@intentius/behold 0.19.0 → 0.21.0

package/dist/cli.js

@@ -118,17 +118,17 @@ var init_read_scheduler = __esm({
             recordRefused();
             return Promise.reject(new Error("Chant read queue is full; retry after current reads finish"));
           }
-          let resolve15;
+          let resolve19;
           let reject;
           const promise = new Promise((yes, no) => {
-            resolve15 = yes;
+            resolve19 = yes;
             reject = no;
           });
           job = {
             key,
             run: run3,
             promise,
-            resolve: resolve15,
+            resolve: resolve19,
             reject,
             controller: new AbortController(),
             users: 0,
@@ -142,7 +142,7 @@ var init_read_scheduler = __esm({
         }
         const shared2 = job;
         shared2.users++;
-        const result = new Promise((resolve15, reject) => {
+        const result = new Promise((resolve19, reject) => {
           let done = false;
           const finish = (error, value, failed = false) => {
             if (done) return;
@@ -150,7 +150,7 @@ var init_read_scheduler = __esm({
             signal?.removeEventListener("abort", abort);
             shared2.users--;
             if (failed) reject(error);
-            else resolve15(value);
+            else resolve19(value);
           };
           const abort = () => {
             finish(signal?.reason, void 0, true);
@@ -1038,11 +1038,11 @@ async function createK8sClient(options = {}) {
     }
     return void 0;
   }
-  async function resolve15(selector, signal) {
+  async function resolve19(selector, signal) {
     return "apiVersion" in selector ? resolveByGvk(selector.apiVersion, selector.kind, signal) : resolveByResourceString(selector.resource, selector.group, signal);
   }
   async function resolveOrThrow(selector, signal) {
-    const info = await resolve15(selector, signal);
+    const info = await resolve19(selector, signal);
     if (!info) throw new UnknownResourceError(selectorText(selector));
     return info;
   }
@@ -1054,7 +1054,7 @@ async function createK8sClient(options = {}) {
     return parts.join("/");
   }
   async function pathFor(ref, signal) {
-    const info = await resolve15({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
+    const info = await resolve19({ apiVersion: ref.apiVersion, kind: ref.kind }, signal);
     if (!info) return void 0;
     return objectPath(info, ref.name, ref.namespace);
   }
@@ -1168,8 +1168,8 @@ async function createK8sClient(options = {}) {
           const { lines } = await openStream(listPath, query, controller.signal, target);
           let expired = false;
           const iterator = lines[Symbol.asyncIterator]();
-          const stopped = new Promise((resolve16) => {
-            const finish = () => resolve16({ done: true, value: void 0 });
+          const stopped = new Promise((resolve20) => {
+            const finish = () => resolve20({ done: true, value: void 0 });
             if (controller.signal.aborted) finish();
             else controller.signal.addEventListener("abort", finish, { once: true });
           });
@@ -1196,11 +1196,11 @@ async function createK8sClient(options = {}) {
             resourceVersion = await listResourceVersion();
             continue;
           }
-          await new Promise((resolve16) => {
-            const timer = setTimeout(resolve16, reopenDelayMs);
+          await new Promise((resolve20) => {
+            const timer = setTimeout(resolve20, reopenDelayMs);
             controller.signal.addEventListener("abort", () => {
               clearTimeout(timer);
-              resolve16(void 0);
+              resolve20(void 0);
             }, { once: true });
           });
         }
@@ -1318,7 +1318,7 @@ async function createK8sClient(options = {}) {
   return {
     provenance,
     defaultNamespace,
-    resolve: resolve15,
+    resolve: resolve19,
     read,
     pathFor,
     readIfPresent,
@@ -1576,8 +1576,8 @@ function parseLiveCheckOutput(run3, dir) {
   if (run3.code === 127) return refuse(`choudoufu is not on PATH (${stripAnsi(run3.stderr).trim() || "spawn failed"}).`, INSTALL);
   const text = run3.stdout.trim();
   if (!text) {
-    const said3 = stripAnsiLines(run3.stderr);
-    const why = said3.find((l) => /^Error:/.test(l)) ?? said3[0] ?? `exit ${run3.code}`;
+    const said4 = stripAnsiLines(run3.stderr);
+    const why = said4.find((l) => /^Error:/.test(l)) ?? said4[0] ?? `exit ${run3.code}`;
     return refuse(`choudoufu could not read ${dir}: ${why}`, "Fix the configuration until `choudoufu live-check` prints a document, then reload.");
   }
   let json;
@@ -1734,6 +1734,9 @@ function choudoufuVersion(bin = choudoufuBinary()) {
 function setChoudoufuSpawnEnv(env) {
   spawnEnvOverride = env && Object.keys(env).length ? { ...env } : void 0;
 }
+function choudoufuSpawnOverride() {
+  return spawnEnvOverride ? { ...spawnEnvOverride } : void 0;
+}
 function choudoufuSpawnEnv(base = process.env) {
   return { ...base, ...spawnEnvOverride ?? {}, NO_COLOR: "1" };
 }
@@ -2312,9 +2315,9 @@ function beholdNodeModules(from = beholdDir()) {
     dir = parent;
   }
 }
-function terraformScratchDir(estate, tmp = tmpdir()) {
+function terraformScratchDir(estate, tmp = tmpdir(), flavour = "tf") {
   const target = resolve(estate);
-  const name = `${SCRATCH_PREFIX}tf-${createHash("sha1").update(target).digest("hex").slice(0, 12)}`;
+  const name = `${SCRATCH_PREFIX}${flavour}-${createHash("sha1").update(target).digest("hex").slice(0, 12)}`;
   assertScratch(name);
   let root = resolve(tmp);
   try {
@@ -2327,7 +2330,7 @@ function terraformScratchDir(estate, tmp = tmpdir()) {
   }
   return dir;
 }
-function terraformScratchConfig(scan, estateLink) {
+function terraformScratchConfig(scan, estateLink, flavour = "tf") {
   const roots = [...scan.roots].sort((a, b) => a.name < b.name ? -1 : 1);
   const entries = roots.map((r) => `      ${JSON.stringify(r.name)}: { dir: ${JSON.stringify(r.dir === "." ? estateLink : `${estateLink}/${r.dir}`)} },`);
   return [
@@ -2341,6 +2344,7 @@ function terraformScratchConfig(scan, estateLink) {
     "export default {",
     '  lexicons: ["terraform"],',
     "  terraform: {",
+    ...flavour === "chdf" ? ['    binary: "choudoufu",'] : [],
     "    roots: {",
     ...entries,
     "    },",
@@ -2357,14 +2361,14 @@ function relink(path, target) {
   }
   symlinkSync(target, path);
 }
-function writeTerraformScratchProject(estate, scan, tmp = tmpdir()) {
+function writeTerraformScratchProject(estate, scan, tmp = tmpdir(), flavour = "tf") {
   const target = resolve(estate);
-  const dir = terraformScratchDir(target, tmp);
+  const dir = terraformScratchDir(target, tmp, flavour);
   mkdirSync2(dir, { recursive: true });
   relink(join3(dir, ESTATE_LINK), target);
   const modules = beholdNodeModules();
   if (modules) relink(join3(dir, "node_modules"), modules);
-  const config = terraformScratchConfig(scan, ESTATE_LINK);
+  const config = terraformScratchConfig(scan, ESTATE_LINK, flavour);
   const path = join3(dir, "chant.config.ts");
   if (!existsSync3(path) || readFileSync3(path, "utf8") !== config) writeFileSync2(path, config);
   return dir;
@@ -2398,7 +2402,7 @@ var init_terraform_member = __esm({
     init_terraform_lens();
     init_scratch();
     TERRAFORM_LEXICON_PKG = "@intentius/chant-lexicon-terraform";
-    HCL_PARSER_PKG = "@cdktf/hcl2json";
+    HCL_PARSER_PKG = "@cdktn/hcl2json";
     ROOT_SCAN_DEPTH = 3;
     SKIP_DIRS = /* @__PURE__ */ new Set([".terraform", "node_modules", ".git", "dist", ".chant", "cdk.out"]);
     ROOT_BLOCK = /^(terraform\s*\{|provider\s+")/m;
@@ -2636,6 +2640,7 @@ function verdictFor(address, ls, plan) {
   const gap = ls?.gaps?.find((g) => g.address === address);
   const omission = plan?.omissions?.find((o) => o.addr === address);
   const unowned = plan?.unowned?.find((u) => u.addr === address);
+  const adoptable = plan?.adoptable?.find((a) => a.addr === address);
   const listing = gap ? { listing: gap.detail } : {};
   if (bound) {
     const id = bound.identity || item?.id;
@@ -2649,6 +2654,26 @@ function verdictFor(address, ls, plan) {
   if (omission) {
     const tone = REASON_TONE[omission.reason] ?? "neutral";
     const base = { omission: omission.reason, detail: omission.detail, ...listing };
+    if (omission.reason === "NEEDS_DISCOVERY" && adoptable) {
+      const adopt = adoptLine(adoptable);
+      const matched = (adoptable.matched ?? []).filter((m) => m && m.attribute);
+      return {
+        _status: "warn",
+        physicalId: adoptable.identity,
+        ownership: "foreign",
+        attrs: {
+          // The write to run first, as #393 item 10 settled for the unowned
+          // card. behold composes none of its own: `adoptLine` prints
+          // choudoufu's `adopt_command` when there is one and the two marker
+          // values when there is not.
+          ...adopt ? { adopt } : {},
+          // Then why choudoufu believes it. Rendered as the estate's own
+          // words rather than a shape behold invented.
+          ...matched.length ? { matchedOn: matched.map((m) => `${m.attribute}=${m.value}`).join(", ") } : {},
+          ...base
+        }
+      };
+    }
     if (omission.reason === "UNOWNED" && unowned) {
       const adopt = adoptLine(unowned);
       if (adopt) {
@@ -2918,6 +2943,12 @@ var init_member_kind = __esm({
 import { readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 import { pathToFileURL } from "node:url";
+function readBehaviour(raw) {
+  const b = raw.behaviour;
+  if (!b || typeof b !== "object" || Array.isArray(b)) return void 0;
+  const traffic = b.traffic;
+  return typeof traffic === "string" && traffic.trim() ? { traffic: traffic.trim() } : void 0;
+}
 function readMember(v) {
   if (typeof v === "string") return v ? { dir: v, kind: "chant" } : void 0;
   if (!v || typeof v !== "object") return void 0;
@@ -3072,7 +3103,13 @@ function loadBeholdConfig(projectDir) {
     const tiers = readTiers(raw);
     const members = Array.isArray(raw.members) ? raw.members.map(readMember).filter((m) => !!m) : [];
     const executor = readExecutor(raw);
-    return { ...tiers ? { tiers } : {}, ...members.length ? { members } : {}, ...executor ? { executor } : {} };
+    const behaviour = readBehaviour(raw);
+    return {
+      ...tiers ? { tiers } : {},
+      ...members.length ? { members } : {},
+      ...executor ? { executor } : {},
+      ...behaviour ? { behaviour } : {}
+    };
   } catch {
     return {};
   }
@@ -3142,8 +3179,12 @@ var init_project = __esm({
 import { createHash as createHash2 } from "node:crypto";
 import { readdirSync as readdirSync3, statSync } from "node:fs";
 import { join as join5, relative as relative2, resolve as resolve2 } from "node:path";
+function setStampExclusions(next) {
+  exclusions = new Map([...next].map(([k, v]) => [resolve2(k), new Set(v.map((d) => resolve2(d)))]));
+}
 function memberSourceStamp(dir) {
   const root = resolve2(dir);
+  const skipDirs = exclusions.get(root);
   const h = createHash2("sha1");
   let any = false;
   const walk = (at) => {
@@ -3152,7 +3193,7 @@ function memberSourceStamp(dir) {
       if (SKIP.has(e.name)) continue;
       const path = join5(at, e.name);
       if (e.isDirectory()) {
-        walk(path);
+        if (!skipDirs?.has(path)) walk(path);
         continue;
       }
       if (!e.isFile()) continue;
@@ -3169,11 +3210,12 @@ function memberSourceStamp(dir) {
   }
   return any ? h.digest("hex") : void 0;
 }
-var SKIP;
+var SKIP, exclusions;
 var init_member_source = __esm({
   "src/member-source.ts"() {
     "use strict";
     SKIP = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
+    exclusions = /* @__PURE__ */ new Map();
   }
 });
 
@@ -3887,6 +3929,7 @@ var chant_exports = {};
 __export(chant_exports, {
   CI_FORGES: () => CI_FORGES,
   ChantCliError: () => ChantCliError,
+  TRAFFIC_FLOOR: () => TRAFFIC_FLOOR,
   applyArgs: () => applyArgs,
   carveStatus: () => carveStatus,
   chantBinFrom: () => chantBinFrom,
@@ -3920,6 +3963,7 @@ __export(chant_exports, {
   lifecyclePlan: () => lifecyclePlan,
   lifecyclePlanArgs: () => lifecyclePlanArgs,
   meetsFloor: () => meetsFloor,
+  memberTakesTraffic: () => memberTakesTraffic,
   parseCiPipeline: () => parseCiPipeline,
   pipelineEnvFromYaml: () => pipelineEnvFromYaml,
   readsInFlight: () => readsInFlight,
@@ -3940,7 +3984,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { dirname as dirname4, join as join7, resolve as resolve5 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 function envOverridesFor(opts) {
-  const overrides = {};
+  const overrides = { ...opts.spawnEnv ?? {} };
   if (opts.tier && opts.tierEnvVar) overrides[opts.tierEnvVar] = opts.tier;
   if (opts.substrateTargets?.length) {
     Object.assign(overrides, targetEnvOverrides(opts.substrateTargets, opts.target));
@@ -3949,6 +3993,11 @@ function envOverridesFor(opts) {
   }
   return Object.keys(overrides).length ? overrides : void 0;
 }
+function memberTakesTraffic(dir, kind) {
+  if (kind === "terraform") return true;
+  if (kind !== "chant") return false;
+  return meetsFloor(resolveChant(dir).version, TRAFFIC_FLOOR);
+}
 function graphFlags(opts) {
   const flags = [];
   if (opts.detail !== void 0) flags.push("--detail", String(opts.detail));
@@ -3959,6 +4008,7 @@ function graphFlags(opts) {
   if (opts.live) flags.push("--live");
   if (opts.overlay) flags.push("--overlay");
   if (opts.namespace) flags.push("--namespace", opts.namespace);
+  if (opts.traffic) flags.push("--traffic", opts.traffic);
   return flags;
 }
 function packageManifestFrom(req, name) {
@@ -4304,7 +4354,7 @@ async function helmRenderDiffLive(projectDir, contentDigest, env, opts = {}) {
 function applyArgs(target, env) {
   return ["run", target, "--components", "--env", env, "--progress-json"];
 }
-var reads, unstampableRead, ChantCliError, CI_FORGES;
+var TRAFFIC_FLOOR, reads, unstampableRead, ChantCliError, CI_FORGES;
 var init_chant = __esm({
   "src/chant.ts"() {
     "use strict";
@@ -4318,6 +4368,7 @@ var init_chant = __esm({
     init_yaml();
     init_carve_manifest();
     init_foreign();
+    TRAFFIC_FLOOR = "0.75.0";
     reads = new ReadScheduler();
     unstampableRead = 0;
     ChantCliError = class extends Error {
@@ -4333,8 +4384,8 @@ var init_chant = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve14, dirname as dirname9, join as join27 } from "node:path";
-import { realpathSync as realpathSync2, existsSync as existsSync19, readFileSync as readFileSync21, rmSync as rmSync4 } from "node:fs";
+import { resolve as resolve18, dirname as dirname10, join as join29 } from "node:path";
+import { realpathSync as realpathSync2, existsSync as existsSync21, readFileSync as readFileSync22, rmSync as rmSync4 } from "node:fs";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { spawn as spawn7, spawnSync as spawnSync3 } from "node:child_process";
 
@@ -4392,8 +4443,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync17, readFileSync as readFileSync19 } from "node:fs";
-import { basename as basename2, dirname as dirname7, join as join25, relative as relative8, resolve as resolve13, sep as sep7 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync19 } from "node:fs";
+import { basename as basename3, dirname as dirname7, join as join26, relative as relative8, resolve as resolve16, sep as sep7 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -4635,19 +4686,19 @@ function finishPipelineProgress(state, exitCode) {
 }
 
 // src/gh-run.ts
-var defaultGhExec = (args) => new Promise((resolve15) => {
+var defaultGhExec = (args) => new Promise((resolve19) => {
   let out = "";
   let proc;
   try {
     proc = spawn3("gh", args, { stdio: ["ignore", "pipe", "pipe"] });
   } catch {
-    resolve15({ code: 127, out: "" });
+    resolve19({ code: 127, out: "" });
     return;
   }
   proc.stdout.on("data", (d) => out += d);
   proc.stderr.on("data", (d) => out += d);
-  proc.on("error", () => resolve15({ code: 127, out }));
-  proc.on("close", (code) => resolve15({ code: code ?? 1, out }));
+  proc.on("error", () => resolve19({ code: 127, out }));
+  proc.on("close", (code) => resolve19({ code: code ?? 1, out }));
 });
 async function ghReady(exec = defaultGhExec) {
   const { code, out } = await exec(["auth", "status"]);
@@ -6143,7 +6194,7 @@ async function carveStatesUnder(dirs) {
 init_read_scheduler();
 init_chant();
 import { statSync as statSync5 } from "node:fs";
-import { join as join12, resolve as resolve9, sep as sep4 } from "node:path";
+import { join as join13, resolve as resolve10, sep as sep4 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 
 // src/overlay-ir.ts
@@ -6271,6 +6322,241 @@ function tierMismatchNote(ir, tiers, currentTier) {
   return void 0;
 }
 
+// src/workspace.ts
+init_chant();
+init_floor();
+init_member_source();
+import { existsSync as existsSync8 } from "node:fs";
+import { join as join12, resolve as resolve9 } from "node:path";
+var WORKSPACE_CONTRACT = 1;
+var WORKSPACE_CHANT_FLOOR = "0.81.0";
+var DECLARATION_FILES = ["chant.workspace.json", "chant.workspace.jsonc"];
+function findDeclaration(dir) {
+  const found = DECLARATION_FILES.filter((f) => existsSync8(join12(dir, f)));
+  if (found.length > 1) return { ambiguous: true };
+  return found.length === 1 ? { file: found[0] } : void 0;
+}
+function hasDeclaration(dir) {
+  return findDeclaration(dir) !== void 0;
+}
+var refuse4 = (error, code, remedy) => ({ ok: false, refusal: { error, code, remedy } });
+var isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function parseWorkspaceLs(text, root) {
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return refuse4(`chant workspace ls printed something that is not JSON for ${root}.`, "workspace-ls", "Run `chant workspace ls --json` in the workspace root to see what it says.");
+  }
+  if (!isRecord6(doc)) return refuse4("chant workspace ls printed JSON that is not an object.", "workspace-ls", "Run `chant workspace ls --json` in the workspace root.");
+  const contract = contractRefusal(doc, "ls");
+  if (contract) return { ok: false, refusal: contract };
+  if (isRecord6(doc.error)) {
+    const code = String(doc.error.code ?? "unknown");
+    return refuse4(`chant could not read the workspace declaration in ${root}: ${code}: ${String(doc.error.message ?? "")}`, code, "`chant workspace check` names the problem and where it is.");
+  }
+  const ws = doc.workspace;
+  if (!isRecord6(ws) || typeof ws.name !== "string" || !Array.isArray(doc.members)) {
+    return refuse4("That is not a workspace ls document: it has no `workspace` and `members`.", "workspace-ls", "Run `chant workspace ls --json` in the workspace root.");
+  }
+  const members = [];
+  for (const m of doc.members) {
+    if (!isRecord6(m) || typeof m.name !== "string" || typeof m.dir !== "string" || typeof m.kind !== "string") {
+      return refuse4("A member in the workspace ls document has no name, dir or kind.", "workspace-ls", "Run `chant workspace ls --json` in the workspace root.");
+    }
+    const reason = isRecord6(m.reason) ? { code: String(m.reason.code), message: String(m.reason.message ?? "") } : null;
+    members.push({
+      name: m.name,
+      dir: m.dir,
+      kind: m.kind,
+      abs: m.dir === "." ? resolve9(root) : resolve9(root, m.dir),
+      reason,
+      because: typeof m.because === "string" ? m.because : null
+    });
+  }
+  return {
+    ok: true,
+    workspace: { name: ws.name, root: resolve9(root), file: typeof ws.file === "string" ? ws.file : "chant.workspace.json", chant: String(doc.chant ?? ""), members }
+  };
+}
+function contractRefusal(doc, command) {
+  if (doc.contract === WORKSPACE_CONTRACT) return void 0;
+  const said4 = doc.contract === void 0 ? "no contract version" : `contract ${JSON.stringify(doc.contract)}`;
+  return {
+    error: `chant workspace ${command} wrote a document with ${said4}; behold reads contract ${WORKSPACE_CONTRACT}.`,
+    code: "workspace-contract",
+    remedy: doc.contract === void 0 ? `Upgrade the workspace's chant to ${WORKSPACE_CHANT_FLOOR} or newer.` : "Upgrade behold: this chant writes a newer workspace contract than it knows."
+  };
+}
+async function readWorkspace(root) {
+  const dir = resolve9(root);
+  const found = findDeclaration(dir);
+  if (!found) return refuse4(`${dir} has no chant.workspace.json.`, "declaration-missing", "`chant workspace init` proposes one.");
+  if ("ambiguous" in found) {
+    return refuse4(`${dir} has both chant.workspace.json and chant.workspace.jsonc.`, "declaration-ambiguous", "Keep one of the two files.");
+  }
+  const chant = resolveChant(dir);
+  if (chant.version && !meetsFloor(chant.version, WORKSPACE_CHANT_FLOOR)) {
+    return refuse4(
+      `${dir} declares a chant workspace, and the chant behold would read it with is ${chant.version}; workspaces need ${WORKSPACE_CHANT_FLOOR} or newer.`,
+      "workspace-chant-too-old",
+      `Install @intentius/chant ${WORKSPACE_CHANT_FLOOR} or newer in the workspace root.`
+    );
+  }
+  const run3 = await runChantRaw(["workspace", "ls", dir, "--json"], dir);
+  if (!run3.stdout.trim()) {
+    return refuse4(`chant workspace ls failed in ${dir} (exit ${run3.code}): ${run3.stderr.trim().split("\n").slice(-3).join(" ")}`, "workspace-ls", "Run `chant workspace ls` in the workspace root.");
+  }
+  return parseWorkspaceLs(run3.stdout, dir);
+}
+var served;
+var byDir = /* @__PURE__ */ new Map();
+function setServedWorkspace(ws) {
+  served = ws;
+  byDir.clear();
+  for (const m of ws?.members ?? []) byDir.set(m.abs, m);
+  const root = ws?.members.find((m) => m.dir === ".");
+  setStampExclusions(root && ws ? /* @__PURE__ */ new Map([[root.abs, ws.members.filter((m) => m !== root).map((m) => m.abs)]]) : /* @__PURE__ */ new Map());
+}
+function servedWorkspace() {
+  return served;
+}
+function workspaceMemberOf(dir) {
+  return byDir.get(resolve9(dir));
+}
+var UNDRAWN_KINDS = /* @__PURE__ */ new Set(["other", "workspace"]);
+function drawnMembers(ws) {
+  return ws.members.filter((m) => m.reason === null && !UNDRAWN_KINDS.has(m.kind));
+}
+function unreadableMembers(ws) {
+  return ws.members.filter((m) => m.reason !== null && !UNDRAWN_KINDS.has(m.kind));
+}
+function undrawnMembers(ws) {
+  return ws.members.filter((m) => UNDRAWN_KINDS.has(m.kind));
+}
+function unreadableMemberIr(m) {
+  return {
+    nodes: [
+      {
+        id: "unreadable",
+        kind: "UnreadableMember",
+        lexicon: "workspace",
+        attrs: {
+          _status: "neutral",
+          _unreadable: { code: m.reason?.code ?? "unknown", message: m.reason?.message ?? "" },
+          dir: m.dir,
+          kind: m.kind
+        }
+      }
+    ],
+    edges: [],
+    groups: {}
+  };
+}
+function workspaceGraphTakes(opts) {
+  return opts.detail === void 0 && !opts.lens && !opts.up && !opts.down && !opts.namespace;
+}
+var WorkspaceMemberError = class extends Error {
+  constructor(member, reason) {
+    super(`chant workspace graph could not read ${member}: ${reason.code}: ${reason.message}`);
+    this.member = member;
+    this.reason = reason;
+  }
+  member;
+  reason;
+};
+function stripRefs(value, prefix) {
+  if (Array.isArray(value)) return value.map((v) => stripRefs(v, prefix));
+  if (!isRecord6(value)) return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = k === "$ref" && typeof v === "string" && v.startsWith(prefix) ? v.slice(prefix.length) : stripRefs(v, prefix);
+  }
+  return out;
+}
+function memberIrFromWorkspaceGraph(text, member) {
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    throw new Error("chant workspace graph printed something that is not JSON");
+  }
+  if (!isRecord6(doc)) throw new Error("chant workspace graph printed JSON that is not an object");
+  const contract = contractRefusal(doc, "graph");
+  if (contract) throw new Error(`${contract.error} ${contract.remedy}`);
+  if (isRecord6(doc.error)) throw new Error(`chant workspace graph: ${String(doc.error.code)}: ${String(doc.error.message ?? "")}`);
+  const entry = Array.isArray(doc.members) ? doc.members.find((m) => isRecord6(m) && m.name === member) : void 0;
+  if (!isRecord6(entry)) throw new Error(`chant workspace graph did not list member ${member}`);
+  if (entry.status !== "composed") {
+    const r = isRecord6(entry.reason) ? entry.reason : {};
+    throw new WorkspaceMemberError(member, { code: String(r.code ?? entry.status), message: String(r.message ?? "") });
+  }
+  const p = `${member}/`;
+  const un = (id) => typeof id === "string" && id.startsWith(p) ? id.slice(p.length) : String(id);
+  const mine = (x) => isRecord6(x) && x.member === member;
+  const nodes = (Array.isArray(doc.nodes) ? doc.nodes : []).filter(mine).map((n) => {
+    const { member: _m, ...rest } = n;
+    const out = { ...rest, id: un(n.id), attrs: stripRefs(n.attrs ?? {}, p) };
+    if (typeof n.compositeInstance === "string") out.compositeInstance = un(n.compositeInstance);
+    if (typeof n.runtimeOwner === "string") out.runtimeOwner = un(n.runtimeOwner);
+    return out;
+  });
+  const edges = (Array.isArray(doc.edges) ? doc.edges : []).filter(mine).map((e) => {
+    const { member: _m, ...rest } = e;
+    return { ...rest, from: un(e.from), to: un(e.to) };
+  });
+  const own = new Set(nodes.map((n) => n.id));
+  const groups = {};
+  if (isRecord6(doc.groups)) {
+    for (const [key, table] of Object.entries(doc.groups)) {
+      if (key === "byMember" || !isRecord6(table)) continue;
+      const scoped = key === "byStack" || key === "byContainer" || key === "byWave";
+      for (const [k, ids] of Object.entries(table)) {
+        if (scoped && !k.startsWith(p)) continue;
+        const members = (Array.isArray(ids) ? ids : []).map(un).filter((id) => own.has(id));
+        if (members.length) (groups[key] ??= {})[scoped ? k.slice(p.length) : k] = members;
+      }
+    }
+  }
+  const exports = (Array.isArray(doc.exports) ? doc.exports : []).filter(mine).map((e) => {
+    const { member: _m, ...rest } = e;
+    return typeof e.node === "string" ? { ...rest, node: un(e.node) } : rest;
+  });
+  const imports = (Array.isArray(doc.imports) ? doc.imports : []).filter(mine).map((i) => {
+    const { member: _m, ...rest } = i;
+    return { ...rest, node: un(i.node) };
+  });
+  const ir = { version: 1, nodes, edges, groups, exports, imports };
+  if (isRecord6(entry.meta)) ir.meta = entry.meta;
+  if (entry.pipeline !== void 0) ir.pipeline = entry.pipeline;
+  if (isRecord6(doc.derivedAttrs)) ir.derivedAttrs = doc.derivedAttrs;
+  return ir;
+}
+function workspaceGraphArgs(root, member, opts) {
+  const args = ["workspace", "graph", root, "--member", member];
+  if (opts.env) args.push("--env", opts.env);
+  if (opts.live) args.push("--live");
+  if (opts.overlay) args.push("--overlay");
+  if (opts.traffic) args.push("--traffic", opts.traffic);
+  return args;
+}
+var CONTRACT_READ_KINDS = /* @__PURE__ */ new Set(["chant", "terraform"]);
+function workspaceVia(member, root, fallback) {
+  return {
+    tool: (dir) => {
+      const chant = resolveChant(root);
+      return `workspace\0${chant.bin}\0${chant.version ?? ""}\0${fallback.tool(dir)}`;
+    },
+    read: async (dir, opts) => {
+      if (!workspaceGraphTakes(opts)) return fallback.read(dir, opts);
+      const args = workspaceGraphArgs(root, member.name, opts);
+      const run3 = await runChantRaw(args, root, envOverridesFor(opts));
+      if (!run3.stdout.trim()) throw new Error(`chant ${args.join(" ")} exited ${run3.code}: ${run3.stderr.trim()}`);
+      return memberIrFromWorkspaceGraph(run3.stdout, member.name);
+    }
+  };
+}
+
 // src/estate.ts
 function estateReadPool(members, env = process.env) {
   return Math.max(1, Math.min(readConcurrency(env), members));
@@ -6287,14 +6573,35 @@ async function mapPool(items, width, fn) {
   return results;
 }
 function estateMembers(projectDirs) {
-  const names = shortStackNames([...projectDirs]);
-  return projectDirs.map((dir, i) => ({ name: names[i], dir, kind: memberKindOf(dir) ?? "chant" }));
+  const names = estateMemberNames(projectDirs);
+  const kindOf2 = (dir) => workspaceMemberOf(dir)?.kind ?? memberKindOf(dir) ?? "chant";
+  return projectDirs.map((dir, i) => ({ name: names[i], dir, kind: kindOf2(dir) }));
+}
+function estateMemberNames(projectDirs) {
+  const declared = projectDirs.map((d) => workspaceMemberOf(d)?.name);
+  if (declared.every((n) => n !== void 0)) return declared;
+  return shortStackNames([...projectDirs]);
+}
+function unreadableStacks(projectDirs) {
+  const ws = servedWorkspace();
+  if (!ws || !projectDirs.every((d) => workspaceMemberOf(d))) return [];
+  return unreadableMembers(ws).map((m) => ({ name: m.name, ir: unreadableMemberIr(m) }));
+}
+var memberViaFor = (dir) => {
+  const own = memberKindSpec(memberKindOf(dir) ?? "chant")?.via ?? chantVia;
+  const declared = workspaceMemberOf(dir);
+  const ws = servedWorkspace();
+  return declared && ws && CONTRACT_READ_KINDS.has(declared.kind) ? workspaceVia(declared, ws.root, own) : own;
+};
+function forMember(dir, opts) {
+  if (!opts.traffic || memberTakesTraffic(dir, memberKindOf(dir) ?? "chant")) return opts;
+  const { traffic: _traffic, ...rest } = opts;
+  return rest;
 }
-var memberViaFor = (dir) => memberKindSpec(memberKindOf(dir) ?? "chant")?.via ?? chantVia;
-var memberSource = (dir, opts) => memberIr(dir, opts, memberViaFor(dir));
-var memberLive = (dir, opts, fresh) => overlayIr(dir, opts, memberViaFor(dir), fresh);
+var memberSource = (dir, opts) => memberIr(dir, forMember(dir, opts), memberViaFor(dir));
+var memberLive = (dir, opts, fresh) => overlayIr(dir, forMember(dir, opts), memberViaFor(dir), fresh);
 async function composeEstate(projectDirs, opts = {}) {
-  const names = shortStackNames(projectDirs);
+  const names = estateMemberNames(projectDirs);
   const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => ({
     name: names[i],
     // chant#2040: the manifests a member holds name the files its carved
@@ -6302,17 +6609,17 @@ async function composeEstate(projectDirs, opts = {}) {
     // known, onto a COPY (the member IR is the #312 cache's own object).
     ir: joinCarvedSources(await memberSource(dir, opts), (await carveStatesFor(dir)).values(), dir).ir
   }));
-  return composeStacks(stacks);
+  return composeStacks([...stacks, ...unreadableStacks(projectDirs)]);
 }
 async function composeEstatePending(projectDirs, opts = {}) {
-  const names = shortStackNames(projectDirs);
+  const names = estateMemberNames(projectDirs);
   const { env: _env, live: _live, overlay: _overlay, ...srcOpts } = opts;
   const stacks = await mapPool(projectDirs, estateReadPool(projectDirs.length), async (dir, i) => {
     const ir = joinCarvedSources(await memberSource(dir, srcOpts), (await carveStatesFor(dir)).values(), dir).ir;
     for (const n of ir.nodes) n.attrs = { ...n.attrs, _pendingRead: true };
     return { name: names[i], ir };
   });
-  return composeStacks(stacks);
+  return composeStacks([...stacks, ...unreadableStacks(projectDirs)]);
 }
 var firstLine2 = (e) => {
   const msg = e instanceof Error ? e.message : String(e);
@@ -6361,11 +6668,11 @@ function declaredSegments(path) {
 function pathAlignment(declared, dir, isDir = realIsDir) {
   const want = declaredSegments(declared);
   if (!want) return 0;
-  const root = resolve9(dir);
+  const root = resolve10(dir);
   const have = root.split(sep4).filter(Boolean);
   for (let k = Math.min(want.length, have.length); k >= 1; k--) {
     if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join12(root, ...want.slice(k)))) continue;
+    if (!isDir(join13(root, ...want.slice(k)))) continue;
     return k;
   }
   return 0;
@@ -6395,10 +6702,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join28 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join28 });
+    const join30 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join30 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join28 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join30 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -6422,7 +6729,7 @@ function withoutJoinedMembers(nodes, joined) {
   return nodes.filter((n) => !joined.some((j) => n.id.startsWith(`${j.name}/`)));
 }
 async function composeEstateOverlay(projectDirs, opts, classify, observe = {}) {
-  const names = shortStackNames(projectDirs);
+  const names = estateMemberNames(projectDirs);
   const unobserved = [];
   const dropped = [];
   const joined = [];
@@ -6456,7 +6763,7 @@ async function composeEstateOverlay(projectDirs, opts, classify, observe = {}) {
   });
   const present = stacks.filter((s) => !!s);
   return {
-    ir: composeStacks(present),
+    ir: composeStacks([...present, ...unreadableStacks(projectDirs)]),
     observed: present.length - unobserved.length,
     total: projectDirs.length,
     unobserved,
@@ -7123,8 +7430,8 @@ function projectHelmLogical(ir) {
 }
 
 // src/logical-kustomize.ts
-import { existsSync as existsSync8 } from "node:fs";
-import { join as join13 } from "node:path";
+import { existsSync as existsSync9 } from "node:fs";
+import { join as join14 } from "node:path";
 function overlayBoxTitle(name) {
   return `overlay ${name}`;
 }
@@ -7144,7 +7451,7 @@ function kustomizationRoot(bases, dir, exists) {
   let current = dir;
   for (let i = 0; i < 4 && current; i++) {
     for (const base of bases) {
-      if (exists(join13(base, current, "kustomization.yaml")) || exists(join13(base, current, "kustomization.yml"))) {
+      if (exists(join14(base, current, "kustomization.yaml")) || exists(join14(base, current, "kustomization.yml"))) {
         return current;
       }
     }
@@ -7153,7 +7460,7 @@ function kustomizationRoot(bases, dir, exists) {
   }
   return void 0;
 }
-function projectKustomizeLogical(ir, sourceRoots, exists = existsSync8) {
+function projectKustomizeLogical(ir, sourceRoots, exists = existsSync9) {
   const bases = Array.isArray(sourceRoots) ? sourceRoots : [sourceRoots];
   const k8s = ir.nodes.filter((n) => n.lexicon === "k8s");
   if (k8s.length === 0) return { ir: { nodes: [], edges: [], groups: {} }, byContainer: {} };
@@ -7934,9 +8241,9 @@ import {
 
 // src/icon-packs.ts
 import { readFileSync as readFileSync10 } from "node:fs";
-import { dirname as dirname5, join as join14 } from "node:path";
+import { dirname as dirname5, join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-var ICON_ROOT = join14(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
+var ICON_ROOT = join15(dirname5(fileURLToPath3(import.meta.url)), "..", "web", "icons");
 var cache4 = /* @__PURE__ */ new Map();
 function unprefix(body) {
   return body.replace(/\s(?:inkscape|sodipodi):[\w-]+\s*=\s*(["'])[\s\S]*?\1/g, "").replace(/\sxlink:href\s*=/g, " href=");
@@ -7958,7 +8265,7 @@ function plate(glyph) {
 function loadIcon(rel) {
   const hit = cache4.get(rel);
   if (hit) return hit;
-  const raw = readFileSync10(join14(ICON_ROOT, `${rel}.svg`), "utf8");
+  const raw = readFileSync10(join15(ICON_ROOT, `${rel}.svg`), "utf8");
   const open = raw.indexOf("<svg");
   const openEnd = raw.indexOf(">", open);
   const close = raw.lastIndexOf("</svg");
@@ -8119,22 +8426,22 @@ init_carve_manifest();
 
 // src/ops-lens.ts
 var SUPPORTED_MAJOR2 = 1;
-var refuse4 = (error, remedy) => ({ ok: false, refusal: { error, code: "op-ir", remedy } });
+var refuse5 = (error, remedy) => ({ ok: false, refusal: { error, code: "op-ir", remedy } });
 var HOW_TO_EMIT = "Build the project with a chant >= 0.50 (`chant build --lexicon temporal`), which writes `dist/ops/<name>/op.json` beside each Op's generated workflow.";
-var isRecord6 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function parseOpIr(value) {
-  if (!isRecord6(value)) {
-    return refuse4("That file isn't an op.json \u2014 its top level isn't a JSON object.", HOW_TO_EMIT);
+  if (!isRecord7(value)) {
+    return refuse5("That file isn't an op.json \u2014 its top level isn't a JSON object.", HOW_TO_EMIT);
   }
   if (typeof value.name !== "string" || !Array.isArray(value.phases)) {
-    return refuse4(
+    return refuse5(
       "That JSON doesn't look like an op.json \u2014 it needs a string `name` and a `phases` array.",
       HOW_TO_EMIT
     );
   }
-  const bad2 = value.phases.findIndex((p) => !isRecord6(p) || typeof p.name !== "string" || !Array.isArray(p.steps));
+  const bad2 = value.phases.findIndex((p) => !isRecord7(p) || typeof p.name !== "string" || !Array.isArray(p.steps));
   if (bad2 >= 0) {
-    return refuse4(
+    return refuse5(
       `That JSON has a \`phases\` array, but entry ${bad2} isn't a phase (needs a string \`name\` and a \`steps\` array).`,
       HOW_TO_EMIT
     );
@@ -8143,7 +8450,7 @@ function parseOpIr(value) {
   if (version !== void 0) {
     const major = Number(String(version).split(".")[0]);
     if (!Number.isFinite(major) || major !== SUPPORTED_MAJOR2) {
-      return refuse4(
+      return refuse5(
         `This op.json declares format version ${String(version)}; behold reads version ${SUPPORTED_MAJOR2}.`,
         "Upgrade behold, or render the Op with a behold that speaks its version."
       );
@@ -8156,13 +8463,13 @@ function readOpIr(path, readFile) {
   try {
     text = readFile(path);
   } catch (err) {
-    return refuse4(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
+    return refuse5(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
   }
   let json;
   try {
     json = JSON.parse(text);
   } catch (err) {
-    return refuse4(`${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
+    return refuse5(`${path} isn't valid JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_EMIT);
   }
   return parseOpIr(json);
 }
@@ -8229,14 +8536,14 @@ function opPlacedSteps(op) {
 }
 var RULE_BOX = (opName) => `${opName} \xB7 rule table`;
 var ruleId = (opName, rule) => `${opName}/rules/${rule.id}`;
-var isPredicate = (v) => isRecord6(v) && typeof v.kind === "string";
+var isPredicate = (v) => isRecord7(v) && typeof v.kind === "string";
 function isConvergeRule(v) {
-  if (!isRecord6(v)) return false;
+  if (!isRecord7(v)) return false;
   if (typeof v.id !== "string" || !v.id) return false;
   if (typeof v.why !== "string" || !v.why) return false;
   if (!isPredicate(v.when)) return false;
   const then = v.then;
-  if (!isRecord6(then)) return false;
+  if (!isRecord7(then)) return false;
   return then.kind === "run" && typeof then.op === "string" || then.kind === "report" && typeof then.reason === "string";
 }
 function convergeTable(op) {
@@ -8577,15 +8884,15 @@ function entityCountClause(ir) {
 var LAYOUT_ROW_VIA = "_layout-row";
 var ROW_ASPECT = 2.4;
 var ROW_MIN_CARDS = 6;
-function rowColumns(n, cell, sep8, aspect = ROW_ASPECT) {
+function rowColumns(n, cell, sep9, aspect = ROW_ASPECT) {
   if (n < 2) return Math.max(1, n);
-  const cols = Math.round(Math.sqrt(n * (cell.h + sep8.y) * aspect / (cell.w + sep8.x)));
+  const cols = Math.round(Math.sqrt(n * (cell.h + sep9.y) * aspect / (cell.w + sep9.x)));
   return Math.max(1, Math.min(n, cols));
 }
 var FALLBACK = { w: 175, h: 104 };
 function withRowChains(ir, groups, opts) {
   const min = opts.min ?? ROW_MIN_CARDS;
-  const sep8 = { x: opts.nodesep ?? 64, y: opts.ranksep ?? 72 };
+  const sep9 = { x: opts.nodesep ?? 64, y: opts.ranksep ?? 72 };
   const known = new Set(ir.nodes.map((n) => n.id));
   const boxOf2 = /* @__PURE__ */ new Map();
   for (const [key, ids] of Object.entries(groups)) for (const id of ids) if (known.has(id)) boxOf2.set(id, key);
@@ -8606,7 +8913,7 @@ function withRowChains(ir, groups, opts) {
       },
       { w: 0, h: 0 }
     );
-    const cols = rowColumns(ids.length, cell.w ? cell : FALLBACK, sep8, opts.aspect);
+    const cols = rowColumns(ids.length, cell.w ? cell : FALLBACK, sep9, opts.aspect);
     if (cols >= ids.length) continue;
     const bands = bandsOf(ids, opts.bandOf);
     let rows = 0;
@@ -9364,17 +9671,17 @@ function gridComponent(one, sizes) {
     },
     { w: NODE_W, h: NODE_H }
   );
-  const sep8 = { x: 48, y: 60 };
-  const cols = rowColumns(order.length, cell, sep8);
+  const sep9 = { x: 48, y: 60 };
+  const cols = rowColumns(order.length, cell, sep9);
   const local = /* @__PURE__ */ new Map();
   order.forEach((n, i) => {
     local.set(n.id, {
-      x: i % cols * (cell.w + sep8.x) + cell.w / 2,
-      y: Math.floor(i / cols) * (cell.h + sep8.y) + cell.h / 2
+      x: i % cols * (cell.w + sep9.x) + cell.w / 2,
+      y: Math.floor(i / cols) * (cell.h + sep9.y) + cell.h / 2
     });
   });
   const rows = Math.ceil(order.length / cols);
-  return { local, w: Math.min(cols, order.length) * (cell.w + sep8.x) - sep8.x, h: rows * (cell.h + sep8.y) - sep8.y };
+  return { local, w: Math.min(cols, order.length) * (cell.w + sep9.x) - sep9.x, h: rows * (cell.h + sep9.y) - sep9.y };
 }
 function packBoxComponents(layout, ir, boxes, bandOf) {
   const grids = /* @__PURE__ */ new Map();
@@ -9618,12 +9925,12 @@ init_carve_manifest();
 
 // src/carve-actions.ts
 init_chant();
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join17, relative as relative4, resolve as resolve10, sep as sep5 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync13, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join18, relative as relative4, resolve as resolve11, sep as sep5 } from "node:path";
 
 // src/layout.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
-import { join as join15 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync11, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync4, accessSync, constants } from "node:fs";
+import { join as join16 } from "node:path";
 var LAYOUT_DIR = ".behold";
 var LAYOUT_FILE = "layout.json";
 var MAX_BODY_BYTES = 64 * 1024;
@@ -9664,10 +9971,10 @@ function lensFromQuery(params) {
   return [slug2(zoom), params.get("radial") === "1" ? "radial" : null, stack ? slug2(`stack-${stack}`) : null].filter(Boolean).join("+");
 }
 function layoutPath(projectDir) {
-  return join15(projectDir, LAYOUT_DIR, LAYOUT_FILE);
+  return join16(projectDir, LAYOUT_DIR, LAYOUT_FILE);
 }
 function unwritableReason(projectDir) {
-  if (!projectDir || !existsSync9(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
+  if (!projectDir || !existsSync10(projectDir)) return `no such project directory: ${projectDir || "(none)"}`;
   try {
     accessSync(projectDir, constants.W_OK);
   } catch {
@@ -9679,7 +9986,7 @@ function readLayoutFile(projectDir) {
   const empty = { version: 1, lenses: {} };
   const file = layoutPath(projectDir);
   try {
-    if (!existsSync9(file)) return empty;
+    if (!existsSync10(file)) return empty;
     const raw = readFileSync11(file, "utf8");
     if (raw.length > MAX_FILE_BYTES) return empty;
     const parsed = JSON.parse(raw);
@@ -9720,7 +10027,7 @@ function writeLens(projectDir, lens, deltas) {
   }
   const body = JSON.stringify({ version: 1, lenses }, null, 2) + "\n";
   if (body.length > MAX_FILE_BYTES) throw new LayoutTooLarge(`a layout sidecar is capped at ${MAX_FILE_BYTES} bytes`);
-  mkdirSync4(join15(projectDir, LAYOUT_DIR), { recursive: true });
+  mkdirSync4(join16(projectDir, LAYOUT_DIR), { recursive: true });
   const tmp = `${file}.tmp`;
   writeFileSync4(tmp, body, "utf8");
   renameSync(tmp, file);
@@ -9806,8 +10113,8 @@ function reanchorEdges(svg, moved) {
 // src/carve-live.ts
 init_scratch();
 import { spawn as spawn4 } from "node:child_process";
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, existsSync as existsSync11 } from "node:fs";
+import { join as join17 } from "node:path";
 var LIVE_CONTAINER = "behold-carve-floci";
 var LIVE_PORT = 4602;
 var LIVE_IMAGE = "floci/floci:1.5.34";
@@ -9867,9 +10174,9 @@ async function teardownScratchFloci() {
   await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
 }
 async function applyIntoFloci(fromDir, step) {
-  const template = join16(fromDir, "floci-override.tf.disabled");
-  if (!existsSync10(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
-  writeFileSync5(join16(fromDir, "floci_override.tf"), armOverride(readFileSync12(template, "utf8"), LIVE_PORT));
+  const template = join17(fromDir, "floci-override.tf.disabled");
+  if (!existsSync11(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
+  writeFileSync5(join17(fromDir, "floci_override.tf"), armOverride(readFileSync12(template, "utf8"), LIVE_PORT));
   const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
   if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
   const apply = await step(
@@ -9893,7 +10200,7 @@ ${tail}`, exitCode: r.code };
 // src/carve-actions.ts
 async function runCarvePlan(demo) {
   if (!demo?.live) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       "terraform plan is the live tier's beat, and this server isn't serving one",
       "run `behold demo carve --live` (needs docker + terraform)"
@@ -9901,7 +10208,7 @@ async function runCarvePlan(demo) {
   }
   const r = await runLivePlan(demo.from);
   if ("error" in r) {
-    return refuse5("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
+    return refuse6("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
   }
   return {
     ok: true,
@@ -9913,14 +10220,14 @@ async function runCarvePlan(demo) {
 }
 async function runCarveObserve(demo, select) {
   if (!demo.live) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       "the observe beat reads the scratch Floci, and this server isn't serving one",
       "run `behold demo carve --live` (needs docker + terraform)"
     );
   }
-  if (!existsSync11(join17(demo.out, "src"))) {
-    return refuse5("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
+  if (!existsSync12(join18(demo.out, "src"))) {
+    return refuse6("carve-action", "nothing has been emitted yet", "run Emit first \u2014 observe reads the carveout emit writes");
   }
   const args = ["lifecycle", "diff", "prod", "--live", "--json"];
   const run3 = await runChantRaw(args, demo.out, { AWS_ENDPOINT_URL: demo.live.endpoint }).catch((err) => ({
@@ -9929,7 +10236,7 @@ async function runCarveObserve(demo, select) {
     stderr: err instanceof Error ? err.message : String(err)
   }));
   if (run3.code !== 0) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       `chant lifecycle diff exited ${run3.code}: ${merge(run3, demo.root) || "(no output)"}`,
       "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + "."
@@ -9939,10 +10246,10 @@ async function runCarveObserve(demo, select) {
   try {
     parsed = JSON.parse(run3.stdout);
   } catch {
-    return refuse5("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
+    return refuse6("carve-action", "chant lifecycle diff answered something that isn't JSON", "re-run \u2014 a partial read is not a verdict");
   }
   if (parsed.stacks && !parsed.lexicons) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       "chant lifecycle diff answered a stacked shape ({stacks}) \u2014 observe only reads the stack-less {lexicons} shape",
       "point the target at a stack-less carveout, or file a shape-read gap against observe for the stacked case"
@@ -9983,13 +10290,13 @@ async function runCarveObserve(demo, select) {
 var MAX_ARTIFACT_BYTES = 64 * 1024;
 var MAX_ARTIFACTS = 24;
 var MAX_OUTPUT_BYTES = 32 * 1024;
-var refuse5 = (code, error, remedy) => ({
+var refuse6 = (code, error, remedy) => ({
   ok: false,
   refusal: { error, code, remedy }
 });
 var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
 function insideDemo(root, p) {
-  const rel = relative4(resolve10(root), resolve10(p));
+  const rel = relative4(resolve11(root), resolve11(p));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function selectFromReport(report, raw) {
@@ -10000,7 +10307,7 @@ function carveWriteBlock(demo) {
   if (!demo) {
     return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
   }
-  if (!existsSync11(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!existsSync12(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
   if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
   return unwritableReason(demo.root);
 }
@@ -10017,7 +10324,7 @@ function readArtifacts(demo, dir, filter) {
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join17(d, name);
+      const full = join18(d, name);
       let st;
       try {
         st = statSync6(full);
@@ -10062,9 +10369,9 @@ function merge(r, root) {
 }
 async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
-  if (block) return refuse5("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  if (block) return refuse6("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync5(demo.out, { recursive: true });
-  const reportFile = join17(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join18(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -10085,10 +10392,10 @@ async function runCarveEmit(demo, select) {
   }));
   const output = merge(run3, demo.root);
   if (run3.code !== 0) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       `chant carve emit exited ${run3.code}: ${output || "(no output)"}`,
-      "The offline emit needs `@cdktf/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
+      "The offline emit needs `@cdktn/hcl2json` in the demo copy and the demo's own chant install \u2014 `npm install` in the copy's `app/` and re-run `behold demo carve`."
     );
   }
   let boundary = null;
@@ -10096,7 +10403,7 @@ async function runCarveEmit(demo, select) {
     boundary = JSON.parse(readFileSync13(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative4(demo.project, join17(demo.out, "src")).split(sep5).join("/");
+  const lintPath = relative4(demo.project, join18(demo.out, "src")).split(sep5).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -10120,7 +10427,7 @@ async function runCarveEmit(demo, select) {
 }
 async function runCarveBridge(demo, select) {
   const block = carveWriteBlock(demo);
-  if (block) return refuse5("read-only", block, "Start the walkthrough with `behold demo carve`.");
+  if (block) return refuse6("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync5(demo.out, { recursive: true });
   const args = [
     "carve",
@@ -10140,7 +10447,7 @@ async function runCarveBridge(demo, select) {
   }));
   const output = merge(run3, demo.root);
   if (run3.code !== 0) {
-    return refuse5(
+    return refuse6(
       "carve-action",
       `chant carve bridge exited ${run3.code}: ${output || "(no output)"}`,
       "Run the Emit step first \u2014 bridge reads the carve manifest emit leaves in the output directory."
@@ -10159,8 +10466,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync9, readFileSync as readFileSync14, existsSync as existsSync12 } from "node:fs";
-import { join as join18 } from "node:path";
+import { readdirSync as readdirSync9, readFileSync as readFileSync14, existsSync as existsSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -10182,11 +10489,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join18(projectDir, sub);
-    if (!existsSync12(dir)) continue;
+    const dir = join19(projectDir, sub);
+    if (!existsSync13(dir)) continue;
     for (const f of readdirSync9(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync14(join18(dir, f), "utf8");
+      const content = readFileSync14(join19(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -10202,25 +10509,25 @@ function discoverOps(projectDir) {
         ...gate ? { gate } : {},
         ...env ? { env } : {},
         ...substrate ? { substrate } : {},
-        ...existsSync12(irPath) ? { irPath } : {}
+        ...existsSync13(irPath) ? { irPath } : {}
       });
     }
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function opIrPath(projectDir, name) {
-  return join18(projectDir, "dist", "ops", name, "op.json");
+  return join19(projectDir, "dist", "ops", name, "op.json");
 }
 function discoverOpIrs(projectDirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const dir of projectDirs) {
-    const root = join18(dir, "dist", "ops");
-    if (!existsSync12(root)) continue;
+    const root = join19(dir, "dist", "ops");
+    if (!existsSync13(root)) continue;
     for (const name of readdirSync9(root)) {
       if (seen.has(name)) continue;
       const path = opIrPath(dir, name);
-      if (!existsSync12(path)) continue;
+      if (!existsSync13(path)) continue;
       seen.add(name);
       out.push({ name, dir, path });
     }
@@ -10244,9 +10551,9 @@ function discoverEstateOps(projectDirs) {
 var RECEIPT_READ_FN = "receiptRead";
 var RECEIPT_WRITE_FN = "receiptWrite";
 var STEP_STATUSES = /* @__PURE__ */ new Set(["ok", "fail", "skipped"]);
-var isRecord7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isRecord8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function asStepRecord(value) {
-  if (!isRecord7(value)) return null;
+  if (!isRecord8(value)) return null;
   if (typeof value.phase !== "string" || typeof value.fn !== "string") return null;
   if (typeof value.status !== "string" || !STEP_STATUSES.has(value.status)) return null;
   if (typeof value.durationMs !== "number") return null;
@@ -10261,7 +10568,7 @@ function parseRunProgressLine(line) {
   }
   const one = asStepRecord(parsed);
   if (one) return [one];
-  if (isRecord7(parsed) && typeof parsed.op === "string" && Array.isArray(parsed.records)) {
+  if (isRecord8(parsed) && typeof parsed.op === "string" && Array.isArray(parsed.records)) {
     const records = parsed.records.map(asStepRecord).filter((r) => r !== null);
     return records.length ? records : null;
   }
@@ -10455,11 +10762,11 @@ var RAN = { ok: "ok", fail: "failed", skipped: "skipped" };
 function tookLabel(ms) {
   return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
 }
-function paintPlayhead(ir, join28, gate) {
-  if (!join28.byNode.size && !join28.at) return ir;
+function paintPlayhead(ir, join30, gate) {
+  if (!join30.byNode.size && !join30.at) return ir;
   const nodes = ir.nodes.map((node) => {
-    const run3 = join28.byNode.get(node.id);
-    const here = join28.at === node.id;
+    const run3 = join30.byNode.get(node.id);
+    const here = join30.at === node.id;
     if (!run3 && !here) return node;
     const isGate = node.attrs?._step === "gate";
     const attrs = { ...node.attrs };
@@ -10474,7 +10781,7 @@ function paintPlayhead(ir, join28, gate) {
     if (here) {
       attrs._playhead = true;
       attrs._status = isGate && gate ? "warn" : "accent";
-      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join28.atReason ?? "here";
+      attrs.run = isGate && gate ? `waiting for approval since ${gate.since}` : join30.atReason ?? "here";
       if (isGate && gate?.description) attrs.gateDescription = gate.description;
     }
     return { ...node, attrs };
@@ -10496,11 +10803,11 @@ function pendingGateCard(op, gate, ir) {
     }
   };
 }
-function playheadNote(state, join28) {
+function playheadNote(state, join30) {
   if (!state.op) {
     return "No run state: nothing has been run from this behold session, so every step paints as declared.";
   }
-  const settled = join28 ? join28.byNode.size : state.records.length;
+  const settled = join30 ? join30.byNode.size : state.records.length;
   const bits = [];
   const head = state.status === "idle" ? `Run state for ${state.op}: no per-step records \u2014 this behold session didn't start the run, so only the gate query answers` : `Run: ${state.op} (${state.mode === "temporal" ? "durable" : "local executor"}) \u2014 ${settled} step${settled === 1 ? "" : "s"} settled`;
   if (state.status === "running") {
@@ -10516,9 +10823,9 @@ function playheadNote(state, join28) {
   } else if (state.gateNote) {
     bits.push(`gate state unavailable \u2014 ${state.gateNote}`);
   }
-  if (join28?.unplaced.length) {
+  if (join30?.unplaced.length) {
     bits.push(
-      `${join28.unplaced.length} record${join28.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join28.unplaced.length === 1 ? "is" : "are"} not painted`
+      `${join30.unplaced.length} record${join30.unplaced.length === 1 ? "" : "s"} matched no declared step and ${join30.unplaced.length === 1 ? "is" : "are"} not painted`
     );
   }
   if (!bits.length) return `${head}.`;
@@ -11190,24 +11497,24 @@ var OpRunner = class {
 
 // src/substrates.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync15 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
+import { join as join20 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve19) => {
     let out = "";
     let proc;
     try {
       proc = spawn5(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
-      resolve15({ code: 127, out: "" });
+      resolve19({ code: 127, out: "" });
       return;
     }
     proc.stdout.on("data", (d) => out += d);
     proc.stderr.on("data", (d) => out += d);
-    proc.on("error", () => resolve15({ code: 127, out }));
-    proc.on("close", (code) => resolve15({ code: code ?? 1, out }));
+    proc.on("error", () => resolve19({ code: 127, out }));
+    proc.on("close", (code) => resolve19({ code: code ?? 1, out }));
   });
 }
 async function dockerAvailable(run3) {
@@ -11220,11 +11527,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync13(join19(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync14(join20(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync15(join19(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync15(join20(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -11276,7 +11583,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync13(join19(projectDir, marker))) continue;
+    if (!existsSync14(join20(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -11310,7 +11617,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync13(join19(projectDir, ".github", "workflows"))) {
+  if (existsSync14(join20(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -11323,7 +11630,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync15(join19(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync15(join20(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -11467,7 +11774,7 @@ function statusVocabulary(kinds) {
 
 // src/behaviour.ts
 import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var rec5 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
 var str5 = (v) => typeof v === "string" && v.trim().length > 0 ? v : void 0;
 var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
@@ -11570,6 +11877,7 @@ function validateBehaviourReport(v) {
   if (d.entities !== void 0 && !rec5(d.entities)) return bad("entities is not an object");
   return { ok: true, value: { meta: meta.value, entities } };
 }
+var FIRST_TOTAL_SHOWN = "two members stated an estate total; the first is shown";
 var behaviourFileName = (env) => `behaviour.${env}.json`;
 var realRead = (path) => {
   try {
@@ -11612,7 +11920,7 @@ function attachBehaviour(ir, members, env, readFile = realRead) {
     const label = m.name ?? "the project";
     const slice = sliceOf(ir.nodes, m.name);
     const inline = slice.filter((n) => n.attrs?.[BEHAVIOUR_ATTR] !== void 0);
-    if (inline.length > 0) {
+    if (inline.length > 0 || m.meta !== void 0) {
       sources.set(label, "attrs");
       for (const n of inline) {
         const v = validateBehaviourBlock(n.attrs[BEHAVIOUR_ATTR]);
@@ -11631,7 +11939,7 @@ function attachBehaviour(ir, members, env, readFile = realRead) {
     }
     const file = behaviourFileName(env);
     looked.push(`${label}/${file}`);
-    const raw = readFile(join20(m.dir, file));
+    const raw = readFile(join21(m.dir, file));
     if (raw === void 0) {
       sources.set(label, "none");
       continue;
@@ -11698,7 +12006,7 @@ function attachBehaviour(ir, members, env, readFile = realRead) {
   const engineTotal = metas.map((m) => m.meta.total).find((t) => !!t);
   if (engineTotal) {
     meta.total = engineTotal;
-    if (metas.filter((m) => m.meta.total).length > 1) diagnostics.push("two members stated an estate total; the first is shown");
+    if (metas.filter((m) => m.meta.total).length > 1) diagnostics.push(FIRST_TOTAL_SHOWN);
   } else {
     const sum = sumOver(ir.nodes, (cs) => diagnostics.push(`no estate sum: the figures are in ${cs.join(" and ")} and behold converts no currency`));
     if (sum) meta.sum = sum;
@@ -11722,6 +12030,239 @@ function attachBehaviour(ir, members, env, readFile = realRead) {
   return meta;
 }
 
+// src/behaviour-delta.ts
+init_chant();
+import { basename as basename2, resolve as resolve12 } from "node:path";
+init_choudoufu_member();
+init_terraform_member();
+var DECLARED_ATTR = "_behaviourDeclared";
+function trafficFor(query, config) {
+  const asked = query.get("traffic")?.trim();
+  return asked || config.behaviour?.traffic || void 0;
+}
+function reportFromIr(ir, strip3 = "") {
+  const meta = ir.meta?._behaviour;
+  const entities = {};
+  for (const n of ir.nodes) {
+    const block = n.attrs?._behaviour;
+    if (block === void 0) continue;
+    entities[strip3 && n.id.startsWith(strip3) ? n.id.slice(strip3.length) : n.id] = block;
+  }
+  if (meta === void 0 && Object.keys(entities).length === 0) return void 0;
+  return { meta, entities };
+}
+function choudoufuPredictVia(read, readerState = terraformReaderState) {
+  return {
+    tool: () => `${TERRAFORM_LEXICON_PKG}\0predict\0${readerState().lexicon.version ?? "absent"}`,
+    read: async (dir, opts) => {
+      const state = readerState();
+      if (state.refusal) throw new TerraformReadError(state.refusal, dir);
+      const own = [{ name: basename2(dir), dir: "." }];
+      const project = writeTerraformScratchProject(dir, { roots: own, skipped: [] }, void 0, "chdf");
+      const spawnEnv = choudoufuSpawnOverride();
+      const ir = await read(project, {
+        traffic: opts.traffic,
+        ...opts.live ? { live: true, env: opts.env } : {},
+        ...spawnEnv ? { spawnEnv } : {}
+      });
+      return Object.assign(ir, { behaviourRoot: own[0].name });
+    }
+  };
+}
+var rootPrefix = (ir) => {
+  const root = ir.behaviourRoot;
+  return root ? `${root}/` : "";
+};
+var said2 = (err) => (err instanceof Error ? err.message : String(err)).split("\n")[0];
+async function predictMember(member, env, traffic, deps, fresh = false) {
+  const dir = resolve12(member.dir);
+  if (member.kind === "terraform") {
+    try {
+      const declared = reportFromIr(await memberIr(dir, { traffic }, terraformVia));
+      return declared ? { declared } : {};
+    } catch (err) {
+      return { note: `declared prediction unavailable: ${said2(err)}` };
+    }
+  }
+  if (member.kind === "choudoufu") {
+    const via = choudoufuPredictVia(deps.read, deps.readerState);
+    const notes = [];
+    const side = async (from) => {
+      try {
+        const ir = from === "live" ? await overlayIr(dir, { traffic, live: true, env }, via, fresh) : await memberIr(dir, { traffic }, via);
+        return reportFromIr(ir, rootPrefix(ir));
+      } catch (err) {
+        notes.push(`${from} prediction unavailable: ${said2(err)}`);
+        return void 0;
+      }
+    };
+    const [live2, declared] = await Promise.all([env === void 0 ? void 0 : side("live"), side("declared")]);
+    return { ...live2 ? { live: live2 } : {}, ...declared ? { declared } : {}, ...notes.length ? { note: notes.join("; ") } : {} };
+  }
+  if (member.kind === "chant" && memberTakesTraffic(dir, "chant")) {
+    try {
+      const declared = reportFromIr(await memberIr(dir, { traffic }));
+      return declared ? { declared } : {};
+    } catch (err) {
+      return { note: `declared prediction unavailable: ${said2(err)}` };
+    }
+  }
+  if (member.kind === "chant") {
+    return { note: `this member's chant predates \`graph --traffic\` (${TRAFFIC_FLOOR}), so nothing was predicted for it` };
+  }
+  return {};
+}
+var idFor = (name, address) => name === void 0 ? address : `${name}/${address}`;
+function paintLive(ir, name, report, diagnostics) {
+  const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+  for (const [address, block] of Object.entries(report.entities)) {
+    const node = byId.get(idFor(name, address));
+    if (!node) {
+      diagnostics.push(`${name ?? "the project"}: the live prediction prices ${address}, which this overlay has no entity for`);
+      continue;
+    }
+    node.attrs = { ...node.attrs, _behaviour: block };
+  }
+  return report.meta;
+}
+var round62 = (n) => Math.round(n * 1e6) / 1e6;
+function figureOf(meta, blocks, onMixed) {
+  if (meta?.total) return { perHour: meta.total.perHour, currency: meta.total.currency, basis: "total" };
+  if (!blocks.length) return void 0;
+  const currencies = [...new Set(blocks.map((b) => b.cost.currency))].sort();
+  if (currencies.length > 1) {
+    onMixed(currencies);
+    return void 0;
+  }
+  return { perHour: round62(blocks.reduce((sum, b) => sum + b.cost.perHour, 0)), currency: currencies[0], basis: "sum" };
+}
+function deltaOf(live2, declared, label, diagnostics) {
+  if (!live2 || !declared) return void 0;
+  if (live2.currency !== declared.currency) {
+    diagnostics.push(`no delta for ${label}: the live figure is in ${live2.currency} and the declared one in ${declared.currency}`);
+    return void 0;
+  }
+  if (live2.basis !== declared.basis) {
+    diagnostics.push(`no delta for ${label}: one side is the engine's own total and the other is behold's sum, and those are not the same kind of figure`);
+    return void 0;
+  }
+  return { perHour: round62(live2.perHour - declared.perHour), currency: live2.currency };
+}
+function attachBehaviourDelta(ir, members, behaviour) {
+  const diagnostics = [...behaviour.diagnostics ?? []];
+  const perMember = {};
+  const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+  for (const m of members) {
+    const label = m.name ?? "the project";
+    if (m.prediction.note) diagnostics.push(`${label}: ${m.prediction.note}`);
+    const slice = m.name === void 0 ? ir.nodes : ir.nodes.filter((n) => n.id.startsWith(`${m.name}/`));
+    const liveMeta = m.liveMeta === void 0 ? void 0 : validateBehaviourMeta(m.liveMeta);
+    const liveBlocks = slice.map((n) => n.attrs?._behaviour).filter((b) => !!b);
+    const live3 = behaviour.refusal ? void 0 : figureOf(liveMeta?.ok ? liveMeta.value : void 0, liveBlocks, (cs) => diagnostics.push(`no live figure for ${label}: the figures are in ${cs.join(" and ")}`));
+    let declared2;
+    const report = m.prediction.declared;
+    if (report) {
+      const meta = validateBehaviourMeta(report.meta);
+      if (!meta.ok) diagnostics.push(`${label}: dropped the declared prediction's meta \u2014 ${meta.reason}`);
+      else if (meta.value.refusal) diagnostics.push(`${label}: the declared prediction was refused \u2014 ${meta.value.refusal.reason}`);
+      else {
+        const blocks = [];
+        for (const [address, raw] of Object.entries(report.entities)) {
+          const v = validateBehaviourBlock(raw);
+          if (!v.ok) {
+            diagnostics.push(`dropped the declared behaviour block on ${idFor(m.name, address)}: ${v.reason}`);
+            continue;
+          }
+          blocks.push(v.value);
+          const node = byId.get(idFor(m.name, address));
+          if (node) node.attrs = { ...node.attrs, [DECLARED_ATTR]: v.value };
+        }
+        declared2 = figureOf(meta.value, blocks, (cs) => diagnostics.push(`no declared figure for ${label}: the figures are in ${cs.join(" and ")}`));
+      }
+    }
+    const delta2 = deltaOf(live3, declared2, label, diagnostics);
+    if (live3 || declared2) perMember[label] = { ...live3 ? { live: live3 } : {}, ...declared2 ? { declared: declared2 } : {}, ...delta2 ? { delta: delta2 } : {} };
+  }
+  const rows = Object.values(perMember);
+  const addUp = (side) => {
+    const figures = rows.map((r) => r[side]).filter((f) => !!f);
+    if (!figures.length || figures.length !== rows.length) return void 0;
+    if (new Set(figures.map((f) => f.currency)).size > 1) return void 0;
+    const basis = figures.every((f) => f.basis === "total") && figures.length === 1 ? "total" : "sum";
+    return { perHour: round62(figures.reduce((sum, f) => sum + f.perHour, 0)), currency: figures[0].currency, basis };
+  };
+  const live2 = addUp("live");
+  const declared = addUp("declared");
+  const allDeltas = rows.length > 0 && rows.every((r) => r.delta);
+  const delta = live2 && declared && allDeltas ? { perHour: round62(live2.perHour - declared.perHour), currency: live2.currency } : void 0;
+  const out = { ...behaviour };
+  const stated = rows.filter((r) => r.live?.basis === "total").length;
+  if (live2 && stated > 1) {
+    delete out.total;
+    const at = diagnostics.indexOf(FIRST_TOTAL_SHOWN);
+    if (at >= 0) diagnostics.splice(at, 1);
+  }
+  if (live2) out.live = live2;
+  if (declared) out.declared = declared;
+  if (delta) out.delta = delta;
+  if (rows.length && members.some((m) => m.name !== void 0)) out.members = perMember;
+  if (diagnostics.length) out.diagnostics = diagnostics;
+  else delete out.diagnostics;
+  return out;
+}
+function attachDeclaredBehaviour(ir, members) {
+  const diagnostics = [];
+  const perMember = {};
+  const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+  let first;
+  for (const m of members) {
+    const label = m.name ?? "the project";
+    if (m.prediction.note) diagnostics.push(`${label}: ${m.prediction.note}`);
+    const report = m.prediction.declared;
+    if (!report) continue;
+    const meta = validateBehaviourMeta(report.meta);
+    if (!meta.ok) {
+      diagnostics.push(`${label}: dropped the declared prediction's meta \u2014 ${meta.reason}`);
+      continue;
+    }
+    if (meta.value.refusal) {
+      for (const n of ir.nodes) if (n.attrs?._behaviour !== void 0) delete n.attrs._behaviour;
+      return { refusal: meta.value.refusal };
+    }
+    first ??= meta.value;
+    const blocks = [];
+    for (const [address, raw] of Object.entries(report.entities)) {
+      const v = validateBehaviourBlock(raw);
+      if (!v.ok) {
+        diagnostics.push(`dropped the behaviour block on ${idFor(m.name, address)}: ${v.reason}`);
+        continue;
+      }
+      blocks.push(v.value);
+      const node = byId.get(idFor(m.name, address));
+      if (node) node.attrs = { ...node.attrs, _behaviour: v.value };
+    }
+    const declared2 = figureOf(meta.value, blocks, (cs) => diagnostics.push(`no declared figure for ${label}: the figures are in ${cs.join(" and ")}`));
+    if (declared2) perMember[label] = { declared: declared2 };
+  }
+  if (!first) {
+    return {
+      absent: "no behaviour block: a traffic level was given and no member's declared prediction came back",
+      ...diagnostics.length ? { diagnostics } : {}
+    };
+  }
+  const figures = Object.values(perMember).map((r) => r.declared);
+  const oneCurrency = new Set(figures.map((f) => f.currency)).size === 1;
+  const declared = figures.length && oneCurrency ? { perHour: round62(figures.reduce((sum, f) => sum + f.perHour, 0)), currency: figures[0].currency, basis: figures.length === 1 ? figures[0].basis : "sum" } : void 0;
+  return {
+    ...first.engine ? { engine: first.engine } : {},
+    ...first.version ? { version: first.version } : {},
+    ...first.at ? { at: first.at } : {},
+    ...declared ? { declared } : {},
+    ...members.some((m) => m.name !== void 0) && figures.length ? { members: perMember } : {},
+    ...diagnostics.length ? { diagnostics } : {}
+  };
+}
+
 // src/estate-edges.ts
 import { statSync as statSync7 } from "node:fs";
 var rec6 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
@@ -11834,29 +12375,29 @@ init_choudoufu_live();
 init_choudoufu_member();
 import { mkdtempSync, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join21 } from "node:path";
-var isRecord8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var refuse6 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
+import { join as join22 } from "node:path";
+var isRecord9 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var CREDS2 = "Give behold the ambient read-only AWS credentials the estate's `plan` needs (AWS_PROFILE, or AWS_ENDPOINT_URL for an emulator), then re-check live with plan.";
-function said2(run3, fallback) {
+function said3(run3, fallback) {
   const lines = stripAnsiLines(run3.stderr);
   return lines.find((l) => /^Error:/.test(l)) ?? lines[0] ?? fallback;
 }
 function parsePlanShow(run3, dir) {
-  if (run3.code === 127) return refuse6("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
+  if (run3.code === 127) return refuse7("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
-  if (!text) return refuse6(`choudoufu show could not read the plan for ${dir}: ${said2(run3, `exit ${run3.code}`)}`, CREDS2);
+  if (!text) return refuse7(`choudoufu show could not read the plan for ${dir}: ${said3(run3, `exit ${run3.code}`)}`, CREDS2);
   let json;
   try {
     json = JSON.parse(text);
   } catch {
-    return refuse6(`choudoufu show printed something that is not JSON for ${dir}: ${said2(run3, "unparseable stdout")}`, CREDS2);
+    return refuse7(`choudoufu show printed something that is not JSON for ${dir}: ${said3(run3, "unparseable stdout")}`, CREDS2);
   }
-  if (!isRecord8(json) || typeof json.format_version !== "string") {
-    return refuse6("That is not a plan document \u2014 no `format_version`.", CREDS2);
+  if (!isRecord9(json) || typeof json.format_version !== "string") {
+    return refuse7("That is not a plan document \u2014 no `format_version`.", CREDS2);
   }
   if (json.resource_changes !== void 0 && json.resource_changes !== null && !Array.isArray(json.resource_changes)) {
-    return refuse6("That plan document's `resource_changes` is not a list.", CREDS2);
+    return refuse7("That plan document's `resource_changes` is not a list.", CREDS2);
   }
   return { ok: true, doc: json };
 }
@@ -11864,9 +12405,9 @@ var KNOWN_AFTER_APPLY = "(known after apply)";
 var SENSITIVE = "(sensitive)";
 var flagged = (tree, key) => {
   if (tree === true) return true;
-  if (!isRecord8(tree)) return false;
+  if (!isRecord9(tree)) return false;
   const v = tree[key];
-  return v === true || isRecord8(v) && Object.values(v).some((x) => x === true) || Array.isArray(v) && v.some((x) => x === true);
+  return v === true || isRecord9(v) && Object.values(v).some((x) => x === true) || Array.isArray(v) && v.some((x) => x === true);
 };
 function same(a, b) {
   if (a === b) return true;
@@ -11874,7 +12415,7 @@ function same(a, b) {
     if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
     return a.every((x, i) => same(x, b[i]));
   }
-  if (isRecord8(a) && isRecord8(b)) {
+  if (isRecord9(a) && isRecord9(b)) {
     const ka = Object.keys(a);
     const kb = Object.keys(b);
     if (ka.length !== kb.length) return false;
@@ -11885,10 +12426,10 @@ function same(a, b) {
 function planDrift(doc) {
   const out = /* @__PURE__ */ new Map();
   for (const rc of doc.resource_changes ?? []) {
-    if (!rc || typeof rc.address !== "string" || !isRecord8(rc.change)) continue;
+    if (!rc || typeof rc.address !== "string" || !isRecord9(rc.change)) continue;
     const { actions, before, after } = rc.change;
     if (!Array.isArray(actions) || actions.every((a) => a === "no-op")) continue;
-    if (!isRecord8(before) || !isRecord8(after)) continue;
+    if (!isRecord9(before) || !isRecord9(after)) continue;
     const changes = [];
     for (const key of [.../* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])].sort()) {
       const unknownAfter = flagged(rc.change.after_unknown, key);
@@ -11908,14 +12449,14 @@ var planArgv = (out) => ({
   show: ["show", "-json", out]
 });
 async function readChoudoufuPlan(dir, run3 = captureChoudoufu) {
-  const scratch = mkdtempSync(join21(tmpdir2(), "behold-choudoufu-plan-"));
-  const file = join21(scratch, "plan.tfplan");
+  const scratch = mkdtempSync(join22(tmpdir2(), "behold-choudoufu-plan-"));
+  const file = join22(scratch, "plan.tfplan");
   const argv = planArgv(file);
   try {
     const planRun = await run3(argv.plan, dir);
     if (planRun.code === 127) throw new ChoudoufuReadError({ error: "choudoufu is not on PATH.", code: "choudoufu-live-check", remedy: "Install choudoufu and put it on PATH." }, dir);
     if (planRun.code !== 0) {
-      throw new ChoudoufuReadError({ error: `choudoufu plan could not plan ${dir}: ${said2(planRun, `exit ${planRun.code}`)}`, code: "choudoufu-live-check", remedy: CREDS2 }, dir);
+      throw new ChoudoufuReadError({ error: `choudoufu plan could not plan ${dir}: ${said3(planRun, `exit ${planRun.code}`)}`, code: "choudoufu-live-check", remedy: CREDS2 }, dir);
     }
     const parsed = parsePlanShow(await run3(argv.show, dir), dir);
     if (!parsed.ok) throw new ChoudoufuReadError(parsed.refusal, dir);
@@ -11941,16 +12482,16 @@ init_choudoufu_refs();
 // src/choudoufu-moves.ts
 init_choudoufu_member();
 init_choudoufu_live();
-import { existsSync as existsSync14, readFileSync as readFileSync17 } from "node:fs";
-import { join as join22, relative as relative5 } from "node:path";
-var isRecord9 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var refuse7 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
+import { existsSync as existsSync15, readFileSync as readFileSync17 } from "node:fs";
+import { join as join23, relative as relative5 } from "node:path";
+var isRecord10 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var refuse8 = (error, remedy) => ({ ok: false, refusal: { error, code: "choudoufu-live-check", remedy } });
 var HOW_TO_GET_ONE2 = "A plan is the live-mv workbench's carve.json: `{from, estates[], moves[{address, from, to}]}` \u2014 the workbench's plan phase writes one, or write it by hand.";
 function parseCarvePlan(value) {
-  if (!isRecord9(value)) return refuse7("That file is not a move plan \u2014 its top level is not a JSON object.", HOW_TO_GET_ONE2);
-  if (!Array.isArray(value.moves)) return refuse7("That JSON is not a move plan \u2014 it has no `moves` array.", HOW_TO_GET_ONE2);
-  const bad2 = value.moves.findIndex((m) => !isRecord9(m) || typeof m.address !== "string" || typeof m.from !== "string" || typeof m.to !== "string");
-  if (bad2 >= 0) return refuse7(`moves[${bad2}] is not a move (needs string \`address\`, \`from\` and \`to\`).`, HOW_TO_GET_ONE2);
+  if (!isRecord10(value)) return refuse8("That file is not a move plan \u2014 its top level is not a JSON object.", HOW_TO_GET_ONE2);
+  if (!Array.isArray(value.moves)) return refuse8("That JSON is not a move plan \u2014 it has no `moves` array.", HOW_TO_GET_ONE2);
+  const bad2 = value.moves.findIndex((m) => !isRecord10(m) || typeof m.address !== "string" || typeof m.from !== "string" || typeof m.to !== "string");
+  if (bad2 >= 0) return refuse8(`moves[${bad2}] is not a move (needs string \`address\`, \`from\` and \`to\`).`, HOW_TO_GET_ONE2);
   const moves = value.moves;
   return {
     ok: true,
@@ -11967,34 +12508,34 @@ function readCarvePlan(path, readFile = (p) => readFileSync17(p, "utf8")) {
   try {
     text = readFile(path);
   } catch (err) {
-    return refuse7(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_GET_ONE2);
+    return refuse8(`Couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_GET_ONE2);
   }
   try {
     return parseCarvePlan(JSON.parse(text));
   } catch (err) {
-    return refuse7(`${path} is not JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_GET_ONE2);
+    return refuse8(`${path} is not JSON: ${err instanceof Error ? err.message : String(err)}`, HOW_TO_GET_ONE2);
   }
 }
 function discoverCarvePlans(memberDirs, base) {
   const out = [];
   for (const dir of memberDirs) {
-    const p = join22(dir, "carve.json");
-    if (existsSync14(p)) out.push(relative5(base, p));
+    const p = join23(dir, "carve.json");
+    if (existsSync15(p)) out.push(relative5(base, p));
   }
   return out;
 }
 function parseLiveMv(run3, what) {
-  if (run3.code === 127) return refuse7("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
+  if (run3.code === 127) return refuse8("choudoufu is not on PATH.", "Install choudoufu and put it on PATH.");
   const text = run3.stdout.trim();
-  if (!text) return refuse7(`choudoufu live-mv printed no document for ${what} (exit ${run3.code}).`, "Run the line by hand to see choudoufu's own words.");
+  if (!text) return refuse8(`choudoufu live-mv printed no document for ${what} (exit ${run3.code}).`, "Run the line by hand to see choudoufu's own words.");
   let json;
   try {
     json = JSON.parse(text);
   } catch {
-    return refuse7(`choudoufu live-mv printed something that is not JSON for ${what}.`, "Run the line by hand to see choudoufu's own words.");
+    return refuse8(`choudoufu live-mv printed something that is not JSON for ${what}.`, "Run the line by hand to see choudoufu's own words.");
   }
-  if (!isRecord9(json) || !isRecord9(json.from) || !isRecord9(json.to) || typeof json.dry_run !== "boolean") {
-    return refuse7(`That is not a live-mv document (${what}).`, "Upgrade choudoufu to 0.16.0 or newer.");
+  if (!isRecord10(json) || !isRecord10(json.from) || !isRecord10(json.to) || typeof json.dry_run !== "boolean") {
+    return refuse8(`That is not a live-mv document (${what}).`, "Upgrade choudoufu to 0.16.0 or newer.");
   }
   return { ok: true, doc: json };
 }
@@ -12070,6 +12611,142 @@ async function moveReceipt(plan, members, run3 = captureChoudoufu) {
   };
 }
 
+// src/workspace-gates.ts
+init_chant();
+import { resolve as resolve13 } from "node:path";
+var isRecord11 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var str7 = (v) => typeof v === "string" && v ? v : null;
+function gateKey(member, op, gate) {
+  return `${member}/${op}/${gate}`;
+}
+function approveArgs(g) {
+  return ["approve", g.op, g.gate, ...g.env ? ["--env", g.env] : [], ...g.planDigest ? ["--plan", g.planDigest] : []];
+}
+function parseWorkspaceStatus(text, root) {
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return { ok: false, refusal: { error: "chant workspace status printed something that is not JSON.", code: "workspace-status", remedy: "Run `chant workspace status <env> --json` in the workspace root to see what it says." } };
+  }
+  if (!isRecord11(doc)) return { ok: false, refusal: { error: "chant workspace status printed JSON that is not an object.", code: "workspace-status", remedy: "Run `chant workspace status <env> --json` in the workspace root." } };
+  const contract = contractRefusal(doc, "status");
+  if (contract) return { ok: false, refusal: contract };
+  if (isRecord11(doc.error)) {
+    const code = String(doc.error.code ?? "unknown");
+    return { ok: false, refusal: { error: `chant could not read the workspace's status: ${code}: ${String(doc.error.message ?? "")}`, code, remedy: "`chant workspace check` names the problem and where it is." } };
+  }
+  const gates = [];
+  for (const m of Array.isArray(doc.members) ? doc.members : []) {
+    if (!isRecord11(m) || typeof m.name !== "string") continue;
+    const dir = typeof m.dir === "string" ? m.dir === "." ? resolve13(root) : resolve13(root, m.dir) : resolve13(root);
+    for (const g of Array.isArray(m.gates) ? m.gates : []) {
+      if (!isRecord11(g)) continue;
+      if (g.state !== void 0 && g.state !== "pending") continue;
+      const op = str7(g.component);
+      const gate = str7(g.name);
+      if (!op || !gate) continue;
+      const env = str7(g.env);
+      const planDigest = str7(g.planDigest);
+      const approvals = (Array.isArray(g.approvals) ? g.approvals : []).filter(isRecord11).map((a) => ({
+        principal: String(a.principal ?? "unknown"),
+        at: str7(a.at),
+        channel: str7(a.channel)
+      }));
+      gates.push({
+        key: gateKey(m.name, op, gate),
+        member: m.name,
+        dir,
+        op,
+        gate,
+        env,
+        planDigest,
+        approvals,
+        needed: typeof g.needed === "number" ? g.needed : 1,
+        recordedAt: str7(g.recordedAt),
+        expiresAt: str7(g.expiresAt),
+        signed: isRecord11(g.signed),
+        // status's line already carries --sign for a signed gate; only the
+        // line built here needs it added.
+        approve: str7(g.approve) ?? ["chant", ...approveArgs({ op, gate, env, planDigest }), ...isRecord11(g.signed) ? ["--sign"] : []].join(" ")
+      });
+    }
+  }
+  return { ok: true, env: String(doc.env ?? ""), gates };
+}
+async function readWorkspaceGates(ws, env) {
+  const run3 = await runChantRaw(["workspace", "status", env, "--json"], ws.root);
+  if (!run3.stdout.trim()) {
+    return {
+      ok: false,
+      refusal: {
+        error: `chant workspace status ${env} failed in ${ws.root} (exit ${run3.code}): ${run3.stderr.trim().split("\n").slice(-3).join(" ")}`,
+        code: "workspace-status",
+        remedy: "Run `chant workspace status <env>` in the workspace root."
+      }
+    };
+  }
+  return parseWorkspaceStatus(run3.stdout, ws.root);
+}
+function isEnvName(env) {
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(env);
+}
+function localApprover(env = process.env) {
+  return env.GITHUB_ACTOR ?? env.GITLAB_USER_LOGIN ?? env.USER ?? "unknown";
+}
+
+// src/request-guard.ts
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+var SAFE = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostName(hostport) {
+  const h = hostport.trim().toLowerCase();
+  if (h.startsWith("[")) {
+    const end = h.indexOf("]");
+    return end >= 0 ? h.slice(0, end + 1) : h;
+  }
+  const colon = h.lastIndexOf(":");
+  return colon >= 0 && h.indexOf(":") === colon ? h.slice(0, colon) : h;
+}
+function isLoopbackName(name) {
+  return LOOPBACK.has(name) || name.endsWith(".localhost");
+}
+function allowedName(name, cfg) {
+  if (isLoopbackName(name)) return true;
+  if (cfg.boundHost && !isWildcard(cfg.boundHost) && hostName(cfg.boundHost) === name) return true;
+  return cfg.allowedHosts.some((h) => hostName(h) === name);
+}
+function isWildcard(h) {
+  return h === "0.0.0.0" || h === "::" || h === "[::]";
+}
+function guardRequest(req, cfg) {
+  const name = hostName(req.host);
+  if (!allowedName(name, cfg)) {
+    return { ok: false, status: 421, error: `behold doesn't answer to host ${name}. Start it with --allow-host ${name} if a proxy of yours sends that name.` };
+  }
+  if (SAFE.has(req.method.toUpperCase())) return { ok: true };
+  if ((req.secFetchSite || "").toLowerCase() === "cross-site") {
+    return { ok: false, status: 403, error: "a cross-site page can't write to behold" };
+  }
+  if (req.origin && req.origin !== "null") {
+    let originHost;
+    try {
+      originHost = new URL(req.origin).host.toLowerCase();
+    } catch {
+      return { ok: false, status: 403, error: "a write with an unreadable Origin is refused" };
+    }
+    const same2 = originHost === req.host.trim().toLowerCase();
+    if (!same2 && !cfg.allowedHosts.some((h) => hostName(h) === hostName(originHost))) {
+      return { ok: false, status: 403, error: `a page from ${originHost} can't write to behold` };
+    }
+  } else if (req.origin === "null") {
+    return { ok: false, status: 403, error: "a write from an opaque origin is refused" };
+  }
+  return { ok: true };
+}
+function allowedHostsFrom(flag = [], env = process.env.BEHOLD_ALLOWED_HOSTS) {
+  return [...flag, ...(env || "").split(",")].map((s) => s.trim()).filter(Boolean);
+}
+
 // src/server.ts
 init_member_kind();
 init_terraform_member();
@@ -12079,8 +12756,8 @@ init_chant();
 init_member_kind();
 init_choudoufu_member();
 init_project();
+import { relative as relative6, resolve as resolve14 } from "node:path";
 init_terraform_member();
-import { relative as relative6, resolve as resolve11 } from "node:path";
 init_targets();
 var list2 = (xs) => xs.join(", ");
 var EMPTY_KUBECONFIG = { contexts: /* @__PURE__ */ new Map(), servers: /* @__PURE__ */ new Map() };
@@ -12262,11 +12939,11 @@ async function choudoufuCheck(root, members, probe2) {
     };
   }
   if (!choudoufuMeetsFloor(v)) {
-    const said3 = v.forkField ? `choudoufu ${v.version}` : `a choudoufu whose \`version -json\` carries no \`choudoufu_version\` (v0.15.0 or older)`;
+    const said4 = v.forkField ? `choudoufu ${v.version}` : `a choudoufu whose \`version -json\` carries no \`choudoufu_version\` (v0.15.0 or older)`;
     return {
       name: "choudoufu",
       status: "fail",
-      detail: `${said3} at ${v.bin} \u2014 below behold's floor ${CHOUDOUFU_FLOOR}, whose \`-json\` documents carry the fields behold reads (schemas, identity, choudoufu_version)`,
+      detail: `${said4} at ${v.bin} \u2014 below behold's floor ${CHOUDOUFU_FLOOR}, whose \`-json\` documents carry the fields behold reads (schemas, identity, choudoufu_version)`,
       fix: `Upgrade choudoufu to ${CHOUDOUFU_FLOOR} or newer (a build from main after 2026-09-08 also carries them).`
     };
   }
@@ -12308,10 +12985,41 @@ function terraformCheck(members, probe2) {
   const reader = `${TERRAFORM_LEXICON_PKG} ${state.lexicon.version || "dev"} (${HCL_PARSER_PKG} ${state.parser.version || "dev"})`;
   return { name: "terraform", status: "pass", detail: `${reader}; ${perMember}` };
 }
+function workspaceShape(ws) {
+  return { kind: "estate", members: drawnMembers(ws).map((m) => ({ dir: m.dir, kind: m.kind })) };
+}
+function workspaceCheck(ws, beholdMembers) {
+  const drawn = drawnMembers(ws);
+  const unreadable = unreadableMembers(ws);
+  const undrawn = undrawnMembers(ws);
+  const parts = [
+    `chant workspace ${ws.name} (${ws.file}, listed by chant ${ws.chant}): ${drawn.length} of ${ws.members.length} members drawn: ${list2(drawn.map((m) => `${m.name} (${m.kind})`))}`,
+    ...unreadable.length ? [`unreadable: ${list2(unreadable.map((m) => `${m.name} ${m.reason.code}: ${m.reason.message}`))}`] : [],
+    ...undrawn.length ? [`listed, not drawn: ${list2(undrawn.map((m) => `${m.name} (${m.kind})`))}`] : [],
+    ...beholdMembers ? [".behold.json also lists members, which are ignored beside the declaration"] : []
+  ];
+  const warn = unreadable.length > 0 || beholdMembers;
+  const fix = [
+    ...unreadable.length ? ["`chant workspace check` says what each unreadable member needs."] : [],
+    ...beholdMembers ? ["Delete `members` from .behold.json; chant.workspace.json lists them now."] : []
+  ].join(" ");
+  return { name: "project", status: warn ? "warn" : "pass", detail: parts.join("; "), ...warn ? { fix } : {} };
+}
 async function diagnose(dir, probes = {}) {
-  const root = resolve11(dir);
-  const shape = detectProjectShape(root);
+  const root = resolve14(dir);
   const behold = beholdVersion();
+  const listing = hasDeclaration(root) ? await (probes.readWorkspace ?? readWorkspace)(root) : void 0;
+  if (listing && !listing.ok) {
+    return {
+      behold,
+      dir: root,
+      kind: "estate",
+      ok: false,
+      checks: [{ name: "project", status: "fail", detail: listing.refusal.error, fix: listing.refusal.remedy }]
+    };
+  }
+  const workspace = listing?.ok ? listing.workspace : void 0;
+  const shape = workspace ? workspaceShape(workspace) : detectProjectShape(root);
   const invalid = shape.invalidMembers ?? [];
   const invalidDetail = invalid.map((m) => `${m.dir} \u2014 ${m.invalid}`);
   const kindsFix = `Member kinds this behold reads: ${registeredMemberKinds().join(", ")}. Fix or remove the entry in .behold.json \`members\`.`;
@@ -12337,14 +13045,14 @@ async function diagnose(dir, probes = {}) {
     };
   }
   const estate = shape.kind === "estate";
-  const members = (shape.members ?? []).map((m) => ({ ...m, abs: resolve11(root, m.dir) }));
+  const members = (shape.members ?? []).map((m) => ({ ...m, abs: resolve14(root, m.dir) }));
   const targets = estate ? members.map((m) => m.abs) : [root];
   const primary = targets[0];
   const chantTargets = estate ? members.filter((m) => m.kind === "chant").map((m) => m.abs) : [root];
   const memberList = list2(members.map((m) => `${m.dir} (${m.kind})`));
   const membersFrom = shape.membersFrom === "behold-config" ? ".behold.json members" : "npm workspaces";
   const estateDetail = shape.membersFrom === "itself" ? `a ${members[0].kind} member \u2014 the directory itself, no member list` : `estate of ${members.length} members (${membersFrom}): ${memberList}`;
-  const projectCheck = estate ? invalid.length ? {
+  const projectCheck = workspace ? workspaceCheck(workspace, !!loadBeholdConfig(root).members) : estate ? invalid.length ? {
     name: "project",
     status: "fail",
     detail: `${estateDetail}; invalid: ${list2(invalidDetail)}`,
@@ -12397,12 +13105,11 @@ function formatReport(report) {
 
 // src/server.ts
 init_read_stats();
-import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
 init_foreign();
 
 // src/events.ts
-import { watch, existsSync as existsSync15 } from "node:fs";
-import { join as join23 } from "node:path";
+import { watch, existsSync as existsSync16 } from "node:fs";
+import { join as join24 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -12420,7 +13127,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync15(join23(projectDir, "src")) ? join23(projectDir, "src") : projectDir;
+  const dir = existsSync16(join24(projectDir, "src")) ? join24(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -12722,8 +13429,8 @@ async function emulatorDown(projectDir) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync18, existsSync as existsSync16, cpSync, mkdirSync as mkdirSync6 } from "node:fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join24, relative as relative7, resolve as resolve12, sep as sep6 } from "node:path";
+import { readFileSync as readFileSync18, existsSync as existsSync17, cpSync, mkdirSync as mkdirSync6 } from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join25, relative as relative7, resolve as resolve15, sep as sep6 } from "node:path";
 import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
 function readCatalog(file, catalog) {
   let raw;
@@ -12734,7 +13441,7 @@ function readCatalog(file, catalog) {
   }
   const list3 = raw?.demos;
   if (!Array.isArray(list3)) return [];
-  const catalogDir = dirname6(resolve12(file));
+  const catalogDir = dirname6(resolve15(file));
   return list3.filter((e) => validEntry(e)).map((e) => ({ ...e, catalog, catalogDir }));
 }
 function validEntry(e) {
@@ -12768,10 +13475,10 @@ function validEntry(e) {
   return true;
 }
 function loadDemoRegistry(pkgRoot3) {
-  const merged = readCatalog(join24(pkgRoot3, "demos.json"), "demos");
+  const merged = readCatalog(join25(pkgRoot3, "demos.json"), "demos");
   const seen = new Set(merged.map((e) => e.name));
   const named = process.env.BEHOLD_WORKBENCH;
-  for (const e of [...readCatalog(join24(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve12(named), "workbench") : []]) {
+  for (const e of [...readCatalog(join25(pkgRoot3, "workbench.json"), "workbench"), ...named ? readCatalog(resolve15(named), "workbench") : []]) {
     if (seen.has(e.name)) {
       process.stderr.write(`behold: workbench entry "${e.name}" collides with a demo already in the catalog \u2014 dropped
 `);
@@ -12784,17 +13491,17 @@ function loadDemoRegistry(pkgRoot3) {
 }
 function demoLocalPath(entry) {
   if (entry.source !== "local" || !entry.path) return void 0;
-  return isAbsolute4(entry.path) ? entry.path : resolve12(entry.catalogDir ?? process.cwd(), entry.path);
+  return isAbsolute4(entry.path) ? entry.path : resolve15(entry.catalogDir ?? process.cwd(), entry.path);
 }
 function missingRequirements(entry) {
   const bins = entry.source === "git" && !entry.requires.includes("git") ? [...entry.requires, "git"] : entry.requires;
   const finder = process.platform === "win32" ? "where" : "which";
   const missing = bins.filter((bin) => {
-    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync16(process.env.CHOUDOUFU_BIN)) return false;
+    if (bin === "choudoufu" && process.env.CHOUDOUFU_BIN && existsSync17(process.env.CHOUDOUFU_BIN)) return false;
     return spawnSync2(finder, [bin], { stdio: "ignore" }).status !== 0;
   });
   const local = demoLocalPath(entry);
-  if (local && !existsSync16(local)) missing.push(`${entry.path} (not checked out)`);
+  if (local && !existsSync17(local)) missing.push(`${entry.path} (not checked out)`);
   return missing;
 }
 function fetchesFromNetwork(entry) {
@@ -12803,9 +13510,9 @@ function fetchesFromNetwork(entry) {
 function demoTargetDir(entry, cwd = process.cwd()) {
   const inPlace = entry.inPlace ? demoLocalPath(entry) : void 0;
   if (inPlace) return inPlace;
-  const legacy = resolve12(cwd, "behold-demo");
-  if (entry.name === "writes" && existsSync16(legacy)) return legacy;
-  return resolve12(cwd, "behold-demos", entry.name);
+  const legacy = resolve15(cwd, "behold-demo");
+  if (entry.name === "writes" && existsSync17(legacy)) return legacy;
+  return resolve15(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot3, target } = opts;
@@ -12814,12 +13521,12 @@ async function loadDemo(entry, opts) {
   const inPlace = entry.source === "local" && entry.inPlace;
   const work = inPlace ? local : target;
   if (inPlace) {
-    if (!existsSync16(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
+    if (!existsSync17(work)) return { ok: false, error: `${entry.path} is not checked out (looked in ${work})` };
     say(`serving ${work} where it is \u2014 nothing copied`);
-  } else if (!existsSync16(target)) {
+  } else if (!existsSync17(target)) {
     if (entry.source === "bundled" || entry.source === "local" && local) {
-      const from = entry.source === "bundled" ? join24(pkgRoot3, entry.dir) : local;
-      if (!existsSync16(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
+      const from = entry.source === "bundled" ? join25(pkgRoot3, entry.dir) : local;
+      if (!existsSync17(from)) return { ok: false, error: entry.source === "bundled" ? `this install has no bundled ${entry.dir}` : `${entry.path} is not checked out (looked in ${from})` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(from, target, {
@@ -12845,7 +13552,7 @@ async function loadDemo(entry, opts) {
   } else {
     say(`reusing ${target}`);
   }
-  if (!inPlace && existsSync16(join24(work, "package.json")) && !existsSync16(join24(work, "node_modules"))) {
+  if (!inPlace && existsSync17(join25(work, "package.json")) && !existsSync17(join25(work, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: work, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${work}` };
@@ -12862,7 +13569,7 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join24(work, d)) : [work] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join25(work, d)) : [work] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
@@ -12873,8 +13580,8 @@ function runStep(cmd, args, opts = {}) {
 }
 
 // src/server.ts
-var pkgRoot = join25(dirname7(fileURLToPath4(import.meta.url)), "..");
-var webRoot = join25(pkgRoot, "web");
+var pkgRoot = join26(dirname7(fileURLToPath4(import.meta.url)), "..");
+var webRoot = join26(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -12925,7 +13632,7 @@ function tierFailure(tier, message) {
 function beholdVersion() {
   try {
     const here = dirname7(fileURLToPath4(import.meta.url));
-    return JSON.parse(readFileSync19(join25(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync19(join26(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -13214,13 +13921,29 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
 })) {
   const app = new Hono();
+  const guard = { allowedHosts: allowedHostsFrom(cfg.allowedHosts ?? []), ...cfg.host ? { boundHost: cfg.host } : {} };
+  app.use("*", async (c, next) => {
+    const verdict = guardRequest(
+      {
+        method: c.req.method,
+        host: c.req.header("host") ?? new URL(c.req.url).host,
+        origin: c.req.header("origin") ?? null,
+        secFetchSite: c.req.header("sec-fetch-site") ?? null
+      },
+      guard
+    );
+    if (!verdict.ok) return c.json({ error: verdict.error, code: "request-refused" }, verdict.status);
+    await next();
+  });
   setChoudoufuRunner(cfg.choudoufu?.run);
   setEstateLexiconRead(cfg.choudoufu ? cfg.choudoufu.lexicon ?? null : void 0);
+  setServedWorkspace(cfg.workspace);
   app.use("/api/*", async (c, next) => {
     if (c.req.method === "GET") return withReadSignal(c.req.raw.signal, next);
     await next();
   });
   if (cfg.carveReport) carveRoutes(app, cfg.carveReport, cfg.carveDemo);
+  const predictDeps = cfg.behaviour ?? { read: graphIr };
   let beholdConfig = loadBeholdConfig(cfg.projectDir);
   let tierEnvVar = beholdConfig.tiers?.envVar;
   const executorFor = (env) => env ? beholdConfig.executor?.[env] : void 0;
@@ -13331,9 +14054,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join25(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join25(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync17(down) || !existsSync17(up)) {
+    const down = join26(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join26(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync18(down) || !existsSync18(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -13433,6 +14156,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ history });
   });
   app.post("/api/operator/approve/:op/:gate", async (c) => {
+    if (cfg.previewMode) return c.json({ error: "approving is disabled in preview mode", code: "preview" }, 403);
     const { op, gate } = c.req.param();
     const info = estateOps().find((o) => o.name === op);
     broadcaster.emit("op", `\u270E approve ${op} ${gate} \u2014 records a fact; the next tick acts on it`);
@@ -13443,6 +14167,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ recorded: true, op, gate, semantics: APPROVE_SEMANTICS });
   });
   app.post("/api/ops/:name/signal/:gate", async (c) => {
+    if (cfg.previewMode) return c.json({ error: "approving is disabled in preview mode", code: "preview" }, 403);
     const { name, gate } = c.req.param();
     const info = estateOps().find((o) => o.name === name);
     broadcaster.emit("op", `\u270E signal ${name} ${gate}`);
@@ -13450,6 +14175,38 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (code !== 0) return c.json({ error: stderr.trim() || `signal exited ${code}` }, 500);
     return c.json({ signalled: true });
   });
+  app.get("/api/workspace/gates", async (c) => {
+    const ws = servedWorkspace();
+    const env = c.req.query("env") || cfg.env || "local";
+    if (!isEnvName(env)) return c.json({ error: `${JSON.stringify(env)} isn't an env name`, code: "env" }, 400);
+    if (!ws) return c.json({ workspace: false, env, gates: [], approver: localApprover() });
+    const read = await readWorkspaceGates(ws, env);
+    if (!read.ok) return c.json({ workspace: true, env, gates: [], refusal: read.refusal, approver: localApprover() });
+    return c.json({ workspace: true, env, gates: read.gates.map(({ dir: _dir, ...g }) => g), approver: localApprover() });
+  });
+  app.post("/api/workspace/gates/approve", async (c) => {
+    if (cfg.previewMode) return c.json({ error: "approving is disabled in preview mode", code: "preview" }, 403);
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) {
+      return c.json({ error: "send the body as application/json", code: "content-type" }, 415);
+    }
+    const ws = servedWorkspace();
+    if (!ws) return c.json({ error: "behold isn't serving a declared workspace", code: "no-workspace" }, 404);
+    const body = await c.req.json().catch(() => ({}));
+    const key = typeof body?.key === "string" ? body.key : "";
+    const env = typeof body?.env === "string" && body.env ? body.env : cfg.env || "local";
+    if (!isEnvName(env)) return c.json({ error: `${JSON.stringify(env)} isn't an env name`, code: "env" }, 400);
+    const read = await readWorkspaceGates(ws, env);
+    if (!read.ok) return c.json({ error: read.refusal.error, code: read.refusal.code }, 422);
+    const g = read.gates.find((x) => x.key === key);
+    if (!g) return c.json({ error: `no gate ${key} is waiting in ${env}`, code: "no-gate" }, 404);
+    if (g.signed) return c.json({ error: `${key} wants a signed approval, which behold can't make. Run: ${g.approve}`, code: "signed" }, 422);
+    const approver = localApprover();
+    broadcaster.emit("op", `\u270E approve ${g.key} as ${approver}`);
+    const { code, stderr, stdout } = await runChantRaw(approveArgs(g), g.dir);
+    if (code !== 0) return c.json({ error: stderr.trim() || stdout.trim() || `approve exited ${code}`, code: "approve" }, 500);
+    broadcaster.emit("changed", "");
+    return c.json({ recorded: true, key: g.key, approver });
+  });
   app.get(
     "/api/events",
     (c) => streamSSE(c, async (stream) => {
@@ -13516,6 +14273,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       currentEnv: cfg.env ?? null,
       // v0.1.0 preview: the SPA hides git/PR ops + arbitrary-project affordances.
       ...cfg.previewMode ? { previewMode: true } : {},
+      // #477: who `chant approve` records when behold runs it. The approve
+      // buttons say it before the click.
+      approver: localApprover(),
       // The tier picker's options (M2 #54, sourced #70): gated on the served
       // project's `.behold.json` declaring a `tiers` block at all — NOT on
       // whether its env var happens to be set in behold's own launch env
@@ -13566,9 +14326,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   app.post("/api/project/open", async (c) => {
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve13(body.dir.trim()) : "";
-    if (!dir || !existsSync17(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync17(join25(dir, "chant.config.ts"))) {
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve16(body.dir.trim()) : "";
+    if (!dir || !existsSync18(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync18(join26(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -13577,6 +14337,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   const switchServedProject = (dirs, env, spawnEnv) => {
     addRecent(cfg.projectDir);
     cfg.projectDir = dirs[0];
+    cfg.workspace = void 0;
+    setServedWorkspace(void 0);
     cfg.projectDirs = servesAsEstate(dirs) ? dirs : void 0;
     setChoudoufuSpawnEnv(spawnEnv);
     cfg.env = env;
@@ -13589,7 +14351,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   };
   app.post("/api/project/reveal", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve13(body.dir.trim()) : cfg.projectDir;
+    const dir = typeof body.dir === "string" && body.dir.trim() ? resolve16(body.dir.trim()) : cfg.projectDir;
     const known = /* @__PURE__ */ new Set([cfg.projectDir, ...cfg.projectDirs ?? [], ...listRecents().map((r) => r.dir)]);
     if (!known.has(dir)) return c.json({ error: "not a served or recent project directory" }, 400);
     const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
@@ -13617,7 +14379,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       fetches: fetchesFromNetwork(e),
       ...e.repo ? { repo: e.repo } : {},
       target,
-      loaded: existsSync17(target),
+      loaded: existsSync18(target),
       satisfiable: missing.length === 0,
       // #254: the carve walkthrough runs fine here — it just isn't a project
       // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
@@ -13676,20 +14438,21 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       loadingDemo = null;
     }
   });
+  const layoutDir = () => cfg.workspace?.root ?? cfg.projectDir;
   const layoutWriteBlock = () => {
     if (cfg.previewMode) return "the layout sidecar is read-only in preview mode";
     if (cfg.carveReport) return "a carve report isn't a project \u2014 there's nowhere to keep a hand layout";
     if (cfg.layoutWrites === false) return "a static export captures a snapshot \u2014 it doesn't write to the project";
-    return unwritableReason(cfg.projectDir);
+    return unwritableReason(layoutDir());
   };
   app.get("/api/layout", (c) => {
     const block = layoutWriteBlock();
-    const shared2 = { path: layoutPath(cfg.projectDir), writable: !block, ...block ? { reason: block } : {} };
+    const shared2 = { path: layoutPath(layoutDir()), writable: !block, ...block ? { reason: block } : {} };
     const raw = new URL(c.req.url).searchParams.get("lens");
-    if (raw === null) return c.json({ ...shared2, lenses: readLayoutFile(cfg.projectDir).lenses });
+    if (raw === null) return c.json({ ...shared2, lenses: readLayoutFile(layoutDir()).lenses });
     const lens = normalizeLens(raw);
     if (!lens) return c.json({ error: `not a lens key: ${raw}`, code: "bad-layout" }, 400);
-    return c.json({ ...shared2, lens, deltas: readLens(cfg.projectDir, lens) });
+    return c.json({ ...shared2, lens, deltas: readLens(layoutDir(), lens) });
   });
   app.post("/api/layout", async (c) => {
     const block = layoutWriteBlock();
@@ -13713,8 +14476,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       return c.json({ error: "body needs `deltas`: {<node id>: {dx,dy,dw,dh}}", code: "bad-layout" }, 400);
     }
     try {
-      const stored = writeLens(cfg.projectDir, lens, body.deltas);
-      return c.json({ ok: true, lens: stored.lens, deltas: stored.deltas, count: Object.keys(stored.deltas).length, path: layoutPath(cfg.projectDir) });
+      const stored = writeLens(layoutDir(), lens, body.deltas);
+      return c.json({ ok: true, lens: stored.lens, deltas: stored.deltas, count: Object.keys(stored.deltas).length, path: layoutPath(layoutDir()) });
     } catch (err) {
       if (err instanceof LayoutTooLarge) return c.json({ error: err.message, code: "too-large" }, 413);
       return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
@@ -13727,7 +14490,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     const res = c.res;
     if (!res || res.status !== 200 || !(res.headers.get("content-type") ?? "").includes("json")) return;
     const lens = lensFromQuery(url.searchParams);
-    const deltas = readLens(cfg.projectDir, lens);
+    const deltas = readLens(layoutDir(), lens);
     if (!Object.keys(deltas).length) return;
     let body;
     try {
@@ -13776,7 +14539,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         {
           method: "GET",
           path: "/api/overlay",
-          desc: "live drift overlay for ?env= \u2014 same shape/params as /api/graph, plus runtime=1; each priced entity carries attrs._behaviour (cost/headroom/errorRate/resilience/rightSize/provenance, #398) and meta.behaviour holds the engine, its sums, a refusal or an absent line"
+          desc: "live drift overlay for ?env= \u2014 same shape/params as /api/graph, plus runtime=1; each priced entity carries attrs._behaviour (cost/headroom/errorRate/resilience/rightSize/provenance, #398) and meta.behaviour holds the engine, its sums, a refusal or an absent line; with ?traffic= (or .behold.json behaviour.traffic) each member is predicted live and declared, and meta.behaviour adds live, declared and delta with attrs._behaviourDeclared per entity (#402)"
         },
         { method: "GET", path: "/api/layout", desc: "hand-layout sidecar (.behold/layout.json): ?lens=<key> \u2192 {lens, deltas, writable}; no lens \u2192 every lens" },
         { method: "POST", path: "/api/layout", desc: "store one lens's deltas: JSON body {lens, deltas: {<node id>: {dx,dy,dw,dh}}} (the only file behold writes in your project)" },
@@ -13799,10 +14562,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         { method: "GET", path: "/api/history", desc: "recent source commits (rollback targets)" },
         { method: "GET", path: "/api/frames", desc: "captured lanes frames" },
         { method: "GET", path: "/api/events", desc: "SSE: changed / op / apply / run / pr" },
-        { method: "POST", path: "/api/refresh", desc: "re-observe live now (?env=) \u2014 returns the fresh graph" },
+        { method: "POST", path: "/api/refresh", desc: "re-observe live now (?env=) \u2014 returns the fresh graph. With ?notify=1 it is a host's notice that the workspace changed: cached reads are dropped and every open page re-pulls (#476)" },
         { method: "POST", path: "/api/apply", desc: "delegated apply: ?env=&component=<name|all> (guarded, preview-locked)" },
         { method: "POST", path: "/api/ops/:name/run", desc: "run a committed Op (delegated write)" },
         { method: "POST", path: "/api/ops/:name/signal/:gate", desc: "approve an Op's gate (releases the waiting run)" },
+        { method: "GET", path: "/api/workspace/gates", desc: "a declared workspace's waiting gates from chant workspace status <env> --json (?env=), keyed member/op/gate, with the approver behold would record (#477)" },
+        { method: "POST", path: "/api/workspace/gates/approve", desc: "approve one workspace gate: JSON body {key, env}; env and plan come from a fresh status read; recorded as the user running behold; preview-locked (#477)" },
         { method: "POST", path: "/api/operator/approve/:op/:gate", desc: "record a converge gate's resolution (chant approve \u2014 a fact for the next tick, not an unblock)" },
         { method: "POST", path: "/api/rollback", desc: "open a rollback PR: ?to=<sha>" },
         { method: "POST", path: "/api/substrates/:name/up", desc: "bring a substrate up" },
@@ -13878,8 +14643,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         }
         const runState = runner.runState;
         const ranOp = runState.op ? parsedOps.find((o) => o.name === runState.op) : void 0;
-        const join28 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
-        const opsIr = join28 ? paintPlayhead(declaredIr, join28, runState.gate) : declaredIr;
+        const join30 = ranOp ? joinRun(ranOp, runState.records, runState.gate) : null;
+        const opsIr = join30 ? paintPlayhead(declaredIr, join30, runState.gate) : declaredIr;
         const { svg: svg2 } = renderGraph(opsIr, { boxes: "byStack" });
         const operator = runner.noteDeclaredConvergeOps(declaredConvergeOps(parsedOps));
         return c.json({
@@ -13892,7 +14657,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             target: null,
             mode: "ops",
             ops: parsedOps.length,
-            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join28)} ${operatorNote(operator)}`,
+            note: `${opsNote(parsedOps, opsIr)} ${playheadNote(runState, join30)} ${operatorNote(operator)}`,
             // The operator strip's own model: the ConvergeOps this project
             // declares, plus whatever the last status read said. `declared`
             // without a `strip` is the honest starting state — a loop exists and
@@ -13999,12 +14764,21 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync17(join25(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && !ownKindVia && ir.nodes.length === 0 && !existsSync18(join26(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
       const collapse = new URL(c.req.url).searchParams.get("collapse") === "1";
       let collapsedNote;
+      const srcTraffic = components ? void 0 : trafficFor(new URL(c.req.url).searchParams, beholdConfig);
+      const srcBehaviour = srcTraffic ? attachDeclaredBehaviour(
+        ir,
+        await Promise.all(
+          (multi ? estateMembers(cfg.projectDirs) : [{ name: void 0, dir: cfg.projectDir, kind: memberKindOf(cfg.projectDir) ?? "chant" }]).map(
+            async (m) => ({ name: m.name, prediction: await predictMember(m, void 0, srcTraffic, predictDeps) })
+          )
+        )
+      ) : void 0;
       const expanded = ir;
       if (multi && collapse) {
         const shut = collapseBoxes(ir);
@@ -14029,6 +14803,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         meta: {
           projectDir: cfg.projectDir,
           env: metaEnv,
+          ...srcBehaviour ? { behaviour: srcBehaviour } : {},
           ...srcNote ? { note: srcNote } : {},
           // #393 item 7: the strip's form of the same note, when there is a
           // shorter true one. Absent means "the note fits" — the SPA shows
@@ -14162,7 +14937,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   const choudoufuPlanDrift = async (dirs, wanted) => {
     const members = estateMembers(dirs).filter((m) => m.kind === "choudoufu");
-    const byDir = /* @__PURE__ */ new Map();
+    const byDir2 = /* @__PURE__ */ new Map();
     let read = false;
     for (const m of members) {
       const stamp = memberSourceStamp(m.dir);
@@ -14170,7 +14945,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const hit = cachedChoudoufuPlan(m.dir, stamp);
         if (hit) {
           read = true;
-          byDir.set(m.dir, { name: m.name, drift: hit });
+          byDir2.set(m.dir, { name: m.name, drift: hit });
         }
         continue;
       }
@@ -14178,11 +14953,11 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
         const drift = await readChoudoufuPlan(m.dir, cfg.choudoufu?.run);
         cacheChoudoufuPlan(m.dir, stamp, drift);
         read = true;
-        byDir.set(m.dir, { name: m.name, drift });
+        byDir2.set(m.dir, { name: m.name, drift });
       } catch {
       }
     }
-    return { read, byDir };
+    return { read, byDir: byDir2 };
   };
   app.get("/api/overlay", async (c) => {
     const query = optsFromQuery(new URL(c.req.url), tierEnvVar, cfg.projectDir);
@@ -14224,11 +14999,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
               mode: "progressive",
               // Which members the picture is still waiting on, so a client can
               // say so without inferring it from the attrs.
-              pending: shortStackNames2(cfg.projectDirs)
+              pending: estateMemberNames(cfg.projectDirs)
             }
           });
         }
-        const est = await composeEstateOverlay(cfg.projectDirs, { ...tierTargetOpts(query), detail, env }, reclassifyOverlay, { fresh: planWanted });
+        const traffic2 = trafficFor(new URL(c.req.url).searchParams, beholdConfig);
+        const est = await composeEstateOverlay(cfg.projectDirs, { ...tierTargetOpts(query), detail, env, ...traffic2 ? { traffic: traffic2 } : {} }, reclassifyOverlay, { fresh: planWanted });
         if (est.dropped.length === est.total) {
           return c.json({ error: `no project in the estate could be graphed \u2014 ${est.dropped.map((d) => `${d.name}: ${d.reason}`).join("; ")}` }, 500);
         }
@@ -14267,11 +15043,24 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
             meta: { projectDir: cfg.projectDir, env, mode: "logical", estate: est.total, vocabulary, ...note3 ? { note: note3 } : {} }
           });
         }
-        const behaviour2 = attachBehaviour(
+        const predicted = traffic2 ? await Promise.all(
+          estateMembers(cfg.projectDirs).map(async (m) => ({ m, prediction: await predictMember(m, env, traffic2, predictDeps, planWanted) }))
+        ) : [];
+        const paintNotes2 = [];
+        for (const { m, prediction: prediction2 } of predicted) {
+          if (prediction2.live) est.memberMeta[m.name] = paintLive(ir2, m.name, prediction2.live, paintNotes2);
+        }
+        const attached2 = attachBehaviour(
           ir2,
           estateMembers(cfg.projectDirs).map((m) => ({ name: m.name, dir: m.dir, meta: est.memberMeta[m.name] })),
-          env
+          env,
+          ...traffic2 ? [() => void 0] : []
         );
+        const behaviour2 = traffic2 ? attachBehaviourDelta(
+          ir2,
+          predicted.map(({ m, prediction: prediction2 }) => ({ name: m.name, liveMeta: est.memberMeta[m.name], prediction: prediction2 })),
+          paintNotes2.length ? { ...attached2, diagnostics: [...attached2.diagnostics ?? [], ...paintNotes2] } : attached2
+        ) : attached2;
         const collapsed = new URL(c.req.url).searchParams.get("collapse") === "1" && !runtime ? collapseBoxes(ir2) : void 0;
         const expanded = ir2;
         if (collapsed) ir2 = collapsed.ir;
@@ -14317,7 +15106,16 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           }
         });
       }
-      const opts = { ...query, live: true, overlay: true, env, ...logical || runtime ? { detail: 3 } : {} };
+      const traffic = trafficFor(new URL(c.req.url).searchParams, beholdConfig);
+      const ownKind = memberKindOf(cfg.projectDir) ?? "chant";
+      const opts = {
+        ...query,
+        live: true,
+        overlay: true,
+        env,
+        ...logical || runtime ? { detail: 3 } : {},
+        ...traffic && memberTakesTraffic(cfg.projectDir, ownKind) ? { traffic } : {}
+      };
       const read = await graphIr(cfg.projectDir, opts);
       const readMeta = read.meta;
       let ir = joinCarvedSources(reclassifyOverlay(read), (await carveStatesFor(cfg.projectDir)).values(), cfg.projectDir).ir;
@@ -14358,7 +15156,11 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           compositeEdgesAttached = 0;
         }
       }
-      const behaviour = attachBehaviour(ir, [{ dir: cfg.projectDir, meta: readMeta }], env);
+      const prediction = traffic ? await predictMember({ dir: cfg.projectDir, kind: ownKind }, env, traffic, predictDeps) : void 0;
+      const paintNotes = [];
+      const liveMeta = prediction?.live ? paintLive(ir, void 0, prediction.live, paintNotes) : readMeta;
+      const attached = attachBehaviour(ir, [{ dir: cfg.projectDir, meta: liveMeta }], env, ...traffic ? [() => void 0] : []);
+      const behaviour = prediction ? attachBehaviourDelta(ir, [{ liveMeta, prediction }], paintNotes.length ? { ...attached, diagnostics: [...attached.diagnostics ?? [], ...paintNotes] } : attached) : attached;
       const { svg } = renderGraph(ir, { boxes: "byContainer", radial: new URL(c.req.url).searchParams.get("radial") === "1" });
       const zoom = runtime ? "runtime" : query.detail === 1 ? "composites" : query.detail === 3 ? "attributes" : "resources";
       const tierNote = tierMismatchNote(ir, beholdConfig.tiers, query.tier);
@@ -14371,7 +15173,14 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     }
   });
   app.post("/api/refresh", async (c) => {
-    const env = optsFromQuery(new URL(c.req.url)).env ?? cfg.env;
+    const url = new URL(c.req.url);
+    if (url.searchParams.get("notify") === "1") {
+      invalidateMember();
+      invalidateOverlay();
+      broadcaster.emit("changed", "");
+      return c.json({ notified: true });
+    }
+    const env = optsFromQuery(url).env ?? cfg.env;
     const result = await captureFrame(cfg.projectDir, env, frames, broadcaster);
     if (!result) return c.json({ error: "refresh failed \u2014 see server log" }, 500);
     if (env) reclassifyOverlay(result.ir);
@@ -14451,9 +15260,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   const choudoufuPlanPath = (plan) => {
     if (!plan) return { error: "no plan named", code: "choudoufu_no_plan", remedy: "pass ?plan=<path to a carve.json inside a served choudoufu member> \u2014 GET /api/project lists the ones found" };
-    const abs = resolve13(cfg.projectDir, plan);
+    const abs = resolve16(cfg.projectDir, plan);
     const members = (cfg.projectDirs ?? [cfg.projectDir]).filter((d) => memberKindOf(d) === "choudoufu");
-    const inside = members.some((d) => abs.startsWith(resolve13(d) + sep7));
+    const inside = members.some((d) => abs.startsWith(resolve16(d) + sep7));
     if (!inside) return { error: `${plan} is not inside a served choudoufu member`, code: "choudoufu_plan_outside", remedy: "a plan lives in the estate it moves; point ?plan= at a carve.json under one of the served members" };
     return { path: abs };
   };
@@ -14584,8 +15393,12 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, component, env });
   });
   const rel = relative8(process.cwd(), webRoot) || ".";
+  app.use("/*", async (c, next) => {
+    await next();
+    if (!c.req.path.startsWith("/api/") && c.res.ok && !c.res.headers.has("cache-control")) c.res.headers.set("cache-control", "no-cache");
+  });
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join25(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join26(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -14614,7 +15427,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync17(join25(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync18(join26(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -14623,6 +15436,7 @@ async function startServer(cfg) {
     broadcaster,
     onDone: (opEnv) => captureFrame(cfg.projectDir, opEnv ?? cfg.env, frames, broadcaster)
   });
+  if (!cfg.host && process.env.BEHOLD_HOST) cfg.host = process.env.BEHOLD_HOST;
   const app = createApp(cfg, broadcaster, frames, runner);
   const autoSync = cfg.autoSync ?? "off";
   if (!cfg.carveReport) {
@@ -14646,7 +15460,7 @@ async function startServer(cfg) {
     invalidateOverlay(memberDir);
     onEstateChange(memberDir);
   };
-  const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename2(dir)}]` : "";
+  const memberTag = (dir) => (cfg.projectDirs?.length ?? 0) > 1 ? ` [${basename3(dir)}]` : "";
   const onPollDrift = (dir, movedLexicons) => {
     broadcaster.emit("changed", dir);
     if (autoSync === "off") return;
@@ -14656,7 +15470,7 @@ async function startServer(cfg) {
     const suspended = autoSync === "pull-request" ? suspendedByRollback(await openRollbackBranches(dir, cfg.env), movedLexicons) : /* @__PURE__ */ new Set();
     const { routed, local } = splitForgeRouted(discoverEstateOps(cfg.projectDirs ?? [cfg.projectDir]), executorDesignation);
     for (const { op: o, designation: d } of routed) {
-      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined ${o.name}: env ${o.env} deploys through ${"invalid" in d ? "a forge" : d.forge} per ${basename2(o.dir)}/.behold.json \u2014 never applied from here`);
+      broadcaster.emit("op", `\u27F3 auto-sync (${autoSync})${memberTag(dir)} declined ${o.name}: env ${o.env} deploys through ${"invalid" in d ? "a forge" : d.forge} per ${basename3(o.dir)}/.behold.json \u2014 never applied from here`);
     }
     const { picks, declined } = pickAutoSyncOps(
       autoSync,
@@ -14730,7 +15544,8 @@ async function startServer(cfg) {
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
-  const server = serve({ fetch: app.fetch, port: cfg.port }, (info) => {
+  const hostname = cfg.host ?? process.env.BEHOLD_HOST ?? "127.0.0.1";
+  const server = serve({ fetch: app.fetch, port: cfg.port, hostname }, (info) => {
     if (carve) {
       process.stdout.write(
         `behold \u2192 http://localhost:${info.port}
@@ -14778,9 +15593,132 @@ async function startServer(cfg) {
 // src/cli.ts
 init_chant();
 
+// src/workspace-convert.ts
+init_chant();
+import { existsSync as existsSync19, mkdirSync as mkdirSync7, readFileSync as readFileSync20, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename4, dirname as dirname8, join as join27, relative as relative9, resolve as resolve17, sep as sep8 } from "node:path";
+import { shortStackNames as shortStackNames2 } from "@intentius/pinhole";
+init_project();
+init_terraform_member();
+var TERRAFORM_LEXICON2 = "@intentius/chant-lexicon-terraform";
+function declarationName(raw) {
+  const folded = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
+  return folded || "member";
+}
+function unique(name, taken) {
+  let out = name;
+  for (let i = 2; taken.has(out); i++) out = `${name.slice(0, 40 - String(i).length - 1)}-${i}`;
+  taken.add(out);
+  return out;
+}
+var posix = (p) => p.split(sep8).join("/");
+function installedVersion(pkg, dir) {
+  for (let at = resolve17(dir); ; at = dirname8(at)) {
+    const manifest = join27(at, "node_modules", ...pkg.split("/"), "package.json");
+    if (existsSync19(manifest)) {
+      try {
+        const v = JSON.parse(readFileSync20(manifest, "utf8")).version;
+        return typeof v === "string" ? v : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    if (dirname8(at) === at) return void 0;
+  }
+}
+function planConversion(rootArg) {
+  const root = resolve17(rootArg);
+  const existing = DECLARATION_FILES.find((f) => existsSync19(join27(root, f)));
+  if (existing) return { ok: false, error: `${root} already has ${existing}; there is nothing to convert.` };
+  const shape = detectProjectShape(root);
+  if (shape.kind !== "estate" || !shape.members?.length || shape.membersFrom === "itself") {
+    return { ok: false, error: `${root} is not an estate root with a member list, so there is no member list to convert.` };
+  }
+  const abs = shape.members.map((m) => resolve17(root, m.dir));
+  const shorts = shortStackNames2(abs);
+  const taken = /* @__PURE__ */ new Set();
+  const members = [];
+  const moves = [];
+  const notes = [];
+  let needsLexicon = false;
+  shape.members.forEach((m, i) => {
+    const short = shorts[i];
+    const dir = posix(relative9(root, abs[i])) || ".";
+    if (m.kind === "terraform") {
+      needsLexicon = true;
+      const scan = discoverTerraformRoots(abs[i]);
+      for (const r of scan.roots) {
+        const name2 = unique(declarationName(r.name), taken);
+        members.push({ name: name2, dir: r.dir === "." ? dir : posix(join27(dir, r.dir)), kind: "terraform" });
+        moves.push({ from: `${short}/${r.name}/`, to: `${name2}/${name2}/` });
+      }
+      for (const s of scan.skipped) notes.push(`${posix(join27(dir, s.dir))} is not declared: ${s.why}.`);
+      if (scan.roots.length > 1) notes.push(`${dir} held ${scan.roots.length} Terraform roots; each is its own member now, since a chant terraform member is one root.`);
+      return;
+    }
+    if (m.kind === "choudoufu") needsLexicon = true;
+    const name = unique(declarationName(short), taken);
+    members.push({ name, dir, kind: m.kind });
+    if (name !== short) {
+      moves.push({ from: `${short}/`, to: `${name}/` });
+      notes.push(`member ${short} is declared as ${name}: a declared name is lowercase letters, digits and hyphens.`);
+    }
+  });
+  const pins = [];
+  const chant = resolveChant(root);
+  if (chant.source === "project" && chant.version) pins.push({ package: "@intentius/chant", version: chant.version });
+  if (needsLexicon) {
+    const version = installedVersion(TERRAFORM_LEXICON2, root);
+    if (version) pins.push({ package: TERRAFORM_LEXICON2, version });
+    else notes.push(`${TERRAFORM_LEXICON2} is not installed where chant looks from ${root}; install it there and add it to "pins", or chant cannot read the terraform and choudoufu members.`);
+  }
+  const declaration = {
+    name: declarationName(basename4(root)),
+    schema: 1,
+    ...pins.length ? { pins } : {},
+    members
+  };
+  const firstLayout = layoutPath(abs[0]);
+  moves.sort((a, b) => b.from.length - a.from.length);
+  return { ok: true, plan: { root, from: shape.membersFrom === "behold-config" ? "behold-config" : "workspaces", declaration, moves, ...existsSync19(firstLayout) ? { layoutFrom: firstLayout } : {}, notes } };
+}
+function moveLayoutIds(file, moves) {
+  const lenses = {};
+  for (const [lens, deltas] of Object.entries(file.lenses)) {
+    const out = {};
+    for (const [id, d] of Object.entries(deltas)) {
+      const move = moves.find((m) => id.startsWith(m.from));
+      out[move ? move.to + id.slice(move.from.length) : id] = d;
+    }
+    lenses[lens] = out;
+  }
+  return { version: 1, lenses };
+}
+function applyConversion(plan) {
+  const declarationFile = join27(plan.root, DECLARATION_FILES[0]);
+  if (existsSync19(declarationFile)) throw new Error(`${declarationFile} appeared while converting; nothing was written`);
+  writeFileSync6(declarationFile, `${JSON.stringify(plan.declaration, null, 2)}
+`);
+  let layout;
+  const target = layoutPath(plan.root);
+  if (!plan.layoutFrom) layout = { skipped: "no saved layout to move" };
+  else if (resolve17(plan.layoutFrom) === resolve17(target)) layout = { skipped: "the saved layout is already in the root" };
+  else if (existsSync19(target)) layout = { skipped: `${target} already exists; the layout in ${plan.layoutFrom} was left alone` };
+  else {
+    const moved = moveLayoutIds(readLayoutFile(dirname8(dirname8(plan.layoutFrom))), plan.moves);
+    mkdirSync7(join27(plan.root, LAYOUT_DIR), { recursive: true });
+    const tmp = `${target}.tmp`;
+    writeFileSync6(tmp, `${JSON.stringify(moved, null, 2)}
+`);
+    renameSync2(tmp, target);
+    layout = { wrote: target, ids: Object.values(moved.lenses).reduce((n, l) => n + Object.keys(l).length, 0) };
+  }
+  return { declaration: declarationFile, layout };
+}
+
 // src/export.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6, copyFileSync, readFileSync as readFileSync20, readdirSync as readdirSync10, existsSync as existsSync18 } from "node:fs";
-import { join as join26, dirname as dirname8, basename as basename3 } from "node:path";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync7, copyFileSync, readFileSync as readFileSync21, readdirSync as readdirSync10, existsSync as existsSync20 } from "node:fs";
+import { join as join28, dirname as dirname9, basename as basename5 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var LENS_PARAMS = ["collapse", "components", "detail", "env", "logical", "ops", "radial", "stacks", "tier"];
 function canonicalKey(path, params) {
@@ -14829,31 +15767,31 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join26(dirname8(fileURLToPath5(import.meta.url)), "..", "web");
+  return join28(dirname9(fileURLToPath5(import.meta.url)), "..", "web");
 }
 function pkgRoot2() {
-  return join26(dirname8(fileURLToPath5(import.meta.url)), "..");
+  return join28(dirname9(fileURLToPath5(import.meta.url)), "..");
 }
 var NOTICE_FILES = ["LICENSE", "THIRD_PARTY.md"];
 function copyNotices(outDir, root = pkgRoot2()) {
   const copied = [];
   for (const f of NOTICE_FILES) {
-    if (!existsSync18(join26(root, f))) continue;
-    copyFileSync(join26(root, f), join26(outDir, f));
+    if (!existsSync20(join28(root, f))) continue;
+    copyFileSync(join28(root, f), join28(outDir, f));
     copied.push(f);
   }
-  const lic = join26(root, "licenses");
-  if (existsSync18(lic)) {
-    mkdirSync7(join26(outDir, "licenses"), { recursive: true });
+  const lic = join28(root, "licenses");
+  if (existsSync20(lic)) {
+    mkdirSync8(join28(outDir, "licenses"), { recursive: true });
     for (const f of readdirSync10(lic)) {
-      copyFileSync(join26(lic, f), join26(outDir, "licenses", f));
+      copyFileSync(join28(lic, f), join28(outDir, "licenses", f));
       copied.push(`licenses/${f}`);
     }
   }
   return copied;
 }
 function workerName(project, override) {
-  const raw = override ?? `behold-${basename3(project)}`;
+  const raw = override ?? `behold-${basename5(project)}`;
   const name = raw.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
   return name || "behold-export";
 }
@@ -14861,8 +15799,8 @@ async function runExport(cfg, outDir, opts = {}) {
   const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [], ...proj.ops ? { ops: proj.ops } : {} };
-  const snapDir = join26(outDir, "snapshots");
-  mkdirSync7(snapDir, { recursive: true });
+  const snapDir = join28(outDir, "snapshots");
+  mkdirSync8(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
   let failed = 0;
@@ -14870,7 +15808,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
     const file = slug3(key);
-    writeFileSync6(join26(snapDir, file), body);
+    writeFileSync7(join28(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -14882,22 +15820,22 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync6(join26(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync20(join26(webDir(), "index.html"), "utf8").replace(
+  writeFileSync7(join28(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync21(join28(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync6(join26(outDir, "index.html"), html);
+  writeFileSync7(join28(outDir, "index.html"), html);
   for (const f of readdirSync10(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join26(webDir(), f), join26(outDir, f));
+    copyFileSync(join28(webDir(), f), join28(outDir, f));
   }
-  writeFileSync6(join26(outDir, "README.md"), BUNDLE_README);
+  writeFileSync7(join28(outDir, "README.md"), BUNDLE_README);
   copyNotices(outDir);
   const name = workerName(cfg.projectDir, opts.name);
-  writeFileSync6(
-    join26(outDir, "wrangler.jsonc"),
+  writeFileSync7(
+    join28(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -14949,15 +15887,16 @@ init_project();
 init_member_kind();
 init_choudoufu_member();
 init_carve_lens();
+init_terraform_member();
 var USAGE = `behold \u2014 a live control plane on chant (read-only core)
 
 Usage:
   behold demo [name] [target-dir] [--port <n>] [--list]
   behold demo carve [--live] [--port <n>]
-  behold doctor [project-dir] [--json]
+  behold doctor [project-dir] [--json] [--fix]
   behold preview [project-dir] [--port <n>] [--emulator]
   behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
-  behold serve <project-dir\u2026> [--port <n>] [--env <name>] [--poll <secs>] [--local]
+  behold serve <project-dir\u2026> [--port <n>] [--host <addr>] [--allow-host <name,\u2026>] [--env <name>] [--poll <secs>] [--local]
   behold carve <report.json> [--port <n>]
 
   carve   Render a chant Terraform peelability report \u2014 the JSON from
@@ -15016,6 +15955,12 @@ Usage:
 
 Options:
   --port <n>          Port (default 4600). preview/serve/carve.
+  --host <addr>       serve only: the address to bind (default 127.0.0.1, or
+                      BEHOLD_HOST). behold runs writes with your credentials,
+                      so it answers this machine unless you say otherwise.
+  --allow-host <n,\u2026>  serve only: names besides loopback behold answers to, and
+                      whose pages may write (BEHOLD_ALLOWED_HOSTS too). For a
+                      proxy that frames behold, or --host 0.0.0.0.
   --env <name>        Environment name \u2014 turns on the live drift overlay.
                       export/serve.
   --poll <secs>       Re-query live drift every <secs> and push updates (needs --env).
@@ -15048,6 +15993,10 @@ Options:
                       with chant's generic \`chant emulator up\`.
   --json              doctor only: the report as JSON (stable keys) instead of
                       the console lines \u2014 the AGENTS.md audience.
+  --fix               doctor only: write chant.workspace.json for an estate
+                      root that lists its members in .behold.json, move its
+                      saved layout to the root, and run chant workspace check.
+                      The one doctor that writes (#464).
   --out <dir>         export only: output directory (default ./behold-export).
   --name <worker>     export only: Cloudflare Worker name in the generated
                       wrangler.jsonc.
@@ -15096,9 +16045,13 @@ ${USAGE}`);
   let pollSecs;
   let autoSync = "off";
   let local = false;
+  let host;
+  const allowHosts = [];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     if (a === "--port") port = Number(rest[++i]);
+    else if (a === "--host") host = rest[++i];
+    else if (a === "--allow-host") allowHosts.push(...(rest[++i] ?? "").split(","));
     else if (a === "--env") env = rest[++i];
     else if (a === "--poll") pollSecs = Number(rest[++i]);
     else if (a === "--local") local = true;
@@ -15139,7 +16092,24 @@ ${USAGE}`);
     process.stderr.write("behold serve: --auto-sync needs --env and --poll (it acts on polled drift)\n");
     process.exit(2);
   }
-  const dirs = projectDirs.map((d) => resolve14(d));
+  const dirs = projectDirs.map((d) => resolve18(d));
+  const workspace = dirs.length === 1 && hasDeclaration(dirs[0]) ? await declaredWorkspace(dirs[0]) : void 0;
+  if (workspace) {
+    const drawn = drawnMembers(workspace).map((m) => m.abs);
+    await startServer({
+      projectDir: drawn[0] ?? workspace.root,
+      projectDirs: drawn,
+      workspace,
+      port,
+      ...env ? { env } : {},
+      ...pollSecs !== void 0 ? { pollSecs } : {},
+      ...autoSync !== "off" ? { autoSync } : {},
+      ...local ? { local: true } : {},
+      ...host ? { host } : {},
+      ...allowHosts.length ? { allowedHosts: allowHosts } : {}
+    });
+    return;
+  }
   for (const d of dirs) warnIfNotChantProject(d);
   await startServer({
     projectDir: dirs[0],
@@ -15153,9 +16123,33 @@ ${USAGE}`);
     ...env ? { env } : {},
     ...pollSecs !== void 0 ? { pollSecs } : {},
     ...autoSync !== "off" ? { autoSync } : {},
-    ...local ? { local: true } : {}
+    ...local ? { local: true } : {},
+    ...host ? { host } : {},
+    ...allowHosts.length ? { allowedHosts: allowHosts } : {}
   });
 }
+async function declaredWorkspace(root) {
+  const read = await readWorkspace(root);
+  if (!read.ok) {
+    process.stderr.write(`behold serve: ${read.refusal.error}
+        ${read.refusal.remedy}
+`);
+    process.exit(1);
+  }
+  const ws = read.workspace;
+  const drawn = drawnMembers(ws);
+  process.stdout.write(`behold: serving chant workspace ${ws.name} (${ws.file}), ${drawn.length} of ${ws.members.length} members drawn
+`);
+  for (const m of unreadableMembers(ws)) process.stdout.write(`        ${m.name}: unreadable, ${m.reason.code}: ${m.reason.message}
+`);
+  for (const m of undrawnMembers(ws)) process.stdout.write(`        ${m.name}: kind ${m.kind}, listed and not drawn${m.because ? ` (${m.because})` : ""}
+`);
+  if (loadBeholdConfig(root).members) {
+    process.stderr.write(`behold: warning \u2014 ${root}/.behold.json lists members, and chant.workspace.json does too; the declaration wins and .behold.json's members are ignored.
+`);
+  }
+  return ws;
+}
 function warnIfNotChantProject(dir) {
   const shape = detectProjectShape(dir);
   if (shape.kind === "project") return;
@@ -15163,7 +16157,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join27(dir, m.dir)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join29(dir, m.dir)).join(" ")}
 `
     );
     return;
@@ -15198,8 +16192,8 @@ async function runCarve(rest) {
     );
     process.exit(2);
   }
-  const reportPath = resolve14(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync21(p, "utf8"));
+  const reportPath = resolve18(fileArg);
+  const parsed = readCarveReport(reportPath, (p) => readFileSync22(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -15210,13 +16204,15 @@ async function runCarve(rest) {
     `behold carve \u2014 ${parsed.report.resources.length} resource(s)/module(s) ranked${parsed.report.from ? ` from ${parsed.report.from}` : ""}
 `
   );
-  await startServer({ projectDir: dirname9(reportPath), carveReport: reportPath, port });
+  await startServer({ projectDir: dirname10(reportPath), carveReport: reportPath, port });
 }
 async function runDoctor(rest) {
   let json = false;
+  let fix = false;
   let dirArg;
   for (const a of rest) {
     if (a === "--json") json = true;
+    else if (a === "--fix") fix = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
     else {
@@ -15226,17 +16222,44 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync19(resolve14(dir))) {
-    process.stderr.write(`behold doctor: no such directory: ${resolve14(dir)}
+  if (!existsSync21(resolve18(dir))) {
+    process.stderr.write(`behold doctor: no such directory: ${resolve18(dir)}
 `);
     process.exit(2);
   }
+  if (fix) return runDoctorFix(dir);
   const report = await diagnose(dir);
   process.stdout.write(json ? JSON.stringify(report, null, 2) + "\n" : formatReport(report));
   if (!report.ok) process.exitCode = 1;
 }
+async function runDoctorFix(dir) {
+  const planned = planConversion(dir);
+  if (!planned.ok) {
+    process.stderr.write(`behold doctor --fix: ${planned.error}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const { plan } = planned;
+  const wrote = applyConversion(plan);
+  process.stdout.write(`wrote ${wrote.declaration} (${plan.declaration.members.length} members)
+`);
+  if ("wrote" in wrote.layout) process.stdout.write(`moved the saved layout to ${wrote.layout.wrote} (${wrote.layout.ids} node ids)
+`);
+  else process.stdout.write(`layout: ${wrote.layout.skipped}
+`);
+  for (const n of plan.notes) process.stdout.write(`note: ${n}
+`);
+  if (plan.from === "behold-config") process.stdout.write(`.behold.json's members are ignored from now on, since the declaration lists them; you can delete them.
+`);
+  const check = await runChantRaw(["workspace", "check", "--format", "json"], plan.root);
+  process.stdout.write(check.code === 0 ? "chant workspace check: passed\n" : `chant workspace check failed (exit ${check.code}):
+${check.stdout || check.stderr}
+`);
+  if (check.code !== 0) process.exitCode = 1;
+}
 async function runDemo(rest) {
-  const pkgRoot3 = join27(dirname9(fileURLToPath6(import.meta.url)), "..");
+  const pkgRoot3 = join29(dirname10(fileURLToPath6(import.meta.url)), "..");
   const registry2 = loadDemoRegistry(pkgRoot3);
   let port = 4600;
   let live2 = false;
@@ -15299,7 +16322,7 @@ async function runDemo(rest) {
 `);
     process.exit(2);
   }
-  const target = dirArg ? resolve14(dirArg) : demoTargetDir(entry);
+  const target = dirArg ? resolve18(dirArg) : demoTargetDir(entry);
   const loaded = await loadDemo(entry, { pkgRoot: pkgRoot3, target, log: (line) => process.stdout.write(line + "\n") });
   if (!loaded.ok) {
     process.stderr.write(`behold demo ${entry.name}: ${loaded.error}
@@ -15331,7 +16354,7 @@ function spawnStep(cmd, args, cwd) {
   });
 }
 async function serveCarveDemo(target, carve, port, live2 = false) {
-  const at = (rel) => resolve14(target, rel);
+  const at = (rel) => resolve18(target, rel);
   const project = at(carve.project);
   const from = at(carve.from);
   const state = carve.state ? at(carve.state) : void 0;
@@ -15371,7 +16394,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     };
     process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
   }
-  if (existsSync19(join27(project, "package.json")) && !existsSync19(join27(project, "node_modules"))) {
+  if (existsSync21(join29(project, "package.json")) && !existsSync21(join29(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -15382,10 +16405,11 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     }
   }
   let degraded;
-  if (!existsSync19(join27(target, "node_modules", "@cdktf", "hcl2json"))) {
-    process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
-    const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
-    if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
+  if (!existsSync21(join29(target, "node_modules", ...HCL_PARSER_PKG.split("/")))) {
+    process.stdout.write(`behold demo carve \u2192 npm install ${HCL_PARSER_PKG} (chant's HCL parser, ~2MB, once)\u2026
+`);
+    const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", HCL_PARSER_PKG], target);
+    if (code !== 0) degraded = `couldn't install ${HCL_PARSER_PKG} (chant's HCL parser) \u2014 no network?`;
   }
   const report = at("carve-report.json");
   if (!degraded) {
@@ -15398,7 +16422,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
     );
     if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  const serving = !degraded && existsSync19(report) ? report : committed;
+  const serving = !degraded && existsSync21(report) ? report : committed;
   if (degraded) {
     process.stderr.write(
       `behold demo carve: ${degraded}
@@ -15406,7 +16430,7 @@ async function serveCarveDemo(target, carve, port, live2 = false) {
 `
     );
   }
-  if (!existsSync19(serving)) {
+  if (!existsSync21(serving)) {
     process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
     process.exit(2);
@@ -15451,8 +16475,8 @@ async function runPreview(rest) {
     process.stderr.write("behold preview: --port must be a number\n");
     process.exit(2);
   }
-  const projectDir = resolve14(dirArg ?? process.cwd());
-  if (!existsSync19(projectDir)) {
+  const projectDir = resolve18(dirArg ?? process.cwd());
+  if (!existsSync21(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -15472,26 +16496,26 @@ async function runPreview(rest) {
   await startServer({ projectDir, port, env: "local", previewMode: true });
 }
 async function runExportCmd(rest) {
-  let outDir = resolve14("behold-export");
+  let outDir = resolve18("behold-export");
   let env;
   let name;
   let dirArg;
   let emulator = false;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
-    if (a === "--out") outDir = resolve14(rest[++i]);
+    if (a === "--out") outDir = resolve18(rest[++i]);
     else if (a === "--env") env = rest[++i];
     else if (a === "--name") name = rest[++i];
     else if (a === "--emulator") emulator = true;
     else if (a === "-h" || a === "--help") return void process.stdout.write(USAGE);
     else if (!a.startsWith("-")) dirArg = a;
   }
-  const projectDir = resolve14(dirArg ?? process.cwd());
+  const projectDir = resolve18(dirArg ?? process.cwd());
   if (emulator) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync19(projectDir)) {
+  if (!existsSync21(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);