@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/dist/rules/tf025.ts

@@ -0,0 +1,101 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope";
+
+/** Recursively search a parsed HCL body for a `terraform.workspace` reference, un-evaluated interpolations included. */
+function containsWorkspaceRef(value: unknown): boolean {
+  if (typeof value === "string") return /\bterraform\.workspace\b/.test(value);
+  if (Array.isArray(value)) return value.some(containsWorkspaceRef);
+  if (value !== null && typeof value === "object") return Object.values(value).some(containsWorkspaceRef);
+  return false;
+}
+
+export const tf025: PostSynthCheck = {
+  id: "TF025",
+  description: "Live root references a non-default terraform.workspace, which choudoufu refuses",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flaggedRootWorkspace = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as {
+        root?: unknown;
+        body?: unknown;
+        mode?: unknown;
+        workspace?: unknown;
+        address?: unknown;
+      };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+
+      if (
+        typeof props.workspace === "string" &&
+        props.workspace !== "" &&
+        props.workspace !== "default" &&
+        isRootScoped(entity) &&
+        !flaggedRootWorkspace.has(root)
+      ) {
+        flaggedRootWorkspace.add(root);
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `Root module "${root}" runs choudoufu with a declared estate and configures workspace ` +
+            `"${props.workspace}" in terraform.roots.${root}. choudoufu refuses any workspace but ` +
+            '"default" on a live root. Remove `workspace` from this root\'s config (or set it to "default").',
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+
+      if (containsWorkspaceRef(props.body)) {
+        const address = typeof props.address === "string" ? props.address : name;
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `"${address}" in root module "${root}" references \`terraform.workspace\`. choudoufu refuses ` +
+            'any workspace but "default" on a live root, so this always resolves to "default" there. ' +
+            "Remove the reference.",
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf026.ts

@@ -0,0 +1,84 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+
+/** Verbs that satisfy `delete: "never"` for the `undeclared_tagged` quadrant. */
+const SATISFIES_NEVER = new Set(["keep", "untag", "report"]);
+
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export function policyBlockOf(liveBody: BlockBody): BlockBody | undefined {
+  const policy = liveBody["policy"];
+  return Array.isArray(policy) && policy.length > 0 && typeof policy[0] === "object" && policy[0] !== null
+    ? (policy[0] as BlockBody)
+    : undefined;
+}
+
+export const tf026: PostSynthCheck = {
+  id: "TF026",
+  description: "Live root declares delete: \"never\" but its policy leaves undeclared_tagged at \"delete\"",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown; delete?: unknown };
+      if (props.mode !== "live") continue;
+      if (props.delete !== "never") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      const undeclaredTagged = policy && typeof policy["undeclared_tagged"] === "string" ? (policy["undeclared_tagged"] as string) : undefined;
+      if (undeclaredTagged !== undefined && SATISFIES_NEVER.has(undeclaredTagged)) continue;
+
+      flagged.add(root);
+      const found =
+        undeclaredTagged === undefined
+          ? "leaves undeclared_tagged unset, which defaults to \"delete\""
+          : `sets undeclared_tagged = "${undeclaredTagged}"`;
+      diagnostics.push({
+        checkId: "TF026",
+        severity: "error",
+        message:
+          `Root module "${root}" declares delete: "never" (terraform.roots.${root}.delete), but its ` +
+          `policy block ${found}. Add undeclared_tagged = "keep" (or "untag" or "report") to the live ` +
+          "block's policy block, or change this root's delete mode.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf027.ts

@@ -0,0 +1,74 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+import { policyBlockOf } from "./tf026";
+
+export const tf027: PostSynthCheck = {
+  id: "TF027",
+  description: "Live root's policy block sets undeclared_untagged = \"delete\", which deletes resources chant does not own",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      if (!policy || policy["undeclared_untagged"] !== "delete") continue;
+
+      flagged.add(root);
+      diagnostics.push({
+        checkId: "TF027",
+        severity: "error",
+        message:
+          `Root module "${root}"'s policy block sets undeclared_untagged = "delete" (account-scoped ` +
+          "reconciliation, scoped by a `scope` block). chant never proposes deleting a resource it does " +
+          "not own, and neither does an Op it generates. Remove that setting from the policy block, or " +
+          "narrow the estate's ownership answer (undeclared_tagged) instead of the account's.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf028.ts

@@ -0,0 +1,96 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isOpEntity } from "@intentius/chant/op/resource";
+
+/** The labels `TerraformWatchOp` stamps on the Op it builds (`../../composites/terraform-watch-op.ts`). */
+interface WatchOpLabels {
+  Watch?: unknown;
+  TerraformRoot?: unknown;
+  TerraformMode?: unknown;
+}
+
+/** Every root name the build parsed as live: `terraform.binary: "choudoufu"` plus a declared estate. */
+function liveRootsOf(ctx: PostSynthContext): Set<string> {
+  const roots = new Set<string>();
+  for (const entity of ctx.entities.values()) {
+    if (!isResourceDeclarable(entity)) continue;
+    const props = entity.props as { root?: unknown; mode?: unknown };
+    if (props.mode !== "live" || typeof props.root !== "string") continue;
+    roots.add(props.root);
+  }
+  return roots;
+}
+
+export const tf028: PostSynthCheck = {
+  id: "TF028",
+  description: "A live root is watched by a TerraformWatchOp built without live: true",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const liveRoots = liveRootsOf(ctx);
+    if (liveRoots.size === 0) return [];
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const props = (entity as { props?: Record<string, unknown> }).props;
+      if (!props || typeof props.name !== "string") continue;
+      const labels = (typeof props.labels === "object" && props.labels !== null
+        ? props.labels
+        : {}) as WatchOpLabels;
+      if (labels.Watch !== "true") continue;
+      if (labels.TerraformMode === "live") continue;
+      const root = labels.TerraformRoot;
+      if (typeof root !== "string" || !liveRoots.has(root)) continue;
+
+      diagnostics.push({
+        checkId: "TF028",
+        severity: "error",
+        message:
+          `Op "${props.name}" watches root module "${root}" in stock mode, but that root runs choudoufu ` +
+          "with a declared estate. A stock plan reports drift alone and stays quiet about every unowned " +
+          `and adoptable resource in the estate. Set live: true on this TerraformWatchOp, or drop the ` +
+          "root's estate if it is not a live root.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/skills/chant-terraform.md

@@ -65,7 +65,7 @@ export const { op } = TerraformApplyOp({
 });
 ```
 
-`gate: "never"` is what makes the Op runnable under the local executor (`chant run`); any other mode emits a Gate phase, and a gate is durable-runtime work the local executor refuses. The Gate phase always shows the saved plan first and reports its `destroys` count as a `Destroys` search attribute, because `GateStep` carries no condition to branch on at build time — the approver sees what's at stake before approving, rather than the Op deciding for them.
+`gate: "never"` drops the Gate phase, so `chant run` walks straight from Plan to Apply; any other mode emits a Gate phase, and a run that reaches an unapproved gate records a pending fact on the gate ledger, ends `gated` and exits 3 until someone runs `chant approve <op> <gate>`. The Gate phase always shows the saved plan first and reports its `destroys` count as a `Destroys` run outcome, because `GateStep` carries no condition to branch on at build time — the approver sees what's at stake before approving, rather than the Op deciding for them.
 
 Terraform has no automatic rollback, so `compensate: true` with no command throws at build time, naming the Op, rather than warning once an apply has already half-run:
 

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAQpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAcvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAQpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "type": "module",
   "files": [
     "src/",
@@ -22,6 +22,11 @@
       "types": "./dist/op/activities/index.d.ts",
       "default": "./src/op/activities/index.ts"
     },
+    "./op/activity-contracts": {
+      "development": "./src/op/activity-contracts.ts",
+      "types": "./dist/op/activity-contracts.d.ts",
+      "default": "./src/op/activity-contracts.ts"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -51,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.57.0",
+    "@intentius/chant": "^0.59.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -0,0 +1,181 @@
+# What the gated acceptance suites have actually run against
+
+Four `describe` blocks across three files run this lexicon against a real
+binary rather than a fixture, and every one of them skips rather than fails
+when its dependency is absent. A skip is silent by design, so without this
+file nothing in the tree says which of them has ever passed, against what, or
+when. The evidence had been living in PR prose (`#2157` for the live apply
+pair), which no reader of the suite can see.
+
+One row per gated block below: what it proves, what gates it, the command,
+and the last binary and emulator it is known to have passed against.
+
+`live-estate/README.md` next door is the sibling record for the two recorded
+documents (`../live-plan.json`, `../live-ls.json`) rather than for a suite,
+and stays where it is.
+
+## The binary and the emulator these rows name
+
+`choudoufu v0.14.0` below means the published release binary, not a source
+build: `gh release download v0.14.0 -R INTENTIUS/choudoufu -p
+'choudoufu_v0.14.0_darwin_arm64.tar.gz' -p SHA256SUMS`, verified against
+`SHA256SUMS` (`41c705d9b5fec47100c4f2fb9ab0694f0160b31a4e0661e877b4d9821bc464e3`),
+extracted and put first on PATH. `choudoufu version` prints `choudoufu v0.14.0
+(based on OpenTofu v1.13.0-dev)`.
+
+`the pinned floci emulator` means choudoufu's own smoke stack image,
+`ghcr.io/lex00/floci@sha256:a39185cc3971d0188663d61043cb038dff1260d8a975b1aa72c4e2bb1feac3cb`
+(that checkout's `live/floci-image`), brought up from
+`live/smoke/docker-compose.yml` and exported as
+`CHOUDOUFU_EMULATOR_ENDPOINT=http://localhost:<mapped port>`.
+
+## The four blocks
+
+### 1. `TerraformApplyOp applies a real root`
+
+`composites/terraform-apply-op.acceptance.test.ts`. One test: `runOpLocally`
+drives `TerraformApplyOp` with `gate: "never"` through Init, Plan and Apply
+over the `with-backend/` fixture in a temp directory, and two
+`null_resource`s in the resulting state is the pass. The backend is `local`,
+so no credentials and no remote state are involved.
+
+Gated on a `terraform` or `tofu` on PATH, and on the provider download
+reaching `registry.terraform.io` (`CHANT_OFFLINE` unset and the host
+resolvable).
+
+```
+npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.test.ts
+```
+
+Last passed: 2026-09-07, `Terraform v1.15.8` on `darwin_arm64`, with
+`hashicorp/null` resolved from the public registry for the fixture's `~> 3.2`
+constraint. No emulator is involved. Re-run by chant #2168 alongside the two
+live blocks in the same file, so the file's three rows all come from one run.
+
+### 2. `TerraformApplyOp applies a live root against choudoufu's emulator`
+
+Same file, second block. Two tests. The first is the live-root happy path end
+to end through `runOpLocally`: Init, `plan -out=<file>`, `show` over that
+file, `apply <file>`, two `null_resource`s applied against the `live/`
+fixture. The second moves the world between plan and apply and asserts both
+named refusals (`approval-mismatch`, `wrong-estate`) come back as results
+carrying choudoufu's own message rather than as thrown errors, then applies
+the same file once the world is restored.
+
+Gated on a `choudoufu` on PATH, on it reporting a release version at or above
+`MIN_CHOUDOUFU_VERSION` (0.14.0), and on `CHOUDOUFU_EMULATOR_ENDPOINT`. Not
+gated on choudoufu #894 and never was: the plan half here is the stock `plan
+-out` path and reads no JSON document.
+
+```
+npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.test.ts
+```
+
+Last passed: 2026-09-07, choudoufu v0.14.0 with the pinned floci emulator up,
+recorded by chant #2168. That run is reproducible from this file: the binary
+is a release asset and the emulator is a pinned digest. Before it, the only
+record was PR #2157's prose ("the acceptance suite 3 passed against v0.13.0
+with the emulator up", merged at `81200b5d97c15920619de4b109c4393ec3223720`),
+which #2220 could not reproduce because no binary existed on the machine that
+wrote this file.
+
+### 3. `choudoufu live-check and live-plan against the fixture`
+
+`op/activities/choudoufu.acceptance.test.ts`. Two tests. `live-check -json`
+admits the `live/` fixture root (no cloud calls, so this half needs only the
+binary), and `live-plan` reads the emulator and proposes creating both
+`null_resource`s on a fresh estate.
+
+Gated on a `choudoufu` on PATH and on `CHOUDOUFU_EMULATOR_ENDPOINT`. The
+`CHOUDOUFU_894_OPEN` constant that used to skip the block whatever was on
+PATH is gone.
+
+```
+npx vitest run lexicons/terraform/src/op/activities/choudoufu.acceptance.test.ts
+```
+
+Last passed: 2026-09-07, choudoufu v0.14.0 with the pinned floci emulator up,
+recorded by chant #2168. That is the first pass this block has ever had as a
+suite, and the first the `live-plan` test has ever had at all. It had been
+gated shut on choudoufu #894 since commit `65821d76` (2026-09-06 12:45Z);
+before that gate, PR #2135's body records a hand verification of the
+`live-check` half only.
+
+Two chant-side changes in #2168 were what the pass needed, both consequences
+of what choudoufu PR 915 shipped. `-estate` is still refused beside a declared
+estate; what changed is that the flag is no longer needed, so
+`choudoufuLivePlanCommand` omits it exactly when the configuration names its
+own estate. And the human-render call carries `-detailed-exitcode` too, so
+exit 2 there is a plan with changes rather than a failure, which is what the
+first real run of this block found.
+
+### 4. `TerraformAdoptOp adopts an unmarked live resource`
+
+`composites/terraform-adopt-op.acceptance.test.ts`. One test: create an
+unmarked VPC directly against the emulator so it is a live resource this
+estate does not own at an identity the `live-adopt/` root declares, run the
+Ledger step and expect exactly one adoptable match carrying the two marker
+values, run the Adopt step and let it write them, then re-plan and expect the
+estate to own the same VPC with nothing left adoptable.
+
+Gated on a `choudoufu` on PATH, on an `aws` CLI on PATH (the unmarked
+resource is created and adopted through it), on
+`CHOUDOUFU_EMULATOR_ENDPOINT`, and then on
+`CHOUDOUFU_ADOPTABLE_NOT_IN_DOCUMENT`, which replaced the #894 gate and names
+choudoufu #962.
+
+```
+npx vitest run lexicons/terraform/src/composites/terraform-adopt-op.acceptance.test.ts
+```
+
+Last passed: never, and the reason changed on 2026-09-07 rather than going
+away. chant #2168 dropped the #894 gate and ran the block against choudoufu
+v0.14.0 and the pinned floci emulator. It reached the document and stopped
+there, with `ledger.adoptions` empty:
+
+```
+AssertionError: expected [] to have a length of 1 but got +0
+ ❯ terraform-adopt-op.acceptance.test.ts:116:34
+```
+
+The document's `unowned[]` is the resources found at an identity the
+configuration itself declares, and it works: an unmarked
+`aws_cloudwatch_log_group` in the same fixture shape comes back on the same
+binary with `adopt_tofu_estate` and `adopt_tofu_address` on it, which is the
+shape `../live-plan.json` recorded. An `aws_vpc` has no such identity, so the
+document reports `omissions[].reason = "NEEDS_DISCOVERY"` and leaves
+`unowned[]` empty. The VPC is matched by choudoufu's content matcher during
+the estate-wide unclaimed sweep instead, and that match is printed only in the
+human render's "Adoptable" section, for which `views.LivePlanDocument` has no
+field. `-adoption-only` is refused alongside `-json`, and
+`TOFU_LIVE_COLLECT_UNCLAIMED=1` on the `-json` run leaves `"unowned": []`
+while the text run beside it prints `Adoptable: 1 live resource matches a
+declared resource`. Filed upstream as choudoufu #962
+(https://github.com/INTENTIUS/choudoufu/issues/962), which carries the full
+measurement; chant #2168 has the same.
+
+The fixture was deliberately left as an `aws_vpc`. A log group would make the
+block pass and would stop it proving the content-matcher path, which is the
+only thing it exists to prove.
+
+## Running everything that can run on a machine with no choudoufu
+
+```
+npx vitest run \
+  lexicons/terraform/src/composites/terraform-apply-op.acceptance.test.ts \
+  lexicons/terraform/src/composites/terraform-adopt-op.acceptance.test.ts \
+  lexicons/terraform/src/op/activities/choudoufu.acceptance.test.ts
+```
+
+With `terraform` on PATH and the registry reachable, that is 1 passed and 5
+skipped, and each skip names its own reason in the block title. With
+choudoufu v0.14.0, the `aws` CLI and the emulator all present, it is 5 passed
+and 1 skipped: block 4 is the skip. On 2026-09-07 that is exactly what it
+printed.
+
+## Keeping this file honest
+
+Add a row when a suite is added, and update a "last passed" line in the same
+change that makes a run happen. A line here that names no binary version and
+no date is worth less than no line at all, so if a run cannot be reproduced,
+say whose prose the claim comes from and that it was not reproduced.

package/src/__fixtures__/live/main.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/__fixtures__/live-adopt/estate.chdf.hcl

@@ -0,0 +1,6 @@
+# The body of this file is the live block's content, with no wrapper block
+# (choudoufu's live/MARKERS.md and site/content/docs/use/setup.md). The sidecar
+# form rather than the in-block one, because choudoufu's own migration guide
+# calls it the leading form: stock tooling never reads this file, so adopting
+# live markers adds one file and changes zero existing lines.
+estate = "chant-adopt-fixture"

package/src/__fixtures__/live-adopt/main.tf

@@ -0,0 +1,21 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "aws" {}
+
+# A VPC the acceptance test creates out of band, with no ownership marker on
+# it, before this root ever plans. choudoufu's content matcher offers a VPC on
+# `cidr_block` (`matchTable` in choudoufu's internal/live/foreign/classify.go),
+# so an unmarked live VPC at this exact cidr is what makes this root's plan
+# report one adoptable match rather than proposing a second VPC beside it.
+resource "aws_vpc" "adoptable" {
+  cidr_block = "10.77.0.0/16"
+}