@intentius/chant 0.79.0 → 0.81.0

package/src/components/__fixtures__/alb-ecs-service.json

@@ -39,13 +39,5 @@
         { "kind": "health-gate", "path": "/healthz" }
       ]
     }
-  ],
-  "rollback": [
-    {
-      "phase": "Rollback",
-      "steps": [
-        { "kind": "rollback-previous", "service": "search", "cluster": "$env.cluster" }
-      ]
-    }
   ]
 }

package/src/components/capability-plugin-loader.ts

@@ -22,6 +22,7 @@
  */
 
 import { CapabilityRegistry } from "./capability";
+import { lexiconModulePath } from "../lexicon-module";
 import type { CapabilityPlugin } from "./capability-plugin";
 import { isCapabilityPlugin } from "./capability-plugin";
 import { starterCapabilityPlugin } from "./starter-plugin";
@@ -113,7 +114,8 @@ export async function loadCapabilityPlugins(names: string[]): Promise<Capability
  * where the package's whole reason to exist is the plugin.
  */
 export async function loadCapabilityPluginFromLexicon(name: string): Promise<CapabilityPlugin | null> {
-  const packageName = `@intentius/chant-lexicon-${name}`;
+  // chant #2520 — a lexicon declared by module path is imported from that path.
+  const packageName = lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`;
   let mod: Record<string, unknown>;
   try {
     mod = (await import(packageName)) as Record<string, unknown>;

package/src/components/cli-support.ts

@@ -22,6 +22,7 @@
  *    executor, the CLI entrypoint the driver (#556) never had.
  */
 
+import { lexiconModulePath, lexiconNames } from "../lexicon-module";
 import { discoverComponents } from "./discover";
 import type { BuildParamProvenance } from "../provenance";
 import { projectToJson, type Archetype } from "./component";
@@ -38,7 +39,7 @@ import {
   type DriverRunResult,
 } from "./driver";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
-import type { GateLedgerPort } from "../op/gate";
+import type { GateDigestMismatch, GateLedgerPort } from "../op/gate";
 import { gateName } from "../op/gate-name";
 import { isLexiconPlugin, type LexiconPlugin, type ComponentPipelineOptions } from "../lexicon";
 import type { RunProgressEvent } from "./run-progress";
@@ -237,7 +238,7 @@ export interface GenerateComponentsResult {
 async function loadLexiconPlugin(name: string): Promise<LexiconPlugin | null> {
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(`@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
+    mod = (await import(lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
   } catch {
     return null;
   }
@@ -431,6 +432,8 @@ export interface RunComponentsResult {
     /** Whether this run's own append reached the remote (#2310); absent when the pending fact was already standing. */
     pushed?: boolean;
     pushWarning?: string;
+    /** Set when an approval stands for this gate, but for another plan or none (#2574). */
+    mismatch?: GateDigestMismatch;
   };
   /** This run's resolved build-time parameters (chant #1108) — the component-driver counterpart of `../cli/commands/build.ts`'s `BuildResult.buildParams`. Present only once the run actually reached dispatch (mirrors `BuildResult.buildParams`, which is likewise absent on an early-error return). */
   buildParams?: BuildParamProvenance[];
@@ -550,7 +553,7 @@ export async function runComponents(
     options.registry ??
     (await buildCapabilityRegistry({
       plugins: options.capabilityPlugins ?? config.capabilities,
-      lexicons: config.lexicons,
+      lexicons: lexiconNames(config.lexicons),
     }));
   const env = options.env ?? "local";
   const selected = targets.map((c) => c.name);
@@ -583,6 +586,7 @@ export async function runComponents(
                 gate: run.gate,
                 ...(run.gatePushed !== undefined ? { pushed: run.gatePushed } : {}),
                 ...(run.gatePushWarning ? { pushWarning: run.gatePushWarning } : {}),
+                ...(run.gateMismatch ? { mismatch: run.gateMismatch } : {}),
               },
             }
           : {}),
@@ -631,6 +635,7 @@ export async function runComponents(
             gate: componentResult.gate,
             ...(componentResult.gatePushed !== undefined ? { gatePushed: componentResult.gatePushed } : {}),
             ...(componentResult.gatePushWarning ? { gatePushWarning: componentResult.gatePushWarning } : {}),
+            ...(componentResult.gateMismatch ? { gateMismatch: componentResult.gateMismatch } : {}),
           }
         : {}),
       componentOutputs,
@@ -647,6 +652,7 @@ export async function runComponents(
               gate: componentResult.gate,
               ...(componentResult.gatePushed !== undefined ? { pushed: componentResult.gatePushed } : {}),
               ...(componentResult.gatePushWarning ? { pushWarning: componentResult.gatePushWarning } : {}),
+              ...(componentResult.gateMismatch ? { mismatch: componentResult.gateMismatch } : {}),
             },
           }
         : {}),

package/src/components/discover.test.ts

@@ -280,76 +280,46 @@ describe("discoverComponents", () => {
     expect(result.errors.some((e) => e.type === "import")).toBe(true);
   });
 
-  test("the first chant.config.ts encountered becomes the source root and is still scanned", async () => {
-    // Matches findInfraFiles's own rule: the *first* config directory found
-    // becomes `sourceRoot` and is descended into, same as any other
-    // directory — the skip only applies to a *second* nested config found
-    // after that (see the next test).
-    const childDir = join(testDir, "child-project");
-    await mkdir(childDir, { recursive: true });
-    await writeFile(join(childDir, "chant.config.ts"), `export default {};`);
-    await writeFile(
-      join(childDir, "child.component.ts"),
-      `
-        export const childSvc = {
-          name: "child-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
-    await writeFile(
-      join(testDir, "root.component.ts"),
-      `
-        export const rootSvc = {
-          name: "root-svc",
+  const svc = (exportName: string, name: string) => `
+        export const ${exportName} = {
+          name: "${name}",
           dependsOn: [],
           deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
         };
-      `,
-    );
+      `;
 
-    const result = await discoverComponents(testDir);
-
-    expect(result.components.has("root-svc")).toBe(true);
-    expect(result.components.has("child-svc")).toBe(true);
-  });
-
-  test("a second nested chant.config.ts (a true child project) is not descended into", async () => {
+  test("from outside every project, every child project is read (#2527)", async () => {
+    // The source-root quirk is gone: no child config is special for being
+    // found first. The scan root has no config at or above it, so every
+    // child project's components are discovered, nested ones included.
     const firstConfigDir = join(testDir, "first-config");
     const nestedChildProject = join(firstConfigDir, "nested-child-project");
     await mkdir(nestedChildProject, { recursive: true });
     await writeFile(join(firstConfigDir, "chant.config.ts"), `export default {};`);
     await writeFile(join(nestedChildProject, "chant.config.ts"), `export default {};`);
-    await writeFile(
-      join(firstConfigDir, "first.component.ts"),
-      `
-        export const firstSvc = {
-          name: "first-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
-    await writeFile(
-      join(nestedChildProject, "nested.component.ts"),
-      `
-        export const nestedSvc = {
-          name: "nested-svc",
-          dependsOn: [],
-          deploy: [{ phase: "Apply", steps: [{ kind: "shell" }] }],
-        };
-      `,
-    );
+    await writeFile(join(testDir, "root.component.ts"), svc("rootSvc", "root-svc"));
+    await writeFile(join(firstConfigDir, "first.component.ts"), svc("firstSvc", "first-svc"));
+    await writeFile(join(nestedChildProject, "nested.component.ts"), svc("nestedSvc", "nested-svc"));
 
     const result = await discoverComponents(testDir);
 
-    // first-config/ has no config above it, so it becomes the source root
-    // and is scanned; nested-child-project/'s own chant.config.ts is the
-    // *second* config encountered, so it is treated as a separate project
-    // scope and not descended into.
+    expect(result.components.has("root-svc")).toBe(true);
     expect(result.components.has("first-svc")).toBe(true);
-    expect(result.components.has("nested-svc")).toBe(false);
+    expect(result.components.has("nested-svc")).toBe(true);
+  });
+
+  test("from inside a project, a child project is a boundary (#2527)", async () => {
+    const childDir = join(testDir, "child-project");
+    await mkdir(childDir, { recursive: true });
+    await writeFile(join(testDir, "chant.config.ts"), `export default {};`);
+    await writeFile(join(childDir, "chant.config.ts"), `export default {};`);
+    await writeFile(join(testDir, "root.component.ts"), svc("rootSvc", "root-svc"));
+    await writeFile(join(childDir, "child.component.ts"), svc("childSvc", "child-svc"));
+
+    const result = await discoverComponents(testDir);
+
+    expect(result.components.has("root-svc")).toBe(true);
+    expect(result.components.has("child-svc")).toBe(false);
   });
 
   // ── chant #1108 — build-time parameters populated before import ────────────

package/src/components/discover.ts

@@ -40,15 +40,16 @@
  * `./component.ts`, already proves the plain-JSON round-trip).
  */
 
-import { readdir } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { existsSync } from "node:fs";
 import { DiscoveryError } from "../errors";
 import { isComponent, type Component } from "./component";
 import type { BuildParamProvenance } from "../provenance";
 import { buildParamValues } from "../build-params";
 import { setBuildParams } from "../params";
+import { hasDiscoveryMarkerSync } from "../discovery/files";
+import { resolveDiscoveryGlobs } from "../config";
+import { walkDiscovery, workspaceMemberDirs } from "../discovery/walk";
 
 /** One discovered component, paired with the file it was exported from. */
 export interface DiscoveredComponent {
@@ -115,56 +116,24 @@ export interface ImportedComponentModule {
 }
 
 /**
- * Recursively find every `*.component.ts` file under `path`, the same
- * child-project boundary rule `findInfraFiles` (`../discovery/files.ts`)
- * uses: a subdirectory with its own `chant.config.ts` is a separate scope
- * once the outer project's own source root has been established.
+ * Every `*.component.ts` file under `path`, through the one discovery walk
+ * (`../discovery/walk.ts`, #2527): the same dot-directory, `dist`,
+ * git-ignore and child-project rules as source discovery, the project's
+ * `exclude`/`include` globs and the skip marker (#2519). Scanned from outside
+ * any project, every child project is read.
  */
 async function findComponentFiles(path: string): Promise<string[]> {
-  const files: string[] = [];
-  let sourceRoot: string | null = null;
-
-  async function scanDirectory(dir: string): Promise<void> {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-
-    for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-
-      if (entry.isDirectory()) {
-        // Skip dependency and tool/VCS directories: component sources never live
-        // in them, and descending in is both wasted work and a correctness bug —
-        // e.g. a CI runner like gitlab-ci-local stages a copy of the project
-        // under `.gitlab-ci-local/`, which discovery would otherwise pick up as
-        // duplicate component names alongside the originals.
-        if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-
-        const configPath = join(fullPath, "chant.config.ts");
-        if (existsSync(configPath)) {
-          if (sourceRoot === null) {
-            sourceRoot = fullPath;
-          } else {
-            continue;
-          }
-        }
-        await scanDirectory(fullPath);
-      } else if (
-        entry.isFile() &&
-        entry.name.endsWith(".component.ts") &&
-        !entry.name.endsWith(".test.component.ts") &&
-        !entry.name.endsWith(".spec.component.ts")
-      ) {
-        files.push(fullPath);
-      }
-    }
-  }
-
-  await scanDirectory(path);
-  return files;
+  return walkDiscovery({
+    walker: "components",
+    root: path,
+    globs: await resolveDiscoveryGlobs(path),
+    excludeDirs: await workspaceMemberDirs(path),
+    accept: (name, full) =>
+      name.endsWith(".component.ts") &&
+      !name.endsWith(".test.component.ts") &&
+      !name.endsWith(".spec.component.ts") &&
+      !hasDiscoveryMarkerSync(full),
+  });
 }
 
 /**

package/src/components/driver.test.ts

@@ -13,7 +13,8 @@
 import { describe, expect, it } from "vitest";
 import { CapabilityRegistry, type DeployContext } from "./capability";
 import { stubCapability } from "./verbs/stub";
-import { memoryGateLedgerPort } from "../op/gate";
+import { describeGateMismatch, memoryGateLedgerPort } from "../op/gate";
+import { componentPlanDigest } from "./gate-plan";
 import type { PendingGateInput } from "../lifecycle/gate-ledger";
 import {
   DependencyCycleError,
@@ -311,14 +312,17 @@ describe("runComponentDeploy — gate as fact (#2119)", () => {
 
   it("a resolution newer than the pending fact passes the gate and carries the approver", async () => {
     const { registry, calls } = registryWithCalls();
+    const planDigest = componentPlanDigest({ environment: "dev", component: gatedComponent() });
     const port = memoryGateLedgerPort({
       pending: [{
         version: 1, kind: "pending", op: "neo4j-cluster", gate: "approve-node-1",
         timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2026-09-07T10:00:00.000Z",
+        planDigest, environment: "dev",
       }],
       resolutions: [{
         version: 1, op: "neo4j-cluster", gate: "approve-node-1",
         resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
+        planDigest, environment: "dev",
       }],
     });
     const result = await runComponentDeploy(
@@ -332,6 +336,79 @@ describe("runComponentDeploy — gate as fact (#2119)", () => {
       .toEqual({ gate: "approve-node-1", resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z" });
   });
 
+  // #2574: a component gate approval is bound to the environment and the plan.
+  describe("approvals bound to environment and plan (#2574)", () => {
+    const run = (port: ReturnType<typeof memoryGateLedgerPort>, env: string, component = gatedComponent()) =>
+      runComponentDeploy(component, { env, component: "neo4j-cluster" }, registryWithCalls().registry, {}, undefined, { port, now: NOW });
+
+    it("the pending fact records the environment and the plan", async () => {
+      const port = memoryGateLedgerPort();
+      const result = await run(port, "staging");
+      expect(result.gate).toMatchObject({
+        environment: "staging",
+        planDigest: componentPlanDigest({ environment: "staging", component: gatedComponent() }),
+      });
+    });
+
+    it("an approval given for another environment does not pass the gate", async () => {
+      const port = memoryGateLedgerPort();
+      const staging = await run(port, "staging");
+      const approval = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1", resolvedBy: "alex",
+        timestamp: "2026-09-05T12:30:00.000Z",
+        planDigest: staging.gate!.planDigest!, environment: "staging",
+      };
+      const withApproval = memoryGateLedgerPort({ pending: [staging.gate!], resolutions: [approval] });
+
+      expect((await run(withApproval, "staging")).status).toBe("ok");
+      const prod = await run(withApproval, "prod");
+      expect(prod.status).toBe("gated");
+      expect(prod.gate).toMatchObject({ environment: "prod" });
+      // The staging approval is not this run's business, so it is not reported as a mismatch either.
+      expect(prod.gateMismatch).toBeUndefined();
+    });
+
+    it("an approval given for another plan in the same environment is refused and named", async () => {
+      const port = memoryGateLedgerPort();
+      const before = await run(port, "prod");
+      const approval = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1", resolvedBy: "alex",
+        timestamp: "2026-09-05T12:30:00.000Z",
+        planDigest: before.gate!.planDigest!, environment: "prod",
+      };
+      const changed = gatedComponent();
+      changed.deploy[1]!.steps.push({ kind: "cfn-deploy", stack: "extra" });
+      const result = await run(memoryGateLedgerPort({ pending: [before.gate!], resolutions: [approval] }), "prod", changed);
+
+      expect(result.status).toBe("gated");
+      expect(result.gateMismatch).toMatchObject({
+        approved: before.gate!.planDigest, planned: result.gate!.planDigest, environment: "prod", resolvedBy: "alex",
+      });
+      expect(result.gate!.planDigest).not.toBe(before.gate!.planDigest);
+    });
+
+    it("an approval recorded before the binding is refused, with the command that replaces it", async () => {
+      const legacyPending = {
+        version: 1 as const, kind: "pending" as const, op: "neo4j-cluster", gate: "approve-node-1",
+        timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2026-09-07T10:00:00.000Z",
+      };
+      const legacy = {
+        version: 1 as const, op: "neo4j-cluster", gate: "approve-node-1",
+        resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
+      };
+      const port = memoryGateLedgerPort({ pending: [legacyPending], resolutions: [legacy] });
+      const result = await run(port, "prod");
+
+      expect(result.status).toBe("gated");
+      expect(port.appended).toHaveLength(1);
+      expect(result.gateMismatch).toMatchObject({ resolvedBy: "alex", environment: "prod" });
+      expect(result.gateMismatch!.approved).toBeUndefined();
+      const message = describeGateMismatch("neo4j-cluster", "approve-node-1", result.gateMismatch!);
+      expect(message).toContain("predates environment- and plan-bound component gates (#2574)");
+      expect(message).toContain("chant approve neo4j-cluster approve-node-1 --env prod");
+    });
+  });
+
   it("the neo4j pilot's gated Node 1 phase ends the run pending approval", async () => {
     const registry = new CapabilityRegistry();
     for (const kind of ["cfn-deploy", "code-deploy", "wait-cluster-healthy"]) {
@@ -450,7 +527,7 @@ describe("runComponentDeploy — onFailure saga rollback", () => {
     );
   });
 
-  it("runs a component-level rollback (schema `rollback` field) after step rollback, matching the ALB/ECS pilot's explicit compensation", async () => {
+  it("runs a component-level rollback (schema `rollback` field) after step rollback", async () => {
     const registry = new CapabilityRegistry();
     registry.register(fakeCapability("docker-build", { run: () => ({ digest: "sha256:abc" }) }).capability);
     registry.register(
@@ -458,26 +535,29 @@ describe("runComponentDeploy — onFailure saga rollback", () => {
         .capability,
     );
     registry.register(fakeCapability("cfn-deploy", { run: () => ({ stackStatus: "UPDATE_COMPLETE", outputs: {} }) }).capability);
-    // ecs-update-service fails, and (per the pilot's comment) has no native
-    // rollback — the component's own `rollback` phase is what should fire.
+    // ecs-update-service fails; the component's own `rollback` phase is what
+    // should fire after the executed steps unwind.
     registry.register(fakeCapability("ecs-update-service", { failRun: true }).capability);
-    const { capability: rollbackPreviousCap, calls: rollbackPreviousCalls } = fakeCapability("rollback-previous", {
+    const { capability: restoreCap, calls: restoreCalls } = fakeCapability("restore-service", {
       run: () => ({ restored: true }),
     });
-    registry.register(rollbackPreviousCap);
+    registry.register(restoreCap);
     // Verify/rollback phases never reached since Apply fails first, but register
     // stubs anyway so a hypothetical reordering wouldn't crash the test on an
     // unregistered kind.
     registry.register(fakeCapability("wait-steady-state", { run: () => ({ runningCount: 1 }) }).capability);
     registry.register(fakeCapability("health-gate", { run: () => ({ healthy: true }) }).capability);
 
-    const json = projectToJson(searchService) as unknown as DriverComponent;
+    const json: DriverComponent = {
+      ...(projectToJson(searchService) as unknown as DriverComponent),
+      rollback: [{ phase: "Rollback", steps: [{ kind: "restore-service", service: "search" }] }],
+    };
     const result = await runComponentDeploy(json, { env: "dev", component: "search-service" }, registry, {});
 
     expect(result.ok).toBe(false);
-    expect(rollbackPreviousCalls).toHaveLength(1);
-    expect(rollbackPreviousCalls[0]!.input).toMatchObject({ service: "search" });
-    const rollbackRecord = result.records.find((r) => r.phase === "Rollback" && r.kind === "rollback-previous");
+    expect(restoreCalls).toHaveLength(1);
+    expect(restoreCalls[0]!.input).toMatchObject({ service: "search" });
+    const rollbackRecord = result.records.find((r) => r.phase === "Rollback" && r.kind === "restore-service");
     expect(rollbackRecord?.status).toBe("ok");
   });
 });
@@ -630,7 +710,6 @@ describe("runInterpretDriver — end to end", () => {
       "ecs-update-service",
       "wait-steady-state",
       "health-gate",
-      "rollback-previous",
       "wait-for-stack",
       "run-migration",
     ];
@@ -750,7 +829,6 @@ describe("runInterpretDriver — end to end", () => {
       "ecs-update-service",
       "wait-steady-state",
       "health-gate",
-      "rollback-previous",
       "wait-for-stack",
       "run-migration",
       "lambda-deploy",

package/src/components/driver.ts

@@ -47,8 +47,9 @@
  */
 
 import { topoSort } from "../codegen/topo-sort";
-import { evaluateGate, gitGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { evaluateGate, gitGateLedgerPort, type GateDigestMismatch, type GateLedgerPort } from "../op/gate";
 import { gateName } from "../op/gate-name";
+import { componentPlanDigest } from "./gate-plan";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
 import type { CapabilityRegistry, DeployContext } from "./capability";
 import type { RunProgressEvent, RunProgressStatus } from "./run-progress";
@@ -167,6 +168,8 @@ export interface DriverComponentResult {
   gatePushed?: boolean;
   /** Set when `gatePushed` is false: why, in one line. */
   gatePushWarning?: string;
+  /** Present when `status === "gated"` because an approval stands for this gate, but for another plan or none (#2574). */
+  gateMismatch?: GateDigestMismatch;
 }
 
 export interface DriverRunResult {
@@ -188,6 +191,8 @@ export interface DriverRunResult {
   gatePushed?: boolean;
   /** Set when `gatePushed` is false: why, in one line. */
   gatePushWarning?: string;
+  /** Present when `status === "gated"` because an approval stands for another plan or none (#2574). */
+  gateMismatch?: GateDigestMismatch;
   /**
    * The accumulated cross-component/cross-stack outputs after the run — each
    * component's `publish` output and, for an applied stack, its `cfn-deploy`
@@ -370,6 +375,8 @@ class GateStop extends Error {
     /** Whether this run's own append reached the remote — see {@link DriverComponentResult.gatePushed} (#2310). */
     public readonly pushed?: boolean,
     public readonly pushWarning?: string,
+    /** Set when an approval stands for this gate but not for this plan (#2574). */
+    public readonly mismatch?: GateDigestMismatch,
   ) {
     super(`gate "${pending.gate}" is pending approval`);
     this.name = "GateStop";
@@ -385,6 +392,14 @@ function progressStatus(status: DriverComponentResult["status"]): RunProgressSta
 export interface GateContext {
   port: GateLedgerPort;
   now?: string;
+  /**
+   * The recorded digest each component is deployed at, for a promote or a
+   * rollback (#2574). It goes into the plan digest a gate approval is bound
+   * to, keyed by component name.
+   */
+  releases?: ReadonlyMap<string, string>;
+  /** This component's plan digest. Set by {@link runComponentDeploy}, never by a caller. */
+  planDigest?: string;
 }
 
 /** Run a single capability step. Never throws for a capability-run failure; returns a fail record instead. */
@@ -467,6 +482,9 @@ async function runPhase(
       const check = await evaluateGate(gates.port, {
         op: ctx.component,
         gate: gateName(gate),
+        // #2574: an approval counts only for this environment and this plan.
+        environment: ctx.env,
+        ...(gates.planDigest !== undefined ? { planDigest: gates.planDigest } : {}),
         ...(gate.description ? { description: gate.description } : {}),
         ...(gate.timeout ? { timeout: gate.timeout } : {}),
         ...(gates.now ? { now: gates.now } : {}),
@@ -477,7 +495,7 @@ async function runPhase(
         for (const skipped of phaseDef.steps.filter((s): s is DriverStep | DriverPhase => !isGateStep(s))) {
           gateRecords.push(skippedRecord(skipped));
         }
-        throw new GateStop(gateRecords, [], check.pending, check.pushed, check.pushWarning);
+        throw new GateStop(gateRecords, [], check.pending, check.pushed, check.pushWarning, check.mismatch);
       }
       gateRecords.push({
         ...base,
@@ -505,6 +523,7 @@ async function runPhase(
     pending?: PendingGateRecord;
     pushed?: boolean;
     pushWarning?: string;
+    mismatch?: GateDigestMismatch;
   }> => {
     if (isPhaseStep(entry)) {
       try {
@@ -522,6 +541,7 @@ async function runPhase(
             pending: err.pending,
             pushed: err.pushed,
             pushWarning: err.pushWarning,
+            mismatch: err.mismatch,
           };
         }
         throw err;
@@ -570,7 +590,7 @@ async function runPhase(
       const executed = results.flatMap((r) => r.executed);
       const withPending = results.find((r) => r.pending);
       if (withPending?.pending) {
-        throw new GateStop(records, executed, withPending.pending, withPending.pushed, withPending.pushWarning);
+        throw new GateStop(records, executed, withPending.pending, withPending.pushed, withPending.pushWarning, withPending.mismatch);
       }
       if (results.some((r) => r.failed)) throw new StepFailure(records, executed);
       return { records, executed };
@@ -584,7 +604,7 @@ async function runPhase(
       executed.push(...result.executed);
       if (result.pending) {
         for (const skipped of entries.slice(i + 1)) records.push(skippedRecord(skipped));
-        throw new GateStop(records, executed, result.pending, result.pushed, result.pushWarning);
+        throw new GateStop(records, executed, result.pending, result.pushed, result.pushWarning, result.mismatch);
       }
       if (result.failed) {
         for (const skipped of entries.slice(i + 1)) records.push(skippedRecord(skipped));
@@ -693,9 +713,22 @@ export async function runComponentDeploy(
   registry: CapabilityRegistry,
   componentOutputs: Record<string, Record<string, unknown>>,
   onProgress?: (event: RunProgressEvent) => void,
-  gates: GateContext = { port: gitGateLedgerPort() },
+  gateContext: GateContext = { port: gitGateLedgerPort() },
 ): Promise<DriverComponentResult> {
   const phaseOutputs: Record<string, Record<string, unknown>> = {};
+  // #2574: every gate this component reaches binds its approval to this
+  // environment and this composition, so an approval for staging or for last
+  // week's deploy cannot pass it.
+  const release = gateContext.releases?.get(component.name);
+  const gates: GateContext = {
+    ...gateContext,
+    planDigest: componentPlanDigest({
+      environment: ctx.env,
+      component,
+      ...(ctx.vars ? { vars: ctx.vars } : {}),
+      ...(release !== undefined ? { release } : {}),
+    }),
+  };
   const records: DriverStepRecord[] = [];
   const allExecuted: ExecutedStep[] = [];
 
@@ -720,6 +753,7 @@ export async function runComponentDeploy(
         gate: err.pending,
         ...(err.pushed !== undefined ? { gatePushed: err.pushed } : {}),
         ...(err.pushWarning ? { gatePushWarning: err.pushWarning } : {}),
+        ...(err.mismatch ? { gateMismatch: err.mismatch } : {}),
       };
     }
 
@@ -873,6 +907,8 @@ export interface InterpretRunOptions {
   gates?: GateLedgerPort;
   /** ISO-8601 "now" for gate decisions, so a test is deterministic. */
   now?: string;
+  /** The recorded digest a promote or rollback deploys, per component (#2574). Part of the plan a gate approval is bound to. */
+  releases?: ReadonlyMap<string, string>;
 }
 
 /**
@@ -906,6 +942,7 @@ export async function runInterpretDriver(
   const gates: GateContext = {
     port: options.gates ?? gitGateLedgerPort(),
     ...(options.now ? { now: options.now } : {}),
+    ...(options.releases ? { releases: options.releases } : {}),
   };
 
   onProgress?.({ type: "run-start", waves });
@@ -957,6 +994,7 @@ export async function runInterpretDriver(
           gate: gated.gate,
           ...(gated.gatePushed !== undefined ? { gatePushed: gated.gatePushed } : {}),
           ...(gated.gatePushWarning ? { gatePushWarning: gated.gatePushWarning } : {}),
+          ...(gated.gateMismatch ? { gateMismatch: gated.gateMismatch } : {}),
         }
       : {}),
   };

package/src/components/fan-out-support.ts

@@ -13,6 +13,7 @@
  * over.
  */
 
+import { lexiconNames } from "../lexicon-module";
 import { resolveComponentTargets } from "./cli-support";
 import { applyConfigDefaults } from "./config-defaults";
 import { buildCapabilityRegistry } from "./capability-plugin-loader";
@@ -91,5 +92,5 @@ export async function deriveFanOut(options: DeriveFanOutOptions): Promise<Derive
  */
 export async function fanOutRegistry(path: string, config?: ChantConfig): Promise<CapabilityRegistry> {
   const resolved = config ?? (await loadChantConfig(path)).config;
-  return buildCapabilityRegistry({ plugins: resolved.capabilities, lexicons: resolved.lexicons });
+  return buildCapabilityRegistry({ plugins: resolved.capabilities, lexicons: lexiconNames(resolved.lexicons) });
 }