@intentius/chant-lexicon-pulumi 0.124.58 → 0.124.59

package/dist/drift-read.d.ts

@@ -13,8 +13,12 @@
  * | plunge | unset | `plunge drift --resource <urn> --stream`, once per resource in the export |
  * | plunge | `<urn>` | the same, for that URN alone |
  *
- * Each read passes `--stack` (#4496): the member's declared
- * `pulumi.member.stack`, else the stack the export's URNs name.
+ * Each read passes `--stack` (#4496): the stack asked for (`chant workspace
+ * drift --stack`), else the member's declared `pulumi.member.stack`, else the
+ * stack the export's URNs name. A stack asked for is read from that stack's
+ * export in the index store alone; with none there the read is refused
+ * (`no-drift-read`), where without `--stack` the member reads the store's
+ * export, then the checked-in file.
  *
  * The one read is `refresh`. The member's engine is `pulumiMemberEngine`'s:
  * the member config's `engine`, then a plunge backend URL in `Pulumi.yaml`.
@@ -25,10 +29,13 @@
  */
 import type { ReadDriftOptions, ReadDriftResult } from "@intentius/chant/drift-record";
 import { type PulumiRunner } from "./run.js";
+import type { SnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 /** The runners, injectable so the tests run no binary. */
 export interface PulumiDriftRunners {
     run?: PulumiRunner;
     plunge?: PulumiRunner;
+    /** The index store the exports are read from. Default: the project's. */
+    exportStore?: SnapshotStore | null;
 }
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
 export declare function readPulumiDrift(options: ReadDriftOptions, runners?: PulumiDriftRunners): Promise<ReadDriftResult>;

package/dist/drift-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drift-read.d.ts","sourceRoot":"","sources":["../src/drift-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAA0B,gBAAgB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAG/G,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAEnF,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmC3H"}
+{"version":3,"file":"drift-read.d.ts","sourceRoot":"","sources":["../src/drift-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAA0B,gBAAgB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAG/G,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAEnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgD3H"}

package/dist/drift-read.js

@@ -1,5 +1,6 @@
 import { driftRecordLine, driftSettle, driftStart } from "@intentius/chant/drift-record";
 import { pulumiMemberEngine, refreshPulumiMember } from "./run.js";
+import { readStoredPulumiExport } from "./stack-export-snapshot.js";
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
 export async function readPulumiDrift(options, runners = {}) {
     const member = options.config.pulumi?.member;
@@ -9,6 +10,18 @@ export async function readPulumiDrift(options, runners = {}) {
         return { refused: { code: "read-unsupported", message: `a Pulumi member answers refresh, not ${options.read}` } };
     }
     const { engine } = pulumiMemberEngine(member.dir, member.engine);
+    const stack = options.stack ?? member.stack;
+    if (options.stack !== undefined) {
+        const stored = await readStoredPulumiExport({ dir: member.dir, stack: options.stack, ...(runners.exportStore !== undefined ? { store: runners.exportStore } : {}) });
+        if (!stored) {
+            return {
+                refused: {
+                    code: "no-drift-read",
+                    message: `the index store holds no export for stack ${options.stack} of ${options.member}; the pulumi-up capability writes one after each apply through chant, so apply that stack once, or read without --stack`,
+                },
+            };
+        }
+    }
     let records;
     try {
         records = await refreshPulumiMember({
@@ -16,7 +29,8 @@ export async function readPulumiDrift(options, runners = {}) {
             dir: member.dir,
             observedAt: options.observedAt,
             ...(member.engine ? { engine: member.engine } : {}),
-            ...(member.stack ? { stack: member.stack } : {}),
+            ...(stack ? { stack } : {}),
+            ...(runners.exportStore !== undefined ? { exportStore: runners.exportStore } : {}),
             ...(options.resource !== undefined ? { urns: [options.resource] } : {}),
             ...(runners.run ? { run: runners.run } : {}),
             ...(runners.plunge ? { plunge: runners.plunge } : {}),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d9975374a07d5764ef1b0b209c48fc2ec1b4ec4669808c6d6b1b6429d23a97d6",
+    "manifest.json": "36b210d8802b50b7293b719add906eb945a655ac56fb904660c7c6f210363318",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -20,10 +20,10 @@
     "rules/pul012.ts": "136f9764a532f56ce72461641550c9c4cee6af06c30968d8374f1a65a1b810d4",
     "rules/pul013.ts": "a19b397fecc2bda3e5f32c8f339b0befbd8f1148b32e70a3ba4f9370ee103379",
     "rules/pul014.ts": "25dd5ca4cb7f9906c608f4b7f78559efd188215c9a9a2f9f131498a847d3259b",
-    "rules/pul015.ts": "f5eb45e941dfbe1ec53a31fd12258d7adb9877de33b5bcc566a09e3a0829d9da",
+    "rules/pul015.ts": "d6805c3b8bfacf0fc4a08fb466b066d949a8a5d164b7927cebc50111d1807ae9",
     "skills/chant-pulumi.md": "aef93407423daf6d0acc492a4d5bbf002fbae67b4f993ad36f86725686b98d61",
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "a4603282326e0ed1abf7f6c24fd702e35975fbbc9b1cdee72341269a8f9a9ac1"
+  "composite": "e0f89c0f3684dc4a84e5ca6d311e2901881c5bbd892bd5cbc8eabbe1e367bd76"
 }

package/dist/lint/post-synth/pul015.d.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 export declare const pul015: PostSynthCheck;

package/dist/lint/post-synth/pul015.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}
+{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}

package/dist/lint/post-synth/pul015.js

@@ -3,7 +3,7 @@ import { lastMemberRead } from "../../workspace-member.js";
 import { finding } from "./member-read-helpers.js";
 export const pul015 = {
     id: "PUL015",
-    description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+    description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
     check(_ctx) {
         const read = lastMemberRead();
         if (read?.engine !== "pulumi")

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.58",
+  "version": "0.124.59",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/okf/index.md

@@ -18,5 +18,5 @@ okf_version: '0.2'
 * [PUL012](/rules/PUL012.md) - The pulumi member's stack export holds resources the stack reads and does not manage (external: true)
 * [PUL013](/rules/PUL013.md) - The pulumi member's stack export has a deployment version other than 3, the one chant reads
 * [PUL014](/rules/PUL014.md) - The pulumi member's stack export reads but holds no resources besides the stack and its providers
-* [PUL015](/rules/PUL015.md) - pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+* [PUL015](/rules/PUL015.md) - pulumi.member.engine says pulumi, but the resolved engine is plunge
 * [PUL101](/rules/PUL101.md) - `pulumi.member.dir` is an absolute path written in source.

package/dist/okf/rules/PUL015.md

@@ -1,11 +1,11 @@
 ---
 type: post-synth-check
 title: PUL015
-description: pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+description: pulumi.member.engine says pulumi, but the resolved engine is plunge
 id: PUL015
 severity: error
 category: post-synth
 lexicon: pulumi
 docs: https://intentius.io/chant/lexicons/pulumi/rules/
 ---
-pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+pulumi.member.engine says pulumi, but the resolved engine is plunge

package/dist/rules/pul015.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { pulumiMemberEngine } from "../../run";
@@ -19,7 +20,7 @@ import { finding } from "./member-read-helpers";
 
 export const pul015: PostSynthCheck = {
   id: "PUL015",
-  description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+  description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
 
   check(_ctx: PostSynthContext): PostSynthDiagnostic[] {
     const read = lastMemberRead();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-pulumi",
-  "version": "0.124.58",
+  "version": "0.124.59",
   "type": "module",
   "files": [
     "src/",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.58",
+    "@intentius/chant": "^0.124.59",
     "zod": "^4.3.6"
   },
   "description": "pulumi lexicon for chant: a Pulumi program as a workspace member, its preview in the change set and its refresh as drift records",

package/src/drift-read.test.ts

@@ -9,13 +9,16 @@
  * `plunge-member`'s export is a cut of the recorded plunge stack's. No binary
  * runs here.
  */
-import { readFileSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "vitest";
+import { createSnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 import { foldDriftLines, type ReadDriftOptions } from "@intentius/chant/drift-record";
 import { readPulumiDrift } from "./drift-read";
 import { pulumiPlugin } from "./plugin";
 import type { PulumiRunner } from "./run";
+import { writePulumiExportSnapshot } from "./stack-export-snapshot";
 
 const testdata = join(import.meta.dirname, "testdata");
 const text = (...path: string[]) => readFileSync(join(testdata, ...path), "utf-8");
@@ -104,3 +107,72 @@ describe("readPulumiDrift", () => {
     expect(never.calls).toEqual([]);
   });
 });
+
+describe("readPulumiDrift with --stack", () => {
+  const exportText = text("pulumi-preview", "stack-export.json");
+
+  /** A member directory with Pulumi.yaml and no checked-in export, and a store holding the stacks named. */
+  async function memberWithStore(stacks: string[]) {
+    const dir = mkdtempSync(join(tmpdir(), "pulumi-drift-stack-"));
+    cpSync(join(testdata, "pulumi-preview", "Pulumi.yaml"), join(dir, "Pulumi.yaml"));
+    mkdirSync(join(dir, "node_modules"));
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    for (const stack of stacks) {
+      const wrote = await writePulumiExportSnapshot({
+        dir,
+        stack,
+        environment: "prod",
+        engine: "pulumi",
+        run: async () => ({ stdout: exportText }),
+        store,
+      });
+      expect(wrote.written, JSON.stringify(wrote)).toBe(true);
+    }
+    return { dir, store };
+  }
+
+  test("reads the named stack's stored export and passes that stack to every refresh", async () => {
+    const { dir, store } = await memberWithStore(["staging", "prod-eu"]);
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "prod-eu" }), { run: pulumi.run, plunge: never.run, exportStore: store });
+    if (!("lines" in answer)) throw new Error(JSON.stringify(answer));
+    expect(pulumi.calls.length).toBeGreaterThan(0);
+    for (const call of pulumi.calls) expect(call.slice(call.indexOf("--stack"), call.indexOf("--stack") + 2)).toEqual(["--stack", "prod-eu"]);
+  });
+
+  test("beats the member's declared stack", async () => {
+    const { dir, store } = await memberWithStore(["staging", "prod-eu"]);
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const config = { pulumi: { member: { dir, label: "site", stack: "staging" } } };
+    const answer = await readPulumiDrift({ ...options(dir, { stack: "prod-eu", resource: bucket }), config }, { run: pulumi.run, plunge: never.run, exportStore: store });
+    expect("lines" in answer).toBe(true);
+    expect(pulumi.calls).toEqual([["refresh", "--preview-only", "--json", "--stack", "prod-eu", "--target", bucket]]);
+  });
+
+  test("a store with no export for that stack is an error naming the stack, and nothing runs", async () => {
+    const { dir, store } = await memberWithStore(["staging"]);
+    const spy = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "prod-eu" }), { run: spy.run, plunge: never.run, exportStore: store });
+    expect(answer).toMatchObject({ refused: { code: "no-drift-read" } });
+    expect("refused" in answer && answer.refused.message).toMatch(/holds no export for stack prod-eu of site/);
+    expect(spy.calls).toEqual([]);
+  });
+
+  test("an empty store is refused too, though a checked-in export sits beside the member", async () => {
+    const dir = join(testdata, "pulumi-preview");
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    const spy = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "floci" }), { run: spy.run, plunge: never.run, exportStore: store });
+    expect(answer).toMatchObject({ refused: { code: "no-drift-read" } });
+    expect(spy.calls).toEqual([]);
+  });
+
+  test("without --stack the read is as before: the checked-in export when the store has none", async () => {
+    const dir = join(testdata, "pulumi-preview");
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { resource: bucket }), { run: pulumi.run, plunge: never.run, exportStore: store });
+    expect("lines" in answer).toBe(true);
+    expect(pulumi.calls).toEqual([["refresh", "--preview-only", "--json", "--stack", "floci", "--target", bucket]]);
+  });
+});

package/src/drift-read.ts

@@ -13,8 +13,12 @@
  * | plunge | unset | `plunge drift --resource <urn> --stream`, once per resource in the export |
  * | plunge | `<urn>` | the same, for that URN alone |
  *
- * Each read passes `--stack` (#4496): the member's declared
- * `pulumi.member.stack`, else the stack the export's URNs name.
+ * Each read passes `--stack` (#4496): the stack asked for (`chant workspace
+ * drift --stack`), else the member's declared `pulumi.member.stack`, else the
+ * stack the export's URNs name. A stack asked for is read from that stack's
+ * export in the index store alone; with none there the read is refused
+ * (`no-drift-read`), where without `--stack` the member reads the store's
+ * export, then the checked-in file.
  *
  * The one read is `refresh`. The member's engine is `pulumiMemberEngine`'s:
  * the member config's `engine`, then a plunge backend URL in `Pulumi.yaml`.
@@ -27,11 +31,15 @@ import type { DriftLine, DriftRecord, ReadDriftOptions, ReadDriftResult } from "
 import { driftRecordLine, driftSettle, driftStart } from "@intentius/chant/drift-record";
 import type { PulumiConfig } from "./config";
 import { pulumiMemberEngine, refreshPulumiMember, type PulumiRunner } from "./run";
+import { readStoredPulumiExport } from "./stack-export-snapshot";
+import type { SnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 
 /** The runners, injectable so the tests run no binary. */
 export interface PulumiDriftRunners {
   run?: PulumiRunner;
   plunge?: PulumiRunner;
+  /** The index store the exports are read from. Default: the project's. */
+  exportStore?: SnapshotStore | null;
 }
 
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
@@ -42,6 +50,18 @@ export async function readPulumiDrift(options: ReadDriftOptions, runners: Pulumi
     return { refused: { code: "read-unsupported", message: `a Pulumi member answers refresh, not ${options.read}` } };
   }
   const { engine } = pulumiMemberEngine(member.dir, member.engine);
+  const stack = options.stack ?? member.stack;
+  if (options.stack !== undefined) {
+    const stored = await readStoredPulumiExport({ dir: member.dir, stack: options.stack, ...(runners.exportStore !== undefined ? { store: runners.exportStore } : {}) });
+    if (!stored) {
+      return {
+        refused: {
+          code: "no-drift-read",
+          message: `the index store holds no export for stack ${options.stack} of ${options.member}; the pulumi-up capability writes one after each apply through chant, so apply that stack once, or read without --stack`,
+        },
+      };
+    }
+  }
   let records: DriftRecord[];
   try {
     records = await refreshPulumiMember({
@@ -49,7 +69,8 @@ export async function readPulumiDrift(options: ReadDriftOptions, runners: Pulumi
       dir: member.dir,
       observedAt: options.observedAt,
       ...(member.engine ? { engine: member.engine } : {}),
-      ...(member.stack ? { stack: member.stack } : {}),
+      ...(stack ? { stack } : {}),
+      ...(runners.exportStore !== undefined ? { exportStore: runners.exportStore } : {}),
       ...(options.resource !== undefined ? { urns: [options.resource] } : {}),
       ...(runners.run ? { run: runners.run } : {}),
       ...(runners.plunge ? { plunge: runners.plunge } : {}),

package/src/lint/post-synth/post-synth.test.ts

@@ -1,5 +1,7 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, test } from "vitest";
+import { afterEach, describe, expect, test, vi } from "vitest";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
 import { PULUMI_SECRET_SIG, PULUMI_SIG_KEY } from "../../values";
 import { setLastMemberRead, setLastMemberReport } from "../../workspace-member";
@@ -23,6 +25,7 @@ import { pul015 } from "./pul015";
 const ctx = { outputs: new Map(), entities: new Map() } as unknown as PostSynthContext;
 
 afterEach(() => {
+  vi.unstubAllEnvs();
   setLastMemberReport(undefined);
   setLastMemberRead(undefined);
 });
@@ -196,4 +199,47 @@ describe("pulumi post-synth checks", () => {
     readWith([], { dir: stockDir, engine: "plunge" });
     expect(pul015.check(ctx)).toEqual([]);
   });
+
+  test("PUL015 names the source of the resolved plunge engine", () => {
+    // Pulumi.yaml
+    readWith([], { dir: plungeDir, engine: "pulumi" });
+    expect(pul015.check(ctx)[0].message).toContain("Pulumi.yaml names the plunge backend");
+
+    // PULUMI_BACKEND_URL, on a program whose Pulumi.yaml names no backend
+    vi.stubEnv("PULUMI_BACKEND_URL", "plunge+s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "pulumi" });
+    const fromEnv = pul015.check(ctx);
+    expect(fromEnv).toHaveLength(1);
+    expect(fromEnv[0].message).toContain("PULUMI_BACKEND_URL names the plunge backend plunge+s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "plunge" });
+    expect(pul015.check(ctx)).toEqual([]);
+    vi.stubEnv("PULUMI_BACKEND_URL", "s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "pulumi" });
+    expect(pul015.check(ctx)).toEqual([]);
+    vi.unstubAllEnvs();
+
+    // plywood.yml, engine and backend
+    const root = mkdtempSync(join(tmpdir(), "pul015-"));
+    mkdirSync(join(root, ".git"));
+    const member = join(root, "infra");
+    mkdirSync(member);
+    writeFileSync(join(member, "Pulumi.yaml"), "name: app\nruntime: nodejs\n");
+    writeFileSync(join(root, "plywood.yml"), "engine: plunge\n");
+    readWith([], { dir: member, engine: "pulumi" });
+    const fromEngine = pul015.check(ctx);
+    expect(fromEngine).toHaveLength(1);
+    expect(fromEngine[0].message).toContain("plywood.yml says engine: plunge");
+    writeFileSync(join(root, "plywood.yml"), "backend: plunge+file:///state\n");
+    const fromBackend = pul015.check(ctx);
+    expect(fromBackend).toHaveLength(1);
+    expect(fromBackend[0].message).toContain("plywood.yml names the plunge backend plunge+file:///state");
+    writeFileSync(join(root, "plywood.yml"), "engine: pulumi\n");
+    expect(pul015.check(ctx)).toEqual([]);
+  });
+
+  test("PUL015 does not report the other direction: engine plunge on a stock backend", () => {
+    vi.stubEnv("PULUMI_BACKEND_URL", "s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "plunge" });
+    expect(pul015.check(ctx)).toEqual([]);
+  });
 });

package/src/lint/post-synth/pul015.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { pulumiMemberEngine } from "../../run";
@@ -19,7 +20,7 @@ import { finding } from "./member-read-helpers";
 
 export const pul015: PostSynthCheck = {
   id: "PUL015",
-  description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+  description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
 
   check(_ctx: PostSynthContext): PostSynthDiagnostic[] {
     const read = lastMemberRead();