@intentius/behold 0.15.0 → 0.16.0

package/dist/cli.js

@@ -716,11 +716,11 @@ async function createK8sClient(options = {}) {
     }
     return void 0;
   }
-  async function resolve9(selector, signal) {
+  async function resolve10(selector, signal) {
     return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
   }
   async function resolveOrThrow(selector, signal) {
-    const info = await resolve9(selector, signal);
+    const info = await resolve10(selector, signal);
     if (!info) throw new UnknownResourceError(selectorText(selector));
     return info;
   }
@@ -732,7 +732,7 @@ async function createK8sClient(options = {}) {
     return parts.join("/");
   }
   async function pathFor(ref, signal) {
-    const info = await resolve9({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    const info = await resolve10({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
     if (!info) return void 0;
     return objectPath(info, ref.name, ref.namespace);
   }
@@ -872,7 +872,7 @@ async function createK8sClient(options = {}) {
   return {
     provenance,
     defaultNamespace,
-    resolve: resolve9,
+    resolve: resolve10,
     read,
     pathFor,
     readIfPresent,
@@ -1065,7 +1065,7 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve8, dirname as dirname7, join as join20 } from "node:path";
+import { resolve as resolve9, dirname as dirname7, join as join21 } from "node:path";
 import { realpathSync, existsSync as existsSync14, readFileSync as readFileSync16, rmSync as rmSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
@@ -1148,7 +1148,7 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
-import { basename, dirname as dirname5, join as join18, relative as relative4, resolve as resolve6, sep as sep4 } from "node:path";
+import { basename, dirname as dirname5, join as join19, relative as relative5, resolve as resolve7, sep as sep4 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -1182,10 +1182,10 @@ function addRecent(dir, now = () => (/* @__PURE__ */ new Date()).toISOString())
 
 // src/chant.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname2, join as join3, resolve } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
 
 // src/project.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
@@ -1305,6 +1305,30 @@ function readTiers(cfg) {
   if (!values.length) return void 0;
   return { envVar: tiers.envVar, values };
 }
+var EXECUTOR_FORGES = ["github", "gitlab", "forgejo"];
+function readExecutor(cfg) {
+  const raw = cfg?.executor;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const out = {};
+  for (const [env, value] of Object.entries(raw)) {
+    if (!env) continue;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      out[env] = { invalid: `executor.${env} must be {forge, workflow}, got ${JSON.stringify(value)}` };
+      continue;
+    }
+    const v = value;
+    if (typeof v.forge !== "string" || !EXECUTOR_FORGES.includes(v.forge)) {
+      out[env] = { invalid: `executor.${env}.forge must be one of ${EXECUTOR_FORGES.join(", ")}, got ${JSON.stringify(v.forge)}` };
+      continue;
+    }
+    if (typeof v.workflow !== "string" || !/^[^/\\]+\.ya?ml$/.test(v.workflow)) {
+      out[env] = { invalid: `executor.${env}.workflow must name a file in .github/workflows (e.g. deploy-${env}.yml), got ${JSON.stringify(v.workflow)}` };
+      continue;
+    }
+    out[env] = { forge: v.forge, workflow: v.workflow };
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function loadBeholdConfig(projectDir) {
   const path = join2(projectDir, BEHOLD_CONFIG_NAME);
   if (!existsSync2(path)) return {};
@@ -1312,7 +1336,8 @@ function loadBeholdConfig(projectDir) {
     const raw = JSON.parse(readFileSync2(path, "utf8"));
     const tiers = readTiers(raw);
     const members = Array.isArray(raw.members) ? raw.members.filter((m) => typeof m === "string" && !!m) : [];
-    return { ...tiers ? { tiers } : {}, ...members.length ? { members } : {} };
+    const executor = readExecutor(raw);
+    return { ...tiers ? { tiers } : {}, ...members.length ? { members } : {}, ...executor ? { executor } : {} };
   } catch {
     return {};
   }
@@ -1664,6 +1689,309 @@ function unescapeDoubleQuoted(body) {
   return out;
 }
 
+// src/carve-manifest.ts
+import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join3, relative, resolve } from "node:path";
+var CARVE_MANIFEST_SUFFIX = ".carve.json";
+var APPLY_IS_HUMAN = "`chant carve apply` graduates ownership \u2014 it resolves the marker that makes chant the owner of a live resource. behold shows what the manifest records and echoes the command; it has no apply endpoint and no apply button, by design. Read the graduation plan, then run it yourself.";
+var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+function parseCarveManifest(value) {
+  if (!isRecord(value)) return null;
+  if (value.version !== 1) return null;
+  if (typeof value.target !== "string" || !value.target) return null;
+  return value;
+}
+function readCarveManifest(path, readFile = (p) => readFileSync3(p, "utf8")) {
+  let text;
+  try {
+    text = readFile(path);
+  } catch {
+    return null;
+  }
+  try {
+    return parseCarveManifest(JSON.parse(text));
+  } catch {
+    return null;
+  }
+}
+function carveStageOf(m) {
+  if (m.apply) return "applied";
+  if (m.bridge) return "bridged";
+  return "emitted";
+}
+function carveWordFor(stage) {
+  switch (stage) {
+    case "applied":
+      return "carved \u2192 chant";
+    case "bridged":
+      return "bridged \u2014 apply is yours";
+    default:
+      return "emitted \u2014 not bridged";
+  }
+}
+function carveToneFor(stage) {
+  return stage === "applied" ? "good" : "accent";
+}
+function carveStageNote(state) {
+  switch (state.stage) {
+    case "applied":
+      return `graduated \u2014 \`carve apply\` recorded the ownership marker` + (state.ownership?.stack ? ` (stack ${state.ownership.stack}${state.ownership.env ? `, env ${state.ownership.env}` : ""})` : "") + ". chant owns it.";
+    case "bridged":
+      return "emitted and bridged \u2014 the survivor patch is proposed. Terraform still owns the resource until `carve apply`.";
+    default:
+      return "emitted \u2014 typed chant source exists, and the surviving Terraform still reads the resource directly. `carve bridge` is next.";
+  }
+}
+function carveStateOf(m, path) {
+  const stage = carveStageOf(m);
+  const deferred = Object.entries(m.emit?.params ?? {}).map(([name, p]) => `${name} \u2190 ${p?.survivor ?? "a survivor"}`);
+  return {
+    target: m.target,
+    ...m.tfType ? { tfType: m.tfType } : {},
+    stage,
+    graduated: stage === "applied",
+    // The last stamped step wins — that is the age of the state, not the age
+    // of the carve.
+    ...m.apply?.at || m.bridge?.at || m.emit?.at ? { at: m.apply?.at ?? m.bridge?.at ?? m.emit?.at } : {},
+    files: strings(m.emit?.files),
+    sourceFiles: strings(m.emit?.files).map((f) => isAbsolute(f) ? f : resolve(dirname2(path), f)),
+    excised: strings(m.bridge?.excised),
+    deferredInputs: deferred,
+    ...m.apply ? {
+      ownership: {
+        ...m.apply.marker?.stack ? { stack: m.apply.marker.stack } : {},
+        ...m.apply.marker?.env ? { env: m.apply.marker.env } : {},
+        ...m.apply.ownershipTags ? { tags: m.apply.ownershipTags } : {}
+      }
+    } : {},
+    ...m.from ? { from: m.from } : {},
+    outDir: dirname2(path),
+    path
+  };
+}
+var nodeCarveIo = {
+  readdir: (dir) => readdirSync(dir),
+  isDirectory: (p) => {
+    try {
+      return statSync(p).isDirectory();
+    } catch {
+      return false;
+    }
+  },
+  readFile: (p) => readFileSync3(p, "utf8")
+};
+var MANIFEST_SCAN_DEPTH = 2;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "cdk.out", ".terraform", ".git"]);
+function listCarveManifests(dir, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
+  const out = [];
+  const walk = (d, level) => {
+    let entries;
+    try {
+      entries = io.readdir(d).sort();
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const full = join3(d, name);
+      if (name.endsWith(CARVE_MANIFEST_SUFFIX)) {
+        out.push(full);
+        continue;
+      }
+      if (level >= depth) continue;
+      if (name.startsWith(".") || SKIP_DIRS.has(name)) continue;
+      if (io.isDirectory(full)) walk(full, level + 1);
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+function readCarveStates(dirs, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const dir of dirs) mergeCarveStates(byTarget, listCarveManifests(dir, io, depth), io);
+  return byTarget;
+}
+function mergeCarveStates(byTarget, paths, io) {
+  const rank = { emitted: 0, bridged: 1, applied: 2 };
+  for (const path of paths) {
+    const manifest = readCarveManifest(path, io.readFile);
+    if (!manifest) continue;
+    const state = carveStateOf(manifest, path);
+    const held = byTarget.get(state.target);
+    if (!held || rank[state.stage] > rank[held.stage]) byTarget.set(state.target, state);
+  }
+}
+var CARVE_STATUS_FLOOR = "0.54.0";
+function carveStatusArgs(from) {
+  return ["carve", "status", "--from", from, "--json"];
+}
+async function discoverCarveStates(dirs, read, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
+  const byTarget = /* @__PURE__ */ new Map();
+  for (const dir of dirs) {
+    const status = await read(dir).catch(() => void 0);
+    const paths = status?.carves ? status.carves.map((row) => resolve(status.from ?? dir, row.path)) : listCarveManifests(dir, io, depth);
+    mergeCarveStates(byTarget, paths, io);
+  }
+  return byTarget;
+}
+function joinCarvedSources(ir, states, memberDir) {
+  const byFile = /* @__PURE__ */ new Map();
+  for (const s of states) for (const f of s.sourceFiles) byFile.set(resolve(f), s);
+  if (byFile.size === 0) return { ir, joined: 0 };
+  let joined = 0;
+  const nodes = ir.nodes.map((n) => {
+    const file = n.sourceLoc?.file;
+    if (!file) return n;
+    const abs = resolve(memberDir, file);
+    const state = byFile.get(abs);
+    if (!state) return n;
+    joined++;
+    const carve = {
+      target: state.target,
+      ...state.tfType ? { tfType: state.tfType } : {},
+      stage: state.stage,
+      graduated: state.graduated,
+      ...state.at ? { at: state.at } : {},
+      ...state.from ? { from: state.from } : {},
+      file: relative(memberDir, abs).split("\\").join("/")
+    };
+    return { ...n, attrs: { ...n.attrs, carved: state.target, _carve: carve } };
+  });
+  return { ir: joined ? { ...ir, nodes } : ir, joined };
+}
+function emittedNodesFor(ir, states, memberDir) {
+  const out = /* @__PURE__ */ new Map();
+  if (!ir) return out;
+  for (const n of joinCarvedSources(ir, states, memberDir).ir.nodes) {
+    const carve = n.attrs._carve;
+    if (carve && !out.has(carve.target)) out.set(carve.target, n);
+  }
+  return out;
+}
+function carveProgress(states, total) {
+  let applied = 0;
+  let bridged = 0;
+  let emitted = 0;
+  for (const s of states) {
+    if (s.stage === "applied") applied++;
+    else if (s.stage === "bridged") bridged++;
+    else emitted++;
+  }
+  const inFlight = bridged + emitted;
+  const parts = [];
+  if (emitted) parts.push(`${emitted} emitted`);
+  if (bridged) parts.push(`${bridged} bridged`);
+  return {
+    applied,
+    bridged,
+    emitted,
+    inFlight,
+    total: typeof total === "number" ? total : null,
+    label: typeof total === "number" ? `${applied} of ${total} carved` : `${applied} carved`,
+    detail: parts.length ? `${parts.join(", ")} \u2014 apply is yours` : ""
+  };
+}
+function applyCommandFor(state, labels = {}) {
+  const env = state.ownership?.env ?? "<env>";
+  const stack = state.ownership?.stack ?? "<stack>";
+  const from = labels.from ?? state.from ?? "<terraform-dir>";
+  const out = labels.out ?? state.outDir;
+  return `chant carve apply --from ${from} --output ${out} --env ${env} --stack ${stack} --write-source`;
+}
+function carveStatePayload(states, total, labels = () => ({})) {
+  const list3 = [...states.values()].sort((a, b) => a.target.localeCompare(b.target));
+  return {
+    manifests: list3.length,
+    progress: carveProgress(list3, total),
+    states: list3.map((s) => ({ ...s, note: carveStageNote(s), applyCommand: applyCommandFor(s, labels(s)) })),
+    apply: { human: true, note: APPLY_IS_HUMAN }
+  };
+}
+function splitCarveState(tfIr, states, opts = {}) {
+  if (states.size === 0) return { tf: tfIr, graduated: [] };
+  const shorten = opts.shorten ?? ((p) => p);
+  const emitted = opts.emitted ?? /* @__PURE__ */ new Map();
+  const declaredAttrs = (n) => Object.fromEntries(Object.entries(n.attrs ?? {}).filter(([k]) => !k.startsWith("_") && k !== "carved"));
+  const source = (files) => files.map(shorten).join(", ");
+  const gone = /* @__PURE__ */ new Set();
+  const graduated = [];
+  const nodes = [];
+  for (const node of tfIr.nodes) {
+    const state = states.get(node.id);
+    if (!state) {
+      nodes.push(node);
+      continue;
+    }
+    const became = emitted.get(node.id);
+    if (state.graduated) {
+      gone.add(node.id);
+      graduated.push({
+        ...node,
+        ...became ? { kind: became.kind, lexicon: became.lexicon, ...became.sourceLoc ? { sourceLoc: became.sourceLoc } : {} } : {},
+        attrs: {
+          ...node.attrs,
+          ...became ? { ...declaredAttrs(became), chantEntity: `${became.kind} ${became.id}` } : {},
+          _status: "good",
+          carve: carveWordFor(state.stage),
+          carveState: state.stage,
+          ...state.ownership?.stack ? { ownedStack: state.ownership.stack } : {},
+          ...state.ownership?.env ? { ownedEnv: state.ownership.env } : {},
+          ...state.at ? { carvedAt: state.at } : {},
+          ...state.files.length ? { chantSource: source(state.files) } : {}
+        }
+      });
+      continue;
+    }
+    nodes.push({
+      ...node,
+      attrs: {
+        ...node.attrs,
+        _status: carveToneFor(state.stage),
+        carve: carveWordFor(state.stage),
+        carveState: state.stage,
+        ...became ? { chantEntity: `${became.kind} ${became.id}` } : {},
+        ...state.at ? { carvedAt: state.at } : {},
+        ...state.files.length ? { chantSource: source(state.files) } : {},
+        ...state.excised.length ? { excisesOnApply: state.excised.join(", ") } : {},
+        ...state.deferredInputs.length ? { deferredInputs: state.deferredInputs.join(", ") } : {}
+      }
+    });
+  }
+  const byStack = {};
+  for (const [band, members] of Object.entries(tfIr.groups?.byStack ?? {})) {
+    const left = members.filter((id) => !gone.has(id));
+    if (left.length) byStack[band] = left;
+  }
+  return {
+    tf: {
+      nodes,
+      edges: tfIr.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
+      groups: { ...tfIr.groups, byStack }
+    },
+    graduated
+  };
+}
+var GRADUATED_BAND = "carved \u2192 chant";
+function bandGraduated(tf, graduated) {
+  if (graduated.length === 0) return tf;
+  return {
+    nodes: [...graduated, ...tf.nodes],
+    edges: tf.edges,
+    groups: {
+      ...tf.groups,
+      byStack: {
+        [GRADUATED_BAND]: graduated.map((n) => n.id),
+        ...tf.groups?.byStack ?? {}
+      }
+    }
+  };
+}
+function carveStateNote(progress, states) {
+  if (states.size === 0) return "";
+  const head = ` Carve state (from ${states.size} manifest${states.size === 1 ? "" : "s"}): ${progress.label}`;
+  return progress.detail ? `${head}, ${progress.detail}.` : `${head}.`;
+}
+
 // src/chant.ts
 function envOverridesFor(opts) {
   const overrides = {};
@@ -1694,14 +2022,14 @@ function packageManifestFrom(req, name) {
   } catch {
     return void 0;
   }
-  let dir = dirname2(entry);
+  let dir = dirname3(entry);
   for (; ; ) {
     try {
-      const pkg = createRequire(import.meta.url)(join3(dir, "package.json"));
+      const pkg = createRequire(import.meta.url)(join4(dir, "package.json"));
       if (pkg.name === name) return { root: dir, manifest: pkg };
     } catch {
     }
-    const parent = dirname2(dir);
+    const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1711,10 +2039,10 @@ function chantPackageFrom(req) {
   const found = packageManifestFrom(req, "@intentius/chant");
   if (!found) return void 0;
   const { root, manifest } = found;
-  return { root, bin: join3(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
+  return { root, bin: join4(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
 }
 function resolveLexicons(projectDir, lexicons) {
-  const req = createRequire(join3(resolve(projectDir), "noop.js"));
+  const req = createRequire(join4(resolve2(projectDir), "noop.js"));
   return lexicons.map((lexicon) => {
     const pkg = `@intentius/chant-lexicon-${lexicon}`;
     const found = packageManifestFrom(req, pkg);
@@ -1724,7 +2052,7 @@ function resolveLexicons(projectDir, lexicons) {
 function resolveChant(projectDir) {
   const own = chantPackageFrom(createRequire(import.meta.url));
   if (projectDir) {
-    const fromProject = chantPackageFrom(createRequire(join3(resolve(projectDir), "noop.js")));
+    const fromProject = chantPackageFrom(createRequire(join4(resolve2(projectDir), "noop.js")));
     if (fromProject) return { source: fromProject.root === own?.root ? "behold" : "project", ...fromProject };
   }
   if (own) return { source: "behold", ...own };
@@ -1732,8 +2060,8 @@ function resolveChant(projectDir) {
 }
 function chantFloor() {
   try {
-    const here = dirname2(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync3(join3(here, "..", "package.json"), "utf8"));
+    const here = dirname3(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync4(join4(here, "..", "package.json"), "utf8"));
     return pkg.dependencies?.["@intentius/chant"]?.replace(/^[^0-9]*/, "") || void 0;
   } catch {
     return void 0;
@@ -1839,7 +2167,7 @@ function runCommandStream(cmd, args, cwd, onLine) {
   return { pid: proc.pid ?? -1, kill: () => proc.kill(), done };
 }
 function legacyGraphPath(projectDir) {
-  const src = join3(projectDir, "src");
+  const src = join4(projectDir, "src");
   return existsSync3(src) ? src : projectDir;
 }
 async function graphPath(projectDir, opts = {}) {
@@ -1851,9 +2179,9 @@ async function graphPath(projectDir, opts = {}) {
   }
   if (info.stacks?.length) {
     const picked = opts.stack ? info.stacks.find((s) => s.name === opts.stack) : void 0;
-    return resolve(projectDir, (picked ?? info.stacks[0]).src);
+    return resolve2(projectDir, (picked ?? info.stacks[0]).src);
   }
-  if (info.sourceDir) return resolve(projectDir, info.sourceDir);
+  if (info.sourceDir) return resolve2(projectDir, info.sourceDir);
   return legacyGraphPath(projectDir);
 }
 function graphArgs(src, format, opts, components) {
@@ -1864,7 +2192,7 @@ async function graphIr(projectDir, opts = {}) {
   return runChantJson(graphArgs(src, "ir", opts, false), projectDir, envOverridesFor(opts));
 }
 async function clusterRootGraphIr(projectDir, opts = {}) {
-  if (!existsSync3(join3(projectDir, "cluster"))) return void 0;
+  if (!existsSync3(join4(projectDir, "cluster"))) return void 0;
   const { live: _live, overlay: _overlay, env: _env, ...sourceOnly } = opts;
   try {
     return await runChantJson(graphArgs("cluster", "ir", sourceOnly, false), projectDir, envOverridesFor(sourceOnly));
@@ -1882,6 +2210,9 @@ function componentStatusArgs(env) {
 function componentStatus(projectDir, env, opts = {}) {
   return runChantJson(componentStatusArgs(env), projectDir, envOverridesFor(opts));
 }
+function ciWorkflowName(env) {
+  return `chant-components-${env}`;
+}
 var CI_FORGES = ["gitlab", "github", "forgejo"];
 function ciForgeFor(lexicons) {
   return CI_FORGES.find((forge) => lexicons.includes(forge));
@@ -1899,7 +2230,7 @@ function parseCiPipeline(stdout) {
     const script = Array.isArray(props?.script) ? props.script.map(String) : [];
     return { ...j, script };
   });
-  return { stages: parsed.stages, jobs };
+  return { stages: parsed.stages, jobs, ...typeof parsed.env === "string" && parsed.env ? { env: parsed.env } : {} };
 }
 function ciPipeline(projectDir, opts = {}, forge = "gitlab") {
   const args = ciPipelineArgs(opts, forge);
@@ -1920,6 +2251,9 @@ function lifecycleDiffArgs(env) {
 function lifecycleDiffLive(projectDir, env, opts = {}) {
   return runChantJson(lifecycleDiffArgs(env), projectDir, envOverridesFor(opts));
 }
+function carveStatus(from, projectDir) {
+  return runChantJson(carveStatusArgs(from), projectDir);
+}
 function helmRendersArgs() {
   return ["helm", "renders", "--json"];
 }
@@ -1996,8 +2330,8 @@ function mergeClusterRoot(ir, clusterIr, running) {
 }
 
 // src/helm-releases.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { join as join4 } from "node:path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "node:fs";
+import { join as join5 } from "node:path";
 var RELEASE_KEY = /^release\/([^/]+)\/(.+)$/;
 function declaredChartNames(ir) {
   const names = /* @__PURE__ */ new Set();
@@ -2017,15 +2351,15 @@ function matchesDeclaredChart(chart, declared) {
 }
 function discoverReleaseUnits(projectDir) {
   const owners = /* @__PURE__ */ new Map();
-  const roots = [join4(projectDir, "src"), join4(projectDir, "ops")];
+  const roots = [join5(projectDir, "src"), join5(projectDir, "ops")];
   const files = [];
   const walk = (dir, depth) => {
     if (depth > 4 || !existsSync4(dir)) return;
-    for (const f of readdirSync(dir)) {
-      const p = join4(dir, f);
+    for (const f of readdirSync2(dir)) {
+      const p = join5(dir, f);
       let s;
       try {
-        s = statSync(p);
+        s = statSync2(p);
       } catch {
         continue;
       }
@@ -2037,7 +2371,7 @@ function discoverReleaseUnits(projectDir) {
   for (const file of files) {
     let content;
     try {
-      content = readFileSync4(file, "utf8");
+      content = readFileSync5(file, "utf8");
     } catch {
       continue;
     }
@@ -2090,8 +2424,8 @@ function synthesizeHelmReleases(ir, observed, owners) {
 
 // src/gh-run.ts
 import { spawn as spawn2 } from "node:child_process";
-import { readdirSync as readdirSync2, readFileSync as readFileSync5 } from "node:fs";
-import { join as join5 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync6 } from "node:fs";
+import { join as join6 } from "node:path";
 
 // src/ci-run.ts
 function pipelineProgress(pipeline) {
@@ -2145,19 +2479,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve9) => {
+var defaultGhExec = (args) => new Promise((resolve10) => {
   let out = "";
   let proc;
   try {
     proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve9({ code: 127, out: "" });
+    resolve10({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve9({ code: 127, out }));
-  proc.on("close", (code) => resolve9({ code: code ?? 1, out }));
+  proc.on("error", () => resolve10({ code: 127, out }));
+  proc.on("close", (code) => resolve10({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -2176,31 +2510,49 @@ function parseWorkflow(file, text) {
   const jobs = d.jobs && typeof d.jobs === "object" && !Array.isArray(d.jobs) ? Object.keys(d.jobs) : [];
   const on = d.on ?? d[true];
   const dispatchable = on === "workflow_dispatch" || Array.isArray(on) && on.includes("workflow_dispatch") || !!on && typeof on === "object" && "workflow_dispatch" in on || /^\s{2,}workflow_dispatch\s*:?\s*$/m.test(text);
-  return { file, jobIds: jobs, dispatchable };
+  return { file, jobIds: jobs, dispatchable, ...typeof d.name === "string" && d.name ? { name: d.name } : {} };
 }
-function pickWorkflow(projectDir, pipeline) {
-  const dir = join5(projectDir, ".github", "workflows");
+function committedWorkflows(projectDir) {
+  const dir = join6(projectDir, ".github", "workflows");
   let files;
   try {
-    files = readdirSync2(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+    files = readdirSync3(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
   } catch {
-    return void 0;
+    return [];
   }
-  const wanted = new Set(pipeline.jobs.map((j) => j.jobName));
-  let best;
+  const out = [];
   for (const f of files) {
-    let text;
     try {
-      text = readFileSync5(join5(dir, f), "utf8");
+      out.push(parseWorkflow(f, readFileSync6(join6(dir, f), "utf8")));
     } catch {
-      continue;
     }
-    const info = parseWorkflow(f, text);
-    if (!info.dispatchable) continue;
-    const overlap = info.jobIds.filter((id) => wanted.has(id)).length;
-    if (overlap > 0 && (!best || overlap > best.overlap)) best = { info, overlap };
   }
-  return best?.info;
+  return out;
+}
+function resolveWorkflow(projectDir, pipeline, designated) {
+  const all = committedWorkflows(projectDir);
+  if (designated) {
+    const hit = all.find((w) => w.file === designated);
+    if (!hit) return { reason: `the designated workflow .github/workflows/${designated} is not committed \u2014 Deploy is disabled for this env until it is (behold never falls back to a guess, or to running it here)` };
+    if (!hit.dispatchable) return { reason: `the designated workflow ${designated} declares no workflow_dispatch \u2014 add it to its \`on:\` block; until then Deploy is disabled for this env` };
+    return { workflow: hit };
+  }
+  const dispatchable = all.filter((w) => w.dispatchable);
+  if (pipeline.env) {
+    const named = dispatchable.filter((w) => w.name === ciWorkflowName(pipeline.env));
+    if (named.length === 1) return { workflow: named[0] };
+    if (named.length > 1) return { reason: `${named.length} committed workflows are named ${ciWorkflowName(pipeline.env)} (${named.map((w) => w.file).join(", ")}) \u2014 designate one in .behold.json's executor block` };
+  }
+  const wanted = new Set(pipeline.jobs.map((j) => j.jobName));
+  const scored = dispatchable.map((w) => ({ w, overlap: w.jobIds.filter((id) => wanted.has(id)).length })).filter((x) => x.overlap > 0).sort((a, b) => b.overlap - a.overlap);
+  if (scored.length === 0) {
+    return { reason: "no committed workflow_dispatch workflow whose jobs match the generated pipeline \u2014 commit one (or add `workflow_dispatch:` to its `on:` block)" };
+  }
+  if (scored.length > 1 && scored[1].overlap === scored[0].overlap) {
+    const tied = scored.filter((x) => x.overlap === scored[0].overlap).map((x) => x.w.file);
+    return { reason: `${tied.length} committed workflows match the pipeline equally (${tied.join(", ")}) \u2014 the generated job ids are the same for every env, so behold cannot tell which one deploys ${pipeline.env ?? "this env"}; designate it in .behold.json's executor block` };
+  }
+  return { workflow: scored[0].w };
 }
 async function latestRunId(workflowFile, exec = defaultGhExec) {
   const { code, out } = await exec(["run", "list", "--workflow", workflowFile, "--limit", "1", "--json", "databaseId"]);
@@ -2234,6 +2586,7 @@ function runViewToProgress(pipeline, view) {
       return { ...w, status };
     })
   };
+  if (view.url) state = { ...state, url: view.url };
   if (view.status === "completed") {
     return { ...state, status: view.conclusion === "success" ? "ok" : "failed" };
   }
@@ -2267,8 +2620,9 @@ async function dispatchAndFollow(workflow, pipeline, ref, deps) {
     return 1;
   }
   deps.onLine(`\u25CF run ${runId} started \u2014 following`);
+  let urlSaid = false;
   for (; ; ) {
-    const { code, out } = await exec(["run", "view", String(runId), "--json", "status,conclusion,jobs"]);
+    const { code, out } = await exec(["run", "view", String(runId), "--json", "status,conclusion,jobs,url"]);
     if (code === 0) {
       let view;
       try {
@@ -2277,6 +2631,10 @@ async function dispatchAndFollow(workflow, pipeline, ref, deps) {
         view = void 0;
       }
       if (view) {
+        if (view.url && !urlSaid) {
+          urlSaid = true;
+          deps.onLine(`\u25CF ${view.url} \u2014 if the workflow's environment requires an approval, it is granted there, by a GitHub identity; behold holds none that could`);
+        }
         deps.onProgress(runViewToProgress(pipeline, view));
         if (view.status === "completed") {
           deps.onLine(`\u25A0 run ${runId} ${view.conclusion ?? "completed"}`);
@@ -2313,15 +2671,15 @@ function joinCiProgress(ir, state) {
 // src/operator.ts
 var ANSI = /\x1b\[[0-9;]*m/g;
 var strip = (s) => s.replace(ANSI, "");
-var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var HOW_TO_DECLARE = "An operating loop is a ConvergeOp: declare one in a `*.op.ts` (`ConvergeOp({ name, env, dial, rules })` from @intentius/chant-lexicon-temporal), build the project, and tick it with `chant operator` (or a cron / CronJob invoking it).";
 function readRow(value) {
-  if (!isRecord(value)) return null;
+  if (!isRecord2(value)) return null;
   if (typeof value.op !== "string" || typeof value.env !== "string") return null;
   if (!Array.isArray(value.pendingGates)) return null;
   const gates = [];
   for (const g of value.pendingGates) {
-    if (!isRecord(g) || typeof g.rule !== "string" || typeof g.gate !== "string") return null;
+    if (!isRecord2(g) || typeof g.rule !== "string" || typeof g.gate !== "string") return null;
     gates.push({
       rule: g.rule,
       gate: g.gate,
@@ -2333,9 +2691,9 @@ function readRow(value) {
       ...typeof g.url === "string" && g.url ? { url: g.url } : {}
     });
   }
-  const tick = isRecord(value.lastTick) ? value.lastTick : void 0;
+  const tick = isRecord2(value.lastTick) ? value.lastTick : void 0;
   const usable = tick && typeof tick.timestamp === "string" && typeof tick.log === "string";
-  const lease = isRecord(value.lease) ? value.lease : void 0;
+  const lease = isRecord2(value.lease) ? value.lease : void 0;
   return {
     op: value.op,
     env: value.env,
@@ -2433,7 +2791,7 @@ var CHANT = "chant";
 var CONVERGE_TICK = "converge-tick";
 var CRONJOB_KIND = "K8s::Batch::CronJob";
 var NAMESPACE_KIND = "K8s::Core::Namespace";
-var rec = (v) => isRecord(v) ? v : void 0;
+var rec = (v) => isRecord2(v) ? v : void 0;
 var str = (v) => typeof v === "string" && v ? v : void 0;
 var labelsOf = (n) => rec(rec(n.attrs?.metadata)?.labels) ?? {};
 function operatorHomes(ir) {
@@ -2541,10 +2899,10 @@ function tickFreshness(at, now = Date.now()) {
 }
 var RECONCILIATIONS = /* @__PURE__ */ new Set(["reconciled", "unrecorded", "stale", "drifted", "unknown"]);
 function readVerdict(value) {
-  if (!isRecord(value)) return null;
+  if (!isRecord2(value)) return null;
   if (typeof value.component !== "string" || !value.component) return null;
   if (typeof value.reconciliation !== "string" || !RECONCILIATIONS.has(value.reconciliation)) return null;
-  const unobserved = isRecord(value.unobserved) && typeof value.unobserved.reason === "string" ? value.unobserved : void 0;
+  const unobserved = isRecord2(value.unobserved) && typeof value.unobserved.reason === "string" ? value.unobserved : void 0;
   return {
     component: value.component,
     reconciliation: value.reconciliation,
@@ -2655,12 +3013,12 @@ function operatorLogArgs(window) {
   ];
 }
 function readTickRecord(value) {
-  if (!isRecord(value)) return null;
+  if (!isRecord2(value)) return null;
   if (typeof value.op !== "string" || typeof value.timestamp !== "string" || typeof value.log !== "string") return null;
   return value;
 }
 function readResolutionRecord(value) {
-  if (!isRecord(value)) return null;
+  if (!isRecord2(value)) return null;
   const needed = ["op", "gate", "resolvedBy", "timestamp"];
   if (needed.some((k) => typeof value[k] !== "string")) return null;
   return value;
@@ -2721,10 +3079,10 @@ function readOperatorLog(run3) {
       remedy: "behold reads `{entries: [{kind, timestamp, record}], malformed: {converge, gates}}`."
     }
   });
-  if (!isRecord(parsed) || !Array.isArray(parsed.entries)) return unreadable("no `entries` array");
+  if (!isRecord2(parsed) || !Array.isArray(parsed.entries)) return unreadable("no `entries` array");
   const entries = [];
   for (const value of parsed.entries) {
-    if (!isRecord(value) || typeof value.timestamp !== "string") return unreadable("an entry with no timestamp");
+    if (!isRecord2(value) || typeof value.timestamp !== "string") return unreadable("an entry with no timestamp");
     if (value.kind === "tick") {
       const record = readTickRecord(value.record);
       if (!record) return unreadable("a tick entry with no `op`/`timestamp`/`log`");
@@ -2737,7 +3095,7 @@ function readOperatorLog(run3) {
       return unreadable(`an entry of an unknown kind "${String(value.kind)}"`);
     }
   }
-  const counts = isRecord(parsed.malformed) ? parsed.malformed : {};
+  const counts = isRecord2(parsed.malformed) ? parsed.malformed : {};
   const count = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
   return { ok: true, entries, malformed: { converge: count(counts.converge), gates: count(counts.gates) } };
 }
@@ -3369,7 +3727,9 @@ function applyHelmArtifacts(ir, observed) {
       release: key.replace(/^release\//, ""),
       ...o.status ? { status: o.status } : {},
       ...typeof o.attributes?.revision === "string" ? { revision: o.attributes.revision } : {},
-      ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {}
+      ...typeof o.attributes?.chart === "string" ? { chart: o.attributes.chart } : {},
+      ...typeof o.attributes?.inputDigest === "string" ? { inputDigest: o.attributes.inputDigest } : {},
+      ...typeof o.attributes?.contentDigest === "string" ? { contentDigest: o.attributes.contentDigest } : {}
     };
     attrs._artifact = match;
     attrs._status = o.status === "deployed" ? "good" : "warn";
@@ -3378,37 +3738,35 @@ function applyHelmArtifacts(ir, observed) {
   return { charts, installed };
 }
 
-// src/estate.ts
-import { statSync as statSync3 } from "node:fs";
-import { availableParallelism } from "node:os";
-import { join as join7, resolve as resolve3, sep } from "node:path";
-import { composeStacks, shortStackNames } from "@intentius/pinhole";
+// src/carve-discovery.ts
+import { readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
+import { join as join8 } from "node:path";
 
 // src/member-ir.ts
 import { createHash } from "node:crypto";
-import { readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { join as join6, relative, resolve as resolve2 } from "node:path";
+import { readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
+import { join as join7, relative as relative2, resolve as resolve3 } from "node:path";
 var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
 function memberIrCacheSize(env = process.env) {
   const override = Number.parseInt(env.BEHOLD_ESTATE_IR_CACHE ?? "", 10);
   return Number.isInteger(override) && override >= 0 ? override : 64;
 }
 function memberSourceStamp(dir) {
-  const root = resolve2(dir);
+  const root = resolve3(dir);
   const h = createHash("sha1");
   let any = false;
   const walk = (at) => {
-    const entries = readdirSync3(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
+    const entries = readdirSync4(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
     for (const e of entries) {
       if (SKIP.has(e.name)) continue;
-      const path = join6(at, e.name);
+      const path = join7(at, e.name);
       if (e.isDirectory()) {
         walk(path);
         continue;
       }
       if (!e.isFile()) continue;
-      const st = statSync2(path);
-      h.update(`${relative(root, path)}\0${st.mtimeMs}\0${st.size}
+      const st = statSync3(path);
+      h.update(`${relative2(root, path)}\0${st.mtimeMs}\0${st.size}
 `);
       any = true;
     }
@@ -3423,7 +3781,7 @@ function memberSourceStamp(dir) {
 function cacheKey(dir, opts) {
   const chant = resolveChant(dir);
   const canonical = JSON.stringify(opts, Object.keys(opts).sort());
-  return `${resolve2(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
+  return `${resolve3(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
 }
 var cache = /* @__PURE__ */ new Map();
 var hits = 0;
@@ -3433,7 +3791,7 @@ function invalidateMember(dir) {
     cache.clear();
     return;
   }
-  const root = resolve2(dir);
+  const root = resolve3(dir);
   for (const [key, entry] of cache) if (entry.dir === root) cache.delete(key);
 }
 async function memberIr(dir, opts = {}) {
@@ -3452,7 +3810,7 @@ async function memberIr(dir, opts = {}) {
   const ir = await graphIr(dir, opts);
   if (stamp === void 0 || memberSourceStamp(dir) !== stamp) return ir;
   cache.delete(key);
-  cache.set(key, { dir: resolve2(dir), stamp, ir });
+  cache.set(key, { dir: resolve3(dir), stamp, ir });
   for (const oldest of cache.keys()) {
     if (cache.size <= size) break;
     cache.delete(oldest);
@@ -3460,6 +3818,70 @@ async function memberIr(dir, opts = {}) {
   return structuredClone(ir);
 }
 
+// src/carve-discovery.ts
+function carveStatusReader(projectDir) {
+  return async (dir) => {
+    const via = projectDir ?? dir;
+    if (!meetsFloor(resolveChant(via).version, CARVE_STATUS_FLOOR)) return void 0;
+    return carveStatus(dir, via).catch(() => void 0);
+  };
+}
+var SKIP2 = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".chant", ".terraform", "cdk.out"]);
+function hasAnyCarveManifest(dir, io = fsIo) {
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = io.readdir(d);
+    } catch {
+      return false;
+    }
+    for (const name of entries) {
+      if (name.endsWith(CARVE_MANIFEST_SUFFIX)) return true;
+      if (name.startsWith(".") || SKIP2.has(name)) continue;
+      const full = join8(d, name);
+      if (io.isDirectory(full) && walk(full)) return true;
+    }
+    return false;
+  };
+  return walk(dir);
+}
+var fsIo = {
+  readdir: (d) => readdirSync5(d),
+  isDirectory: (p) => {
+    try {
+      return statSync4(p).isDirectory();
+    } catch {
+      return false;
+    }
+  }
+};
+var cache2 = /* @__PURE__ */ new Map();
+async function carveStatesFor(dir) {
+  const stamp = memberSourceStamp(dir);
+  const held = cache2.get(dir);
+  if (held && stamp !== void 0 && held.stamp === stamp) return held.states;
+  const states = hasAnyCarveManifest(dir) ? await discoverCarveStates([dir], carveStatusReader(), nodeCarveIo, MANIFEST_SCAN_DEPTH) : /* @__PURE__ */ new Map();
+  if (stamp !== void 0) cache2.set(dir, { stamp, states });
+  return states;
+}
+async function carveStatesUnder(dirs) {
+  const rank = { emitted: 0, bridged: 1, applied: 2 };
+  const out = /* @__PURE__ */ new Map();
+  for (const dir of dirs) {
+    for (const s of (await carveStatesFor(dir)).values()) {
+      const held = out.get(s.target);
+      if (!held || rank[s.stage] > rank[held.stage]) out.set(s.target, s);
+    }
+  }
+  return out;
+}
+
+// src/estate.ts
+import { statSync as statSync5 } from "node:fs";
+import { availableParallelism } from "node:os";
+import { join as join9, resolve as resolve4, sep } from "node:path";
+import { composeStacks, shortStackNames } from "@intentius/pinhole";
+
 // src/zoom-notes.ts
 function zoomNote(zoom, ir, compositeEdgesAttached) {
   const empty = ir.nodes.length === 0;
@@ -3562,7 +3984,10 @@ async function composeEstate(projectDirs, opts = {}) {
   const names = shortStackNames(projectDirs);
   const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
     name: names[i],
-    ir: await memberIr(dir, opts)
+    // chant#2040: the manifests a member holds name the files its carved
+    // entities were emitted into — joined here, where the member's root is
+    // known, onto a COPY (the member IR is the #312 cache's own object).
+    ir: joinCarvedSources(await memberIr(dir, opts), (await carveStatesFor(dir)).values(), dir).ir
   }));
   return composeStacks(stacks);
 }
@@ -3583,7 +4008,7 @@ var rec3 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str3 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 var realIsDir = (p) => {
   try {
-    return statSync3(p).isDirectory();
+    return statSync5(p).isDirectory();
   } catch {
     return false;
   }
@@ -3613,11 +4038,11 @@ function declaredSegments(path) {
 function pathAlignment(declared, dir, isDir = realIsDir) {
   const want = declaredSegments(declared);
   if (!want) return 0;
-  const root = resolve3(dir);
+  const root = resolve4(dir);
   const have = root.split(sep).filter(Boolean);
   for (let k = Math.min(want.length, have.length); k >= 1; k--) {
     if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join7(root, ...want.slice(k)))) continue;
+    if (!isDir(join9(root, ...want.slice(k)))) continue;
     return k;
   }
   return 0;
@@ -3647,10 +4072,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join21 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join21 });
+    const join22 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join22 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join21 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join22 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -3691,7 +4116,7 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
       const reason = firstLine2(err);
       try {
         const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
-        const src = await memberIr(dir, srcOpts);
+        const src = joinCarvedSources(await memberIr(dir, srcOpts), (await carveStatesFor(dir)).values(), dir).ir;
         for (const n of src.nodes) n.attrs = { ...n.attrs, _status: "neutral", _unobserved: reason };
         stacks[i] = { name, ir: src };
         unobserved.push({ name, reason });
@@ -3714,6 +4139,36 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
 }
 
 // src/helm-drift.ts
+function renderIdentity(record, observed) {
+  const declared = {
+    ...record.inputDigest ? { inputDigest: record.inputDigest } : {},
+    ...record.contentDigest ? { contentDigest: record.contentDigest } : {}
+  };
+  const a = observed?.observation.attributes ?? {};
+  const obs = {
+    ...observed ? { release: observed.key.replace(/^release\//, "") } : {},
+    ...typeof a.inputDigest === "string" ? { inputDigest: a.inputDigest } : {},
+    ...typeof a.contentDigest === "string" ? { contentDigest: a.contentDigest } : {}
+  };
+  const base = { declared, observed: obs };
+  if (!declared.inputDigest && !declared.contentDigest) return { match: "unpinned", ...base };
+  if (!obs.inputDigest && !obs.contentDigest) return { match: "unrecorded", ...base };
+  if (declared.contentDigest && obs.contentDigest) {
+    return { match: declared.contentDigest === obs.contentDigest ? "content" : "mismatch", ...base };
+  }
+  if (declared.inputDigest && obs.inputDigest) {
+    return { match: declared.inputDigest === obs.inputDigest ? "input" : "mismatch", ...base };
+  }
+  return { match: "unrecorded", ...base };
+}
+function observedReleaseFor(record, observed, namespace) {
+  if (!observed) return void 0;
+  const candidates = Object.entries(observed).filter(([key2]) => key2.startsWith("release/") && key2.split("/").pop() === record.name);
+  if (candidates.length === 0) return void 0;
+  const scoped = namespace ? candidates.find(([key2]) => key2 === `release/${namespace}/${record.name}`) : void 0;
+  const [key, observation] = scoped ?? candidates[0];
+  return { key, observation };
+}
 function countChanges(docs) {
   return docs.reduce((n, d) => n + d.changes.length, 0);
 }
@@ -3736,8 +4191,9 @@ function provenanceOf(live) {
     sourceRef: m.sourceRef
   };
 }
-function helmRenderReport(record, live) {
-  const base = { render: record.name, chart: record.chart };
+function helmRenderReport(record, live, observed) {
+  const identity = observed ? { identity: renderIdentity(record, observedReleaseFor(record, observed, live?.manifest.namespace)) } : {};
+  const base = { render: record.name, chart: record.chart, ...identity };
   if (!live) {
     return { ...base, verdict: "unobserved", reason: record.contentDigest ? "no-stored-render" : "unpinned" };
   }
@@ -3761,21 +4217,24 @@ function helmRenderReport(record, live) {
   }
   return { ...base, verdict: "in-sync", counts, provenance };
 }
-async function readHelmRenderDrift(projectDir, env, opts = {}) {
+async function readHelmRenderDrift(projectDir, env, opts = {}, observed) {
   const report = await helmRenders(projectDir, opts).catch(() => void 0);
   const records = report?.records ?? [];
   if (records.length === 0) return [];
   return mapPool(records, estateReadPool(records.length), async (record) => {
-    if (!record.contentDigest) return helmRenderReport(record, void 0);
+    if (!record.contentDigest) return helmRenderReport(record, void 0, observed);
     const live = await helmRenderDiffLive(projectDir, record.contentDigest, env, opts).catch(() => void 0);
-    return helmRenderReport(record, live);
+    return helmRenderReport(record, live, observed);
   });
 }
 function chartNameOf2(node) {
   const name = node.attrs?.name;
   return typeof name === "string" && name.length > 0 ? name : void 0;
 }
-var SEVERITY = { drifted: 2, unobserved: 1, "in-sync": 0 };
+var SEVERITY = { drifted: 3, unobserved: 1, "in-sync": 0 };
+function severityOf(r) {
+  return Math.max(SEVERITY[r.verdict], r.identity?.match === "mismatch" ? 2 : 0);
+}
 function applyHelmRenderDrift(ir, reports) {
   if (reports.length === 0) return { charts: 0, drifted: 0 };
   const byChart = /* @__PURE__ */ new Map();
@@ -3791,11 +4250,11 @@ function applyHelmRenderDrift(ir, reports) {
     const chartName = chartNameOf2(node);
     const matched = chartName ? byChart.get(chartName) : void 0;
     if (!matched || matched.length === 0) continue;
-    const worst = matched.reduce((a, b) => SEVERITY[b.verdict] > SEVERITY[a.verdict] ? b : a);
+    const worst = matched.reduce((a, b) => severityOf(b) > severityOf(a) ? b : a);
     const attrs = node.attrs ??= {};
     attrs._renderDrift = matched.length === 1 ? worst : { ...worst, renders: matched };
     charts++;
-    if (worst.verdict === "drifted") {
+    if (worst.verdict === "drifted" || matched.some((r) => r.identity?.match === "mismatch")) {
       attrs._status = "warn";
       drifted++;
     }
@@ -4335,7 +4794,7 @@ function projectHelmLogical(ir) {
 
 // src/logical-kustomize.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 function overlayBoxTitle(name) {
   return `overlay ${name}`;
 }
@@ -4355,7 +4814,7 @@ function kustomizationRoot(bases, dir, exists) {
   let current = dir;
   for (let i = 0; i < 4 && current; i++) {
     for (const base of bases) {
-      if (exists(join8(base, current, "kustomization.yaml")) || exists(join8(base, current, "kustomization.yml"))) {
+      if (exists(join10(base, current, "kustomization.yaml")) || exists(join10(base, current, "kustomization.yml"))) {
         return current;
       }
     }
@@ -5086,11 +5545,11 @@ import {
 } from "@intentius/pinhole";
 
 // src/icon-packs.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname3, join as join9 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname4, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var ICON_ROOT = join9(dirname3(fileURLToPath2(import.meta.url)), "..", "web", "icons");
-var cache2 = /* @__PURE__ */ new Map();
+var ICON_ROOT = join11(dirname4(fileURLToPath2(import.meta.url)), "..", "web", "icons");
+var cache3 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
 }
@@ -5109,9 +5568,9 @@ function plate(glyph) {
   return { ...glyph, body: `${ground}<g transform="${inset}">${glyph.body}</g>` };
 }
 function loadIcon(rel) {
-  const hit = cache2.get(rel);
+  const hit = cache3.get(rel);
   if (hit) return hit;
-  const raw = readFileSync6(join9(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync7(join11(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -5120,7 +5579,7 @@ function loadIcon(rel) {
   if (!viewBox) throw new Error(`vendored icon has no viewBox: ${rel}.svg`);
   const bare = { body: unprefix(raw.slice(openEnd + 1, close).trim()), colored: true, viewBox };
   const glyph = PLATED.has(rel) ? plate(bare) : bare;
-  cache2.set(rel, glyph);
+  cache3.set(rel, glyph);
   return glyph;
 }
 var K8S_ICON_BY_KIND = {
@@ -5176,9 +5635,9 @@ function helmIconFor(kind) {
 var SUPPORTED_MAJOR = 1;
 var refuse = (error, remedy) => ({ ok: false, refusal: { error, code: "carve-report", remedy } });
 var HOW_TO_GET_ONE = "Generate one with `chant carve advise --from <terraform-dir> --report report.json` (chant's read-only Terraform peelability advisor), then `behold carve report.json`.";
-var isRecord2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function parseCarveReport(value) {
-  if (!isRecord2(value)) {
+  if (!isRecord3(value)) {
     return refuse("That file isn't a carve report \u2014 its top level isn't a JSON object.", HOW_TO_GET_ONE);
   }
   if (!Array.isArray(value.resources)) {
@@ -5188,7 +5647,7 @@ function parseCarveReport(value) {
     );
   }
   const bad = value.resources.findIndex(
-    (r) => !isRecord2(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
+    (r) => !isRecord3(r) || typeof r.address !== "string" || typeof r.score !== "number" || typeof r.band !== "string"
   );
   if (bad >= 0) {
     return refuse(
@@ -5233,384 +5692,136 @@ function statusForBand(band, score) {
   switch (band) {
     case "clean leaf":
       return "good";
-    case "carvable w/ edits":
-      return "warn";
-    case "leave in Terraform":
-      return "neutral";
-    default:
-      return score >= 80 ? "good" : score >= 50 ? "warn" : "neutral";
-  }
-}
-function verdictForStatus(status) {
-  return status === "good" ? "carve now" : status === "warn" ? "boundary work" : "leave in Terraform";
-}
-function tfTypeOf(address, kind) {
-  if (kind === "module" || address.startsWith("module.")) return "module";
-  const dot = address.indexOf(".");
-  return dot > 0 ? address.slice(0, dot) : address;
-}
-var directionOf = (e) => e.direction ?? "inbound";
-function boundaryEdgesOf(r) {
-  const b = r.boundary;
-  if (!b) return [];
-  const list3 = Array.isArray(b) ? b : [...b.inbound ?? [], ...b.outbound ?? []];
-  return list3.filter((e) => isRecord2(e) && typeof e.survivor === "string" && typeof e.carved === "string");
-}
-function scoreArithmetic(r) {
-  const b = r.breakdown;
-  if (!b || b.tier === null) return `${r.score} (no known native mapping \u2014 nothing to carve into)`;
-  const p = b.penalties ?? {};
-  const terms = [];
-  if (p.inbound) terms.push(`- 12x${b.inbound ?? 0} inbound`);
-  if (p.outbound) terms.push(`- 4x${b.outbound ?? 0} outbound`);
-  if (p.outputs) terms.push(`- 4x${b.outputs ?? 0} output`);
-  if (p.tier) terms.push(`- 15x${(b.tier ?? 1) - 1} tier${b.tier}`);
-  if (p.dynamic) terms.push(`- 10 dynamic`);
-  if (p.instances) terms.push(`- 3x${(b.instances ?? 1) - 1} instances`);
-  if (!terms.length) return `100 (no penalties) = ${r.score}`;
-  const raw = 100 + Object.values(p).reduce((s, n) => s + (n ?? 0), 0);
-  const clamped = raw !== r.score ? ` (clamped from ${raw})` : "";
-  return `100 ${terms.join(" ")} = ${r.score}${clamped}`;
-}
-function boundaryWorkOf(r) {
-  const b = r.breakdown;
-  if (!b || b.tier === null) return "no known native mapping (unsupported provider/type)";
-  const parts = [];
-  if (b.inbound) parts.push(`${b.inbound} inbound (a data-source patch each)`);
-  if (b.outbound) parts.push(`${b.outbound} outbound (a deferred input each)`);
-  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (a one-line rewrite each)`);
-  if ((b.tier ?? 1) > 1) parts.push(`tier ${b.tier} map`);
-  if (b.hasDynamic) parts.push("count/for_each/data present");
-  if ((b.instances ?? 1) > 1) parts.push(`${b.instances} instances`);
-  return parts.length ? parts.join(", ") : "clean 1:1 native map, no boundary edges";
-}
-function carveCardFields(node) {
-  const score = node.attrs.score;
-  const carve = node.attrs.carve;
-  if (typeof score !== "number") return void 0;
-  return [
-    { label: "score", value: String(score) },
-    ...typeof carve === "string" ? [{ label: "carve", value: carve }] : []
-  ];
-}
-function carveReportToIr(report) {
-  const resources = report.resources ?? [];
-  const known = new Set(resources.map((r) => r.address));
-  const nodes = resources.map((r) => {
-    const status = statusForBand(r.band, r.score);
-    const b = r.breakdown ?? {};
-    const edges2 = boundaryEdgesOf(r);
-    const patches = edges2.filter((e) => e.carved === r.address && directionOf(e) === "inbound").map((e) => e.survivor);
-    const inputs = edges2.filter((e) => e.carved === r.address && directionOf(e) === "outbound").map((e) => e.survivor);
-    return {
-      id: r.address,
-      kind: tfTypeOf(r.address, r.kind),
-      lexicon: "terraform",
-      attrs: {
-        // The drift palette's channel — `_`-prefixed, so it paints the card and
-        // stays out of both the card's fields and the inspect pane's list.
-        _status: status,
-        score: r.score,
-        carve: verdictForStatus(status),
-        band: r.band,
-        arithmetic: scoreArithmetic(r),
-        boundaryWork: boundaryWorkOf(r),
-        ...r.mapsTo ? { mapsTo: r.mapsTo } : {},
-        tier: b.tier === null || b.tier === void 0 ? "none" : b.tier,
-        inbound: b.inbound ?? 0,
-        outbound: b.outbound ?? 0,
-        outputs: b.outputs ?? 0,
-        instances: b.instances ?? 1,
-        dynamic: b.hasDynamic ?? false,
-        // The predicted diff, when the report carries the edge lists: who needs
-        // a `data` source the moment this is carved, and what becomes a
-        // deploy-time input. Absent (not empty) when the report has no lists —
-        // "none" and "not reported" are different claims.
-        ...patches.length ? { patchOnCarve: patches.join(", ") } : {},
-        ...inputs.length ? { deferredInputs: inputs.join(", ") } : {}
-      }
-    };
-  });
-  const seen = /* @__PURE__ */ new Set();
-  const edges = [];
-  for (const r of resources) {
-    for (const e of boundaryEdgesOf(r)) {
-      const direction = directionOf(e);
-      const from = direction === "inbound" ? e.survivor : e.carved;
-      const to = direction === "inbound" ? e.carved : e.survivor;
-      if (!known.has(from) || !known.has(to)) continue;
-      const key = `${from}|${to}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      edges.push({
-        from,
-        to,
-        kind: "ref",
-        viaAttr: direction,
-        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
-      });
-    }
-  }
-  const byStack = {};
-  for (const order of ["good", "warn", "neutral"]) {
-    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
-    if (members.length) byStack[verdictForStatus(order)] = members;
-  }
-  return { nodes, edges, groups: { byStack } };
-}
-function carveNote(report, ir) {
-  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
-  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
-  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
-  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
-}
-
-// src/carve-manifest.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as statSync4 } from "node:fs";
-import { dirname as dirname4, join as join10 } from "node:path";
-var CARVE_MANIFEST_SUFFIX = ".carve.json";
-var APPLY_IS_HUMAN = "`chant carve apply` graduates ownership \u2014 it resolves the marker that makes chant the owner of a live resource. behold shows what the manifest records and echoes the command; it has no apply endpoint and no apply button, by design. Read the graduation plan, then run it yourself.";
-var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
-function parseCarveManifest(value) {
-  if (!isRecord3(value)) return null;
-  if (value.version !== 1) return null;
-  if (typeof value.target !== "string" || !value.target) return null;
-  return value;
-}
-function readCarveManifest(path, readFile = (p) => readFileSync7(p, "utf8")) {
-  let text;
-  try {
-    text = readFile(path);
-  } catch {
-    return null;
-  }
-  try {
-    return parseCarveManifest(JSON.parse(text));
-  } catch {
-    return null;
-  }
-}
-function carveStageOf(m) {
-  if (m.apply) return "applied";
-  if (m.bridge) return "bridged";
-  return "emitted";
-}
-function carveWordFor(stage) {
-  switch (stage) {
-    case "applied":
-      return "carved \u2192 chant";
-    case "bridged":
-      return "bridged \u2014 apply is yours";
-    default:
-      return "emitted \u2014 not bridged";
-  }
-}
-function carveToneFor(stage) {
-  return stage === "applied" ? "good" : "accent";
-}
-function carveStageNote(state) {
-  switch (state.stage) {
-    case "applied":
-      return `graduated \u2014 \`carve apply\` recorded the ownership marker` + (state.ownership?.stack ? ` (stack ${state.ownership.stack}${state.ownership.env ? `, env ${state.ownership.env}` : ""})` : "") + ". chant owns it.";
-    case "bridged":
-      return "emitted and bridged \u2014 the survivor patch is proposed. Terraform still owns the resource until `carve apply`.";
-    default:
-      return "emitted \u2014 typed chant source exists, and the surviving Terraform still reads the resource directly. `carve bridge` is next.";
-  }
-}
-function carveStateOf(m, path) {
-  const stage = carveStageOf(m);
-  const deferred = Object.entries(m.emit?.params ?? {}).map(([name, p]) => `${name} \u2190 ${p?.survivor ?? "a survivor"}`);
-  return {
-    target: m.target,
-    ...m.tfType ? { tfType: m.tfType } : {},
-    stage,
-    graduated: stage === "applied",
-    // The last stamped step wins — that is the age of the state, not the age
-    // of the carve.
-    ...m.apply?.at || m.bridge?.at || m.emit?.at ? { at: m.apply?.at ?? m.bridge?.at ?? m.emit?.at } : {},
-    files: strings(m.emit?.files),
-    excised: strings(m.bridge?.excised),
-    deferredInputs: deferred,
-    ...m.apply ? {
-      ownership: {
-        ...m.apply.marker?.stack ? { stack: m.apply.marker.stack } : {},
-        ...m.apply.marker?.env ? { env: m.apply.marker.env } : {},
-        ...m.apply.ownershipTags ? { tags: m.apply.ownershipTags } : {}
-      }
-    } : {},
-    ...m.from ? { from: m.from } : {},
-    outDir: dirname4(path),
-    path
-  };
-}
-var nodeCarveIo = {
-  readdir: (dir) => readdirSync4(dir),
-  isDirectory: (p) => {
-    try {
-      return statSync4(p).isDirectory();
-    } catch {
-      return false;
-    }
-  },
-  readFile: (p) => readFileSync7(p, "utf8")
-};
-var MANIFEST_SCAN_DEPTH = 2;
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "cdk.out", ".terraform", ".git"]);
-function listCarveManifests(dir, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
-  const out = [];
-  const walk = (d, level) => {
-    let entries;
-    try {
-      entries = io.readdir(d).sort();
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const full = join10(d, name);
-      if (name.endsWith(CARVE_MANIFEST_SUFFIX)) {
-        out.push(full);
-        continue;
-      }
-      if (level >= depth) continue;
-      if (name.startsWith(".") || SKIP_DIRS.has(name)) continue;
-      if (io.isDirectory(full)) walk(full, level + 1);
-    }
-  };
-  walk(dir, 0);
-  return out;
-}
-function readCarveStates(dirs, io = nodeCarveIo, depth = MANIFEST_SCAN_DEPTH) {
-  const rank = { emitted: 0, bridged: 1, applied: 2 };
-  const byTarget = /* @__PURE__ */ new Map();
-  for (const dir of dirs) {
-    for (const path of listCarveManifests(dir, io, depth)) {
-      const manifest = readCarveManifest(path, io.readFile);
-      if (!manifest) continue;
-      const state = carveStateOf(manifest, path);
-      const held = byTarget.get(state.target);
-      if (!held || rank[state.stage] > rank[held.stage]) byTarget.set(state.target, state);
-    }
+    case "carvable w/ edits":
+      return "warn";
+    case "leave in Terraform":
+      return "neutral";
+    default:
+      return score >= 80 ? "good" : score >= 50 ? "warn" : "neutral";
   }
-  return byTarget;
 }
-function carveProgress(states, total) {
-  let applied = 0;
-  let bridged = 0;
-  let emitted = 0;
-  for (const s of states) {
-    if (s.stage === "applied") applied++;
-    else if (s.stage === "bridged") bridged++;
-    else emitted++;
-  }
-  const inFlight = bridged + emitted;
-  const parts = [];
-  if (emitted) parts.push(`${emitted} emitted`);
-  if (bridged) parts.push(`${bridged} bridged`);
-  return {
-    applied,
-    bridged,
-    emitted,
-    inFlight,
-    total: typeof total === "number" ? total : null,
-    label: typeof total === "number" ? `${applied} of ${total} carved` : `${applied} carved`,
-    detail: parts.length ? `${parts.join(", ")} \u2014 apply is yours` : ""
-  };
+function verdictForStatus(status) {
+  return status === "good" ? "carve now" : status === "warn" ? "boundary work" : "leave in Terraform";
 }
-function applyCommandFor(state, labels = {}) {
-  const env = state.ownership?.env ?? "<env>";
-  const stack = state.ownership?.stack ?? "<stack>";
-  const from = labels.from ?? state.from ?? "<terraform-dir>";
-  const out = labels.out ?? state.outDir;
-  return `chant carve apply --from ${from} --output ${out} --env ${env} --stack ${stack} --write-source`;
+function tfTypeOf(address, kind) {
+  if (kind === "module" || address.startsWith("module.")) return "module";
+  const dot = address.indexOf(".");
+  return dot > 0 ? address.slice(0, dot) : address;
 }
-function carveStatePayload(states, total, labels = () => ({})) {
-  const list3 = [...states.values()].sort((a, b) => a.target.localeCompare(b.target));
-  return {
-    manifests: list3.length,
-    progress: carveProgress(list3, total),
-    states: list3.map((s) => ({ ...s, note: carveStageNote(s), applyCommand: applyCommandFor(s, labels(s)) })),
-    apply: { human: true, note: APPLY_IS_HUMAN }
-  };
+var directionOf = (e) => e.direction ?? "inbound";
+function boundaryEdgesOf(r) {
+  const b = r.boundary;
+  if (!b) return [];
+  const list3 = Array.isArray(b) ? b : [...b.inbound ?? [], ...b.outbound ?? []];
+  return list3.filter((e) => isRecord3(e) && typeof e.survivor === "string" && typeof e.carved === "string");
 }
-function splitCarveState(tfIr, states, opts = {}) {
-  if (states.size === 0) return { tf: tfIr, graduated: [] };
-  const shorten = opts.shorten ?? ((p) => p);
-  const source = (files) => files.map(shorten).join(", ");
-  const gone = /* @__PURE__ */ new Set();
-  const graduated = [];
-  const nodes = [];
-  for (const node of tfIr.nodes) {
-    const state = states.get(node.id);
-    if (!state) {
-      nodes.push(node);
-      continue;
-    }
-    if (state.graduated) {
-      gone.add(node.id);
-      graduated.push({
-        ...node,
-        attrs: {
-          ...node.attrs,
-          _status: "good",
-          carve: carveWordFor(state.stage),
-          carveState: state.stage,
-          ...state.ownership?.stack ? { ownedStack: state.ownership.stack } : {},
-          ...state.ownership?.env ? { ownedEnv: state.ownership.env } : {},
-          ...state.at ? { carvedAt: state.at } : {},
-          ...state.files.length ? { chantSource: source(state.files) } : {}
-        }
-      });
-      continue;
-    }
-    nodes.push({
-      ...node,
+function scoreArithmetic(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return `${r.score} (no known native mapping \u2014 nothing to carve into)`;
+  const p = b.penalties ?? {};
+  const terms = [];
+  if (p.inbound) terms.push(`- 12x${b.inbound ?? 0} inbound`);
+  if (p.outbound) terms.push(`- 4x${b.outbound ?? 0} outbound`);
+  if (p.outputs) terms.push(`- 4x${b.outputs ?? 0} output`);
+  if (p.tier) terms.push(`- 15x${(b.tier ?? 1) - 1} tier${b.tier}`);
+  if (p.dynamic) terms.push(`- 10 dynamic`);
+  if (p.instances) terms.push(`- 3x${(b.instances ?? 1) - 1} instances`);
+  if (!terms.length) return `100 (no penalties) = ${r.score}`;
+  const raw = 100 + Object.values(p).reduce((s, n) => s + (n ?? 0), 0);
+  const clamped = raw !== r.score ? ` (clamped from ${raw})` : "";
+  return `100 ${terms.join(" ")} = ${r.score}${clamped}`;
+}
+function boundaryWorkOf(r) {
+  const b = r.breakdown;
+  if (!b || b.tier === null) return "no known native mapping (unsupported provider/type)";
+  const parts = [];
+  if (b.inbound) parts.push(`${b.inbound} inbound (a data-source patch each)`);
+  if (b.outbound) parts.push(`${b.outbound} outbound (a deferred input each)`);
+  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (a one-line rewrite each)`);
+  if ((b.tier ?? 1) > 1) parts.push(`tier ${b.tier} map`);
+  if (b.hasDynamic) parts.push("count/for_each/data present");
+  if ((b.instances ?? 1) > 1) parts.push(`${b.instances} instances`);
+  return parts.length ? parts.join(", ") : "clean 1:1 native map, no boundary edges";
+}
+function carveCardFields(node) {
+  const score = node.attrs.score;
+  const carve = node.attrs.carve;
+  if (typeof score !== "number") return void 0;
+  return [
+    { label: "score", value: String(score) },
+    ...typeof carve === "string" ? [{ label: "carve", value: carve }] : []
+  ];
+}
+function carveReportToIr(report) {
+  const resources = report.resources ?? [];
+  const known = new Set(resources.map((r) => r.address));
+  const nodes = resources.map((r) => {
+    const status = statusForBand(r.band, r.score);
+    const b = r.breakdown ?? {};
+    const edges2 = boundaryEdgesOf(r);
+    const patches = edges2.filter((e) => e.carved === r.address && directionOf(e) === "inbound").map((e) => e.survivor);
+    const inputs = edges2.filter((e) => e.carved === r.address && directionOf(e) === "outbound").map((e) => e.survivor);
+    return {
+      id: r.address,
+      kind: tfTypeOf(r.address, r.kind),
+      lexicon: "terraform",
       attrs: {
-        ...node.attrs,
-        _status: carveToneFor(state.stage),
-        carve: carveWordFor(state.stage),
-        carveState: state.stage,
-        ...state.at ? { carvedAt: state.at } : {},
-        ...state.files.length ? { chantSource: source(state.files) } : {},
-        ...state.excised.length ? { excisesOnApply: state.excised.join(", ") } : {},
-        ...state.deferredInputs.length ? { deferredInputs: state.deferredInputs.join(", ") } : {}
+        // The drift palette's channel — `_`-prefixed, so it paints the card and
+        // stays out of both the card's fields and the inspect pane's list.
+        _status: status,
+        score: r.score,
+        carve: verdictForStatus(status),
+        band: r.band,
+        arithmetic: scoreArithmetic(r),
+        boundaryWork: boundaryWorkOf(r),
+        ...r.mapsTo ? { mapsTo: r.mapsTo } : {},
+        tier: b.tier === null || b.tier === void 0 ? "none" : b.tier,
+        inbound: b.inbound ?? 0,
+        outbound: b.outbound ?? 0,
+        outputs: b.outputs ?? 0,
+        instances: b.instances ?? 1,
+        dynamic: b.hasDynamic ?? false,
+        // The predicted diff, when the report carries the edge lists: who needs
+        // a `data` source the moment this is carved, and what becomes a
+        // deploy-time input. Absent (not empty) when the report has no lists —
+        // "none" and "not reported" are different claims.
+        ...patches.length ? { patchOnCarve: patches.join(", ") } : {},
+        ...inputs.length ? { deferredInputs: inputs.join(", ") } : {}
       }
-    });
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const edges = [];
+  for (const r of resources) {
+    for (const e of boundaryEdgesOf(r)) {
+      const direction = directionOf(e);
+      const from = direction === "inbound" ? e.survivor : e.carved;
+      const to = direction === "inbound" ? e.carved : e.survivor;
+      if (!known.has(from) || !known.has(to)) continue;
+      const key = `${from}|${to}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      edges.push({
+        from,
+        to,
+        kind: "ref",
+        viaAttr: direction,
+        ...e.attrs?.length ? { toAttr: e.attrs.join(", ") } : {}
+      });
+    }
   }
   const byStack = {};
-  for (const [band, members] of Object.entries(tfIr.groups?.byStack ?? {})) {
-    const left = members.filter((id) => !gone.has(id));
-    if (left.length) byStack[band] = left;
+  for (const order of ["good", "warn", "neutral"]) {
+    const members = resources.filter((r) => statusForBand(r.band, r.score) === order).map((r) => r.address);
+    if (members.length) byStack[verdictForStatus(order)] = members;
   }
-  return {
-    tf: {
-      nodes,
-      edges: tfIr.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
-      groups: { ...tfIr.groups, byStack }
-    },
-    graduated
-  };
-}
-var GRADUATED_BAND = "carved \u2192 chant";
-function bandGraduated(tf, graduated) {
-  if (graduated.length === 0) return tf;
-  return {
-    nodes: [...graduated, ...tf.nodes],
-    edges: tf.edges,
-    groups: {
-      ...tf.groups,
-      byStack: {
-        [GRADUATED_BAND]: graduated.map((n) => n.id),
-        ...tf.groups?.byStack ?? {}
-      }
-    }
-  };
+  return { nodes, edges, groups: { byStack } };
 }
-function carveStateNote(progress, states) {
-  if (states.size === 0) return "";
-  const head = ` Carve state (from ${states.size} manifest${states.size === 1 ? "" : "s"}): ${progress.label}`;
-  return progress.detail ? `${head}, ${progress.detail}.` : `${head}.`;
+function carveNote(report, ir) {
+  const counts = Object.entries(report.bands ?? {}).filter(([, n]) => n > 0).map(([band, n]) => `${n} ${band}`).join(" \xB7 ");
+  const head = `chant carve advisory${report.from ? ` for ${report.from}` : ""}${counts ? ` \u2014 ${counts}` : ""}`;
+  if (ir.edges.length) return `${head}. Read-only: nothing is emitted, patched, or applied.`;
+  return `${head}. This report carries per-resource boundary COUNTS but no edge lists, so no boundary edges are drawn (chant#1636). Read-only: nothing is emitted, patched, or applied.`;
 }
 
 // src/ops-lens.ts
@@ -5884,9 +6095,12 @@ function nodeFor(op, placed, guards) {
       ...profile ? { profile } : {},
       ...policy ? { policy } : {},
       // The resolved args, verbatim from the IR. They carry the Op's SCOPE
-      // (env, stack, template path) and never an estate entity id — see the
-      // module doc on why no edge is drawn from them.
+      // (env, stack, template path); which of them identify an ENTITY is the
+      // contract's to say, and 0.54's op.json says it in `entities` below.
       ...args ? { args } : {},
+      // chant#2022: what the step touches, verbatim. `entities` prints on the
+      // card; `_entities` is what `joinStepEntities` resolves.
+      ...step.entities?.length ? { entities: step.entities.join(", "), _entities: step.entities } : {},
       ...step.outcomeAttribute ? { outcome: step.outcomeAttribute.from ? `${step.outcomeAttribute.name} \u2190 ${step.outcomeAttribute.from}` : step.outcomeAttribute.name } : {},
       ...op.activityContracts?.[step.fn] ? { contract: "declared (args/returns JSON Schema in op.json)" } : {}
     }
@@ -5988,17 +6202,83 @@ function opCardFields(node) {
 function opsNote(ops, ir) {
   const gates = ir.nodes.filter((n) => n.attrs._step === "gate").length;
   const rules = ir.nodes.filter((n) => n.attrs._step === "rule");
-  const steps = ir.nodes.length - rules.length;
+  const estate = ir.nodes.filter((n) => n.lexicon !== "op").length;
+  const steps = ir.nodes.length - rules.length - estate;
   const dangling = rules.filter((n) => n.attrs.dangling !== void 0).length;
   const counts = [
     `${ops.length} declared Op${ops.length === 1 ? "" : "s"}`,
     `${steps} step${steps === 1 ? "" : "s"}`,
     ...gates ? [`${gates} gate${gates === 1 ? "" : "s"}`] : [],
-    ...rules.length ? [`${rules.length} converge rule${rules.length === 1 ? "" : "s"}`] : []
+    ...rules.length ? [`${rules.length} converge rule${rules.length === 1 ? "" : "s"}`] : [],
+    ...entityCountClause(ir)
   ].join(" \xB7 ");
   const ruleNote = rules.length ? ` Each converge rule carries the why chant requires of it, verbatim, and a rule whose then is run(<op>) is drawn as an edge to that Op's first step.` + (dangling ? ` ${dangling} rule${dangling === 1 ? " names an Op" : "s name Ops"} not in this set \u2014 stated on the card, not drawn.` : "") : "";
   return `${counts}, from each Op's emitted dist/ops/<name>/op.json.${ruleNote} No estate cross-links: op.json names an Op's env and stack but never an estate entity id, so nothing here is joined to the graph's nodes (chant ask). Read-only: this renders the declared Op \u2014 nothing is started, signalled, or applied.`;
 }
+var ESTATE_BOX = "estate";
+function joinStepEntities(ir, estate) {
+  const steps = ir.nodes.filter((n) => Array.isArray(n.attrs._entities));
+  if (steps.length === 0) return { refs: 0, resolved: 0 };
+  const byId = /* @__PURE__ */ new Map();
+  const byLeaf = /* @__PURE__ */ new Map();
+  for (const n of estate?.nodes ?? []) {
+    byId.set(n.id, n);
+    for (const leaf of stringLeaves(n.attrs)) {
+      const list3 = byLeaf.get(leaf.value);
+      if (list3) {
+        if (!list3.includes(n)) list3.push(n);
+      } else byLeaf.set(leaf.value, [n]);
+    }
+  }
+  const present = new Set(ir.nodes.map((n) => n.id));
+  let refs = 0;
+  let resolvedCount = 0;
+  for (const step of steps) {
+    const links = { resolved: [], unresolved: [] };
+    for (const value of step.attrs._entities) {
+      refs++;
+      const targets = [];
+      const idHit = byId.get(value);
+      if (idHit) targets.push({ node: idHit, via: "id" });
+      for (const n of byLeaf.get(value) ?? []) if (n !== idHit) targets.push({ node: n, via: "attr" });
+      if (targets.length === 0) {
+        links.unresolved.push(value);
+        continue;
+      }
+      resolvedCount++;
+      for (const { node, via } of targets) {
+        links.resolved.push({ value, node: node.id, via });
+        if (!present.has(node.id)) {
+          present.add(node.id);
+          ir.nodes.push({ ...node, attrs: { ...node.attrs, _touchedBy: [step.id] } });
+          (ir.groups.byStack ??= {})[ESTATE_BOX] = [...ir.groups.byStack[ESTATE_BOX] ?? [], node.id];
+        } else {
+          const held = ir.nodes.find((n) => n.id === node.id);
+          const touched = held.attrs._touchedBy ?? [];
+          if (!touched.includes(step.id)) held.attrs._touchedBy = [...touched, step.id];
+        }
+        ir.edges.push({ from: step.id, to: node.id, kind: "ref", viaAttr: "entities" });
+      }
+    }
+    step.attrs._entityLinks = links;
+  }
+  return { refs, resolved: resolvedCount };
+}
+function entityCountClause(ir) {
+  let refs = 0;
+  let resolved = 0;
+  for (const n of ir.nodes) {
+    const links = n.attrs._entityLinks;
+    if (links) {
+      refs += links.resolved.length + links.unresolved.length;
+      resolved += links.resolved.length;
+    } else if (Array.isArray(n.attrs._entities)) {
+      refs += n.attrs._entities.length;
+    }
+  }
+  if (refs === 0) return [];
+  return [`${refs} entity ref${refs === 1 ? "" : "s"}, ${resolved} linked`];
+}
 
 // src/render.ts
 registerPack({ lexicon: "k8s", iconFor: k8sIconFor });
@@ -6112,7 +6392,10 @@ function renderCarveEstate(tfIr, appIr, opts) {
 }
 function withCarveState(tfIr, appIr, opts) {
   const states = opts.carved ?? /* @__PURE__ */ new Map();
-  const { tf, graduated } = splitCarveState(tfIr, states, { ...opts.shorten ? { shorten: opts.shorten } : {} });
+  const { tf, graduated } = splitCarveState(tfIr, states, {
+    ...opts.shorten ? { shorten: opts.shorten } : {},
+    ...opts.emitted ? { emitted: opts.emitted } : {}
+  });
   const ns = namespaceAppIr(appIr, opts.appTitle);
   const progress = carveProgress(states.values(), tfIr.nodes.length);
   return {
@@ -6452,12 +6735,12 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
 }
 
 // src/carve-actions.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync5 } from "node:fs";
-import { isAbsolute, join as join13, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, readdirSync as readdirSync6, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join14, relative as relative3, resolve as resolve5, sep as sep2 } from "node:path";
 
 // src/layout.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -6498,7 +6781,7 @@ function lensFromQuery(params) {
   return [slug(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join11(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join12(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
   if (!projectDir || !existsSync6(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
@@ -6554,7 +6837,7 @@ function writeLens(projectDir, lens, deltas) {
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync2(join11(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync2(join12(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
   writeFileSync2(tmp, body, "utf8");
   renameSync(tmp, file);
@@ -6640,7 +6923,7 @@ function reanchorEdges(svg, moved) {
 // src/carve-live.ts
 import { spawn as spawn3 } from "node:child_process";
 import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 
 // src/scratch.ts
 var PROTECTED_INFRA = [
@@ -6728,9 +7011,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join12(fromDir, "floci-override.tf.disabled");
+  const template = join13(fromDir, "floci-override.tf.disabled");
   if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync3(join12(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
+  writeFileSync3(join13(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -6780,7 +7063,7 @@ async function runCarveObserve(demo, select) {
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync8(join13(demo.out, "src"))) {
+  if (!existsSync8(join14(demo.out, "src"))) {
     return refuse3("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
@@ -6850,8 +7133,8 @@ var refuse3 = (code, error, remedy) => ({
 });
 var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
 function insideDemo(root, p) {
-  const rel = relative2(resolve4(root), resolve4(p));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+  const rel = relative3(resolve5(root), resolve5(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function selectFromReport(report, raw) {
   if (typeof raw !== "string" || !raw || raw.length > 512) return null;
@@ -6871,17 +7154,17 @@ function readArtifacts(demo, dir, filter) {
     if (out.length >= MAX_ARTIFACTS || depth > 2) return;
     let entries;
     try {
-      entries = readdirSync5(d).sort();
+      entries = readdirSync6(d).sort();
     } catch {
       return;
     }
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join13(d, name);
+      const full = join14(d, name);
       let st;
       try {
-        st = statSync5(full);
+        st = statSync6(full);
       } catch {
         continue;
       }
@@ -6889,7 +7172,7 @@ function readArtifacts(demo, dir, filter) {
         walk(full, depth + 1);
         continue;
       }
-      const rel = relative2(demo.root, full).split(sep2).join("/");
+      const rel = relative3(demo.root, full).split(sep2).join("/");
       if (!filter(rel)) continue;
       let text = "";
       try {
@@ -6925,7 +7208,7 @@ async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync3(demo.out, { recursive: true });
-  const reportFile = join13(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join14(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -6957,7 +7240,7 @@ async function runCarveEmit(demo, select) {
     boundary = JSON.parse(readFileSync10(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative2(demo.project, join13(demo.out, "src")).split(sep2).join("/");
+  const lintPath = relative3(demo.project, join14(demo.out, "src")).split(sep2).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -7020,8 +7303,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
+import { join as join15 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -7043,11 +7326,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join14(projectDir, sub);
+    const dir = join15(projectDir, sub);
     if (!existsSync9(dir)) continue;
-    for (const f of readdirSync6(dir)) {
+    for (const f of readdirSync7(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync11(join14(dir, f), "utf8");
+      const content = readFileSync11(join15(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -7070,15 +7353,15 @@ function discoverOps(projectDir) {
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function opIrPath(projectDir, name) {
-  return join14(projectDir, "dist", "ops", name, "op.json");
+  return join15(projectDir, "dist", "ops", name, "op.json");
 }
 function discoverOpIrs(projectDirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of projectDirs) {
-    const root = join14(dir, "dist", "ops");
+    const root = join15(dir, "dist", "ops");
     if (!existsSync9(root)) continue;
-    for (const name of readdirSync6(root)) {
+    for (const name of readdirSync7(root)) {
       if (seen.has(name)) continue;
       const path = opIrPath(dir, name);
       if (!existsSync9(path)) continue;
@@ -7316,11 +7599,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join21, gate) {
-  if (!join21.byNode.size && !join21.at) return ir;
+function paintPlayhead(ir, join22, gate) {
+  if (!join22.byNode.size && !join22.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join21.byNode.get(node.id);
-    const here = join21.at === node.id;
+    const run3 = join22.byNode.get(node.id);
+    const here = join22.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -7335,7 +7618,7 @@ function paintPlayhead(ir, join21, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join21.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join22.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -7357,11 +7640,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join21) {
+function playheadNote(state, join22) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join21 ? join21.byNode.size : state.records.length;
+  const settled = join22 ? join22.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -7377,9 +7660,9 @@ function playheadNote(state, join21) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join21?.unplaced.length) {
+  if (join22?.unplaced.length) {
     bits.push(
-      `${join21.unplaced.length} record${join21.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join21.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join22.unplaced.length} record${join22.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join22.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -8046,23 +8329,23 @@ var OpRunner = class {
 // src/substrates.ts
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let out = "";
     let proc;
     try {
       proc = spawn4(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve9({ code: 127, out: "" });
+      resolve10({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve9({ code: 127, out }));
-    proc.on("close", (code) => resolve9({ code: code ?? 1, out }));
+    proc.on("error", () => resolve10({ code: 127, out }));
+    proc.on("close", (code) => resolve10({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable(run3) {
@@ -8075,11 +8358,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync10(join15(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync10(join16(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync12(join15(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync12(join16(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -8131,7 +8414,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync10(join15(projectDir, marker))) continue;
+    if (!existsSync10(join16(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -8165,7 +8448,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync10(join15(projectDir, ".github", "workflows"))) {
+  if (existsSync10(join16(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -8178,7 +8461,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync12(join15(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync12(join16(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -8282,12 +8565,12 @@ async function openRollbackBranches(projectDir, env) {
 }
 
 // src/estate-edges.ts
-import { statSync as statSync6 } from "node:fs";
+import { statSync as statSync7 } from "node:fs";
 var rec5 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str5 = (v) => typeof v === "string" && v.length > 0 ? v : void 0;
 var realIsDir2 = (p) => {
   try {
-    return statSync6(p).isDirectory();
+    return statSync7(p).isDirectory();
   } catch {
     return false;
   }
@@ -8387,7 +8670,7 @@ function addEstateMemberEdges(ir, members, isDir = realIsDir2) {
 
 // src/events.ts
 import { watch, existsSync as existsSync11 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -8405,7 +8688,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync11(join16(projectDir, "src")) ? join16(projectDir, "src") : projectDir;
+  const dir = existsSync11(join17(projectDir, "src")) ? join17(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -8694,12 +8977,12 @@ async function emulatorDown(projectDir) {
 
 // src/demos.ts
 import { readFileSync as readFileSync13, existsSync as existsSync12, cpSync } from "node:fs";
-import { join as join17, relative as relative3, resolve as resolve5, sep as sep3 } from "node:path";
+import { join as join18, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
 import { spawn as spawn5, spawnSync } from "node:child_process";
 function loadDemoRegistry(pkgRoot2) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(join17(pkgRoot2, "demos.json"), "utf8"));
+    raw = JSON.parse(readFileSync13(join18(pkgRoot2, "demos.json"), "utf8"));
   } catch {
     return [];
   }
@@ -8739,22 +9022,22 @@ function fetchesFromNetwork(entry) {
   return entry.source === "git";
 }
 function demoTargetDir(entry, cwd = process.cwd()) {
-  const legacy = resolve5(cwd, "behold-demo");
+  const legacy = resolve6(cwd, "behold-demo");
   if (entry.name === "writes" && existsSync12(legacy)) return legacy;
-  return resolve5(cwd, "behold-demos", entry.name);
+  return resolve6(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot2, target } = opts;
   const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
   if (!existsSync12(target)) {
     if (entry.source === "bundled") {
-      const bundled = join17(pkgRoot2, entry.dir);
+      const bundled = join18(pkgRoot2, entry.dir);
       if (!existsSync12(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(bundled, target, {
           recursive: true,
-          filter: (src) => !relative3(bundled, src).split(sep3).includes("node_modules")
+          filter: (src) => !relative4(bundled, src).split(sep3).includes("node_modules")
         });
       } catch (err) {
         return { ok: false, error: `copy failed: ${err instanceof Error ? err.message : String(err)}` };
@@ -8768,7 +9051,7 @@ async function loadDemo(entry, opts) {
   } else {
     say(`reusing ${target}`);
   }
-  if (existsSync12(join17(target, "package.json")) && !existsSync12(join17(target, "node_modules"))) {
+  if (existsSync12(join18(target, "package.json")) && !existsSync12(join18(target, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${target}` };
@@ -8780,7 +9063,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join17(target, d)) : [target] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join18(target, d)) : [target] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -8791,8 +9074,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join18(dirname5(fileURLToPath3(import.meta.url)), "..");
-var webRoot = join18(pkgRoot, "web");
+var pkgRoot = join19(dirname5(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join19(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -8842,7 +9125,7 @@ function tierFailure(tier, message) {
 function beholdVersion() {
   try {
     const here = dirname5(fileURLToPath3(import.meta.url));
-    return JSON.parse(readFileSync14(join18(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync14(join19(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -8890,6 +9173,11 @@ function carveRoutes(app, reportPath, demo) {
   const load = () => readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
   const carveDirs = [dirname5(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
+  const emittedNodes = async (states) => {
+    if (!demo || states.size === 0) return /* @__PURE__ */ new Map();
+    const outIr = await memberIr(demo.out).catch(() => void 0);
+    return emittedNodesFor(outIr, states.values(), demo.out);
+  };
   const demoBlock = () => carveWriteBlock(demo);
   const demoInfo = () => {
     if (!demo) return null;
@@ -8901,8 +9189,8 @@ function carveRoutes(app, reportPath, demo) {
       project: demo.project,
       out: demo.out,
       // Paths the UI can print without leaking the operator's whole home dir.
-      outLabel: relative4(demo.root, demo.out).split(sep4).join("/"),
-      fromLabel: relative4(demo.root, demo.from).split(sep4).join("/"),
+      outLabel: relative5(demo.root, demo.out).split(sep4).join("/"),
+      fromLabel: relative5(demo.root, demo.from).split(sep4).join("/"),
       runnable: !block,
       ...block ? { reason: block } : {},
       // The live tier, when this boot armed it: the scratch endpoint the
@@ -8919,7 +9207,7 @@ function carveRoutes(app, reportPath, demo) {
   let appGraph;
   const appGraphOnce = () => {
     if (!demo) return Promise.resolve(null);
-    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative4(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
+    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative5(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
     return appGraph;
   };
   app.get("/api/graph", async (c) => {
@@ -8928,16 +9216,18 @@ function carveRoutes(app, reportPath, demo) {
     const tfIr = carveReportToIr(parsed.report);
     const appSide = await appGraphOnce();
     const states = carveStates();
+    const emitted = await emittedNodes(states);
     const shorten = demo ? (p) => shortenIn(p, demo.root) : (p) => p;
     const single = () => {
-      const split = splitCarveState(tfIr, states, { shorten });
+      const split = splitCarveState(tfIr, states, { shorten, emitted });
       return bandGraduated(split.tf, split.graduated);
     };
     const { svg, ir } = appSide ? renderCarveEstate(tfIr, appSide.ir, {
-      tfTitle: `${relative4(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      tfTitle: `${relative5(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
       appTitle: `${appSide.label} \u2014 chant`,
       carved: states,
-      shorten
+      shorten,
+      emitted
     }) : (() => {
       const banded = single();
       return { ...renderBanded(banded), ir: banded };
@@ -8985,7 +9275,7 @@ function carveRoutes(app, reportPath, demo) {
     }
     const tfIr = carveReportToIr(parsed.report);
     const html = renderCarveMorph(tfIr, appSide.ir, [select], {
-      tfTitle: `${relative4(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      tfTitle: `${relative5(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
       appTitle: `${appSide.label} \u2014 chant`,
       title: `carve \u2014 ${select}`,
       carved: carveStates(),
@@ -8993,7 +9283,7 @@ function carveRoutes(app, reportPath, demo) {
     });
     return c.html(html);
   });
-  app.get("/api/project", (c) => {
+  app.get("/api/project", async (c) => {
     const parsed = load();
     const total = parsed.ok ? parsed.report.count ?? parsed.report.resources.length : null;
     const state = carveStatePayload(
@@ -9088,6 +9378,20 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   if (cfg.carveReport) carveRoutes(app, cfg.carveReport, cfg.carveDemo);
   let beholdConfig = loadBeholdConfig(cfg.projectDir);
   let tierEnvVar = beholdConfig.tiers?.envVar;
+  const executorFor = (env) => env ? beholdConfig.executor?.[env] : void 0;
+  const executorStatus = (env, d, pipeline) => {
+    if ("invalid" in d) return { ok: false, reason: d.invalid };
+    if (d.forge !== "github") {
+      return { forge: d.forge, workflow: d.workflow, ok: false, reason: `env ${env} deploys through ${d.forge} per .behold.json, and behold has no ${d.forge} trigger (only GitHub Actions, via your gh) \u2014 Deploy stays disabled here; run the pipeline on the forge` };
+    }
+    const r = resolveWorkflow(cfg.projectDir, pipeline ?? { stages: [], jobs: [] }, d.workflow);
+    return "workflow" in r ? { forge: d.forge, workflow: d.workflow, ok: true } : { forge: d.forge, workflow: d.workflow, ok: false, reason: r.reason };
+  };
+  const forgeRefusal = (env, d, what) => ({
+    error: `${what} is refused: env ${env} deploys through ${"invalid" in d ? "a forge" : `${d.forge} (${d.workflow})`} per .behold.json's executor block \u2014 behold never runs it from this machine`,
+    code: "executor-forge",
+    remedy: "invalid" in d ? `Fix .behold.json: ${d.invalid}` : `Use Deploy (POST /api/ci/dispatch?env=${env}), which dispatches the designated workflow through your gh login.`
+  });
   const boundK8sContext = async (env) => {
     try {
       const { lexicons, k8sProfiles } = await detectProject(cfg.projectDir);
@@ -9149,6 +9453,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (!info) {
       return c.json({ error: `no Op named "${name}" in the estate` }, 404);
     }
+    const designatedEnv = info.kind === "apply" ? executorFor(info.env) : void 0;
+    if (designatedEnv && info.env) return c.json(forgeRefusal(info.env, designatedEnv, `running ${name}`), 409);
     if (!runner.trigger(name, info.env, info.dir, Boolean(info.gate))) {
       return c.json({ error: `an Op is already running (${runner.running})` }, 409);
     }
@@ -9180,8 +9486,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join18(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join18(cfg.projectDir, "scripts/local/local-up.sh");
+    const down = join19(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join19(cfg.projectDir, "scripts/local/local-up.sh");
     if (!existsSync13(down) || !existsSync13(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
@@ -9318,7 +9624,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const k8sTarget = lexicons.includes("k8s") ? resolveK8sTarget(k8sProfiles, cfg.env, await loadKubeconfig()) : void 0;
     const axes = deployAxes(tierEnvVar, lexicons, k8sTarget);
     const emittedOps = discoverOpIrs(estateDirs).length;
-    const carveState = carveStatePayload(readCarveStates(estateDirs));
+    const carveState = carveStatePayload(await carveStatesUnder(estateDirs));
     return c.json({
       projectDir: cfg.projectDir,
       ...carveState.manifests ? { carve: { state: carveState } } : {},
@@ -9345,6 +9651,10 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       // no `tiers` key) → no `tiers` field → the SPA's picker doesn't render
       // and the graph loads with no tier selected (web/app.js `initPickers`).
       ...beholdConfig.tiers ? { tiers: beholdConfig.tiers.values } : {},
+      // The executor contract (#165): per designated env, whether Deploy can
+      // dispatch right now and, if not, why — so the SPA disables the gesture
+      // with the reason rather than offering a control that 4xxs.
+      ...beholdConfig.executor ? { executor: Object.fromEntries(Object.entries(beholdConfig.executor).map(([env, d]) => [env, executorStatus(env, d)])) } : {},
       // The stack picker's options (#76, follow-up to #71): gated exactly like
       // `tiers` above — only present when `chant.config.ts` declares `stacks[]`
       // at all, so a single-stack/sourceDir-only/legacy project's SPA renders no
@@ -9369,9 +9679,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve6(body.dir.trim()) : "";
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve7(body.dir.trim()) : "";
     if (!dir || !existsSync13(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync13(join18(dir, "chant.config.ts"))) {
+    if (!existsSync13(join19(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -9391,7 +9701,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve6(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve7(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -9459,7 +9769,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
       if (!loaded.ok) return c.json({ error: loaded.error }, 500);
       const dirs = loaded.serveDirs;
-      if (!existsSync13(join18(dirs[0], "chant.config.ts"))) {
+      if (!existsSync13(join19(dirs[0], "chant.config.ts"))) {
         return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
       }
       if (entry.serve.local) {
@@ -9557,7 +9867,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           path: "/api/demos/open",
           desc: "load a demo and serve it: JSON body {name} (a catalog name, never a path) \u2014 copies/clones, installs, runs its setup, then switches (preview-locked)"
         },
-        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, ops=1, env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
+        { method: "GET", path: "/api/graph", desc: "the graph {ir, svg, meta} \u2014 params: detail=0..3, components=1, logical=1, ops=1 (+entities=1 to link steps to the estate), env, stack, tier, target, lens, up=1, down=1, radial=1, layout=1" },
         ...cfg.carveReport ? [
           { method: "GET", path: "/api/carve", desc: "carve mode: the raw `chant carve advise --json` peelability report this server is rendering" },
           {
@@ -9594,7 +9904,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "POST", path: "/api/rollback", desc: "open a rollback PR: ?to=<sha>" },
         { method: "POST", path: "/api/substrates/:name/up", desc: "bring a substrate up" },
         { method: "POST", path: "/api/local/reset", desc: "reset the local emulator" },
-        { method: "POST", path: "/api/ci/dispatch", desc: "dispatch the GitHub Actions pipeline via the operator's gh" }
+        { method: "POST", path: "/api/ci/dispatch", desc: "dispatch the GitHub Actions pipeline for ?env= via the operator's gh \u2014 the designated workflow when .behold.json names one" }
       ]
     })
   );
@@ -9621,10 +9931,16 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           parsedOps.push(parsed.ir);
         }
         const declaredIr = opsToIr(parsedOps);
+        if (url.searchParams.get("entities") === "1") {
+          const memberDirs = [...new Set(files.map((f) => f.dir))];
+          const memberReads = await Promise.allSettled(memberDirs.map((dir) => memberIr(dir)));
+          const estateNodes = memberReads.flatMap((r) => r.status === "fulfilled" ? r.value.nodes : []);
+          joinStepEntities(declaredIr, estateNodes.length ? { nodes: estateNodes, edges: [], groups: {} } : void 0);
+        }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join21 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join21 ? paintPlayhead(declaredIr, join21, runState.gate) : declaredIr;
+        const join22 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join22 ? paintPlayhead(declaredIr, join22, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -9637,7 +9953,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join21)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join22)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -9709,6 +10025,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         return c.json({ ir: projected, svg: svg2, byContainer, meta: { projectDir: cfg.projectDir, env: metaEnv, tier: opts.tier ?? null, target: opts.target ?? null, mode: "logical", ...logicalNote ? { note: logicalNote } : {} } });
       } else {
         ir = mergeClusterRoot(await graphIr(cfg.projectDir, opts), await clusterRootGraphIr(cfg.projectDir, opts));
+        ir = joinCarvedSources(ir, (await carveStatesFor(cfg.projectDir)).values(), cfg.projectDir).ir;
         if ((opts.detail ?? 2) < 3) ir = pruneImports(ir);
         ir = addK8sDeclaredEdges(ir);
         ir = addValueMatchEdges(ir);
@@ -9726,7 +10043,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join18(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join19(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -9773,23 +10090,28 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
   });
   app.post("/api/ci/dispatch", async (c) => {
+    const env = new URL(c.req.url).searchParams.get("env") ?? cfg.env;
+    const designated = executorFor(env);
+    if (designated && "invalid" in designated) return c.json({ error: designated.invalid, code: "executor-forge", remedy: "Fix .behold.json's executor block." }, 400);
+    if (designated && designated.forge !== "github") {
+      return c.json({ error: executorStatus(env, designated).reason, code: "executor-forge" }, 400);
+    }
     const ready = await ghReady();
     if (!ready.ok) return c.json({ error: ready.reason }, 400);
-    const pipeline = await ciPipeline(cfg.projectDir, cfg.env ? { env: cfg.env } : {}, "github").catch(() => void 0);
+    const pipeline = await ciPipeline(cfg.projectDir, env ? { env } : {}, "github").catch(() => void 0);
     if (!pipeline || pipeline.jobs.length === 0) {
       return c.json({ error: "no generated GitHub pipeline \u2014 `chant build --components --generate github` produced no jobs" }, 400);
     }
-    const workflow = pickWorkflow(cfg.projectDir, pipeline);
-    if (!workflow) {
-      return c.json({ error: "no committed workflow_dispatch workflow whose jobs match the generated pipeline \u2014 commit one (or add `workflow_dispatch:` to its `on:` block)" }, 400);
-    }
+    const resolved = resolveWorkflow(cfg.projectDir, pipeline, designated?.workflow);
+    if ("reason" in resolved) return c.json({ error: resolved.reason, ...designated ? { code: "executor-forge" } : {} }, 400);
+    const workflow = resolved.workflow;
     const ref = await execFileP("git", ["-C", cfg.projectDir, "branch", "--show-current"]).then((out) => out.trim() || "main").catch(() => "main");
     const started = runner.track(
       `GitHub Actions ${workflow.file}`,
       (io) => dispatchAndFollow(workflow, pipeline, ref, { onLine: io.line, onProgress: io.progress })
     );
     if (!started) return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
-    return c.json({ started: true, workflow: workflow.file, ref, jobs: pipeline.jobs.length });
+    return c.json({ started: true, workflow: workflow.file, ref, jobs: pipeline.jobs.length, ...env ? { env } : {}, designated: Boolean(designated) });
   });
   app.get("/api/resources", async (c) => {
     const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
@@ -9884,7 +10206,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         });
       }
       const opts = { ...query, live: true, overlay: true, env, ...logical || runtime ? { detail: 3 } : {} };
-      let ir = reclassifyOverlay(await graphIr(cfg.projectDir, opts));
+      let ir = joinCarvedSources(reclassifyOverlay(await graphIr(cfg.projectDir, opts)), (await carveStatesFor(cfg.projectDir)).values(), cfg.projectDir).ir;
       const boundContext = await boundK8sContext(env);
       ir = mergeClusterRoot(ir, await clusterRootGraphIr(cfg.projectDir, query), await runningK3dClusters());
       const declaresHelm = await detectProject(cfg.projectDir).then((p) => p.lexicons.includes("helm")).catch(() => false);
@@ -9892,7 +10214,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const observed = await lifecycleDiffLive(cfg.projectDir, env, query).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
         applyHelmArtifacts(ir, observed);
         synthesizeHelmReleases(ir, observed, discoverReleaseUnits(cfg.projectDir));
-        applyHelmRenderDrift(ir, await readHelmRenderDrift(cfg.projectDir, env, query));
+        applyHelmRenderDrift(ir, await readHelmRenderDrift(cfg.projectDir, env, query, observed));
       }
       ir = runtime ? attachRuntimeContainment(ir) : pruneRuntimeChildren(ir);
       if (logical) {
@@ -9943,7 +10265,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const observed = await lifecycleDiffLive(cfg.projectDir, env).then((d) => d.lexicons?.helm?.observedArtifacts).catch(() => void 0);
         applyHelmArtifacts(result.ir, observed);
         synthesizeHelmReleases(result.ir, observed, discoverReleaseUnits(cfg.projectDir));
-        applyHelmRenderDrift(result.ir, await readHelmRenderDrift(cfg.projectDir, env));
+        applyHelmRenderDrift(result.ir, await readHelmRenderDrift(cfg.projectDir, env, {}, observed));
       }
     }
     if (env) {
@@ -10047,6 +10369,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     const component = url.searchParams.get("component") || "all";
     const force = url.searchParams.get("force") === "1";
+    const designated = executorFor(env);
+    if (designated) return c.json(forgeRefusal(env, designated, "apply"), 409);
     const flociTargeted = !!process.env.AWS_ENDPOINT_URL && await detectProject(cfg.projectDir).then((p) => p.lexicons.includes("aws")).catch(() => false);
     if (!force && flociTargeted) {
       try {
@@ -10071,9 +10395,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
     return c.json({ started: true, component, env });
   });
-  const rel = relative4(process.cwd(), webRoot) || ".";
+  const rel = relative5(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join18(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join19(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -10102,7 +10426,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync13(join18(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync13(join19(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -10128,11 +10452,19 @@ async function startServer(cfg) {
     if (autoSync === "off") return;
     void routeAutoSync(dir, movedLexicons);
   };
+  const executorDesignations = loadBeholdConfig(cfg.projectDir).executor ?? {};
+  const executorFor = (env) => env ? executorDesignations[env] : void 0;
   const routeAutoSync = async (dir, movedLexicons) => {
     const suspended = autoSync === "pull-request" ? suspendedByRollback(await openRollbackBranches(dir, cfg.env), movedLexicons) : /* @__PURE__ */ new Set();
+    const allOps = discoverEstateOps(cfg.projectDirs ?? [cfg.projectDir]);
+    const routed = allOps.filter((o) => o.kind === "apply" && o.env && executorFor(o.env));
+    for (const o of routed) {
+      const d = executorFor(o.env);
+      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined ${o.name}: env ${o.env} deploys through ${"invalid" in d ? "a forge" : d.forge} per .behold.json \u2014 never applied from here`);
+    }
     const { picks, declined } = pickAutoSyncOps(
       autoSync,
-      discoverEstateOps(cfg.projectDirs ?? [cfg.projectDir]),
+      allOps.filter((o) => !routed.includes(o)),
       runner.running,
       movedLexicons,
       suspended
@@ -10241,8 +10573,8 @@ async function startServer(cfg) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync15, readdirSync as readdirSync7 } from "node:fs";
-import { join as join19, dirname as dirname6, basename as basename2 } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync15, readdirSync as readdirSync8 } from "node:fs";
+import { join as join20, dirname as dirname6, basename as basename2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var LENS_PARAMS = ["components", "detail", "env", "logical", "ops", "radial", "tier"];
 function canonicalKey(path, params) {
@@ -10260,7 +10592,7 @@ function captureKeys(axes) {
   add("/api/project", {});
   add("/api/substrates", {});
   add("/api/ops", {});
-  if (axes.ops) add("/api/graph", { ops: "1" });
+  if (axes.ops) add("/api/graph", { ops: "1", entities: "1" });
   const tiers = axes.tiers && axes.tiers.length ? axes.tiers : [""];
   const envs = ["", ...axes.environments];
   for (const env of envs) {
@@ -10291,7 +10623,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join19(dirname6(fileURLToPath4(import.meta.url)), "..", "web");
+  return join20(dirname6(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename2(project)}`;
@@ -10302,7 +10634,7 @@ async function runExport(cfg, outDir, opts = {}) {
   const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [], ...proj.ops ? { ops: proj.ops } : {} };
-  const snapDir = join19(outDir, "snapshots");
+  const snapDir = join20(outDir, "snapshots");
   mkdirSync4(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -10311,7 +10643,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
     const file = slug2(key);
-    writeFileSync4(join19(snapDir, file), body);
+    writeFileSync4(join20(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -10323,21 +10655,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync4(join19(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync15(join19(webDir(), "index.html"), "utf8").replace(
+  writeFileSync4(join20(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync15(join20(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync4(join19(outDir, "index.html"), html);
-  for (const f of readdirSync7(webDir())) {
+  writeFileSync4(join20(outDir, "index.html"), html);
+  for (const f of readdirSync8(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join19(webDir(), f), join19(outDir, f));
+    copyFileSync(join20(webDir(), f), join20(outDir, f));
   }
-  writeFileSync4(join19(outDir, "README.md"), BUNDLE_README);
+  writeFileSync4(join20(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
   writeFileSync4(
-    join19(outDir, "wrangler.jsonc"),
+    join20(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -10385,7 +10717,7 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 `;
 
 // src/doctor.ts
-import { relative as relative5, resolve as resolve7 } from "node:path";
+import { relative as relative6, resolve as resolve8 } from "node:path";
 var list2 = (xs) => xs.join(", ");
 var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
 function summarize(xs, max = 4) {
@@ -10393,7 +10725,7 @@ function summarize(xs, max = 4) {
 }
 function labelFor(root, target, estate) {
   if (!estate) return "";
-  const rel = relative5(root, target);
+  const rel = relative6(root, target);
   return `${rel || "."}: `;
 }
 function chantCheck(root, targets, estate) {
@@ -10406,7 +10738,7 @@ function chantCheck(root, targets, estate) {
       name: "chant",
       status: "fail",
       detail: `${list2(resolutions.map(describe))} \u2014 behold shells the project's own chant`,
-      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative5(root, target) || target))}`
+      fix: `Run \`npm install\` in ${list2(missing.map(({ target }) => relative6(root, target) || target))}`
     };
   }
   const stale = resolutions.filter(({ res }) => !meetsFloor(res.version, floor));
@@ -10534,7 +10866,7 @@ function opsCheck(root, ops, chantSource, estate) {
   return { name: "ops", status: "pass", detail: `${ops.length} committed: ${list2(names)}; ${mcp}` };
 }
 async function diagnose(dir, probes = {}) {
-  const root = resolve7(dir);
+  const root = resolve8(dir);
   const shape = detectProjectShape(root);
   const behold = beholdVersion();
   if (shape.kind === "none") {
@@ -10554,16 +10886,16 @@ async function diagnose(dir, probes = {}) {
     };
   }
   const estate = shape.kind === "estate";
-  const members = (shape.members ?? []).map((m) => resolve7(root, m));
+  const members = (shape.members ?? []).map((m) => resolve8(root, m));
   const targets = estate ? members : [root];
   const primary = targets[0];
   const projectCheck = estate ? {
     name: "project",
     status: "pass",
     detail: `estate of ${members.length} projects (${shape.membersFrom === "behold-config" ? ".behold.json members" : "npm workspaces"}): ${list2(
-      members.map((m) => relative5(root, m))
+      members.map((m) => relative6(root, m))
     )}`
-  } : { name: "project", status: "pass", detail: `chant project (${relative5(root, shape.configFile)})` };
+  } : { name: "project", status: "pass", detail: `chant project (${relative6(root, shape.configFile)})` };
   const infos = await Promise.all(targets.map(async (t) => ({ target: t, info: await detectProject(t) })));
   const declared = new Map(infos.map(({ target, info }) => [target, info.lexicons]));
   const lexicons = [...new Set(infos.flatMap(({ info }) => info.lexicons))];
@@ -10788,7 +11120,7 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve8(d));
+  const dirs = projectDirs.map((d) => resolve9(d));
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -10807,7 +11139,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join20(dir, m)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join21(dir, m)).join(" ")}
 `
     );
     return;
@@ -10842,7 +11174,7 @@ async function runCarve(rest) {
     );
     process.exit(2);
   }
-  const reportPath = resolve8(fileArg);
+  const reportPath = resolve9(fileArg);
   const parsed = readCarveReport(reportPath, (p) => readFileSync16(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
@@ -10870,8 +11202,8 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync14(resolve8(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve8(dir)}
+  if (!existsSync14(resolve9(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve9(dir)}
 `);
     process.exit(2);
   }
@@ -10880,7 +11212,7 @@ async function runDoctor(rest) {
   if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot2 = join20(dirname7(fileURLToPath5(import.meta.url)), "..");
+  const pkgRoot2 = join21(dirname7(fileURLToPath5(import.meta.url)), "..");
   const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
   let live = false;
@@ -10934,7 +11266,7 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = dirArg ? resolve8(dirArg) : demoTargetDir(entry);
+  const target = dirArg ? resolve9(dirArg) : demoTargetDir(entry);
   const loaded = await loadDemo(entry, { pkgRoot: pkgRoot2, target, log: (line) => process.stdout.write(line + "\n") });
   if (!loaded.ok) {
     process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
@@ -10965,7 +11297,7 @@ function spawnStep(cmd, args, cwd) {
   });
 }
 async function serveCarveDemo(target, carve, port, live = false) {
-  const at = (rel) => resolve8(target, rel);
+  const at = (rel) => resolve9(target, rel);
   const project = at(carve.project);
   const from = at(carve.from);
   const state = carve.state ? at(carve.state) : void 0;
@@ -11005,7 +11337,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync14(join20(project, "package.json")) && !existsSync14(join20(project, "node_modules"))) {
+  if (existsSync14(join21(project, "package.json")) && !existsSync14(join21(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -11016,7 +11348,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     }
   }
   let degraded;
-  if (!existsSync14(join20(target, "node_modules", "@cdktf", "hcl2json"))) {
+  if (!existsSync14(join21(target, "node_modules", "@cdktf", "hcl2json"))) {
     process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
     if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
@@ -11085,7 +11417,7 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve8(dirArg ?? process.cwd());
+  const projectDir = resolve9(dirArg ?? process.cwd());
   if (!existsSync14(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
@@ -11106,21 +11438,21 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve8("behold-export");
+  let outDir = resolve9("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve8(rest[++i]);
+    if (a === "--out") outDir = resolve9(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve8(dirArg ?? process.cwd());
+  const projectDir = resolve9(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";