@intentius/plywood 0.3.1 → 0.3.5

package/dist/plywood.mjs

@@ -16,6 +16,14 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// <define:__PLYWOOD_IMAGE_DIGESTS__>
+var define_PLYWOOD_IMAGE_DIGESTS_default;
+var init_define_PLYWOOD_IMAGE_DIGESTS = __esm({
+  "<define:__PLYWOOD_IMAGE_DIGESTS__>"() {
+    define_PLYWOOD_IMAGE_DIGESTS_default = { "ghcr.io/intentius/plywood-pulumi:0.3.5-pulumi3.272.0": "sha256:a1288d42eaba8ec556ed3ea40a24cfda94a8413576b7f0129b30ab7620639f07", "ghcr.io/intentius/plywood-plunge:0.3.5-plunge0.2.0": "sha256:4384ee4b92c8b0cb00c4833bc0118a820a0c3620ad78dc50d9e21fb0d9fff370" };
+  }
+});
+
 // src/config/types.ts
 function isObject(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -45,6 +53,7 @@ var BACKEND_SCHEMA;
 var init_types = __esm({
   "src/config/types.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     BACKEND_SCHEMA = {
       type: "string",
       description: "The backend URL. A plunge+ URL (plunge+file://, plunge+s3://) picks the plunge engine."
@@ -89,6 +98,7 @@ var DEFAULT_KEY_ENV, VARIABLE, REVIEW_KEYS, AGENT_KEYS, modelSchema, agents;
 var init_agents = __esm({
   "src/config/agents.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     DEFAULT_KEY_ENV = "ANTHROPIC_API_KEY";
     VARIABLE = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -182,6 +192,7 @@ var APPLY_WHEN, DEFAULT_APPLY_WHEN, APPLY_REQUIRES, APPLY_MERGE, MERGE_METHODS,
 var init_apply = __esm({
   "src/config/apply.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     APPLY_WHEN = ["merge", "pull-request"];
     DEFAULT_APPLY_WHEN = "merge";
@@ -261,7 +272,7 @@ function gateOf(doc) {
   return typeof doc.gate === "string" && GATES.includes(doc.gate) ? doc.gate : DEFAULT_GATE;
 }
 function previewOf(doc) {
-  return doc.preview === true;
+  return doc.preview !== false;
 }
 function quorumOf(rules) {
   return Object.entries(rules).map(([glob, r]) => {
@@ -273,12 +284,13 @@ var GATES, DEFAULT_GATE, APPROVALS, DEFAULT_APPROVAL, DEFAULT_PREVIEW, APPROVAL_
 var init_approval = __esm({
   "src/config/approval.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     GATES = ["always", "on-destructive", "never"];
     DEFAULT_GATE = "on-destructive";
     APPROVALS = ["ledger", "sealed", "pr-review"];
     DEFAULT_APPROVAL = "ledger";
-    DEFAULT_PREVIEW = false;
+    DEFAULT_PREVIEW = true;
     APPROVAL_RULE_KEYS = ["role", "roles", "quorum"];
     approval = {
       name: "approval",
@@ -289,7 +301,7 @@ var init_approval = __esm({
         preview: {
           type: "boolean",
           default: DEFAULT_PREVIEW,
-          description: "true: plywood init sets approvals.preview in the waves spec, so a merged wave applies only the plans its pull request previewed, or exits 4. Known limits: plywood#55 (the second of two disjoint merges is refused) and plywood#56 (a pull request that creates an autonamed resource is refused)."
+          description: "true (the default): plywood init sets approvals.preview in the waves spec, so a merged wave applies only the plans its pull request previewed, or exits 4. false leaves it out."
         },
         approval_rules: {
           type: "object",
@@ -351,6 +363,7 @@ var PLYWOOD_KEY_FOR, chantKeys;
 var init_chant_keys = __esm({
   "src/config/chant-keys.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     PLYWOOD_KEY_FOR = {
       workflow: "apply.when",
@@ -431,8 +444,9 @@ var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS,
 var init_words = __esm({
   "src/words.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     PRODUCT = "plywood";
-    TAGLINE = "Sophisticated automation for Pulumi.";
+    TAGLINE = "Pulumi ops and governance.";
     OP_NAME = "pulumi-up";
     PR_GATE = "up";
     VERBS = [
@@ -496,7 +510,7 @@ ${r.tail}` : ""}`,
     };
     DRIFT_OP_PREFIX = "plywood-drift-";
     LOCK_GRAIN_WORDS = {
-      perEngine: (engine2) => engine2 === "plunge" ? "resource, plunge's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : engine2 === "pulumi" ? "stack, stock Pulumi's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : "per engine: resource on plunge, stack on stock Pulumi (no ci.lockGrain; chant's pulumi lexicon sets it)"
+      perEngine: (engine3) => engine3 === "plunge" ? "resource, plunge's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : engine3 === "pulumi" ? "stack, stock Pulumi's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : "per engine: resource on plunge, stack on stock Pulumi (no ci.lockGrain; chant's pulumi lexicon sets it)"
     };
     PLUNGE_TIMING_ATTRIBUTES = {
       resources: `${PRODUCT}.plunge.resources`,
@@ -525,10 +539,17 @@ function controlOf(doc) {
   }
   return out;
 }
+function controlBuildArgv(doc, member) {
+  const settings = controlOf(doc);
+  if (!settings) return [];
+  const { repo, ...rest } = { member, ...settings };
+  return ["--control", repo, ...Object.entries(rest).flatMap(([k, v]) => ["--control-setting", `${k}=${v}`])];
+}
 var CONTROL_KEYS, CONTROL_FORGES, control;
 var init_control = __esm({
   "src/config/control.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_words();
     init_types();
     CONTROL_KEYS = {
@@ -597,37 +618,27 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.3.1";
+    version = "0.3.5";
     dependencies = {
-      "@intentius/chant": "0.124.59",
-      "@intentius/chant-lexicon-forgejo": "0.124.59",
-      "@intentius/chant-lexicon-github": "0.124.59",
-      "@intentius/chant-lexicon-gitlab": "0.124.59",
-      "@intentius/chant-lexicon-pulumi": "0.124.59"
-    };
-  }
-});
-
-// src/image-digests.json
-var image_digests_default;
-var init_image_digests = __esm({
-  "src/image-digests.json"() {
-    image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.3.1-pulumi3.272.0": "sha256:acdadb5000ade3afea20ab2f555946312281066e1df288b1007bff096514ebfd",
-      "ghcr.io/intentius/plywood-plunge:0.3.1-plunge0.2.0": "sha256:adc42bc97564ecb2074b3ee4d97f84ddb986e0f30f6a26f35b8721106c177456"
+      "@intentius/chant": "0.124.79",
+      "@intentius/chant-lexicon-forgejo": "0.124.79",
+      "@intentius/chant-lexicon-github": "0.124.79",
+      "@intentius/chant-lexicon-gitlab": "0.124.79",
+      "@intentius/chant-lexicon-pulumi": "0.124.79"
     };
   }
 });
 
 // src/images.ts
-function engineDir(engine2, version2) {
-  return `${ENGINE_ROOT}/${engine2}-${version2}`;
+import { CI_DOCKER_ARCH, ciFetchScript, plungeInstallLine, pulumiInstallLine } from "@intentius/chant-lexicon-pulumi/ci-setup";
+function engineDir(engine3, version2) {
+  return `${ENGINE_ROOT}/${engine3}-${version2}`;
 }
-function engineBin(engine2, version2) {
-  return `${engineDir(engine2, version2)}/${engine2}`;
+function engineBin(engine3, version2) {
+  return `${engineDir(engine3, version2)}/${engine3}`;
 }
-function release(engine2, version2) {
-  if (engine2 === "pulumi") {
+function release(engine3, version2) {
+  if (engine3 === "pulumi") {
     return {
       base: `https://github.com/pulumi/pulumi/releases/download/v${version2}`,
       archive: (arch) => `pulumi-v${version2}-linux-${arch}.tar.gz`,
@@ -640,8 +651,8 @@ function release(engine2, version2) {
     checksums: `plunge-v${version2}-checksums.txt`
   };
 }
-function pinnedSums(engine2, version2) {
-  const r = release(engine2, version2);
+function pinnedSums(engine3, version2) {
+  const r = release(engine3, version2);
   const out = {};
   for (const arch of ARCHES) {
     const sum = PINNED_SHA256[r.archive(arch)];
@@ -649,54 +660,10 @@ function pinnedSums(engine2, version2) {
   }
   return out;
 }
-function fetchScript(engine2, version2, dir, arch, checksumsUrl) {
-  const r = release(engine2, version2);
-  const sums = pinnedSums(engine2, version2);
-  const pinCase = Object.keys(sums).length ? `case "$a" in ${ARCHES.filter((x) => sums[x]).map((x) => `${x}) want=${sums[x]} ;;`).join(" ")} *) want= ;; esac` : "want=";
-  const file = `${r.archive("x64").replace("-x64.", "-$a.")}`;
-  return [
-    `a=${arch}`,
-    `f="${file}"`,
-    `t="$(mktemp -d)"`,
-    `curl -fsSLo "$t/$f" "${r.base}/$f"`,
-    `curl -fsSLo "$t/sums" ${checksumsUrl ?? `"${r.base}/${r.checksums}"`}`,
-    // The archive's line, with any ./ or * before the name taken off.
-    `line="$(sed -n "s#^\\([0-9a-f]\\{64\\}\\)  *[*.]*/*$f\\$#\\1#p" "$t/sums")"`,
-    `{ [ -n "$line" ] || { echo "${engine2} ${version2}: $f is not in ${r.checksums}" >&2; exit 1; }; }`,
-    pinCase,
-    `{ [ -z "$want" ] || [ "$line" = "$want" ] || { echo "${engine2} ${version2}: ${r.checksums} lists $line for $f; plywood pins $want" >&2; exit 1; }; }`,
-    `echo "$line  $t/$f" | sha256sum -c - >/dev/null`,
-    `mkdir -p "${dir}"`,
-    `tar -xzf "$t/$f" -C "${dir}" --strip-components=1`
-  ].join(" && ");
-}
-function installLine(engine2, version2, link = true) {
-  const chant = chantLines;
-  if (link && chant) {
-    const sums = pinnedSums(engine2, version2);
-    const options = { root: ENGINE_ROOT, ...Object.keys(sums).length ? { sha256: sums } : {} };
-    return engine2 === "pulumi" ? chant.pulumiInstallLine(version2, options) : chant.plungeInstallLine(version2, options);
-  }
-  return plywoodInstallLine(engine2, version2, link);
-}
-function plywoodInstallLine(engine2, version2, link = true) {
-  const dir = engineDir(engine2, version2);
-  const linkCmd = `ln -sf "${dir}/${engine2}" /usr/local/bin/${engine2}`;
-  const install = `(set -e; ${fetchScript(engine2, version2, dir, JOB_ARCH)})`;
-  return link ? `{ [ -x "${dir}/${engine2}" ] || ${install}; } && ${linkCmd}` : `[ -x "${dir}/${engine2}" ] || ${install}`;
-}
-function useChantInstallLines() {
-  loading ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi/ci-setup");
-      const ok = typeof m.ciRelease === "function" && typeof m.PINNED_SHA256 === "object" && typeof m.pulumiInstallLine === "function" && typeof m.plungeInstallLine === "function";
-      chantLines = ok ? m : void 0;
-    } catch {
-      chantLines = void 0;
-    }
-    return chantLines !== void 0;
-  })();
-  return loading;
+function installLine(engine3, version2, link = true) {
+  const sums = pinnedSums(engine3, version2);
+  const options = { root: ENGINE_ROOT, ...Object.keys(sums).length ? { sha256: sums } : {}, link };
+  return engine3 === "pulumi" ? pulumiInstallLine(version2, options) : plungeInstallLine(version2, options);
 }
 function installLines(pins) {
   const seen = /* @__PURE__ */ new Set();
@@ -710,15 +677,15 @@ function installLines(pins) {
   }
   return out;
 }
-function imageName(engine2) {
-  return `plywood-${engine2}`;
+function imageName(engine3) {
+  return `plywood-${engine3}`;
 }
-function imageTag(engine2, version2 = version) {
-  return `${version2}-${engine2}${TOOL_VERSIONS[engine2]}`;
+function imageTag(engine3, version2 = version) {
+  return `${version2}-${engine3}${TOOL_VERSIONS[engine3]}`;
 }
-function imageFor(engine2, table = image_digests_default) {
-  const repository = `${REGISTRY}/${imageName(engine2)}`;
-  const tag = imageTag(engine2);
+function imageFor(engine3, table = digests) {
+  const repository = `${REGISTRY}/${imageName(engine3)}`;
+  const tag = imageTag(engine3);
   const digest = table[`${repository}:${tag}`];
   return { repository, tag, ...digest ? { digest } : {} };
 }
@@ -730,23 +697,20 @@ function parsePlugin(s) {
   return m ? { kind: m[1] ?? "resource", name: m[2], version: m[3] } : void 0;
 }
 function chantBuildFlags(o) {
-  const lines2 = [...o.beforeScript ?? [], ...o.prLoop?.engineSetup ?? []];
+  const lines2 = o.beforeScript ?? [];
   return [...o.image ? ["--image", o.image] : [], ...lines2.flatMap((l) => ["--before-script", l])];
 }
-function chantPipelineOptions(p, chantReadsEngineSetup) {
+function chantPipelineOptions(p) {
   const lines2 = p.engineSetup ?? [];
-  const out = { ...p.image ? { image: p.image } : {}, ...p.runner !== void 0 ? { runner: p.runner } : {} };
-  if (lines2.length === 0) return out;
-  if (!p.image && chantReadsEngineSetup) out.prLoop = { engineSetup: [...lines2] };
-  else out.beforeScript = [...lines2];
-  return out;
+  return { ...p.image ? { image: p.image } : {}, ...p.runner !== void 0 ? { runner: p.runner } : {}, ...lines2.length ? { beforeScript: [...lines2] } : {} };
 }
-var REGISTRY, TOOL_VERSIONS, ARCHES, PINNED_SHA256, ENGINE_ROOT, JOB_ARCH, chantLines, loading, DIGEST, PLUGIN;
+var digests, REGISTRY, TOOL_VERSIONS, ARCHES, PINNED_SHA256, ENGINE_ROOT, DIGEST, RELEASE_LABEL_ARG, LABEL_REF, PLUGIN;
 var init_images = __esm({
   "src/images.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_package();
-    init_image_digests();
+    digests = typeof define_PLYWOOD_IMAGE_DIGESTS_default !== "undefined" ? define_PLYWOOD_IMAGE_DIGESTS_default : {};
     REGISTRY = "ghcr.io/intentius";
     TOOL_VERSIONS = {
       pulumi: "3.272.0",
@@ -761,8 +725,9 @@ var init_images = __esm({
       "plunge-v0.2.0-linux-arm64.tar.gz": "c176a82f038164085aa19c8ad6530d6022e560e124050e535dbe364ae0473357"
     };
     ENGINE_ROOT = "/opt/plywood";
-    JOB_ARCH = `"$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')"`;
     DIGEST = /@sha256:[0-9a-f]{64}$/;
+    RELEASE_LABEL_ARG = "CHANT_RELEASE_LABEL";
+    LABEL_REF = `\${${RELEASE_LABEL_ARG}}`;
     PLUGIN = /^(?:(resource|converter|language|analyzer|tool):)?([a-z0-9][a-z0-9-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
   }
 });
@@ -831,8 +796,8 @@ function userImage(doc) {
   if (typeof doc.image === "string") return doc.image;
   return isObject(doc.image) && typeof doc.image.name === "string" ? doc.image.name : void 0;
 }
-function linkedVersion(engine2, doc, versions) {
-  const top = pinFor(doc[engine2], void 0) ?? TOOL_VERSIONS[engine2];
+function linkedVersion(engine3, doc, versions) {
+  const top = pinFor(doc[engine3], void 0) ?? TOOL_VERSIONS[engine3];
   if (versions.length === 0) return top;
   const count = /* @__PURE__ */ new Map();
   for (const v of versions) count.set(v, (count.get(v) ?? 0) + 1);
@@ -843,14 +808,15 @@ var VERSION, LABEL, RUNNER_STAGES, IMAGE_KEYS, versionSchema, runnerSpecSchema,
 var init_images2 = __esm({
   "src/config/images.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_images();
     init_types();
     VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
     LABEL = /^[^\s,]+$/;
     RUNNER_STAGES = ["default", "preview", "up", "drift"];
     IMAGE_KEYS = ["name", "plugins"];
-    versionSchema = (engine2, example) => ({
-      description: `The ${engine2} release the jobs run, such as ${example}: one for every stack, or a map of stack glob to release. plywood's image's release when absent.`,
+    versionSchema = (engine3, example) => ({
+      description: `The ${engine3} release the jobs run, such as ${example}: one for every stack, or a map of stack glob to release. plywood's image's release when absent.`,
       anyOf: [
         { type: "string", pattern: VERSION.source },
         { type: "object", minProperties: 1, additionalProperties: { type: "string", pattern: VERSION.source } }
@@ -910,22 +876,22 @@ var init_images2 = __esm({
         const engineOfMember = (e) => e ?? out.memberDefaults.engine ?? "pulumi";
         const per = { pulumi: [], plunge: [] };
         const chosen = out.members.map((m) => {
-          const engine2 = engineOfMember(m.engine);
-          const version2 = pinFor(doc[engine2], m.name) ?? pinFor(doc[engine2], void 0) ?? TOOL_VERSIONS[engine2];
-          per[engine2].push(version2);
-          return { m, engine: engine2, version: version2 };
+          const engine3 = engineOfMember(m.engine);
+          const version2 = pinFor(doc[engine3], m.name) ?? pinFor(doc[engine3], void 0) ?? TOOL_VERSIONS[engine3];
+          per[engine3].push(version2);
+          return { m, engine: engine3, version: version2 };
         });
         const engines = new Set(chosen.map((c) => c.engine));
         engines.add(engineOfMember(void 0));
         if (doc.plunge !== void 0) engines.add("plunge");
         const linked = Object.fromEntries([...engines].map((e) => [e, linkedVersion(e, doc, per[e])]));
-        const pins = [...engines].map((engine2) => ({ engine: engine2, version: linked[engine2], linked: true }));
-        for (const { m, engine: engine2, version: version2 } of chosen) {
-          if (doc[engine2] !== void 0) m.engineVersion = version2;
-          if (version2 !== linked[engine2]) {
-            m.engineBin = engineBin(engine2, version2);
+        const pins = [...engines].map((engine3) => ({ engine: engine3, version: linked[engine3], linked: true }));
+        for (const { m, engine: engine3, version: version2 } of chosen) {
+          if (doc[engine3] !== void 0) m.engineVersion = version2;
+          if (version2 !== linked[engine3]) {
+            m.engineBin = engineBin(engine3, version2);
             m.engineRoot = ENGINE_ROOT;
-            pins.push({ engine: engine2, version: version2, linked: false });
+            pins.push({ engine: engine3, version: version2, linked: false });
           }
         }
         out.pipeline.engineSetup = installLines(pins);
@@ -1051,6 +1017,7 @@ var STACK_KEYS, ACTION_KEYS, WAVES_KEYS, STACK_NAME, ACTION_NAME, ACTION_TYPE_PR
 var init_stacks = __esm({
   "src/config/stacks.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_approval();
     init_types();
     STACK_KEYS = ["dir", "paths", "gate", "backend", "actions"];
@@ -1215,6 +1182,7 @@ var DRIFT_RESPONSES, DEFAULT_DRIFT_RESPONSE, EVENT_RESPONSES, EVENT_KEYS, RESPON
 var init_drift = __esm({
   "src/config/drift.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_images2();
     init_stacks();
     init_types();
@@ -1339,6 +1307,7 @@ var ENGINES, PLUNGE_URL, engine;
 var init_engine = __esm({
   "src/config/engine.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_stacks();
     init_types();
     ENGINES = ["pulumi", "plunge"];
@@ -1472,6 +1441,7 @@ var IDENTITY_CLOUDS, CLOUD_SETTINGS, SETTINGS_CLOUDS, REQUIRED, IDENTITY_KEYS, S
 var init_identity = __esm({
   "src/config/identity.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     IDENTITY_CLOUDS = ["aws", "gcp", "azure", "pulumi"];
     CLOUD_SETTINGS = {
@@ -1630,6 +1600,7 @@ var VARIABLE3, RESERVED_VARIABLES, environmentSchema, jobs;
 var init_jobs = __esm({
   "src/config/jobs.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     init_images2();
     VARIABLE3 = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -1736,6 +1707,7 @@ var LATER_KEYS, later;
 var init_later = __esm({
   "src/config/later.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     LATER_KEYS = {};
     later = {
       name: "later",
@@ -1749,10 +1721,10 @@ var init_later = __esm({
 });
 
 // src/config/locks.ts
-function lockGrainFor(doc, engine2) {
+function lockGrainFor(doc, engine3) {
   const set = locksOf(doc).grain;
   if (set) return set;
-  return engine2 ? DEFAULT_LOCK_GRAIN[engine2] : "per-engine";
+  return engine3 ? DEFAULT_LOCK_GRAIN[engine3] : "per-engine";
 }
 function locksOf(doc) {
   const l = isObject(doc.locks) ? doc.locks : {};
@@ -1770,6 +1742,7 @@ var LOCKS_WHEN, DEFAULT_LOCKS_WHEN, LOCK_GRAINS, DEFAULT_LOCK_GRAIN, CI_LOCKS_OF
 var init_locks = __esm({
   "src/config/locks.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_engine();
     init_stacks();
     init_types();
@@ -1814,11 +1787,6 @@ var init_locks = __esm({
 });
 
 // src/config/observe.ts
-function notifyForChant(notify2, chant) {
-  if (notify2.relay === void 0 || typeof chant?.NOTIFY_RELAY_FLOOR === "string") return { ...notify2 };
-  const { relay: _relay, ...rest } = notify2;
-  return rest;
-}
 function variable(v, key) {
   if (v === void 0) return [];
   return typeof v === "string" && VARIABLE4.test(v) ? [] : [error(key, "names an environment variable, such as SLACK_WEBHOOK_URL; the URL or key itself never goes in plywood.yml")];
@@ -1849,16 +1817,16 @@ function telemetryOf(doc) {
     traces: t.traces !== false
   };
 }
-var NOTIFY_EVENTS, VARIABLE4, DEFAULT_SERVICE_NAME, REPORT_SCHEMES, NEWER_SCHEMES, WEBHOOK_VAR, observe;
+var NOTIFY_EVENTS, VARIABLE4, DEFAULT_SERVICE_NAME, REPORT_SCHEMES, WEBHOOK_VAR, observe;
 var init_observe = __esm({
   "src/config/observe.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     NOTIFY_EVENTS = { "wave-waiting": "waiting", "up-refused": "refused", "up-failed": "failed", drift: "drift" };
     VARIABLE4 = /^[A-Za-z_][A-Za-z0-9_]*$/;
     DEFAULT_SERVICE_NAME = "plywood";
     REPORT_SCHEMES = ["s3", "gs", "az", "file"];
-    NEWER_SCHEMES = /* @__PURE__ */ new Set(["gs", "az"]);
     WEBHOOK_VAR = { type: "object", additionalProperties: false, required: ["webhook"], properties: { webhook: { type: "string", pattern: VARIABLE4.source, description: "The variable holding the incoming webhook's URL." } } };
     observe = {
       name: "notify, telemetry and reports",
@@ -1914,7 +1882,6 @@ var init_observe = __esm({
             if (n.relay !== void 0) {
               out.push(...variable(n.relay, "notify.relay"));
               if (n.slack === void 0 && n.teams === void 0) out.push(error("notify.relay", "needs notify.slack or notify.teams: approvals come back from a chat message"));
-              else out.push(warning("notify.relay", "needs chant >= the release after 0.124.54 (chant#4611); plywood init leaves it out of the waves spec on a chant without the relay"));
             }
             for (const chat of ["slack", "teams"]) {
               const c = n[chat];
@@ -1954,7 +1921,6 @@ var init_observe = __esm({
             out.push(...onlyKeys(r, ["url"], "reports"));
             const scheme = typeof r.url === "string" ? /^([a-z0-9]+):\/\/\S+$/.exec(r.url)?.[1] : void 0;
             if (!scheme || !REPORT_SCHEMES.includes(scheme)) out.push(error("reports.url", `is a ${REPORT_SCHEMES.map((s) => `${s}://`).join(", ")} URL`));
-            else if (NEWER_SCHEMES.has(scheme)) out.push(warning("reports.url", `${scheme}:// reports need chant >= the release after 0.124.54 (chant#4554); the pinned chant takes s3:// and file://`));
           }
         }
         return out;
@@ -1970,21 +1936,7 @@ var init_observe = __esm({
 
 // src/config/policy.ts
 import { posix } from "node:path";
-function useChantPolicySource() {
-  policySourceLoading ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/policy-source");
-      policySource = typeof m.CI_POLICY_SOURCE_FLOOR === "string" && typeof m.assertGatePolicySource === "function";
-    } catch {
-      policySource = false;
-    }
-    return policySource;
-  })();
-  return policySourceLoading;
-}
-function chantHasPolicySource() {
-  return policySource;
-}
+import { assertGatePolicySource } from "@intentius/chant/policy-source";
 function repoPath(v, key) {
   if (typeof v !== "string" || v.trim() === "") return [error(key, "is a path inside the repository")];
   if (v.startsWith("/") || v.startsWith("-") || v.split("/").includes("..")) return [error(key, `is ${JSON.stringify(v)}; give a path relative to the repository root, inside it`)];
@@ -2019,13 +1971,13 @@ function policySourceOf(doc) {
   if (!isObject(src) || typeof src.repo !== "string" || typeof src.ref !== "string") return void 0;
   return { repo: src.repo, ref: src.ref, ...typeof src.path === "string" ? { path: cleanPath(src.path) } : {} };
 }
-function chantPolicyOf(doc, chantReadsSource = chantHasPolicySource()) {
+function chantPolicyOf(doc) {
   const p = doc.policy;
   if (!isObject(p)) return void 0;
   const rego = typeof p.rego === "string" ? cleanPath(p.rego) : void 0;
   const command = Array.isArray(p.command) ? p.command : void 0;
-  const source = chantReadsSource ? policySourceOf(doc) : void 0;
-  const packs = chantReadsSource ? policyPacksOf(doc) : [];
+  const source = policySourceOf(doc);
+  const packs = policyPacksOf(doc);
   if (rego === void 0 && command === void 0 && p.engine === void 0 && p.namespace === void 0 && !source && packs.length === 0) return void 0;
   return {
     ...typeof p.engine === "string" ? { engine: p.engine } : {},
@@ -2036,26 +1988,22 @@ function chantPolicyOf(doc, chantReadsSource = chantHasPolicySource()) {
     ...packs.length ? { packs } : {}
   };
 }
-function stepPolicyPacksOf(doc, chantReadsSource = chantHasPolicySource()) {
-  return chantReadsSource && policySourceOf(doc) ? [] : policyPacksOf(doc);
+function stepPolicyPacksOf(doc) {
+  return policySourceOf(doc) ? [] : policyPacksOf(doc);
 }
-var POLICY_ENGINES, POLICY_KEYS, PACK_KEYS, SOURCE_KEYS, SOURCE_REPO, SOURCE_REF, policySource, policySourceLoading, NO_SUCH_KEY, SOURCE_NEEDS_CHANT, policy;
+var POLICY_ENGINES, POLICY_KEYS, PACK_KEYS, NO_SUCH_KEY, policy;
 var init_policy = __esm({
   "src/config/policy.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     POLICY_ENGINES = ["conftest", "opa"];
     POLICY_KEYS = ["rego", "engine", "namespace", "command", "packs", "source", "providers"];
     PACK_KEYS = ["dir", "config"];
-    SOURCE_KEYS = ["repo", "ref", "path"];
-    SOURCE_REPO = /^(https?:\/\/[^\s/]+\/\S+|ssh:\/\/[^\s/]+\/\S+|file:\/\/\/?\S+|[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:\S+)$/;
-    SOURCE_REF = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-    policySource = false;
     NO_SUCH_KEY = {
       allow_unattended: "chant's gate denies and holds only; a non-empty change always waits for a person, so there is no unattended outcome",
       outcomes: "a Rego rule's name sets its outcome: deny_* denies, hold_* holds, warn_* is a note line"
     };
-    SOURCE_NEEDS_CHANT = "is a shared policy source from a git ref, which needs chant >= the release after 0.124.54 (chant#4613's ci.policy.source); on this chant, vendor the rules into the repository, where they are read at base";
     policy = {
       name: "policy",
       keys: ["policy"],
@@ -2073,7 +2021,7 @@ var init_policy = __esm({
               type: "object",
               additionalProperties: false,
               required: ["repo", "ref"],
-              description: "A shared rule set from a git ref, fetched by the job at the ref the base names (chant >= the release after 0.124.54). packs are then paths inside it.",
+              description: "A shared rule set from a git ref, fetched by the job at the ref the base names. packs are then paths inside it.",
               properties: {
                 repo: { type: "string", description: "The repository: https://, ssh:// or file:// URL, or git@<host>:<path>." },
                 ref: { type: "string", description: "A tag, a branch or a full commit." },
@@ -2114,16 +2062,13 @@ var init_policy = __esm({
         const out = [];
         for (const k of Object.keys(p)) if (k in NO_SUCH_KEY) out.push(error(`policy.${k}`, `is not a plywood key: ${NO_SUCH_KEY[k]}`));
         if (p.source !== void 0) {
-          if (!chantHasPolicySource()) out.push(error("policy.source", SOURCE_NEEDS_CHANT));
-          else if (!isObject(p.source)) out.push(error("policy.source", "is { repo, ref, path }"));
-          else {
-            const src = p.source;
-            out.push(...onlyKeys(src, SOURCE_KEYS, "policy.source"));
-            if (typeof src.repo !== "string" || !SOURCE_REPO.test(src.repo) || src.repo.startsWith("-")) out.push(error("policy.source.repo", "is a git URL: https://, ssh://, file:// or git@<host>:<path>"));
-            if (typeof src.ref !== "string" || !SOURCE_REF.test(src.ref) || src.ref.includes("..") || src.ref.endsWith("/")) out.push(error("policy.source.ref", "is a tag, a branch or a commit"));
-            if (src.path !== void 0) out.push(...repoPath(src.path, "policy.source.path"));
-            if (p.rego !== void 0) out.push(error("policy.rego", "goes with no policy.source: with a source, policy.source.path names the Rego directory inside it"));
+          try {
+            assertGatePolicySource("policy.source", p.source);
+          } catch (e) {
+            const m = /^(\S+) (.*)$/.exec(e.message);
+            out.push(error(m?.[1] ?? "policy.source", m?.[2] ?? e.message));
           }
+          if (p.rego !== void 0) out.push(error("policy.rego", "goes with no policy.source: with a source, policy.source.path names the Rego directory inside it"));
         }
         out.push(...onlyKeys(Object.fromEntries(Object.entries(p).filter(([k]) => !(k in NO_SUCH_KEY))), POLICY_KEYS, "policy"));
         if (p.rego !== void 0) out.push(...repoPath(p.rego, "policy.rego"));
@@ -2173,6 +2118,7 @@ var DEFAULT_REVIEW_STACK_NAME, TTL, REVIEW_STACK_NAME, STACK_KEY, reviewStacks;
 var init_review_stacks = __esm({
   "src/config/review-stacks.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     DEFAULT_REVIEW_STACK_NAME = "pr-{number}";
     TTL = /^\d+[mhd]$/;
@@ -2227,6 +2173,7 @@ var FORGES, GLOB_MAP, copy, routing;
 var init_routing = __esm({
   "src/config/routing.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     FORGES = ["github", "gitlab", "forgejo"];
     GLOB_MAP = {
@@ -2322,6 +2269,7 @@ var GROUPS, CONFIG_NAMES, ConfigError;
 var init_config = __esm({
   "src/config/index.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_agents();
     init_apply();
     init_approval();
@@ -2362,6 +2310,7 @@ function toChantSettings(config2) {
 var init_chant_config = __esm({
   "src/chant-config.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_config();
   }
 });
@@ -2385,25 +2334,25 @@ function configCheck(cwd, file) {
   const lines2 = problems.map((p) => `${path}: ${p.key} ${p.message}${p.severity === "warning" ? " (warning)" : ""}`);
   if (errors.length) return { ok: false, lines: lines2, envelope: { file: path, problems } };
   const doc = config2.doc;
-  const engine2 = engineOf(doc);
+  const engine3 = engineOf(doc);
   const locks2 = locksOf(doc);
   const later2 = Object.keys(doc).filter((k) => k in LATER_KEYS);
   const settings = {
-    engine: engine2?.engine ?? null,
+    engine: engine3?.engine ?? null,
     applyWhen: applyWhenOf(doc),
     gate: gateOf(doc),
     approval: approvalOf(doc),
     locksWhen: locks2.when,
-    lockGrain: lockGrainFor(doc, engine2?.engine)
+    lockGrain: lockGrainFor(doc, engine3?.engine)
   };
   lines2.push(
     `${path}: ok`,
-    `  engine       ${engine2 ? `${engine2.engine} (${engine2.because})` : "not set here; chant reads PULUMI_BACKEND_URL, then Pulumi.yaml"}`,
+    `  engine       ${engine3 ? `${engine3.engine} (${engine3.because})` : "not set here; chant reads PULUMI_BACKEND_URL, then Pulumi.yaml"}`,
     `  apply.when   ${settings.applyWhen}`,
     `  gate         ${settings.gate}`,
     `  approval     ${settings.approval}`,
     `  locks.when   ${locks2.when} (ci.locks ${CI_LOCKS_OF[locks2.when]})`,
-    `  locks.grain  ${locks2.grain ? `${locks2.grain} (ci.lockGrain ${LOCK_GRAIN_OF[locks2.grain]})` : LOCK_GRAIN_WORDS.perEngine(engine2?.engine)}`,
+    `  locks.grain  ${locks2.grain ? `${locks2.grain} (ci.lockGrain ${LOCK_GRAIN_OF[locks2.grain]})` : LOCK_GRAIN_WORDS.perEngine(engine3?.engine)}`,
     `  policy       ${policyLine(doc)}`,
     ...later2.length ? [`  read as written, not yet passed to chant: ${later2.join(", ")}`] : []
   );
@@ -2424,6 +2373,7 @@ function policyLine(doc) {
 var init_config_check = __esm({
   "src/config-check.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_chant_config();
     init_apply();
     init_approval();
@@ -2438,315 +2388,43 @@ var init_config_check = __esm({
 });
 
 // src/chant-product.ts
-function hasChant4620(chant) {
-  return typeof chant.prCommentPreviewJob === "function" && typeof chant.PR_PREVIEW_FLOOR === "string";
-}
-function hasChant4607(chant) {
-  return typeof chant.pendingGatesByPlan === "function" && typeof chant.parseRequiresList === "function";
-}
-function needsChantMessage(what) {
-  return `${what} needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-product (chant#4550). This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
-}
-function isChantProduct(m) {
-  if (!m || typeof m !== "object") return false;
-  const r = m;
-  return REQUIRED2.every((name) => typeof r[name] === "function");
-}
 function chantProduct() {
-  cached2 ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/ci-product");
-      return isChantProduct(m) ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
-  return cached2;
+  cached ??= import("@intentius/chant/ci-product").then((m) => m);
+  return cached;
 }
-var REQUIRED2, BUILT_CHANT, cached2;
+var cached;
 var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
-    REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.59" : "unknown";
-  }
-});
-
-// src/chant-next.ts
-function hasChantRespond(chant) {
-  return typeof chant?.CI_RESPOND_FLOOR === "string";
-}
-function hasChantPrLoopFlags(chant) {
-  return typeof chant?.PR_LOOP_BUILD_FLAGS_FLOOR === "string";
-}
-function hasChantApprovalStatus(chant) {
-  return typeof chant?.APPROVAL_STATUS_FLOOR === "string";
-}
-function hasChantPullRequestApprovalStatus(chant) {
-  return typeof chant?.APPROVAL_STATUS_PULL_REQUEST_FLOOR === "string";
-}
-function hasChantWavePreview() {
-  wavePreview ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/op");
-      return typeof m.OP_WAVES_PREVIEW_FLOOR === "string";
-    } catch {
-      return false;
-    }
-  })();
-  return wavePreview;
-}
-function withWavePreview(spec, forge) {
-  const approvals = spec.approvals && typeof spec.approvals === "object" && !Array.isArray(spec.approvals) ? spec.approvals : {};
-  const next = approvals.preview !== void 0 ? spec : { ...spec, approvals: { ...approvals, preview: true } };
-  if (forge === "gitlab" || next.approvals.preview !== true || !Array.isArray(next.waves)) return next;
-  const waves = next.waves.map((w) => ({
-    ...w,
-    variables: { [WAVE_TOKEN_VARIABLE]: "${{ github.token }}", ...w.variables ?? {} }
-  }));
-  return { ...next, waves };
-}
-function chantAudit() {
-  audit ??= import("@intentius/chant/ci-audit").then((m) => m);
-  return audit;
-}
-var wavePreview, WAVE_TOKEN_VARIABLE, GITLAB_READ_TOKEN, audit;
-var init_chant_next = __esm({
-  "src/chant-next.ts"() {
-    "use strict";
-    WAVE_TOKEN_VARIABLE = "GITHUB_TOKEN";
-    GITLAB_READ_TOKEN = "CHANT_FORGE_TOKEN";
-  }
-});
-
-// src/init/own-jobs.ts
-function indentOf(line) {
-  return line.length - line.trimStart().length;
-}
-function isContent(line) {
-  const t = line.trim();
-  return t !== "" && !t.startsWith("#");
-}
-function jobBlocks(text, forge) {
-  const lines2 = text.split("\n");
-  const out = /* @__PURE__ */ new Map();
-  let start = 0;
-  let end = lines2.length;
-  let depth = 0;
-  if (forge !== "gitlab") {
-    const at = lines2.findIndex((l) => /^jobs:\s*(#.*)?$/.test(l));
-    if (at < 0) return out;
-    start = at + 1;
-    const next = lines2.findIndex((l, i) => i > at && indentOf(l) === 0 && isContent(l));
-    end = next < 0 ? lines2.length : next;
-    depth = 2;
-  }
-  let name;
-  let body = [];
-  const flush = () => {
-    if (name !== void 0) {
-      while (body.length > 0 && body[body.length - 1].trim() === "") body.pop();
-      out.set(name, body.join("\n"));
-    }
-    name = void 0;
-    body = [];
-  };
-  for (let i = start; i < end; i++) {
-    const line = lines2[i];
-    if (isContent(line) && indentOf(line) === depth) {
-      const m = KEY.exec(line.slice(depth));
-      flush();
-      if (m) {
-        name = m[1].replace(/^["']|["']$/g, "");
-        body = [line];
-      }
-      continue;
-    }
-    if (isContent(line) && indentOf(line) < depth) {
-      flush();
-      continue;
-    }
-    if (name !== void 0) body.push(line);
-  }
-  flush();
-  if (forge === "gitlab") {
-    for (const k of [...out.keys()]) if (GITLAB_KEYWORDS.has(k)) out.delete(k);
-  }
-  return out;
-}
-function ownJobs(previous, generated, forge) {
-  const ours = jobBlocks(generated, forge);
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, block] of jobBlocks(previous, forge)) {
-    if (ours.has(name) || PLYWOOD_LINE.test(block)) continue;
-    out.set(name, block);
-  }
-  return out;
-}
-function withOwnJobs(generated, own, forge) {
-  if (own.size === 0) return generated;
-  const indent = forge === "gitlab" ? "" : "  ";
-  const block = [`${indent}${OWN_JOBS_LINE}`, ...own.values()].join("\n");
-  const lines2 = generated.replace(/\n+$/, "").split("\n");
-  if (forge !== "gitlab") {
-    const at = lines2.findIndex((l) => /^jobs:\s*(#.*)?$/.test(l));
-    if (at >= 0) {
-      const next = lines2.findIndex((l, i) => i > at && indentOf(l) === 0 && isContent(l));
-      if (next >= 0) {
-        let cut = next;
-        while (cut > at + 1 && lines2[cut - 1].trim() === "") cut--;
-        return [...lines2.slice(0, cut), block, ...lines2.slice(cut)].join("\n") + "\n";
-      }
-    }
-  }
-  return [...lines2, block].join("\n") + "\n";
-}
-function keepOwnJobs(previous, generated, forge) {
-  if (previous === void 0) return { text: generated, kept: [] };
-  const own = ownJobs(previous, generated, forge);
-  return { text: withOwnJobs(generated, own, forge), kept: [...own.keys()] };
-}
-var OWN_JOBS_LINE, GITLAB_KEYWORDS, PLYWOOD_LINE, KEY;
-var init_own_jobs = __esm({
-  "src/init/own-jobs.ts"() {
-    "use strict";
-    OWN_JOBS_LINE = "# Your own jobs, kept as they are by plywood init and plywood ci.";
-    GITLAB_KEYWORDS = /* @__PURE__ */ new Set(["default", "include", "stages", "variables", "workflow", "image", "services", "cache", "before_script", "after_script", "spec"]);
-    PLYWOOD_LINE = /\bplywood\b\s+(components|ci|run|lock|unlock|check|preview|up|drift)\b/;
-    KEY = /^([A-Za-z0-9_.-]+|"[^"]+"|'[^']+'):(\s|$)/;
-  }
-});
-
-// src/init/note-control.ts
-import { emitYAML } from "@intentius/chant/yaml";
-function indentOf2(line) {
-  return line.length - line.trimStart().length;
-}
-function jobRange(lines2, name, depth) {
-  const head = new RegExp(`^${" ".repeat(depth)}${name}:\\s*(#.*)?$`);
-  const start = lines2.findIndex((l) => head.test(l));
-  if (start < 0) return void 0;
-  let end = lines2.length;
-  for (let i = start + 1; i < lines2.length; i++) {
-    const l = lines2[i];
-    if (l.trim() === "" || l.trimStart().startsWith("#")) continue;
-    if (indentOf2(l) <= depth) {
-      end = i;
-      break;
-    }
-  }
-  return [start, end];
-}
-function withNoteControl(text, forge, step) {
-  if (!step) return text;
-  const lines2 = text.split("\n");
-  const range = jobRange(lines2, NOTE_JOB, forge === "gitlab" ? 0 : 2);
-  if (!range) return text;
-  const [start, end] = range;
-  const job = lines2.slice(start, end);
-  if (job.some((l) => l.includes(step.stepName)) || job.some((l) => l.includes("CHANT_CONTROL_DIR="))) return text;
-  if (forge === "gitlab") {
-    const at2 = job.findIndex((l) => /^ {4}- /.test(l) && l.includes("components pr-post"));
-    if (at2 < 0) return text;
-    const item2 = emitYAML([step.script], 2).replace(/^\n/, "");
-    return [...lines2.slice(0, start + at2), ...item2.split("\n"), ...lines2.slice(start + at2)].join("\n");
-  }
-  const at = job.findIndex((l) => /^ {6}- name: Post the plan note\b/.test(l));
-  if (at < 0) return text;
-  const item = emitYAML([{ name: step.stepName, if: "always()", ...Object.keys(step.env).length ? { env: step.env } : {}, run: step.script }], 3).replace(/^\n/, "");
-  return [...lines2.slice(0, start + at), ...item.split("\n"), ...lines2.slice(start + at)].join("\n");
-}
-var NOTE_JOB;
-var init_note_control = __esm({
-  "src/init/note-control.ts"() {
-    "use strict";
-    NOTE_JOB = "plan-note";
-  }
-});
-
-// src/init/run-group.ts
-function withRunGroup(text, forge, key) {
-  if (forge !== "forgejo" || TOP_CONCURRENCY.test(text)) return text;
-  const jobs2 = TOP_JOBS.exec(text);
-  if (!jobs2) return text;
-  const name = (TOP_NAME.exec(text)?.[1] ?? "plywood").replace(/^["']|["']$/g, "");
-  const group = key === "commit" ? `${name}-\${{ github.event_name }}-\${{ github.sha }}` : `${name}-\${{ github.event_name == 'pull_request' && github.ref || github.run_id }}`;
-  const cancel = key === "commit" ? "false" : "${{ github.event_name == 'pull_request' }}";
-  const block = [
-    "# Without a group Forgejo cancels the run in progress when a push starts another run of this workflow.",
-    key === "commit" ? "# One group for each commit keeps a merge's wave jobs running to completion when another merge lands (plywood#51)." : "# A push to main and a comment get a group of their own, so the record job runs to completion (plywood#51).",
-    "concurrency:",
-    `  group: ${yamlScalar(group)}`,
-    `  cancel-in-progress: ${yamlScalar(cancel)}`,
-    "",
-    ""
-  ].join("\n");
-  return text.slice(0, jobs2.index) + block + text.slice(jobs2.index);
-}
-function yamlScalar(value) {
-  return value === "false" ? value : JSON.stringify(value);
-}
-var TOP_CONCURRENCY, TOP_JOBS, TOP_NAME;
-var init_run_group = __esm({
-  "src/init/run-group.ts"() {
-    "use strict";
-    TOP_CONCURRENCY = /^concurrency:/m;
-    TOP_JOBS = /^jobs:/m;
-    TOP_NAME = /^name:\s*(.+?)\s*$/m;
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
 // src/init/workflow.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
+import { jobBlocks, ownJobsOf } from "@intentius/chant/ci-own-jobs";
 async function writeWorkflow(chant, input) {
   const file = isAbsolute(input.output) ? input.output : join2(input.root, input.output);
   const previous = existsSync2(file) ? readFileSync2(file, "utf8") : void 0;
   mkdirSync(dirname2(file), { recursive: true });
-  const code = await chant.runChantInProcess([...input.argv, "--output", file], input.words);
+  const code = await chant.runChantInProcess([...input.argv, "--keep-own-jobs", "--run-group", "pull-request", "--output", file], input.words);
   if (code !== 0 || !existsSync2(file)) {
     if (previous !== void 0) writeFileSync(file, previous);
     return { code: code !== 0 ? code : 1, file, status: "failed", kept: [] };
   }
-  const generated = withRunGroup(withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl), input.forge, "pull-request");
-  const { text, kept } = keepOwnJobs(previous, generated, input.forge);
-  writeFileSync(file, text);
+  const text = readFileSync2(file, "utf8");
+  const kept = previous === void 0 ? [] : keptJobs(previous, text, input.forge, input.words.bin);
   return { code, file, status: text === previous ? "unchanged" : "written", kept };
 }
+function keptJobs(previous, written, forge, bin) {
+  const now = jobBlocks(written, forge);
+  return [...ownJobsOf(previous, "", forge, bin ? [bin] : [])].filter(([name, block]) => now.get(name) === block).map(([name]) => name);
+}
 var init_workflow = __esm({
   "src/init/workflow.ts"() {
     "use strict";
-    init_own_jobs();
-    init_note_control();
-    init_run_group();
-  }
-});
-
-// src/review-stacks.ts
-function chantReviewStacks() {
-  cached3 ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      const plugin = m.pulumiPlugin;
-      return typeof m.initReviewStack === "function" && typeof m.removeReviewStack === "function" && typeof plugin?.prEnvTemplate === "function" && typeof plugin?.prEnvTeardown === "function";
-    } catch {
-      return false;
-    }
-  })();
-  return cached3;
-}
-function reviewSuffixOf(pattern) {
-  const m = pattern ? /^pr-\{number\}-([a-z0-9][a-z0-9-]*)$/.exec(pattern) : null;
-  return m ? m[1] : void 0;
-}
-var REVIEW_GATE, REVIEW_GATE_WORD, reviewOp, cached3, REVIEW_STACKS_NEED_CHANT;
-var init_review_stacks2 = __esm({
-  "src/review-stacks.ts"() {
-    "use strict";
-    REVIEW_GATE = "pr-env";
-    REVIEW_GATE_WORD = "review";
-    reviewOp = (pr) => `pr-${pr}`;
-    REVIEW_STACKS_NEED_CHANT = "review_stacks is set, and the installed @intentius/chant-lexicon-pulumi cannot run a review stack end to end (initReviewStack, removeReviewStack, and the plugin's prEnvTemplate and prEnvTeardown from chant#4609), so plywood writes no ci.prEnvironment and the workflow has no review stack jobs yet";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
@@ -2754,11 +2432,11 @@ var init_review_stacks2 = __esm({
 import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname as dirname3, join as join3 } from "node:path";
 function wavesEngine(pipeline) {
-  const o = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} }, false);
+  const o = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} });
   return { ...o.image ? { image: o.image } : {}, ...o.beforeScript?.length ? { beforeScript: o.beforeScript } : {} };
 }
-function wavesSpecText(spec, engine2 = {}) {
-  const options = { ...engine2.image ? { image: engine2.image } : {}, ...engine2.beforeScript?.length ? { beforeScript: engine2.beforeScript } : {} };
+function wavesSpecText(spec, engine3 = {}) {
+  const options = { ...engine3.image ? { image: engine3.image } : {}, ...engine3.beforeScript?.length ? { beforeScript: engine3.beforeScript } : {} };
   return JSON.stringify(Object.keys(options).length ? { waves: spec, options } : spec, null, 2) + "\n";
 }
 function unwrapWavesSpec(doc) {
@@ -2821,28 +2499,13 @@ function writeUpOp(cwd, spec) {
   writeFileSync2(path, text);
   return true;
 }
-function binLines(waves, bin) {
-  const binArgs = bin.split(/\s+/).filter(Boolean);
-  return waves.jobs.map((job) => {
-    const own = job.command.slice(0, binArgs.length).join(" ") === binArgs.join(" ");
-    const rest = own ? job.command.slice(binArgs.length) : job.command.slice(1);
-    return { chant: ["chant", ...rest].join(" "), product: [...binArgs, ...rest].join(" ") };
-  });
-}
-function withBinLines(text, lines2) {
-  const sorted = [...lines2].sort((a, b) => b.chant.length - a.chant.length);
-  return text.replace(/chant run wave [^\n"']*/g, (found) => {
-    const hit = sorted.find((l) => found.trimEnd() === l.chant);
-    return hit ? hit.product : found;
-  });
-}
 function generatedFor(dir, specFile) {
   if (!existsSync3(dir)) return [];
   return readdirSync(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join3(dir, f)).filter((p) => (readFileSync3(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
 }
-async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}) {
+async function writeWaveJobs(chant, forge, waves, words, table, io, engine3 = {}) {
   const specPath = join3(io.cwd, waves.specFile);
-  const specText = wavesSpecText(waves.spec, engine2);
+  const specText = wavesSpecText(waves.spec, engine3);
   const before = existsSync3(specPath) ? readFileSync3(specPath, "utf8") : void 0;
   if (before !== specText) {
     mkdirSync2(dirname3(specPath), { recursive: true });
@@ -2851,18 +2514,14 @@ async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}
   }
   if (writeUpOp(io.cwd, waves.spec)) io.err(`${PRODUCT} ci: wrote ${UP_OP_FILE}, the Op the waves spec names; commit it with the workflow`);
   const outDir = WAVES_OUTPUT_DIR[forge];
-  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", waves.specFile, "--output", outDir], words);
+  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", waves.specFile, "--run-group", "commit", "--output", outDir], words);
   if (code !== table.done) return code;
   const files = generatedFor(join3(io.cwd, outDir), waves.specFile);
   if (files.length === 0) {
     io.err(`${PRODUCT} ci: chant wrote no waves workflow for ${waves.specFile} under ${outDir}`);
     return table.failed;
   }
-  const lines2 = hasChant4607(chant) ? void 0 : binLines(waves, words.bin);
   for (const file of files) {
-    const text = readFileSync3(file, "utf8");
-    const next = withRunGroup(lines2 ? withBinLines(text, lines2) : text, forge, "commit");
-    if (next !== text) writeFileSync2(file, next);
     io.err(`${PRODUCT} ci: waves workflow at ${file.slice(io.cwd.length + 1)}`);
   }
   if (forge === "gitlab") {
@@ -2874,9 +2533,8 @@ var WAVES_OUTPUT_DIR, UP_OP_FILE;
 var init_waves_workflow = __esm({
   "src/waves-workflow.ts"() {
     "use strict";
-    init_chant_product();
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_images();
-    init_run_group();
     init_words();
     WAVES_OUTPUT_DIR = {
       github: ".github/workflows",
@@ -2887,12 +2545,34 @@ var init_waves_workflow = __esm({
   }
 });
 
+// src/chant-next.ts
+function withWavePreview(spec, forge) {
+  const approvals = spec.approvals && typeof spec.approvals === "object" && !Array.isArray(spec.approvals) ? spec.approvals : {};
+  const next = approvals.preview !== void 0 ? spec : { ...spec, approvals: { ...approvals, preview: true } };
+  if (forge === "gitlab" || next.approvals.preview !== true || !Array.isArray(next.waves)) return next;
+  const waves = next.waves.map((w) => ({
+    ...w,
+    variables: { [WAVE_TOKEN_VARIABLE]: "${{ github.token }}", ...w.variables ?? {} }
+  }));
+  return { ...next, waves };
+}
+function chantAudit() {
+  audit ??= import("@intentius/chant/ci-audit").then((m) => m);
+  return audit;
+}
+var WAVE_TOKEN_VARIABLE, GITLAB_READ_TOKEN, audit;
+var init_chant_next = __esm({
+  "src/chant-next.ts"() {
+    "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
+    WAVE_TOKEN_VARIABLE = "GITHUB_TOKEN";
+    GITLAB_READ_TOKEN = "CHANT_FORGE_TOKEN";
+  }
+});
+
 // src/agent-jobs.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname4, join as join4 } from "node:path";
-function hasChantAgent(chant) {
-  return typeof chant?.CI_AGENT_FLOOR === "string";
-}
 function stageRunner(runner, stage) {
   if (runner === void 0) return void 0;
   if (typeof runner === "string" || Array.isArray(runner) || "group" in runner) return runner;
@@ -2915,22 +2595,21 @@ function chantAgentOptions(a, doc) {
   };
 }
 function driftOpFields(chant, doc, op, respond) {
-  if (!hasChantAgent(chant)) return {};
   const runner = stageRunner(toChantSettings({ doc }).pipeline.runner, "drift");
   const a = agentOf(doc);
   const wantsAgent = respond === "pull-request" && a?.drift === true;
-  const agent = wantsAgent ? chant.productDriftAgent ? chant.productDriftAgent(PRODUCT_WORDS, op, chantAgentOptions(a, doc)) : { on: "drift", ...chantAgentOptions(a, doc) } : void 0;
+  const agent = wantsAgent ? chant.productDriftAgent(PRODUCT_WORDS, op, chantAgentOptions(a, doc)) : void 0;
   return { ...runner !== void 0 ? { runner } : {}, ...agent ? { agent } : {} };
 }
 function agentOpSpec(spec, doc) {
   const p = toChantSettings({ doc }).pipeline;
-  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
+  const engine3 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} });
   const runner = stageRunner(p.runner, "preview");
   return {
     ops: [{ ...spec, ...runner !== void 0 && spec.runner === void 0 ? { runner } : {} }],
     options: {
-      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
-      ...engine2.image ? { image: engine2.image } : {}
+      ...engine3.beforeScript ? { beforeScript: engine3.beforeScript } : {},
+      ...engine3.image ? { image: engine3.image } : {}
     }
   };
 }
@@ -2944,10 +2623,6 @@ function writeIfChanged(cwd, file, text) {
 async function writeAgentJobs(chant, forge, env, doc, words, table, io) {
   const a = agentOf(doc);
   if (!a?.comment) return table.done;
-  if (!hasChantAgent(chant)) {
-    io.err(`${PRODUCT} ci: ${AGENT_NEEDS_CHANT}`);
-    return table.done;
-  }
   const agentWords = { ...words, commands: { ...words.commands, agent: "agent" } };
   let spec;
   try {
@@ -2973,10 +2648,11 @@ async function writeAgentJobs(chant, forge, env, doc, words, table, io) {
   if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab a pipeline of the default branch started with CHANT_AGENT_PR and CHANT_AGENT_ASK runs the agent; scope CHANT_FORGE_TOKEN to environment ${AGENT_OP}-push`);
   return table.done;
 }
-var AGENT_OP, AGENT_SPEC_FILE, AGENT_NEEDS_CHANT, OP_OUTPUT_DIR;
+var AGENT_OP, AGENT_SPEC_FILE, OP_OUTPUT_DIR;
 var init_agent_jobs = __esm({
   "src/agent-jobs.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_chant_config();
     init_agents();
     init_config();
@@ -2984,7 +2660,6 @@ var init_agent_jobs = __esm({
     init_words();
     AGENT_OP = "plywood-agent";
     AGENT_SPEC_FILE = ".chant/ops/plywood-agent.spec.json";
-    AGENT_NEEDS_CHANT = "agent needs a chant with the agent job (chant#4616), and the installed one has none, so no agent job was written";
     OP_OUTPUT_DIR = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
   }
 });
@@ -3003,7 +2678,6 @@ async function sendDriftNotice(input) {
   const drifted = input.results.filter((r) => r.ok && r.drifted > 0);
   if (drifted.length === 0) return void 0;
   const fingerprint = runFingerprint(input.results, input.stackFingerprint);
-  if (!input.chant) return { sent: false, reason: DRIFT_NOTIFY_NEEDS_CHANT, fingerprint };
   if (drifted.every((r) => r.issue?.action === "unchanged")) {
     return { sent: false, reason: "no drift event was sent: every drifted stack's finding is the one its issue already holds", fingerprint };
   }
@@ -3021,62 +2695,39 @@ async function sendDriftNotice(input) {
 }
 function chantDriftNotify() {
   loaded ??= (async () => {
-    try {
-      const product = await import("@intentius/chant/ci-product");
-      const notify2 = await import("@intentius/chant/notify");
-      const fns = [product.driftNotifyFields, product.productSendOptions, notify2.makeNotifyEvent, notify2.sendNotify];
-      if (!fns.every((f) => typeof f === "function")) return void 0;
-      return {
-        driftNotifyFields: product.driftNotifyFields,
-        productSendOptions: product.productSendOptions,
-        makeNotifyEvent: notify2.makeNotifyEvent,
-        sendNotify: notify2.sendNotify
-      };
-    } catch {
-      return void 0;
-    }
+    const product = await import("@intentius/chant/ci-product");
+    const notify2 = await import("@intentius/chant/notify");
+    return {
+      driftNotifyFields: product.driftNotifyFields,
+      productSendOptions: product.productSendOptions,
+      makeNotifyEvent: notify2.makeNotifyEvent,
+      sendNotify: notify2.sendNotify
+    };
   })();
   return loaded;
 }
-var DRIFT_NOTIFY_NEEDS_CHANT, loaded;
+var loaded;
 var init_drift_notify = __esm({
   "src/drift-notify.ts"() {
     "use strict";
-    DRIFT_NOTIFY_NEEDS_CHANT = "no drift event was sent: the installed chant has no driftNotifyFields (chant#4610)";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
 // src/jobs.ts
 var jobs_exports = {};
 __export(jobs_exports, {
-  JOBS_NEED_CHANT: () => JOBS_NEED_CHANT,
   environmentFor: () => environmentFor,
   groupName: () => groupName,
-  hasChant4625: () => hasChant4625,
   jobVariables: () => jobVariables,
   prJobsFor: () => prJobsFor,
   prLoopJobFlags: () => prLoopJobFlags,
   prLoopJobOptions: () => prLoopJobOptions,
   prLoopRunners: () => prLoopRunners,
   secretReference: () => secretReference,
-  setChant4625ForTests: () => setChant4625ForTests,
   wantsChant4625: () => wantsChant4625,
   withJobSettings: () => withJobSettings
 });
-function hasChant4625() {
-  detected ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/parallelism");
-      return typeof m.mapLimited === "function" && typeof m.parallelismProblem === "function";
-    } catch {
-      return false;
-    }
-  })();
-  return detected;
-}
-function setChant4625ForTests(has) {
-  detected = has === "reset" ? void 0 : Promise.resolve(has);
-}
 function secretReference(forge, secret) {
   return forge === "gitlab" ? `$${secret}` : `\${{ secrets.${secret} }}`;
 }
@@ -3099,7 +2750,7 @@ function groupName(environment, taken) {
   taken.add(name);
   return name;
 }
-function withJobSettings(spec, s, forge, opts) {
+function withJobSettings(spec, s, forge) {
   const variables = jobVariables(forge, s);
   const waves = (Array.isArray(spec.waves) ? spec.waves : []).map((wave) => {
     const out = { ...wave };
@@ -3128,7 +2779,7 @@ function withJobSettings(spec, s, forge, opts) {
     out.groups = [...byEnv.values()].map((g) => ({ name: groupName(g.environment, taken), runs: g.runs, ...g.environment ? { environment: { ...g.environment } } : {} }));
     return out;
   });
-  return { ...spec, waves, ...opts.parallelism && s.parallelism !== void 0 && spec.step !== void 0 ? { parallelism: s.parallelism } : {} };
+  return { ...spec, waves, ...s.parallelism !== void 0 && spec.step !== void 0 ? { parallelism: s.parallelism } : {} };
 }
 function prLoopRunners(runner) {
   if (runner === void 0) return void 0;
@@ -3164,24 +2815,15 @@ function wantsChant4625(s, runner) {
 }
 async function prJobsFor(pipeline) {
   if (!wantsChant4625(pipeline.jobs, pipeline.runner)) return { options: {}, flags: [], notes: [] };
-  if (!await hasChant4625()) {
-    const asked = [
-      ...pipeline.runner !== void 0 ? ["runners"] : [],
-      ...pipeline.jobs && Object.keys(pipeline.jobs.variables).length ? ["env"] : [],
-      ...pipeline.jobs && Object.keys(pipeline.jobs.secrets).length ? ["pass"] : [],
-      ...pipeline.jobs?.parallelism !== void 0 ? ["parallelism"] : []
-    ];
-    return { options: {}, flags: [], notes: [`${asked.join(", ")} on the pull request jobs ${JOBS_NEED_CHANT}; the waves and drift jobs have ${asked.filter((k) => k !== "parallelism").join(", ") || "none of them"}`] };
-  }
   const { flags, notes } = prLoopJobFlags(pipeline.jobs, pipeline.runner);
   return { options: prLoopJobOptions(pipeline.jobs, pipeline.runner), flags, notes };
 }
-var detected, JOBS_NEED_CHANT, GROUP_NAME;
+var GROUP_NAME;
 var init_jobs2 = __esm({
   "src/jobs.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_images2();
-    JOBS_NEED_CHANT = "needs chant's runners, variables, passed secrets and parallelism on the pull request jobs (chant#4625), which this chant lacks";
     GROUP_NAME = /[^a-z0-9_-]+/g;
   }
 });
@@ -3399,6 +3041,7 @@ var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
 var init_detect = __esm({
   "src/init/detect.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
     MAX_DEPTH = 8;
     ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
@@ -3418,6 +3061,7 @@ function fill(text, values) {
 var init_templates = __esm({
   "src/templates.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
@@ -3503,6 +3147,7 @@ function wavesSpec(input) {
     step: { kind: "pulumi-up" },
     ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
     ...input.notify ? { notify: input.notify } : {},
+    ...input.policy ? { holds: { policy: true } } : {},
     waves: waves.map((w) => {
       const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
       return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
@@ -3546,6 +3191,7 @@ var WAVE_NAME, STRICTNESS, MEMBER_NAME, PULUMI_LEXICON;
 var init_render = __esm({
   "src/init/render.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_templates();
     init_words();
     init_detect();
@@ -3599,11 +3245,28 @@ var REFUSALS;
 var init_refusals = __esm({
   "src/refusals.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_words();
     REFUSALS = ["waiting", "moved", "held", "superseded", "denied", "declined", "misplaced"];
   }
 });
 
+// src/review-stacks.ts
+function reviewSuffixOf(pattern) {
+  const m = pattern ? /^pr-\{number\}-([a-z0-9][a-z0-9-]*)$/.exec(pattern) : null;
+  return m ? m[1] : void 0;
+}
+var REVIEW_GATE, REVIEW_GATE_WORD, reviewOp;
+var init_review_stacks2 = __esm({
+  "src/review-stacks.ts"() {
+    "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
+    REVIEW_GATE = "pr-env";
+    REVIEW_GATE_WORD = "review";
+    reviewOp = (pr) => `pr-${pr}`;
+  }
+});
+
 // src/up.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
 import { join as join6 } from "node:path";
@@ -3713,8 +3376,7 @@ function approvalStatusTarget(opts, doc, env) {
   return { ...forge ? { forge } : {}, ...branch ? { branch } : {} };
 }
 async function refreshApprovalStatus(chant, spec, opts, io) {
-  if (!hasChantPullRequestApprovalStatus(chant)) return;
-  const posts = chant.opWavesPostsApprovalStatus ? chant.opWavesPostsApprovalStatus(spec) : wavesTakePullRequestApproval(spec);
+  const posts = chant.opWavesPostsApprovalStatus(spec);
   if (!posts) return;
   const path = findConfig(io.cwd);
   const doc = path ? loadConfig(path).doc : void 0;
@@ -3730,7 +3392,6 @@ async function refreshApprovalStatus(chant, spec, opts, io) {
 }
 async function upTargetByPlan(chant, digest, opts = {}) {
   const needsPr = `the ${PR_GATE} gate is a pull request's: name it with --pr <n> (or PR_NUMBER), or approve pr-<n>`;
-  if (!hasChant4607(chant)) return { error: `${needsPr}. The installed chant cannot find a pull request from a plan digest (chant#4607)` };
   let gates;
   try {
     gates = await chant.pendingGatesByPlan(digest, { pullRequestsOnly: true, ...opts.cwd ? { cwd: opts.cwd } : {} });
@@ -3860,8 +3521,6 @@ async function upBeforeMerge(number, args, json, table, io) {
   const forge = forgeFlag.value ?? configured ?? "github";
   if (!FORGES.includes(forge)) return usage(`--forge ${forge} is not one of ${FORGES.join(", ")}`, table, io);
   return withChant(`/${PRODUCT} up`, table, io, async (chant) => {
-    const note = requiresNotHonoured(chant, config2.doc);
-    if (note) io.err(`${PRODUCT}: ${note}`);
     const argv = [
       "components",
       "pr-apply",
@@ -3911,12 +3570,11 @@ var OVERRIDE_OP, WAVES_SPEC_FILE, UP_STEP_KIND, PR_OP, APPROVE_PASS, APPROVE_SWI
 var init_up = __esm({
   "src/up.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_apply();
-    init_chant_next();
     init_config();
     init_routing();
     init_refusals();
-    init_chant_product();
     init_review_stacks2();
     init_stages();
     init_words();
@@ -3999,7 +3657,10 @@ async function drift2(args, json, table, io) {
     try {
       const attribute = await attributionFor(doc, io);
       const root = dirname6(path);
-      for (const stack of stacks2) results.push(await readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
+      for (const stack of stacks2) {
+        const backend = stacksOf(doc)[stack]?.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
+        results.push(await withBackend(backend, () => readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} })));
+      }
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -4022,9 +3683,7 @@ async function drift2(args, json, table, io) {
       }
     }
     if (respond === "pull-request" && results.some((r) => r.drifted > 0)) {
-      io.err(
-        hasChantAgent(chant) ? `${PRODUCT} drift: respond.drift is pull-request; in CI the agent job after this one opens or updates the pull request (agent.drift)` : `${PRODUCT} drift: respond.drift is pull-request; this chant has no agent job (chant#4616), so this run kept the issue only`
-      );
+      io.err(`${PRODUCT} drift: respond.drift is pull-request; in CI the agent job after this one opens or updates the pull request (agent.drift)`);
     }
     const notice = await driftNotice(chant, doc, results, envFlag.value, io);
     const drifted = results.filter((r) => r.drifted > 0).map((r) => r.stack);
@@ -4062,12 +3721,12 @@ async function drift2(args, json, table, io) {
 }
 async function driftNotice(chant, doc, results, environment, io) {
   const notify2 = chantNotifyOf(doc);
-  const loaded2 = notifiesDrift(notify2) ? await chantDriftNotify() : void 0;
+  if (!notifiesDrift(notify2)) return void 0;
   return sendDriftNotice({
     notify: notify2,
     results,
     stackFingerprint: driftFingerprint,
-    chant: loaded2 ? { ...loaded2, words: chant.assertProductWords(PRODUCT_WORDS) } : void 0,
+    chant: { ...await chantDriftNotify(), words: chant.assertProductWords(PRODUCT_WORDS) },
     env: io.env,
     ...environment ? { environment } : {},
     log: io.err,
@@ -4106,9 +3765,26 @@ async function readStack(chant, stack, member, dir, opts) {
     return { stack, ok: false, drifted: 0, rows: [], error: doc?.error ? `${doc.error.code}: ${doc.error.message}` : `chant workspace drift exited ${code}` };
   }
   const rows = driftRows(doc);
+  const unread = (doc.records ?? []).filter((r) => r.status === "not-observed");
+  if (rows.length === 0 && unread.length > 0) {
+    const first = unread[0];
+    const why = first.unobserved?.detail ?? first.unobserved?.reason ?? "no reason given";
+    return { stack, ok: false, drifted: 0, rows: [], error: `${unread.length} resource${unread.length === 1 ? "" : "s"} could not be read, so the stack's drift is unknown: ${first.address}: ${why}` };
+  }
   const attribution = rows.length && opts.attribute ? await attributeStack(opts.attribute, stack, doc) : void 0;
   return { stack, ok: true, drifted: rows.length, rows, observedAt: observedAt(doc), ...attribution ? { attribution } : {} };
 }
+async function withBackend(backend, read) {
+  if (backend === void 0) return read();
+  const before = process.env.PULUMI_BACKEND_URL;
+  process.env.PULUMI_BACKEND_URL = backend;
+  try {
+    return await read();
+  } finally {
+    if (before === void 0) delete process.env.PULUMI_BACKEND_URL;
+    else process.env.PULUMI_BACKEND_URL = before;
+  }
+}
 async function attributionFor(doc, io) {
   const logs = driftSettingsOf(doc).auditLogs;
   if (!logs) return void 0;
@@ -4165,20 +3841,19 @@ function driftOpFile(doc, stacks2, schedule) {
 }
 function driftOpSpec(doc, forge, stacks2, schedule, chant, opts = {}) {
   const respond = driftResponseOf(doc);
-  const agentJob = hasChantAgent(chant) && respond === "pull-request";
-  const findingMode = respond === "none" ? "report" : respond === "pull-request" && !agentJob ? forge === "gitlab" ? "merge-request" : "pull-request" : "issue";
+  const findingMode = respond === "none" ? "report" : "issue";
   const pipeline = toChantSettings({ doc }).pipeline;
-  const engine2 = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} }, false);
+  const engine3 = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} });
   return {
-    ops: stacks2.map((s) => ({ name: driftOpName(s), trigger: { kind: "cron", schedule }, findingMode, ...driftOpFields(chant, doc, driftOpName(s), respond), ...withNotifyVariables(driftJobFields(forge, pipeline.jobs, s), driftNotifyVariables(forge, chantNotifyOf(doc))), ...opts.cloud ? driftCloudFields(doc, forge, s, respond, opts.env ?? "production", { contentsWrite: opts.contentsWrite === true }) : {} })),
+    ops: stacks2.map((s) => ({ name: driftOpName(s), trigger: { kind: "cron", schedule }, findingMode, ...driftOpFields(chant, doc, driftOpName(s), respond), ...withNotifyVariables(driftJobFields(forge, pipeline.jobs, s), driftNotifyVariables(forge, chantNotifyOf(doc))), ...opts.cloud ? driftCloudFields(doc, forge, s, respond, opts.env ?? "production") : {} })),
     options: {
       runCommand: [...BIN.split(/\s+/), "drift", "--op", "{name}", "--forge", forge],
-      beforeScript: [SNAPSHOTS_FETCH, ...engine2.beforeScript ?? []],
-      ...engine2.image ? { image: engine2.image } : {}
+      beforeScript: [SNAPSHOTS_FETCH, ...engine3.beforeScript ?? []],
+      ...engine3.image ? { image: engine3.image } : {}
     }
   };
 }
-function driftCloudFields(doc, forge, stack, respond, env, opts = {}) {
+function driftCloudFields(doc, forge, stack, respond, env) {
   const settings = toChantSettings({ doc });
   const decl = settings.ci.identity?.cloud;
   const ids = decl ? resolveTargetCloudIdentity(decl, env, stack, stack) : void 0;
@@ -4187,7 +3862,7 @@ function driftCloudFields(doc, forge, stack, respond, env, opts = {}) {
   const waves = wavesHolding(doc, [stack]);
   const command = waves === "all" ? `${BIN} up` : waves.map((k) => `${BIN} up --wave ${k}`).join(" && ");
   const fields = driftJobFields(forge, settings.pipeline.jobs, stack);
-  const permissions = opts.contentsWrite && forge !== "gitlab" ? { permissions: { contents: "write" } } : {};
+  const permissions = forge !== "gitlab" ? { permissions: { contents: "write" } } : {};
   out.update = { command, ...ids?.apply ? { cloud: ids.apply } : {}, ...fields, ...permissions };
   return out;
 }
@@ -4221,7 +3896,7 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
     return table.done;
   }
   if (writeIfChanged2(io.cwd, DRIFT_OP_FILE, driftOpFile(doc, settings.stacks, settings.schedule))) io.err(`${PRODUCT} ci: wrote ${DRIFT_OP_FILE}; commit it with the workflow`);
-  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: true, contentsWrite: true, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
+  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: true, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
@@ -4235,6 +3910,7 @@ var DRIFT_OP_FILE, DRIFT_SPEC_FILE, SNAPSHOTS_REF, SNAPSHOTS_FETCH, DRIFT_STATUS
 var init_drift2 = __esm({
   "src/drift.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_chant_next();
     init_images2();
     init_chant_config();
@@ -4272,6 +3948,7 @@ var TIPS;
 var init_tips = __esm({
   "src/tips.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     TIPS = [
       {
         id: "rename-without-aliases",
@@ -4388,9 +4065,6 @@ async function mcp(args, _json, table, io) {
   if (report.missing) return usage("--report-url takes a URL", table, io);
   if (report.rest.length) return usage(`mcp does not take ${report.rest.join(" ")}`, table, io);
   return withChant(`${PRODUCT} mcp`, table, io, (chant) => {
-    if (typeof chant.PRODUCT_MCP_HOOK_FLOOR !== "string") {
-      io.err(`${PRODUCT} mcp: this chant has no product tool hook (chant#4555), so the server serves chant's read tools and none of ${PRODUCT}'s`);
-    }
     const argv = ["serve", "mcp", "--read-only", ...propose ? ["--propose"] : []];
     return chant.runChantInProcess(argv, PRODUCT_WORDS, { mcp: plywoodMcpHook(report.value, propose) });
   });
@@ -4426,7 +4100,7 @@ function reviewOpFile(doc) {
 function reviewOpSpec(doc) {
   const settings = toChantSettings({ doc });
   const p = settings.pipeline;
-  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
+  const engine3 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} });
   return {
     ops: [
       {
@@ -4438,8 +4112,8 @@ function reviewOpSpec(doc) {
       }
     ],
     options: {
-      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
-      ...engine2.image ? { image: engine2.image } : {}
+      ...engine3.beforeScript ? { beforeScript: engine3.beforeScript } : {},
+      ...engine3.image ? { image: engine3.image } : {}
     }
   };
 }
@@ -4469,6 +4143,7 @@ var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE
 var init_agents2 = __esm({
   "src/agents.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_chant_config();
     init_config_check();
     init_agents();
@@ -4505,6 +4180,7 @@ var PROVIDERS_PACK_DIR, PROVIDERS_PACK_CONFIG, PROVIDERS_REGO_FILE, PROVIDERS_PO
 var init_policy_presets = __esm({
   "src/policy-presets.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     PROVIDERS_PACK_DIR = "policy/plywood-providers";
     PROVIDERS_PACK_CONFIG = "policy/plywood-providers.json";
     PROVIDERS_REGO_FILE = "plywood_providers.rego";
@@ -4586,19 +4262,9 @@ function bucketTarget(url, env) {
   }
   return void 0;
 }
-function needsBucketCheckMessage(builtChant) {
-  return `the bucket check needs chant >= the release after 0.124.54, which carries @intentius/chant/bucket-check (chant#4558). This plywood was built with chant ${builtChant}, which lacks it, so the bucket was not checked.`;
-}
 function chantBucketCheck() {
-  cached4 ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/bucket-check");
-      return typeof m.checkBucket === "function" ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
-  return cached4;
+  cached2 ??= import("@intentius/chant/bucket-check").then((m) => m);
+  return cached2;
 }
 function bucketLines(report) {
   const where = `${report.store === "azblob" ? "container" : "bucket"} ${report.bucket}`;
@@ -4611,47 +4277,38 @@ function bucketLines(report) {
   }
   return out;
 }
-var cached4;
+var cached2;
 var init_backend = __esm({
   "src/init/backend.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
 // src/init/adopt.ts
 function chantAdopt() {
-  cached5 ??= (async () => {
-    try {
-      const run = await import("@intentius/chant-lexicon-pulumi/run");
-      const lexicon = await import("@intentius/chant-lexicon-pulumi");
-      const args = run.plungeAdoptArgs;
-      const allowed = run.runAllowedPlunge;
-      const runner = run.defaultPlungeRunner;
-      const parse = lexicon.parsePlungeAdoptView;
-      const failure = run.pulumiRunFailure;
-      if (typeof args !== "function" || typeof allowed !== "function" || typeof runner !== "function" || typeof parse !== "function") return void 0;
-      return {
-        hasOp: typeof lexicon.PulumiAdoptOp === "function",
-        async preview({ dir, stack, backend }) {
-          try {
-            const { stdout } = await allowed(runner, args({ stack }), dir, { PULUMI_BACKEND_URL: backend });
-            const view = parse(stdout);
-            if (!view) throw new Error("plunge printed no adopt document");
-            return view;
-          } catch (err) {
-            const f = failure ? failure(err) : { message: err.message };
-            const view = parse(f.stdout);
-            if (view) return view;
-            if (f.missingBinary) throw new Error("the plunge binary was not found on PATH");
-            throw new Error((f.stderr?.trim() || f.message).split("\n").slice(-3).join("\n"));
-          }
+  cached3 ??= (async () => {
+    const { plungeAdoptArgs, runAllowedPlunge, defaultPlungeRunner, pulumiRunFailure } = await import("@intentius/chant-lexicon-pulumi/run");
+    const { parsePlungeAdoptView } = await import("@intentius/chant-lexicon-pulumi");
+    const parse = (t) => parsePlungeAdoptView(t);
+    return {
+      async preview({ dir, stack, backend }) {
+        try {
+          const { stdout } = await runAllowedPlunge(defaultPlungeRunner, plungeAdoptArgs({ stack }), dir, { PULUMI_BACKEND_URL: backend });
+          const view = parse(stdout);
+          if (!view) throw new Error("plunge printed no adopt document");
+          return view;
+        } catch (err) {
+          const f = pulumiRunFailure(err);
+          const view = parse(f.stdout);
+          if (view) return view;
+          if (f.missingBinary) throw new Error("the plunge binary was not found on PATH");
+          throw new Error((f.stderr?.trim() || f.message).split("\n").slice(-3).join("\n"));
         }
-      };
-    } catch {
-      return void 0;
-    }
+      }
+    };
   })();
-  return cached5;
+  return cached3;
 }
 function adoptCommand(s, backend) {
   const cd = s.dir === "." ? "" : `cd ${s.dir} && `;
@@ -4661,10 +4318,6 @@ async function adoptPreviews(stacks2, chant, root) {
   const out = [];
   for (const s of stacks2) {
     const command = adoptCommand(s, s.url);
-    if (!chant) {
-      out.push({ key: s.key, backend: s.url, command, error: "not run" });
-      continue;
-    }
     try {
       const view = await chant.preview({ dir: s.dir === "." ? root : `${root}/${s.dir}`, stack: s.stack, backend: s.url });
       out.push({ key: s.key, backend: s.url, command, view });
@@ -4679,9 +4332,8 @@ function fates(view) {
   for (const r of view.resources) n[r.fate] = (n[r.fate] ?? 0) + 1;
   return Object.entries(n).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([f, c]) => `${f} ${c}`).join(", ");
 }
-function adoptLines(previews, chant) {
+function adoptLines(previews) {
   if (previews.length === 0) return [];
-  if (!chant) return [NEEDS_ADOPT_MESSAGE, ...previews.map((p) => `  ${p.key}: ${p.command}`)];
   const out = ["Adopt previews (plunge stack adopt --json, which writes nothing):"];
   for (const p of previews) {
     const v = p.view;
@@ -4747,14 +4399,14 @@ function adoptTodo(stacks2) {
     `Adopt the stacks onto plunge before their first plunge update: npx chant run ${ADOPT_OP}, then npx chant approve ${ADOPT_OP} <gate> for each of ${gates.join(", ")} after reading its preview, then npx chant run ${ADOPT_OP} again`
   ];
 }
-var ADOPT_OP, ADOPT_OP_FILE, cached5, NEEDS_ADOPT_MESSAGE;
+var ADOPT_OP, ADOPT_OP_FILE, cached3;
 var init_adopt = __esm({
   "src/init/adopt.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_detect();
     ADOPT_OP = "plywood-adopt";
     ADOPT_OP_FILE = "plywood.adopt.op.ts";
-    NEEDS_ADOPT_MESSAGE = "the adopt previews and the adopt Op need @intentius/chant-lexicon-pulumi >= the release after 0.124.54 (chant#4562); run each preview by hand:";
   }
 });
 
@@ -4770,9 +4422,9 @@ function plungeUrlOf(url) {
   const scheme = url.split("://")[0];
   return { pointer: `is on ${url}, and plunge has no plunge+ form for ${scheme}. Move it to a file, s3, azblob or gs backend first: ${MOVE_A_STACK_GUIDE}` };
 }
-function plungeStacks(detected2, env) {
-  return detected2.stacks.map((s) => {
-    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+function plungeStacks(detected, env) {
+  return detected.stacks.map((s) => {
+    const project = detected.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, {}, env);
     const to = plungeUrlOf(b.url);
     return {
@@ -4817,6 +4469,7 @@ var INIT_ENGINES, MOVE_A_STACK_GUIDE, PLUNGE_FORMS;
 var init_engine2 = __esm({
   "src/init/engine.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_engine();
     init_backend();
     INIT_ENGINES = ["pulumi", "plunge"];
@@ -4840,6 +4493,7 @@ var PRESET_NAMES, DEFAULT_PRESET, PRESETS;
 var init_presets = __esm({
   "src/init/presets.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     PRESET_NAMES = ["merge", "before-merge", "approve-all"];
     DEFAULT_PRESET = "merge";
     PRESETS = [
@@ -4865,26 +4519,17 @@ var init_presets = __esm({
 // src/stack-order.ts
 import { join as join9 } from "node:path";
 function chantReferenceReader() {
-  cached6 ??= (async () => {
-    try {
-      const lexicon = await import("@intentius/chant-lexicon-pulumi");
-      if (typeof lexicon.pulumiStackReferences !== "function" || typeof lexicon.stackReferenceOwner !== "function") return void 0;
-      let run = {};
-      try {
-        run = await import("@intentius/chant-lexicon-pulumi/run");
-      } catch {
-      }
-      return {
-        pulumiStackReferences: lexicon.pulumiStackReferences,
-        stackReferenceOwner: lexicon.stackReferenceOwner,
-        ...typeof run.memberExportOf === "function" ? { memberExportOf: run.memberExportOf } : {},
-        ...typeof lexicon.readMemberExport === "function" ? { readMemberExport: lexicon.readMemberExport } : {}
-      };
-    } catch {
-      return void 0;
-    }
+  cached4 ??= (async () => {
+    const lexicon = await import("@intentius/chant-lexicon-pulumi");
+    const run = await import("@intentius/chant-lexicon-pulumi/run");
+    return {
+      pulumiStackReferences: lexicon.pulumiStackReferences,
+      stackReferenceOwner: lexicon.stackReferenceOwner,
+      memberExportOf: run.memberExportOf,
+      readMemberExport: lexicon.readMemberExport
+    };
   })();
-  return cached6;
+  return cached4;
 }
 async function exportOf(reader, root, s) {
   const dir = join9(root, s.dir);
@@ -4908,7 +4553,6 @@ async function stackOrder(root, stacks2, after = {}) {
     for (const upstream of ups) if (keys.has(reader2) && keys.has(upstream)) add({ reader: reader2, upstream, because: "waves.after" });
   }
   const reader = await chantReferenceReader();
-  if (!reader) return { edges, outside, reads: false };
   const owners = stacks2.map((s) => ({ component: s.key, project: s.project, stack: s.stack }));
   for (const s of stacks2) {
     const exported = await exportOf(reader, root, s);
@@ -4919,7 +4563,7 @@ async function stackOrder(root, stacks2, after = {}) {
       else outside.push({ stack: s.key, reference: ref.name, why: found.outside });
     }
   }
-  return { edges, outside, reads: true };
+  return { edges, outside };
 }
 function orderWaves(waves, edges, canary = []) {
   const unmet = [];
@@ -4968,16 +4612,16 @@ function orderWaves(waves, edges, canary = []) {
 }
 function orderLines(order, unmet) {
   const out = [];
-  if (!order.reads) out.push("the installed @intentius/chant-lexicon-pulumi reads no StackReferences (chant#4547), so the waves follow waves.after alone");
   for (const e of order.edges) out.push(`${e.reader} updates after ${e.upstream} (${e.because === "stack-reference" ? "its StackReference" : "waves.after"})`);
   for (const o of order.outside) out.push(`${o.stack}'s StackReference ${o.reference} orders nothing: ${o.why}`);
   for (const u of unmet) out.push(`${u.reader} should update after ${u.upstream}, and cannot: ${u.why}; list them in one wave, or reorder waves`);
   return out;
 }
-var cached6;
+var cached4;
 var init_stack_order = __esm({
   "src/stack-order.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
   }
 });
 
@@ -4995,9 +4639,9 @@ function repoJoin(...parts) {
   const out = posix2.normalize(parts.filter((p) => p !== "" && p !== ".").join("/") || ".").replace(/^\.\//, "").replace(/\/+$/, "");
   return out === "" ? "." : out;
 }
-function projectAt(detected2, dir) {
+function projectAt(detected, dir) {
   const want = repoJoin(dir);
-  return detected2.projects.find((p) => repoJoin(p.dir) === want);
+  return detected.projects.find((p) => repoJoin(p.dir) === want);
 }
 function stackEntry(keys, key) {
   const stacks2 = isObject(keys.stacks) ? keys.stacks : keys.stacks = {};
@@ -5032,6 +4676,7 @@ var IMPORT_SOURCES;
 var init_types2 = __esm({
   "src/import/types.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     IMPORT_SOURCES = ["pulumi-actions", "deployments", "spacelift", "env0"];
   }
@@ -5040,10 +4685,10 @@ var init_types2 = __esm({
 // src/import/deployments.ts
 import { readdirSync as readdirSync6 } from "node:fs";
 import { basename as basename2, dirname as dirname8, join as join11 } from "node:path";
-function deploymentFiles(root, detected2, named) {
+function deploymentFiles(root, detected, named) {
   if (named.length) return [...named];
   const out = [];
-  for (const p of detected2.projects) {
+  for (const p of detected.projects) {
     let names;
     try {
       names = readdirSync6(join11(root, p.dir)).sort();
@@ -5058,6 +4703,7 @@ var SETTINGS_FILE, NOT_CARRIED, importDeployments;
 var init_deployments = __esm({
   "src/import/deployments.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     init_detect();
     init_types2();
@@ -5073,7 +4719,7 @@ var init_deployments = __esm({
       "gitHub.deployPullRequest": "set apply.when: pull-request and update with /plywood up",
       "gitHub.repository": "plywood runs in the repository it is set up in"
     };
-    importDeployments = (root, detected2, named) => {
+    importDeployments = (root, detected, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -5081,7 +4727,7 @@ var init_deployments = __esm({
       const not = (file, setting, why) => {
         unsupported.push({ file, setting, why: why ?? NOT_CARRIED[setting] ?? "plywood has no setting for it" });
       };
-      for (const file of deploymentFiles(root, detected2, named)) {
+      for (const file of deploymentFiles(root, detected, named)) {
         const m = SETTINGS_FILE.exec(basename2(file));
         if (!m) {
           not(file, "(file)", "names no stack: call it Pulumi.<stack>.deploy.yaml (or .json) beside the project's Pulumi.yaml");
@@ -5100,7 +4746,7 @@ var init_deployments = __esm({
         const fileDir = repoJoin(posixRel(root, dirname8(join11(root, file))));
         const source = isObject(settings.sourceContext) && isObject(settings.sourceContext.git) ? settings.sourceContext.git : {};
         const dir = typeof source.repoDir === "string" ? repoJoin(source.repoDir) : fileDir;
-        const project = projectAt(detected2, dir)?.name ?? projectAt(detected2, fileDir)?.name;
+        const project = projectAt(detected, dir)?.name ?? projectAt(detected, fileDir)?.name;
         if (!project) {
           not(file, "sourceContext.git.repoDir", `${dir} holds no Pulumi.yaml`);
           continue;
@@ -5155,9 +4801,9 @@ var init_deployments = __esm({
 });
 
 // src/import/env0.ts
-function stackFor(detected2, names) {
+function stackFor(detected, names) {
   for (const n of names) {
-    const hits = detected2.stacks.filter((s) => s.key === n || s.stack === n || detected2.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
+    const hits = detected.stacks.filter((s) => s.key === n || s.stack === n || detected.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
     if (hits.length === 1) return hits[0].key;
   }
   return void 0;
@@ -5166,11 +4812,12 @@ var ENV0_WORKFLOW_FILES, ENV0_FLOW_FILES, importEnv0;
 var init_env0 = __esm({
   "src/import/env0.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     init_types2();
     ENV0_WORKFLOW_FILES = ["env0.workflow.yml", "env0.workflow.yaml"];
     ENV0_FLOW_FILES = ["env0.yml", "env0.yaml"];
-    importEnv0 = (root, detected2, named) => {
+    importEnv0 = (root, detected, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -5188,7 +4835,7 @@ var init_env0 = __esm({
         for (const [id, raw] of Object.entries(envs)) {
           const e = isObject(raw) ? raw : {};
           const names = [id, ...typeof e.name === "string" ? [e.name] : [], ...typeof e.templateName === "string" ? [e.templateName] : []];
-          const key = stackFor(detected2, names);
+          const key = stackFor(detected, names);
           if (key) stackOf.set(id, key);
           else unsupported.push({ file: workflow, setting: `environments.${id}`, why: `names no stack of this repository (${names.join(", ")}); list it under stacks and waves.after by hand` });
           for (const k of Object.keys(e).filter((x) => !["name", "templateName", "needs"].includes(x))) {
@@ -5266,6 +4913,7 @@ var WORKFLOW_DIRS2, CARRIED, WHY, PULUMI_CLOUD, importPulumiActions;
 var init_pulumi_actions = __esm({
   "src/import/pulumi-actions.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     init_types2();
     WORKFLOW_DIRS2 = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
@@ -5282,7 +4930,7 @@ var init_pulumi_actions = __esm({
       plan: "plywood's update applies the preview its approval names, through chant"
     };
     PULUMI_CLOUD = /^https:\/\/(?:app|api)\.pulumi\.com\/?$/;
-    importPulumiActions = (root, detected2, named) => {
+    importPulumiActions = (root, detected, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -5318,7 +4966,7 @@ var init_pulumi_actions = __esm({
             const dir = repoJoin(typeof w["work-dir"] === "string" ? w["work-dir"] : ".");
             const parts = stackName.split("/");
             const stack = parts[parts.length - 1];
-            const project = projectAt(detected2, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
+            const project = projectAt(detected, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
             if (!project) {
               unsupported.push({ file, setting: `${where}.with.stack-name`, why: `${dir} holds no Pulumi.yaml, so ${stackName} names no project` });
               return;
@@ -5371,11 +5019,12 @@ var SPACELIFT_FILES, CARRIED2, importSpacelift;
 var init_spacelift = __esm({
   "src/import/spacelift.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_types();
     init_types2();
     SPACELIFT_FILES = [".spacelift/config.yml", ".spacelift/config.yaml"];
     CARRIED2 = ["project_root", "runner_image"];
-    importSpacelift = (root, detected2, named) => {
+    importSpacelift = (root, detected, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -5402,7 +5051,7 @@ var init_spacelift = __esm({
         const own = isObject(raw) ? raw : {};
         const s = { ...defaults, ...own };
         const dir = repoJoin(typeof s.project_root === "string" ? s.project_root : ".");
-        const project = projectAt(detected2, dir);
+        const project = projectAt(detected, dir);
         if (!project) {
           unsupported.push({ file, setting: `stacks.${id}.project_root`, why: `${dir} holds no Pulumi.yaml` });
           continue;
@@ -5451,9 +5100,9 @@ function parseFrom(value) {
   if (!source) return { error: `--from ${value} is not one of ${IMPORT_SOURCES.join(", ")}, and its path names none; give <source>=${value}` };
   return { source, files: [file] };
 }
-function runImport(root, detected2, from) {
+function runImport(root, detected, from) {
   try {
-    return IMPORTERS[from.source](root, detected2, from.files);
+    return IMPORTERS[from.source](root, detected, from.files);
   } catch (e) {
     const file = from.files[0] ?? "(its files)";
     return { source: from.source, files: [], keys: {}, unsupported: [{ file, setting: "(file)", why: `could not be read: ${e.message}` }], notes: [] };
@@ -5463,6 +5112,7 @@ var IMPORTERS;
 var init_import = __esm({
   "src/import/index.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_deployments();
     init_env0();
     init_pulumi_actions();
@@ -5512,11 +5162,11 @@ function parseInitArgs(args) {
   };
   const preset2 = take("--preset");
   const gate = take("--gate");
-  const engine2 = take("--engine");
+  const engine3 = take("--engine");
   const forge = take("--forge");
   const env = take("--env");
   const fromFlag = take("--from");
-  const bad = [preset2, gate, engine2, forge, env, fromFlag].find((t) => t.error);
+  const bad = [preset2, gate, engine3, forge, env, fromFlag].find((t) => t.error);
   if (bad) return { error: bad.error };
   const flags = /* @__PURE__ */ new Set(["--no-bucket-check", "--dry-run", "--yes", "-y"]);
   const extra = rest.filter((a) => !flags.has(a));
@@ -5524,7 +5174,7 @@ function parseInitArgs(args) {
   if (preset2.value !== void 0 && !presetByName(preset2.value)) return { error: `--preset ${preset2.value} is not one of ${PRESET_NAMES.join(", ")}` };
   const g = gate.value !== void 0 ? gateFlag(gate.value) : void 0;
   if (gate.value !== void 0 && !g) return { error: `--gate ${gate.value} is not one of always, on-destructive (or destroy), never` };
-  if (engine2.value !== void 0 && !INIT_ENGINES.includes(engine2.value)) return { error: `--engine ${engine2.value} is not one of ${INIT_ENGINES.join(", ")}` };
+  if (engine3.value !== void 0 && !INIT_ENGINES.includes(engine3.value)) return { error: `--engine ${engine3.value} is not one of ${INIT_ENGINES.join(", ")}` };
   if (forge.value !== void 0 && !FORGES.includes(forge.value)) return { error: `--forge ${forge.value} is not one of ${FORGES.join(", ")}` };
   const from = fromFlag.value !== void 0 ? parseFrom(fromFlag.value) : void 0;
   if (from && "error" in from) return { error: from.error };
@@ -5532,7 +5182,7 @@ function parseInitArgs(args) {
     ...from ? { from } : {},
     ...preset2.value ? { preset: preset2.value } : {},
     ...g ? { gate: g } : {},
-    ...engine2.value ? { engine: engine2.value } : {},
+    ...engine3.value ? { engine: engine3.value } : {},
     ...forge.value ? { forge: forge.value } : {},
     env: env.value ?? "production",
     bucketCheck: !rest.includes("--no-bucket-check"),
@@ -5553,7 +5203,7 @@ function put(root, rel, text, dryRun, note) {
 function existingConfig(root) {
   return CONFIG_NAMES.find((n) => existsSync10(join13(root, n)));
 }
-async function newConfigKeys(detected2, opts, io) {
+async function newConfigKeys(detected, opts, io) {
   const notes = [];
   let presetName = opts.preset;
   if (!presetName && io.ask && !opts.yes) {
@@ -5563,31 +5213,31 @@ async function newConfigKeys(detected2, opts, io) {
   const preset2 = presetByName(presetName ?? DEFAULT_PRESET);
   const keys = structuredClone(preset2.keys);
   if (opts.gate) keys.gate = opts.gate;
-  const engine2 = engineStep({ engine: opts.engine, detected: detected2, env: io.env });
-  Object.assign(keys, engine2.keys);
-  notes.push(...engine2.notes);
-  const engineBackends = engine2.keys.backend !== void 0 || engine2.keys.stacks !== void 0;
+  const engine3 = engineStep({ engine: opts.engine, detected, env: io.env });
+  Object.assign(keys, engine3.keys);
+  notes.push(...engine3.notes);
+  const engineBackends = engine3.keys.backend !== void 0 || engine3.keys.stacks !== void 0;
   let forge;
   if (opts.forge) {
     forge = { kind: opts.forge, because: "--forge" };
-    if (detected2.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
-    else if (detected2.forge.url) keys.forge = { kind: opts.forge, url: detected2.forge.url };
-  } else if (detected2.forge) {
-    forge = { kind: detected2.forge.kind, because: detected2.forge.because };
-    if (detected2.forge.url) keys.forge = { kind: detected2.forge.kind, url: detected2.forge.url };
+    if (detected.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
+    else if (detected.forge.url) keys.forge = { kind: opts.forge, url: detected.forge.url };
+  } else if (detected.forge) {
+    forge = { kind: detected.forge.kind, because: detected.forge.because };
+    if (detected.forge.url) keys.forge = { kind: detected.forge.kind, url: detected.forge.url };
   } else {
     const kind = io.ask && !opts.yes ? await io.ask("Forge", FORGES, "github") : "github";
     forge = { kind, because: io.ask && !opts.yes ? "you chose it" : "origin names no forge init knows, so github; change forge.kind in plywood.yml" };
     keys.forge = { kind };
   }
   const fromEnv = io.env.PULUMI_BACKEND_URL?.trim();
-  if (fromEnv && !engineBackends && detected2.projects.some((p) => !p.backendUrl)) {
+  if (fromEnv && !engineBackends && detected.projects.some((p) => !p.backendUrl)) {
     keys.backend = fromEnv;
     notes.push(`backend ${fromEnv} came from PULUMI_BACKEND_URL; it is in plywood.yml so the jobs use it too`);
   }
   return { keys, notes, forge };
 }
-function initStacks(detected2, doc, members = []) {
+function initStacks(detected, doc, members = []) {
   const listed = stacksOf(doc);
   const pinned = new Map(members.filter((m) => m.engineBin && m.engineVersion).map((m) => [m.name, m]));
   const out = [];
@@ -5595,8 +5245,8 @@ function initStacks(detected2, doc, members = []) {
   const add = (key, project, stack, dir) => {
     const own = listed[key] ?? {};
     const backend = own.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
-    const engine2 = engineOf(doc, backend)?.engine;
-    const grain = lockGrainFor(doc, engine2);
+    const engine3 = engineOf(doc, backend)?.engine;
+    const grain = lockGrainFor(doc, engine3);
     const stackDir = own.dir ?? dir;
     const packs = packsForStack(stepPolicyPacksOf(doc), stackDir);
     const pin = pinned.get(key);
@@ -5605,7 +5255,7 @@ function initStacks(detected2, doc, members = []) {
       project,
       stack,
       dir: stackDir,
-      ...engine2 ? { engine: engine2 } : {},
+      ...engine3 ? { engine: engine3 } : {},
       // plywood#22: the step's backend, so a preview and an update read this stack's store, not the job's PULUMI_BACKEND_URL.
       ...backend ? { backend } : {},
       ...pin ? { engineVersion: pin.engineVersion, ...pin.engineRoot ? { engineRoot: pin.engineRoot } : {} } : {},
@@ -5617,7 +5267,7 @@ function initStacks(detected2, doc, members = []) {
     });
     seen.add(key);
   };
-  for (const s of detected2.stacks) add(s.key, s.project, s.stack, s.dir);
+  for (const s of detected.stacks) add(s.key, s.project, s.stack, s.dir);
   for (const [key, own] of Object.entries(listed)) {
     if (seen.has(key)) continue;
     const [project, stack] = key.split("/");
@@ -5625,30 +5275,22 @@ function initStacks(detected2, doc, members = []) {
   }
   return out;
 }
-function forgeFor2(doc, detected2, opts) {
+function forgeFor2(doc, detected, opts) {
   if (opts.forge) return { kind: opts.forge, because: "--forge" };
   const kind = isObject(doc.forge) ? doc.forge.kind : void 0;
   if (kind) return { kind, because: "plywood.yml says forge.kind" };
-  if (detected2.forge) return { kind: detected2.forge.kind, because: detected2.forge.because };
+  if (detected.forge) return { kind: detected.forge.kind, because: detected.forge.because };
   return { kind: "github", because: "origin names no forge init knows, so github" };
 }
-async function chantWriteCiHook() {
-  try {
-    const m = await import("@intentius/chant/components/check-hooks");
-    return typeof m.writeCiHook === "function" ? m.writeCiHook : void 0;
-  } catch {
-    return void 0;
-  }
-}
 async function runInit(opts, table, io) {
-  const detected2 = detect(io.cwd);
-  const { root } = detected2;
+  const detected = detect(io.cwd);
+  const { root } = detected;
   const files = [];
   const notes = [];
   const todo = [];
   const buckets = [];
   const adopt = [];
-  const imported = opts.from ? runImport(root, detected2, opts.from) : void 0;
+  const imported = opts.from ? runImport(root, detected, opts.from) : void 0;
   if (imported && imported.files.length === 0) notes.push(`--from ${imported.source} found no file to read${imported.notes.length ? `: ${imported.notes.join("; ")}` : ""}`);
   const fail = (message, forge2 = { kind: "github", because: "" }) => ({
     ok: false,
@@ -5663,8 +5305,8 @@ async function runInit(opts, table, io) {
     adopt,
     ...imported ? { imported } : {}
   });
-  if (detected2.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
-  if (detected2.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
+  if (detected.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
+  if (detected.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
   let config2;
   let forge;
   const kept = existingConfig(root);
@@ -5678,10 +5320,10 @@ async function runInit(opts, table, io) {
     const onPlunge = opts.engine === "plunge" && engineOf(config2.doc)?.engine === "plunge";
     const ignored = [opts.preset && "--preset", opts.gate && "--gate", opts.engine && !onPlunge && "--engine", imported && "--from"].filter(Boolean);
     if (ignored.length) notes.push(`${kept} is kept as it is, so ${ignored.join(", ")} changed nothing; set the keys there`);
-    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected2, io.env));
-    forge = forgeFor2(config2.doc, detected2, opts);
+    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected, io.env));
+    forge = forgeFor2(config2.doc, detected, opts);
   } else {
-    const made = await newConfigKeys(detected2, opts, io);
+    const made = await newConfigKeys(detected, opts, io);
     notes.push(...made.notes);
     forge = made.forge;
     const text = plywoodYml(imported ? mergeKeys(made.keys, imported.keys) : made.keys);
@@ -5694,15 +5336,13 @@ async function runInit(opts, table, io) {
   if (problems.length) return fail(problems.map((p) => `${kept}: ${p.key} ${p.message}`).join("\n"), forge);
   const doc = config2.doc;
   const settings = toChantSettings(config2);
-  const reviewStacks2 = config2.doc.review_stacks !== void 0 ? await chantReviewStacks() : false;
-  if (settings.ci.prEnvironment && !reviewStacks2) delete settings.ci.prEnvironment;
-  const reviewSuffix = reviewStacks2 ? reviewSuffixOf(settings.pipeline.reviewStackName) : void 0;
-  const stacks2 = initStacks(detected2, doc, settings.members);
+  const reviewSuffix = config2.doc.review_stacks !== void 0 ? reviewSuffixOf(settings.pipeline.reviewStackName) : void 0;
+  const stacks2 = initStacks(detected, doc, settings.members);
   const order = await stackOrder(root, stacks2, settings.pipeline.after);
   const ordered = orderWaves(wavesOf(stacks2, settings.pipeline.waves), order.edges, settings.pipeline.canary);
   const waves = ordered.waves;
-  if (order.edges.length || order.outside.length || ordered.unmet.length || !order.reads && stacks2.length > 1) notes.push(...orderLines(order, ordered.unmet));
-  const declaration = declarationStep(root, detected2, settings, opts.dryRun);
+  if (order.edges.length || order.outside.length || ordered.unmet.length) notes.push(...orderLines(order, ordered.unmet));
+  const declaration = declarationStep(root, detected, settings, opts.dryRun);
   files.push(declaration.file);
   if (existsSync10(join13(root, CHANT_CONFIG_FILE))) {
     const text = readFileSync12(join13(root, CHANT_CONFIG_FILE), "utf8");
@@ -5712,19 +5352,16 @@ async function runInit(opts, table, io) {
   } else files.push(put(root, CHANT_CONFIG_FILE, chantConfigTs(), opts.dryRun));
   files.push(put(root, COMPONENTS_FILE, componentsFile(stacks2, settings.pipeline.after, reviewSuffix ? { reviewSuffix } : {}), opts.dryRun));
   files.push(...providersPresetStep(root, doc, opts.dryRun, notes));
-  if (detected2.preCommit) files.push(await preCommitStep(root, detected2.preCommit, opts.dryRun));
-  for (const wf of detected2.pulumiActions) {
+  if (detected.preCommit) files.push(await preCommitStep(root, detected.preCommit, opts.dryRun));
+  for (const wf of detected.pulumiActions) {
     notes.push(`${wf} runs pulumi/actions. init leaves it as it is; once plywood's previews and updates replace it, remove it, or keep it for the stacks plywood does not run`);
   }
   const chant = await chantProduct();
-  if (!chant) {
-    const message = needsChantMessage("Writing the waves spec and the workflow");
-    files.push({ file: WAVES_SPEC_FILE2, status: "skipped", note: message }, { file: WORKFLOW_FILE[forge.kind], status: "skipped", note: "needs the same chant" });
-  } else {
-    let spec = await wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves, forge.kind);
+  {
+    let spec = await wavesSpecStep(chant, stacks2, doc, settings, detected.defaultBranch, waves, forge.kind);
     if (settings.pipeline.jobs) {
       try {
-        spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind, { parallelism: await hasChant4625() });
+        spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind);
       } catch (e) {
         files.push({ file: WAVES_SPEC_FILE2, status: "failed", note: e.message });
         spec = void 0;
@@ -5736,10 +5373,10 @@ async function runInit(opts, table, io) {
     }
     if (spec) files.push(...await workflowStep(chant, root, doc, settings, forge.kind, opts, stacks2.length > 0 ? spec : void 0, table, io));
   }
-  if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
-  adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
-  todo.push(...todoLines(detected2, doc, forge.kind, io.env));
-  if (forge.kind === "gitlab" && chant && stacks2.length > 0 && previewOf(doc) && await hasChantWavePreview()) {
+  if (opts.bucketCheck) notes.push(...await bucketStep(detected, doc, io.env, buckets));
+  adopt.push(...await adoptStep(root, detected, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
+  todo.push(...todoLines(detected, doc, forge.kind, io.env));
+  if (forge.kind === "gitlab" && stacks2.length > 0 && previewOf(doc)) {
     todo.push(`Add a ${GITLAB_READ_TOKEN} CI/CD variable (a project access token with the read_api scope, masked and protected) so a wave can read the merge request it applies; without it the wave refuses`);
   }
   const failed = files.find((f) => f.status === "failed");
@@ -5757,9 +5394,9 @@ async function runInit(opts, table, io) {
     ...imported ? { imported } : {}
   };
 }
-function declarationStep(root, detected2, settings, dryRun) {
+function declarationStep(root, detected, settings, dryRun) {
   if (existsSync10(join13(root, "chant.workspace.jsonc"))) {
-    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected2.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
+    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
   }
   let existing;
   const file = join13(root, DECLARATION_FILE);
@@ -5772,7 +5409,7 @@ function declarationStep(root, detected2, settings, dryRun) {
       return { file: { file: DECLARATION_FILE, status: "failed", note: `is not JSON init can merge into (${e.message})` } };
     }
   }
-  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected2.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
+  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
   if (existing && JSON.stringify(existing) === JSON.stringify(doc)) return { file: { file: DECLARATION_FILE, status: "unchanged" }, doc };
   return { file: put(root, DECLARATION_FILE, jsonText(doc), dryRun), doc };
 }
@@ -5792,10 +5429,7 @@ function providersPresetStep(root, doc, dryRun, notes) {
   return out;
 }
 async function preCommitStep(root, config2, dryRun) {
-  const write = await chantWriteCiHook();
-  if (!write) {
-    return { file: DECLARATION_FILE, status: "skipped", note: `${config2} found; running it as a check hook needs chant >= the release after 0.124.54 (chant#4556's writeCiHook). This plywood was built with chant ${BUILT_CHANT}` };
-  }
+  const { writeCiHook: write } = await import("@intentius/chant/components/check-hooks");
   if (dryRun || !existsSync10(join13(root, DECLARATION_FILE))) return { file: DECLARATION_FILE, status: "skipped", note: `${config2} would run as the check hook pre-commit` };
   const before = readFileSync12(join13(root, DECLARATION_FILE), "utf8");
   try {
@@ -5807,19 +5441,20 @@ async function preCommitStep(root, config2, dryRun) {
   return { file: DECLARATION_FILE, status: after === before ? "unchanged" : "written", note: `${config2} runs as the check hook pre-commit; the check job's image needs pre-commit` };
 }
 async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, forge) {
-  const runner = waveRunner(chantPipelineOptions(settings.pipeline, false).runner);
+  const runner = waveRunner(chantPipelineOptions(settings.pipeline).runner);
+  const rego = isObject(doc.policy) && (typeof doc.policy.rego === "string" || doc.policy.source !== void 0 || doc.policy.command !== void 0);
   const base = wavesSpec({
+    ...rego ? { policy: true } : {},
     stacks: stacks2,
     ordered,
     gate: gateOf(doc),
     branch,
     ...runner !== void 0 ? { runner } : {},
     ...settings.pipeline.quorum?.length ? { quorum: settings.pipeline.quorum } : {},
-    // notify.relay only on a chant with the relay (chant#4611); an older chant refuses the setting.
-    ...settings.pipeline.notify ? { notify: { ...notifyForChant(settings.pipeline.notify, chant) } } : {}
+    ...settings.pipeline.notify ? { notify: { ...settings.pipeline.notify } } : {}
   });
-  const named = chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
-  return previewOf(doc) && await hasChantWavePreview() ? withWavePreview(named, forge) : named;
+  const named = chant.productWavesSpec(base, PRODUCT_WORDS);
+  return previewOf(doc) ? withWavePreview(named, forge) : named;
 }
 async function workflowStep(chant, root, doc, settings, forge, opts, spec, table, io) {
   const output = WORKFLOW_FILE[forge];
@@ -5828,17 +5463,16 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   try {
     const { noteControlTarget: noteControlTarget2 } = await Promise.resolve().then(() => (init_control2(), control_exports));
     const control3 = await noteControlTarget2(doc, root);
-    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline, false)), { reviewStacks: await chantReviewStacks(), prJobs, ...control3 ? { control: control3 } : {} });
+    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline)), { prJobs, ...control3 ? { control: control3 } : {} });
   } catch (e) {
     return [{ file: output, status: "failed", note: e.message }];
   }
   if (opts.dryRun) return [{ file: output, status: "skipped", note: "--dry-run: chant's generator was not run" }];
   const argv = plan.argv.map((a, i) => i === 1 && a === "." ? root : a);
-  const written = await writeWorkflow(chant, { root, forge, output, argv, words: plan.prWords, noteControl: plan.jobs.post.control });
+  const written = await writeWorkflow(chant, { root, forge, output, argv, words: plan.prWords });
   if (written.status === "failed") return [{ file: output, status: "failed", note: `chant's generator exited ${written.code}; the old file is back as it was` }];
   const notes = [
     ...written.kept.length ? [`kept your own jobs: ${written.kept.join(", ")}`] : [],
-    ...doc.review_stacks !== void 0 && !plan.argv.includes("--pr-env") ? [REVIEW_STACKS_NEED_CHANT] : [],
     ...prJobs.notes,
     ...plan.notes,
     ...writtenNotes(plan, written.file)
@@ -5850,18 +5484,17 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   }
   return out;
 }
-async function bucketStep(detected2, doc, env, reports) {
+async function bucketStep(detected, doc, env, reports) {
   const listed = stacksOf(doc);
   const urls = /* @__PURE__ */ new Set();
-  for (const s of detected2.stacks) {
-    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected.stacks) {
+    const project = detected.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, { ...listed[s.key]?.backend ? { stack: listed[s.key].backend } : {}, ...typeof doc.backend === "string" ? { all: doc.backend } : {} }, env);
     if (b.url && !isPulumiCloud(b.url)) urls.add(b.url);
   }
   const targets = [...urls].map((u) => bucketTarget(u, env)).filter((t) => t !== void 0);
   if (targets.length === 0) return [];
   const check2 = await chantBucketCheck();
-  if (!check2) return [needsBucketCheckMessage(BUILT_CHANT)];
   const lines2 = ["State buckets:"];
   for (const t of targets) {
     if (!t.ok) {
@@ -5878,12 +5511,12 @@ async function bucketStep(detected2, doc, env, reports) {
   }
   return lines2;
 }
-async function adoptStep(root, detected2, doc, env, declaration, dryRun, files, notes, todo) {
+async function adoptStep(root, detected, doc, env, declaration, dryRun, files, notes, todo) {
   const listed = stacksOf(doc);
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
   const targets = [];
-  for (const s of detected2.stacks) {
-    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected.stacks) {
+    const project = detected.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const own = listed[s.key];
     const b = backendOf(project, { ...own?.backend ? { stack: own.backend } : {}, ...all ? { all } : {} }, env);
     if (b.url && /^plunge\+/.test(b.url)) targets.push({ key: s.key, project: s.project, projectDir: s.dir, dir: own?.dir ?? s.dir, stack: s.stack, url: b.url });
@@ -5891,11 +5524,7 @@ async function adoptStep(root, detected2, doc, env, declaration, dryRun, files,
   if (targets.length === 0) return [];
   const chant = await chantAdopt();
   const previews = await adoptPreviews(targets, chant, root);
-  notes.push(...adoptLines(previews, chant));
-  if (!chant?.hasOp) {
-    files.push({ file: ADOPT_OP_FILE, status: "skipped", note: `the adopt Op needs @intentius/chant-lexicon-pulumi >= the release after 0.124.54 (chant#4562's PulumiAdoptOp). This plywood was built with chant ${BUILT_CHANT}` });
-    return previews;
-  }
+  notes.push(...adoptLines(previews));
   const left = stacksToAdopt(targets, previews);
   if (left.length === 0) {
     if (existsSync10(join13(root, ADOPT_OP_FILE))) files.push({ file: ADOPT_OP_FILE, status: "kept", note: "every stack is adopted; delete it" });
@@ -5906,17 +5535,17 @@ async function adoptStep(root, detected2, doc, env, declaration, dryRun, files,
   todo.push(...adoptTodo(rows));
   return previews;
 }
-function keptPlungeLines(kept, detected2, env) {
-  const step = engineStep({ engine: "plunge", detected: detected2, env });
+function keptPlungeLines(kept, detected, env) {
+  const step = engineStep({ engine: "plunge", detected, env });
   const entries = Object.entries(step.keys);
   if (entries.length === 0) return step.notes;
   const yaml = entries.map(([k, v]) => emitYAMLEntry2(k, v)).join("\n").split("\n").filter((l) => l !== "");
   return [...step.notes, `To move to plunge, set these keys in ${kept}:`, ...yaml.map((l) => `    ${l}`)];
 }
-function todoLines(detected2, doc, forge, env) {
+function todoLines(detected, doc, forge, env) {
   const out = [];
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
-  const cloud = detected2.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
+  const cloud = detected.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
   const where = forge === "gitlab" ? "CI/CD variables" : "repository secrets";
   const traded = identityClouds(doc);
   if (cloud && traded.includes("pulumi")) {
@@ -5924,9 +5553,9 @@ function todoLines(detected2, doc, forge, env) {
   } else if (cloud) {
     out.push(`Set pulumi_cloud.org and identity.preview.pulumi and identity.up.pulumi in plywood.yml, so each job trades its OIDC token for its own Pulumi Cloud token, or add PULUMI_ACCESS_TOKEN_PREVIEW and PULUMI_ACCESS_TOKEN_UP to the ${where}`);
   }
-  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected2.defaultBranch} only`);
+  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected.defaultBranch} only`);
   else if (!cloud) out.push("Give the preview job and the update job their cloud access, each its own role through OIDC (identity in plywood.yml); the backend bucket's read and write go with them");
-  out.push(`Make ${PRODUCT}/preview a required status on ${detected2.defaultBranch}`);
+  out.push(`Make ${PRODUCT}/preview a required status on ${detected.defaultBranch}`);
   return out;
 }
 function initLines(r) {
@@ -5962,11 +5591,11 @@ var DECLARATION_FILE, CHANT_CONFIG_FILE, COMPONENTS_FILE, WAVES_SPEC_FILE2, CHAN
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_package();
     init_chant_product();
     init_chant_config();
     init_identity();
-    init_observe();
     init_policy();
     init_policy_presets();
     init_approval();
@@ -6005,13 +5634,11 @@ var init_init = __esm({
 var control_exports = {};
 __export(control_exports, {
   CONTROLLED_KEYS: () => CONTROLLED_KEYS,
-  CONTROL_NEEDS_CHANT: () => CONTROL_NEEDS_CHANT,
   chantControl: () => chantControl,
   control: () => control2,
   controlGenerator: () => controlGenerator,
   controlTarget: () => controlTarget,
   controlledConfigText: () => controlledConfigText,
-  hasWavesControl: () => hasWavesControl,
   noteControlTarget: () => noteControlTarget,
   projectSettings: () => projectSettings,
   setChantControlForTests: () => setChantControlForTests,
@@ -6024,15 +5651,10 @@ import { createRequire } from "node:module";
 import { dirname as dirname10, join as join14 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { emitYAMLEntry as emitYAMLEntry3, parseYAML as parseYAML4 } from "@intentius/chant/yaml";
-function hasWavesControl(chant) {
-  return typeof chant.recordControlAppliedFromEnv === "function";
-}
 async function wavesControl(cwd) {
   const file = findConfig(cwd);
   if (!file || controlOf(loadConfig(file).doc) === void 0) return { none: true };
   const chant = await chantControl();
-  if (!chant) return { missing: CONTROL_NEEDS_CHANT };
-  if (!hasWavesControl(chant)) return { missing: "the waves workflow tells the control repo with a chant that has chant#4617" };
   const target = await controlTarget(chant, cwd);
   if ("error" in target) return target;
   const settings = { ...controlOf(loadConfig(file).doc), member: target.member };
@@ -6044,7 +5666,7 @@ async function noteControlTarget(doc, root) {
   const settings = controlOf(doc);
   if (!settings) return void 0;
   const chant = await chantControl();
-  if (!chant || chant.controlSettingsProblems(settings).length > 0) return void 0;
+  if (chant.controlSettingsProblems(settings).length > 0) return void 0;
   try {
     return chant.resolveControlTarget(settings, repoName(root));
   } catch {
@@ -6052,18 +5674,11 @@ async function noteControlTarget(doc, root) {
   }
 }
 function chantControl() {
-  cached7 ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/ci-control");
-      return REQUIRED3.every((n) => typeof m[n] === "function") ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
-  return cached7;
+  cached5 ??= import("@intentius/chant/ci-control").then((m) => m);
+  return cached5;
 }
 function setChantControlForTests(fake) {
-  cached7 = fake === "reset" ? void 0 : Promise.resolve(fake);
+  cached5 = fake === "reset" ? void 0 : Promise.resolve(fake);
 }
 function projectSettings(defaults, own) {
   return { ...defaults ?? {}, ...own };
@@ -6109,7 +5724,6 @@ async function control2(args, json, table, io) {
   const subs = ["init", "put", "import", "list", "retire", "reconcile", "dispatch"];
   if (!sub || !subs.includes(sub)) return usage(`control takes one of ${subs.join(", ")}`, table, io);
   const chant = await chantControl();
-  if (!chant) return usage(`${CONTROL_NEEDS_CHANT}. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`, table, io);
   const emit = (envelope, lines2) => {
     if (json) io.out(JSON.stringify({ command: `control ${sub}`, ...envelope }));
     else for (const l of lines2) io.out(l);
@@ -6157,8 +5771,8 @@ async function controlInit(chant, args, emit, table, io) {
   const before = existsSync11(path) ? readFileSync13(path, "utf8") : void 0;
   const status = before === file.content ? "unchanged" : "written";
   if (!dryRun && status === "written") {
-    const { mkdirSync: mkdirSync8 } = await import("node:fs");
-    mkdirSync8(dirname10(path), { recursive: true });
+    const { mkdirSync: mkdirSync7 } = await import("node:fs");
+    mkdirSync7(dirname10(path), { recursive: true });
     writeFileSync7(path, file.content);
   }
   emit({ ok: true, exitCode: table.done, forge, file: file.path, status, dryRun, notes: file.notes }, [
@@ -6293,10 +5907,11 @@ async function controlReconcile(chant, args, emit, table, io) {
   emit({ ok: !failed, exitCode: code, mode, outcomes }, chant.describeReconcile(outcomes, mode).split("\n"));
   return code;
 }
-var CONTROLLED_KEYS, CONTROL_NEEDS_CHANT, WAVES_CONTROL_KEYS, REQUIRED3, cached7, validateControlSettings;
+var CONTROLLED_KEYS, WAVES_CONTROL_KEYS, cached5, validateControlSettings;
 var init_control2 = __esm({
   "src/control.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_config();
     init_control();
     init_routing();
@@ -6305,9 +5920,7 @@ var init_control2 = __esm({
     init_stages();
     init_words();
     CONTROLLED_KEYS = ["gate", "approval", "approval_rules", "pulumi", "plunge", "image"];
-    CONTROL_NEEDS_CHANT = "the control repo needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-control (chant#4568)";
     WAVES_CONTROL_KEYS = ["repo", "op", "forge", "member", "tokenSecret", "readTokenSecret", "ref", "apiBase"];
-    REQUIRED3 = ["controlDispatchRequest", "putControlEntry", "reconcileProjects"];
     validateControlSettings = (_entry, _project, settings) => {
       const out = [];
       for (const key of Object.keys(settings)) {
@@ -6341,13 +5954,8 @@ function positionals(args) {
   }
   return out;
 }
-async function withChant(what, table, io, run) {
-  const chant = await chantProduct();
-  if (!chant) {
-    io.err(`${PRODUCT}: ${needsChantMessage(what)}`);
-    return table.failed;
-  }
-  return run(chant);
+async function withChant(_what, _table, _io, run) {
+  return run(await chantProduct());
 }
 function passthrough(argv, table, io) {
   if (argv[0] === "run" && argv[1] === "wave") return runWave(argv, table, io);
@@ -6410,7 +6018,6 @@ async function preview(args, json, table, io) {
   const gate = rest.includes("--gate") ? [] : ["--gate", PR_GATE];
   const argv = ["components", "pr-plan", "--base", at, "--pr", number, ...gate, ...stack ? ["--member", stack] : [], ...rest, ...json ? ["--json"] : []];
   return withChant(`${PRODUCT} preview`, table, io, async (chant) => {
-    if (targeted && !hasChant4620(chant)) return usage(PREVIEW_TARGET_NEEDS_CHANT, table, io);
     return chant.runChantInProcess(argv, PRODUCT_WORDS);
   });
 }
@@ -6449,12 +6056,6 @@ async function ci(args, json, table, io) {
   const env = envFlag.value ?? "production";
   const output = outFlag.value ?? WORKFLOW_FILE[forge];
   return withChant(`${PRODUCT} ci`, table, io, async (chant) => {
-    const reviewStacks2 = await chantReviewStacks();
-    if (config2.doc.review_stacks !== void 0 && !reviewStacks2) io.err(`${PRODUCT}: ${REVIEW_STACKS_NEED_CHANT}`);
-    if (applyWhenOf(config2.doc) === "pull-request") {
-      const note = requiresNotHonoured(chant, config2.doc);
-      if (note) io.err(`${PRODUCT}: ${note}`);
-    }
     let waves;
     try {
       waves = readWavesSpec(io.cwd);
@@ -6462,12 +6063,12 @@ async function ci(args, json, table, io) {
       return usage(`.chant/op-waves/${OP_NAME}.spec.json: ${e.message}`, table, io);
     }
     const pipeline = toChantSettings(config2).pipeline;
-    const { prJobsFor: prJobsFor2, hasChant4625: hasChant46252, withJobSettings: withJobSettings2 } = await Promise.resolve().then(() => (init_jobs2(), jobs_exports));
+    const { prJobsFor: prJobsFor2, withJobSettings: withJobSettings2 } = await Promise.resolve().then(() => (init_jobs2(), jobs_exports));
     const prJobs = await prJobsFor2(pipeline);
     for (const note of prJobs.notes) io.err(`${PRODUCT}: ${note}`);
     if (waves !== void 0 && pipeline.jobs) {
       try {
-        waves = withJobSettings2(waves, pipeline.jobs, forge, { parallelism: await hasChant46252() });
+        waves = withJobSettings2(waves, pipeline.jobs, forge);
       } catch (e) {
         io.err(`${PRODUCT}: ${e.message}`);
         return table.failed;
@@ -6477,7 +6078,8 @@ async function ci(args, json, table, io) {
     const noteControl = await noteControlTarget2(config2.doc, io.cwd);
     let plan;
     try {
-      plan = workflowPlan(chant, config2.doc, forge, env, waves, [], { reviewStacks: reviewStacks2, prJobs, ...noteControl ? { control: noteControl } : {} });
+      const engine3 = chantBuildFlags(chantPipelineOptions(pipeline));
+      plan = workflowPlan(chant, config2.doc, forge, env, waves, engine3, { prJobs, ...noteControl ? { control: noteControl } : {} });
     } catch (e) {
       io.err(`${PRODUCT}: ${e.message}`);
       return table.failed;
@@ -6518,9 +6120,8 @@ async function ci(args, json, table, io) {
       if (jobs2.action) io.err(`  action    ${jobs2.action.command} (${jobs2.action.comment} <stack> <name>, or a dispatch with inputs ${jobs2.action.inputs.member} and ${jobs2.action.inputs.action})`);
     }
     if (!json && "control" in control3) io.err(`  control   after the last wave, tells ${control3.repo} how the waves ended`);
-    else if (!json && "missing" in control3) io.err(`  control   the waves workflow sends no dispatch: ${control3.missing}; a job of your own after the last wave runs '${PRODUCT} control dispatch'`);
     if (dryRun) return table.done;
-    const written = await writeWorkflow(chant, { root: io.cwd, forge, output, argv: plan.argv, words: plan.prWords, noteControl: plan.jobs.post.control });
+    const written = await writeWorkflow(chant, { root: io.cwd, forge, output, argv: plan.argv, words: plan.prWords });
     if (!json && written.kept.length) io.err(`  kept your own jobs: ${written.kept.join(", ")}`);
     if (written.code === table.done) for (const note of writtenNotes(plan, written.file)) io.err(`${PRODUCT}: ${note}`);
     if (json) io.out(JSON.stringify({ command: "ci", ok: written.code === 0, exitCode: written.code, dryRun, ...summary, status: written.status, kept: written.kept }));
@@ -6545,21 +6146,20 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   const shape = pipelineShape(doc, forge, waves);
   const notes = [];
   const pipeline = toChantSettings({ doc }).pipeline;
-  const respond = respondOptions(chant, pipeline, shape.applyBeforeMerge, notes);
+  const respond = respondOptions(pipeline, notes);
   const applyMerge = shape.applyBeforeMerge ? pipeline.applyMerge : void 0;
-  if (approvalOf(doc) === "pr-review" && shape.waves && hasChantApprovalStatus(chant) && !hasChantPullRequestApprovalStatus(chant)) notes.push(APPROVAL_STATUS_NOTE);
   const actionJob = actionJobFor(doc, forge, notes);
   const jobsWanted = actionJob ? [...shape.jobs, "action"] : shape.jobs;
   const words = wordsForJobs(jobsWanted);
   const requires = shape.applyBeforeMerge ? requiresArgv(chant, doc) : [];
-  const previewComment = hasChant4620(chant);
   const jobs2 = chant.productPipelineJobs(forge, env, {
     words,
     ...shape.applyBeforeMerge ? { applyBeforeMerge: true } : {},
     ...shape.locks ? { locks: shape.locks } : {},
     ...shape.waves ? { waves } : {},
     ...requires.length ? { applyRequires: requires[1].split(",") } : {},
-    ...previewComment ? { previewComment: true } : {},
+    // chant#4620: `/plywood preview` previews the pull request again.
+    previewComment: true,
     // chant#4619: the note job's read of the control repo comes back as post.control.
     ...opts.control !== void 0 ? { control: { target: opts.control } } : {},
     // plywood#29: runners, env, pass and parallelism on the pull request jobs, with chant#4625 (src/jobs.ts).
@@ -6585,12 +6185,14 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...shape.applyBeforeMerge ? ["--apply-before-merge", ...requires] : [],
     ...applyMerge ? applyMergeArgv(applyMerge) : [],
     ...respond.argv,
-    ...previewComment ? ["--preview-comment"] : [],
+    "--preview-comment",
     "--stale-notes",
     ...actionJob ? ["--action-job"] : [],
-    // Review stacks (plywood#15): chant's pr-env jobs, only once the pulumi lexicon can remove what they create.
-    ...doc.review_stacks !== void 0 && opts.reviewStacks ? ["--pr-env"] : [],
+    // Review stacks (plywood#15): chant's pr-env jobs.
+    ...doc.review_stacks !== void 0 ? ["--pr-env"] : [],
     ...opts.prJobs?.flags ?? [],
+    // chant#4772: the control repo, so the note job the build writes reads its records (plywood#28).
+    ...opts.control !== void 0 ? controlBuildArgv(doc, opts.control.member) : [],
     ...extra
   ];
   return { jobs: jobs2, words, prWords, argv, notes, ...applyMerge ? { applyMerge } : {} };
@@ -6603,15 +6205,11 @@ function actionJobFor(doc, forge, notes) {
 function applyMergeArgv(m) {
   return ["--merge", "auto", "--merge-token-env", m.tokenEnv, ...m.method ? ["--merge-method", m.method] : []];
 }
-function respondOptions(chant, pipeline, applyBeforeMerge, notes) {
+function respondOptions(pipeline, notes) {
   const r = pipeline.respond;
   if (pipeline.decide && r?.description !== "check") notes.push(DECIDE_LEFT_OFF);
   if (!r || Object.keys(r).length === 0) return { options: {}, argv: [] };
   const keys = Object.keys(r).map((e) => e.replace("-", "_"));
-  if (!hasChantRespond(chant)) {
-    notes.push(`respond.${keys.join(", respond.")} ${keys.length === 1 ? "needs" : "need"} chant's responses to pipeline events (chant#4629), which this chant lacks; chant's defaults hold`);
-    return { options: {}, argv: [] };
-  }
   const responses = { ...r };
   const check2 = responses.description === "check";
   const decide = check2 ? pipeline.decide : void 0;
@@ -6620,14 +6218,7 @@ function respondOptions(chant, pipeline, applyBeforeMerge, notes) {
     notes.push("respond.description is check and decide names no backend and model, so the description check is left off");
   }
   const options = { respond: responses, ...decide ? { decide: { ...decide } } : {} };
-  if (hasChantPrLoopFlags(chant)) return { options, argv: respondArgv(responses, decide) };
-  const prSide = [
-    ...responses.description === "check" ? ["respond.description"] : [],
-    ...applyBeforeMerge && responses["apply-failed"] === "off" ? ["respond.apply_failed"] : [],
-    ...applyBeforeMerge && responses["wave-refused"] === "off" ? ["respond.wave_refused"] : []
-  ];
-  if (prSide.length) notes.push(`${prSide.join(", ")} ${prSide.length === 1 ? "reaches" : "reach"} no pull request job yet: chant's build --pr-loop writes no responses into them, so the note and the update before merge keep chant's defaults; the waves workflow takes wave_refused and apply_failed`);
-  return { options, argv: [] };
+  return { options, argv: respondArgv(responses, decide) };
 }
 function respondArgv(responses, decide) {
   const list = Object.keys(CHANT_RESPOND_DEFAULTS).filter((e) => responses[e] !== void 0 && responses[e] !== CHANT_RESPOND_DEFAULTS[e]).map((e) => `${e}=${responses[e]}`).join(",");
@@ -6636,35 +6227,30 @@ function respondArgv(responses, decide) {
 }
 function requiresArgv(chant, doc) {
   const listed = applyRequiresOf(doc);
-  if (listed.length === APPLY_REQUIRES.length || !hasChant4607(chant)) return [];
+  if (listed.length === APPLY_REQUIRES.length) return [];
   const parsed = chant.parseRequiresList(listed);
   return "checks" in parsed ? ["--requires", parsed.checks.join(",")] : [];
 }
-function requiresNotHonoured(chant, doc) {
-  const listed = applyRequiresOf(doc);
-  if (listed.length === APPLY_REQUIRES.length || hasChant4607(chant)) return void 0;
-  return `apply.requires lists ${listed.join(", ")}, and the installed chant has no pr-apply --requires (chant#4607), so the update before merge asks all four checks: ${APPLY_REQUIRES.join(", ")}`;
-}
 function usage(message, table, io) {
   io.err(`${PRODUCT}: ${message}`);
   return table.failed;
 }
-var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, ACTIONS_NOT_ON_GITLAB, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
+var CHANT_PASSTHROUGH, VALUED, WORKFLOW_FILE, ACTIONS_NOT_ON_GITLAB, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
 var init_stages = __esm({
   "src/stages.ts"() {
     "use strict";
+    init_define_PLYWOOD_IMAGE_DIGESTS();
     init_chant_product();
     init_chant_config();
-    init_chant_next();
-    init_approval();
     init_config_check();
     init_apply();
     init_config();
+    init_control();
     init_locks();
     init_stacks();
     init_routing();
+    init_images();
     init_workflow();
-    init_review_stacks2();
     init_waves_workflow();
     init_drift2();
     init_refusals();
@@ -6673,20 +6259,22 @@ var init_stages = __esm({
     init_words();
     CHANT_PASSTHROUGH = ["components", "run", "lock", "unlock", "query", "ledger", "audit-log"];
     VALUED = /* @__PURE__ */ new Set(["--base", "--pr", "--forge", "--env", "--output", "-o", "--stack", "--file", "--head", "--gate", "--branch", "--report-url", "--target"]);
-    PREVIEW_TARGET_NEEDS_CHANT = "--target needs a chant whose pr-plan passes it to the pulumi-up step (chant#4620), which this chant lacks";
     WORKFLOW_FILE = {
       github: ".github/workflows/plywood.yml",
       forgejo: ".forgejo/workflows/plywood.yml",
       gitlab: ".gitlab-ci.yml"
     };
     ACTIONS_NOT_ON_GITLAB = "plywood.yml declares actions, and a GitLab pipeline starts on no comment or dispatch with inputs, so it has no action job; run 'plywood action <stack> <name>' from a pipeline of your own";
-    APPROVAL_STATUS_NOTE = `approval is pr-review, and chant posts its approval status only for waves that wait on pr-review; plywood's waves wait on the pull request's own approval, so no ${PRODUCT}/approval status is posted before merge`;
     CHANT_RESPOND_DEFAULTS = Object.freeze({ "wave-refused": "diff", "apply-failed": "triage", description: "off" });
     DECIDE_LEFT_OFF = "decide is set and respond.description is not check, so plywood leaves the decide service off the pull request jobs";
   }
 });
 
+// src/bin.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
+
 // src/chant-resolve.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 import * as nodeModule from "node:module";
 var CHANT_SPECIFIER = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?(?:\/|$)/;
 function chantResolveHook(from) {
@@ -6712,50 +6300,22 @@ function installChantResolution(from = import.meta.url) {
 }
 
 // src/cli.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_config_check();
 
 // src/exit-codes.ts
-var FALLBACK_EXIT = Object.freeze({
-  done: 0,
-  failed: 1,
-  drift: 2,
-  waiting: 3,
-  moved: 4,
-  held: 5,
-  superseded: 6,
-  denied: 7,
-  declined: 8,
-  misplaced: 9
-});
-var NAMES = Object.keys(FALLBACK_EXIT).filter((n) => n !== "misplaced");
-function isExitTable(t) {
-  if (!t || typeof t !== "object") return false;
-  const r = t;
-  return NAMES.every((n) => Number.isInteger(r[n])) && (r.misplaced === void 0 || Number.isInteger(r.misplaced));
-}
-function withMisplaced(t) {
-  return Number.isInteger(t.misplaced) ? t : Object.freeze({ ...t, misplaced: FALLBACK_EXIT.misplaced });
-}
-var cached;
-function exitCodes() {
-  cached ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/exit-codes");
-      const table = m.CHANT_EXIT;
-      if (isExitTable(table)) return { table: withMisplaced(table), source: "chant" };
-    } catch {
-    }
-    return { table: FALLBACK_EXIT, source: "fallback" };
-  })();
-  return cached;
-}
+init_define_PLYWOOD_IMAGE_DIGESTS();
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+var EXIT = CHANT_EXIT;
 
 // src/actions.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_chant_product();
 init_stacks();
 init_stages();
 
 // src/stack-ops.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_chant_config();
 init_identity();
 init_config();
@@ -6764,28 +6324,18 @@ init_adopt();
 init_detect();
 init_refusals();
 init_stages();
-init_chant_product();
 init_words();
 import { existsSync as existsSync13 } from "node:fs";
 import { dirname as dirname11, isAbsolute as isAbsolute2, join as join16, resolve as resolve2 } from "node:path";
 var STACK_OPS_OP = "pulumi-stack-ops";
-var REQUIRED4 = ["gatedStackExport", "gatedStackCancel", "gatedStackMove"];
 var cachedLocks;
 function chantStackLockReader() {
-  cachedLocks ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return typeof m.pulumiStackLockIds === "function" ? m.pulumiStackLockIds : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
+  cachedLocks ??= import("@intentius/chant-lexicon-pulumi").then((m) => m.pulumiStackLockIds);
   return cachedLocks;
 }
 async function lockToCancel(given, stack, env) {
   if (given) return { lockId: given, read: false };
   const reader = await chantStackLockReader();
-  if (!reader) return { error: STACK_OP_WORDS.needsLock };
   let locks2;
   try {
     locks2 = await reader({ dir: stack.dir, stack: stack.stack, ...stack.project ? { project: stack.project } : {}, ...stack.engine ? { engine: stack.engine } : {}, env });
@@ -6798,34 +6348,10 @@ async function lockToCancel(given, stack, env) {
   return { lockId: locks2.ids[0], read: true };
 }
 var cachedOps;
-var cachedRollback;
 function chantStackOps() {
-  cachedOps ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return REQUIRED4.every((name) => typeof m[name] === "function") ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
+  cachedOps ??= import("@intentius/chant-lexicon-pulumi").then((m) => m);
   return cachedOps;
 }
-function chantStackRollback() {
-  cachedRollback ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      if (typeof m.pulumiReleaseInputs !== "function") return false;
-      const copy2 = await import("@intentius/chant-lexicon-pulumi/release-copy");
-      return typeof copy2.prepareReleaseCopy === "function";
-    } catch {
-      return false;
-    }
-  })();
-  return cachedRollback;
-}
-function needsStackOpsMessage(what, feature, after = "0.124.54") {
-  return `${what} needs @intentius/chant-lexicon-pulumi >= the release after ${after}, which carries ${feature}. This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
-}
 function readConfig(cwd) {
   const path = findConfig(cwd);
   if (!path) return { error: `no plywood.yml in ${cwd} or above it; run '${PRODUCT} init' first` };
@@ -6921,10 +6447,6 @@ function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
 }
 async function runRequest(verb, json, table, io, call) {
   const ops = await chantStackOps();
-  if (!ops) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} ${verb}`, "the gated stack operations (chant#4578)")}`);
-    return table.failed;
-  }
   try {
     return await call(ops);
   } catch (e) {
@@ -7035,7 +6557,7 @@ async function moveStack(args, json, table, io) {
   if (backend) return usage(backend, table, io);
   const rules = requestRules(read.config);
   const destName = destStackName(source, dest, read.config);
-  const engine2 = source.engine ?? dest.engine;
+  const engine3 = source.engine ?? dest.engine;
   return runRequest("move", json, table, io, async (ops) => {
     const outcome = await ops.gatedStackMove({
       by: requesterOf(common.by, io.env),
@@ -7046,13 +6568,13 @@ async function moveStack(args, json, table, io) {
       source: { member: source.key, dir: source.dir, stack: source.stack },
       dest: { member: dest.key, dir: dest.dir, stack: destName },
       urns,
-      ...engine2 ? { engine: engine2 } : {}
+      ...engine3 ? { engine: engine3 } : {}
     });
     return reportOutcome("move", outcome, `move:${source.stack}:${destName}`, rules, (r) => STACK_OP_WORDS.moved(source.key, dest.key, r), json, table, io);
   });
 }
-async function moveOntoPlunge(engine2, args, json, table, io) {
-  if (engine2 !== "plunge") return usage(`--onto takes plunge, not '${engine2}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
+async function moveOntoPlunge(engine3, args, json, table, io) {
+  if (engine3 !== "plunge") return usage(`--onto takes plunge, not '${engine3}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
   const extra = args.filter((a) => a.startsWith("-"));
   if (extra.length) return usage(`move --onto does not take ${extra.join(" ")}`, table, io);
   const named = positionals(args);
@@ -7102,10 +6624,6 @@ async function rollbackStack(args, json, table, io) {
     argv = ["components", "rollback", env.value ?? environmentOf(stack.stack), "--component", slug(stack.key), ...digest.value ? ["--digest", digest.value] : []];
   }
   argv.push(...actor.value ? ["--actor", actor.value] : [], ...switches, ...json ? ["--json"] : []);
-  if (!await chantStackRollback()) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} rollback`, "rollback by release for stacks (chant#4542)")}`);
-    return table.failed;
-  }
   return withChant(`${PRODUCT} rollback`, table, io, async (chant) => {
     const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
     if (code === table.waiting && !json) io.err(STACK_OP_WORDS.rollbackWaiting);
@@ -7123,7 +6641,6 @@ function chantStackAction() {
 }
 async function fromEvent(env) {
   const chant = await chantProduct();
-  if (!chant) return { error: `${PRODUCT} action --from-event reads the action job's comment or inputs through chant's productActionFromEnv, and chant's product entry did not load` };
   const words = chant.assertProductWords({ ...PRODUCT_WORDS, commands: { ...PRODUCT_WORDS.commands, ...ACTION_COMMAND } });
   const asked = chant.productActionFromEnv(words, env);
   if (asked.kind === "refused") return { error: `the action job was asked for no action: ${asked.reason}` };
@@ -7194,6 +6711,7 @@ async function action(args, json, table, io) {
 }
 
 // src/audit.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_detect();
 init_stages();
 init_words();
@@ -7252,6 +6770,7 @@ init_agents2();
 init_drift2();
 
 // src/estate.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_chant_product();
 init_chant_config();
 init_config();
@@ -7261,19 +6780,12 @@ import { dirname as dirname12 } from "node:path";
 var estateModule;
 function chantEstate() {
   estateModule ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/ci-estate");
-      const r = await import("@intentius/chant/pr-report-url");
-      if (!["readEstateLedger", "buildLedgerEstate", "writeEstate"].every((f) => typeof m[f] === "function")) return void 0;
-      if (typeof r.parseReportUrl !== "function" || typeof r.reportPut !== "function") return void 0;
-      return { ...m, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
-    } catch {
-      return void 0;
-    }
+    const m = await import("@intentius/chant/ci-estate");
+    const r = await import("@intentius/chant/pr-report-url");
+    return { readEstateLedger: m.readEstateLedger, buildLedgerEstate: m.buildLedgerEstate, writeEstate: m.writeEstate, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
   })();
   return estateModule;
 }
-var ESTATE_NEEDS_CHANT = `${PRODUCT} estate needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-estate (chant#4612). Run '${PRODUCT} audit' for the ledger's rows on this chant.`;
 function estateSchedules(config2) {
   const drift3 = toChantSettings(config2).pipeline.drift;
   const driftOps = (drift3?.stacks ?? []).map(driftOpName);
@@ -7292,11 +6804,6 @@ async function estate(args, json, table, io) {
   }
   if (rest.length) return usage(`estate does not take ${rest.join(" ")}`, table, io);
   const chant = await chantEstate();
-  if (!chant) {
-    if (json) io.out(JSON.stringify({ command: "estate", ok: false, exitCode: table.failed, error: ESTATE_NEEDS_CHANT }));
-    else io.err(`${PRODUCT}: ${ESTATE_NEEDS_CHANT}`);
-    return table.failed;
-  }
   const path = flags["--file"] ?? findConfig(io.cwd);
   let config2;
   if (path) {
@@ -7312,8 +6819,7 @@ async function estate(args, json, table, io) {
     }
   }
   const { schedules, driftOps } = config2 ? estateSchedules(config2) : { schedules: [], driftOps: [] };
-  const product = await chantProduct();
-  const words = product ? product.assertProductWords(PRODUCT_WORDS) : PRODUCT_WORDS;
+  const words = (await chantProduct()).assertProductWords(PRODUCT_WORDS);
   const root = path ? dirname12(path) : io.cwd;
   const load = await chant.readEstateLedger(root);
   const built = chant.buildLedgerEstate({ load, words, schedules, ...driftOps.length ? { driftOps } : {} });
@@ -7338,79 +6844,37 @@ async function estate(args, json, table, io) {
 }
 
 // src/notify.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_stages();
 init_words();
-var RELAY_NEEDS_CHANT = `${PRODUCT} notify relay needs chant >= the release after 0.124.54, which carries chant notify relay (chant#4611).`;
 async function notify(args, json, table, io) {
   if (args[0] !== "relay") return usage(`unknown notify command '${args[0] ?? ""}'. Run '${PRODUCT} notify relay'.`, table, io);
-  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => {
-    if (typeof chant.startRelayServer !== "function") {
-      if (json) io.out(JSON.stringify({ command: "notify relay", ok: false, exitCode: table.failed, error: RELAY_NEEDS_CHANT }));
-      else io.err(`${PRODUCT}: ${RELAY_NEEDS_CHANT}`);
-      return Promise.resolve(table.failed);
-    }
-    return chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS);
-  });
+  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS));
 }
 
-// src/cli.ts
-init_policy();
-
 // src/guard.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_stages();
 init_words();
-import { chmodSync, copyFileSync, existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join17 } from "node:path";
-var GUARDED = {
-  pulumi: ["up", "update", "destroy"],
-  plunge: ["up", "update", "destroy"]
-};
-var VALUED_GLOBALS = /* @__PURE__ */ new Set(["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"]);
-var LAUNCHERS = /* @__PURE__ */ new Set(["env", "npx", "sudo", "command", "exec", "nohup", "time", "xargs"]);
-function segments(line) {
-  return line.split(/\|\||&&|[;|\n`]|\$\(|\)/).map((seg) => (seg.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map((t) => t.replace(/^['"]|['"]$/g, ""))).filter((t) => t.length > 0);
-}
-function guardVerdict(line) {
-  for (const words of segments(line)) {
-    let i = 0;
-    while (i < words.length && (LAUNCHERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i - 1] === "env" && words[i].startsWith("-"))) i++;
-    const bin = (words[i] ?? "").split("/").pop();
-    const refused = GUARDED[bin];
-    if (!refused) continue;
-    for (let j = i + 1; j < words.length; j++) {
-      const w = words[j];
-      if (w.startsWith("-")) {
-        if (VALUED_GLOBALS.has(w)) j++;
-        continue;
-      }
-      if (refused.includes(w)) {
-        return {
-          engine: bin,
-          subcommand: w,
-          message: `${PRODUCT} guard: an agent session does not run '${bin} ${w}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.`
-        };
-      }
-      break;
-    }
+import { agentGuard, installAgentGuard } from "@intentius/chant/ci-product";
+var engine2 = { refuse: ["up", "update", "destroy"], valuedFlags: ["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"] };
+var GUARD = {
+  words: { product: PRODUCT, refusal: `an agent session does not run '{what}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.` },
+  rules: {
+    engines: { pulumi: engine2, plunge: engine2 },
+    product: { commands: [["up"], ["resume"], ["approve"], ["override"], ["cancel"], ["move"], ["rollback"], ["action"]], flagValues: [["--respond", "up"]] },
+    wrapperExit: 1
   }
-  return void 0;
-}
-var GUARD_TEMPLATES = new URL("../templates/agent-guard/", import.meta.url);
-var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
-function withGuardHook(settings) {
-  const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
-  const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
-  const has = JSON.stringify(pre).includes("plywood-guard.mjs");
-  if (!has) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
-  return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
-}
+};
 async function guard(args, json, table, io) {
   const [sub, ...rest] = args;
   if (sub === "check") {
     const line = (rest[0] === "--" ? rest.slice(1) : rest).join(" ");
     if (!line.trim()) return usage("guard check takes the command line to check", table, io);
-    const v = guardVerdict(line);
-    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused: v ?? null }));
+    const v = agentGuard(GUARD, { repo: io.cwd }).checkCommand(line, io.cwd);
+    const refused = v ? { engine: v.bin, subcommand: v.command, message: v.message } : null;
+    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused }));
     else io.out(v ? v.message : `${PRODUCT} guard: '${line}' runs`);
     return v ? table.denied : table.done;
   }
@@ -7419,34 +6883,16 @@ async function guard(args, json, table, io) {
     if (dirFlag.missing) return usage("--dir takes a directory", table, io);
     if (dirFlag.rest.length) return usage(`guard install does not take ${dirFlag.rest.join(" ")}`, table, io);
     const root = dirFlag.value ? join17(io.cwd, dirFlag.value) : io.cwd;
-    const written = [];
-    const hookDir = join17(root, ".claude/hooks");
-    mkdirSync7(hookDir, { recursive: true });
-    copyFileSync(new URL("plywood-guard.mjs", GUARD_TEMPLATES), join17(hookDir, "plywood-guard.mjs"));
-    written.push(".claude/hooks/plywood-guard.mjs");
-    const settingsFile = join17(root, ".claude/settings.json");
-    let settings = {};
-    if (existsSync14(settingsFile)) {
-      try {
-        settings = JSON.parse(readFileSync15(settingsFile, "utf8"));
-      } catch (e) {
-        return usage(`.claude/settings.json is not JSON (${e.message}); fix it, then run this again`, table, io);
-      }
-    }
-    writeFileSync8(settingsFile, JSON.stringify(withGuardHook(settings), null, 2) + "\n");
-    written.push(".claude/settings.json");
-    const binDir = join17(root, ".plywood/agent-bin");
-    mkdirSync7(binDir, { recursive: true });
-    for (const name of Object.keys(GUARDED)) {
-      const to = join17(binDir, name);
-      copyFileSync(new URL(`bin/${name}`, GUARD_TEMPLATES), to);
-      chmodSync(to, 493);
-      written.push(`.plywood/agent-bin/${name}`);
+    let written;
+    try {
+      written = installAgentGuard({ ...GUARD, repo: root, install: "project" }).written;
+    } catch (e) {
+      return usage(e.message, table, io);
     }
     if (json) io.out(JSON.stringify({ command: "guard install", ok: true, exitCode: table.done, written }));
     else {
       for (const f of written) io.err(`${PRODUCT} guard: wrote ${f}`);
-      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH and sets PLYWOOD_AGENT_GUARD=1`);
+      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH`);
     }
     return table.done;
   }
@@ -7454,6 +6900,7 @@ async function guard(args, json, table, io) {
 }
 
 // src/identities.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_jobs2();
 init_chant_config();
 init_identity();
@@ -7461,7 +6908,7 @@ init_config();
 init_stacks();
 init_stages();
 init_words();
-import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync15 } from "node:fs";
 import { dirname as dirname13, join as join18 } from "node:path";
 import { targetGlobMatch } from "@intentius/chant/ci-identity";
 function identityRows(config2, env) {
@@ -7524,28 +6971,21 @@ function configIdentities(args, json, table, io) {
   else for (const line of identityLines(config2, environment, rows)) io.out(line);
   return table.done;
 }
-var FORGE_CHECK_MESSAGE = `${PRODUCT} forge check holds the identities next to the forge's environments, protected branches and each cloud's trust policy. The read is chant's (@intentius/chant/forge-check, chant#4608), and the installed chant lacks it; it comes with the chant release after 0.124.54. Run '${PRODUCT} config identities' for what the jobs will hold.`;
 var FORGES2 = ["github", "gitlab", "forgejo"];
-var FORGE_CHECK_FUNCTIONS = ["forgeCheck", "forgeCheckExit", "describeForgeCheck", "forgeCheckTarget", "pipelineContract"];
 var forgeCheckModule;
 function chantForgeCheck() {
   forgeCheckModule ??= (async () => {
-    try {
-      const fc = await import("@intentius/chant/forge-check");
-      const id = await import("@intentius/chant/ci-identity");
-      if (!FORGE_CHECK_FUNCTIONS.every((f) => typeof fc[f] === "function") || typeof id.resolveCloudIdentity !== "function") return void 0;
-      return { ...fc, resolveCloudIdentity: id.resolveCloudIdentity };
-    } catch {
-      return void 0;
-    }
+    const fc = await import("@intentius/chant/forge-check");
+    const { resolveCloudIdentity } = await import("@intentius/chant/ci-identity");
+    return { ...fc, resolveCloudIdentity };
   })();
   return forgeCheckModule;
 }
 function workspaceMembers(root) {
   const file = join18(root, "chant.workspace.json");
-  if (!existsSync15(file)) return [];
+  if (!existsSync14(file)) return [];
   try {
-    const doc = JSON.parse(readFileSync16(file, "utf8"));
+    const doc = JSON.parse(readFileSync15(file, "utf8"));
     return (doc.members ?? []).map((m) => m.name).filter((n) => typeof n === "string");
   } catch {
     return [];
@@ -7574,11 +7014,6 @@ function contractPipelines(fc, cloud, env, members, runner, jobs2) {
 async function forgeCheck(args, json, table, io) {
   if (args[0] !== "check") return usage(`unknown forge command '${args[0] ?? ""}'. Run '${PRODUCT} forge check'.`, table, io);
   const fc = await chantForgeCheck();
-  if (!fc) {
-    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, error: FORGE_CHECK_MESSAGE }));
-    else io.err(`${PRODUCT}: ${FORGE_CHECK_MESSAGE}`);
-    return table.failed;
-  }
   const requireClouds = args.includes("--require-clouds");
   let rest = args.slice(1).filter((a) => a !== "--require-clouds");
   const flags = {};
@@ -7648,6 +7083,7 @@ async function forgeCheck(args, json, table, io) {
 init_control2();
 
 // src/telemetry.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_chant_product();
 init_observe();
 init_config();
@@ -7676,8 +7112,7 @@ async function applyTelemetry(cwd, env = process.env) {
     return {};
   }
   Object.assign(env, added);
-  const chant = await chantProduct();
-  if (chant && typeof chant.configureOtlp === "function") chant.configureOtlp({ prefix: PRODUCT, env });
+  (await chantProduct()).configureOtlp({ prefix: PRODUCT, env });
   return added;
 }
 
@@ -7685,16 +7120,16 @@ async function applyTelemetry(cwd, env = process.env) {
 init_init();
 init_stages();
 init_tips();
-init_images();
 init_up();
 
 // src/upgrade.ts
+init_define_PLYWOOD_IMAGE_DIGESTS();
 init_config();
 init_images();
 init_stages();
 init_words();
 import { execFile } from "node:child_process";
-import { existsSync as existsSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname14, join as join19, relative as relative2, resolve as resolve3 } from "node:path";
 var PLYWOOD_PACKAGE = "@intentius/plywood";
 var CHANT_PACKAGE = "@intentius/chant";
@@ -7727,9 +7162,9 @@ function findPlywoodPackage(dir) {
   let cur = resolve3(dir);
   for (let depth = 0; depth < 32; depth++) {
     const file = join19(cur, "package.json");
-    if (existsSync16(file)) {
+    if (existsSync15(file)) {
       try {
-        const pkg = JSON.parse(readFileSync17(file, "utf8"));
+        const pkg = JSON.parse(readFileSync16(file, "utf8"));
         if (DEP_FIELDS.some((f) => isObject2(pkg[f]) && typeof pkg[f][PLYWOOD_PACKAGE] === "string")) return file;
       } catch {
       }
@@ -7827,10 +7262,10 @@ async function upgrade(args, json, table, io) {
   const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
   if ("error" in release2) return fail(release2.error);
   const chant = opts.chant ?? release2.chant;
-  const pkgText = readFileSync17(pkgFile, "utf8");
+  const pkgText = readFileSync16(pkgFile, "utf8");
   const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
   const declFile = join19(configDir, "chant.workspace.json");
-  const declText = existsSync16(declFile) ? readFileSync17(declFile, "utf8") : void 0;
+  const declText = existsSync15(declFile) ? readFileSync16(declFile, "utf8") : void 0;
   let declMove;
   if (declText !== void 0) {
     try {
@@ -7840,7 +7275,7 @@ async function upgrade(args, json, table, io) {
     }
   }
   const notes = [...pkgMove.left];
-  if (existsSync16(join19(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
+  if (existsSync15(join19(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
   if (configFile) {
     try {
       const note = imageNote(loadConfig(configFile).doc, release2.version);
@@ -7869,8 +7304,8 @@ async function upgrade(args, json, table, io) {
     if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, steps }));
     return table.done;
   }
-  if (pkgMove.text !== pkgText) writeFileSync9(pkgFile, pkgMove.text);
-  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync9(declFile, declMove.text);
+  if (pkgMove.text !== pkgText) writeFileSync8(pkgFile, pkgMove.text);
+  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync8(declFile, declMove.text);
   const files = [...new Set(moves.map((m) => m.file))];
   if (!opts.install) {
     say(`  left to run: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
@@ -7896,7 +7331,7 @@ ${installed2.stderr.trim()}`);
   for (const n of notes) say(`  note: ${n}`);
   const ok = ci2 === void 0 || ci2.code === 0;
   const lockFile = join19(pkgDir, "package-lock.json");
-  const changed = [...files, ...existsSync16(lockFile) ? [rel(lockFile)] : []];
+  const changed = [...files, ...existsSync15(lockFile) ? [rel(lockFile)] : []];
   if (ok) say(`  Open one pull request with ${changed.join(", ")} and the files ${PRODUCT} ci wrote.`);
   else say(`  ${PRODUCT} ci failed (exit ${ci2?.code}); the pins are moved and installed, so fix plywood.yml and run '${steps.ci.command}'`);
   const code = ok ? table.done : ci2?.code ?? table.failed;
@@ -7905,7 +7340,7 @@ ${installed2.stderr.trim()}`);
 }
 function installedVersion(dir) {
   try {
-    const pkg = JSON.parse(readFileSync17(join19(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync16(join19(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -7928,7 +7363,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.3.1" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.5" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
@@ -8019,7 +7454,7 @@ function helpText() {
   ].join("\n");
 }
 async function main(argv, io = stdio) {
-  const { table, source } = await exitCodes();
+  const table = EXIT;
   const json = argv.includes("--json");
   const args = argv.filter((a) => a !== "--json");
   const verb = args[0];
@@ -8032,11 +7467,9 @@ async function main(argv, io = stdio) {
     return table.done;
   }
   if (verb === "--version" || verb === "-v") {
-    emit({ command: "version", ok: true, exitCode: table.done, version: VERSION3, exitCodes: source }, VERSION3);
+    emit({ command: "version", ok: true, exitCode: table.done, version: VERSION3, exitCodes: "chant" }, VERSION3);
     return table.done;
   }
-  await useChantInstallLines();
-  await useChantPolicySource();
   const stageIo = { out: io.out, err: io.err, cwd: process.cwd(), env: process.env };
   if (verb !== "config" && verb !== "init" && verb !== "tips" && verb !== "upgrade") await applyTelemetry(stageIo.cwd, stageIo.env);
   if (verb === "audit") return audit2(args.slice(1), json, table, stageIo);