@intentius/chant 0.124.24 → 0.124.26

package/src/cli/compiled-cli.e2e.test.ts

@@ -7,7 +7,9 @@
  * Each run is traced through a load hook that NODE_OPTIONS hands to the CLI's
  * node, so the test can say what loaded: none of chant's TypeScript source,
  * ever, and tsx only for a command that imports TypeScript (here the
- * lexicon and the project source).
+ * lexicon and the project source). tsx's ESM hooks run on a thread of their
+ * own, about 200 MB of the process (#3276), so a workspace read must not
+ * register it either.
  *
  * End to end because it packs, installs from the registry and spawns the CLI.
  */
@@ -20,12 +22,14 @@ import { afterAll, beforeAll, describe, expect, test } from "vitest";
 
 const coreRoot = resolve(import.meta.dirname, "..", "..");
 const renderRoot = resolve(coreRoot, "..", "..", "lexicons", "render");
+const referenceDecisions = resolve(coreRoot, "..", "..", "reference-workspace", "decisions");
 const version = (JSON.parse(readFileSync(join(coreRoot, "package.json"), "utf-8")) as { version: string }).version;
 
 let scratch: string;
 let project: string;
 let cjsProject: string;
 let waves: string;
+let workspace: string;
 let chant: string;
 let tracer: string;
 
@@ -126,6 +130,31 @@ beforeAll(() => {
   writeFileSync(join(waves, ".gitignore"), ".chant/\n");
   git("add", "-A");
   git("commit", "-qm", "ignore");
+
+  // A workspace whose declaration names a .mjs record kind, with a member
+  // that has a chant.config.ts, for the workspace reads below (#3276).
+  workspace = join(scratch, "workspace");
+  mkdirSync(join(workspace, "decisions"), { recursive: true });
+  mkdirSync(join(workspace, "app"));
+  for (const file of ["decision.kind.mjs", "decision.schema.json", "ref-001-how-the-app-is-deployed.md"]) {
+    writeFileSync(join(workspace, "decisions", file), readFileSync(join(referenceDecisions, file)));
+  }
+  writeFileSync(
+    join(workspace, "chant.workspace.json"),
+    JSON.stringify({
+      name: "e2e",
+      schema: 1,
+      members: [{ name: "app", dir: "app", kind: "chant" }],
+      records: [{ kind: "decisions/decision.kind.mjs" }],
+    }),
+  );
+  writeFileSync(join(workspace, "app", "chant.config.ts"), `export default { lexicons: [] as string[] };\n`);
+  symlinkSync(join(project, "node_modules"), join(workspace, "node_modules"), "dir");
+  const wsGit = (...args: string[]) => execFileSync("git", ["-c", "user.email=e2e@chant", "-c", "user.name=e2e", ...args], { cwd: workspace, stdio: "ignore" });
+  wsGit("init", "-q", "-b", "main");
+  writeFileSync(join(workspace, ".gitignore"), "node_modules\n");
+  wsGit("add", "-A");
+  wsGit("commit", "-qm", "workspace");
 }, 600_000);
 
 afterAll(() => {
@@ -148,6 +177,21 @@ describe("the installed chant CLI (#3878)", () => {
     expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0 });
   });
 
+  test("workspace ls reads a .mjs record kind from a member with a chant.config.ts without loading tsx", () => {
+    const r = run(join(workspace, "app"), ["workspace", "ls", "--json"]);
+    expect(r.status, r.stderr).toBe(0);
+    const ls = JSON.parse(r.stdout) as { workspace: { records: Array<{ name: string; kind: string | null }> } };
+    expect(ls.workspace.records.map((k) => k.kind)).toEqual(["decision"]);
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0 });
+  });
+
+  test("workspace records reads the declared .mjs kind's records without loading tsx", () => {
+    const r = run(join(workspace, "app"), ["workspace", "records", "--json"]);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout).toContain("ref-001");
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0 });
+  });
+
   test("build loads the TypeScript lexicon and project through tsx, against the one compiled core", () => {
     const r = run(project, ["build", "src", "-o", "out/render.json"]);
     expect(r.status, r.stderr).toBe(0);

package/src/cli/handlers/approve.ts

@@ -5,6 +5,7 @@
  * re-exports everything here.
  */
 import { discoverOps } from "../../op/discover";
+import { aliasingGate } from "../../op/gate-alias";
 import type { GateResolutionRecord, PendingGateRecord } from "../../lifecycle/gate-ledger";
 import {
   currentGateOrigin, isModelAuthored, sameOriginRefusal, UNATTESTED_APPROVER, type GateOrigin,
@@ -280,7 +281,9 @@ export async function recordGateApproval(
   // `fan-out` is the op name every `chant components fan-out` gate is recorded
   // under (../handlers/fan-out.ts). It is a command rather than a declaration,
   // so there is no `*.op.ts` to find and nothing is wrong when none is there.
-  if (!ops.has(opName) && opName !== FAN_OUT_GATE_OP && opName !== WORKSPACE_UPGRADE_GATE_OP && opName !== OVERRIDE_GATE_OP) {
+  // #3949: a gate that lists this one as an alias, after an Op was restructured.
+  const successor = aliasingGate([...ops.values()].map((o) => o.config), opName, gate);
+  if (!successor && !ops.has(opName) && opName !== FAN_OUT_GATE_OP && opName !== WORKSPACE_UPGRADE_GATE_OP && opName !== OVERRIDE_GATE_OP) {
     console.error(formatWarning({
       message: `Op "${opName}" was not found among discovered *.op.ts declarations — recording the resolution anyway`,
     }));
@@ -301,6 +304,26 @@ export async function recordGateApproval(
     return { ok: false };
   }
 
+  // #3949: an approval under an alias counts toward the new gate only while
+  // the new gate has no standing fact of its own. Once it has one, approve
+  // the gate the runs now stop at.
+  if (successor) {
+    const theirs = latestPendingGate((await readGateLedger(successor.op)).pending, successor.gate);
+    if (theirs && !isPendingGateExpired(theirs, new Date().toISOString())) {
+      console.error(formatError({
+        message:
+          `Gate "${gate}" on "${opName}" is now gate "${successor.gate}" on "${successor.op}", which lists it as an alias, ` +
+          `and "${successor.gate}" has a standing pending fact`,
+        hint: `Approve that gate instead: chant approve ${successor.op} ${successor.gate}`,
+      }));
+      return { ok: false };
+    }
+    console.error(formatInfo(
+      `Gate "${gate}" on "${opName}" is an alias of gate "${successor.gate}" on "${successor.op}": ` +
+        `the next run of ${successor.op} counts this approval there while the pending fact it answers stands and the plan is the same.`,
+    ));
+  }
+
   // #2028: the resolution's link is typed. `--url` wins; otherwise, running
   // inside the PR/MR job that carries the change is itself the address, the
   // same env fallback `--actor` uses. `--note` stays free-text prose.
@@ -358,6 +381,14 @@ export async function recordGateApproval(
     }
     planDigest = standing.planDigest;
   }
+  // #3947: a gate that resumes recorded a checkpoint with its pending fact.
+  // An approval of that fact's plan copies the checkpoint's digest, the way it
+  // copies the plan's, so the run that resumes checks the file against what
+  // was approved here. An approval of another plan copies none.
+  const checkpointDigest =
+    standing?.checkpointDigest !== undefined && samePlanDigest(planDigest, standing.planDigest)
+      ? standing.checkpointDigest
+      : undefined;
 
   // chant#2384 — the gate's whole value is that its two halves have different
   // authors. At a shell they do: a person runs, reads the plan, and approves.
@@ -457,11 +488,11 @@ export async function recordGateApproval(
   const timestamp = new Date().toISOString();
   let seal: GateResolutionRecord["seal"];
   if (opts.sign !== undefined) {
-    const { resolveSigningKey, sealGateApproval, SealError } = await import("../../workspace/trust/seal");
+    const { resolveSigningKey, sealGateApproval, gateSealVersion, SealError } = await import("../../workspace/trust/seal");
     try {
       const key = resolveSigningKey(opts.sign, cwd);
       try {
-        seal = sealGateApproval(key.file, {
+        const sealed = {
           op: opName,
           gate,
           ...(environment !== undefined ? { environment } : {}),
@@ -469,7 +500,10 @@ export async function recordGateApproval(
           resolvedBy,
           ...(relayedBy ? { relayedBy } : {}),
           timestamp,
-        });
+          ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
+        };
+        // #3947: a seal over a checkpoint digest is seal version 2.
+        seal = { ...sealGateApproval(key.file, sealed), ...(gateSealVersion(sealed) === 2 ? { version: 2 as const } : {}) };
       } finally {
         key.cleanup();
       }
@@ -488,6 +522,7 @@ export async function recordGateApproval(
       resolvedBy,
       ...(relayedBy ? { relayedBy } : {}),
       timestamp,
+      ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
       seal,
     });
     if (why !== null) {
@@ -550,6 +585,7 @@ export async function recordGateApproval(
     ...(opts.note ? { note: opts.note } : {}),
     ...(url ? { url } : {}),
     ...(planDigest !== undefined ? { planDigest } : {}),
+    ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
     ...(environment !== undefined ? { environment } : {}),
     origin,
     ...(refusal && opts.allowSameOrigin ? { sameOriginOverride: true } : {}),
@@ -574,6 +610,12 @@ export async function recordGateApproval(
         ", and only that plan. A run whose fresh plan differs refuses rather than applying it.",
     ));
   }
+  if (record.checkpointDigest) {
+    console.error(formatInfo(
+      `The next run resumes at this gate from run ${standing?.runId ?? "(unknown)"}'s checkpoint ${record.checkpointDigest}, ` +
+        "after it plans again. A moved plan or another commit starts it at the first phase.",
+    ));
+  }
   if (approval) {
     for (const line of describeApprovalProgress(approval, record, ledger.resolutions, standingForOrigin, ledger.pending)) {
       console.error(formatInfo(line));

package/src/cli/handlers/operator.test.ts

@@ -929,6 +929,97 @@ describe("runApprove — the resolution names the plan it approves (#2300)", ()
   });
 });
 
+/** #3947 — a gate that resumes recorded a checkpoint, and its approval copies the digest. */
+describe("runApprove — the approval copies the checkpoint a resumed run carries on from (#3947)", () => {
+  const CHECKPOINT = `jcs1-sha256:${"c".repeat(64)}`;
+  const seedCheckpoint = () =>
+    readGateLedgerMock.mockResolvedValue({
+      resolutions: [],
+      pending: [{
+        version: 1, kind: "pending", op: "fountain-apply", gate: "rollout-gate", runId: "local-1",
+        timestamp: "2026-01-01T00:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z",
+        planDigest: PLAN_A, checkpointDigest: CHECKPOINT,
+      }],
+      malformed: 0,
+    });
+
+  test("approving the standing fact copies its checkpoint digest and says the next run resumes", async () => {
+    seedCheckpoint();
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: {
+        version: 1, op: "fountain-apply", gate: "rollout-gate", resolvedBy: "alex",
+        timestamp: "2026-01-01T00:00:00.000Z", planDigest: PLAN_A, checkpointDigest: CHECKPOINT,
+      },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "alex" }))).toBe(0);
+    expect(appendGateResolutionMock).toHaveBeenCalledWith(expect.objectContaining({ planDigest: PLAN_A, checkpointDigest: CHECKPOINT }));
+    expect(errSpy.mock.calls.map((c) => String(c[0])).join("\n")).toContain(`resumes at this gate from run local-1's checkpoint ${CHECKPOINT}`);
+    errSpy.mockRestore();
+  });
+
+  test("an approval of another plan copies no checkpoint", async () => {
+    seedCheckpoint();
+    const other = `sha256:${"b".repeat(64)}`;
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: { version: 1, op: "fountain-apply", gate: "rollout-gate", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z", planDigest: other },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "alex", plan: other }))).toBe(0);
+    expect(appendGateResolutionMock.mock.calls[0][0]).not.toHaveProperty("checkpointDigest");
+    errSpy.mockRestore();
+  });
+});
+
+/** #3949 — once a gate that aliases this one has a standing fact, approve that gate. */
+describe("runApprove — an approval under a gate's alias (#3949)", () => {
+  const merged = {
+    config: {
+      name: "upgrade",
+      overview: "upgrade every tier",
+      phases: [{ name: "Wave 1", steps: [{ kind: "gate", gate: "approve-tier-1", plan: PLAN_A, aliases: [{ op: "upgrade-tier-1", gate: "approve" }] }] }],
+    },
+  };
+  const fact = (op: string, gate: string) => ({
+    version: 1, kind: "pending", op, gate, timestamp: "2026-01-01T00:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z", planDigest: PLAN_A,
+  });
+  const ledgers = (byOp: Record<string, unknown[]>) =>
+    readGateLedgerMock.mockImplementation(async (op: string) => ({ resolutions: [], pending: byOp[op] ?? [], malformed: 0 }));
+
+  test("refuses and names the new gate once it has a standing pending fact", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([["upgrade", merged]]), errors: [] });
+    ledgers({ "upgrade-tier-1": [fact("upgrade-tier-1", "approve")], upgrade: [fact("upgrade", "approve-tier-1")] });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "upgrade-tier-1", extraPositional: "approve", actor: "alex" }))).toBe(1);
+    const out = errSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(out).toContain('is now gate "approve-tier-1" on "upgrade"');
+    expect(out).toContain("chant approve upgrade approve-tier-1");
+    expect(out).not.toContain("was not found among discovered");
+    expect(appendGateResolutionMock).not.toHaveBeenCalled();
+    errSpy.mockRestore();
+  });
+
+  test("records the approval while the new gate has none, and says where it counts", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([["upgrade", merged]]), errors: [] });
+    ledgers({ "upgrade-tier-1": [fact("upgrade-tier-1", "approve")] });
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: { version: 1, op: "upgrade-tier-1", gate: "approve", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z", planDigest: PLAN_A },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "upgrade-tier-1", extraPositional: "approve", actor: "alex" }))).toBe(0);
+    expect(appendGateResolutionMock).toHaveBeenCalledWith(expect.objectContaining({ op: "upgrade-tier-1", gate: "approve", planDigest: PLAN_A }));
+    expect(errSpy.mock.calls.map((c) => String(c[0])).join("\n")).toContain('is an alias of gate "approve-tier-1" on "upgrade"');
+    errSpy.mockRestore();
+  });
+});
+
 /**
  * #2574 — a component's gate ledger holds every environment's pending facts.
  * The approval records the environment it answers, and `--env` picks it.

package/src/cli/main.test.ts

@@ -1003,3 +1003,13 @@ describe("chant workspace check --generated (#2641)", () => {
     expect(() => parseArgs(["workspace", "check", "--generated=yes"])).toThrow();
   });
 });
+
+describe("chant --help", () => {
+  test("lists every top-level command in the registry", () => {
+    const source = readFileSync(join(import.meta.dirname, "main.ts"), "utf-8");
+    const help = source.slice(source.indexOf("function printHelp("), source.indexOf("Options:", source.indexOf("function printHelp(")));
+    const listed = new Set([...help.matchAll(/^ {2}([a-z][a-z-]*)\b/gm)].map((m) => m[1]));
+    const commands = new Set(commandRegistry.map((def) => def.name.split(" ")[0]));
+    expect([...commands].filter((name) => !listed.has(name))).toEqual([]);
+  });
+});

package/src/cli/main.ts

@@ -167,7 +167,12 @@ Commands:
                         okf emits an OKF v0.2 knowledge bundle — one markdown
                         concept per entity + index.md; -o <dir> writes the
                         bundle tree, otherwise JSON path→content on stdout)
-  generate              Generate typed code from sources chant.config declares
+  search "<query>"      Answer an estate question with a few matching rows
+                        instead of a graph dump (kind:, tag:, attr:, ->/<- edge
+                        terms; --live or --at <ref> with --env <name> reads the
+                        estate or a recorded snapshot; --show <attr>,
+                        --check-live, --check-snapshot, --fail-on-drift)
+  generate             Generate typed code from sources chant.config declares
                         (k8s.crds, helm.charts) into src/generated/<lexicon>/
                         (codegen.outDir); --check exits 1 when the committed
                         output no longer matches its sources, as build does
@@ -402,9 +407,11 @@ Workspace (level 1, #2524):
                         state transitions, new verdicts, new supersessions
                         and changed pins. A session id compares the commits
                         the session opened and closed at
-  workspace records pin <path>
+  workspace records pin <path> [--kind <kind file>]
                         Print the path from the workspace root and the
-                        sha256 of a file, for a decision's evidence pin
+                        sha256 of a file, for a decision's evidence pin. The
+                        root is the kind file's workspace with --kind, else
+                        the workspace above the current directory
   workspace records new [<kind file>] --from <file|-> [--prefix <prefix>] [--sign [<key file>]] [--dry-run]
                         Write one new record in the kind's directory from
                         the JSON fields given, after validating them as
@@ -559,6 +566,11 @@ Workspace (level 1, #2524):
   workspace points retract <id> --by <name>... [--note <text>] [--kind <kind file>] [--dry-run]
                         Take an answer back: the question is open for people
                         again, and the answer stays in its retractions
+  workspace points withdraw <id> --by <name>... [--note <text>] [--kind <kind file>] [--dry-run]
+                        Close an open question that no longer applies, such as
+                        one about a work item its author changed: points --open
+                        leaves it out, nobody answers it, and asking it again
+                        opens it again (#2888)
   workspace pin <path> [--json]
                         Print the integrity value that pins the plugin at
                         <path>, to put in a path pin of chant.workspace.json.
@@ -1226,16 +1238,18 @@ export const commandRegistry: CommandDef[] = [
 
   // Workspace reads (#2524). Imported on first use, so a level-0 command never
   // loads anything under workspace/ (#2525 rule 5, pinned by #2526's goldens).
-  { name: "workspace records", handler: async (ctx) => (await import("../workspace/records-cli")).runWorkspaceRecords(ctx) },
+  // #3276 — records, points, ls and status read the declaration and never the
+  // config of the member they run in, so they skip its load (and tsx with it).
+  { name: "workspace records", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/records-cli")).runWorkspaceRecords(ctx) },
   // ws-058 (#2739) — decision points and the questions asked of them; never calls a model.
-  { name: "workspace points", handler: async (ctx) => (await import("../workspace/points-cli")).runWorkspacePoints(ctx) },
+  { name: "workspace points", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/points-cli")).runWorkspacePoints(ctx) },
   { name: "workspace init", handler: async (ctx) => (await import("../workspace/init")).runWorkspaceInit(ctx) },
-  { name: "workspace ls", handler: async (ctx) => (await import("../workspace/ls")).runWorkspaceLs(ctx) },
+  { name: "workspace ls", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ls")).runWorkspaceLs(ctx) },
   // #2732 — the work lease: claim, renew and release a work item.
   { name: "workspace work", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/work-cli")).runWorkspaceWork(ctx) },
   // #3033 — the agent run record: what each run cost and which commits it made. chant records runs and never starts one.
   { name: "workspace runs", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/runs-cli")).runWorkspaceRuns(ctx) },
-  { name: "workspace status", handler: async (ctx) => (await import("../workspace/status")).runWorkspaceStatus(ctx) },
+  { name: "workspace status", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/status")).runWorkspaceStatus(ctx) },
   { name: "workspace lineage", handler: async (ctx) => (await import("../workspace/lineage-cli")).runWorkspaceLineage(ctx) },
   { name: "workspace upgrade", handler: async (ctx) => (await import("../workspace/lineage-upgrade-cli")).runWorkspaceUpgrade(ctx) },
   // #2551 — adopt a lineage, the hash index it matches against, and the versions of a family of workspaces.

package/src/cli/mcp/workspace-tools.e2e.test.ts

@@ -85,7 +85,7 @@ describe("which servers have the workspace tools", () => {
       const { tools } = (await rpc(server(cwd), "tools/list")) as { tools: { name: string }[] };
       expect(tools.map((t) => t.name)).toEqual(expect.arrayContaining(names));
     }
-    expect(names).toEqual(["workspace-ls", "workspace-status", "workspace-graph", "workspace-changes", "workspace-records", "workspace-points", "workspace-agent", "workspace-work-history", "workspace-runs", "records-new", "records-amend", "records-review", "records-close", "points-answer", "points-retract"]);
+    expect(names).toEqual(["workspace-ls", "workspace-status", "workspace-graph", "workspace-changes", "workspace-records", "workspace-points", "workspace-agent", "workspace-work-history", "workspace-runs", "records-new", "records-amend", "records-review", "records-close", "points-answer", "points-retract", "points-withdraw"]);
   });
 
   test("a server outside any workspace, or given none, does not", async () => {

package/src/cli/mcp/workspace-tools.ts

@@ -15,9 +15,9 @@
  *   read to the workspace root's pinned chant included (ws-021), and keeps
  *   anything a command prints away from the protocol on stdout.
  * - The writes (`records-new`, `records-amend`, `records-review`,
- *   `records-close`, `points-answer`, `points-retract`) call the functions
- *   `chant workspace records new|amend|review|close` and `points
- *   answer|retract` call, and return the
+ *   `records-close`, `points-answer`, `points-retract`, `points-withdraw`)
+ *   call the functions `chant workspace records new|amend|review|close` and
+ *   `points answer|retract|withdraw` call, and return the
  *   same JSON result. They keep every rule
  *   the CLI keeps: the kind's schema, a closed record never changing, an
  *   approved one changing only as its approval rule allows, a dissent needing
@@ -165,7 +165,7 @@ export const workspaceReadTools: ToolDefinition[] = [
   {
     name: "workspace-points",
     description:
-      "The workspace's decision points and the questions asked of them: chant workspace points --json (points.schema.json, ws-058). A question is open while it is escalated to people, or proposed by a model and not yet confirmed; each lists any model's answer with its confidence and threshold. Returns the document unchanged. chant calls no model to answer this.",
+      "The workspace's decision points and the questions asked of them: chant workspace points --json (points.schema.json, ws-058). A question is open while it is escalated to people, or proposed by a model and not yet confirmed, and not withdrawn; each lists any model's answer with its confidence and threshold. Returns the document unchanged. chant calls no model to answer this.",
     inputSchema: {
       type: "object",
       properties: {
@@ -326,6 +326,23 @@ export const workspaceWriteTools: ToolDefinition[] = [
       required: ["id", "by"],
     },
   },
+  {
+    name: "points-withdraw",
+    description:
+      "Close an open decision point question that no longer applies, such as one about a work item its author changed, which a run asks about anew: chant workspace points withdraw (#2888). The question keeps its state, with who withdrew it, when and why; workspace-points open leaves it out, and points-answer refuses it. Asking it again opens it again. Withdrawing answers nothing, so it needs no quorum. An answered question is not withdrawn: points-retract takes the answer back. " +
+      PROTOCOL,
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The question's id, as workspace-points lists it." },
+        by: { type: "array", items: { type: "string" }, description: "Who withdraws the question (--by)." },
+        note: { type: "string", description: "Why, such as the question that asks about the subject now (--note)." },
+        kind: { type: "string", description: "The answer kind file. Without it, the declared answer kinds." },
+        dryRun: dryRunProp,
+      },
+      required: ["id", "by"],
+    },
+  },
 ];
 
 /** A tool call that can't be made as given: the client gets it as an error result, and nothing runs. */
@@ -581,6 +598,12 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
       if (!Array.isArray(by) || by.length === 0 || !by.every((b) => typeof b === "string" && b.trim() !== "")) throw new ToolInputError("by must list each person who takes the answer back");
       return retractAnswer({ cwd, id: str(params, "id", true)!, by: by as string[], note: str(params, "note"), kind: str(params, "kind"), dryRun: bool(params, "dryRun") });
     },
+    "points-withdraw": async (params) => {
+      const { withdrawQuestion } = await import("../../workspace/decide");
+      const by = params.by;
+      if (!Array.isArray(by) || by.length === 0 || !by.every((b) => typeof b === "string" && b.trim() !== "")) throw new ToolInputError("by must name who withdraws the question");
+      return withdrawQuestion({ cwd, id: str(params, "id", true)!, by: by as string[], note: str(params, "note"), kind: str(params, "kind"), dryRun: bool(params, "dryRun") });
+    },
     "records-close": async (params) => {
       const w = await write();
       const { closeRecord, RECORDS_CLOSE_SCHEMA_ID } = await import("../../workspace/records-close");

package/src/effect-receipt.ts

@@ -66,6 +66,28 @@ export const EFFECT_RECEIPT_ENTITY_TYPE = "Chant::EffectReceipt";
  */
 export const EXISTENCE_EXPECTATION = "chant.effect-receipt:exists";
 
+const OUTPUTS_SEPARATOR = "+outputs=";
+
+/**
+ * A receipt expectation with the digest of the step outputs its effect read
+ * appended (#3948). The effect step writes this value, so the next run fires
+ * again when one of those outputs changed, though the declared inputs did not.
+ */
+export function withStepOutputs(expectation: string, outputs: string): string {
+  return `${expectation}${OUTPUTS_SEPARATOR}${outputs}`;
+}
+
+/**
+ * The part of a stored receipt value that the declared inputs determine: the
+ * value without any step-output digest {@link withStepOutputs} appended. The
+ * plan and `receiptStaleness` compare this part, since step outputs exist only
+ * while the Op runs.
+ */
+export function declaredExpectation(value: string): string {
+  const at = value.indexOf(OUTPUTS_SEPARATOR);
+  return at < 0 ? value : value.slice(0, at);
+}
+
 /**
  * An effect receipt declaration — a Declarable, so discovery collects it,
  * `chant list` shows it, and (unlike a secret declaration) serialization

package/src/gate-decision.ts

@@ -72,6 +72,8 @@ export {
   GATE_SEAL_NAMESPACE,
   gateSealPayload,
   gateSealRefusal,
+  gateSealVersion,
+  sealedFieldsOf,
   sshKeyFingerprint,
   verifySshSignatureWith,
   type GateSigners,

package/src/lexicon-module.ts

@@ -176,12 +176,19 @@ export function resetLexiconModules(): void {
  * Import the module a path-declared lexicon names. Returns `undefined` when
  * `name` is package-backed, so a caller falls through to its package import.
  * An import failure is thrown with the declared path in the message.
+ *
+ * `typeScript: false` imports it with plain node, without registering tsx
+ * (#3276): tsx's ESM hooks run on a thread of their own, which costs the
+ * compiled CLI about 200 MB, so a caller whose module is JavaScript says so.
  */
-export async function importLexiconModule(name: string): Promise<Record<string, unknown> | undefined> {
+export async function importLexiconModule(
+  name: string,
+  options: { typeScript?: boolean } = {},
+): Promise<Record<string, unknown> | undefined> {
   const path = modulePaths.get(name);
   if (path === undefined) return undefined;
   try {
-    ensureTypeScriptLoader();
+    if (options.typeScript !== false) ensureTypeScriptLoader();
     return esModuleNamespace((await import(path)) as Record<string, unknown>);
   } catch (err) {
     throw new Error(

package/src/lifecycle/gate-audit.ts

@@ -48,6 +48,13 @@
  * - `override`: an apply cites an override that no line holds.
  * - `malformed-line`: a line that is not a gate record. Its content is lost
  *   to the trail, so it is said.
+ * - `carried-without-source`: an approval carried from a gate's alias
+ *   (#3949, `carriedFrom`) whose cited line is not in the cited op's
+ *   ledger. Checked only when that ledger is passed in.
+ *
+ * A carried approval's request is the pending fact of the name it was
+ * carried from, in that op's ledger. When that ledger is not passed in,
+ * neither gap is looked for, and the entry's `carriedFrom` says where to look.
  *
  * ## Sources and ids
  *
@@ -211,13 +218,15 @@ export interface GateAuditEntry {
   subject?: "approval" | "override";
   /** An applied entry: the approval entry it ran under, if one is held. An override-spent entry: the override entry. */
   under?: string;
+  /** An approval a run carried from one of the gate's aliases (#3949): the op, gate and time of the line it came from. */
+  carriedFrom?: { op: string; gate: string; at: string };
   /** Everything else the line carries, such as `members`, `via` or a product's own fields. */
   detail: Record<string, unknown>;
   source: GateAuditSource;
 }
 
 export interface GateAuditGap {
-  kind: "approval-without-request" | "unsealed" | "approval" | "override" | "malformed-line";
+  kind: "approval-without-request" | "unsealed" | "approval" | "override" | "malformed-line" | "carried-without-source";
   op?: string;
   gate?: string;
   digest?: string;
@@ -284,7 +293,7 @@ type Row = Record<string, unknown>;
 
 const KNOWN = new Set([
   "version", "kind", "op", "gate", "resolvedBy", "relayedBy", "timestamp", "note", "url", "planDigest", "environment",
-  "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers",
+  "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers", "carriedFrom",
 ]);
 
 const waveOf = (v: unknown): { number: number; name: string; op?: string } | undefined => {
@@ -335,6 +344,11 @@ function approverOf(r: Row): GateAuditEntry["approver"] {
   return { kind: a.kind, ...(roles ? { roles } : {}) };
 }
 
+const carriedOf = (v: unknown): GateAuditEntry["carriedFrom"] => {
+  const c = v as { op?: unknown; gate?: unknown; timestamp?: unknown } | null;
+  return c && typeof c === "object" && typeof c.op === "string" && typeof c.gate === "string" && typeof c.timestamp === "string" ? { op: c.op, gate: c.gate, at: c.timestamp } : undefined;
+};
+
 const drop = <T extends object>(o: T): T => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined)) as T;
 
 const idOf = (...parts: unknown[]): string => contentDigest(canonicalJson(parts));
@@ -375,6 +389,19 @@ export function deriveGateAudit(input: GateAuditInput): { entries: GateAuditEntr
   const entries: GateAuditEntry[] = [];
   const gaps: GateAuditGap[] = [];
 
+  // #3949: every ledger's requests and approvals by op, for an approval carried from another op's gate.
+  const byOp = new Map<string, { requests: Seen[]; approvals: Row[] }>();
+  for (const ledger of input.ledgers) {
+    const held = byOp.get(ledger.op) ?? { requests: [], approvals: [] };
+    byOp.set(ledger.op, held);
+    for (const line of ledger.lines) {
+      const r = rowOf(line);
+      if (!r || line.removed || typeof r.gate !== "string" || typeof r.timestamp !== "string") continue;
+      if (r.kind === "pending") held.requests.push({ op: ledger.op, gate: r.gate, at: time(r.timestamp), ...(str(r.planDigest) ? { digest: str(r.planDigest) } : {}) });
+      else held.approvals.push(r);
+    }
+  }
+
   for (const ledger of input.ledgers) {
     const path = ledger.path ?? `_gates/${ledger.op}.jsonl`;
     const parsed: { line: GateLedgerLine; n: number; r: Row; pending: boolean }[] = [];
@@ -453,12 +480,22 @@ export function deriveGateAudit(input: GateAuditInput): { entries: GateAuditEntr
         at: String(r.timestamp),
         by: String(r.resolvedBy),
         seal,
-        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules }),
+        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules, carriedFrom: carriedOf(r.carriedFrom) }),
         detail: extra,
       });
       entries.push(entry);
 
-      if (!override) {
+      const carried = entry.carriedFrom;
+      if (!override && carried) {
+        const cited = byOp.get(carried.op);
+        const from = `${carried.op}/${carried.gate}`;
+        if (cited && !cited.approvals.some((a) => a.gate === carried.gate && time(String(a.timestamp)) === time(carried.at) && a.resolvedBy === r.resolvedBy)) {
+          gaps.push({ kind: "carried-without-source", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at}, and _gates/${carried.op}.jsonl holds no such approval` });
+        }
+        if (cited && !cited.requests.some((q) => q.gate === carried.gate && q.at <= time(carried.at) && compatible(q.digest, digest))) {
+          gaps.push({ kind: "approval-without-request", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at} with no pending fact of ${from}${digest ? " and digest" : ""} before it` });
+        }
+      } else if (!override) {
         const at = time(entry.at);
         const env = str(r.environment);
         const asked = requests.some((q) => q.gate === gate && q.at <= at && compatible(q.digest, digest) && (q.environment === undefined || env === undefined || q.environment === env));