@intentius/behold 0.16.0 → 0.17.0

package/dist/cli.js

@@ -716,11 +716,11 @@ async function createK8sClient(options = {}) {
     }
     return void 0;
   }
-  async function resolve10(selector, signal) {
+  async function resolve12(selector, signal) {
     return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
   }
   async function resolveOrThrow(selector, signal) {
-    const info = await resolve10(selector, signal);
+    const info = await resolve12(selector, signal);
     if (!info) throw new UnknownResourceError(selectorText(selector));
     return info;
   }
@@ -732,7 +732,7 @@ async function createK8sClient(options = {}) {
     return parts.join("/");
   }
   async function pathFor(ref, signal) {
-    const info = await resolve10({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    const info = await resolve12({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
     if (!info) return void 0;
     return objectPath(info, ref.name, ref.namespace);
   }
@@ -872,7 +872,7 @@ async function createK8sClient(options = {}) {
   return {
     provenance,
     defaultNamespace,
-    resolve: resolve10,
+    resolve: resolve12,
     read,
     pathFor,
     readIfPresent,
@@ -1065,8 +1065,8 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve9, dirname as dirname7, join as join21 } from "node:path";
-import { realpathSync, existsSync as existsSync14, readFileSync as readFileSync16, rmSync as rmSync2 } from "node:fs";
+import { resolve as resolve11, dirname as dirname7, join as join22 } from "node:path";
+import { realpathSync, existsSync as existsSync15, readFileSync as readFileSync17, rmSync as rmSync3 } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
 
@@ -1147,8 +1147,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
-import { basename, dirname as dirname5, join as join19, relative as relative5, resolve as resolve7, sep as sep4 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+import { basename, dirname as dirname5, join as join20, relative as relative5, resolve as resolve9, sep as sep6 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -1185,7 +1185,7 @@ import { spawn } from "node:child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 
 // src/project.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "node:fs";
@@ -1691,14 +1691,14 @@ function unescapeDoubleQuoted(body) {
 
 // src/carve-manifest.ts
 import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
-import { dirname as dirname2, isAbsolute, join as join3, relative, resolve } from "node:path";
+import { dirname as dirname2, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
 var CARVE_MANIFEST_SUFFIX = ".carve.json";
 var APPLY_IS_HUMAN = "`chant carve apply` graduates ownership \u2014 it resolves the marker that makes chant the owner of a live resource. behold shows what the manifest records and echoes the command; it has no apply endpoint and no apply button, by design. Read the graduation plan, then run it yourself.";
 var isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
 function parseCarveManifest(value) {
   if (!isRecord(value)) return null;
-  if (value.version !== 1) return null;
+  if (value.version !== 1 && value.version !== 2) return null;
   if (typeof value.target !== "string" || !value.target) return null;
   return value;
 }
@@ -1835,17 +1835,23 @@ async function discoverCarveStates(dirs, read, io = nodeCarveIo, depth = MANIFES
   return byTarget;
 }
 function joinCarvedSources(ir, states, memberDir) {
-  const byFile = /* @__PURE__ */ new Map();
-  for (const s of states) for (const f of s.sourceFiles) byFile.set(resolve(f), s);
-  if (byFile.size === 0) return { ir, joined: 0 };
+  const root = resolve(memberDir);
+  const candidates = [];
+  for (const s of states) {
+    for (const f of s.sourceFiles) {
+      const abs = resolve(f);
+      if (abs === root || abs.startsWith(root + sep)) candidates.push({ abs, state: s });
+    }
+  }
+  if (candidates.length === 0) return { ir, joined: 0 };
   let joined = 0;
   const nodes = ir.nodes.map((n) => {
     const file = n.sourceLoc?.file;
     if (!file) return n;
-    const abs = resolve(memberDir, file);
-    const state = byFile.get(abs);
-    if (!state) return n;
+    const hit = emittedFileFor(file, root, candidates);
+    if (!hit) return n;
     joined++;
+    const { state, abs } = hit;
     const carve = {
       target: state.target,
       ...state.tfType ? { tfType: state.tfType } : {},
@@ -1853,12 +1859,24 @@ function joinCarvedSources(ir, states, memberDir) {
       graduated: state.graduated,
       ...state.at ? { at: state.at } : {},
       ...state.from ? { from: state.from } : {},
-      file: relative(memberDir, abs).split("\\").join("/")
+      file: relative(root, abs).split(sep).join("/")
     };
     return { ...n, attrs: { ...n.attrs, carved: state.target, _carve: carve } };
   });
   return { ir: joined ? { ...ir, nodes } : ir, joined };
 }
+function emittedFileFor(file, root, candidates) {
+  const rel = file.split("\\").join("/").replace(/^\.\//, "");
+  if (isAbsolute(rel)) {
+    const abs = resolve(rel);
+    return candidates.find((c) => c.abs === abs);
+  }
+  const exact = resolve(root, rel);
+  const direct = candidates.find((c) => c.abs === exact);
+  if (direct) return direct;
+  const suffix = candidates.filter((c) => c.abs.split(sep).join("/").endsWith("/" + rel));
+  return suffix.length === 1 ? suffix[0] : void 0;
+}
 function emittedNodesFor(ir, states, memberDir) {
   const out = /* @__PURE__ */ new Map();
   if (!ir) return out;
@@ -1992,6 +2010,46 @@ function carveStateNote(progress, states) {
   return progress.detail ? `${head}, ${progress.detail}.` : `${head}.`;
 }
 
+// src/foreign.ts
+import { isAbsolute as isAbsolute2, resolve as resolve2, sep as sep2 } from "node:path";
+function dropForeignDeclarations(ir, projectDir) {
+  const root = resolve2(projectDir);
+  const foreign = [];
+  for (const n of ir.nodes) {
+    const file = n.sourceLoc?.file;
+    if (!file || !isAbsolute2(file)) continue;
+    const abs = resolve2(file);
+    if (abs === root || abs.startsWith(root + sep2)) continue;
+    foreign.push({ id: n.id, kind: n.kind, file });
+  }
+  if (foreign.length === 0) return ir;
+  const gone = new Set(foreign.map((f) => f.id));
+  const groups = {};
+  for (const [axis, members] of Object.entries(ir.groups ?? {})) {
+    if (!members || typeof members !== "object") continue;
+    const kept = {};
+    for (const [box, ids] of Object.entries(members)) {
+      const left = ids.filter((id) => !gone.has(id));
+      if (left.length) kept[box] = left;
+    }
+    groups[axis] = kept;
+  }
+  return {
+    ...ir,
+    nodes: ir.nodes.filter((n) => !gone.has(n.id)),
+    edges: ir.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
+    groups,
+    foreign
+  };
+}
+function foreignNote(ir) {
+  const f = ir.foreign;
+  if (!f || f.length === 0) return void 0;
+  const named = f.slice(0, 3).map((d) => d.id).join(", ");
+  const more = f.length > 3 ? ` +${f.length - 3}` : "";
+  return `${f.length} declaration${f.length === 1 ? "" : "s"} outside this project dropped (${named}${more}) \u2014 chant graphs Ops from the git root (chant#2058)`;
+}
+
 // src/chant.ts
 function envOverridesFor(opts) {
   const overrides = {};
@@ -2042,7 +2100,7 @@ function chantPackageFrom(req) {
   return { root, bin: join4(root, manifest.bin?.chant ?? "bin/chant"), ...manifest.version ? { version: manifest.version } : {} };
 }
 function resolveLexicons(projectDir, lexicons) {
-  const req = createRequire(join4(resolve2(projectDir), "noop.js"));
+  const req = createRequire(join4(resolve3(projectDir), "noop.js"));
   return lexicons.map((lexicon) => {
     const pkg = `@intentius/chant-lexicon-${lexicon}`;
     const found = packageManifestFrom(req, pkg);
@@ -2052,7 +2110,7 @@ function resolveLexicons(projectDir, lexicons) {
 function resolveChant(projectDir) {
   const own = chantPackageFrom(createRequire(import.meta.url));
   if (projectDir) {
-    const fromProject = chantPackageFrom(createRequire(join4(resolve2(projectDir), "noop.js")));
+    const fromProject = chantPackageFrom(createRequire(join4(resolve3(projectDir), "noop.js")));
     if (fromProject) return { source: fromProject.root === own?.root ? "behold" : "project", ...fromProject };
   }
   if (own) return { source: "behold", ...own };
@@ -2179,9 +2237,9 @@ async function graphPath(projectDir, opts = {}) {
   }
   if (info.stacks?.length) {
     const picked = opts.stack ? info.stacks.find((s) => s.name === opts.stack) : void 0;
-    return resolve2(projectDir, (picked ?? info.stacks[0]).src);
+    return resolve3(projectDir, (picked ?? info.stacks[0]).src);
   }
-  if (info.sourceDir) return resolve2(projectDir, info.sourceDir);
+  if (info.sourceDir) return resolve3(projectDir, info.sourceDir);
   return legacyGraphPath(projectDir);
 }
 function graphArgs(src, format, opts, components) {
@@ -2189,7 +2247,8 @@ function graphArgs(src, format, opts, components) {
 }
 async function graphIr(projectDir, opts = {}) {
   const src = await graphPath(projectDir, opts);
-  return runChantJson(graphArgs(src, "ir", opts, false), projectDir, envOverridesFor(opts));
+  const ir = await runChantJson(graphArgs(src, "ir", opts, false), projectDir, envOverridesFor(opts));
+  return dropForeignDeclarations(ir, projectDir);
 }
 async function clusterRootGraphIr(projectDir, opts = {}) {
   if (!existsSync3(join4(projectDir, "cluster"))) return void 0;
@@ -2230,7 +2289,21 @@ function parseCiPipeline(stdout) {
     const script = Array.isArray(props?.script) ? props.script.map(String) : [];
     return { ...j, script };
   });
-  return { stages: parsed.stages, jobs, ...typeof parsed.env === "string" && parsed.env ? { env: parsed.env } : {} };
+  const fromJson = typeof parsed.env === "string" && parsed.env ? parsed.env : void 0;
+  const env = fromJson ?? pipelineEnvFromYaml(doc);
+  return { stages: parsed.stages, jobs, ...env ? { env } : {} };
+}
+function pipelineEnvFromYaml(doc) {
+  const name = doc?.name;
+  if (typeof name === "string") {
+    const m = /^chant-components-(.+)$/.exec(name);
+    if (m) return m[1];
+  }
+  const env = doc?.env;
+  if (env && typeof env === "object" && typeof env.CHANT_ENV === "string") {
+    return env.CHANT_ENV;
+  }
+  return void 0;
 }
 function ciPipeline(projectDir, opts = {}, forge = "gitlab") {
   const args = ciPipelineArgs(opts, forge);
@@ -2423,7 +2496,7 @@ function synthesizeHelmReleases(ir, observed, owners) {
 }
 
 // src/gh-run.ts
-import { spawn as spawn2 } from "node:child_process";
+import { execFileSync, spawn as spawn2 } from "node:child_process";
 import { readdirSync as readdirSync3, readFileSync as readFileSync6 } from "node:fs";
 import { join as join6 } from "node:path";
 
@@ -2469,6 +2542,9 @@ function foldPipelineLine(state, line) {
   }
   return out;
 }
+function losePipelineProgress(state) {
+  return { ...state, status: "lost" };
+}
 function finishPipelineProgress(state, exitCode) {
   const terminal = exitCode === 0 ? "ok" : "failed";
   let out = state;
@@ -2479,19 +2555,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve10) => {
+var defaultGhExec = (args) => new Promise((resolve12) => {
   let out = "";
   let proc;
   try {
     proc = spawn2("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve10({ code: 127, out: "" });
+    resolve12({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve10({ code: 127, out }));
-  proc.on("close", (code) => resolve10({ code: code ?? 1, out }));
+  proc.on("error", () => resolve12({ code: 127, out }));
+  proc.on("close", (code) => resolve12({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -2512,8 +2588,16 @@ function parseWorkflow(file, text) {
   const dispatchable = on === "workflow_dispatch" || Array.isArray(on) && on.includes("workflow_dispatch") || !!on && typeof on === "object" && "workflow_dispatch" in on || /^\s{2,}workflow_dispatch\s*:?\s*$/m.test(text);
   return { file, jobIds: jobs, dispatchable, ...typeof d.name === "string" && d.name ? { name: d.name } : {} };
 }
+function workflowsDir(projectDir) {
+  let root = projectDir;
+  try {
+    root = execFileSync("git", ["-C", projectDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || projectDir;
+  } catch {
+  }
+  return join6(root, ".github", "workflows");
+}
 function committedWorkflows(projectDir) {
-  const dir = join6(projectDir, ".github", "workflows");
+  const dir = workflowsDir(projectDir);
   let files;
   try {
     files = readdirSync3(dir).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
@@ -2544,9 +2628,16 @@ function resolveWorkflow(projectDir, pipeline, designated) {
     if (named.length > 1) return { reason: `${named.length} committed workflows are named ${ciWorkflowName(pipeline.env)} (${named.map((w) => w.file).join(", ")}) \u2014 designate one in .behold.json's executor block` };
   }
   const wanted = new Set(pipeline.jobs.map((j) => j.jobName));
-  const scored = dispatchable.map((w) => ({ w, overlap: w.jobIds.filter((id) => wanted.has(id)).length })).filter((x) => x.overlap > 0).sort((a, b) => b.overlap - a.overlap);
+  const otherEnv = (w) => {
+    const m = w.name ? /^chant-components-(.+)$/.exec(w.name) : null;
+    return !!m && !!pipeline.env && m[1] !== pipeline.env;
+  };
+  const scored = dispatchable.filter((w) => !otherEnv(w)).map((w) => ({ w, overlap: w.jobIds.filter((id) => wanted.has(id)).length })).filter((x) => x.overlap > 0).sort((a, b) => b.overlap - a.overlap);
   if (scored.length === 0) {
-    return { reason: "no committed workflow_dispatch workflow whose jobs match the generated pipeline \u2014 commit one (or add `workflow_dispatch:` to its `on:` block)" };
+    const excluded = dispatchable.filter(otherEnv).map((w) => `${w.file} (${w.name})`);
+    return {
+      reason: "no committed workflow_dispatch workflow whose jobs match the generated pipeline \u2014 commit one (or add `workflow_dispatch:` to its `on:` block)" + (excluded.length ? `; ${excluded.join(", ")} ${excluded.length === 1 ? "is" : "are"} named for another env and never stand in` : "")
+    };
   }
   if (scored.length > 1 && scored[1].overlap === scored[0].overlap) {
     const tied = scored.filter((x) => x.overlap === scored[0].overlap).map((x) => x.w.file);
@@ -2592,6 +2683,7 @@ function runViewToProgress(pipeline, view) {
   }
   return state;
 }
+var LOST_EXIT = 75;
 async function dispatchAndFollow(workflow, pipeline, ref, deps) {
   const exec = deps.exec ?? defaultGhExec;
   const pollMs = deps.pollMs ?? 5e3;
@@ -2620,10 +2712,28 @@ async function dispatchAndFollow(workflow, pipeline, ref, deps) {
     return 1;
   }
   deps.onLine(`\u25CF run ${runId} started \u2014 following`);
+  deps.onAdopted?.({ runId });
+  return followRun(runId, pipeline, deps);
+}
+async function followRun(runId, pipeline, deps) {
+  const exec = deps.exec ?? defaultGhExec;
+  const pollMs = deps.pollMs ?? 5e3;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const pollFailBudget = deps.pollFailBudget ?? 24;
+  const followDeadline = Date.now() + (deps.followTimeoutMs ?? 6 * 60 * 60 * 1e3);
   let urlSaid = false;
+  let state = pipelineProgress(pipeline);
+  let consecutiveFailures = 0;
+  const lose = (why) => {
+    deps.onLine(`\u2717 run ${runId}: ${why} \u2014 behold stopped following; the run itself may still be live${state.url ? ` at ${state.url}` : " on the forge"} (restart behold, or POST /api/ci/readopt, to re-adopt it)`);
+    deps.onProgress(losePipelineProgress(state));
+    deps.onConcluded?.({ verdict: "lost" });
+    return LOST_EXIT;
+  };
   for (; ; ) {
     const { code, out } = await exec(["run", "view", String(runId), "--json", "status,conclusion,jobs,url"]);
     if (code === 0) {
+      consecutiveFailures = 0;
       let view;
       try {
         view = JSON.parse(out);
@@ -2633,16 +2743,27 @@ async function dispatchAndFollow(workflow, pipeline, ref, deps) {
       if (view) {
         if (view.url && !urlSaid) {
           urlSaid = true;
+          deps.onAdopted?.({ runId, url: view.url });
           deps.onLine(`\u25CF ${view.url} \u2014 if the workflow's environment requires an approval, it is granted there, by a GitHub identity; behold holds none that could`);
         }
-        deps.onProgress(runViewToProgress(pipeline, view));
+        state = runViewToProgress(pipeline, view);
+        deps.onProgress(state);
         if (view.status === "completed") {
           deps.onLine(`\u25A0 run ${runId} ${view.conclusion ?? "completed"}`);
-          return view.conclusion === "success" ? 0 : 1;
+          const ok = view.conclusion === "success";
+          deps.onConcluded?.({ verdict: ok ? "ok" : "failed" });
+          return ok ? 0 : 1;
         }
       }
     } else {
-      deps.onLine(`\u26A0 gh run view ${runId} failed (exit ${code}) \u2014 retrying`);
+      consecutiveFailures++;
+      deps.onLine(`\u26A0 gh run view ${runId} failed (exit ${code}) \u2014 retrying (${consecutiveFailures}/${pollFailBudget})`);
+      if (consecutiveFailures >= pollFailBudget) {
+        return lose(`${pollFailBudget} consecutive polls failed \u2014 the stream is dead, not flaky`);
+      }
+    }
+    if (Date.now() >= followDeadline) {
+      return lose("the follow deadline passed");
     }
     await sleep(pollMs);
   }
@@ -2668,6 +2789,45 @@ function joinCiProgress(ir, state) {
   return ir;
 }
 
+// src/ci-run-store.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2, rmSync } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join7, resolve as resolve4 } from "node:path";
+function slug(projectDir) {
+  return resolve4(projectDir).replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(-80);
+}
+function defaultRoot() {
+  return process.env.BEHOLD_CI_RUN_DIR ?? join7(homedir2(), ".behold", "ci-runs");
+}
+function dispatchedRunPath(projectDir, root = defaultRoot()) {
+  return join7(root, `${slug(projectDir)}.json`);
+}
+function saveDispatchedRun(run3, root = defaultRoot()) {
+  try {
+    const path = dispatchedRunPath(run3.projectDir, root);
+    mkdirSync2(join7(path, ".."), { recursive: true });
+    writeFileSync2(path, JSON.stringify({ version: 1, ...run3 }, null, 2) + "\n");
+  } catch {
+  }
+}
+function readDispatchedRun(projectDir, root) {
+  try {
+    const path = dispatchedRunPath(projectDir, root);
+    if (!existsSync5(path)) return void 0;
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    if (parsed?.version !== 1 || typeof parsed.runId !== "number") return void 0;
+    if (resolve4(parsed.projectDir) !== resolve4(projectDir)) return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function concludeDispatchedRun(projectDir, runId, verdict, root) {
+  const current = readDispatchedRun(projectDir, root);
+  if (!current || current.runId !== runId) return;
+  saveDispatchedRun({ ...current, concluded: { verdict, at: (/* @__PURE__ */ new Date()).toISOString() } }, root);
+}
+
 // src/operator.ts
 var ANSI = /\x1b\[[0-9;]*m/g;
 var strip = (s) => s.replace(ANSI, "");
@@ -3740,26 +3900,26 @@ function applyHelmArtifacts(ir, observed) {
 
 // src/carve-discovery.ts
 import { readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/member-ir.ts
 import { createHash } from "node:crypto";
 import { readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
-import { join as join7, relative as relative2, resolve as resolve3 } from "node:path";
+import { join as join8, relative as relative2, resolve as resolve5 } from "node:path";
 var SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
 function memberIrCacheSize(env = process.env) {
   const override = Number.parseInt(env.BEHOLD_ESTATE_IR_CACHE ?? "", 10);
   return Number.isInteger(override) && override >= 0 ? override : 64;
 }
 function memberSourceStamp(dir) {
-  const root = resolve3(dir);
+  const root = resolve5(dir);
   const h = createHash("sha1");
   let any = false;
   const walk = (at) => {
     const entries = readdirSync4(at, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1);
     for (const e of entries) {
       if (SKIP.has(e.name)) continue;
-      const path = join7(at, e.name);
+      const path = join8(at, e.name);
       if (e.isDirectory()) {
         walk(path);
         continue;
@@ -3781,7 +3941,7 @@ function memberSourceStamp(dir) {
 function cacheKey(dir, opts) {
   const chant = resolveChant(dir);
   const canonical = JSON.stringify(opts, Object.keys(opts).sort());
-  return `${resolve3(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
+  return `${resolve5(dir)}\0${chant.bin}\0${chant.version ?? ""}\0${canonical}`;
 }
 var cache = /* @__PURE__ */ new Map();
 var hits = 0;
@@ -3791,7 +3951,7 @@ function invalidateMember(dir) {
     cache.clear();
     return;
   }
-  const root = resolve3(dir);
+  const root = resolve5(dir);
   for (const [key, entry] of cache) if (entry.dir === root) cache.delete(key);
 }
 async function memberIr(dir, opts = {}) {
@@ -3810,7 +3970,7 @@ async function memberIr(dir, opts = {}) {
   const ir = await graphIr(dir, opts);
   if (stamp === void 0 || memberSourceStamp(dir) !== stamp) return ir;
   cache.delete(key);
-  cache.set(key, { dir: resolve3(dir), stamp, ir });
+  cache.set(key, { dir: resolve5(dir), stamp, ir });
   for (const oldest of cache.keys()) {
     if (cache.size <= size) break;
     cache.delete(oldest);
@@ -3838,7 +3998,7 @@ function hasAnyCarveManifest(dir, io = fsIo) {
     for (const name of entries) {
       if (name.endsWith(CARVE_MANIFEST_SUFFIX)) return true;
       if (name.startsWith(".") || SKIP2.has(name)) continue;
-      const full = join8(d, name);
+      const full = join9(d, name);
       if (io.isDirectory(full) && walk(full)) return true;
     }
     return false;
@@ -3879,7 +4039,7 @@ async function carveStatesUnder(dirs) {
 // src/estate.ts
 import { statSync as statSync5 } from "node:fs";
 import { availableParallelism } from "node:os";
-import { join as join9, resolve as resolve4, sep } from "node:path";
+import { join as join10, resolve as resolve6, sep as sep3 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 
 // src/zoom-notes.ts
@@ -4038,11 +4198,11 @@ function declaredSegments(path) {
 function pathAlignment(declared, dir, isDir = realIsDir) {
   const want = declaredSegments(declared);
   if (!want) return 0;
-  const root = resolve4(dir);
-  const have = root.split(sep).filter(Boolean);
+  const root = resolve6(dir);
+  const have = root.split(sep3).filter(Boolean);
   for (let k = Math.min(want.length, have.length); k >= 1; k--) {
     if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join9(root, ...want.slice(k)))) continue;
+    if (!isDir(join10(root, ...want.slice(k)))) continue;
     return k;
   }
   return 0;
@@ -4072,10 +4232,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join22 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join22 });
+    const join23 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join23 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join22 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join23 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -4793,8 +4953,8 @@ function projectHelmLogical(ir) {
 }
 
 // src/logical-kustomize.ts
-import { existsSync as existsSync5 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join11 } from "node:path";
 function overlayBoxTitle(name) {
   return `overlay ${name}`;
 }
@@ -4814,7 +4974,7 @@ function kustomizationRoot(bases, dir, exists) {
   let current = dir;
   for (let i = 0; i < 4 && current; i++) {
     for (const base of bases) {
-      if (exists(join10(base, current, "kustomization.yaml")) || exists(join10(base, current, "kustomization.yml"))) {
+      if (exists(join11(base, current, "kustomization.yaml")) || exists(join11(base, current, "kustomization.yml"))) {
         return current;
       }
     }
@@ -4823,7 +4983,7 @@ function kustomizationRoot(bases, dir, exists) {
   }
   return void 0;
 }
-function projectKustomizeLogical(ir, sourceRoots, exists = existsSync5) {
+function projectKustomizeLogical(ir, sourceRoots, exists = existsSync6) {
   const bases = Array.isArray(sourceRoots) ? sourceRoots : [sourceRoots];
   const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
   if (k8s.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
@@ -5545,10 +5705,10 @@ import {
 } from "@intentius/pinhole";
 
 // src/icon-packs.ts
-import { readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname4, join as join11 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { dirname as dirname4, join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-var ICON_ROOT = join11(dirname4(fileURLToPath2(import.meta.url)), "..", "web", "icons");
+var ICON_ROOT = join12(dirname4(fileURLToPath2(import.meta.url)), "..", "web", "icons");
 var cache3 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
@@ -5570,7 +5730,7 @@ function plate(glyph) {
 function loadIcon(rel) {
   const hit = cache3.get(rel);
   if (hit) return hit;
-  const raw = readFileSync7(join11(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync8(join12(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -6735,12 +6895,12 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
 }
 
 // src/carve-actions.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, readdirSync as readdirSync6, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join14, relative as relative3, resolve as resolve5, sep as sep2 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync11, readdirSync as readdirSync6, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join15, relative as relative3, resolve as resolve7, sep as sep4 } from "node:path";
 
 // src/layout.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync8, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync9, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3, accessSync, constants } from "node:fs";
+import { join as join13 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -6750,12 +6910,12 @@ var MAX_LENSES = 64;
 var MAX_ID_LENGTH = 512;
 var MAX_LENS_LENGTH = 128;
 var NUM = ["dx", "dy", "dw", "dh"];
-function slug(s) {
+function slug2(s) {
   return String(s ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
 }
 function normalizeLens(raw) {
   if (typeof raw !== "string" || !raw.trim() || raw.length > MAX_LENS_LENGTH) return null;
-  const parts = raw.split("+").map((p) => slug(p)).filter((p) => p && p !== "unknown");
+  const parts = raw.split("+").map((p) => slug2(p)).filter((p) => p && p !== "unknown");
   if (!parts.length) return null;
   const key = parts.join("+");
   return key === "__proto__" || key === "constructor" || key === "prototype" ? null : key;
@@ -6778,13 +6938,13 @@ function normalizeDeltas(raw) {
 function lensFromQuery(params) {
   const zoom = params.get("components") === "1" ? "components" : params.get("logical") === "1" ? "logical" : params.get("runtime") === "1" ? "runtime" : { 1: "composites", 2: "resources", 3: "attributes" }[Number(params.get("detail") ?? 2)] ?? "resources";
   const stack = params.get("stack");
-  return [slug(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug(`stack-${stack}`) : null].filter(Boolean).join("+");
+  return [slug2(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug2(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join12(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join13(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
-  if (!projectDir || !existsSync6(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
+  if (!projectDir || !existsSync7(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
   try {
     accessSync(projectDir, constants.W_OK);
   } catch {
@@ -6796,8 +6956,8 @@ function readLayoutFile(projectDir) {
   const empty = { version: 1, lenses: {} };
   const file = layoutPath(projectDir);
   try {
-    if (!existsSync6(file)) return empty;
-    const raw = readFileSync8(file, "utf8");
+    if (!existsSync7(file)) return empty;
+    const raw = readFileSync9(file, "utf8");
     if (raw.length > MAX_FILE_BYTES) return empty;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || !parsed.lenses || typeof parsed.lenses !== "object") return empty;
@@ -6832,14 +6992,14 @@ function writeLens(projectDir, lens, deltas) {
   if (Object.keys(lenses).length > MAX_LENSES) throw new LayoutTooLarge(`a layout sidecar holds at most ${MAX_LENSES} lenses`);
   const file = layoutPath(projectDir);
   if (!Object.keys(lenses).length) {
-    rmSync(file, { force: true });
+    rmSync2(file, { force: true });
     return { lens: key, deltas: clean, bytes: 0 };
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync2(join12(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync3(join13(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
-  writeFileSync2(tmp, body, "utf8");
+  writeFileSync3(tmp, body, "utf8");
   renameSync(tmp, file);
   return { lens: key, deltas: clean, bytes: body.length };
 }
@@ -6922,8 +7082,8 @@ function reanchorEdges(svg, moved) {
 
 // src/carve-live.ts
 import { spawn as spawn3 } from "node:child_process";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync8 } from "node:fs";
+import { join as join14 } from "node:path";
 
 // src/scratch.ts
 var PROTECTED_INFRA = [
@@ -7011,9 +7171,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join13(fromDir, "floci-override.tf.disabled");
-  if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync3(join13(fromDir, "floci_override.tf"), armOverride(readFileSync9(template, "utf8"), LIVE_PORT));
+  const template = join14(fromDir, "floci-override.tf.disabled");
+  if (!existsSync8(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
+  writeFileSync4(join14(fromDir, "floci_override.tf"), armOverride(readFileSync10(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -7063,7 +7223,7 @@ async function runCarveObserve(demo, select) {
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync8(join14(demo.out, "src"))) {
+  if (!existsSync9(join15(demo.out, "src"))) {
     return refuse3("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
@@ -7133,8 +7293,8 @@ var refuse3 = (code, error, remedy) => ({
 });
 var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
 function insideDemo(root, p) {
-  const rel = relative3(resolve5(root), resolve5(p));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+  const rel = relative3(resolve7(root), resolve7(p));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function selectFromReport(report, raw) {
   if (typeof raw !== "string" || !raw || raw.length > 512) return null;
@@ -7144,7 +7304,7 @@ function carveWriteBlock(demo) {
   if (!demo) {
     return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
   }
-  if (!existsSync8(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!existsSync9(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
   if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
   return unwritableReason(demo.root);
 }
@@ -7161,7 +7321,7 @@ function readArtifacts(demo, dir, filter) {
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join14(d, name);
+      const full = join15(d, name);
       let st;
       try {
         st = statSync6(full);
@@ -7172,11 +7332,11 @@ function readArtifacts(demo, dir, filter) {
         walk(full, depth + 1);
         continue;
       }
-      const rel = relative3(demo.root, full).split(sep2).join("/");
+      const rel = relative3(demo.root, full).split(sep4).join("/");
       if (!filter(rel)) continue;
       let text = "";
       try {
-        text = readFileSync10(full, "utf8");
+        text = readFileSync11(full, "utf8");
       } catch {
         continue;
       }
@@ -7198,17 +7358,17 @@ function carveSlug(select) {
 }
 var clip = (s) => s.length > MAX_OUTPUT_BYTES ? s.slice(0, MAX_OUTPUT_BYTES) + "\n\u2026 (truncated)" : s;
 function shortenIn(arg, root) {
-  return arg.startsWith(root + sep2) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
+  return arg.startsWith(root + sep4) ? arg.slice(root.length + 1) : arg === root ? "." : arg;
 }
 function merge(r, root) {
   const joined = stripAnsi([r.stdout, r.stderr].filter((s) => s.trim()).join("\n").trim());
-  return clip(joined.split(root + sep2).join("").split(root).join("."));
+  return clip(joined.split(root + sep4).join("").split(root).join("."));
 }
 async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
-  mkdirSync3(demo.out, { recursive: true });
-  const reportFile = join14(demo.out, `${carveSlug(select)}-boundary.json`);
+  mkdirSync4(demo.out, { recursive: true });
+  const reportFile = join15(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -7237,10 +7397,10 @@ async function runCarveEmit(demo, select) {
   }
   let boundary = null;
   try {
-    boundary = JSON.parse(readFileSync10(reportFile, "utf8"));
+    boundary = JSON.parse(readFileSync11(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative3(demo.project, join14(demo.out, "src")).split(sep2).join("/");
+  const lintPath = relative3(demo.project, join15(demo.out, "src")).split(sep4).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -7265,7 +7425,7 @@ async function runCarveEmit(demo, select) {
 async function runCarveBridge(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse3("read-only", block, "Start the walkthrough with `behold demo carve`.");
-  mkdirSync3(demo.out, { recursive: true });
+  mkdirSync4(demo.out, { recursive: true });
   const args = [
     "carve",
     "bridge",
@@ -7290,21 +7450,21 @@ async function runCarveBridge(demo, select) {
       "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
     );
   }
-  const slug3 = carveSlug(select);
+  const slug4 = carveSlug(select);
   const all = readArtifacts(demo, demo.out, (rel) => /\.(tf|md|patch)$/.test(rel));
   return {
     ok: true,
     select,
     command: `chant ${args.map((a) => shortenIn(a, demo.root)).join(" ")}`,
     output,
-    runbook: all.find((a) => a.path.endsWith(`${slug3}-runbook.md`)) ?? null,
-    proposals: all.filter((a) => !a.path.endsWith(`${slug3}-runbook.md`))
+    runbook: all.find((a) => a.path.endsWith(`${slug4}-runbook.md`)) ?? null,
+    proposals: all.filter((a) => !a.path.endsWith(`${slug4}-runbook.md`))
   };
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync11, existsSync as existsSync9 } from "node:fs";
-import { join as join15 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync12, existsSync as existsSync10 } from "node:fs";
+import { join as join16 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -7326,11 +7486,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join15(projectDir, sub);
-    if (!existsSync9(dir)) continue;
+    const dir = join16(projectDir, sub);
+    if (!existsSync10(dir)) continue;
     for (const f of readdirSync7(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync11(join15(dir, f), "utf8");
+      const content = readFileSync12(join16(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -7346,25 +7506,25 @@ function discoverOps(projectDir) {
         ...gate ? { gate } : {},
         ...env ? { env } : {},
         ...substrate ? { substrate } : {},
-        ...existsSync9(irPath) ? { irPath } : {}
+        ...existsSync10(irPath) ? { irPath } : {}
       });
     }
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function opIrPath(projectDir, name) {
-  return join15(projectDir, "dist", "ops", name, "op.json");
+  return join16(projectDir, "dist", "ops", name, "op.json");
 }
 function discoverOpIrs(projectDirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of projectDirs) {
-    const root = join15(dir, "dist", "ops");
-    if (!existsSync9(root)) continue;
+    const root = join16(dir, "dist", "ops");
+    if (!existsSync10(root)) continue;
     for (const name of readdirSync7(root)) {
       if (seen.has(name)) continue;
       const path = opIrPath(dir, name);
-      if (!existsSync9(path)) continue;
+      if (!existsSync10(path)) continue;
       seen.add(name);
       out.push({ name, dir, path });
     }
@@ -7599,11 +7759,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join22, gate) {
-  if (!join22.byNode.size && !join22.at) return ir;
+function paintPlayhead(ir, join23, gate) {
+  if (!join23.byNode.size && !join23.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join22.byNode.get(node.id);
-    const here = join22.at === node.id;
+    const run3 = join23.byNode.get(node.id);
+    const here = join23.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -7618,7 +7778,7 @@ function paintPlayhead(ir, join22, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join22.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join23.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -7640,11 +7800,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join22) {
+function playheadNote(state, join23) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join22 ? join22.byNode.size : state.records.length;
+  const settled = join23 ? join23.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -7660,9 +7820,9 @@ function playheadNote(state, join22) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join22?.unplaced.length) {
+  if (join23?.unplaced.length) {
     bits.push(
-      `${join22.unplaced.length} record${join22.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join22.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join23.unplaced.length} record${join23.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join23.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -8328,24 +8488,24 @@ var OpRunner = class {
 
 // src/substrates.ts
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { join as join17 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve10) => {
+  return new Promise((resolve12) => {
     let out = "";
     let proc;
     try {
       proc = spawn4(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve10({ code: 127, out: "" });
+      resolve12({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve10({ code: 127, out }));
-    proc.on("close", (code) => resolve10({ code: code ?? 1, out }));
+    proc.on("error", () => resolve12({ code: 127, out }));
+    proc.on("close", (code) => resolve12({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable(run3) {
@@ -8358,11 +8518,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync10(join16(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync11(join17(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync12(join16(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync13(join17(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -8414,7 +8574,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync10(join16(projectDir, marker))) continue;
+    if (!existsSync11(join17(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -8448,7 +8608,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync10(join16(projectDir, ".github", "workflows"))) {
+  if (existsSync11(join17(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -8461,7 +8621,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync12(join16(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync13(join17(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -8669,8 +8829,8 @@ function addEstateMemberEdges(ir, members, isDir = realIsDir2) {
 }
 
 // src/events.ts
-import { watch, existsSync as existsSync11 } from "node:fs";
-import { join as join17 } from "node:path";
+import { watch, existsSync as existsSync12 } from "node:fs";
+import { join as join18 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -8688,7 +8848,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync11(join17(projectDir, "src")) ? join17(projectDir, "src") : projectDir;
+  const dir = existsSync12(join18(projectDir, "src")) ? join18(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -8976,13 +9136,13 @@ async function emulatorDown(projectDir) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync13, existsSync as existsSync12, cpSync } from "node:fs";
-import { join as join18, relative as relative4, resolve as resolve6, sep as sep3 } from "node:path";
+import { readFileSync as readFileSync14, existsSync as existsSync13, cpSync } from "node:fs";
+import { join as join19, relative as relative4, resolve as resolve8, sep as sep5 } from "node:path";
 import { spawn as spawn5, spawnSync } from "node:child_process";
 function loadDemoRegistry(pkgRoot2) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync13(join18(pkgRoot2, "demos.json"), "utf8"));
+    raw = JSON.parse(readFileSync14(join19(pkgRoot2, "demos.json"), "utf8"));
   } catch {
     return [];
   }
@@ -9022,22 +9182,22 @@ function fetchesFromNetwork(entry) {
   return entry.source === "git";
 }
 function demoTargetDir(entry, cwd = process.cwd()) {
-  const legacy = resolve6(cwd, "behold-demo");
-  if (entry.name === "writes" && existsSync12(legacy)) return legacy;
-  return resolve6(cwd, "behold-demos", entry.name);
+  const legacy = resolve8(cwd, "behold-demo");
+  if (entry.name === "writes" && existsSync13(legacy)) return legacy;
+  return resolve8(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot2, target } = opts;
   const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
-  if (!existsSync12(target)) {
+  if (!existsSync13(target)) {
     if (entry.source === "bundled") {
-      const bundled = join18(pkgRoot2, entry.dir);
-      if (!existsSync12(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
+      const bundled = join19(pkgRoot2, entry.dir);
+      if (!existsSync13(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(bundled, target, {
           recursive: true,
-          filter: (src) => !relative4(bundled, src).split(sep3).includes("node_modules")
+          filter: (src) => !relative4(bundled, src).split(sep5).includes("node_modules")
         });
       } catch (err) {
         return { ok: false, error: `copy failed: ${err instanceof Error ? err.message : String(err)}` };
@@ -9051,7 +9211,7 @@ async function loadDemo(entry, opts) {
   } else {
     say(`reusing ${target}`);
   }
-  if (existsSync12(join18(target, "package.json")) && !existsSync12(join18(target, "node_modules"))) {
+  if (existsSync13(join19(target, "package.json")) && !existsSync13(join19(target, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${target}` };
@@ -9063,7 +9223,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join18(target, d)) : [target] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join19(target, d)) : [target] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -9074,8 +9234,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join19(dirname5(fileURLToPath3(import.meta.url)), "..");
-var webRoot = join19(pkgRoot, "web");
+var pkgRoot = join20(dirname5(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join20(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -9125,7 +9285,7 @@ function tierFailure(tier, message) {
 function beholdVersion() {
   try {
     const here = dirname5(fileURLToPath3(import.meta.url));
-    return JSON.parse(readFileSync14(join19(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync15(join20(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -9170,7 +9330,7 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load = () => readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
+  const load = () => readCarveReport(reportPath, (p) => readFileSync15(p, "utf8"));
   const carveDirs = [dirname5(reportPath), ...demo ? [demo.out] : []];
   const carveStates = () => readCarveStates(carveDirs, nodeCarveIo, 0);
   const emittedNodes = async (states) => {
@@ -9189,8 +9349,8 @@ function carveRoutes(app, reportPath, demo) {
       project: demo.project,
       out: demo.out,
       // Paths the UI can print without leaking the operator's whole home dir.
-      outLabel: relative5(demo.root, demo.out).split(sep4).join("/"),
-      fromLabel: relative5(demo.root, demo.from).split(sep4).join("/"),
+      outLabel: relative5(demo.root, demo.out).split(sep6).join("/"),
+      fromLabel: relative5(demo.root, demo.from).split(sep6).join("/"),
       runnable: !block,
       ...block ? { reason: block } : {},
       // The live tier, when this boot armed it: the scratch endpoint the
@@ -9207,7 +9367,7 @@ function carveRoutes(app, reportPath, demo) {
   let appGraph;
   const appGraphOnce = () => {
     if (!demo) return Promise.resolve(null);
-    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative5(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
+    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative5(demo.root, demo.project).split(sep6).join("/") } : null).catch(() => null);
     return appGraph;
   };
   app.get("/api/graph", async (c) => {
@@ -9223,7 +9383,7 @@ function carveRoutes(app, reportPath, demo) {
       return bandGraduated(split.tf, split.graduated);
     };
     const { svg, ir } = appSide ? renderCarveEstate(tfIr, appSide.ir, {
-      tfTitle: `${relative5(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      tfTitle: `${relative5(demo.root, demo.from).split(sep6).join("/")} \u2014 terraform`,
       appTitle: `${appSide.label} \u2014 chant`,
       carved: states,
       shorten,
@@ -9243,7 +9403,9 @@ function carveRoutes(app, reportPath, demo) {
         carve: true,
         // A demo whose own advisor run failed says so on the statusbar, not
         // only in the terminal the viewer isn't looking at.
-        note: carveNote(parsed.report, tfIr) + carveStateNote(carveProgress(states.values(), tfIr.nodes.length), states) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
+        note: carveNote(parsed.report, tfIr) + carveStateNote(carveProgress(states.values(), tfIr.nodes.length), states) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "") + // chant#2058: the app box shows only the app's own declarations;
+        // what the git-root Op discovery added from elsewhere is named.
+        (appSide && foreignNote(appSide.ir) ? ` ${foreignNote(appSide.ir)}.` : "")
       }
     });
   });
@@ -9275,7 +9437,7 @@ function carveRoutes(app, reportPath, demo) {
     }
     const tfIr = carveReportToIr(parsed.report);
     const html = renderCarveMorph(tfIr, appSide.ir, [select], {
-      tfTitle: `${relative5(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      tfTitle: `${relative5(demo.root, demo.from).split(sep6).join("/")} \u2014 terraform`,
       appTitle: `${appSide.label} \u2014 chant`,
       title: `carve \u2014 ${select}`,
       carved: carveStates(),
@@ -9369,6 +9531,36 @@ function carveRoutes(app, reportPath, demo) {
   app.get("/api/resources", (c) => c.json({ byComponent: {} }));
   app.get("/api/ci", (c) => c.json({ stages: [], jobs: [], forge: null }));
 }
+function followLimits(env = process.env) {
+  const timeout = Number.parseInt(env.BEHOLD_CI_FOLLOW_TIMEOUT_MS ?? "", 10);
+  const budget = Number.parseInt(env.BEHOLD_CI_POLL_FAIL_BUDGET ?? "", 10);
+  return {
+    ...Number.isInteger(timeout) && timeout >= 0 ? { followTimeoutMs: timeout } : {},
+    ...Number.isInteger(budget) && budget > 0 ? { pollFailBudget: budget } : {}
+  };
+}
+async function readoptDispatchedRun(cfg, runner) {
+  const run3 = readDispatchedRun(cfg.projectDir);
+  if (!run3 || run3.concluded && run3.concluded.verdict !== "lost") return { outcome: "none" };
+  const ready = await ghReady();
+  if (!ready.ok) return { outcome: "refused", reason: ready.reason ?? "gh is not ready", run: run3 };
+  const pipeline = await ciPipeline(cfg.projectDir, run3.env ? { env: run3.env } : {}, "github").catch(() => void 0);
+  if (!pipeline || pipeline.jobs.length === 0) {
+    return { outcome: "refused", reason: "no generated GitHub pipeline to paint the run onto \u2014 `chant build --components --generate github` first", run: run3 };
+  }
+  const started = runner.track(`GitHub Actions ${run3.workflow} (re-adopted run ${run3.runId})`, (io) => {
+    io.line(`\u25CF re-adopting run ${run3.runId} (${run3.workflow}, dispatched ${run3.dispatchedAt}) \u2014 \`gh run view\` is the durable read`);
+    return followRun(run3.runId, pipeline, {
+      ...followLimits(),
+      onLine: io.line,
+      onProgress: io.progress,
+      onAdopted: ({ runId, url }) => saveDispatchedRun({ ...run3, runId, ...url ? { url } : {} }),
+      onConcluded: ({ verdict }) => concludeDispatchedRun(cfg.projectDir, run3.runId, verdict)
+    });
+  });
+  if (!started) return { outcome: "refused", reason: `busy \u2014 ${runner.running} is running`, run: run3 };
+  return { outcome: "readopted", run: run3 };
+}
 function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffer(), runner = new OpRunner({
   projectDir: cfg.projectDir,
   broadcaster,
@@ -9486,9 +9678,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join19(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join19(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync13(down) || !existsSync13(up)) {
+    const down = join20(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join20(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync14(down) || !existsSync14(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -9509,7 +9701,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const dirs = [];
     const declared = [];
     for (const f of discoverOpIrs(estateDirs)) {
-      const parsed = readOpIr(f.path, (p) => readFileSync14(p, "utf8"));
+      const parsed = readOpIr(f.path, (p) => readFileSync15(p, "utf8"));
       if (!parsed.ok) continue;
       const mine = declaredConvergeOps([parsed.ir]);
       if (!mine.length) continue;
@@ -9679,9 +9871,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve7(body.dir.trim()) : "";
-    if (!dir || !existsSync13(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync13(join19(dir, "chant.config.ts"))) {
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve9(body.dir.trim()) : "";
+    if (!dir || !existsSync14(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync14(join20(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -9701,7 +9893,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve7(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve9(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -9725,7 +9917,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       fetches: fetchesFromNetwork(e),
       ...e.repo ? { repo: e.repo } : {},
       target,
-      loaded: existsSync13(target),
+      loaded: existsSync14(target),
       satisfiable: missing.length === 0,
       // #254: the carve walkthrough runs fine here — it just isn't a project
       // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
@@ -9769,7 +9961,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
       if (!loaded.ok) return c.json({ error: loaded.error }, 500);
       const dirs = loaded.serveDirs;
-      if (!existsSync13(join19(dirs[0], "chant.config.ts"))) {
+      if (!existsSync14(join20(dirs[0], "chant.config.ts"))) {
         return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
       }
       if (entry.serve.local) {
@@ -9904,7 +10096,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "POST", path: "/api/rollback", desc: "open a rollback PR: ?to=<sha>" },
         { method: "POST", path: "/api/substrates/:name/up", desc: "bring a substrate up" },
         { method: "POST", path: "/api/local/reset", desc: "reset the local emulator" },
-        { method: "POST", path: "/api/ci/dispatch", desc: "dispatch the GitHub Actions pipeline for ?env= via the operator's gh \u2014 the designated workflow when .behold.json names one" }
+        { method: "POST", path: "/api/ci/dispatch", desc: "dispatch the GitHub Actions pipeline for ?env= via the operator's gh \u2014 the designated workflow when .behold.json names one" },
+        { method: "GET", path: "/api/ci/run", desc: "the persisted dispatched-run record (id, verdict) \u2014 what survives a behold restart" },
+        { method: "POST", path: "/api/ci/readopt", desc: "re-adopt the persisted unconcluded run: follow it by its saved id (also attempted automatically at boot)" }
       ]
     })
   );
@@ -9926,7 +10120,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const parsedOps = [];
         for (const f of files) {
-          const parsed = readOpIr(f.path, (p) => readFileSync14(p, "utf8"));
+          const parsed = readOpIr(f.path, (p) => readFileSync15(p, "utf8"));
           if (!parsed.ok) return c.json(parsed.refusal, 422);
           parsedOps.push(parsed.ir);
         }
@@ -9939,8 +10133,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join22 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join22 ? paintPlayhead(declaredIr, join22, runState.gate) : declaredIr;
+        const join23 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join23 ? paintPlayhead(declaredIr, join23, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -9953,7 +10147,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join22)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join23)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -10043,7 +10237,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join19(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync14(join20(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -10106,13 +10300,36 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if ("reason" in resolved) return c.json({ error: resolved.reason, ...designated ? { code: "executor-forge" } : {} }, 400);
     const workflow = resolved.workflow;
     const ref = await execFileP("git", ["-C", cfg.projectDir, "branch", "--show-current"]).then((out) => out.trim() || "main").catch(() => "main");
+    const base = { projectDir: cfg.projectDir, ...env ? { env } : {}, workflow: workflow.file, ref, dispatchedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    let adoptedId;
     const started = runner.track(
       `GitHub Actions ${workflow.file}`,
-      (io) => dispatchAndFollow(workflow, pipeline, ref, { onLine: io.line, onProgress: io.progress })
+      (io) => dispatchAndFollow(workflow, pipeline, ref, {
+        ...followLimits(),
+        onLine: io.line,
+        onProgress: io.progress,
+        onAdopted: ({ runId, url }) => {
+          adoptedId = runId;
+          saveDispatchedRun({ ...base, runId, ...url ? { url } : {} });
+        },
+        onConcluded: ({ verdict }) => {
+          if (adoptedId !== void 0) concludeDispatchedRun(cfg.projectDir, adoptedId, verdict);
+        }
+      })
     );
     if (!started) return c.json({ error: `busy \u2014 ${runner.running} is running` }, 409);
     return c.json({ started: true, workflow: workflow.file, ref, jobs: pipeline.jobs.length, ...env ? { env } : {}, designated: Boolean(designated) });
   });
+  app.get("/api/ci/run", (c) => {
+    const run3 = readDispatchedRun(cfg.projectDir);
+    return c.json({ run: run3 ?? null });
+  });
+  app.post("/api/ci/readopt", async (c) => {
+    const result = await readoptDispatchedRun(cfg, runner);
+    if (result.outcome === "none") return c.json({ error: "no unconcluded dispatched run is persisted for this project" }, 404);
+    if (result.outcome === "refused") return c.json({ error: result.reason, run: result.run }, 409);
+    return c.json({ readopted: true, runId: result.run.runId, workflow: result.run.workflow });
+  });
   app.get("/api/resources", async (c) => {
     const opts = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
     const env = opts.env ?? cfg.env;
@@ -10397,7 +10614,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   const rel = relative5(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join19(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join20(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -10426,7 +10643,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync13(join19(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync14(join20(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -10437,6 +10654,17 @@ async function startServer(cfg) {
   });
   const app = createApp(cfg, broadcaster, frames, runner);
   const autoSync = cfg.autoSync ?? "off";
+  if (!cfg.carveReport) {
+    void readoptDispatchedRun(cfg, runner).then((result) => {
+      if (result.outcome === "readopted") {
+        process.stdout.write(`  re-adopted dispatched run ${result.run.runId} (${result.run.workflow}) \u2014 following via gh
+`);
+      } else if (result.outcome === "refused") {
+        process.stdout.write(`  a dispatched run (${result.run.runId}, ${result.run.workflow}) is persisted but not re-adopted: ${result.reason}
+`);
+      }
+    }).catch(() => void 0);
+  }
   const capture2 = () => captureFrame(cfg.projectDir, cfg.env, frames, broadcaster);
   const onEstateChange = (memberDir) => {
     broadcaster.emit("changed", memberDir ?? "");
@@ -10573,8 +10801,8 @@ async function startServer(cfg) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync15, readdirSync as readdirSync8 } from "node:fs";
-import { join as join20, dirname as dirname6, basename as basename2 } from "node:path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, copyFileSync, readFileSync as readFileSync16, readdirSync as readdirSync8 } from "node:fs";
+import { join as join21, dirname as dirname6, basename as basename2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var LENS_PARAMS = ["components", "detail", "env", "logical", "ops", "radial", "tier"];
 function canonicalKey(path, params) {
@@ -10582,7 +10810,7 @@ function canonicalKey(path, params) {
   const q = LENS_PARAMS.filter((k) => params.has(k) && !(flat && (k === "detail" || k === "radial"))).map((k) => `${k}=${params.get(k)}`).join("&");
   return q ? `${path}?${q}` : path;
 }
-function slug2(key) {
+function slug3(key) {
   const base = key.replace(/^\//, "").replace(/[^a-zA-Z0-9=_.-]+/g, "_").slice(0, 120);
   return `${base}.json`;
 }
@@ -10623,7 +10851,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join20(dirname6(fileURLToPath4(import.meta.url)), "..", "web");
+  return join21(dirname6(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename2(project)}`;
@@ -10634,16 +10862,16 @@ async function runExport(cfg, outDir, opts = {}) {
   const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [], ...proj.ops ? { ops: proj.ops } : {} };
-  const snapDir = join20(outDir, "snapshots");
-  mkdirSync4(snapDir, { recursive: true });
+  const snapDir = join21(outDir, "snapshots");
+  mkdirSync5(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
   let failed = 0;
   for (const key of captureKeys(axes)) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
-    const file = slug2(key);
-    writeFileSync4(join20(snapDir, file), body);
+    const file = slug3(key);
+    writeFileSync5(join21(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -10655,21 +10883,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync4(join20(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync15(join20(webDir(), "index.html"), "utf8").replace(
+  writeFileSync5(join21(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync16(join21(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync4(join20(outDir, "index.html"), html);
+  writeFileSync5(join21(outDir, "index.html"), html);
   for (const f of readdirSync8(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join20(webDir(), f), join20(outDir, f));
+    copyFileSync(join21(webDir(), f), join21(outDir, f));
   }
-  writeFileSync4(join20(outDir, "README.md"), BUNDLE_README);
+  writeFileSync5(join21(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
-  writeFileSync4(
-    join20(outDir, "wrangler.jsonc"),
+  writeFileSync5(
+    join21(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -10717,7 +10945,7 @@ It's just files \u2014 GitHub Pages, S3, nginx, or Cloudflare Pages
 `;
 
 // src/doctor.ts
-import { relative as relative6, resolve as resolve8 } from "node:path";
+import { relative as relative6, resolve as resolve10 } from "node:path";
 var list2 = (xs) => xs.join(", ");
 var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
 function summarize(xs, max = 4) {
@@ -10866,7 +11094,7 @@ function opsCheck(root, ops, chantSource, estate) {
   return { name: "ops", status: "pass", detail: `${ops.length} committed: ${list2(names)}; ${mcp}` };
 }
 async function diagnose(dir, probes = {}) {
-  const root = resolve8(dir);
+  const root = resolve10(dir);
   const shape = detectProjectShape(root);
   const behold = beholdVersion();
   if (shape.kind === "none") {
@@ -10886,7 +11114,7 @@ async function diagnose(dir, probes = {}) {
     };
   }
   const estate = shape.kind === "estate";
-  const members = (shape.members ?? []).map((m) => resolve8(root, m));
+  const members = (shape.members ?? []).map((m) => resolve10(root, m));
   const targets = estate ? members : [root];
   const primary = targets[0];
   const projectCheck = estate ? {
@@ -11120,7 +11348,7 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve9(d));
+  const dirs = projectDirs.map((d) => resolve11(d));
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -11139,7 +11367,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join21(dir, m)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join22(dir, m)).join(" ")}
 `
     );
     return;
@@ -11174,8 +11402,8 @@ async function runCarve(rest) {
     );
     process.exit(2);
   }
-  const reportPath = resolve9(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync16(p, "utf8"));
+  const reportPath = resolve11(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync17(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -11202,8 +11430,8 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync14(resolve9(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve9(dir)}
+  if (!existsSync15(resolve11(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve11(dir)}
 `);
     process.exit(2);
   }
@@ -11212,7 +11440,7 @@ async function runDoctor(rest) {
   if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot2 = join21(dirname7(fileURLToPath5(import.meta.url)), "..");
+  const pkgRoot2 = join22(dirname7(fileURLToPath5(import.meta.url)), "..");
   const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
   let live = false;
@@ -11266,7 +11494,7 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = dirArg ? resolve9(dirArg) : demoTargetDir(entry);
+  const target = dirArg ? resolve11(dirArg) : demoTargetDir(entry);
   const loaded = await loadDemo(entry, { pkgRoot: pkgRoot2, target, log: (line) => process.stdout.write(line + "\n") });
   if (!loaded.ok) {
     process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
@@ -11297,7 +11525,7 @@ function spawnStep(cmd, args, cwd) {
   });
 }
 async function serveCarveDemo(target, carve, port, live = false) {
-  const at = (rel) => resolve9(target, rel);
+  const at = (rel) => resolve11(target, rel);
   const project = at(carve.project);
   const from = at(carve.from);
   const state = carve.state ? at(carve.state) : void 0;
@@ -11321,7 +11549,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
       process.exit(1);
     }
     process.stdout.write("behold demo carve --live \u2192 terraform init + apply (the starred resources, into the scratch Floci)\u2026\n");
-    if (state) rmSync2(state, { force: true });
+    if (state) rmSync3(state, { force: true });
     const applyErr = await applyIntoFloci(from, spawnStep);
     if (applyErr) {
       await teardownScratchFloci();
@@ -11337,7 +11565,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync14(join21(project, "package.json")) && !existsSync14(join21(project, "node_modules"))) {
+  if (existsSync15(join22(project, "package.json")) && !existsSync15(join22(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -11348,7 +11576,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     }
   }
   let degraded;
-  if (!existsSync14(join21(target, "node_modules", "@cdktf", "hcl2json"))) {
+  if (!existsSync15(join22(target, "node_modules", "@cdktf", "hcl2json"))) {
     process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
     if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
@@ -11364,7 +11592,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
     );
     if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  const serving = !degraded && existsSync14(report) ? report : committed;
+  const serving = !degraded && existsSync15(report) ? report : committed;
   if (degraded) {
     process.stderr.write(
       `behold demo carve: ${degraded}
@@ -11372,7 +11600,7 @@ async function serveCarveDemo(target, carve, port, live = false) {
 `
     );
   }
-  if (!existsSync14(serving)) {
+  if (!existsSync15(serving)) {
     process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
     process.exit(2);
@@ -11417,8 +11645,8 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve9(dirArg ?? process.cwd());
-  if (!existsSync14(projectDir)) {
+  const projectDir = resolve11(dirArg ?? process.cwd());
+  if (!existsSync15(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -11438,26 +11666,26 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve9("behold-export");
+  let outDir = resolve11("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve9(rest[++i]);
+    if (a === "--out") outDir = resolve11(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve9(dirArg ?? process.cwd());
+  const projectDir = resolve11(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync14(projectDir)) {
+  if (!existsSync15(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);