@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EAEvB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/H,OAAO,EACL,SAAS,IAAI,iBAAiB,EAC9B,SAAS,EACT,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1J,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9F,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3G,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAIlF,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EAEvB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/H,OAAO,EACL,SAAS,IAAI,iBAAiB,EAC9B,SAAS,EACT,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1J,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9F,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3G,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAIjI,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -21,6 +21,7 @@ export { priorStateValues, stateResources, stateOutputs } from "./applied-state.
 export { ComposedRun, composedPlanDigest, changesSomething, } from "./compose/run.js";
 // The plan shape of a `show -json` plan (#4436), for core's `coveredRound`.
 export { terraformPlanShape } from "./plan-shape.js";
+export { terraformLockRows, terraformLockRowsFromPart, terraformDefaultLockGrain, terraformLockGrainRefusal } from "./lock-rows.js";
 // Composed runs (#4419, #4438): which roots compose, in what order, and why
 // the others fall back. Off unless `terraform.compose.enabled` is set.
 export { compositionFor, compositionIfEnabled, composeOff, composeSet, readOrder, moduleNames, fallbackLine, withPlanFailed, identityKey, DEFAULT_COMPOSE_MAX, COMPOSE_STEP_KIND, } from "./compose.js";
@@ -63,3 +64,5 @@ export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 // engine is injected, and defaults to core's front (#2495): this lexicon
 // dials none.
 export { predictTerraformBehaviour, terraformBehaviourRequest, terraformPredictOptionsFrom, TERRAFORM_REFERENCE_CATALOG, } from "./behaviour/index.js";
+// terraform, tofu and choudoufu exit statuses on chant's exit-code table (#4553).
+export { terraformExitOf, terraformPlanMoved } from "./exit-codes.js";

package/dist/integrity.json

@@ -1,16 +1,17 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "a4392033f97c3faba6875ccbdaee0d9702511e9c441b628b5ad7352aa61bd101",
+    "manifest.json": "fc7d3f91a4b8cbef48f1ef39e169b36d41f90bfe2b68ba0c46153dd5461efdcd",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
     "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
     "rules/flat-attributes.ts": "135b4b118cb76ea7ef7a6f2851bb5c80d0907485b86a364c017f66388d0d4cb2",
     "rules/module-source.ts": "9e6e8f47725c3a01ee8b65b7acff6fe902bf5fc638820efdb5721f4c6ea9d95c",
+    "rules/record-store.ts": "644ef9785ea9500e8945a181160aff1c4133ad895451413b40d293abc9620066",
     "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
     "rules/terragrunt.ts": "1973dbee0933db9593347aa662c71b86f02302c19a28f5ecba23a694ca96641b",
-    "rules/tf001.ts": "1f07f0f9172a7ddb9c726ba4be1bea08e54e25701fbe59cc54c3cf4401aca999",
+    "rules/tf001.ts": "d0c20e9e70403ec79515114cc00dff8c599c372b343ff96beb951bb7b0dbf9ba",
     "rules/tf002.ts": "6759fe5135c85ed9016adbddd90e77743cdf243b261a98deb38e907da83c6d25",
     "rules/tf003.ts": "7b705a08f03769f353910e524bb3f1b4cc844bcb620e240a9063288d0fd60802",
     "rules/tf004.ts": "59ef2108aa561cc6a40cd970fc54604be60872b51a035ed3bc3c53346a31d358",
@@ -32,7 +33,7 @@
     "rules/tf020.ts": "2210815c355e37459c34de0fe622f0b87b78010ee7c444135cf5abf7e048adf7",
     "rules/tf021.ts": "ad3cd813a289437d33da866927697077e7a5b20f3c05341325193d286b57bbd5",
     "rules/tf022.ts": "5466797cd88fd5489f6c5abd1e796d7c5d3d0e977d0e9e043d253f6ecf369cdc",
-    "rules/tf024.ts": "c0c101f913bd3d0fdb5403ee57888e80d8fc612e363f0eb43d7ae759ac1d5651",
+    "rules/tf024.ts": "e82bb9d29fb1645823899fb03fcb0381ca2df11039f02609acee861013278724",
     "rules/tf025.ts": "0c31be3885e940e2b3e9ac8e023067d8d6e2b42c04f628890405c9fc6db7d1ce",
     "rules/tf026.ts": "8cf1e61bc9563aa2d3c149f243ffa02ad4f183eebb672f861cd6c4e6fba1d310",
     "rules/tf027.ts": "0a6062a230cdaa707f82b2353be4b34dff81322d24075d46f732a47bcef15893",
@@ -54,7 +55,9 @@
     "rules/tf043.ts": "c8724a7c0734870101d73e411ed97240c03a01a1133adbf0b445a5083f40faee",
     "rules/tf044.ts": "4e9b17a6080074d2b2e02862a9f1c9c2baf0ef32d4f3b48df1e62d9d8c362008",
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
+    "rules/tf046.ts": "d3de9a40366847a832a5ad739aa8c4411249aab36815f7eeb245f9b2fdb91e42",
+    "rules/tf047.ts": "bfa86f85c4c5efff297280fc2f15104d6319fa96dfc444a31829fb7353224092",
     "skills/chant-terraform.md": "53dd11c7b289652f92fdaf2c03766abda46d8964e31fe709e8b142ced4f19c50"
   },
-  "composite": "8f145fa60592252c6d7e4bb60ce4599c7bcfb273853c12a1626757b34bd72411"
+  "composite": "4ad36b947836a73adda4843346e414abf6ed9efe81fda791855d70f3143ed0f0"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAge1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0f1D,CAAC"}

package/dist/lint/audit-catalog.js

@@ -65,9 +65,10 @@ export const terraformAuditCatalog = {
         tier: "merge-worthy",
         fixKind: "guidance",
         category: "correctness",
-        title: "Live root declares a backend or cloud block, which choudoufu refuses",
-        remediation: "Remove the `backend`/`cloud` block from the live root's terraform block; a live root's prior " +
-            "state is a projection rebuilt from the live system every run, so there is no state to store.",
+        title: "Live root declares a backend or cloud block, which choudoufu ignores",
+        remediation: "Keep a `backend` block if other roots read this estate's outputs or the record store should be " +
+            "derived from its bucket; declare `record_store` to put records elsewhere. Remove a `cloud` block, " +
+            "which choudoufu drops entirely, or swap it for a `backend` block.",
         yamlBased: false,
     },
     TF025: {
@@ -495,6 +496,29 @@ export const terraformAuditCatalog = {
         remediation: 'Set `terragrunt_version_constraint = ">= 1.1.0"` in the root config. Off by default; judged only across the configs scanned.',
         yamlBased: false,
     },
+    TF046: {
+        id: "TF046",
+        tier: "report-only",
+        fixKind: "guidance",
+        category: "correctness",
+        title: "Live root resolves to the local record store in a CI run",
+        remediation: "Keep or add a `backend` block of type s3, gcs or azurerm with a literal bucket, so choudoufu " +
+            "derives the record store from it, or declare `record_store` in the live block or `estate.chdf.hcl`. " +
+            "The rule is off by default and terragucci turns it on for its users; an emulator or test lane " +
+            "that keeps the local store on purpose sets `CHANT_ALLOW_LOCAL_RECORD_STORE=1`.",
+        yamlBased: false,
+    },
+    TF047: {
+        id: "TF047",
+        tier: "report-only",
+        fixKind: "guidance",
+        category: "correctness",
+        title: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+        remediation: "Run `choudoufu live-check` on the root to see each refused site, or pin a version whose examples are clear in " +
+            "the static tier of choudoufu's module table (https://intentius.io/choudoufu/aws/compatibility/#modules). " +
+            "Off by default; terragucci turns it on for its users.",
+        yamlBased: false,
+    },
 };
 // Prior art credits, if any, live beside the rules in ./audit-lineage.ts (see
 // core audit/prior-art.ts).

package/dist/lint/audit-lineage.d.ts

@@ -76,8 +76,8 @@
  *
  * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
  * own `RuleStateBackend`, `internal/live/lint/issue.go` of
- * github.com/INTENTIUS/choudoufu: the identical condition, checked the same
- * way this fork checks it at `init` before any command runs. TF025 (a live
+ * github.com/INTENTIUS/choudoufu: the same condition, which choudoufu has
+ * reported as a warning since its #2213 (the block is ignored, not refused). TF025 (a live
  * root's non-default `terraform.workspace`) has no entry: its workspace half
  * is refused at the CLI argument-parsing layer there
  * (`internal/command/live_mode.go`), not by a dedicated lint rule under
@@ -110,6 +110,18 @@
  * a root's mode, and no surveyed tool has an Op model to read: choudoufu lints
  * HCL, and every tflint ruleset, tfsec/trivy-checks and the Sentinel policies
  * do the same. There is nothing upstream to credit.
+ *
+ * TF046 (chant#4561, a live root on the local record store in a CI run) has
+ * no entry. choudoufu prints where records go on every run and reports a
+ * `record_store.note` in `live-check -json` (INTENTIUS/choudoufu#2293), but
+ * it has no `internal/live/lint` rule for the local store, and no surveyed
+ * tool knows about record stores. TF044 is the nearest neighbour, for a
+ * Terragrunt state backend.
+ *
+ * TF047 (chant#4560, a live root pins a module version the known-module
+ * catalog has no row for, or one with refusals) has no entry. Its data is
+ * choudoufu's own module table (choudoufu#2292), vendored; no surveyed tool
+ * checks a module pin against a measured compatibility table.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 export declare const terraformAuditLineage: Record<string, Lineage[]>;

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAob3D,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAob3D,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6C3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA+C3C,CAAC"}

package/dist/lint/post-synth/index.js

@@ -42,6 +42,8 @@ import { tf042 } from "./tf042.js";
 import { tf043 } from "./tf043.js";
 import { tf044 } from "./tf044.js";
 import { tf045 } from "./tf045.js";
+import { tf046 } from "./tf046.js";
+import { tf047 } from "./tf047.js";
 export const postSynthChecks = [
     tf001,
     tf002,
@@ -87,4 +89,6 @@ export const postSynthChecks = [
     tf043,
     tf044,
     tf045,
+    tf046,
+    tf047,
 ];

package/dist/lint/post-synth/record-store.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The record store a live root resolves to, read from its HCL the way
+ * choudoufu resolves it (INTENTIUS/choudoufu#2293, `internal/configs/live_derive.go`
+ * at choudoufu 74ffde956bfd97f44b8ad444424584e23321adc2). Shared by TF024,
+ * which names where records go, and TF046, which guards a CI root that ends
+ * up on the local store, so the two never disagree.
+ *
+ * The order is choudoufu's:
+ *
+ * 1. A `record_store "<kind>"` block in the `live` block or the
+ *    `estate.chdf.hcl` sidecar always wins (`source: "record_store"`).
+ * 2. Otherwise the backend block choudoufu ignores under live gives the store,
+ *    s3 to s3, gcs to gcs, azurerm to azurerm (`source: "backend"`). s3 and gcs
+ *    need a literal `bucket`; azurerm needs literal `storage_account_name`,
+ *    `container_name` and `resource_group_name`. A value passed only with
+ *    `-backend-config` is not in the configuration, so choudoufu does not see
+ *    it either.
+ * 3. Otherwise the store is local (`source: "implied"`), with `note` saying
+ *    why a backend that was there was not used.
+ *
+ * This mirrors `record_store.source` and `record_store.note` in
+ * `choudoufu live-check -json`. A literal here is a string hcl2json hands back
+ * with no `${...}` in it, the same "not determined" reading the Terragrunt
+ * rules use (`./terragrunt.ts`).
+ */
+import type { BlockBody } from "../../hcl/parse.js";
+export type RecordStoreSource = "record_store" | "backend" | "implied";
+export interface ResolvedRecordStore {
+    /** `local`, `s3`, `gcs`, `azurerm` or `kubernetes`, or whatever label a `record_store` block carries. */
+    kind: string;
+    source: RecordStoreSource;
+    /** The backend type the store came from, or was not derived from, when there is a backend block. */
+    backend?: string;
+    /** Why a backend block that was present did not give a store. Set only with `source: "implied"`. */
+    note?: string;
+}
+/** Backend types choudoufu derives a record store from (INTENTIUS/choudoufu#2293). */
+export declare const DERIVABLE_BACKENDS: ReadonlySet<string>;
+/**
+ * The label of a `record_store "<kind>"` block in a live declaration body, or
+ * undefined when it declares none. hcl2json nests the label one level down,
+ * as it does for `backend` (see `backendTypes` in `./tf001.ts`).
+ */
+export declare function recordStoreKind(liveBody: BlockBody): string | undefined;
+/**
+ * Resolve one live root's record store.
+ *
+ * `terraformBodies` are the bodies of every `terraform` block in the root (a
+ * backend can sit in a separate `backend.tf`). `liveBodies` are the root's
+ * live declarations: its `live` block and its sidecar, if any. choudoufu
+ * refuses a root that has both, so the first `record_store` found is the one.
+ */
+export declare function resolveRecordStore(terraformBodies: readonly BlockBody[], liveBodies: readonly BlockBody[]): ResolvedRecordStore;
+//# sourceMappingURL=record-store.d.ts.map

package/dist/lint/post-synth/record-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAClC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAOzF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAMvE;AAmCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,SAAS,SAAS,EAAE,EACrC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,mBAAmB,CAcrB"}

package/dist/lint/post-synth/record-store.js

@@ -0,0 +1,104 @@
+/**
+ * The record store a live root resolves to, read from its HCL the way
+ * choudoufu resolves it (INTENTIUS/choudoufu#2293, `internal/configs/live_derive.go`
+ * at choudoufu 74ffde956bfd97f44b8ad444424584e23321adc2). Shared by TF024,
+ * which names where records go, and TF046, which guards a CI root that ends
+ * up on the local store, so the two never disagree.
+ *
+ * The order is choudoufu's:
+ *
+ * 1. A `record_store "<kind>"` block in the `live` block or the
+ *    `estate.chdf.hcl` sidecar always wins (`source: "record_store"`).
+ * 2. Otherwise the backend block choudoufu ignores under live gives the store,
+ *    s3 to s3, gcs to gcs, azurerm to azurerm (`source: "backend"`). s3 and gcs
+ *    need a literal `bucket`; azurerm needs literal `storage_account_name`,
+ *    `container_name` and `resource_group_name`. A value passed only with
+ *    `-backend-config` is not in the configuration, so choudoufu does not see
+ *    it either.
+ * 3. Otherwise the store is local (`source: "implied"`), with `note` saying
+ *    why a backend that was there was not used.
+ *
+ * This mirrors `record_store.source` and `record_store.note` in
+ * `choudoufu live-check -json`. A literal here is a string hcl2json hands back
+ * with no `${...}` in it, the same "not determined" reading the Terragrunt
+ * rules use (`./terragrunt.ts`).
+ */
+import { backendTypes } from "./tf001.js";
+import { isExpression } from "./terragrunt.js";
+/** Backend types choudoufu derives a record store from (INTENTIUS/choudoufu#2293). */
+export const DERIVABLE_BACKENDS = new Set(["s3", "gcs", "azurerm"]);
+const asRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+const firstBody = (v) => asRecord(Array.isArray(v) ? v[0] : v);
+/**
+ * The label of a `record_store "<kind>"` block in a live declaration body, or
+ * undefined when it declares none. hcl2json nests the label one level down,
+ * as it does for `backend` (see `backendTypes` in `./tf001.ts`).
+ */
+export function recordStoreKind(liveBody) {
+    const raw = liveBody["record_store"];
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const labels = Object.keys(raw);
+    return labels[0];
+}
+/** A top-level backend argument as a literal string, or undefined when it is absent, empty or an expression. */
+function literal(body, name) {
+    const v = body[name];
+    if (typeof v !== "string" || v === "" || isExpression(v))
+        return undefined;
+    return v;
+}
+/**
+ * Why a backend block gives no record store, or undefined when it gives one.
+ * The wording follows choudoufu's `Live.RecordStoreNote`; an empty string
+ * means no store and nothing to say (a `local` backend).
+ */
+function derivationNote(type, body) {
+    const where = `backend "${type}"`;
+    switch (type) {
+        case "s3":
+        case "gcs":
+            return literal(body, "bucket") === undefined
+                ? `${where} sets no literal bucket; values passed with -backend-config are not read`
+                : undefined;
+        case "azurerm":
+            for (const name of ["storage_account_name", "container_name", "resource_group_name"]) {
+                if (literal(body, name) === undefined)
+                    return `${where} sets no literal ${name}, which the azurerm record store needs`;
+            }
+            return undefined;
+        case "local":
+            // choudoufu leaves no note here: a local backend and the local store agree.
+            return "";
+        default:
+            return `${where} has no record store counterpart`;
+    }
+}
+/**
+ * Resolve one live root's record store.
+ *
+ * `terraformBodies` are the bodies of every `terraform` block in the root (a
+ * backend can sit in a separate `backend.tf`). `liveBodies` are the root's
+ * live declarations: its `live` block and its sidecar, if any. choudoufu
+ * refuses a root that has both, so the first `record_store` found is the one.
+ */
+export function resolveRecordStore(terraformBodies, liveBodies) {
+    for (const live of liveBodies) {
+        const kind = recordStoreKind(live);
+        if (kind !== undefined)
+            return { kind, source: "record_store" };
+    }
+    for (const tf of terraformBodies) {
+        const type = backendTypes(tf)[0];
+        if (type === undefined)
+            continue;
+        const body = firstBody(asRecord(tf["backend"])[type]);
+        const note = derivationNote(type, body);
+        if (note === undefined)
+            return { kind: type, source: "backend", backend: type };
+        return { kind: "local", source: "implied", backend: type, ...(note ? { note } : {}) };
+    }
+    return { kind: "local", source: "implied" };
+}

package/dist/lint/post-synth/tf001.d.ts

@@ -30,8 +30,8 @@
  * module's `terraform` block is skipped here rather than read as if it were
  * the root's.
  *
- * Does not fire on a live root (#2103): a `backend` block is exactly what
- * choudoufu refuses there (TF024's territory), and the fallback to local
+ * Does not fire on a live root (#2103): choudoufu ignores a `backend` block
+ * there (TF024 reports what it still does with it), and the fallback to local
  * state this check warns about does not apply, since a live root keeps no
  * state file at all, local or remote.
  */

package/dist/lint/post-synth/tf001.js

@@ -30,8 +30,8 @@
  * module's `terraform` block is skipped here rather than read as if it were
  * the root's.
  *
- * Does not fire on a live root (#2103): a `backend` block is exactly what
- * choudoufu refuses there (TF024's territory), and the fallback to local
+ * Does not fire on a live root (#2103): choudoufu ignores a `backend` block
+ * there (TF024 reports what it still does with it), and the fallback to local
  * state this check warns about does not apply, since a live root keeps no
  * state file at all, local or remote.
  */

package/dist/lint/post-synth/tf024.d.ts

@@ -1,24 +1,48 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
  *
  * One diagnostic per root, fired from the root's `terraform` block.
  */
-import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import type { PostSynthCheck, PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+export { DERIVABLE_BACKENDS } from "./record-store.js";
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export declare function liveBodiesByRoot(ctx: PostSynthContext): Map<string, BlockBody[]>;
 export declare const tf024: PostSynthCheck;
 //# sourceMappingURL=tf024.d.ts.map

package/dist/lint/post-synth/tf024.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}
+{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAK5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAKpD,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAYhF;AAqCD,eAAO,MAAM,KAAK,EAAE,cA4CnB,CAAC"}

package/dist/lint/post-synth/tf024.js

@@ -1,18 +1,38 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
@@ -20,15 +40,61 @@
  * One diagnostic per root, fired from the root's `terraform` block.
  */
 import { isResourceDeclarable } from "@intentius/chant/declarable";
-import { TERRAFORM_TYPE } from "../../hcl/parse.js";
-import { hasBlock } from "./tf001.js";
+import { LIVE_TYPE, TERRAFORM_TYPE } from "../../hcl/parse.js";
+import { backendTypes, hasBlock } from "./tf001.js";
 import { isRootScoped } from "./scope.js";
+import { DERIVABLE_BACKENDS, resolveRecordStore } from "./record-store.js";
+export { DERIVABLE_BACKENDS } from "./record-store.js";
+const bodyOf = (props) => (typeof props.body === "object" && props.body !== null ? props.body : {});
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export function liveBodiesByRoot(ctx) {
+    const roots = new Map();
+    for (const entity of ctx.entities.values()) {
+        if (entity.entityType !== LIVE_TYPE)
+            continue;
+        if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+            continue;
+        const props = entity.props;
+        const root = typeof props.root === "string" ? props.root : "";
+        const list = roots.get(root) ?? [];
+        list.push(bodyOf(props));
+        roots.set(root, list);
+    }
+    return roots;
+}
+function backendMessage(root, type, store) {
+    const label = type ? `backend "${type}"` : "backend";
+    const head = `Root module "${root}" runs choudoufu with a declared estate and also declares a ${label} block. ` +
+        "choudoufu ignores it with a warning: no state is read or written there and `init -migrate-state` " +
+        "is refused. An apply publishes the estate's non-sensitive outputs to the location it names, so " +
+        "terraform_remote_state readers keep working.";
+    if (store.source === "record_store") {
+        return `${head} Records go to the record_store the live declaration names, which wins over the backend.`;
+    }
+    if (store.source === "backend") {
+        return (`${head} With no record_store declared, choudoufu derives the record store from this backend's ` +
+            "bucket and prints it on every init and plan (INTENTIUS/choudoufu#2293). Declare record_store to " +
+            "put records somewhere else.");
+    }
+    const why = DERIVABLE_BACKENDS.has(type) && store.note
+        ? `No record store is derived from it: ${store.note}.`
+        : `No record store is derived from a ${type ? `"${type}"` : "backend of unknown type"} (only s3, gcs and azurerm are).`;
+    return (`${head} ${why} No record_store is declared, so records stay in the local ` +
+        "store. Declare record_store if more than one machine runs this root (TF046 guards this in CI).");
+}
+function cloudMessage(root) {
+    return (`Root module "${root}" runs choudoufu with a declared estate and also declares a cloud block. ` +
+        "choudoufu ignores it entirely: no state is read or written there, no outputs are published to it, " +
+        "and no record store is derived from it. Remove it, or use a backend block if " +
+        "terraform_remote_state readers need this estate's outputs.");
+}
 export const tf024 = {
     id: "TF024",
-    description: "Live root declares a backend or cloud block, which choudoufu refuses",
+    description: "Live root declares a backend or cloud block, which choudoufu ignores",
     check(ctx) {
         const diagnostics = [];
         const flagged = new Set();
+        let liveBodies;
         for (const [name, entity] of ctx.entities) {
             if (entity.entityType !== TERRAFORM_TYPE)
                 continue;
@@ -40,19 +106,25 @@ export const tf024 = {
             const root = typeof props.root === "string" ? props.root : "";
             if (flagged.has(root))
                 continue;
-            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
-            const hasBackend = hasBlock(body, "backend");
+            const body = bodyOf(props);
             const hasCloud = hasBlock(body, "cloud");
+            const hasBackend = hasBlock(body, "backend");
             if (!hasBackend && !hasCloud)
                 continue;
             flagged.add(root);
-            const blockKind = hasBackend ? "backend" : "cloud";
+            // A cloud block does nothing at all, so it is the one worth a warning
+            // when a (malformed) root somehow carries both.
+            if (hasCloud) {
+                diagnostics.push({ checkId: "TF024", severity: "warning", message: cloudMessage(root), entity: name, lexicon: "terraform" });
+                continue;
+            }
+            liveBodies ?? (liveBodies = liveBodiesByRoot(ctx));
+            const type = backendTypes(body)[0] ?? "";
+            const store = resolveRecordStore([body], liveBodies.get(root) ?? []);
             diagnostics.push({
                 checkId: "TF024",
-                severity: "error",
-                message: `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
-                    `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
-                    `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+                severity: "info",
+                message: backendMessage(root, type, store),
                 entity: name,
                 lexicon: "terraform",
             });