@intentius/behold 0.19.0 → 0.20.0

package/example-writes/README.md

@@ -10,7 +10,7 @@ src/bucket.ts        one S3 Bucket + a TLS-only policy (the whole "infra")
 ops/apply.op.ts      ApplyOp "prod-apply" — code → real AWS (aws cloudformation deploy)
 ops/floci.op.ts      Op "floci-apply" — code → local Floci (CloudFormation API), no account
 ops/reconcile.op.ts  ReconcileOp "prod-reconcile" — cloud → code PR (the Adopt button)
-chant.config.ts      lexicons [aws, temporal], environments [prod]
+chant.config.ts      lexicons [aws], environments [prod]
 ```
 
 The **Sync** button appears because a project declares an `ApplyOp`. A project with
@@ -19,7 +19,7 @@ no `*.op.ts` (like `../example`) shows no Sync — that's expected, not a bug.
 ## Creds-free: deploy to a local emulator (`--local`)
 
 No AWS account? Serve with `--local` and behold boots a local Floci emulator
-(needs Docker), then the **floci-apply** Op deploys the bucket to it — the same
+(needs Docker), then the **floci-apply** Op deploys the bucket to it, the same
 delegated-write path, zero cloud creds:
 
 ```sh
@@ -36,7 +36,7 @@ you Ctrl-C. Everything below uses real AWS instead.
 ## Prerequisites
 
 - Node 20+, and **AWS credentials** in your environment (`aws sts get-caller-identity`
-  should work). The apply creates a real S3 bucket via CloudFormation — a few cents,
+  should work). The apply creates a real S3 bucket via CloudFormation, a few cents,
   torn down at the end. behold holds no creds; `chant` uses yours on this machine.
 - One edit: S3 bucket names are **globally unique**, so change `BucketName` in
   [`src/bucket.ts`](src/bucket.ts) to something of your own (e.g. include your AWS
@@ -59,10 +59,10 @@ npm run dev -- serve example-writes --env prod
    colour flip.)
 2. In the header, click **Sync**. The now-line streams the Op's phases:
    `▶ chant run prod-apply` → Build → Plan → **Apply** (`aws cloudformation deploy`).
-   `prod-apply` is **ungated**, so it applies straight away — no approval step.
+   `prod-apply` is **ungated**, so it applies straight away, no approval step.
 3. When it finishes, the `store` node flips **blue → green (managed)**. Click it: the
    inspect panel's **live** section shows the bucket's observed **physical id** and
-   status. That's the hydration — the cloud's view of your declared resource.
+   status. That's the hydration, the cloud's view of your declared resource.
 4. Click **Refresh** any time to re-check drift and drop a lanes frame.
 
 ## What "gated" looks like

package/example-writes/chant.config.ts

@@ -1,7 +1,7 @@
 import type { TemporalChantConfig } from "@intentius/chant-lexicon-temporal";
 
 export default {
-  lexicons: ["aws", "temporal"],
+  lexicons: ["aws"],
   sourceDir: "src",
   environments: ["prod"],
   ownership: { stack: "behold-writes", env: "prod" },

package/example-writes/ops/apply.op.ts

@@ -1,4 +1,4 @@
-import { ApplyOp } from "@intentius/chant-lexicon-temporal";
+import { ApplyOp } from "@intentius/chant/op";
 
 // code → cloud. Additive apply (no gate) runs one-shot on the local executor —
 // behold's Sync button shells `chant run prod-apply`. Target cloudformation;

package/example-writes/ops/floci.op.ts

@@ -1,4 +1,5 @@
-import { Op, phase, build, awsApply, httpCheck } from "@intentius/chant-lexicon-temporal";
+import { Op, phase, build, httpCheck } from "@intentius/chant/op";
+import { awsApply } from "@intentius/chant-lexicon-aws";
 
 // Deploy the S3 bucket to the local Floci emulator via the CloudFormation API
 // (awsApply — direct create-or-update + poll, no aws CLI, honours the endpoint).
@@ -8,7 +9,6 @@ import { Op, phase, build, awsApply, httpCheck } from "@intentius/chant-lexicon-
 export default Op({
   name: "floci-apply",
   overview: "S3 bucket → local Floci (CloudFormation API), no cloud account",
-  taskQueue: "behold-local",
   phases: [
     phase("Build", [build(".", { script: "build" })]),
     // Stack name = the env ("prod"), so `serve --local --env prod`'s overlay —

package/example-writes/ops/reconcile.op.ts

@@ -1,4 +1,4 @@
-import { ReconcileOp } from "@intentius/chant-lexicon-temporal";
+import { ReconcileOp } from "@intentius/chant/op";
 
 // cloud → code. Snapshot live prod, diff vs source, open a PR for drift/orphans.
 // Scoped to chant-owned resources. behold's Adopt button triggers this.

package/example-writes/package-lock.json

@@ -6,9 +6,8 @@
     "": {
       "name": "behold-example-writes",
       "dependencies": {
-        "@intentius/chant": "^0.54.0",
-        "@intentius/chant-lexicon-aws": "^0.54.0",
-        "@intentius/chant-lexicon-temporal": "^0.54.0"
+        "@intentius/chant": "^0.95.0",
+        "@intentius/chant-lexicon-aws": "^0.95.0"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -443,14 +442,16 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.54.0.tgz",
-      "integrity": "sha512-ETYVPvDWqJiEsaaaYK+1U2lGrZZqHPU6/bOH797oQNw5gd7ESkEoYZxlh0qO90FQGVdx1pQMvmlCWskWD4xIlA==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.95.0.tgz",
+      "integrity": "sha512-zhReqEbP7apFyI9bwHATxSKPbc9HK8W2lJvZpib0YNEgSafydm+dd31Hn+7o3AcHhYbAkLpHFQwlFYbM2uVYCg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
+        "ajv": "^8.20.0",
         "esbuild": "^0.28.1",
         "fflate": "^0.8.2",
+        "js-yaml": "^4.3.1",
         "picomatch": "^4.0.3",
         "tsx": "^4.0.0",
         "typescript": "^5.5.0",
@@ -458,130 +459,44 @@
       },
       "bin": {
         "chant": "bin/chant"
+      },
+      "peerDependencies": {
+        "vitest": ">=2"
+      },
+      "peerDependenciesMeta": {
+        "vitest": {
+          "optional": true
+        }
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.54.0.tgz",
-      "integrity": "sha512-HVyTEmOu73WJXpVpI9C/TyVo34Rbms9uKohb6sob5Y9Oa/T4yly9P5aqsuE6fMDyLwoLZmknW4v7qxENilrFLg==",
+      "version": "0.95.0",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.95.0.tgz",
+      "integrity": "sha512-DHW/cHL4JEU1foEvFK1i2/1Ur4O9meu4dpuyh1o+rnr8DJwW2Ktf7g+84nVDhTjcPVPGE1DROnnQlSuAlu4u8g==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.3.1"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.54.0",
+        "@intentius/chant": "^0.95.0",
         "typescript": "^5.9.3"
       }
     },
-    "node_modules/@intentius/chant-lexicon-temporal": {
-      "version": "0.54.0",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-temporal/-/chant-lexicon-temporal-0.54.0.tgz",
-      "integrity": "sha512-gXjdbhoOKKyGAsCOrgG+O/hUoKyWKoTLLpC4whPiNHtXdoFqdnwkL/CTLfm+xlS898MjSY4widJMa2SWihmbpw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@temporalio/common": "^1.17.2",
-        "js-yaml": "^4.3.1"
-      },
-      "peerDependencies": {
-        "@intentius/chant": "^0.54.0",
-        "typescript": "^5.9.3",
-        "zod": "^4.3.6"
-      }
-    },
-    "node_modules/@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
-      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/fetch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
-      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1"
-      }
-    },
-    "node_modules/@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/utf8": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
-      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@temporalio/common": {
-      "version": "1.22.0",
-      "resolved": "https://registry.npmjs.org/@temporalio/common/-/common-1.22.0.tgz",
-      "integrity": "sha512-1NpQpo/y6XU1ULbo/bXgBEhl6qQnOeB79NrsSJdjI38/hfXPom2IYGJcIxOFfsQICQ0zePEKzB9Yyo31KNpIxA==",
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "license": "MIT",
       "dependencies": {
-        "@temporalio/proto": "1.22.0",
-        "long": "^5.2.3",
-        "ms": "3.0.0-canary.1",
-        "nexus-rpc": "^0.0.2",
-        "proto3-json-serializer": "^2.0.0"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
-      "engines": {
-        "node": ">= 20.3.0"
-      }
-    },
-    "node_modules/@temporalio/proto": {
-      "version": "1.22.0",
-      "resolved": "https://registry.npmjs.org/@temporalio/proto/-/proto-1.22.0.tgz",
-      "integrity": "sha512-X7NVa0Z6HK3l9irZR48FKwZ9w9YXetCdF2z2KCIRr0W7Kul64Wt9o5hwvSXShAtrZuCEEHH8WO/ffHTXxJieLg==",
-      "license": "MIT",
-      "dependencies": {
-        "long": "^5.2.3",
-        "protobufjs": "^7.6.4"
-      },
-      "engines": {
-        "node": ">= 20.3.0"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "26.2.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
-      "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~8.3.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
       }
     },
     "node_modules/argparse": {
@@ -631,6 +546,28 @@
         "@esbuild/win32-x64": "0.28.2"
       }
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fflate": {
       "version": "0.8.3",
       "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
@@ -673,29 +610,11 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
-    },
-    "node_modules/ms": {
-      "version": "3.0.0-canary.1",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-3.0.0-canary.1.tgz",
-      "integrity": "sha512-kh8ARjh8rMN7Du2igDRO9QJnqCb2xYTJxyQYK7vJJS4TvLLmsbyhiKpSW+t+y26gyOyMd0riphX0GeWKU3ky5g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.13"
-      }
-    },
-    "node_modules/nexus-rpc": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/nexus-rpc/-/nexus-rpc-0.0.2.tgz",
-      "integrity": "sha512-IWjIExdVYlmwXuzHdY/Q3lXCv1gbqoAXPazQhy2w4Xgtgha3H0OOujEESVPQcFUFMWm+pAk2gKnb57g8S41JZg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 20.0.0"
-      }
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
     },
     "node_modules/picomatch": {
       "version": "4.0.5",
@@ -709,39 +628,13 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/proto3-json-serializer": {
+    "node_modules/require-from-string": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/proto3-json-serializer/-/proto3-json-serializer-2.0.2.tgz",
-      "integrity": "sha512-SAzp/O4Yh02jGdRc+uIrGoe87dkN/XtwxfZ4ZyafJHymd79ozp5VG5nyZ7ygqPM5+cpLDjjGnYFUkngonyDPOQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "protobufjs": "^7.2.5"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/protobufjs": {
-      "version": "7.6.5",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz",
-      "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.1",
-        "@protobufjs/fetch": "^1.1.1",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.3.2"
-      },
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">=0.10.0"
       }
     },
     "node_modules/tsx": {
@@ -775,12 +668,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "license": "MIT"
-    },
     "node_modules/zod": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",

package/example-writes/package.json

@@ -7,8 +7,7 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.0",
-    "@intentius/chant-lexicon-aws": "^0.54.0",
-    "@intentius/chant-lexicon-temporal": "^0.54.0"
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-lexicon-aws": "^0.95.0"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
@@ -41,20 +41,20 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.5",
-    "@intentius/chant": "^0.61.0",
-    "@intentius/chant-k8s-client": "^0.61.0",
+    "@intentius/chant": "^0.95.0",
+    "@intentius/chant-k8s-client": "^0.95.0",
     "@intentius/pinhole": "^0.3.8",
     "hono": "^4.12.34"
   },
   "peerDependencies": {
-    "@intentius/chant-lexicon-terraform": "^0.61.0",
-    "@cdktf/hcl2json": "^0.21.0"
+    "@intentius/chant-lexicon-terraform": "^0.95.0",
+    "@cdktn/hcl2json": "^0.24.0"
   },
   "peerDependenciesMeta": {
     "@intentius/chant-lexicon-terraform": {
       "optional": true
     },
-    "@cdktf/hcl2json": {
+    "@cdktn/hcl2json": {
       "optional": true
     }
   },

package/web/app.js

@@ -35,6 +35,7 @@ import {
   scaleEnds,
   totalsFor,
   totalsText,
+  deltaRows,
 } from "./behaviour-scale.js";
 import { addPanelTab, initPanel, setPanelTab, togglePanelCollapsed, isPanelCollapsed } from "./panel.js";
 // #254: the carve walkthrough's stepper — everything it DECIDES is a pure
@@ -727,6 +728,15 @@ function inspect(node) {
   // statement about this entity is legible — and where a figure without its
   // provenance would be visible as the contract violation it is.
   renderBehaviourSection(section, blockOf(node));
+  // #402: what the FILE says this entity costs, beside what the account does.
+  // On a card the account no longer holds this is the only behaviour row, and
+  // it says so rather than reading as the card's cost.
+  const declared = node.attrs && node.attrs._behaviourDeclared;
+  if (declared && declared.cost) {
+    const add = section("behaviour · declared");
+    add("cost", figureWithBadge(fmtCost(declared.cost.perHour, declared.cost.currency), [declared], behaviourMeta()));
+    if (!blockOf(node)) add("live", "no live figure — the prediction of the account does not include this entity");
+  }
 
   // Render diff (#146's deferred half): what `chant helm diff <digest> <env>
   // --live --json` said about this chart's PINNED render. Never rely on the
@@ -858,15 +868,22 @@ function inspect(node) {
   const attrKeys = Object.keys(node.attrs || {}).filter((k) => !k.startsWith("_") && !(k === "release" && release));
   if (attrKeys.length) {
     const decl = section("declared");
-    // #393 item 10: an UNOWNED choudoufu card leads with the write that adopts
-    // the object — the two marker tags choudoufu named (`adopt_tofu_estate` /
-    // `adopt_tofu_address`), or its own one-line command if a release ever
-    // sends one. behold composes neither (src/choudoufu-live.ts); this puts
-    // the line first and makes it copyable, the way the moves panel already
-    // does for a `live-mv` line. The paragraph explaining the omission — which
-    // used to be the whole section, with the tags under it as JSON — follows.
+    // #393 item 10: a choudoufu card that can be adopted leads with the write
+    // that does it — the two marker tags choudoufu named (`adopt_tofu_estate` /
+    // `adopt_tofu_address`), or its own one-line command when it sends one.
+    // behold composes neither (src/choudoufu-live.ts); this puts the line
+    // first and makes it copyable, the way the moves panel already does for a
+    // `live-mv` line. The paragraph explaining the omission follows.
+    //
+    // #413: both kinds reach here now. An UNOWNED row carries the marker pair,
+    // and an adoptable one carries choudoufu's own command — so the tooltip
+    // says which of the two this is rather than claiming tags either way.
     const adoptable = node.lexicon === "choudoufu" && typeof node.attrs.adopt === "string" ? "adopt" : null;
-    if (adoptable) copyableRow(decl, adoptable, node.attrs.adopt, "Copy the tags that adopt this object");
+    if (adoptable) {
+      const isCommand = /\s/.test(node.attrs.adopt.trim()) && !node.attrs.adopt.startsWith("tofu-estate=");
+      copyableRow(decl, adoptable, node.attrs.adopt,
+        isCommand ? "Copy the command that adopts this object" : "Copy the tags that adopt this object");
+    }
     for (const k of attrKeys) {
       if (k === adoptable) continue;
       decl(k, fmtValue(node.attrs[k]));
@@ -1735,6 +1752,35 @@ function renderBehaviourTotals(host) {
   // precedence in one place rather than at each call site.
   row(b.total ? "estate · engine total" : "estate", all, b.sum, b.total, b.total ? "the engine stated this estate total itself; behold added nothing" : "behold's sum over the engine's per-entity figures");
   if (mode === "headroom") host.appendChild(panelMuted("min and median computed by behold over the engine's per-entity figures — no engine states a headroom aggregate."));
+  if (mode === "cost") renderBehaviourDelta(host, b);
+}
+
+/**
+ * Live versus declared (#402): what the account costs as it stands, what the
+ * file says it should, and the difference. Present only when the overlay was
+ * asked for at a traffic level, because both figures are predictions *at* one.
+ * The wording of every row is `deltaRows`' (web/behaviour-scale.js).
+ */
+function renderBehaviourDelta(host, b) {
+  const rows = deltaRows(b);
+  if (!rows.length) return;
+  host.appendChild(panelHeading(`live versus declared${b.at ? ` · at ${b.at.traffic}` : ""}`));
+  for (const t of rows) {
+    const r = document.createElement("div");
+    r.className = "behaviour-total";
+    const name = document.createElement("div");
+    name.className = "grow";
+    name.style.fontWeight = "600";
+    name.textContent = t.label;
+    r.appendChild(name);
+    for (const [word, text] of [["live", t.live], ["declared", t.declared], ["delta", t.delta]]) {
+      const line = document.createElement("div");
+      line.textContent = `${word} ${text}`;
+      r.appendChild(line);
+    }
+    host.appendChild(r);
+  }
+  host.appendChild(panelMuted("delta is live minus declared. A negative one means the account holds less than the file declares."));
 }
 
 function renderPanelScope() {

package/web/behaviour-scale.js

@@ -199,6 +199,38 @@ export function fmtCost(perHour, currency) {
 }
 
 /** A headroom fraction as the percentage of capacity still free. */
+/** A signed delta, in the engine's own currency: the sign is the statement. */
+export function fmtDelta(perHour, currency) {
+  const figure = fmtCost(Math.abs(perHour), currency);
+  if (perHour === 0) return `${figure}, no difference`;
+  return `${perHour > 0 ? "+" : "-"}${figure}`;
+}
+
+/**
+ * Live versus declared (#402), as the rows the Scope panel prints: one triple
+ * for the estate, one per member that has a side. Empty when the payload
+ * carries neither figure, which is a request that named no traffic level.
+ *
+ * Each figure says whose it is. `total` is the engine's own statement and
+ * `sum` is behold adding the engine's per-entity figures; the delta is always
+ * behold's subtraction of the two beside it, and a missing side is said, not
+ * left blank, so a reader never takes an absent live figure for a zero.
+ */
+export function deltaRows(meta) {
+  if (!meta || (!meta.live && !meta.declared)) return [];
+  const whose = (f) => (f.basis === "total" ? "engine total" : "behold's sum");
+  const side = (f, missing) => (f ? `${fmtCost(f.perHour, f.currency)} · ${whose(f)}` : missing);
+  const triple = (label, t) => ({
+    label,
+    live: side(t.live, "no live figure"),
+    declared: side(t.declared, "no declared figure"),
+    delta: t.delta ? fmtDelta(t.delta.perHour, t.delta.currency) : "no delta, see diagnostics",
+  });
+  const rows = [triple("estate", meta)];
+  for (const [name, t] of Object.entries(meta.members || {}).sort(([a], [b]) => a.localeCompare(b))) rows.push(triple(name, t));
+  return rows;
+}
+
 export function fmtHeadroom(v) {
   return typeof v === "number" && Number.isFinite(v) ? `${Math.round(v * 100)}% free` : "—";
 }

package/web/behaviour-scale.test.js

@@ -9,6 +9,8 @@ import { describe, it, expect } from "vitest";
 import { THEMES } from "./themes.js";
 import { tokensFor, hexToOklch } from "./theme.js";
 import {
+  deltaRows,
+  fmtDelta,
   badgeFor,
   blockOf,
   countFigures,
@@ -305,3 +307,40 @@ describe("what a refusal and an absence do to the modes (#401)", () => {
     expect(a.refusal).toBeNull();
   });
 });
+
+describe("live versus declared rows (#402)", () => {
+  const live = { perHour: 0.005, currency: "USD", basis: "sum" };
+  const declared = { perHour: 0.01, currency: "USD", basis: "sum" };
+
+  it("signs the delta, and says when there is none", () => {
+    expect(fmtDelta(-0.005, "USD")).toBe("-0.0050 USD/h");
+    expect(fmtDelta(1.5, "USD")).toBe("+1.50 USD/h");
+    expect(fmtDelta(0, "USD")).toBe("0.0000 USD/h, no difference");
+  });
+
+  it("is empty for a payload with neither figure: no traffic level was named", () => {
+    expect(deltaRows(null)).toEqual([]);
+    expect(deltaRows({ engine: "e", sum: { perHour: 1, currency: "USD", priced: 1, unpriced: 0 } })).toEqual([]);
+  });
+
+  it("prints the estate, then each member by name, and says whose each figure is", () => {
+    const rows = deltaRows({
+      live,
+      declared,
+      delta: { perHour: -0.005, currency: "USD" },
+      members: {
+        "team-a": { live: { perHour: 0, currency: "USD", basis: "total" }, declared: { perHour: 0, currency: "USD", basis: "total" }, delta: { perHour: 0, currency: "USD" } },
+        monolith: { live: { ...live, basis: "total" }, declared: { ...declared, basis: "total" }, delta: { perHour: -0.005, currency: "USD" } },
+      },
+    });
+    expect(rows.map((r) => r.label)).toEqual(["estate", "monolith", "team-a"]);
+    expect(rows[0]).toEqual({ label: "estate", live: "0.0050 USD/h · behold's sum", declared: "0.0100 USD/h · behold's sum", delta: "-0.0050 USD/h" });
+    expect(rows[1].live).toBe("0.0050 USD/h · engine total");
+  });
+
+  it("says a missing side is missing rather than printing a zero", () => {
+    const [estate] = deltaRows({ declared });
+    expect(estate.live).toBe("no live figure");
+    expect(estate.delta).toBe("no delta, see diagnostics");
+  });
+});

package/example-choudoufu-estate/.behold.json

@@ -1,8 +0,0 @@
-{
-  "members": [
-    { "dir": "monolith", "kind": "choudoufu" },
-    { "dir": "team-a", "kind": "choudoufu" },
-    { "dir": "team-b", "kind": "choudoufu" },
-    { "dir": "team-c", "kind": "choudoufu" }
-  ]
-}