@intentius/chant 0.124.46 → 0.124.49

package/src/__golden__/wave-loop/op-wide-refused.json

@@ -190,6 +190,32 @@
     "wave 1 (apps) is refused by its policy; nothing applied."
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1-share-2.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "refused"
+        },
+        "t2": {
+          "status": "refused"
+        },
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/plans.json": {
       "runs": [
         {

package/src/__golden__/wave-loop/op-wide-waiting.json

@@ -178,6 +178,35 @@
     "wave 3 (prod) is waiting on migrations-wave-3; nothing applied. chant approve migrations migrations-wave-3 --plan jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        },
+        "t3": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.plan.json": {
       "planDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
     },

package/src/__golden__/wave-loop/op-wide.json

@@ -351,6 +351,45 @@
     "t2: its plan moved since wave 3 was decided, so it was not applied. decided: sha256:2222222222222222222222222222222222222222222222222222222222222222; planned now: sha256:9999999999999999999999999999999999999999999999999999999999999999"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "applied"
+        },
+        "t2": {
+          "status": "not-applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-2.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "decided"
+        },
+        "t2": {
+          "status": "decided"
+        },
+        "t3": {
+          "status": "decided"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/src/action-pins.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ACTION_PINS, pinAtMajor, pinMajor, tagComments, unpinnedActions, usesRef } from "./action-pins";
+
+describe("the action pin table", () => {
+  it("holds a full commit SHA and a release of the row's major for every action", () => {
+    for (const [key, p] of Object.entries(ACTION_PINS)) {
+      expect({ key, sha: /^[0-9a-f]{40}$/.test(p.sha) }).toEqual({ key, sha: true });
+      expect({ key, tag: p.tag.startsWith(`${p.major}.`) }).toEqual({ key, tag: true });
+    }
+  });
+
+  it("finds a tag, a branch or a short SHA, and passes a full SHA, a local action and a docker image", () => {
+    const yaml = [
+      "      - uses: actions/checkout@v4",
+      "        uses: https://code.forgejo.org/actions/cache@main",
+      "      - uses: 'actions/setup-node@8207627'",
+      `      - uses: actions/checkout@${"a".repeat(40)} # v4.4.0`,
+      "      - uses: ./.github/actions/local",
+      "      - uses: docker://alpine:3.20",
+    ].join("\n");
+    expect(unpinnedActions(yaml)).toEqual(["actions/checkout@v4", "https://code.forgejo.org/actions/cache@main", "actions/setup-node@8207627"]);
+  });
+
+  it("writes the release beside a pinned line once, and leaves an unknown SHA alone", () => {
+    const line = `      - uses: ${usesRef(ACTION_PINS.checkout6)}`;
+    const once = tagComments(line);
+    expect(once).toBe(`${line} # ${ACTION_PINS.checkout6.tag}`);
+    expect(tagComments(once)).toBe(once);
+    expect(tagComments(`  uses: actions/checkout@${"f".repeat(40)}`)).toBe(`  uses: actions/checkout@${"f".repeat(40)}`);
+  });
+
+  it("moves a pinned upload-artifact to another major of the same action", () => {
+    expect(pinAtMajor(ACTION_PINS.uploadArtifact4.sha, "v3")).toBe(ACTION_PINS.uploadArtifact3);
+    expect(pinAtMajor(ACTION_PINS.uploadArtifact4.sha, "v9")).toBeUndefined();
+    expect(pinAtMajor("0".repeat(40), "v3")).toBeUndefined();
+    expect(pinMajor(ACTION_PINS.downloadArtifact4.sha)).toBe(4);
+  });
+});
+
+// #4410: the places that are not generators pin too.
+const repoRoot = join(__dirname, "../../..");
+
+describe("hand-written actions are pinned (#4410)", () => {
+  it("chant's own workflows name every action by a full commit SHA", () => {
+    const dir = join(repoRoot, ".github/workflows");
+    const unpinned: Record<string, string[]> = {};
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".yml"))) {
+      const found = unpinnedActions(readFileSync(join(dir, f), "utf8"));
+      if (found.length) unpinned[f] = found;
+    }
+    expect(unpinned).toEqual({});
+  });
+
+  it("every pinned line in chant's own workflows carries a release comment", () => {
+    const dir = join(repoRoot, ".github/workflows");
+    const bare: string[] = [];
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".yml"))) {
+      for (const line of readFileSync(join(dir, f), "utf8").split("\n")) {
+        if (/uses: *[^\s#]+@[0-9a-f]{40}\s*$/.test(line)) bare.push(`${f}: ${line.trim()}`);
+      }
+    }
+    expect(bare).toEqual([]);
+  });
+
+  it("no github composite writes a `uses:` tag literal; each takes its ref from the pin table", () => {
+    const dir = join(repoRoot, "lexicons/github/src/composites");
+    const literal: Record<string, string[]> = {};
+    for (const f of readdirSync(dir).filter((n) => n.endsWith(".ts") && !n.endsWith(".test.ts"))) {
+      const found = [...readFileSync(join(dir, f), "utf8").matchAll(/(?:uses|setupAction):\s*["'`]([^"'`]+)["'`]/g)]
+        .map((m) => m[1])
+        .filter((r) => unpinnedActions(`uses: ${r}`).length > 0);
+      if (found.length) literal[f] = found;
+    }
+    expect(literal).toEqual({});
+  });
+});

package/src/action-pins.ts

@@ -0,0 +1,92 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+
+export interface ActionPin {
+  /** The action, with its subpath: `actions/cache/restore`. */
+  readonly slug: string;
+  /** The major tag the row follows, such as `v4`. */
+  readonly major: string;
+  readonly sha: string;
+  /** The release at that commit, written beside the `uses:` line. */
+  readonly tag: string;
+}
+
+const pin = (slug: string, major: string, sha: string, tag: string): ActionPin => ({ slug, major, sha, tag });
+
+export const ACTION_PINS = {
+  checkout7: pin("actions/checkout", "v7", "3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"),
+  checkout6: pin("actions/checkout", "v6", "d23441a48e516b6c34aea4fa41551a30e30af803", "v6.1.0"),
+  checkout4: pin("actions/checkout", "v4", "11d5960a326750d5838078e36cf38b85af677262", "v4.4.0"),
+  setupNode6: pin("actions/setup-node", "v6", "249970729cb0ef3589644e2896645e5dc5ba9c38", "v6.5.0"),
+  setupNode4: pin("actions/setup-node", "v4", "49933ea5288caeca8642d1e84afbd3f7d6820020", "v4.4.0"),
+  setupNode7: pin("actions/setup-node", "v7", "949feb2413d6458794dcd2491c4babbbce0c15c1", "v7.1.0"),
+  cache6: pin("actions/cache", "v6", "55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6.1.0"),
+  uploadArtifact7: pin("actions/upload-artifact", "v7", "cf430e030ddbb5b0abf93d22962f4752f3646cd9", "v7.0.2"),
+  downloadArtifact8: pin("actions/download-artifact", "v8", "9000827ccba6bdab643e8b6fd33ac0654aef8333", "v8.0.2"),
+  setupGo7: pin("actions/setup-go", "v7", "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", "v7.0.0"),
+  setupPython7: pin("actions/setup-python", "v7", "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0", "v7.1.0"),
+  setupBun2: pin("oven-sh/setup-bun", "v2", "0c5077e51419868618aeaa5fe8019c62421857d6", "v2.2.0"),
+  golangciLint9: pin("golangci/golangci-lint-action", "v9", "ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a", "v9.3.0"),
+  dockerLogin4: pin("docker/login-action", "v4", "81c6f93d4bc991e510b342a00b419b3bb4efc5c6", "v4.7.0"),
+  dockerSetupBuildx4: pin("docker/setup-buildx-action", "v4", "f87e5991a6d7451dcb8d9637bfbc97413f497069", "v4.4.1"),
+  dockerMetadata6: pin("docker/metadata-action", "v6", "dc802804100637a589fabce1cb79ff13a1411302", "v6.2.0"),
+  dockerBuildPush7: pin("docker/build-push-action", "v7", "c3c9e263c25d99ce0380d002d59b67737d91b0dc", "v7.4.0"),
+  createGithubAppToken2: pin("actions/create-github-app-token", "v2", "fee1f7d63c2ff003460e3d139729b119787bc349", "v2.2.2"),
+  cacheRestore4: pin("actions/cache/restore", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+  cacheSave4: pin("actions/cache/save", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+  uploadArtifact4: pin("actions/upload-artifact", "v4", "ea165f8d65b6e75b540449e92b4886f43607fa02", "v4.6.2"),
+  uploadArtifact3: pin("actions/upload-artifact", "v3", "ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5", "v3.2.1"),
+  downloadArtifact4: pin("actions/download-artifact", "v4", "d3f86a106a0bac45b974a628896c90dbdf5c8093", "v4.3.0"),
+  downloadArtifact3: pin("actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "v3.0.2"),
+} as const satisfies Record<string, ActionPin>;
+
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export const usesRef = (p: ActionPin): string => `${p.slug}@${p.sha}`;
+
+const TAG_BY_SHA = new Map<string, string>();
+for (const p of Object.values(ACTION_PINS) as ActionPin[]) TAG_BY_SHA.set(p.sha, p.tag);
+
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export function tagComments(yaml: string): string {
+  return yaml.replace(/^(\s*(?:- )?uses: *["']?[^\s"'#]+@([0-9a-f]{40})["']?)[ \t]*$/gm, (line, head: string, sha: string) => {
+    const tag = TAG_BY_SHA.get(sha);
+    return tag ? `${head} # ${tag}` : line;
+  });
+}
+
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export function unpinnedActions(yaml: string): string[] {
+  const out: string[] = [];
+  for (const m of yaml.matchAll(/^\s*(?:- )?uses: *["']?([^\s"'#]+)["']?/gm)) {
+    const ref = m[1];
+    if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith("docker://")) continue;
+    if (!/@[0-9a-f]{40}$/.test(ref)) out.push(ref);
+  }
+  return out;
+}
+
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export function pinAtMajor(sha: string, major: string): ActionPin | undefined {
+  const rows = Object.values(ACTION_PINS) as ActionPin[];
+  const from = rows.find((p) => p.sha === sha);
+  return from ? rows.find((p) => p.slug === from.slug && p.major === major) : undefined;
+}
+
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export function pinMajor(sha: string): number | undefined {
+  const row = (Object.values(ACTION_PINS) as ActionPin[]).find((p) => p.sha === sha);
+  return row ? Number(row.major.slice(1)) : undefined;
+}

package/src/cli/commands/carve-score-once.test.ts

@@ -0,0 +1,99 @@
+import { describe, test, expect } from "vitest";
+import { carveJson } from "./carve";
+import { boundaryIndex, boundaryReport } from "../../terraform/carve";
+import { scoreEstate } from "../../terraform/score";
+import type { TfEdge, TfGraph, TfNode } from "../../terraform/types";
+
+const node = (type: string, name: string): TfNode => ({
+  address: `${type}.${name}`,
+  kind: "resource",
+  type,
+  name,
+  instances: 1,
+  hasDynamic: false,
+});
+
+const edge = (from: string, to: string, extra: Partial<TfEdge> = {}): TfEdge => ({
+  from,
+  to,
+  attrs: ["id"],
+  via: ["bucket"],
+  ...extra,
+});
+
+/** A fixture with a fold, an output edge, a module, an unmapped type and a duplicate edge. */
+function fixture(): TfGraph {
+  return {
+    nodes: [
+      node("aws_s3_bucket", "assets"),
+      node("aws_s3_bucket_versioning", "assets"),
+      node("aws_lambda_function", "api"),
+      node("aws_sqs_queue", "q"),
+      node("random_pet", "name"),
+      { address: "module.cdn", kind: "module", name: "cdn", instances: 1, hasDynamic: false },
+    ],
+    edges: [
+      edge("aws_s3_bucket_versioning.assets", "aws_s3_bucket.assets"),
+      edge("aws_lambda_function.api", "aws_s3_bucket.assets", { attrs: ["bucket"] }),
+      edge("aws_lambda_function.api", "aws_s3_bucket.assets", { attrs: ["arn"], via: ["env"] }),
+      edge("output.bucket", "aws_s3_bucket.assets", { fromKind: "output", via: ["value"] }),
+      edge("aws_lambda_function.api", "aws_sqs_queue.q"),
+      edge("module.cdn", "aws_lambda_function.api"),
+    ],
+  };
+}
+
+/** The old path: every resource's boundary rescored the whole estate. */
+function legacyJson(graph: TfGraph) {
+  const results = scoreEstate(graph);
+  return results.map((r) => {
+    const report = boundaryReport(graph, r.address, { dialect: "terraform" });
+    return report ? { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } } : r;
+  });
+}
+
+function chain(n: number): TfGraph {
+  const nodes: TfNode[] = [];
+  const edges: TfEdge[] = [];
+  for (let i = 0; i < n; i++) {
+    nodes.push(node("aws_sqs_queue", `q${i}`));
+    if (i > 0) edges.push(edge(`aws_sqs_queue.q${i}`, `aws_sqs_queue.q${i - 1}`));
+    if (i > 1) edges.push(edge(`aws_sqs_queue.q${i}`, `aws_sqs_queue.q${i - 2}`));
+  }
+  return { nodes, edges };
+}
+
+describe("carve advise scores the estate once (#4391)", () => {
+  test("output is byte-identical to the per-resource rescoring path", () => {
+    const graph = fixture();
+    const payload = carveJson({ ok: true, from: "x", source: "terraform", results: scoreEstate(graph), graph });
+    expect(JSON.stringify(payload.resources)).toBe(JSON.stringify(legacyJson(graph)));
+    expect(payload.resources.some((r) => r.boundary?.inbound.length)).toBe(true);
+  });
+
+  test("a supplied peelability and edge index give the same report", () => {
+    const graph = fixture();
+    for (const r of scoreEstate(graph)) {
+      expect(JSON.stringify(boundaryReport(graph, r.address, { peelability: r, index: boundaryIndex(graph) }))).toBe(
+        JSON.stringify(boundaryReport(graph, r.address)),
+      );
+    }
+  });
+
+  test("on a few thousand nodes the old path costs more per resource than the whole new pass", () => {
+    const graph = chain(3000);
+    // Radius is its own walk per node (#2326), not what this test is about.
+    const t0 = performance.now();
+    const results = scoreEstate(graph, { radius: false });
+    const payload = carveJson({ ok: true, from: "x", source: "terraform", results, graph });
+    const fresh = performance.now() - t0;
+    expect(payload.resources).toHaveLength(3000);
+
+    // Rescoring is O(V) per resource, so 50 of them already outweigh the one pass over all 3000.
+    const sample = results.slice(0, 50);
+    const t1 = performance.now();
+    for (const r of sample) boundaryReport(graph, r.address);
+    const legacy = performance.now() - t1;
+    expect(legacy).toBeGreaterThan(fresh);
+  });
+});

package/src/cli/commands/carve.ts

@@ -19,7 +19,7 @@ import { adviseCloudAssembly, CDK_DIALECT } from "../../cdk/advise";
 import { isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { scoreEstate, type Peelability, type PeelabilityBand, type ScoreOptions } from "../../terraform/score";
-import { boundaryReport, type BoundaryEdge, type CarveDialect } from "../../terraform/carve";
+import { boundaryIndex, boundaryReport, type BoundaryIndex, type BoundaryEdge, type CarveDialect } from "../../terraform/carve";
 import type { TfGraph } from "../../terraform/types";
 
 export interface CarveAdviseOptions {
@@ -141,6 +141,9 @@ async function adviseTerraform(opts: CarveAdviseOptions): Promise<CarveAdviseRes
  * additive and ignorable: the top-level `source` discriminator, per-resource
  * `notes` and `members`, and two more `bridge` values in a list that was
  * already declared open-ended.
+ *
+ * Per-resource `radius` (#2326) is additive the same way: a new field beside
+ * `score`, not a term inside it, so the score and its penalties are unchanged.
  */
 export const CARVE_REPORT_VERSION = 1;
 
@@ -201,6 +204,7 @@ export function carveJson(result: CarveAdviseResult): CarveJsonReport {
   );
   const source = result.source ?? "terraform";
   const dialect: CarveDialect = source === "cdk" ? CDK_DIALECT : "terraform";
+  const index = result.graph ? boundaryIndex(result.graph) : undefined;
   return {
     version: CARVE_REPORT_VERSION,
     from: result.from,
@@ -209,7 +213,7 @@ export function carveJson(result: CarveAdviseResult): CarveJsonReport {
     count: results.length,
     bands: counts,
     ...(result.diagnostics?.length ? { diagnostics: result.diagnostics } : {}),
-    resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions)),
+    resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions, index)),
   };
 }
 
@@ -219,9 +223,11 @@ function withBoundary(
   graph: TfGraph | undefined,
   dialect: CarveDialect,
   score: ScoreOptions | undefined,
+  index: BoundaryIndex | undefined,
 ): CarveJsonResource {
   if (!graph) return r;
-  const report = boundaryReport(graph, r.address, { dialect, score });
+  // The ranking already scored this resource; the report reads it back rather than rescoring the estate (#4391).
+  const report = boundaryReport(graph, r.address, { dialect, score, peelability: r, index });
   if (!report) return r;
   return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
 }
@@ -246,6 +252,8 @@ export function formatCarveReport(result: CarveAdviseResult): string {
   );
   for (const note of result.diagnostics ?? []) lines.push(`  ! ${note}`);
   lines.push("");
+  const cells = new Map(results.map((r) => [r.address, radiusCell(r)]));
+  const cellWidth = Math.max(...[...cells.values()].map((c) => c.length));
 
   for (const band of BAND_ORDER) {
     const inBand = results.filter((r) => r.band === band);
@@ -253,9 +261,11 @@ export function formatCarveReport(result: CarveAdviseResult): string {
     lines.push(`${bandLabel(band, cdk)}  (${inBand.length})`);
     for (const r of inBand) {
       const target = r.mapsTo ? ` -> ${r.mapsTo}` : "";
-      lines.push(`  ${String(r.score).padStart(3)}  ${r.address}${target}`);
-      lines.push(`       ${reasons(r, cdk)}`);
-      for (const note of r.notes ?? []) lines.push(`       ${note}`);
+      const cell = cellWidth > 0 ? `${cells.get(r.address)!.padEnd(cellWidth)}  ` : "";
+      const indent = " ".repeat(7 + (cellWidth > 0 ? cellWidth + 2 : 0));
+      lines.push(`  ${String(r.score).padStart(3)}  ${cell}${r.address}${target}`);
+      lines.push(`${indent}${reasons(r, cdk)}`);
+      for (const note of r.notes ?? []) lines.push(`${indent}${note}`);
     }
     lines.push("");
   }
@@ -263,9 +273,30 @@ export function formatCarveReport(result: CarveAdviseResult): string {
   lines.push(
     `Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in ${cdk ? "CDK" : "Terraform"}`,
   );
+  if (cellWidth > 0) {
+    lines.push(
+      "Radius: resources+outputs that depend on it at any depth, dN the farthest hop; - none; " +
+        (cdk ? "xN across a stack boundary." : "? a module or unresolved count/for_each hides how many."),
+    );
+  }
   return lines.join("\n").trimEnd();
 }
 
+/**
+ * The radius column (#2326): `3+1 d2` is three resources and one output that
+ * depend on the node, the farthest two hops away; `-` is nothing; `?` stands in
+ * for a count a module or unresolved `count` hides; ` x2` is how many sit
+ * across a stack boundary. Empty when the result carries no radius.
+ */
+function radiusCell(r: Peelability): string {
+  const radius = r.radius;
+  if (!radius) return "";
+  if (radius.depth === 0) return "-";
+  const n = (v: number | "unknown"): string => (v === "unknown" ? "?" : String(v));
+  const cross = radius.crossStack !== undefined && radius.crossStack !== 0 ? ` x${n(radius.crossStack)}` : "";
+  return `${n(radius.resources)}+${radius.outputs} d${radius.depth}${cross}`;
+}
+
 function bandLabel(band: PeelabilityBand, cdk: boolean): string {
   switch (band) {
     case "clean leaf":

package/src/cli/commands/check-lexicon.test.ts

@@ -85,8 +85,8 @@ describe("coverageReportCheck", () => {
 describe("countRequiredNames (#3377)", () => {
   const read = (lex: string) => readFileSync(join(repoRoot, "lexicons", lex, "src/validate.ts"), "utf8");
 
-  test("counts names with digits: otel reports 37", () => {
-    expect(countRequiredNames(read("otel"))).toBe(37);
+  test("counts names with digits: otel reports 38", () => {
+    expect(countRequiredNames(read("otel"))).toBe(38);
   });
 
   test("counts only the REQUIRED_NAMES entries: prometheus reports the array length", () => {

package/src/cli/commands/import-report.ts

@@ -0,0 +1,71 @@
+/**
+ * The review report of `chant import` (#4398): the parser's diagnostics as
+ * SARIF (`--report <path>`), a summary on stderr, and the exit code under
+ * `--strict`. The shape follows `chant migrate`: a needs-review diagnostic is
+ * a `warning`, and `--strict` makes any open `warning` or `error` fail the
+ * run. An `info` diagnostic names something not carried that needs no
+ * decision, and never fails a run.
+ */
+
+import { writeFileSync } from "fs";
+import type { ImportDiagnostic } from "../../import/parser";
+import type { LintDiagnostic } from "../../lint/rule";
+import { formatSarif } from "../reporters/stylish";
+
+/** Import diagnostics as lint diagnostics against `file`, the template that was imported. */
+export function importDiagnosticsToLint(file: string, diagnostics: readonly ImportDiagnostic[]): LintDiagnostic[] {
+  return diagnostics.map((d) => ({
+    file,
+    line: d.line ?? 1,
+    column: d.column ?? 1,
+    ruleId: d.ruleId,
+    severity: d.severity,
+    message: d.message,
+    ...(d.entity ? { entity: d.entity } : {}),
+  }));
+}
+
+/** The SARIF document for a run. */
+export function importSarif(file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string {
+  return formatSarif(importDiagnosticsToLint(file, diagnostics), undefined, undefined, version);
+}
+
+/** Write the SARIF report; an unwritable path is returned as a message, not thrown. */
+export function writeImportReport(path: string, file: string, diagnostics: readonly ImportDiagnostic[], version?: string): string | undefined {
+  try {
+    writeFileSync(path, importSarif(file, diagnostics, version));
+    return undefined;
+  } catch (err) {
+    return `could not write SARIF report to ${path}: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+
+/** Diagnostics that are open: everything but `info`. */
+export function openDiagnostics(diagnostics: readonly ImportDiagnostic[]): ImportDiagnostic[] {
+  return diagnostics.filter((d) => d.severity !== "info");
+}
+
+/**
+ * The exit code for a finished import. An `error` always fails (a failed
+ * `--validate`); a `warning` fails under `--strict`.
+ */
+export function importExitCode(diagnostics: readonly ImportDiagnostic[] | undefined, strict: boolean): number {
+  if (!diagnostics) return 0;
+  if (diagnostics.some((d) => d.severity === "error")) return 1;
+  return strict && diagnostics.some((d) => d.severity === "warning") ? 1 : 0;
+}
+
+/** Counts by severity and rule, as the lines printed after an import. */
+export function summarizeImportDiagnostics(diagnostics: readonly ImportDiagnostic[]): string {
+  const bySeverity = { error: 0, warning: 0, info: 0 };
+  const byRule = new Map<string, number>();
+  for (const d of diagnostics) {
+    bySeverity[d.severity]++;
+    byRule.set(d.ruleId, (byRule.get(d.ruleId) ?? 0) + 1);
+  }
+  const rules = [...byRule].sort(([a], [b]) => a.localeCompare(b)).map(([id, n]) => `${id} x${String(n)}`);
+  return [
+    `Review: ${String(bySeverity.warning)} to review, ${String(bySeverity.error)} errors, ${String(bySeverity.info)} notes (${rules.join(", ")}).`,
+    "Write them with --report <path> as SARIF; --strict fails while any to review or error is open.",
+  ].join("\n");
+}