@intentius/chant-lexicon-terraform 0.60.0 → 0.61.0

package/dist/op/adoption.d.ts

@@ -1,14 +1,42 @@
 /**
  * The adoption ledger: which live resources this estate's markers can claim,
- * read off `live-plan -json`'s document and rendered as text (#2105).
+ * read off `live-plan -json`'s document and rendered as text (#2105, #2241).
  *
  * Pure. No filesystem, no child process, no HCL parse — everything here is a
- * projection of GitHub issue #788's `unowned` section, which is the one place
- * choudoufu states both halves of the answer: the live resource sitting at a
- * declared instance's identity, and the `tofu-estate`/`tofu-address` pair that
- * would adopt it. Two tags is the whole ownership contract (choudoufu's
- * `live/MARKERS.md`), so those two values are the whole of what an adoption
- * needs to know.
+ * projection of two sections of choudoufu's document, which between them state
+ * both halves of the answer: the live resource an adoption would claim, and
+ * the `tofu-estate`/`tofu-address` pair that claims it. Two tags is the whole
+ * ownership contract (choudoufu's `live/MARKERS.md`), so those two values are
+ * the whole of what an adoption needs to know.
+ *
+ * ## The two sections, and why there are two
+ *
+ * `unowned[]` (choudoufu issue #788) is a live resource read at an identity
+ * the configuration itself declares: a log group's name is in the block, so an
+ * unmarked live one with that name is found by reading it.
+ *
+ * `adoptable[]` (choudoufu issue #962, shipped in v0.15.0) is a live resource
+ * the estate-wide sweep matched to a declared instance by content, for a
+ * declaration that carries no identity at all: EC2 assigns a VPC's id, so a
+ * declared `aws_vpc` lands in `omissions[]` as `NEEDS_DISCOVERY` and the live
+ * VPC standing at its `cidr_block` is found by comparing arguments. Each row
+ * carries `matched[]`, the arguments that agreed, and `adopt_command`, the
+ * paste-ready tagging command, so nothing on this path parses the human
+ * render any more. Before v0.15.0 the document had no row for that match at
+ * all and chant read the two regexes {@link parseAdoptionCommands} still
+ * holds, which is what chant #2168 measured and filed.
+ *
+ * The two sections are disjoint by construction, so this reads both and keys
+ * the union by declared address.
+ *
+ * ## What the empty ledger means
+ *
+ * `adoptable[]` and `swept[]` are populated only on a run that asked the
+ * estate-wide sweep the account-bounded question (`-adoption-only`, or
+ * `TOFU_LIVE_COLLECT_UNCLAIMED=1` on a `-json` run). {@link AdoptionLedger}
+ * carries `swept` for exactly that reason: an empty `adoptions` under an empty
+ * `swept` is "this run did not look", not "there is nothing to adopt", and
+ * {@link renderAdoptionLedger} says which.
  *
  * ## Why chant renders a ledger at all
  *
@@ -18,42 +46,62 @@
  * says why each unadoptable instance is unadoptable. But `-adoption-only` and
  * `-json` are refused together (`internal/command/live_plan.go`: "this run
  * cannot produce both reports at once"), and an Op that reports adoptables
- * needs the machine-readable document anyway — for the counts it publishes as
- * outcome attributes, and for the addresses an adoption step acts on. So the
+ * needs the machine-readable document anyway, for the counts it publishes as
+ * outcome attributes and for the addresses an adoption step acts on. So the
  * ledger below is rendered from the document that run already has, in the row
  * form `-adoption-only` prints, rather than paying for a third live read.
  *
  * ## Ambiguity
  *
- * `unowned[]` is one entry per live resource, keyed by the declared instance
- * whose identity found it, so two live resources at one declared identity are
- * two entries carrying the same `addr`. That is the ambiguous case: no single
- * tag write claims the address, and picking one of the two is a decision about
- * the estate rather than something a tool infers. {@link readAdoptionLedger}
- * separates those into `contested` and never lets them into `adoptions`, and
- * `TerraformAdoptOp` passes the contested list to its Adopt step so the Op's
- * result names what it refused as well as what it wrote.
+ * Both sections are one entry per live resource, keyed by the declared
+ * instance the resource was matched to, so two live resources at one
+ * declaration are two entries carrying the same `addr`. That is the ambiguous
+ * case: no single tag write claims the address, and picking one of the two is
+ * a decision about the estate rather than something a tool infers.
+ * {@link readAdoptionLedger} separates those into `contested` and never lets
+ * them into `adoptions`, and `TerraformAdoptOp` passes the contested list to
+ * its Adopt step so the Op's result names what it refused as well as what it
+ * wrote.
  */
+/** One argument a content match rested on, as choudoufu's `adoptable[].matched[]`. */
+export interface AdoptionMatch {
+    /** The argument's name in the declared block, `cidr_block` and the like. */
+    attribute: string;
+    /** The value both the declaration and the live resource carried. */
+    value: string;
+}
 /** One live resource a marker write would bind to a declared instance. */
 export interface AdoptionCandidate {
-    /** The declared instance address whose identity found the live resource. */
+    /** The declared instance address the live resource was matched to. */
     addr: string;
-    /** The live resource's type, as choudoufu's `unowned[].type`. */
+    /** The live resource's type, as choudoufu's `type`. */
     type: string;
-    /** The identity the live resource was read with — the handle a human, or a tagging call, needs. */
+    /** The identity the live resource was read with: the handle a human, or a tagging call, needs. */
     identity: string;
     /** The `tofu-estate` value that adopts it. */
     markerEstate: string;
     /** The `tofu-address` value that adopts it, escaped as choudoufu stores it. */
     markerAddress: string;
     /**
-     * The paste-ready tagging command choudoufu printed for this address under
-     * `live-plan -adoption-only`, when it printed one. Absent for a type whose
-     * service has its own tagging call this fork does not spell out (IAM,
-     * Route53, S3 and friends): the two marker values above are still the whole
-     * contract, but the caller has to write them itself.
+     * The paste-ready tagging command choudoufu printed for this address, when
+     * it printed one. Absent for a type whose service has its own tagging call
+     * this fork does not spell out (IAM, Route53, S3 and friends): the two
+     * marker values above are still the whole contract, but the caller has to
+     * write them itself.
+     *
+     * An `adoptable[]` row carries its own (`adopt_command`, choudoufu #962). An
+     * `unowned[]` row does not, so a command for one of those comes from the
+     * `commands` map {@link parseAdoptionCommands} builds off the human render.
      */
     command?: string;
+    /**
+     * The arguments the declaration and the live resource agreed on exactly, in
+     * the order choudoufu's matcher compared them. Present on a content match
+     * (`adoptable[]`) and absent on a row found by reading a declared identity
+     * (`unowned[]`), which matched on the identity itself and has nothing else
+     * to name.
+     */
+    matched?: AdoptionMatch[];
 }
 /** What {@link readAdoptionLedger} found in one `live-plan -json` document. */
 export interface AdoptionLedger {
@@ -68,20 +116,29 @@ export interface AdoptionLedger {
     contested: AdoptionCandidate[];
     /** How many distinct declared addresses are contested. */
     ambiguous: number;
+    /**
+     * `swept[]`: every resource type the estate-wide sweep listed in full on the
+     * run that produced the document. Empty means the run never asked the
+     * account-bounded question, so an empty `adoptions` beside it is silence
+     * rather than a finding.
+     */
+    swept: string[];
 }
 /**
- * Project a `live-plan -json` document's `unowned` section into the adoptable
- * and the contested sets.
+ * Project a `live-plan -json` document's `unowned` and `adoptable` sections
+ * into the adoptable and the contested sets.
  *
  * An entry counts as a candidate only when choudoufu offered both marker
- * values. Both empty means adoption was not this run's to offer — the resource
+ * values. Both empty means adoption was not this run's to offer: the resource
  * belongs to another estate (`tofu_estate` names it), or the run had no estate
- * name of its own — and such an entry is neither adoptable nor contested here,
+ * name of its own, and such an entry is neither adoptable nor contested here,
  * because there is no tag write to refuse.
  *
  * `commands` maps a declared address to the paste-ready tagging command
- * choudoufu printed for it, from {@link parseAdoptionCommands}; omit it when
- * the run had no `-adoption-only` render to read one out of.
+ * choudoufu printed for it, from {@link parseAdoptionCommands}. An
+ * `adoptable[]` row carries its own command in the document and never needs
+ * the map; omit the map entirely when the run had no `-adoption-only` render
+ * to read one out of.
  */
 export declare function readAdoptionLedger(document: unknown, commands?: ReadonlyMap<string, string>): AdoptionLedger;
 /**
@@ -100,6 +157,17 @@ export declare function readAdoptionLedger(document: unknown, commands?: Readonl
  * choudoufu already wrote.
  *
  * An address the render offered no command for is simply absent from the map.
+ *
+ * ## Which caller still needs this (#2241)
+ *
+ * One: the `unowned[]` half of {@link readAdoptionLedger}. choudoufu's
+ * `views.StatelessUnowned` has no command field, so a live resource found at
+ * an identity the configuration declares still gets its paste-ready command
+ * from the human render and from nowhere else. The `adoptable[]` half no
+ * longer reads a line of text: those rows carry `adopt_command` in the
+ * document itself since v0.15.0 (choudoufu #962), which is what made the
+ * adopt path stop resting on two regexes over a render nobody promised to
+ * keep stable.
  */
 export declare function parseAdoptionCommands(ledgerText: string): Map<string, string>;
 /**
@@ -109,10 +177,17 @@ export declare function parseAdoptionCommands(ledgerText: string): Map<string, s
  * One line per adoptable match, naming the declared address, the live resource
  * it binds, and the two tag values that adopt it, in the token forms
  * `-adoption-only` prints them in (`<addr> <- <type> <identity>`,
- * `tofu-estate=`, `tofu-address=`). Contested addresses follow, listed and not
- * offered. An empty ledger still renders a line: "nothing adoptable" is a
- * result a reader wants, and a section that vanishes reads as one that was
- * never computed.
+ * `tofu-estate=`, `tofu-address=`). A content match adds the arguments it
+ * rested on under its row, in the same `matched on:` form the human render
+ * uses, because "these two agreed on this cidr" is the whole evidence for a
+ * match nobody read an identity for. Contested addresses follow, listed and
+ * not offered.
+ *
+ * An empty ledger still renders a line: "nothing adoptable" is a result a
+ * reader wants, and a section that vanishes reads as one that was never
+ * computed. Which of the two empties it is comes from `swept`: a run that
+ * asked no estate-wide sweep found nothing because it did not look, and
+ * saying so is the difference between a report and a silence.
  */
 export declare function renderAdoptionLedger(ledger: AdoptionLedger, estate?: string): string;
 //# sourceMappingURL=adoption.d.ts.map

package/dist/op/adoption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../../src/op/adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CAqC5G;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAoB7E;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAgDpF"}
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../../src/op/adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAsCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CA2D5G;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAoB7E;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CA0DpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "type": "module",
   "files": [
     "src/",
@@ -56,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.60.0",
+    "@intentius/chant": "^0.61.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -16,12 +16,14 @@ and stays where it is.
 
 ## The binary and the emulator these rows name
 
-`choudoufu v0.14.0` below means the published release binary, not a source
-build: `gh release download v0.14.0 -R INTENTIUS/choudoufu -p
-'choudoufu_v0.14.0_darwin_arm64.tar.gz' -p SHA256SUMS`, verified against
-`SHA256SUMS` (`41c705d9b5fec47100c4f2fb9ab0694f0160b31a4e0661e877b4d9821bc464e3`),
-extracted and put first on PATH. `choudoufu version` prints `choudoufu v0.14.0
-(based on OpenTofu v1.13.0-dev)`.
+`choudoufu v0.15.0` below means the published release binary, not a source
+build: `gh release download v0.15.0 -R INTENTIUS/choudoufu -p
+'choudoufu_v0.15.0_darwin_arm64.tar.gz' -p SHA256SUMS`, verified against
+`SHA256SUMS` (`db29573cb7d8dfa7205eeaecc0e4bcf154e941b8bb8179fb93ad53ac5c959409`),
+extracted and put first on PATH. `choudoufu version` prints `choudoufu v0.15.0
+(based on OpenTofu v1.13.0-dev)`. A row that still names `v0.14.0` means the
+same recipe one tag back
+(`41c705d9b5fec47100c4f2fb9ab0694f0160b31a4e0661e877b4d9821bc464e3`).
 
 `the pinned floci emulator` means choudoufu's own smoke stack image,
 `ghcr.io/lex00/floci@sha256:a39185cc3971d0188663d61043cb038dff1260d8a975b1aa72c4e2bb1feac3cb`
@@ -47,10 +49,11 @@ resolvable).
 npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.test.ts
 ```
 
-Last passed: 2026-09-07, `Terraform v1.15.8` on `darwin_arm64`, with
+Last passed: 2026-09-08, `Terraform v1.15.8` on `darwin_arm64`, with
 `hashicorp/null` resolved from the public registry for the fixture's `~> 3.2`
-constraint. No emulator is involved. Re-run by chant #2168 alongside the two
-live blocks in the same file, so the file's three rows all come from one run.
+constraint. No emulator is involved. Re-run by chant #2241 alongside every
+other block in this file, so all four rows come from one run; #2168 had run it
+on 2026-09-07 the same way.
 
 ### 2. `TerraformApplyOp applies a live root against choudoufu's emulator`
 
@@ -63,21 +66,22 @@ carrying choudoufu's own message rather than as thrown errors, then applies
 the same file once the world is restored.
 
 Gated on a `choudoufu` on PATH, on it reporting a release version at or above
-`MIN_CHOUDOUFU_VERSION` (0.14.0), and on `CHOUDOUFU_EMULATOR_ENDPOINT`. Not
-gated on choudoufu #894 and never was: the plan half here is the stock `plan
--out` path and reads no JSON document.
+`MIN_CHOUDOUFU_VERSION` (0.15.0 since chant #2241), and on
+`CHOUDOUFU_EMULATOR_ENDPOINT`. Not gated on choudoufu #894 and never was: the
+plan half here is the stock `plan -out` path and reads no JSON document.
 
 ```
 npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.test.ts
 ```
 
-Last passed: 2026-09-07, choudoufu v0.14.0 with the pinned floci emulator up,
-recorded by chant #2168. That run is reproducible from this file: the binary
-is a release asset and the emulator is a pinned digest. Before it, the only
-record was PR #2157's prose ("the acceptance suite 3 passed against v0.13.0
-with the emulator up", merged at `81200b5d97c15920619de4b109c4393ec3223720`),
-which #2220 could not reproduce because no binary existed on the machine that
-wrote this file.
+Last passed: 2026-09-08, choudoufu v0.15.0 with the pinned floci emulator up,
+recorded by chant #2241; before that 2026-09-07 on v0.14.0, recorded by chant
+#2168. Both runs are reproducible from this file: the binary is a release
+asset and the emulator is a pinned digest. Before them, the only record was PR
+#2157's prose ("the acceptance suite 3 passed against v0.13.0 with the
+emulator up", merged at `81200b5d97c15920619de4b109c4393ec3223720`), which
+#2220 could not reproduce because no binary existed on the machine that wrote
+this file.
 
 ### 3. `choudoufu live-check and live-plan against the fixture`
 
@@ -94,12 +98,12 @@ PATH is gone.
 npx vitest run lexicons/terraform/src/op/activities/choudoufu.acceptance.test.ts
 ```
 
-Last passed: 2026-09-07, choudoufu v0.14.0 with the pinned floci emulator up,
-recorded by chant #2168. That is the first pass this block has ever had as a
-suite, and the first the `live-plan` test has ever had at all. It had been
-gated shut on choudoufu #894 since commit `65821d76` (2026-09-06 12:45Z);
-before that gate, PR #2135's body records a hand verification of the
-`live-check` half only.
+Last passed: 2026-09-08, choudoufu v0.15.0 with the pinned floci emulator up,
+recorded by chant #2241; before that 2026-09-07 on v0.14.0, recorded by chant
+#2168, which was the first pass this block ever had as a suite and the first
+the `live-plan` test ever had at all. It had been gated shut on choudoufu #894
+since commit `65821d76` (2026-09-06 12:45Z); before that gate, PR #2135's body
+records a hand verification of the `live-check` half only.
 
 Two chant-side changes in #2168 were what the pass needed, both consequences
 of what choudoufu PR 915 shipped. `-estate` is still refused beside a declared
@@ -112,51 +116,59 @@ first real run of this block found.
 ### 4. `TerraformAdoptOp adopts an unmarked live resource`
 
 `composites/terraform-adopt-op.acceptance.test.ts`. One test: create an
-unmarked VPC directly against the emulator so it is a live resource this
-estate does not own at an identity the `live-adopt/` root declares, run the
-Ledger step and expect exactly one adoptable match carrying the two marker
-values, run the Adopt step and let it write them, then re-plan and expect the
-estate to own the same VPC with nothing left adoptable.
+unmarked VPC directly against the emulator at the cidr the `live-adopt/` root
+declares, so it is a live resource this estate does not own and the sweep can
+match to a declaration by content, run the Ledger step and expect exactly one
+adoptable match carrying the two marker values, run the Adopt step and let it
+write them, then re-plan and expect the estate to own the same VPC with
+nothing left adoptable.
 
 Gated on a `choudoufu` on PATH, on an `aws` CLI on PATH (the unmarked
-resource is created and adopted through it), on
-`CHOUDOUFU_EMULATOR_ENDPOINT`, and then on
-`CHOUDOUFU_ADOPTABLE_NOT_IN_DOCUMENT`, which replaced the #894 gate and names
-choudoufu #962.
+resource is created and adopted through it), and on
+`CHOUDOUFU_EMULATOR_ENDPOINT`. Those three and nothing else since chant
+#2241: the `CHOUDOUFU_ADOPTABLE_NOT_IN_DOCUMENT` constant that named choudoufu
+#962, and the #894 gate before it, are both gone.
 
 ```
 npx vitest run lexicons/terraform/src/composites/terraform-adopt-op.acceptance.test.ts
 ```
 
-Last passed: never, and the reason changed on 2026-09-07 rather than going
-away. chant #2168 dropped the #894 gate and ran the block against choudoufu
-v0.14.0 and the pinned floci emulator. It reached the document and stopped
-there, with `ledger.adoptions` empty:
+Last passed: 2026-09-08, choudoufu v0.15.0 with the pinned floci emulator up,
+recorded by chant #2241. **That is the first time this block has ever passed,
+on any binary.**
+
+```
+ ✓ TerraformAdoptOp adopts an unmarked live resource > ledgers one adoptable
+   VPC, writes its two markers, and re-plans with it owned 18614ms
+```
+
+What it needed was choudoufu PR 963, released in v0.15.0. `live-plan -json`'s
+document now carries the estate-wide sweep's content matches as an
+`adoptable[]` section, with `swept[]` beside it, and each row carries the two
+marker values, the arguments the match rested on, and the tagging command that
+writes them. Before that the match existed only in the human `-adoption-only`
+render, which choudoufu refuses alongside `-json`, so an `aws_vpc` (EC2
+assigns the id, so no argument in the block determines it) reached
+`omissions[].reason = "NEEDS_DISCOVERY"` and never `unowned[]`, and
+`ledger.adoptions` came back empty:
 
 ```
 AssertionError: expected [] to have a length of 1 but got +0
  ❯ terraform-adopt-op.acceptance.test.ts:116:34
 ```
 
-The document's `unowned[]` is the resources found at an identity the
-configuration itself declares, and it works: an unmarked
-`aws_cloudwatch_log_group` in the same fixture shape comes back on the same
-binary with `adopt_tofu_estate` and `adopt_tofu_address` on it, which is the
-shape `../live-plan.json` recorded. An `aws_vpc` has no such identity, so the
-document reports `omissions[].reason = "NEEDS_DISCOVERY"` and leaves
-`unowned[]` empty. The VPC is matched by choudoufu's content matcher during
-the estate-wide unclaimed sweep instead, and that match is printed only in the
-human render's "Adoptable" section, for which `views.LivePlanDocument` has no
-field. `-adoption-only` is refused alongside `-json`, and
-`TOFU_LIVE_COLLECT_UNCLAIMED=1` on the `-json` run leaves `"unowned": []`
-while the text run beside it prints `Adoptable: 1 live resource matches a
-declared resource`. Filed upstream as choudoufu #962
-(https://github.com/INTENTIUS/choudoufu/issues/962), which carries the full
-measurement; chant #2168 has the same.
+That was chant #2168's measurement on 2026-09-07 against v0.14.0, filed
+upstream as choudoufu #962
+(https://github.com/INTENTIUS/choudoufu/issues/962), which carries the whole
+of it. Two chant-side changes in #2241 were what the pass needed on top of the
+release: `choudoufuLivePlan` puts `TOFU_LIVE_COLLECT_UNCLAIMED=1` on the
+`-json` run under `adoptionOnly`, because a `-json` run asks no estate-wide
+sweep of its own and the section is empty without one; and
+`readAdoptionLedger` reads both `unowned[]` and `adoptable[]` into one ledger.
 
 The fixture was deliberately left as an `aws_vpc`. A log group would make the
-block pass and would stop it proving the content-matcher path, which is the
-only thing it exists to prove.
+block pass off `unowned[]` alone and would stop it proving the content-matcher
+path, which is the only thing it exists to prove.
 
 ## Running everything that can run on a machine with no choudoufu
 
@@ -169,9 +181,31 @@ npx vitest run \
 
 With `terraform` on PATH and the registry reachable, that is 1 passed and 5
 skipped, and each skip names its own reason in the block title. With
-choudoufu v0.14.0, the `aws` CLI and the emulator all present, it is 5 passed
-and 1 skipped: block 4 is the skip. On 2026-09-07 that is exactly what it
-printed.
+choudoufu v0.15.0, the `aws` CLI and the emulator all present, it is 6 passed
+and 0 skipped: no block in this file skips any more. On 2026-09-08 that is
+exactly what it printed.
+
+```
+ Test Files  3 passed (3)
+      Tests  6 passed (6)
+```
+
+Bring the emulator up on a fixed port from choudoufu's own compose file rather
+than through `just smoke`, which runs one scenario and tears the stack down
+again:
+
+```
+cd <choudoufu checkout>
+FLOCI_IMAGE="$(cat live/floci-image)" FLOCI_PORT=4660 \
+OPENTOFU_IMAGE=unused SMOKE_WORK=/tmp \
+  docker compose -p chant-acceptance -f live/smoke/docker-compose.yml up -d floci
+export CHOUDOUFU_EMULATOR_ENDPOINT=http://localhost:4660
+```
+
+Each run wants a fresh emulator: the adopt block creates an unmarked VPC at a
+fixed cidr, and a second one left over from an earlier run is a contested
+address rather than an adoptable match, which is a real refusal and not a
+flake. `docker compose -p chant-acceptance ... down -v` between runs.
 
 ## Keeping this file honest
 

package/src/__fixtures__/graph-roots/README.md

@@ -0,0 +1,21 @@
+# graph-roots
+
+Two root modules with real references between their blocks, for the graph-IR
+edge and grouping tests (chant #2265, #2266).
+
+Everything the two issues asked to have pinned by a test rather than by prose
+is here exactly once:
+
+- every reference form that becomes an edge: `resource`, `data`, `module`,
+  `var` and `local`
+- a `depends_on`, which is an edge with no attribute
+- a `count` block, which stays ONE node and one edge per target
+- a local child module, so a reference resolves inside the child's own scope
+  and never against the root's
+- a `provider = aws.replica` meta-argument, which is deliberately NOT an edge
+- two roots that share nothing, which is what a cross-root edge would have to
+  invent
+
+`app` reads a policy by NAME through a data source rather than by reference,
+which is how the estate these issues were filed against composes its roots.
+No edge should appear between the two roots because of it.

package/src/__fixtures__/graph-roots/app/main.tf

@@ -0,0 +1,41 @@
+variable "region" {
+  type = string
+}
+
+variable "subnets" {
+  type = list(string)
+}
+
+provider "aws" {
+  alias  = "replica"
+  region = var.region
+}
+
+data "aws_iam_policy" "boundary" {
+  name = "waterpark-boundary"
+}
+
+resource "aws_s3_bucket" "assets" {
+  provider = aws.replica
+  bucket   = "app-assets"
+}
+
+module "cdn" {
+  source = "./modules/cdn"
+
+  bucket = aws_s3_bucket.assets.id
+}
+
+resource "aws_instance" "web" {
+  count      = length(var.subnets)
+  subnet_id  = var.subnets[count.index]
+  depends_on = [aws_s3_bucket.assets, module.cdn]
+
+  tags = {
+    boundary = data.aws_iam_policy.boundary.arn
+  }
+}
+
+output "cdn_url" {
+  value = module.cdn.url
+}

package/src/__fixtures__/graph-roots/app/modules/cdn/main.tf

@@ -0,0 +1,7 @@
+variable "bucket" {
+  type = string
+}
+
+resource "aws_cloudfront_distribution" "cdn" {
+  origin_id = var.bucket
+}

package/src/__fixtures__/graph-roots/network/main.tf

@@ -0,0 +1,16 @@
+variable "cidr" {
+  type = string
+}
+
+locals {
+  base_tags = { Team = "platform" }
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = var.cidr
+  tags       = local.base_tags
+}
+
+output "vpc_id" {
+  value = aws_vpc.main.id
+}