@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/__fixtures__/module-tree/cycle/modules/a/main.tf

@@ -0,0 +1,9 @@
+module "b" {
+  source = "../b"
+}
+
+resource "null_resource" "a" {
+  triggers = {
+    name = "a"
+  }
+}

package/src/__fixtures__/module-tree/cycle/modules/b/main.tf

@@ -0,0 +1,9 @@
+module "a" {
+  source = "../a"
+}
+
+resource "null_resource" "b" {
+  triggers = {
+    name = "b"
+  }
+}

package/src/__fixtures__/module-tree/missing/main.tf

@@ -0,0 +1,9 @@
+module "gone" {
+  source = "./modules/gone"
+}
+
+resource "null_resource" "here" {
+  triggers = {
+    name = "here"
+  }
+}

package/src/__fixtures__/module-tree/outside/root/main.tf

@@ -0,0 +1,9 @@
+module "shared" {
+  source = "../../shared"
+}
+
+resource "null_resource" "here" {
+  triggers = {
+    name = "here"
+  }
+}

package/src/__fixtures__/module-tree/root/main.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+  region = var.region
+}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "5.1.2"
+}
+
+resource "aws_s3_bucket" "root_bucket" {
+  bucket = "root-bucket"
+}

package/src/__fixtures__/module-tree/root/modules/cdn/main.tf

@@ -0,0 +1,15 @@
+variable "region" {
+  type = string
+}
+
+provider "aws" {
+  region = var.region
+}
+
+module "bucket" {
+  source = "./modules/bucket"
+}
+
+resource "aws_cloudfront_distribution" "cdn" {
+  comment = "cdn in ${var.region}"
+}

package/src/__fixtures__/module-tree/root/modules/cdn/modules/bucket/main.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "local" {
+    path = "bucket.tfstate"
+  }
+}
+
+resource "aws_s3_bucket" "assets" {
+  bucket = "assets"
+}

package/src/__fixtures__/module-tree/shared/main.tf

@@ -0,0 +1,5 @@
+resource "null_resource" "shared" {
+  triggers = {
+    name = "shared"
+  }
+}

package/src/__fixtures__/references/main.tf

@@ -0,0 +1,56 @@
+# Every reference form the index collects, once each, so a test can assert the
+# whole vocabulary against one parse (chant #2112).
+#
+#   var.<name>              region, subnets
+#   local.<name>            bucket_name, tags
+#   data.<type>.<name>      data.aws_ami.ubuntu
+#   module.<name>           module.cdn
+#   provider = <type>.<alias>   provider.aws.replica, through both the
+#                               `provider` meta-argument and a module's
+#                               `providers` map
+
+variable "region" {
+  type = string
+}
+
+variable "subnets" {
+  type = list(string)
+}
+
+locals {
+  bucket_name = "assets-${var.region}"
+  tags        = { Team = "platform" }
+}
+
+data "aws_ami" "ubuntu" {
+  most_recent = true
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = "eu-west-1"
+}
+
+resource "aws_instance" "web" {
+  count     = length(var.subnets)
+  ami       = data.aws_ami.ubuntu.id
+  subnet_id = var.subnets[count.index]
+  tags      = local.tags
+}
+
+resource "aws_s3_bucket" "replica" {
+  provider = aws.replica
+  bucket   = "${local.bucket_name}-replica"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+
+  providers = {
+    aws = aws.replica
+  }
+}
+
+output "cdn_url" {
+  value = module.cdn.url
+}

package/src/__fixtures__/remote-backend/main.tf

@@ -0,0 +1,34 @@
+# The `with-backend` root next door keeps its state local on purpose, so
+# TF001 reports it (#2218). This one is the same configuration with a remote
+# backend, and is what a root TF001 says nothing about looks like. Nothing
+# ever runs `terraform init` here, so the bucket need not exist.
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "app/terraform.tfstate"
+    region = "us-east-1"
+  }
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+  }
+}
+
+provider "null" {}
+
+resource "null_resource" "first" {
+  triggers = {
+    name = "first"
+  }
+}
+
+resource "null_resource" "second" {
+  triggers = {
+    name = "second"
+  }
+}

package/src/__fixtures__/with-backend/main.tf

@@ -1,3 +1,10 @@
+# The `terraform-apply-op` acceptance test copies this root into a temp
+# directory and runs a real `terraform init`, `plan` and `apply` against it,
+# so the backend has to be one that works with no credentials and no network
+# beyond the provider registry. That is `local`, which is why TF001 reports
+# this root (#2218): the finding is correct, and the local state is the point
+# of the fixture. `remote-backend/` next door is the same configuration with
+# a backend TF001 says nothing about.
 terraform {
   required_version = ">= 1.5.0"
 

package/src/codegen/lint-rules-page.test.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import { scanRules } from "@intentius/chant/codegen/docs-rule-scanning";
+import { RULE_CATALOG } from "@intentius/chant/audit/catalog";
+
+/**
+ * `docs/pages/lint-rules.mdx` is authored by hand, one `##` section per rule
+ * (#2108). Nothing regenerates those sections, so nothing stops the page
+ * lagging the catalog the moment a new rule ships without one. This test
+ * reads the same rule scan the generated `rules` table (`All Rules`) is built
+ * from and fails the moment a scanned id has no matching heading on the
+ * authored page, so the page cannot silently fall behind.
+ */
+const pkgDir = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+/**
+ * The TF ids core owns rather than this lexicon (#2220). `scanRules` walks
+ * this package's `src/`, so it cannot see them: TF023 (Terraform state
+ * committed to the repository) lives in `packages/core/src/audit/catalog.ts`
+ * because it reads the discovered file list rather than a parsed root module,
+ * and its page section here was the one TF section nothing guarded. Read off
+ * `RULE_CATALOG` rather than hardcoded, so a second core-owned TF id is
+ * covered on the day it lands.
+ */
+function coreOwnedTfIds(): string[] {
+  return Object.keys(RULE_CATALOG).filter((id) => /^TF\d+$/.test(id));
+}
+
+describe("lint-rules.mdx stays in sync with the rule catalog", () => {
+  test("every rule id scanned from source has a ## section on the authored page", () => {
+    const core = coreOwnedTfIds();
+    expect(core, "core owns at least TF023").toContain("TF023");
+
+    const ids = [...new Set([...scanRules(join(pkgDir, "src")).map((r) => r.id), ...core])].sort();
+    expect(ids.length).toBeGreaterThan(0);
+
+    const page = readFileSync(join(pkgDir, "docs", "pages", "lint-rules.mdx"), "utf-8");
+    const headingIds = new Set([...page.matchAll(/^## (TF\d+)\b/gm)].map((m) => m[1]));
+
+    const missing = ids.filter((id) => !headingIds.has(id));
+    expect(missing, `lint-rules.mdx has no section for: ${missing.join(", ")}`).toEqual([]);
+  });
+});

package/src/composites/terraform-adopt-op.acceptance.test.ts

@@ -0,0 +1,193 @@
+/**
+ * The acceptance test is choudoufu, not a fixture (#2105): adopt a live
+ * resource nothing has marked, end to end.
+ *
+ * `terraform-adopt-op.test.ts` next door proves the shape chant emits.
+ * `choudoufu.test.ts` proves the activities' contract against a stubbed child
+ * process. This proves the shape does the thing: create an unmarked VPC
+ * directly against choudoufu's pinned emulator, so it is a live resource this
+ * estate does not own at an identity this root's configuration declares; run
+ * the Ledger step and expect exactly one adoptable match with the two marker
+ * values on it; run the Adopt step and let it write them; re-plan and expect
+ * the estate to own the same VPC, with nothing left adoptable.
+ *
+ * The Op's phases are not run through `runOpLocally` here, deliberately.
+ * `TerraformAdoptOp` always emits a gate — adoption moves the estate's
+ * boundary, and there is no ungated form — so a local run would stop at the
+ * gate and record a pending fact rather than reach the Adopt phase
+ * (`packages/core/src/op/gate.ts`). So this drives the two activities the Op's
+ * Ledger and Adopt phases are built from, in the same order and with the same
+ * hand-off, which is the part a real binary can falsify. `choudoufu.acceptance.test.ts` takes the same approach for the same
+ * reason.
+ *
+ * ## Why this still skips on choudoufu v0.14.0
+ *
+ * Not #894 any more. v0.14.0 (choudoufu PR 915) made `live-plan -json`
+ * reachable on a configuration that names its own estate, and this suite was
+ * run against it on 2026-09-07 for the first time. It got as far as the
+ * document and stopped there: `ledger.adoptions` came back empty, because the
+ * #788 document carries no adoptable-by-content section at all.
+ *
+ * The document's `unowned[]` is the resources found at an identity the
+ * configuration itself declares. A `aws_cloudwatch_log_group` has one (its
+ * name is in the block), so an unmarked live one comes back in `unowned[]`
+ * with `adopt_tofu_estate`/`adopt_tofu_address` on it, which is exactly what
+ * `../__fixtures__/live-plan.json` recorded and what `readAdoptionLedger`
+ * reads. An `aws_vpc` has none: EC2 assigns the id, so the document reports
+ * `omissions[].reason = "NEEDS_DISCOVERY"` and leaves `unowned[]` empty. The
+ * VPC is matched instead by choudoufu's content matcher during the
+ * estate-wide unclaimed sweep, and that match is printed only in the human
+ * render's "Adoptable" section. `views.LivePlanDocument` has no field for it,
+ * `-adoption-only` is refused alongside `-json` ("-adoption-only and -json
+ * cannot be combined"), and `TOFU_LIVE_COLLECT_UNCLAIMED=1` on the `-json`
+ * run makes no difference: the text render then prints "Adoptable: 1 live
+ * resource matches a declared resource" and the document beside it still says
+ * `"unowned": []`.
+ *
+ * So `choudoufuLivePlan` cannot produce a ledger for a provider-assigned
+ * identity on any binary that exists today, and this suite is what would
+ * prove it can. Filed upstream as
+ * [choudoufu #962](https://github.com/INTENTIUS/choudoufu/issues/962); the
+ * measurements are there and on chant #2168.
+ *
+ * The gate below names that, alongside the three ordinary dependencies: a
+ * `choudoufu`, an `aws` CLI, and the emulator's endpoint.
+ *
+ * Gating copied from `./terraform-apply-op.acceptance.test.ts` (`onPath`),
+ * which in turn copies `lexicons/k3s/src/serializer.acceptance.test.ts`'s
+ * pattern of skipping with the reason named in the describe title rather than
+ * failing when the real dependency is absent.
+ *
+ * `../__fixtures__/ACCEPTANCE.md` records what this block has last passed
+ * against, which is still nothing, and why the reason changed.
+ */
+
+import { execSync } from "node:child_process";
+import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, describe, expect, it } from "vitest";
+import { choudoufuAdopt, choudoufuLivePlan, terraformInit } from "../op/activities/terraform";
+
+function onPath(cmd: string): boolean {
+  try {
+    execSync(`command -v ${cmd}`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * `true` while `live-plan -json`'s document carries no adoptable-by-content
+ * section, so a provider-assigned identity like an `aws_vpc` never reaches
+ * `readAdoptionLedger`. Filed upstream as
+ * [choudoufu #962](https://github.com/INTENTIUS/choudoufu/issues/962), with
+ * the measurements against the v0.14.0 release binary on 2026-09-07; flip to
+ * `false` when a choudoufu release puts the content matcher's "Adoptable"
+ * rows in the document, either in `unowned[]` or in a sibling array.
+ * choudoufu #894, which gated this block before, is fixed and gone.
+ */
+const CHOUDOUFU_ADOPTABLE_NOT_IN_DOCUMENT = true;
+
+const emulatorEndpoint = process.env.CHOUDOUFU_EMULATOR_ENDPOINT;
+
+const skipReason = !onPath("choudoufu")
+  ? "no choudoufu binary on PATH"
+  : !onPath("aws")
+    ? "no aws CLI on PATH (the unmarked resource is created with it, and adopted through it)"
+    : !emulatorEndpoint
+      ? "CHOUDOUFU_EMULATOR_ENDPOINT is not set (bring up choudoufu's `just smoke` emulator stack and export it)"
+      : CHOUDOUFU_ADOPTABLE_NOT_IN_DOCUMENT
+        ? "choudoufu#962: live-plan -json's document carries no adoptable-by-content section, so the " +
+          "fixture's unmarked aws_vpc reaches omissions[NEEDS_DISCOVERY] and never unowned[]; " +
+          "measured on choudoufu v0.14.0"
+        : "";
+
+const FIXTURE = join(import.meta.dirname, "..", "__fixtures__", "live-adopt");
+const ESTATE = "chant-adopt-fixture";
+const CIDR = "10.77.0.0/16";
+const workspaces: string[] = [];
+
+afterAll(() => {
+  for (const dir of workspaces) rmSync(dir, { recursive: true, force: true });
+});
+
+/** A fresh copy of the live-adopt fixture, wired up with a real project config. */
+function project(): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-adopt-accept-"));
+  workspaces.push(dir);
+  cpSync(FIXTURE, join(dir, "root"), { recursive: true });
+  writeFileSync(
+    join(dir, "chant.config.json"),
+    JSON.stringify(
+      { lexicons: ["terraform"], terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } },
+      null,
+      2,
+    ),
+  );
+  return dir;
+}
+
+describe.skipIf(skipReason !== "")(
+  `TerraformAdoptOp adopts an unmarked live resource${skipReason ? ` (skipped: ${skipReason})` : ""}`,
+  () => {
+    it(
+      "ledgers one adoptable VPC, writes its two markers, and re-plans with it owned",
+      { timeout: 600_000 },
+      async () => {
+        const dir = project();
+
+        process.env.AWS_ENDPOINT_URL ??= emulatorEndpoint;
+        process.env.AWS_ACCESS_KEY_ID ??= "choudoufu-emulator";
+        process.env.AWS_SECRET_ACCESS_KEY ??= "choudoufu-emulator";
+        process.env.AWS_DEFAULT_REGION ??= "us-east-1";
+
+        // The stock-created resource: a VPC at the cidr this root declares,
+        // carrying no ownership marker at all. Nothing about it says which
+        // configuration made it, which is exactly the migration situation.
+        execSync(
+          `aws ec2 create-vpc --cidr-block ${CIDR} --endpoint-url ${emulatorEndpoint} --region us-east-1`,
+          { stdio: "pipe" },
+        );
+
+        await terraformInit({ root: "estate", cwd: dir });
+
+        const ledger = await choudoufuLivePlan({ root: "estate", cwd: dir, adoptionOnly: true });
+        expect(ledger.estate).toBe(ESTATE);
+        expect(ledger.contested).toEqual([]);
+        expect(ledger.adoptions).toHaveLength(1);
+        const [candidate] = ledger.adoptions;
+        expect(candidate.addr).toBe("aws_vpc.adoptable");
+        expect(candidate.markerEstate).toBe(ESTATE);
+        expect(candidate.markerAddress).toBe("aws_vpc.adoptable");
+        // A VPC is tagged through `ec2 create-tags`, which choudoufu prints a
+        // command for; a candidate with none would be refused below instead.
+        expect(candidate.command).toContain("create-tags");
+        expect(ledger.ledger).toContain("aws_vpc.adoptable <- aws_vpc vpc-");
+
+        const adopted = await choudoufuAdopt({
+          root: "estate",
+          cwd: dir,
+          adoptions: ledger.adoptions,
+          contested: ledger.contested,
+        });
+        expect(adopted.mechanism).toBe("tag-write");
+        expect(adopted.adopted).toEqual(["aws_vpc.adoptable"]);
+        expect(adopted.refused).toEqual([]);
+
+        // The markers are the whole ownership answer, so a re-plan binds the
+        // same live VPC instead of proposing a second one: nothing is left
+        // unowned at this estate's declared identity, and nothing adoptable.
+        const after = await choudoufuLivePlan({ root: "estate", cwd: dir });
+        expect(after.adoptable).toBe(0);
+        expect(after.unowned).toBe(0);
+        expect(after.adoptions).toEqual([]);
+
+        // And the estate now says so: the VPC is bound at the declared address.
+        const bound = (after.json as { bound?: Array<{ addr?: string; identity?: string }> }).bound ?? [];
+        expect(bound.map((b) => b.addr)).toContain("aws_vpc.adoptable");
+      },
+    );
+  },
+);

package/src/composites/terraform-adopt-op.test.ts

@@ -0,0 +1,175 @@
+/**
+ * TerraformAdoptOp composite tests (#2105): the four phases, the gate that is
+ * always there, the two references the Adopt step takes off the ledger, and
+ * the rule an adoption Op exists to keep — an ambiguous match is reported and
+ * never written.
+ */
+
+import { describe, test, expect } from "vitest";
+import {
+  collectStepOutputRefs,
+  isStepOutputRef,
+  type ActivityStep,
+  type GateStep,
+  type OpConfig,
+  type StepDefinition,
+} from "@intentius/chant/op";
+
+import { TerraformAdoptOp } from "./terraform-adopt-op";
+
+function props(config: Parameters<typeof TerraformAdoptOp>[0]): OpConfig {
+  return (TerraformAdoptOp(config).op as unknown as { props: OpConfig }).props;
+}
+
+const phaseNames = (op: OpConfig): string[] => op.phases.map((p) => p.name);
+const isActivity = (s: StepDefinition): s is ActivityStep => s.kind === "activity";
+const steps = (op: OpConfig): ActivityStep[] => op.phases.flatMap((p) => p.steps.filter(isActivity));
+const base = { name: "estate-adopt", root: "estate" };
+
+describe("TerraformAdoptOp phases (#2105)", () => {
+  test("Check, Ledger, Gate, Adopt, in that order", () => {
+    const op = props(base);
+    expect(phaseNames(op)).toEqual(["Check", "Ledger", "Gate", "Adopt"]);
+    expect(steps(op).map((s) => s.fn)).toEqual(["choudoufuLiveCheck", "choudoufuLivePlan", "choudoufuAdopt"]);
+  });
+
+  test("Check runs live-check first, and reports whether the root was refused", () => {
+    const check = props(base).phases[0].steps[0] as ActivityStep;
+    expect(check.fn).toBe("choudoufuLiveCheck");
+    expect(check.outcomeAttribute).toEqual({ name: "Refused", from: "refused" });
+    // No cloud calls, so this is the cheapest place to learn the root cannot
+    // move under markers at all.
+    expect(check.profile).toBe("fastIdempotent");
+  });
+
+  test("Ledger is the -adoption-only live plan, and publishes both counts", () => {
+    const ledger = props(base).phases[1].steps[0] as ActivityStep;
+    expect(ledger.fn).toBe("choudoufuLivePlan");
+    expect(ledger.id).toBe("ledger");
+    expect(ledger.args?.adoptionOnly).toBe(true);
+    expect(ledger.outcomeAttribute).toEqual([
+      { name: "Adoptable", from: "adoptable" },
+      { name: "Ambiguous", from: "ambiguous" },
+    ]);
+  });
+
+  test("every step names the configured root", () => {
+    for (const step of steps(props(base))) expect(step.args?.root).toBe("estate");
+  });
+
+  test("cwd rides every step, and no cwd means no cwd arg", () => {
+    for (const step of steps(props({ ...base, cwd: "/repo" }))) expect(step.args?.cwd).toBe("/repo");
+    for (const step of steps(props(base))) expect(step.args && "cwd" in step.args).toBe(false);
+  });
+
+  test("an explicit estate rides the Ledger step only", () => {
+    const op = props({ ...base, estate: "prod-networking" });
+    expect((op.phases[1].steps[0] as ActivityStep).args?.estate).toBe("prod-networking");
+    expect((op.phases[0].steps[0] as ActivityStep).args?.estate).toBeUndefined();
+  });
+});
+
+describe("TerraformAdoptOp gates on the ledger (#2105)", () => {
+  const gateOf = (op: OpConfig): GateStep => {
+    const step = op.phases[2].steps[0];
+    expect(step.kind).toBe("gate");
+    return step as GateStep;
+  };
+
+  test("the gate is always emitted: there is no ungated adoption", () => {
+    // Unlike TerraformApplyOp there is no `gate: "never"` here. Adoption moves
+    // the estate's boundary onto resources it did not own, which is not a
+    // thing to do unattended.
+    expect(gateOf(props(base)).gate).toBe("approve-estate-adopt");
+    expect(Object.keys(TerraformAdoptOp(base))).toEqual(["op"]);
+  });
+
+  test("the description names the ledger as the approval subject", () => {
+    const description = gateOf(props(base)).description!;
+    expect(description).toContain("adoption ledger");
+    expect(description).toContain("tofu-estate and tofu-address");
+    expect(description).toContain("an ambiguous address is never adopted");
+  });
+
+  // #2202: `gateName` is the option; `signalName` is read through 0.59.0.
+  test("the deprecated `signalName` option still names the gate", () => {
+    expect(gateOf(props({ ...base, signalName: "ok" })).gate).toBe("ok");
+  });
+
+  test("gate name, timeout and description are overridable", () => {
+    const gate = gateOf(props({ ...base, gateName: "ok", gateTimeout: "2h", gateDescription: "mine" }));
+    expect(gate).toMatchObject({ gate: "ok", timeout: "2h", description: "mine" });
+  });
+
+  test("no timeout given means the gate carries none, so core's own default applies", () => {
+    expect(gateOf(props(base)).timeout).toBeUndefined();
+  });
+});
+
+describe("TerraformAdoptOp adopts the ledger's matches and nothing else (#2105)", () => {
+  const adoptStep = (op: OpConfig): ActivityStep => op.phases[3].steps[0] as ActivityStep;
+
+  test("the Adopt step takes the ledger's adoptable set by reference", () => {
+    const adopt = adoptStep(props(base));
+    expect(adopt.fn).toBe("choudoufuAdopt");
+    expect(isStepOutputRef(adopt.args?.adoptions)).toBe(true);
+    expect(adopt.args?.adoptions).toMatchObject({ step: "ledger", path: "adoptions" });
+  });
+
+  test("an ambiguous match is handed over as `contested`, which is a separate field from `adoptions`", () => {
+    // `readAdoptionLedger` never puts a contested candidate in `adoptions`, so
+    // the Adopt step cannot write one however it behaves; `contested` is
+    // passed so the Op's own result names what it declined and why.
+    const adopt = adoptStep(props(base));
+    expect(adopt.args?.contested).toMatchObject({ step: "ledger", path: "contested" });
+    expect(adopt.args?.contested).not.toEqual(adopt.args?.adoptions);
+  });
+
+  test("the Adopt step reports how many resources it claimed", () => {
+    expect(adoptStep(props(base)).outcomeAttribute).toEqual({ name: "Adopted", from: "adoptedCount" });
+  });
+
+  test("the Op references exactly the two ledger fields and no document", () => {
+    const op = props(base);
+    const refs = op.phases.flatMap((p) => p.steps.filter(isActivity)).flatMap((s) => collectStepOutputRefs(s.args));
+    expect(refs.map((r) => r.path).sort()).toEqual(["adoptions", "contested"]);
+    expect(refs.every((r) => r.step === "ledger")).toBe(true);
+    // The bound/omissions/unowned document never leaves the Ledger step.
+    expect(JSON.stringify(op)).not.toContain('"json"');
+  });
+});
+
+describe("TerraformAdoptOp compensation (#2105)", () => {
+  test("compensate: true throws, because un-adopting is untag", () => {
+    expect(() => TerraformAdoptOp({ ...base, compensate: true })).toThrow(/un-adopting is untag/);
+  });
+
+  test("an object with no command throws the same way", () => {
+    expect(() => TerraformAdoptOp({ ...base, compensate: {} })).toThrow(/TerraformAdoptOp "estate-adopt"/);
+  });
+
+  test("a supplied command becomes an onFailure Rollback phase", () => {
+    const op = props({ ...base, compensate: { command: "./untag.sh" } });
+    expect(op.onFailure?.map((p) => p.name)).toEqual(["Rollback"]);
+    expect((op.onFailure![0].steps[0] as ActivityStep).args?.cmd).toBe("./untag.sh");
+  });
+
+  test("compensate: false and omitting it both leave no onFailure", () => {
+    expect(props(base).onFailure).toBeUndefined();
+    expect(props({ ...base, compensate: false }).onFailure).toBeUndefined();
+  });
+});
+
+describe("TerraformAdoptOp labels (#2105, #2118)", () => {
+  test("marks the Op as an adoption on a live root", () => {
+    expect(props(base).labels).toEqual({
+      Adopt: "true",
+      TerraformRoot: "estate",
+      TerraformMode: "live",
+    });
+  });
+
+  test("no task queue rides on the Op (#2118)", () => {
+    expect(props(base)).not.toHaveProperty("taskQueue");
+  });
+});