIn(arg, root) {
+  return arg.startsWith(root + sep2) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+}
+function merge(r, root) {
+  const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
+  return clip(joined.split(root + sep2).join("").split(root).join("."));
+}
+async function runCarveEmit(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const reportFile = join13(demo.out, `${carveSlug(select)}-boundary.json`);
+  const args = [
+    "carve",
+    "emit",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out,
+    "--report",
+    reportFile
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse3(
+      "carve-action",
+      `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
+      "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
+    );
   }
-  const cursor = /* @__PURE__ */ new Map();
-  const byNode = /* @__PURE__ */ new Map();
-  const unplaced = [];
-  let lastSettledIndex = -1;
-  const indexOf = new Map(placed.map((p, i) => [p.id, i]));
-  for (const record of records) {
-    const key = `${record.phase}\0${record.fn}`;
-    const list3 = byKey.get(key);
-    const i = cursor.get(key) ?? 0;
-    const slot = list3?.[i];
-    if (!slot) {
-      unplaced.push(record);
-      continue;
-    }
-    cursor.set(key, i + 1);
-    byNode.set(slot.id, mergeRun(byNode.get(slot.id), record));
-    if (record.status !== "skipped") {
-      lastSettledIndex = Math.max(lastSettledIndex, indexOf.get(slot.id) ?? -1);
-    }
+  let boundary = null;
+  try {
+    boundary = JSON.parse(readFileSync10(reportFile, "utf8"));
+  } catch {
   }
-  if (gate) {
-    const gateNode = placed.find((p) => p.step.kind === "gate" && p.step.signalName === gate.signalName);
-    if (gateNode) {
-      return {
-        byNode,
-        at: gateNode.id,
-        atReason: `waiting for ${gate.signalName} since ${gate.since}`,
-        unplaced
-      };
-    }
+  const lintPath = relative2(demo.project, join13(demo.out, "src")).split(sep2).join("/");
+  const lintArgs = ["lint", lintPath];
+  const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  return {
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    // Emitted source first, scaffolding after: `src/assets.ts` is the thing the
+    // step is about, and a package.json sorting above it buries the answer.
+    artifacts: readArtifacts(demo, demo.out, (rel) => /\.(ts|json)$/.test(rel) && !rel.endsWith("tsconfig.json")).sort(
+      (a, b) => Number(!/\/src\//.test(a.path)) - Number(!/\/src\//.test(b.path))
+    ),
+    boundary,
+    lint: { ok: lint.code === 0, code: lint.code, command: `chant ${lintArgs.join(" ")}`, output: merge(lint, demo.root) },
+    buildCaveat: BUILD_CAVEAT
+  };
+}
+async function runCarveBridge(demo, select) {
+  const block = carveWriteBlock(demo);
+  if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  mkdirSync3(demo.out, { recursive: true });
+  const args = [
+    "carve",
+    "bridge",
+    "--from",
+    demo.from,
+    ...demo.state ? ["--state", demo.state] : [],
+    "--select",
+    select,
+    "--output",
+    demo.out
+  ];
+  const run3 = await runChantRaw(args, demo.project).catch((err) => ({
+    code: 127,
+    stdout: "",
+    stderr: err instanceof Error ? err.message : String(err)
+  }));
+  const output = merge(run3, demo.root);
+  if (run3.code !== 0) {
+    return refuse3(
+      "carve-action",
+      `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
+      "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
+    );
   }
-  const next = placed.find((p, i) => i > lastSettledIndex && p.when === "phases");
+  const slug3 = carveSlug(select);
+  const all = readArtifacts(demo, demo.out, (rel) => /\.(tf|md|patch)$/.test(rel));
   return {
-    byNode,
-    at: lastSettledIndex >= 0 && next ? next.id : null,
-    atReason: lastSettledIndex >= 0 && next ? "reached \u2014 not settled yet" : null,
-    unplaced
+    ok: true,
+    select,
+    command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
+    output,
+    runbook: all.find((a) => a.path.endsWith(`${slug3}-runbook.md`)) ?? null,
+    proposals: all.filter((a) => !a.path.endsWith(`${slug3}-runbook.md`))
   };
 }
-var TONE = {
-  ok: "good",
-  fail: "warn",
-  skipped: "neutral"
+
+// src/ops.ts
+import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
+import { join as join14 } from "node:path";
+var APPLY_TARGET_LEXICON = {
+  cloudformation: "aws",
+  kubectl: "k8s",
+  // kustomize renders then applies through the same k8s pipeline
+  // (chant#1548), so it scopes to the same lexicon. Note the auto-sync
+  // wrinkle this creates on purpose: a kustomize Op AND a kubectl Op in one
+  // project both exact-match `k8s`, and two exact matches decline — two Ops
+  // claiming the k8s half genuinely is ambiguous.
+  kustomize: "k8s",
+  arm: "azure"
 };
-var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
-function tookLabel(ms) {
-  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
+function kindOf(content) {
+  if (/\bApplyOp\b/.test(content)) return "apply";
+  if (/\bReconcileOp\b/.test(content)) return "reconcile";
+  if (/AuditOp\b/.test(content)) return "audit";
+  return "op";
 }
-function paintPlayhead(ir, join21, gate) {
-  if (!join21.byNode.size && !join21.at) return ir;
-  const nodes = ir.nodes.map((node) => {
-    const run3 = join21.byNode.get(node.id);
-    const here = join21.at === node.id;
-    if (!run3 && !here) return node;
-    const isGate = node.attrs?._step === "gate";
-    const attrs = { ...node.attrs };
-    if (run3) {
-      attrs._status = TONE[run3.status];
-      attrs.run = run3.status === "skipped" ? "skipped" : `${RAN[run3.status]} \xB7 ${tookLabel(run3.durationMs)}`;
-      attrs.ran = tookLabel(run3.durationMs);
-      if (run3.error) attrs.error = run3.error;
-      if (run3.outcome) attrs.outcome = run3.outcome;
-      if (run3.records > 1) attrs.runRecords = run3.records;
-    }
-    if (here) {
-      attrs._playhead = true;
-      attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join21.atReason ?? "here";
-      if (isGate && gate?.description) attrs.gateDescription = gate.description;
+function discoverOps(projectDir) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sub of ["ops", "src", "."]) {
+    const dir = join14(projectDir, sub);
+    if (!existsSync9(dir)) continue;
+    for (const f of readdirSync6(dir)) {
+      if (!f.endsWith(".op.ts")) continue;
+      const content = readFileSync11(join14(dir, f), "utf8");
+      const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      const gate = content.match(/signalName:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const env = content.match(/\benv:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const target = content.match(/\btarget:\s*["'`]([^"'`]+)["'`]/)?.[1];
+      const substrate = target ? APPLY_TARGET_LEXICON[target] : void 0;
+      const irPath = opIrPath(projectDir, name);
+      out.push({
+        name,
+        kind: kindOf(content),
+        dir: projectDir,
+        ...gate ? { gate } : {},
+        ...env ? { env } : {},
+        ...substrate ? { substrate } : {},
+        ...existsSync9(irPath) ? { irPath } : {}
+      });
     }
-    return { ...node, attrs };
-  });
-  return { ...ir, nodes };
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
 }
-function pendingGateCard(op, gate, ir) {
-  const node = ir.nodes.find((n) => n.attrs?._step === "gate" && n.attrs?.gate === gate.signalName && n.attrs?.op === op);
-  return {
-    op,
-    signalName: gate.signalName,
-    ...gate.description ? { description: gate.description } : {},
-    since: gate.since,
-    ...node ? { node: node.id } : {},
-    ...node && typeof node.attrs?.guards === "string" ? { guards: node.attrs.guards } : {},
-    approve: {
-      method: "POST",
-      path: `/api/ops/${encodeURIComponent(op)}/signal/${encodeURIComponent(gate.signalName)}`
+function opIrPath(projectDir, name) {
+  return join14(projectDir, "dist", "ops", name, "op.json");
+}
+function discoverOpIrs(projectDirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const dir of projectDirs) {
+    const root = join14(dir, "dist", "ops");
+    if (!existsSync9(root)) continue;
+    for (const name of readdirSync6(root)) {
+      if (seen.has(name)) continue;
+      const path = opIrPath(dir, name);
+      if (!existsSync9(path)) continue;
+      seen.add(name);
+      out.push({ name, dir, path });
     }
-  };
-}
-function playheadNote(state, join21) {
-  if (!state.op) {
-    return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join21 ? join21.byNode.size : state.records.length;
-  const bits = [];
-  const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
-  if (state.status === "running") {
-    bits.push(
-      state.mode === "local" ? "still running; the local executor reports every step at once when it ends, so the track fills in on completion" : "still running; only settled steps are painted"
-    );
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function discoverEstateOps(projectDirs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const dir of projectDirs) {
+    for (const op of discoverOps(dir)) {
+      if (seen.has(op.name)) continue;
+      seen.add(op.name);
+      out.push(op);
+    }
   }
-  if (state.status === "ok") bits.push("the run exited cleanly");
-  if (state.status === "failed") bits.push("a step failed");
-  if (state.status === "lost") bits.push(`stream lost \u2014 ${state.lost ?? "the progress stream ended without a verdict"}`);
-  if (state.gate) {
-    bits.push(`waiting on gate ${state.gate.signalName} since ${state.gate.since} \u2014 approve is a delegated signal, behold never signals on its own`);
-  } else if (state.gateNote) {
-    bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/run-playhead.ts
+var RECEIPT_READ_FN = "receiptRead";
+var RECEIPT_WRITE_FN = "receiptWrite";
+var STEP_STATUSES = /* @__PURE__ */ new Set(["ok", "fail", "skipped"]);
+var isRecord5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function asStepRecord(value) {
+  if (!isRecord5(value)) return null;
+  if (typeof value.phase !== "string" || typeof value.fn !== "string") return null;
+  if (typeof value.status !== "string" || !STEP_STATUSES.has(value.status)) return null;
+  if (typeof value.durationMs !== "number") return null;
+  return value;
+}
+function parseRunProgressLine(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
   }
-  if (join21?.unplaced.length) {
-    bits.push(
-      `${join21.unplaced.length} record${join21.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join21.unplaced.length === 1 ? "is" : "are"} not painted`
-    );
+  const one = asStepRecord(parsed);
+  if (one) return [one];
+  if (isRecord5(parsed) && typeof parsed.op === "string" && Array.isArray(parsed.records)) {
+    const records = parsed.records.map(asStepRecord).filter((r) => r !== null);
+    return records.length ? records : null;
   }
-  if (!bits.length) return `${head}.`;
-  const rest = bits.join("; ");
-  return `${head} \u2014 ${rest}.`;
+  return null;
+}
+function recordLine(record) {
+  const mark = record.status === "ok" ? "\u2713" : record.status === "fail" ? "\u2717" : "\u2022";
+  const took = record.status === "skipped" ? "skipped" : record.durationMs < 1e3 ? `${record.durationMs}ms` : `${(record.durationMs / 1e3).toFixed(1)}s`;
+  return `${mark} ${record.phase} \xB7 ${record.fn} \u2014 ${took}${record.error ? ` \u2014 ${record.error}` : ""}`;
 }
-
-// src/operator.ts
 var ANSI2 = /\x1b\[[0-9;]*m/g;
 var strip2 = (s) => s.replace(ANSI2, "");
-var isRecord5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var HOW_TO_DECLARE = "An operating loop is a ConvergeOp: declare one in a `*.op.ts` (`ConvergeOp({ name, env, dial, rules })` from @intentius/chant-lexicon-temporal), build the project, and tick it with `chant operator` (or a cron / CronJob invoking it).";
-function readRow(value) {
-  if (!isRecord5(value)) return null;
-  if (typeof value.op !== "string" || typeof value.env !== "string") return null;
-  if (!Array.isArray(value.pendingGates)) return null;
-  const gates = [];
-  for (const g of value.pendingGates) {
-    if (!isRecord5(g) || typeof g.rule !== "string" || typeof g.gate !== "string") return null;
-    gates.push({ rule: g.rule, gate: g.gate, ...typeof g.op === "string" ? { op: g.op } : {} });
+function statusFields(stdout) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of strip2(stdout).split("\n")) {
+    const m = /^\s{2,}([A-Za-z][A-Za-z ]*?)\s*:\s*(.*)$/.exec(raw);
+    if (m) out.set(m[1].trim(), m[2].trim());
   }
-  const tick = isRecord5(value.lastTick) ? value.lastTick : void 0;
-  const usable = tick && typeof tick.timestamp === "string" && typeof tick.log === "string";
-  const lease = isRecord5(value.lease) ? value.lease : void 0;
-  return {
-    op: value.op,
-    env: value.env,
-    ...usable ? { lastTick: tick } : {},
-    pendingGates: gates,
-    ...lease && typeof lease.holder === "string" && typeof lease.expiresAt === "string" ? { lease: { holder: lease.holder, expiresAt: lease.expiresAt } } : {}
-  };
+  return out;
 }
-function readOperatorStatus(run3) {
-  const err = strip2(run3.stderr);
-  const out = strip2(run3.stdout).trim();
+function parseGateLine(line) {
+  const m = /^(.*?)(?: — (.*?))? \(waiting since (.+)\)$/.exec(line.trim());
+  if (!m) return null;
+  const signalName = m[1].trim();
+  if (!signalName) return null;
+  return { signalName, ...m[2] ? { description: m[2].trim() } : {}, since: m[3].trim() };
+}
+function readRunStatus(op, run3) {
   if (run3.code !== 0) {
-    const message = err.trim() || out || `chant operator status exited ${run3.code}`;
-    const first = message.split("\n")[0].replace(/^error:\s*/i, "");
-    if (/Unknown command|Unknown operator subcommand/i.test(message)) {
+    const message = strip2(run3.stderr).trim() || strip2(run3.stdout).trim() || `chant run status exited ${run3.code}`;
+    if (/not available in local mode|@temporalio\/client is not installed/.test(message)) {
       return {
         ok: false,
         refusal: {
-          error: `This chant has no \`operator status\` \u2014 ${first}`,
-          code: "no-operator-cli",
-          remedy: "The operating loop's status surface landed in chant 0.52 (chant#1485). Upgrade chant to read it."
+          error: `No Temporal run state for "${op}" \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          code: "no-temporal",
+          remedy: "Gate state and per-step run records come from a durable run. Configure a Temporal profile in chant.config.ts (and `npm install @temporalio/client`), then run the Op with --temporal."
         }
       };
     }
-    return {
-      ok: false,
-      refusal: {
-        error: `chant operator status failed: ${first}`,
-        code: "operator-status",
-        remedy: "Run `chant operator status --json` in the project to see the whole error."
-      }
-    };
-  }
-  if (!out) {
-    return {
-      ok: false,
-      refusal: {
-        error: "This project declares no operating loop \u2014 chant found no ConvergeOp.",
-        code: "no-operator",
-        remedy: HOW_TO_DECLARE
-      }
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(out);
-  } catch (e) {
-    return {
-      ok: false,
-      refusal: {
-        error: `chant operator status --json didn't print JSON: ${e instanceof Error ? e.message : String(e)}`,
-        code: "operator-status",
-        remedy: "Run `chant operator status --json` in the project and check what it printed."
-      }
-    };
-  }
-  if (!Array.isArray(parsed)) {
-    return {
-      ok: false,
-      refusal: {
-        error: "chant operator status --json answered with something that isn't an array of ConvergeOp rows.",
-        code: "operator-status",
-        remedy: "behold reads one row per ConvergeOp: `{op, env, lastTick?, pendingGates[], lease?}`."
-      }
-    };
-  }
-  const rows = [];
-  for (const value of parsed) {
-    const row = readRow(value);
-    if (!row) {
+    if (/not found|NotFound/.test(message)) {
       return {
         ok: false,
         refusal: {
-          error: "chant operator status --json answered with a row behold couldn't read (needs `op`, `env`, `pendingGates[]`).",
-          code: "operator-status",
-          remedy: "Check `chant operator status --json` in the project \u2014 and file the shape change if chant's is the newer one."
+          error: `No run of "${op}" to report \u2014 ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+          code: "no-run",
+          remedy: "Start the Op (Run) and the playhead fills in as each step settles."
         }
       };
     }
-    rows.push(row);
+    return {
+      ok: false,
+      refusal: {
+        error: `chant run status ${op} failed: ${message.split("\n")[0].replace(/^error:\s*/, "")}`,
+        code: "run-status",
+        remedy: "Run `chant run status " + op + " --temporal` in the project to see the whole error."
+      }
+    };
   }
-  return { ok: true, rows };
+  const f = statusFields(run3.stdout);
+  const activities = /^(\d+)\/(\d+)/.exec(f.get("Activities") ?? "");
+  const gateLine = f.get("Gate");
+  return {
+    ok: true,
+    read: {
+      op,
+      ...f.get("Workflow ID") ? { workflowId: f.get("Workflow ID") } : {},
+      ...f.get("Run ID") ? { runId: f.get("Run ID") } : {},
+      ...f.get("Status") ? { status: f.get("Status") } : {},
+      ...f.get("Started") ? { startedAt: f.get("Started") } : {},
+      ...f.get("Closed") ? { closedAt: f.get("Closed") } : {},
+      ...activities ? { activities: { completed: Number(activities[1]), scheduled: Number(activities[2]) } } : {},
+      // No Gate line means chant printed none, which it does both when the
+      // query says "nothing pending" and when the Op registers no handler.
+      // Either way: no gate is waiting on a human right now.
+      gate: gateLine ? parseGateLine(gateLine) : null
+    }
+  };
 }
-function declaredConvergeOps(ops) {
-  return ops.filter((o) => o.searchAttributes?.Converge === "true").map((o) => ({
-    name: o.name,
-    ...o.searchAttributes?.Env ? { env: o.searchAttributes.Env } : {},
-    ...o.searchAttributes?.Dial ? { dial: o.searchAttributes.Dial } : {}
-  }));
+var initialRunState = {
+  op: null,
+  mode: null,
+  status: "idle",
+  records: [],
+  gate: null,
+  gateNote: null,
+  startedAt: null,
+  endedAt: null,
+  lost: null
+};
+function runStarted(op, mode, at) {
+  return { ...initialRunState, op, mode, status: "running", startedAt: at };
 }
-var MANAGED_BY = "app.kubernetes.io/managed-by";
-var COMPONENT = "app.kubernetes.io/component";
-var NAME_LABEL = "app.kubernetes.io/name";
-var CHANT = "chant";
-var CONVERGE_TICK = "converge-tick";
-var CRONJOB_KIND = "K8s::Batch::CronJob";
-var NAMESPACE_KIND = "K8s::Core::Namespace";
-var rec3 = (v) => isRecord5(v) ? v : void 0;
-var str3 = (v) => typeof v === "string" && v ? v : void 0;
-var labelsOf = (n) => rec3(rec3(n.attrs?.metadata)?.labels) ?? {};
-function operatorHomes(ir) {
-  const byNamespace = /* @__PURE__ */ new Map();
-  const conflicted = /* @__PURE__ */ new Set();
-  for (const n of ir.nodes) {
-    if (n.kind !== CRONJOB_KIND) continue;
-    const labels = labelsOf(n);
-    if (labels[MANAGED_BY] !== CHANT || labels[COMPONENT] !== CONVERGE_TICK) continue;
-    const meta = rec3(n.attrs?.metadata);
-    const ns = str3(meta?.namespace);
-    const op = str3(meta?.name);
-    if (!ns || !op) continue;
-    const home = byNamespace.get(ns) ?? { namespace: ns, ticks: [] };
-    const stack = str3(labels[NAME_LABEL]);
-    if (stack && !conflicted.has(ns)) {
-      if (home.stack === void 0) home.stack = stack;
-      else if (home.stack !== stack) {
-        conflicted.add(ns);
-        delete home.stack;
+function runRecord(state, record) {
+  return { ...state, records: [...state.records, record] };
+}
+function runGate(state, result) {
+  return result.ok ? { ...state, gate: result.read.gate, gateNote: null } : { ...state, gate: null, gateNote: result.refusal.error };
+}
+function runEnded(state, exitCode, at) {
+  if (state.status !== "running") return state;
+  if (exitCode === 0) return { ...state, status: "ok", endedAt: at };
+  if (state.records.some((r) => r.status === "fail")) return { ...state, status: "failed", endedAt: at };
+  return {
+    ...state,
+    status: "lost",
+    endedAt: at,
+    lost: `the progress stream ended (exit ${exitCode}) after ${state.records.length} settled step${state.records.length === 1 ? "" : "s"} without a failed step \u2014 behold does not know whether the Op failed or the stream broke, so the playhead stays at the last settled step.`
+  };
+}
+function slotsFor(placed) {
+  const out = [];
+  for (const p of placed) {
+    if (p.step.kind === "activity") {
+      out.push({ id: p.id, phase: p.phase, fn: p.step.fn });
+    } else if (p.step.kind === "effect") {
+      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_READ_FN });
+      for (const nested of p.step.steps ?? []) {
+        if (nested.kind === "activity") out.push({ id: p.id, phase: p.phase, fn: nested.fn });
       }
+      out.push({ id: p.id, phase: p.phase, fn: RECEIPT_WRITE_FN });
     }
-    const schedule = str3(rec3(n.attrs?.spec)?.schedule);
-    home.ticks.push({ node: n.id, op, ...schedule ? { schedule } : {} });
-    byNamespace.set(ns, home);
-  }
-  if (!byNamespace.size) return [];
-  for (const n of ir.nodes) {
-    if (n.kind !== NAMESPACE_KIND) continue;
-    const name = str3(rec3(n.attrs?.metadata)?.name);
-    const home = name ? byNamespace.get(name) : void 0;
-    if (home && !home.node) home.node = n.id;
   }
-  for (const home of byNamespace.values()) home.ticks.sort((a, b) => a.op.localeCompare(b.op));
-  return [...byNamespace.values()].sort((a, b) => a.namespace.localeCompare(b.namespace));
+  return out;
 }
-function markOperatorHome(ir) {
-  const homes = operatorHomes(ir);
-  if (!homes.length) return ir;
-  const marks = /* @__PURE__ */ new Map();
-  for (const home of homes) {
-    if (home.node) {
-      marks.set(home.node, {
-        role: "home",
-        namespace: home.namespace,
-        ...home.stack ? { stack: home.stack } : {},
-        ticks: home.ticks.map((t) => t.op)
-      });
+function mergeRun(prev, record) {
+  const rank = { fail: 3, ok: 2, skipped: 1 };
+  const keepPrev = prev && rank[prev.status] >= rank[record.status];
+  return {
+    status: keepPrev ? prev.status : record.status,
+    durationMs: (prev?.durationMs ?? 0) + record.durationMs,
+    ...keepPrev && prev.error ? { error: prev.error } : record.error ? { error: record.error } : {},
+    ...keepPrev && prev.outcome ? { outcome: prev.outcome } : record.outcome ? { outcome: `${record.outcome.name}=${String(record.outcome.value)}` } : {},
+    records: (prev?.records ?? 0) + 1
+  };
+}
+function joinRun(op, records, gate) {
+  const placed = opPlacedSteps(op);
+  const slots = slotsFor(placed);
+  const byKey = /* @__PURE__ */ new Map();
+  for (const s of slots) {
+    const key = `${s.phase}\0${s.fn}`;
+    if (!byKey.has(key)) byKey.set(key, []);
+    byKey.get(key).push({ id: s.id });
+  }
+  const cursor = /* @__PURE__ */ new Map();
+  const byNode = /* @__PURE__ */ new Map();
+  const unplaced = [];
+  let lastSettledIndex = -1;
+  const indexOf = new Map(placed.map((p, i) => [p.id, i]));
+  for (const record of records) {
+    const key = `${record.phase}\0${record.fn}`;
+    const list3 = byKey.get(key);
+    const i = cursor.get(key) ?? 0;
+    const slot = list3?.[i];
+    if (!slot) {
+      unplaced.push(record);
+      continue;
     }
-    for (const tick of home.ticks) {
-      marks.set(tick.node, {
-        role: "tick",
-        namespace: home.namespace,
-        ...home.stack ? { stack: home.stack } : {},
-        op: tick.op,
-        ...tick.schedule ? { schedule: tick.schedule } : {}
-      });
+    cursor.set(key, i + 1);
+    byNode.set(slot.id, mergeRun(byNode.get(slot.id), record));
+    if (record.status !== "skipped") {
+      lastSettledIndex = Math.max(lastSettledIndex, indexOf.get(slot.id) ?? -1);
+    }
+  }
+  if (gate) {
+    const gateNode = placed.find((p) => p.step.kind === "gate" && p.step.signalName === gate.signalName);
+    if (gateNode) {
+      return {
+        byNode,
+        at: gateNode.id,
+        atReason: `waiting for ${gate.signalName} since ${gate.since}`,
+        unplaced
+      };
     }
   }
+  const next = placed.find((p, i) => i > lastSettledIndex && p.when === "phases");
   return {
-    ...ir,
-    nodes: ir.nodes.map((n) => {
-      const mark = marks.get(n.id);
-      return mark ? { ...n, attrs: { ...n.attrs, _operator: mark } } : n;
-    })
+    byNode,
+    at: lastSettledIndex >= 0 && next ? next.id : null,
+    atReason: lastSettledIndex >= 0 && next ? "reached \u2014 not settled yet" : null,
+    unplaced
   };
 }
-var OPERATOR_HOME_GLYPH = {
-  body: '<path d="M16.5 6.63A7 7 0 1 1 6.64 7.5"/><path d="M16.5 6.63 14.3 5.9M16.5 6.63 15.9 8.1"/>'
+var TONE = {
+  ok: "good",
+  fail: "warn",
+  skipped: "neutral"
 };
-function operatorHomeBoxMarks(ir, namespaceBoxes) {
-  const out = {};
-  for (const home of operatorHomes(ir)) {
-    const box = namespaceBoxes[home.namespace];
-    if (box) out[box] = OPERATOR_HOME_GLYPH;
-  }
-  return out;
-}
-function operatorStrip(rows, now = Date.now()) {
-  const out = rows.map((r) => {
-    const expiresAt = r.lease ? Date.parse(r.lease.expiresAt) : NaN;
-    const lease = !r.lease ? "free" : Number.isFinite(expiresAt) && expiresAt <= now ? "expired" : "held";
-    return {
-      op: r.op,
-      env: r.env,
-      log: r.lastTick?.log ?? null,
-      at: r.lastTick?.timestamp ?? null,
-      lease,
-      leaseHolder: r.lease?.holder ?? null,
-      leaseExpiresAt: r.lease?.expiresAt ?? null,
-      pendingGates: r.pendingGates.length
-    };
-  });
-  return { rows: out, pendingGates: out.reduce((n, r) => n + r.pendingGates, 0) };
+var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
+function tookLabel(ms) {
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-var CONVERGE_GATE_LOOP = "converge";
-var APPROVE_SEMANTICS = "Approving records a fact in the gate ledger; it does not unblock the dispatch. The next tick reads it.";
-function convergeGateCards(rows) {
-  const out = [];
-  for (const row of rows) {
-    for (const g of row.pendingGates) {
-      if (!g.op) continue;
-      out.push({
-        loop: CONVERGE_GATE_LOOP,
-        rule: g.rule,
-        op: g.op,
-        gate: g.gate,
-        convergeOp: row.op,
-        env: row.env,
-        since: row.lastTick?.timestamp ?? null,
-        semantics: APPROVE_SEMANTICS,
-        approve: {
-          method: "POST",
-          path: `/api/operator/approve/${encodeURIComponent(g.op)}/${encodeURIComponent(g.gate)}`,
-          command: `chant approve ${g.op} ${g.gate}`
-        }
-      });
+function paintPlayhead(ir, join21, gate) {
+  if (!join21.byNode.size && !join21.at) return ir;
+  const nodes = ir.nodes.map((node) => {
+    const run3 = join21.byNode.get(node.id);
+    const here = join21.at === node.id;
+    if (!run3 && !here) return node;
+    const isGate = node.attrs?._step === "gate";
+    const attrs = { ...node.attrs };
+    if (run3) {
+      attrs._status = TONE[run3.status];
+      attrs.run = run3.status === "skipped" ? "skipped" : `${RAN[run3.status]} \xB7 ${tookLabel(run3.durationMs)}`;
+      attrs.ran = tookLabel(run3.durationMs);
+      if (run3.error) attrs.error = run3.error;
+      if (run3.outcome) attrs.outcome = run3.outcome;
+      if (run3.records > 1) attrs.runRecords = run3.records;
     }
-  }
-  return out;
+    if (here) {
+      attrs._playhead = true;
+      attrs._status = isGate && gate ? "warn" : "accent";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join21.atReason ?? "here";
+      if (isGate && gate?.description) attrs.gateDescription = gate.description;
+    }
+    return { ...node, attrs };
+  });
+  return { ...ir, nodes };
 }
-var initialOperatorState = {
-  declared: [],
-  strip: null,
-  gates: [],
-  note: null,
-  code: null,
-  readAt: null
-};
-function operatorRead(state, result, at, now = Date.now()) {
-  if (!result.ok) {
-    return { ...state, strip: null, gates: [], note: result.refusal.error, code: result.refusal.code, readAt: at };
-  }
+function pendingGateCard(op, gate, ir) {
+  const node = ir.nodes.find((n) => n.attrs?._step === "gate" && n.attrs?.gate === gate.signalName && n.attrs?.op === op);
   return {
-    ...state,
-    strip: operatorStrip(result.rows, now),
-    gates: convergeGateCards(result.rows),
-    note: null,
-    code: null,
-    readAt: at
+    op,
+    signalName: gate.signalName,
+    ...gate.description ? { description: gate.description } : {},
+    since: gate.since,
+    ...node ? { node: node.id } : {},
+    ...node && typeof node.attrs?.guards === "string" ? { guards: node.attrs.guards } : {},
+    approve: {
+      method: "POST",
+      path: `/api/ops/${encodeURIComponent(op)}/signal/${encodeURIComponent(gate.signalName)}`
+    }
   };
 }
-function operatorNote(state) {
-  if (!state.declared.length) {
-    return "No operating loop: this project declares no ConvergeOp, so there is no operator strip.";
-  }
-  const loops = `${state.declared.length} ConvergeOp${state.declared.length === 1 ? "" : "s"}`;
-  if (!state.strip) {
-    return state.note ? `Operating loop: ${loops} declared \u2014 status unavailable: ${state.note}` : `Operating loop: ${loops} declared \u2014 not read yet.`;
+function playheadNote(state, join21) {
+  if (!state.op) {
+    return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
+  const settled = join21 ? join21.byNode.size : state.records.length;
   const bits = [];
-  const ticked = state.strip.rows.filter((r) => r.at).length;
-  bits.push(
-    ticked ? `last tick only \u2014 chant's status surface exposes one tick per loop, not the history (chant#2029), so this is a strip and not a timeline` : `no tick recorded yet on any loop`
-  );
-  const held = state.strip.rows.filter((r) => r.lease === "held").length;
-  if (held) bits.push(`${held} lease${held === 1 ? "" : "s"} held`);
-  const expired = state.strip.rows.filter((r) => r.lease === "expired").length;
-  if (expired) bits.push(`${expired} lease${expired === 1 ? "" : "s"} expired \u2014 the next round reclaims it`);
-  if (state.strip.pendingGates) {
+  const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
+  if (state.status === "running") {
     bits.push(
-      `${state.strip.pendingGates} converge gate${state.strip.pendingGates === 1 ? "" : "s"} pending \u2014 approving one records a fact for the next tick, it does not release a workflow (that is the run gate, a different card), and a gate fact carries no URL yet (chant#2028)`
+      state.mode === "local" ? "still running; the local executor reports every step at once when it ends, so the track fills in on completion" : "still running; only settled steps are painted"
     );
   }
-  return `Operating loop: ${loops} \u2014 ${bits.join("; ")}.`;
+  if (state.status === "ok") bits.push("the run exited cleanly");
+  if (state.status === "failed") bits.push("a step failed");
+  if (state.status === "lost") bits.push(`stream lost \u2014 ${state.lost ?? "the progress stream ended without a verdict"}`);
+  if (state.gate) {
+    bits.push(`waiting on gate ${state.gate.signalName} since ${state.gate.since} \u2014 approve is a delegated signal, behold never signals on its own`);
+  } else if (state.gateNote) {
+    bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
+  }
+  if (join21?.unplaced.length) {
+    bits.push(
+      `${join21.unplaced.length} record${join21.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join21.unplaced.length === 1 ? "is" : "are"} not painted`
+    );
+  }
+  if (!bits.length) return `${head}.`;
+  const rest = bits.join("; ");
+  return `${head} \u2014 ${rest}.`;
 }
 
 // src/adopt.ts
@@ -8847,6 +9236,51 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const state = runner.noteOperator({ ok: true, rows });
     return c.json({ ...state, operator: state });
   });
+  app.get("/api/operator/log", async (c) => {
+    const { dirs } = convergeDirs();
+    if (!dirs.length) {
+      return c.json(
+        {
+          error: "This project declares no operating loop \u2014 no emitted Op carries chant's `Converge` search attribute.",
+          code: "no-operator",
+          remedy: HOW_TO_DECLARE,
+          history: null
+        },
+        200
+      );
+    }
+    const window = operatorLogWindow({ limit: c.req.query("limit") ?? null, since: c.req.query("since") ?? null });
+    if ("error" in window) {
+      return c.json({ error: window.error, code: "operator-log", remedy: "Ask for a bounded window: `?limit=50&since=<iso>`.", history: null }, 400);
+    }
+    const answers = [];
+    for (const dir of dirs) {
+      const version = resolveChant(dir).version;
+      if (!meetsFloor(version, OPERATOR_LOG_FLOOR)) {
+        return c.json(
+          {
+            error: `This chant has no \`operator log\` \u2014 ${version ? `the project resolves chant ${version}` : "the project's chant"}, and the tick history landed in ${OPERATOR_LOG_FLOOR}.`,
+            code: "no-operator-log-cli",
+            remedy: `Upgrade the project's chant to ${OPERATOR_LOG_FLOOR} or newer (chant#2029). The strip itself needs only 0.52, so it keeps reading.`,
+            history: null
+          },
+          422
+        );
+      }
+      const result = readOperatorLog(await runChantRaw(operatorLogArgs(window), dir));
+      if (!result.ok) return c.json({ ...result.refusal, history: null }, result.refusal.code === "no-operator" ? 200 : 422);
+      answers.push({ entries: result.entries, malformed: result.malformed });
+    }
+    const merged = mergeOperatorLogs(answers, window.limit);
+    const history = {
+      entries: operatorTimeline(merged.entries),
+      malformed: merged.malformed,
+      window: { limit: window.limit, since: window.since ?? null },
+      more: merged.entries.length >= window.limit,
+      readAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    return c.json({ history });
+  });
   app.post("/api/operator/approve/:op/:gate", async (c) => {
     const { op, gate } = c.req.param();
     const info = estateOps().find((o) => o.name === op);
@@ -9148,6 +9582,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "GET", path: "/api/ops", desc: "committed Ops + adopt lexicons + apply progress + run playhead" },
         { method: "GET", path: "/api/ops/:name/status", desc: "an Op's durable run status + pending gate (chant run status)" },
         { method: "GET", path: "/api/operator/status", desc: "the operating loop's strip: last tick per ConvergeOp + lease + pending converge gates" },
+        { method: "GET", path: "/api/operator/log", desc: "the operating loop's timeline: converge ticks + gate resolutions, newest ?limit=n (max 200) from ?since=<iso>" },
         { method: "GET", path: "/api/history", desc: "recent source commits (rollback targets)" },
         { method: "GET", path: "/api/frames", desc: "captured lanes frames" },
         { method: "GET", path: "/api/events", desc: "SSE: changed / op / apply / run / pr" },
@@ -9259,6 +9694,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         if (env) {
           const rows = await componentStatus(cfg.projectDir, env, opts);
           ir = joinComponentStatus(ir, rows);
+          ir = joinTickVerdicts(ir, verdictsForEnv(runner.operatorState.verdicts, env));
           mode = "component-status";
           metaEnv = env;
         }