@intentius/behold 0.9.1 → 0.10.0

package/dist/cli.js

@@ -1038,10 +1038,10 @@ var init_src = __esm({
 });
 
 // src/cli.ts
-import { resolve as resolve7, dirname as dirname6, join as join17 } from "node:path";
-import { realpathSync, existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
+import { resolve as resolve7, dirname as dirname6, join as join18 } from "node:path";
+import { realpathSync, existsSync as existsSync14, readFileSync as readFileSync15, rmSync as rmSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { spawn as spawn5 } from "node:child_process";
+import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
 
 // src/server.ts
 import { Hono } from "hono";
@@ -1120,8 +1120,8 @@ import { serve } from "@hono/node-server";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname4, join as join15, relative as relative3, resolve as resolve5, sep as sep4 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "node:fs";
+import { dirname as dirname4, join as join16, relative as relative3, resolve as resolve5, sep as sep4 } from "node:path";
 
 // src/recents.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
@@ -3872,7 +3872,14 @@ function summarizePlan(plan, byComponent, nonResource) {
 }
 
 // src/render.ts
-import { layoutIr, layoutArchitecture, renderSvg, cardSizes, registerPack } from "@intentius/pinhole";
+import {
+  layoutIr,
+  layoutArchitecture,
+  renderSvg,
+  renderMorphHtml,
+  cardSizes,
+  registerPack
+} from "@intentius/pinhole";
 
 // src/icon-packs.ts
 import { readFileSync as readFileSync6 } from "node:fs";
@@ -4189,16 +4196,32 @@ function renderGraph(ir, opts = {}) {
   return { svg };
 }
 function renderBanded(ir, opts = {}) {
-  const bands = ir.groups.byStack ?? {};
+  const plan = bandedPlan(ir, ir.groups.byStack ?? {});
+  const height = plan.height;
+  const layout = {
+    width: plan.width,
+    height,
+    nodes: plan.placed.map((p) => ({ id: p.id, x: p.x, y: height - p.y }))
+  };
+  const svg = renderSvg(ir, layout, {
+    fit: true,
+    hideTitle: true,
+    groups: plan.boxes.map((b) => ({ ...b, y: height - b.y })),
+    ...opts.theme ? { theme: opts.theme } : {}
+  });
+  return { svg };
+}
+var GAP = 28;
+var PAD = 24;
+var TITLE = 34;
+var BAND_GAP = 26;
+var MEMBER_GAP = 48;
+function bandedPlan(ir, bands) {
   const size = footprints(ir);
   const dims = (id) => size.get(id) ?? { w: NODE_W, h: NODE_H };
   const ids = ir.nodes.map((n) => n.id);
   const cellW = Math.max(NODE_W, ...ids.map((id) => dims(id).w));
   const cellH = Math.max(NODE_H, ...ids.map((id) => dims(id).h));
-  const GAP = 28;
-  const PAD = 24;
-  const TITLE = 34;
-  const BAND_GAP = 26;
   const cols = Math.max(1, Math.round(Math.sqrt(ids.length * (cellH + GAP) * 2 / (cellW + GAP))));
   const contentW = cols * cellW + (cols - 1) * GAP;
   const panelW = contentW + PAD * 2;
@@ -4227,19 +4250,95 @@ function renderBanded(ir, opts = {}) {
     boxes.push({ title, x: panelW / 2, y: top + panelH / 2, w: panelW, h: panelH, ...status ? { status } : {} });
     top += panelH + BAND_GAP;
   }
-  const height = Math.max(1, top - BAND_GAP);
-  const layout = {
-    width: panelW,
-    height,
-    nodes: placed.map((p) => ({ id: p.id, x: p.x, y: height - p.y }))
-  };
-  const svg = renderSvg(ir, layout, {
+  return { placed, boxes, width: panelW, height: Math.max(1, top - BAND_GAP) };
+}
+function renderCarveEstate(tfIr, appIr, opts) {
+  const comp = composeCarveEstate(tfIr, namespaceAppIr(appIr, opts.appTitle), opts);
+  const svg = renderSvg(comp.ir, comp.layout, {
     fit: true,
     hideTitle: true,
-    groups: boxes.map((b) => ({ ...b, y: height - b.y })),
+    groups: comp.boxes,
     ...opts.theme ? { theme: opts.theme } : {}
   });
-  return { svg };
+  return { svg, ir: comp.ir };
+}
+function namespaceAppIr(appIr, appTitle) {
+  const prefix = `${appTitle.split(" ")[0]}/`;
+  const appId = (id) => `${prefix}${id}`;
+  return {
+    ...appIr,
+    nodes: appIr.nodes.map((n) => ({ ...n, id: appId(n.id) })),
+    edges: appIr.edges.map((e) => ({ ...e, from: appId(e.from), to: appId(e.to) })),
+    groups: {}
+  };
+}
+function composeCarveEstate(tfIr, appNs, opts) {
+  const tfPlan = bandedPlan(tfIr, tfIr.groups.byStack ?? {});
+  const appPlan = bandedPlan(appNs, { "carved so far": appNs.nodes.map((n) => n.id) });
+  const memberH = (plan) => TITLE + PAD + plan.height + PAD;
+  const memberW = (plan) => plan.width + PAD * 2;
+  const appX0 = memberW(tfPlan) + MEMBER_GAP;
+  const width = appX0 + memberW(appPlan);
+  const height = Math.max(memberH(tfPlan), memberH(appPlan));
+  const offset = (plan, x0) => ({
+    placed: plan.placed.map((p) => ({ id: p.id, x: x0 + PAD + p.x, y: TITLE + PAD + p.y })),
+    boxes: plan.boxes.map((b) => ({ ...b, x: x0 + PAD + b.x, y: TITLE + PAD + b.y }))
+  });
+  const tf = offset(tfPlan, 0);
+  const app = offset(appPlan, appX0);
+  const boxes = [
+    { title: opts.tfTitle, x: memberW(tfPlan) / 2, y: memberH(tfPlan) / 2, w: memberW(tfPlan), h: memberH(tfPlan) },
+    { title: opts.appTitle, x: appX0 + memberW(appPlan) / 2, y: memberH(appPlan) / 2, w: memberW(appPlan), h: memberH(appPlan) },
+    ...tf.boxes,
+    ...app.boxes
+  ];
+  const ir = {
+    nodes: [...tfIr.nodes, ...appNs.nodes],
+    edges: [...tfIr.edges, ...appNs.edges],
+    groups: {
+      byStack: {
+        ...tfIr.groups.byStack ?? {},
+        [opts.appTitle]: appNs.nodes.map((n) => n.id)
+      }
+    }
+  };
+  return {
+    ir,
+    layout: {
+      width,
+      height,
+      nodes: [...tf.placed, ...app.placed].map((p) => ({ id: p.id, x: p.x, y: height - p.y }))
+    },
+    boxes: boxes.map((b) => ({ ...b, y: height - b.y }))
+  };
+}
+function renderCarveMorph(tfIr, appIr, carved, opts) {
+  const appNs = namespaceAppIr(appIr, opts.appTitle);
+  const before = composeCarveEstate(tfIr, appNs, opts);
+  const gone = new Set(carved);
+  const bands = tfIr.groups.byStack ?? {};
+  const bandsAfter = {};
+  for (const [band, members] of Object.entries(bands)) {
+    const left = members.filter((id) => !gone.has(id));
+    if (left.length) bandsAfter[band] = left;
+  }
+  const tfAfter = {
+    nodes: tfIr.nodes.filter((n) => !gone.has(n.id)),
+    edges: tfIr.edges.filter((e) => !gone.has(e.from) && !gone.has(e.to)),
+    groups: { byStack: bandsAfter }
+  };
+  const carvedNodes = tfIr.nodes.filter((n) => gone.has(n.id)).map((n) => ({ ...n, attrs: { ...n.attrs, _status: "good", carve: "carved \u2192 chant" } }));
+  const appAfter = { ...appNs, nodes: [...appNs.nodes, ...carvedNodes] };
+  const after = composeCarveEstate(tfAfter, appAfter, opts);
+  const view = (name, comp) => ({
+    name,
+    ir: comp.ir,
+    layout: comp.layout,
+    groups: comp.boxes
+  });
+  return renderMorphHtml([view("Terraform owns it", before), view("chant owns it", after)], {
+    title: opts.title ?? `carve morph \u2014 ${carved.join(", ")}`
+  });
 }
 var NODE_W = 175;
 var NODE_H = 104;
@@ -4406,8 +4505,8 @@ function radializeLayout(layout, groupOf, size = /* @__PURE__ */ new Map()) {
 }
 
 // src/carve-actions.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { isAbsolute, join as join9, relative, resolve as resolve2, sep } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { isAbsolute, join as join10, relative, resolve as resolve2, sep } from "node:path";
 
 // src/layout.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync, writeFileSync as writeFileSync2, accessSync, constants } from "node:fs";
@@ -4591,7 +4690,112 @@ function reanchorEdges(svg, moved) {
   return out + svg.slice(cursor);
 }
 
+// src/carve-live.ts
+import { spawn as spawn3 } from "node:child_process";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync3, existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
+var LIVE_CONTAINER = "behold-carve-floci";
+var LIVE_PORT = 4602;
+var LIVE_IMAGE = "floci/floci:1.5.34";
+var LIVE_TARGETS = [
+  "aws_s3_bucket.assets",
+  "aws_s3_bucket_versioning.assets",
+  "aws_s3_bucket_public_access_block.assets",
+  "aws_cloudwatch_log_group.worker"
+];
+function armOverride(disabledText, port) {
+  return disabledText.replaceAll("localhost:4566", `localhost:${port}`);
+}
+function parsePlanOutput(stdout, exitCode) {
+  const planLine = stdout.split("\n").reverse().find((l) => l.startsWith("Plan:") || l.includes("No changes.")) ?? `terraform plan exited ${exitCode}`;
+  const destroyMatch = planLine.match(/(\d+) to destroy/);
+  return {
+    planLine: planLine.trim(),
+    changes: exitCode === 2,
+    noDestroy: !destroyMatch || destroyMatch[1] === "0"
+  };
+}
+function capture(cmd, args, cwd) {
+  return new Promise((res) => {
+    const child = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"], cwd, shell: process.platform === "win32" });
+    let out = "";
+    child.stdout?.on("data", (d) => out += d.toString());
+    child.stderr?.on("data", (d) => out += d.toString());
+    child.on("error", () => res({ code: -1, stdout: out }));
+    child.on("close", (code) => res({ code: code ?? 1, stdout: out }));
+  });
+}
+async function bootScratchFloci() {
+  const ps = await capture("docker", ["ps", "-a", "--format", "{{.Names}}"], process.cwd());
+  if (ps.code !== 0) return "docker isn't answering \u2014 is the daemon up?";
+  if (ps.stdout.split("\n").includes(LIVE_CONTAINER)) {
+    return `container ${LIVE_CONTAINER} already exists \u2014 a previous run didn't tear down. \`docker rm -f ${LIVE_CONTAINER}\` and re-run.`;
+  }
+  const run3 = await capture(
+    "docker",
+    ["run", "-d", "--rm", "-p", `${LIVE_PORT}:4566`, "--name", LIVE_CONTAINER, LIVE_IMAGE],
+    process.cwd()
+  );
+  if (run3.code !== 0) return `docker run ${LIVE_IMAGE} failed (${run3.code})`;
+  for (let i = 0; i < 30; i++) {
+    try {
+      const health = await fetch(`http://localhost:${LIVE_PORT}/_localstack/health`);
+      if (health.ok && (await health.text()).includes("cloudformation")) return void 0;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 1e3));
+  }
+  await teardownScratchFloci();
+  return `Floci never reported healthy on :${LIVE_PORT} after 30s`;
+}
+async function teardownScratchFloci() {
+  await capture("docker", ["rm", "-f", LIVE_CONTAINER], process.cwd()).catch(() => void 0);
+}
+async function applyIntoFloci(fromDir, step) {
+  const template = join9(fromDir, "floci-override.tf.disabled");
+  if (!existsSync7(template)) return `no floci-override.tf.disabled in ${fromDir} \u2014 this estate wasn't authored for the live tier`;
+  writeFileSync3(join9(fromDir, "floci_override.tf"), armOverride(readFileSync8(template, "utf8"), LIVE_PORT));
+  const init = await step("terraform", ["init", "-input=false", "-no-color"], fromDir);
+  if (init !== 0) return `terraform init exited ${init} (provider downloads need network)`;
+  const apply = await step(
+    "terraform",
+    ["apply", "-input=false", "-auto-approve", "-no-color", ...LIVE_TARGETS.map((t) => `-target=${t}`)],
+    fromDir
+  );
+  if (apply !== 0) return `terraform apply exited ${apply}`;
+  return void 0;
+}
+async function runLivePlan(fromDir) {
+  const r = await capture("terraform", ["plan", "-input=false", "-no-color", "-detailed-exitcode", ...LIVE_TARGETS.map((t) => `-target=${t}`)], fromDir);
+  if (r.code !== 0 && r.code !== 2) {
+    const tail = r.stdout.trim().split("\n").slice(-8).join("\n");
+    return { error: `terraform plan failed (exit ${r.code}):
+${tail}`, exitCode: r.code };
+  }
+  return { ...parsePlanOutput(r.stdout, r.code), exitCode: r.code };
+}
+
 // src/carve-actions.ts
+async function runCarvePlan(demo) {
+  if (!demo?.live) {
+    return refuse2(
+      "carve-action",
+      "terraform plan is the live tier's beat, and this server isn't serving one",
+      "run `behold demo carve --live` (needs docker + terraform)"
+    );
+  }
+  const r = await runLivePlan(demo.from);
+  if ("error" in r) {
+    return refuse2("carve-action", r.error, "Is the scratch Floci still up? `docker ps` should list " + demo.live.container + ".");
+  }
+  return {
+    ok: true,
+    command: "terraform plan -detailed-exitcode (targeted, in the demo copy)",
+    planLine: r.planLine,
+    changes: r.changes,
+    noDestroy: r.noDestroy
+  };
+}
 var MAX_ARTIFACT_BYTES = 64 * 1024;
 var MAX_ARTIFACTS = 24;
 var MAX_OUTPUT_BYTES = 32 * 1024;
@@ -4612,7 +4816,7 @@ function carveWriteBlock(demo) {
   if (!demo) {
     return "this server isn't running a carve demo \u2014 the carve actions only exist inside a `behold demo carve` copy";
   }
-  if (!existsSync7(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
+  if (!existsSync8(demo.from)) return `the demo copy has no Terraform estate at ${demo.from}`;
   if (!insideDemo(demo.root, demo.out)) return "the carve output directory is outside the demo copy";
   return unwritableReason(demo.root);
 }
@@ -4629,7 +4833,7 @@ function readArtifacts(demo, dir, filter) {
     for (const name of entries) {
       if (out.length >= MAX_ARTIFACTS) return;
       if (name === "node_modules" || name.startsWith(".")) continue;
-      const full = join9(d, name);
+      const full = join10(d, name);
       let st;
       try {
         st = statSync2(full);
@@ -4644,7 +4848,7 @@ function readArtifacts(demo, dir, filter) {
       if (!filter(rel)) continue;
       let text = "";
       try {
-        text = readFileSync8(full, "utf8");
+        text = readFileSync9(full, "utf8");
       } catch {
         continue;
       }
@@ -4676,7 +4880,7 @@ async function runCarveEmit(demo, select) {
   const block = carveWriteBlock(demo);
   if (block) return refuse2("read-only", block, "Start the walkthrough with `behold demo carve`.");
   mkdirSync3(demo.out, { recursive: true });
-  const reportFile = join9(demo.out, `${carveSlug(select)}-boundary.json`);
+  const reportFile = join10(demo.out, `${carveSlug(select)}-boundary.json`);
   const args = [
     "carve",
     "emit",
@@ -4705,10 +4909,10 @@ async function runCarveEmit(demo, select) {
   }
   let boundary = null;
   try {
-    boundary = JSON.parse(readFileSync8(reportFile, "utf8"));
+    boundary = JSON.parse(readFileSync9(reportFile, "utf8"));
   } catch {
   }
-  const lintPath = relative(demo.project, join9(demo.out, "src")).split(sep).join("/");
+  const lintPath = relative(demo.project, join10(demo.out, "src")).split(sep).join("/");
   const lintArgs = ["lint", lintPath];
   const lint = await runChantRaw(lintArgs, demo.project).catch((err) => ({
     code: 127,
@@ -4771,8 +4975,8 @@ async function runCarveBridge(demo, select) {
 }
 
 // src/ops.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, existsSync as existsSync8 } from "node:fs";
-import { join as join10 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, existsSync as existsSync9 } from "node:fs";
+import { join as join11 } from "node:path";
 var APPLY_TARGET_LEXICON = {
   cloudformation: "aws",
   kubectl: "k8s",
@@ -4794,11 +4998,11 @@ function discoverOps(projectDir) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const sub of ["ops", "src", "."]) {
-    const dir = join10(projectDir, sub);
-    if (!existsSync8(dir)) continue;
+    const dir = join11(projectDir, sub);
+    if (!existsSync9(dir)) continue;
     for (const f of readdirSync4(dir)) {
       if (!f.endsWith(".op.ts")) continue;
-      const content = readFileSync9(join10(dir, f), "utf8");
+      const content = readFileSync10(join11(dir, f), "utf8");
       const name = content.match(/name:\s*["'`]([^"'`]+)["'`]/)?.[1];
       if (!name || seen.has(name)) continue;
       seen.add(name);
@@ -5323,9 +5527,9 @@ var OpRunner = class {
 };
 
 // src/substrates.ts
-import { spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
+import { join as join12 } from "node:path";
 import { platform } from "node:os";
 var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
@@ -5333,7 +5537,7 @@ function probe(cmd, args) {
     let out = "";
     let proc;
     try {
-      proc = spawn3(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+      proc = spawn4(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     } catch {
       resolve8({ code: 127, out: "" });
       return;
@@ -5354,11 +5558,11 @@ async function dockerRunning(run3, nameFilter) {
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
 function scriptBringUp(projectDir, relPath, label) {
-  return existsSync9(join11(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
+  return existsSync10(join12(projectDir, relPath)) ? { label, cmd: "bash", args: [relPath] } : void 0;
 }
 function projectLexicons(projectDir) {
   try {
-    const src = readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8");
+    const src = readFileSync11(join12(projectDir, "chant.config.ts"), "utf-8");
     const m = src.match(/lexicons\s*:\s*\[([^\]]*)\]/);
     if (!m) return [];
     return [...m[1].matchAll(/["']([^"']+)["']/g)].map((x) => x[1]);
@@ -5410,7 +5614,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
     ["forgejo", "Forgejo", ".forgejo", "test/forgejo-runtime-e2e.sh"]
   ];
   for (const [name, label, marker, script] of forges) {
-    if (!existsSync9(join11(projectDir, marker))) continue;
+    if (!existsSync10(join12(projectDir, marker))) continue;
     const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
@@ -5444,7 +5648,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
       detail: endpoint ? `targeting ${endpoint}` : "real Fly (FLY_FLAPS_BASE_URL unset)"
     });
   }
-  if (existsSync9(join11(projectDir, ".github", "workflows"))) {
+  if (existsSync10(join12(projectDir, ".github", "workflows"))) {
     const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
@@ -5457,7 +5661,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext, probe
   if (lexicons.includes("temporal")) {
     let hasProfiles = false;
     try {
-      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync10(join11(projectDir, "chant.config.ts"), "utf-8"));
+      hasProfiles = /temporal\s*:\s*\{[\s\S]{0,400}?profiles\s*:/.test(readFileSync11(join12(projectDir, "chant.config.ts"), "utf-8"));
     } catch {
     }
     subs.push({
@@ -5562,7 +5766,7 @@ async function openRollbackBranches(projectDir, env) {
 
 // src/estate.ts
 import { statSync as statSync3 } from "node:fs";
-import { join as join12, resolve as resolve3, sep as sep2 } from "node:path";
+import { join as join13, resolve as resolve3, sep as sep2 } from "node:path";
 import { composeStacks, shortStackNames } from "@intentius/pinhole";
 async function composeEstate(projectDirs, opts = {}) {
   const names = shortStackNames(projectDirs);
@@ -5622,7 +5826,7 @@ function pathAlignment(declared, dir, isDir = realIsDir) {
   const have = root.split(sep2).filter(Boolean);
   for (let k = Math.min(want.length, have.length); k >= 1; k--) {
     if (!have.slice(-k).every((s, i) => s === want[i])) continue;
-    if (!isDir(join12(root, ...want.slice(k)))) continue;
+    if (!isDir(join13(root, ...want.slice(k)))) continue;
     return k;
   }
   return 0;
@@ -5652,10 +5856,10 @@ function joinNamespaceBindings(members, isDir = realIsDir) {
     if (!winner || tied) continue;
     const prev = best.get(winner.dir);
     if (prev === "ambiguous") continue;
-    const join18 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
-    if (!prev) best.set(winner.dir, { score: winner.score, join: join18 });
+    const join19 = { dir: winner.dir, namespace: b.namespace, path: b.path, declaredBy: b.declaredBy };
+    if (!prev) best.set(winner.dir, { score: winner.score, join: join19 });
     else if (prev.join.namespace !== b.namespace) best.set(winner.dir, "ambiguous");
-    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join18 });
+    else if (winner.score > prev.score) best.set(winner.dir, { score: winner.score, join: join19 });
   }
   return [...best.values()].filter((v) => v !== "ambiguous").map((v) => v.join);
 }
@@ -5717,8 +5921,8 @@ async function composeEstateOverlay(projectDirs, opts, classify) {
 }
 
 // src/events.ts
-import { watch, existsSync as existsSync10 } from "node:fs";
-import { join as join13 } from "node:path";
+import { watch, existsSync as existsSync11 } from "node:fs";
+import { join as join14 } from "node:path";
 var Broadcaster = class {
   listeners = /* @__PURE__ */ new Set();
   subscribe(fn) {
@@ -5736,7 +5940,7 @@ var Broadcaster = class {
 };
 var IGNORE = /(^|[\\/])(node_modules|dist|\.git)([\\/]|$)/;
 function watchSource(projectDir, onChange, debounceMs = 200) {
-  const dir = existsSync10(join13(projectDir, "src")) ? join13(projectDir, "src") : projectDir;
+  const dir = existsSync11(join14(projectDir, "src")) ? join14(projectDir, "src") : projectDir;
   let timer;
   const watcher = watch(dir, { recursive: true }, (_event, file) => {
     const name = typeof file === "string" ? file : "";
@@ -5840,7 +6044,7 @@ var FrameBuffer = class {
 };
 
 // src/lanes.ts
-import { renderMorphHtml, layoutIr as layoutIr2 } from "@intentius/pinhole";
+import { renderMorphHtml as renderMorphHtml2, layoutIr as layoutIr2 } from "@intentius/pinhole";
 function safeJson(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
@@ -5967,7 +6171,7 @@ function renderLanes(frames, summaries) {
     ir: f.ir,
     layout: layoutIr2(f.ir)
   }));
-  const doc = renderMorphHtml(views, { title: "Deployment lanes" });
+  const doc = renderMorphHtml2(views, { title: "Deployment lanes" });
   const laneFrames = frames.map((f, i) => ({
     t: summaries[i].t,
     name: new Date(summaries[i].t).toISOString().slice(11, 19),
@@ -6014,13 +6218,13 @@ async function emulatorDown(projectDir) {
 }
 
 // src/demos.ts
-import { readFileSync as readFileSync11, existsSync as existsSync11, cpSync } from "node:fs";
-import { join as join14, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
-import { spawn as spawn4, spawnSync } from "node:child_process";
+import { readFileSync as readFileSync12, existsSync as existsSync12, cpSync } from "node:fs";
+import { join as join15, relative as relative2, resolve as resolve4, sep as sep3 } from "node:path";
+import { spawn as spawn5, spawnSync } from "node:child_process";
 function loadDemoRegistry(pkgRoot2) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync11(join14(pkgRoot2, "demos.json"), "utf8"));
+    raw = JSON.parse(readFileSync12(join15(pkgRoot2, "demos.json"), "utf8"));
   } catch {
     return [];
   }
@@ -6061,16 +6265,16 @@ function fetchesFromNetwork(entry) {
 }
 function demoTargetDir(entry, cwd = process.cwd()) {
   const legacy = resolve4(cwd, "behold-demo");
-  if (entry.name === "writes" && existsSync11(legacy)) return legacy;
+  if (entry.name === "writes" && existsSync12(legacy)) return legacy;
   return resolve4(cwd, "behold-demos", entry.name);
 }
 async function loadDemo(entry, opts) {
   const { pkgRoot: pkgRoot2, target } = opts;
   const say = (line) => opts.log?.(`behold demo ${entry.name} \u2192 ${line}`);
-  if (!existsSync11(target)) {
+  if (!existsSync12(target)) {
     if (entry.source === "bundled") {
-      const bundled = join14(pkgRoot2, entry.dir);
-      if (!existsSync11(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
+      const bundled = join15(pkgRoot2, entry.dir);
+      if (!existsSync12(bundled)) return { ok: false, error: `this install has no bundled ${entry.dir}` };
       say(`copying to ${target} (it's yours \u2014 edit it)`);
       try {
         cpSync(bundled, target, {
@@ -6089,7 +6293,7 @@ async function loadDemo(entry, opts) {
   } else {
     say(`reusing ${target}`);
   }
-  if (existsSync11(join14(target, "package.json")) && !existsSync11(join14(target, "node_modules"))) {
+  if (existsSync12(join15(target, "package.json")) && !existsSync12(join15(target, "node_modules"))) {
     say("npm install\u2026");
     if (await runStep("npm", ["install"], { cwd: target, shell: process.platform === "win32" }) !== 0) {
       return { ok: false, error: `npm install failed in ${target}` };
@@ -6101,19 +6305,19 @@ async function loadDemo(entry, opts) {
       return { ok: false, error: `setup failed (${entry.setup})` };
     }
   }
-  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join14(target, d)) : [target] };
+  return { ok: true, serveDirs: entry.serve.dirs?.length ? entry.serve.dirs.map((d) => join15(target, d)) : [target] };
 }
 function runStep(cmd, args, opts = {}) {
   return new Promise((res) => {
-    const child = spawn4(cmd, args, { stdio: "inherit", cwd: opts.cwd, shell: opts.shell ?? false });
+    const child = spawn5(cmd, args, { stdio: "inherit", cwd: opts.cwd, shell: opts.shell ?? false });
     child.on("error", () => res(-1));
     child.on("close", (code) => res(code ?? 1));
   });
 }
 
 // src/server.ts
-var pkgRoot = join15(dirname4(fileURLToPath3(import.meta.url)), "..");
-var webRoot = join15(pkgRoot, "web");
+var pkgRoot = join16(dirname4(fileURLToPath3(import.meta.url)), "..");
+var webRoot = join16(pkgRoot, "web");
 var execFileP = async (cmd, args) => (await promisify3(execFile3)(cmd, args, { encoding: "utf8", timeout: 1e4 })).stdout;
 function optsFromQuery(url, tierEnvVar, projectDir) {
   const q = url.searchParams;
@@ -6163,7 +6367,7 @@ function tierFailure(tier, message) {
 function beholdVersion() {
   try {
     const here = dirname4(fileURLToPath3(import.meta.url));
-    return JSON.parse(readFileSync12(join15(here, "..", "package.json"), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync13(join16(here, "..", "package.json"), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -6208,7 +6412,7 @@ async function captureFrame(projectDir, env, frames, broadcaster) {
   }
 }
 function carveRoutes(app, reportPath, demo) {
-  const load = () => readCarveReport(reportPath, (p) => readFileSync12(p, "utf8"));
+  const load = () => readCarveReport(reportPath, (p) => readFileSync13(p, "utf8"));
   const demoBlock = () => carveWriteBlock(demo);
   const demoInfo = () => {
     if (!demo) return null;
@@ -6224,6 +6428,9 @@ function carveRoutes(app, reportPath, demo) {
       fromLabel: relative3(demo.root, demo.from).split(sep4).join("/"),
       runnable: !block,
       ...block ? { reason: block } : {},
+      // The live tier, when this boot armed it: the scratch endpoint the
+      // stepper names, and the fact the plan button exists at all.
+      ...demo.live ? { live: { endpoint: demo.live.endpoint, container: demo.live.container, applied: demo.live.applied } } : {},
       ...demo.degraded ? { degraded: demo.degraded } : {},
       buildCaveat: BUILD_CAVEAT
     };
@@ -6232,11 +6439,21 @@ function carveRoutes(app, reportPath, demo) {
     const parsed = load();
     return parsed.ok ? c.json(parsed.report) : c.json(parsed.refusal, 422);
   });
-  app.get("/api/graph", (c) => {
+  let appGraph;
+  const appGraphOnce = () => {
+    if (!demo) return Promise.resolve(null);
+    appGraph ??= graphIr(demo.project).then((ir) => ir.nodes.length ? { ir, label: relative3(demo.root, demo.project).split(sep4).join("/") } : null).catch(() => null);
+    return appGraph;
+  };
+  app.get("/api/graph", async (c) => {
     const parsed = load();
     if (!parsed.ok) return c.json(parsed.refusal, 422);
-    const ir = carveReportToIr(parsed.report);
-    const { svg } = renderBanded(ir);
+    const tfIr = carveReportToIr(parsed.report);
+    const appSide = await appGraphOnce();
+    const { svg, ir } = appSide ? renderCarveEstate(tfIr, appSide.ir, {
+      tfTitle: `${relative3(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      appTitle: `${appSide.label} \u2014 chant`
+    }) : { ...renderBanded(tfIr), ir: tfIr };
     return c.json({
       ir,
       svg,
@@ -6248,10 +6465,44 @@ function carveRoutes(app, reportPath, demo) {
         carve: true,
         // A demo whose own advisor run failed says so on the statusbar, not
         // only in the terminal the viewer isn't looking at.
-        note: carveNote(parsed.report, ir) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
+        note: carveNote(parsed.report, tfIr) + (demo?.degraded ? ` Degraded: ${demo.degraded}` : "")
       }
     });
   });
+  app.get("/carve/morph", async (c) => {
+    const parsed = load();
+    if (!parsed.ok) return c.json(parsed.refusal, 422);
+    const select = c.req.query("select") ?? "";
+    const ranked = (parsed.report.resources ?? []).some((r) => r.address === select);
+    if (!ranked) {
+      return c.json(
+        {
+          error: `"${select}" is not a ranked address in this report`,
+          code: "carve_bad_select",
+          remedy: "pass ?select=<address> naming a resource the report ranks \u2014 GET /api/carve lists them"
+        },
+        400
+      );
+    }
+    const appSide = await appGraphOnce();
+    if (!appSide) {
+      return c.json(
+        {
+          error: "the morph needs the demo estate's chant project, and this server isn't serving a demo copy",
+          code: "carve_no_demo",
+          remedy: "run `behold demo carve` \u2014 the bundled estate has the chant box the card moves into"
+        },
+        404
+      );
+    }
+    const tfIr = carveReportToIr(parsed.report);
+    const html = renderCarveMorph(tfIr, appSide.ir, [select], {
+      tfTitle: `${relative3(demo.root, demo.from).split(sep4).join("/")} \u2014 terraform`,
+      appTitle: `${appSide.label} \u2014 chant`,
+      title: `carve \u2014 ${select}`
+    });
+    return c.html(html);
+  });
   app.get("/api/project", (c) => {
     const parsed = load();
     return c.json({
@@ -6314,6 +6565,17 @@ function carveRoutes(app, reportPath, demo) {
   };
   app.post("/api/carve/emit", (c) => runStep2(c, runCarveEmit));
   app.post("/api/carve/bridge", (c) => runStep2(c, runCarveBridge));
+  app.post("/api/carve/plan", async (c) => {
+    const block = demoBlock();
+    if (block) {
+      return c.json({ error: block, code: "read-only", remedy: "The live plan runs inside a demo copy \u2014 `behold demo carve --live`." }, 403);
+    }
+    if (!(c.req.header("content-type") ?? "").includes("application/json")) {
+      return c.json({ error: "send application/json", code: "carve-action", remedy: "POST {} with content-type application/json" }, 415);
+    }
+    const result = await runCarvePlan(demo);
+    return result.ok ? c.json(result) : c.json(result.refusal, 422);
+  });
   app.get("/api/substrates", (c) => c.json({ substrates: [] }));
   app.get("/api/history", (c) => c.json({ commits: [] }));
   app.get("/api/resources", (c) => c.json({ byComponent: {} }));
@@ -6410,9 +6672,9 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     return c.json({ started: true, name, ran: label });
   });
   app.post("/api/local/reset", (c) => {
-    const down = join15(cfg.projectDir, "scripts/local/local-down.sh");
-    const up = join15(cfg.projectDir, "scripts/local/local-up.sh");
-    if (!existsSync12(down) || !existsSync12(up)) {
+    const down = join16(cfg.projectDir, "scripts/local/local-down.sh");
+    const up = join16(cfg.projectDir, "scripts/local/local-up.sh");
+    if (!existsSync13(down) || !existsSync13(up)) {
       return c.json({ error: "no local-down.sh / local-up.sh in scripts/local \u2014 reset is only for local emulator projects" }, 400);
     }
     if (!runner.bringUp("reset local emulator", "bash", ["-c", "bash scripts/local/local-down.sh && bash scripts/local/local-up.sh"], cfg.projectDir)) {
@@ -6490,8 +6752,8 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
     if (cfg.previewMode) return c.json({ error: "switching projects is locked in preview mode" }, 403);
     const body = await c.req.json().catch(() => ({}));
     const dir = typeof body.dir === "string" && body.dir.trim() ? resolve5(body.dir.trim()) : "";
-    if (!dir || !existsSync12(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
-    if (!existsSync12(join15(dir, "chant.config.ts"))) {
+    if (!dir || !existsSync13(dir)) return c.json({ error: `no such directory: ${dir || "(no dir given)"}` }, 400);
+    if (!existsSync13(join16(dir, "chant.config.ts"))) {
       return c.json({ error: `${dir} doesn't look like a chant project \u2014 no chant.config.ts` }, 400);
     }
     switchServedProject([dir]);
@@ -6535,7 +6797,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       fetches: fetchesFromNetwork(e),
       ...e.repo ? { repo: e.repo } : {},
       target,
-      loaded: existsSync12(target),
+      loaded: existsSync13(target),
       satisfiable: missing.length === 0,
       // #254: the carve walkthrough runs fine here — it just isn't a project
       // to switch INTO. Carve mode claims `/api/graph` and `/api/project` at
@@ -6579,7 +6841,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
       const loaded = await loadDemo(entry, { pkgRoot, target, log: (line) => process.stdout.write(line + "\n") });
       if (!loaded.ok) return c.json({ error: loaded.error }, 500);
       const dirs = loaded.serveDirs;
-      if (!existsSync12(join15(dirs[0], "chant.config.ts"))) {
+      if (!existsSync13(join16(dirs[0], "chant.config.ts"))) {
         return c.json({ error: `${entry.name} loaded to ${target} but ${dirs[0]} has no chant.config.ts` }, 500);
       }
       if (entry.serve.local) {
@@ -6785,7 +7047,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
           srcCompositeEdgesAttached = 0;
         }
       }
-      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync12(join15(cfg.projectDir, "chant.config.ts"))) {
+      if (!multi && !components && !logical && !opts.lens && ir.nodes.length === 0 && !existsSync13(join16(cfg.projectDir, "chant.config.ts"))) {
         return c.json(noProjectError(cfg.projectDir), 404);
       }
       const radial = new URL(c.req.url).searchParams.get("radial") === "1";
@@ -7125,7 +7387,7 @@ function createApp(cfg, broadcaster = new Broadcaster(), frames = new FrameBuffe
   });
   const rel = relative3(process.cwd(), webRoot) || ".";
   app.use("/*", serveStatic({ root: rel }));
-  app.get("/", serveStatic({ path: join15(rel, "index.html") }));
+  app.get("/", serveStatic({ path: join16(rel, "index.html") }));
   return app;
 }
 async function bootLocalEmulators(dir, who) {
@@ -7154,7 +7416,7 @@ async function bootLocalEmulators(dir, who) {
 async function startServer(cfg) {
   if (cfg.local) cfg.emulators = await bootLocalEmulators(cfg.projectDir, "behold serve --local");
   for (const dir of cfg.projectDirs ?? [cfg.projectDir]) {
-    if (existsSync12(join15(dir, "chant.config.ts"))) addRecent(dir);
+    if (existsSync13(join16(dir, "chant.config.ts"))) addRecent(dir);
   }
   const broadcaster = new Broadcaster();
   const frames = new FrameBuffer();
@@ -7165,10 +7427,10 @@ async function startServer(cfg) {
   });
   const app = createApp(cfg, broadcaster, frames, runner);
   const autoSync = cfg.autoSync ?? "off";
-  const capture = () => captureFrame(cfg.projectDir, cfg.env, frames, broadcaster);
+  const capture2 = () => captureFrame(cfg.projectDir, cfg.env, frames, broadcaster);
   const onEstateChange = () => {
     broadcaster.emit("changed");
-    void capture();
+    void capture2();
   };
   const onPollDrift = (movedLexicons) => {
     onEstateChange();
@@ -7215,18 +7477,24 @@ async function startServer(cfg) {
     };
     process.stdout.write(`  switched \u2192 ${dir}
 `);
-    void capture();
+    void capture2();
   };
-  if (!carve) void capture();
+  if (!carve) void capture2();
   let shuttingDown = false;
   const shutdown = () => {
     if (shuttingDown) return;
     shuttingDown = true;
     stopWatch();
     stopPoll();
-    const done = cfg.local && cfg.emulators && cfg.emulators.length ? emulatorDown(cfg.projectDir).catch((err) => process.stderr.write(`emulator down: ${err instanceof Error ? err.message : String(err)}
-`)) : Promise.resolve();
-    void done.finally(() => process.exit(0));
+    const downs = [];
+    if (cfg.local && cfg.emulators && cfg.emulators.length) {
+      downs.push(
+        emulatorDown(cfg.projectDir).catch((err) => process.stderr.write(`emulator down: ${err instanceof Error ? err.message : String(err)}
+`))
+      );
+    }
+    if (cfg.carveDemo?.live) downs.push(teardownScratchFloci().catch(() => void 0));
+    void Promise.all(downs).finally(() => process.exit(0));
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
@@ -7238,7 +7506,8 @@ async function startServer(cfg) {
   green = carve now, amber = boundary work, grey = leave in Terraform.
 ` + (cfg.carveDemo ? `  walkthrough: the panel's Carve tab \u2014 advise \u2192 pick \u2192 emit \u2192 bridge \u2192 handoff \u2192 done.
   Emit and bridge write only into ${cfg.carveDemo.out}; your Terraform is never edited.
-` + (cfg.carveDemo.degraded ? `  degraded: ${cfg.carveDemo.degraded}
+` + (cfg.carveDemo.live ? `  live: scratch Floci at ${cfg.carveDemo.live.endpoint} \u2014 deleted on Ctrl-C.
+` : "") + (cfg.carveDemo.degraded ? `  degraded: ${cfg.carveDemo.degraded}
 ` : "") : `  Read-only advisory: behold emits nothing and touches no Terraform. Ctrl-C to stop.
 `)
       );
@@ -7275,8 +7544,8 @@ async function startServer(cfg) {
 }
 
 // src/export.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, copyFileSync, readFileSync as readFileSync13, readdirSync as readdirSync5 } from "node:fs";
-import { join as join16, dirname as dirname5, basename } from "node:path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, copyFileSync, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "node:fs";
+import { join as join17, dirname as dirname5, basename } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var LENS_PARAMS = ["components", "detail", "env", "logical", "radial", "tier"];
 function canonicalKey(path, params) {
@@ -7324,7 +7593,7 @@ function captureKeys(axes) {
   return [...keys];
 }
 function webDir() {
-  return join16(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
+  return join17(dirname5(fileURLToPath4(import.meta.url)), "..", "web");
 }
 function workerName(project, override) {
   const raw = override ?? `behold-${basename(project)}`;
@@ -7335,7 +7604,7 @@ async function runExport(cfg, outDir, opts = {}) {
   const app = createApp({ ...cfg, layoutWrites: false });
   const proj = await (await app.request("/api/project")).json();
   const axes = { environments: proj.environments ?? [], tiers: proj.tiers ?? [] };
-  const snapDir = join16(outDir, "snapshots");
+  const snapDir = join17(outDir, "snapshots");
   mkdirSync4(snapDir, { recursive: true });
   const keyToFile = {};
   let ok = 0;
@@ -7344,7 +7613,7 @@ async function runExport(cfg, outDir, opts = {}) {
     const res = await app.request(`${key}${key.includes("?") ? "&" : "?"}layout=1`);
     const body = await res.text();
     const file = slug2(key);
-    writeFileSync3(join16(snapDir, file), body);
+    writeFileSync4(join17(snapDir, file), body);
     keyToFile[key] = `snapshots/${file}`;
     if (res.ok) ok++;
     else failed++;
@@ -7356,21 +7625,21 @@ async function runExport(cfg, outDir, opts = {}) {
     axes,
     keyToFile
   };
-  writeFileSync3(join16(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-  const html = readFileSync13(join16(webDir(), "index.html"), "utf8").replace(
+  writeFileSync4(join17(outDir, "manifest.json"), JSON.stringify(manifest, null, 2));
+  const html = readFileSync14(join17(webDir(), "index.html"), "utf8").replace(
     /<\/head>/i,
     `  <script>window.__BEHOLD_STATIC__ = true;</script>
   </head>`
   );
-  writeFileSync3(join16(outDir, "index.html"), html);
+  writeFileSync4(join17(outDir, "index.html"), html);
   for (const f of readdirSync5(webDir())) {
     if (f === "index.html") continue;
-    copyFileSync(join16(webDir(), f), join16(outDir, f));
+    copyFileSync(join17(webDir(), f), join17(outDir, f));
   }
-  writeFileSync3(join16(outDir, "README.md"), BUNDLE_README);
+  writeFileSync4(join17(outDir, "README.md"), BUNDLE_README);
   const name = workerName(cfg.projectDir, opts.name);
-  writeFileSync3(
-    join16(outDir, "wrangler.jsonc"),
+  writeFileSync4(
+    join17(outDir, "wrangler.jsonc"),
     JSON.stringify(
       { $schema: "node_modules/wrangler/config-schema.json", name, compatibility_date: "2025-06-01", assets: { directory: "." } },
       null,
@@ -7637,6 +7906,7 @@ var USAGE = `behold \u2014 a live control plane on chant (read-only core)
 
 Usage:
   behold demo [name] [target-dir] [--port <n>] [--list]
+  behold demo carve [--live] [--port <n>]
   behold doctor [project-dir] [--json]
   behold preview [project-dir] [--port <n>] [--emulator]
   behold export [project-dir] [--out <dir>] [--env <name>] [--name <worker>] [--emulator]
@@ -7669,7 +7939,10 @@ Usage:
           up on a throwaway k3d cluster instead. \`behold demo carve\` is the
           odd one out: no cluster, no Docker, no cloud \u2014 a half-migrated
           Terraform/chant estate plus the six-step carve walkthrough on the
-          panel's Carve tab. Needs Docker (and per-demo tools --list names).
+          panel's Carve tab. Its \`--live\` tier flips that: docker + terraform
+          on PATH, a scratch Floci booted and deleted on exit, the starred
+          resources REALLY applied, and a real \`terraform plan\` button at
+          Handoff. Needs Docker (and per-demo tools --list names).
           Loaded demos land in the panel's recents, so switching between them
           is the Scope tab \u2014 which lists this whole catalog too (#268), one
           click from any served project.
@@ -7836,7 +8109,7 @@ function warnIfNotChantProject(dir) {
   if (shape.kind === "estate") {
     process.stderr.write(
       `behold: warning \u2014 ${dir} is an estate root, not a chant project itself.
-        Serve its members composed: behold serve ${shape.members.map((m) => join17(dir, m)).join(" ")}
+        Serve its members composed: behold serve ${shape.members.map((m) => join18(dir, m)).join(" ")}
 `
     );
     return;
@@ -7872,7 +8145,7 @@ async function runCarve(rest) {
     process.exit(2);
   }
   const reportPath = resolve7(fileArg);
-  const parsed = readCarveReport(reportPath, (p) => readFileSync14(p, "utf8"));
+  const parsed = readCarveReport(reportPath, (p) => readFileSync15(p, "utf8"));
   if (!parsed.ok) {
     process.stderr.write(`behold carve: ${parsed.refusal.error}
   ${parsed.refusal.remedy}
@@ -7899,7 +8172,7 @@ async function runDoctor(rest) {
     }
   }
   const dir = dirArg ?? ".";
-  if (!existsSync13(resolve7(dir))) {
+  if (!existsSync14(resolve7(dir))) {
     process.stderr.write(`behold doctor: no such directory: ${resolve7(dir)}
 `);
     process.exit(2);
@@ -7909,14 +8182,16 @@ async function runDoctor(rest) {
   if (!report.ok) process.exitCode = 1;
 }
 async function runDemo(rest) {
-  const pkgRoot2 = join17(dirname6(fileURLToPath5(import.meta.url)), "..");
+  const pkgRoot2 = join18(dirname6(fileURLToPath5(import.meta.url)), "..");
   const registry = loadDemoRegistry(pkgRoot2);
   let port = 4600;
+  let live = false;
   let name;
   let dirArg;
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     if (a === "--port") port = Number(rest[++i]);
+    else if (a === "--live") live = true;
     else if (a === "--list") {
       if (!registry.length) {
         process.stdout.write("behold demo: no catalog in this install (demos.json missing)\n");
@@ -7969,9 +8244,14 @@ async function runDemo(rest) {
     process.exit(1);
   }
   if (entry.serve.carve) {
-    await serveCarveDemo(target, entry.serve.carve, port);
+    await serveCarveDemo(target, entry.serve.carve, port, live);
     return;
   }
+  if (live) {
+    process.stderr.write(`behold demo ${entry.name}: --live is the carve demo's tier \u2014 only \`behold demo carve --live\` takes it.
+`);
+    process.exit(2);
+  }
   process.stdout.write(`behold demo ${entry.name} \u2192 serving. Blue = declared; Deploy turns it green.
 `);
   const serveArgs = ["serve", ...loaded.serveDirs, "--port", String(port)];
@@ -7981,18 +8261,53 @@ async function runDemo(rest) {
 }
 function spawnStep(cmd, args, cwd) {
   return new Promise((res) => {
-    const child = spawn5(cmd, args, { stdio: "inherit", cwd, shell: process.platform === "win32" });
+    const child = spawn6(cmd, args, { stdio: "inherit", cwd, shell: process.platform === "win32" });
     child.on("error", () => res(-1));
     child.on("close", (code) => res(code ?? 1));
   });
 }
-async function serveCarveDemo(target, carve, port) {
+async function serveCarveDemo(target, carve, port, live = false) {
   const at = (rel) => resolve7(target, rel);
   const project = at(carve.project);
   const from = at(carve.from);
   const state = carve.state ? at(carve.state) : void 0;
   const committed = at(carve.report);
-  if (existsSync13(join17(project, "package.json")) && !existsSync13(join17(project, "node_modules"))) {
+  let liveInfo;
+  if (live) {
+    for (const bin of ["docker", "terraform"]) {
+      const probe2 = spawnSync2(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
+      if (probe2.status !== 0) {
+        process.stderr.write(`behold demo carve --live: needs ${bin} on PATH (the offline tier doesn't \u2014 drop --live).
+`);
+        process.exit(2);
+      }
+    }
+    process.stdout.write(`behold demo carve --live \u2192 scratch Floci (${LIVE_CONTAINER}, :${LIVE_PORT}, deleted on exit)\u2026
+`);
+    const bootErr = await bootScratchFloci();
+    if (bootErr) {
+      process.stderr.write(`behold demo carve --live: ${bootErr}
+`);
+      process.exit(1);
+    }
+    process.stdout.write("behold demo carve --live \u2192 terraform init + apply (the starred resources, into the scratch Floci)\u2026\n");
+    if (state) rmSync2(state, { force: true });
+    const applyErr = await applyIntoFloci(from, spawnStep);
+    if (applyErr) {
+      await teardownScratchFloci();
+      process.stderr.write(`behold demo carve --live: ${applyErr}
+`);
+      process.exit(1);
+    }
+    liveInfo = {
+      container: LIVE_CONTAINER,
+      port: LIVE_PORT,
+      endpoint: `http://localhost:${LIVE_PORT}`,
+      applied: LIVE_TARGETS
+    };
+    process.stdout.write("behold demo carve --live \u2192 the tfstate is real now; the advisor reads what terraform wrote.\n");
+  }
+  if (existsSync14(join18(project, "package.json")) && !existsSync14(join18(project, "node_modules"))) {
     process.stdout.write(`behold demo carve \u2192 npm install in ${carve.project}/ (the chant this walkthrough shells)\u2026
 `);
     const code = await spawnStep("npm", ["install"], project);
@@ -8003,7 +8318,7 @@ async function serveCarveDemo(target, carve, port) {
     }
   }
   let degraded;
-  if (!existsSync13(join17(target, "node_modules", "@cdktf", "hcl2json"))) {
+  if (!existsSync14(join18(target, "node_modules", "@cdktf", "hcl2json"))) {
     process.stdout.write("behold demo carve \u2192 npm install @cdktf/hcl2json (chant's HCL parser, ~2MB, once)\u2026\n");
     const code = await spawnStep("npm", ["install", "--no-save", "--no-package-lock", "@cdktf/hcl2json"], target);
     if (code !== 0) degraded = "couldn't install @cdktf/hcl2json (chant's HCL parser) \u2014 no network?";
@@ -8019,7 +8334,7 @@ async function serveCarveDemo(target, carve, port) {
     );
     if (code !== 0) degraded = `chant carve advise exited ${code}`;
   }
-  const serving = !degraded && existsSync13(report) ? report : committed;
+  const serving = !degraded && existsSync14(report) ? report : committed;
   if (degraded) {
     process.stderr.write(
       `behold demo carve: ${degraded}
@@ -8027,7 +8342,7 @@ async function serveCarveDemo(target, carve, port) {
 `
     );
   }
-  if (!existsSync13(serving)) {
+  if (!existsSync14(serving)) {
     process.stderr.write(`behold demo carve: no carve report at ${serving}
 `);
     process.exit(2);
@@ -8044,6 +8359,7 @@ async function serveCarveDemo(target, carve, port) {
       ...state ? { state } : {},
       project,
       out: at(carve.out),
+      ...liveInfo ? { live: liveInfo } : {},
       ...degraded ? { degraded: `${degraded} \u2014 showing the committed report shipped with the demo.` } : {}
     },
     port
@@ -8072,7 +8388,7 @@ async function runPreview(rest) {
     process.exit(2);
   }
   const projectDir = resolve7(dirArg ?? process.cwd());
-  if (!existsSync13(projectDir)) {
+  if (!existsSync14(projectDir)) {
     process.stderr.write(`behold preview: project not found at ${projectDir}
 `);
     process.exit(2);
@@ -8111,7 +8427,7 @@ async function runExportCmd(rest) {
     injectEmulatorEnv(env);
     env ??= "local";
   }
-  if (!existsSync13(projectDir)) {
+  if (!existsSync14(projectDir)) {
     process.stderr.write(`behold export: project not found at ${projectDir}
 `);
     process.exit(2);

package/example-carve/README.md

@@ -170,14 +170,21 @@ no AWS account and no network. The only dependency beyond this directory is
 `@cdktf/hcl2json`, which chant lazy-loads and names in its error if absent. This
 tier guarantees the first thirty seconds of the video.
 
-**`--live` is the full video.** Boot a scratch Floci, arm
-`legacy-tf/floci-override.tf.disabled` (see its header), and `terraform apply`
-the estate into it, so the state is one terraform really wrote. Then the observe
-beats become footage rather than caption: after Emit, `chant lifecycle diff
---live` reads the bucket out of Floci, clean, while Terraform still owns it; the
-handoff runs a real `terraform plan` showing no destroy; and behold's overlay
-flips the bucket green afterwards. The line it exists for is "Terraform forgot
-it, chant adopted it, and it never blinked."
+**`--live` is the full video.** `behold demo carve --live` boots a scratch
+Floci (`behold-carve-floci`, its own port, deleted on exit), arms
+`legacy-tf/floci-override.tf.disabled` (see its header) into the demo copy, and
+`terraform apply -target`s the starred resources into it — so the tfstate the
+advisor reads is one terraform really wrote. At Handoff the stepper gains a
+read-only **terraform plan** button: before `state rm` it shows a no-op, after
+it the carved bucket is simply gone from Terraform's world — `0 to destroy`.
+The line the tier exists for is "Terraform forgot it, chant adopted it, and it
+never blinked."
+
+One beat stays caption rather than footage for now: `chant lifecycle diff
+--live` reading the bucket clean while Terraform still owns it. chant's AWS
+observe is CFN-stack-scoped by logical id, so a Terraform-owned resource reads
+confirmed-missing regardless of its existence — chant#1647 tracks the
+physical-identity read path that unlocks it.
 
 The live tier needs `docker` and `terraform` on PATH, boots its own throwaway
 Floci and deletes it after, and never touches an existing `floci*` container.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -37,7 +37,7 @@
     "@hono/node-server": "^2.0.5",
     "@intentius/chant": "^0.38.0",
     "@intentius/chant-k8s-client": "^0.44.5",
-    "@intentius/pinhole": "^0.3.3",
+    "@intentius/pinhole": "^0.3.4",
     "hono": "^4.12.34"
   },
   "devDependencies": {

package/web/app.js

@@ -1233,6 +1233,32 @@ const carveActions = {
   },
   runEmit: () => runCarveStep("emit"),
   runBridge: () => runCarveStep("bridge"),
+  async runPlan() {
+    if (carveState.busy) return;
+    carveState.busy = "plan";
+    carveState.error = null;
+    renderPanelCarve();
+    try {
+      const res = await fetch("/api/carve/plan", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      });
+      const body = await res.json().catch(() => ({ error: "plan returned an unreadable body", remedy: "" }));
+      if (!res.ok || body.error) {
+        carveState.error = { step: "handoff", ...body };
+        showToast(`✗ terraform plan: ${body.error || res.status}`, false);
+      } else {
+        carveState.plan = body;
+        showToast(body.noDestroy ? "✓ plan: nothing to destroy" : "✗ plan wants to destroy something", body.noDestroy);
+      }
+    } catch (err) {
+      carveState.error = { step: "handoff", error: String((err && err.message) || err), remedy: "Is the behold server still running?" };
+    } finally {
+      carveState.busy = null;
+      renderPanelCarve();
+    }
+  },
   copy(text, el) {
     const done = () => {
       el.dataset.copied = "1";

package/web/carve-steps.js

@@ -63,7 +63,10 @@ export function initialCarveState() {
     bridge: null,
     /** Set when the user says they ran the handoff commands. */
     handoff: false,
-    /** Which step is mid-run ("emit" | "bridge" | null) — the dial's progress. */
+    /** POST /api/carve/plan's answer (live tier only). Estate-wide, so a new
+     * pick keeps it — the plan is about the armed Terraform, not the pick. */
+    plan: null,
+    /** Which step is mid-run ("emit" | "bridge" | "plan" | null). */
     busy: null,
     /** The last structured refusal, keyed by step id. */
     error: null,
@@ -378,7 +381,7 @@ export function renderCarvePanel(host, state, ctx, actions) {
     pick: () => renderPick(body, state, ctx, actions),
     emit: () => renderEmit(body, state, ctx, actions),
     bridge: () => renderBridge(body, state, ctx, actions),
-    handoff: () => renderHandoff(body, state, actions),
+    handoff: () => renderHandoff(body, state, ctx, actions),
     done: () => renderDone(body, state, ctx, actions),
   };
   renderers[step.id]();
@@ -426,6 +429,17 @@ function renderAdvise(body, ctx) {
         `Terraform read from ${ctx.demo.fromLabel}/ in your demo copy. Emit and bridge write only into ${ctx.demo.outLabel}/.`,
       ),
     );
+    if (ctx.demo.live) {
+      body.appendChild(
+        el(
+          "p",
+          "panel-muted carve-live-note",
+          `Live tier: the starred resources are REALLY applied into a scratch Floci (${ctx.demo.live.endpoint}, ` +
+            "deleted when this server exits) and the tfstate the advisor read was written by terraform, not shipped. " +
+            "The observe beat — chant reading the bucket live while Terraform still owns it — waits on chant#1647.",
+        ),
+      );
+    }
   }
 }
 
@@ -544,12 +558,38 @@ function renderBridge(body, state, ctx, actions) {
   for (const a of b.proposals || []) body.appendChild(artifactBlock(a, actions));
 }
 
-function renderHandoff(body, state, actions) {
+function renderHandoff(body, state, ctx, actions) {
   const runbook = state.bridge && state.bridge.runbook;
   if (!runbook) {
     body.appendChild(el("p", "panel-muted", blockedReason(state, "handoff") || "no runbook yet"));
     return;
   }
+
+  // The live tier's read-only beat (#254): a REAL `terraform plan`. Before the
+  // operator pastes `state rm` it shows a no-op; after, the carved resource is
+  // simply absent from Terraform's world — not destroyed. That verdict line is
+  // the reason the tier exists.
+  if (ctx.demo && ctx.demo.live) {
+    const planBtn = el("button", "act carve-plan", state.busy === "plan" ? "planning…" : "▶ terraform plan (read-only)");
+    planBtn.disabled = !!state.busy;
+    planBtn.title = "Runs terraform plan in the demo copy against the scratch Floci. Reads everything, changes nothing.";
+    planBtn.addEventListener("click", actions.runPlan);
+    body.appendChild(planBtn);
+    if (state.plan) {
+      const verdict = el("div", "carve-plan-verdict");
+      verdict.appendChild(el("code", null, state.plan.planLine));
+      verdict.appendChild(
+        el(
+          "p",
+          "panel-muted",
+          state.plan.noDestroy
+            ? "0 to destroy — the resource never blinked."
+            : "The plan wants to destroy something. Stop and read it before touching the estate.",
+        ),
+      );
+      body.appendChild(verdict);
+    }
+  }
   // The one place the walkthrough refuses to be a button, stated out loud.
   const why = el("div", "carve-refusal carve-human");
   why.appendChild(el("div", "carve-refusal-title", "These two are not buttons, on purpose."));
@@ -605,13 +645,20 @@ function renderDone(body, state, ctx, actions) {
   if (!state.handoff) {
     body.appendChild(el("p", "panel-muted", "The handoff commands haven't been marked as run — this is the shape of the ending, not a claim about your estate."));
   }
+  if (state.pick) {
+    const watch = el("a", "act carve-morph-link", "▶ watch it move");
+    watch.href = "/carve/morph?select=" + encodeURIComponent(state.pick.node.id);
+    watch.target = "_blank";
+    watch.rel = "noopener";
+    watch.title = "The estate frame, morphing: the card slides out of the Terraform box and into the chant project box beside last month's carves.";
+    body.appendChild(watch);
+  }
   body.appendChild(
     el(
       "p",
       "panel-muted carve-honesty",
-      "Deferred to the follow-up: the card doesn't yet SLIDE out of the Terraform box and into the chant project " +
-        "beside last month's carves — it is marked in place. The Floci `--live` tier (a real terraform apply, a real " +
-        "plan showing no destroy) is the other half of that follow-up.",
+      "Deferred to the follow-up: the Floci `--live` tier — a real terraform apply into a scratch emulator, " +
+        "a real plan showing no destroy.",
     ),
   );
   const again = el("button", "act", "↺ start over");