infraweaver 0.3.11 → 0.3.13

package/src/mcp/terraform/azurePrices.ts

@@ -9,30 +9,30 @@ export const AZURE_PRICE_REGION = "westeurope";
 /** Currency of every price below. */
 export const AZURE_PRICE_CURRENCY = "EUR";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export const AZURE_PRICE_FETCHED_AT = "2026-09-03";
+export const AZURE_PRICE_FETCHED_AT = "2026-10-03";
 
 /** meter key → list price per HOUR. */
 export const AZURE_HOURLY_PRICES: Record<string, number> = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341,
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119,
 };

package/src/mcp/terraform/concernResult.ts

@@ -1,5 +1,5 @@
 import type { LocalToolContext } from "#app/mcp/localContext";
-import { remediationBranchSuffix } from "#app/mcp/staleFix";
+import { groupIdFromBranch, type OpenRemediationPr, remediationBranchFor } from "#app/mcp/staleFix";
 import {
   capSeededConcerns,
   type PrioritySignals,
@@ -25,6 +25,7 @@ import {
   type Severity,
   sortConcerns,
 } from "#app/mcp/terraform/types";
+import { recordConcernSites } from "#app/mcp/terraform/verifySites";
 
 export interface ConcernResult {
   /** non-suppressed concerns ≥ threshold, sorted */
@@ -112,6 +113,14 @@ export function buildConcernResult(
      *  the full raw set — so a capped concern the re-scan still sees can never
      *  read as a regression. */
     seedCaps?: SeedCaps;
+    /** The repository's open remediation PRs (see `listOpenRemediationPrs`), so
+     *  a group that already has one keeps its branch. */
+    openRemediationPrs?: readonly OpenRemediationPr[];
+    /** The concerns were scanned off the tree in `cwd` as it is now, so their
+     *  lines name today's resources (see `recordConcernSites`). Only
+     *  `terraform_scan` sets it: a findings file or external report may
+     *  describe another commit. */
+    linesMatchTree?: boolean;
   },
 ): ConcernResult {
   const fullBaseline = dedupe(rawConcerns);
@@ -128,6 +137,7 @@ export function buildConcernResult(
     fullBaseline.map((c) => concernKeyOf(c)),
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd, opts.linesMatchTree ?? false);
   // the files already unformatted at this (pre-fix) scan. terraform_validate
   // subtracts these so PRE-EXISTING `terraform fmt` drift can't force a
   // whole-file reformat into a scoped fix. Captured from the raw set (fmt
@@ -154,17 +164,16 @@ export function buildConcernResult(
     active,
     opts.autonomyThreshold,
   );
-  const suffix = remediationBranchSuffix(
-    remediationBaseOf(ctx),
-    ctx.repo?.data.default_branch?.trim() || undefined,
-  );
+  const base = remediationBaseOf(ctx);
+  const defaultBranch = ctx.repo?.data.default_branch?.trim() || undefined;
+  const branchFor = (id: string) =>
+    remediationBranchFor(id, base, defaultBranch, opts.openRemediationPrs);
   const groups = (
     opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups
-  ).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix}` }));
+  ).map((g) => ({ ...g, branch: branchFor(g.id) }));
   const planned = planBatches(groups);
-  const batchPlan = planned.batch_branch
-    ? { ...planned, batch_branch: `${planned.batch_branch}${suffix}` }
-    : planned;
+  const batchId = planned.batch_branch ? groupIdFromBranch(planned.batch_branch) : null;
+  const batchPlan = batchId ? { ...planned, batch_branch: branchFor(batchId) } : planned;
 
   const bySeverity: Record<string, number> = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;

package/src/mcp/terraform/deltaSummary.ts

@@ -42,6 +42,9 @@ export interface DeltaVerdict {
   gating: number;
   /** introduced findings on a required control, any severity */
   required: number;
+  /** introduced findings that fail either half, each counted once: a high
+   *  finding on a required control is in both `gating` and `required`. */
+  blocking: number;
 }
 
 /** The gate's verdict on a delta: the same two halves `findings-gate` applies. */
@@ -53,6 +56,7 @@ export function deltaVerdict(delta: GateDelta, requiredControls: string[]): Delt
     pass: gate.pass && required.length === 0,
     gating: gate.gating.length,
     required: required.length,
+    blocking: new Set([...gate.gating, ...required]).size,
   };
 }
 

package/src/mcp/terraform/hardcodedSecrets.ts

@@ -12,22 +12,28 @@
  * WHAT IS READ. Every `name = "…"` line inside a `resource`, `data`,
  * `provider`, `module` or `locals` block, at any depth, so
  * `environment { variables = { auth = "…" } }` and `jsonencode({ … })` objects
- * are reached; and the `default` of a `variable` whose name is a secret's. Not
- * read: comments, heredoc bodies, a name/value pair split across two keys
- * (`[{ name = "PASSWORD", value = "…" }]`), and a value that starts on a later
- * line than its name.
+ * are reached; the `default` of a `variable` whose name is a secret's; and
+ * every assignment in a `.tfvars` file, which is where a value kept out of the
+ * `.tf` source usually lands instead. Not read: comments, heredoc bodies, a
+ * name/value pair split across two keys (`[{ name = "PASSWORD", value = "…" }]`),
+ * and a value that starts on a later line than its name.
  *
- * WHAT IS NOT A FINDING. A reference, a function call, an interpolation, an
- * empty string, or a placeholder made only of `*` / `x` / `<…>`. Neither is an
- * argument whose name only mentions a secret (`password_length`, `secret_name`,
- * `token_validity_units`, `creation_token`): the last word of the name decides.
+ * WHAT IS NOT A FINDING. A reference, a function call, an interpolation or a
+ * template directive, an empty string, `true` / `false` / `null`, a number, or
+ * a placeholder made only of `*` / `x` / `<…>`. Nor is a literal that only POINTS
+ * at a secret — an ARN, a GCP `projects/…/secrets/…` name, a Key Vault secret
+ * URI or an SSM parameter path — since that is the fix, not the fault. Neither
+ * is an argument whose name only mentions a secret (`password_length`,
+ * `secret_name`, `token_validity_units`, `creation_token`): the last word of the
+ * name decides, and a name that is `secret` and nothing else names a Secret
+ * Manager secret (`secret_key_ref { secret = "db-password" }`), not its value.
  *
  * Arguments the provider can take write-only (`aws_db_instance.password`) may
  * also be reported by `secret-persisted-to-state`, which says something else:
  * that the value reaches state. This one says it is in git.
  */
 
-import { isStringLiteral, stripTrailingComment } from "#app/mcp/terraform/hcl";
+import { isStringLiteral, skipNonCode, stripTrailingComment } from "#app/mcp/terraform/hcl";
 import { HARDCODED_SECRET_ARGUMENT, NATIVE_SOURCE } from "#app/mcp/terraform/nativeRules";
 import type { SourceFile } from "#app/mcp/terraform/tree";
 import { buildConcern, type Concern } from "#app/mcp/terraform/types";
@@ -46,7 +52,18 @@ const SECRET_WORDS = new Set([
   "credentials",
 ]);
 /** `<word>_key` names that hold a secret (`api_key`, `secret_key`, …). */
-const SECRET_KEY_PREFIXES = new Set(["api", "secret", "private", "signing"]);
+const SECRET_KEY_PREFIXES = new Set([
+  "api",
+  "secret",
+  "private",
+  "signing",
+  "access",
+  "account",
+  "client",
+  "shared",
+  "preshared",
+  "master",
+]);
 /** `<word>_token` names that are identifiers, not credentials. */
 const NOT_SECRET_TOKENS = new Set(["creation", "idempotency", "client", "request", "continuation"]);
 
@@ -66,6 +83,9 @@ export function isSecretName(name: string): boolean {
   if (last === undefined) return false;
   if (last === "key") return prev !== undefined && SECRET_KEY_PREFIXES.has(prev);
   if (last === "token" && prev !== undefined && NOT_SECRET_TOKENS.has(prev)) return false;
+  if (last === "string") return prev === "connection";
+  // `secret` alone is the NAME of a Secret Manager secret (`secret_key_ref { secret = … }`)
+  if (last === "secret" && w.length === 1) return false;
   return SECRET_WORDS.has(last);
 }
 
@@ -75,13 +95,38 @@ function isPlaceholder(inner: string): boolean {
     inner.trim() === "" ||
     /^[*xX.]+$/.test(inner) ||
     /^<[^>]*>$/.test(inner) ||
-    // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
-    /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) ||
+    /^(?:true|false|null)$/.test(inner) ||
+    /^-?\d+(?:\.\d+)?$/.test(inner) ||
+    // a template directive is computed, like an interpolation: `"%{ if … }…%{ endif }"`
+    inner.includes("%{") ||
+    // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`,
+    // `"example-secret"`) — but only when that is the whole value: a lowercase tail at
+    // most, so `"Test-Pr0dDbPassw0rd!"` is a password that happens to start with a word
+    isDummy(inner) ||
     // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
     /^(?:seconds|minutes|hours|days)$/.test(inner)
   );
 }
 
+function isDummy(inner: string): boolean {
+  const m = /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)([_-].*)?$/i.exec(inner);
+  return m !== null && (m[1] === undefined || /^[_-][a-z0-9_-]*$/.test(m[1]));
+}
+
+/**
+ * A literal that names where a secret is kept rather than holding it: a Secrets
+ * Manager / SSM ARN, a GCP Secret Manager resource name, a Key Vault secret URI,
+ * or an SSM parameter path. Passing one of these is the remedy this rule asks for.
+ */
+function isSecretReference(inner: string): boolean {
+  return (
+    inner.startsWith("arn:") ||
+    /^projects\/[^/]+\/secrets\//.test(inner) ||
+    /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\//i.test(inner) ||
+    /^\/[\w./-]+$/.test(inner)
+  );
+}
+
 export interface HardcodedSecret {
   /** the argument, map key or variable name. */
   name: string;
@@ -90,17 +135,52 @@ export interface HardcodedSecret {
   line: number;
 }
 
-/** a top-level block header: `resource "aws_db_instance" "db" {`, `locals {` */
-const HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+/** a top-level block header, `resource "aws_db_instance" "db" {`, and whatever follows its `{` */
+const HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{(.*)$/;
 /** `name = value`, the name bare or quoted */
 const ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
 const HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
 /** a `key = "string"` pair inside a one-line object */
 const INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
 
-function literalValue(raw: string): boolean {
+function literalValue(name: string, raw: string): boolean {
   const value = stripTrailingComment(raw).replace(/,$/, "").trim();
-  return isStringLiteral(value) && !isPlaceholder(value.slice(1, -1));
+  if (!isStringLiteral(value)) return false;
+  const inner = value.slice(1, -1);
+  if (isPlaceholder(inner) || isSecretReference(inner)) return false;
+  // an `auth` setting's mode, not its credential: `iam_auth = "DISABLED"`, `auth = "NONE"`
+  return !(words(name).at(-1) === "auth" && /^[A-Z]+(?:_[A-Z]+)*$/.test(inner));
+}
+
+/** the name a `variable "…"` holder declares. */
+function variableName(holder: string): string {
+  return /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+}
+
+/** True when `line` leaves a block comment open past its end (`foo = 1 /* …`). */
+function opensBlockComment(line: string): boolean {
+  for (let i = 0; i < line.length; i++) {
+    const span = skipNonCode(line, i);
+    if (!span) continue;
+    if (line.startsWith("/*", i) && !line.includes("*/", i + 2)) return true;
+    i = span.end;
+  }
+  return false;
+}
+
+/** True when the text after a header's `{` also closes that block. */
+function closesOnLine(rest: string): boolean {
+  let depth = 1;
+  for (let i = 0; i < rest.length; i++) {
+    const span = skipNonCode(rest, i);
+    if (span) {
+      i = span.end;
+      continue;
+    }
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}" && --depth === 0) return true;
+  }
+  return false;
 }
 
 /**
@@ -111,8 +191,21 @@ function literalValue(raw: string): boolean {
  * parser is shared by every scanner and budgeted (see nativeScan.perf.test).
  */
 export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
+  return findInLines(hcl, null);
+}
+
+/**
+ * Every secret-named literal in a `.tfvars` file. A tfvars file is nothing but
+ * assignments, so every one is read, at any depth, under the file's own name.
+ */
+export function findTfvarsSecrets(hcl: string, path: string): HardcodedSecret[] {
+  return findInLines(hcl, `tfvars input ${path}`);
+}
+
+/** `fileHolder` set: the whole file is one holder (a tfvars file), with no blocks. */
+function findInLines(hcl: string, fileHolder: string | null): HardcodedSecret[] {
   const out: HardcodedSecret[] = [];
-  let holder: string | null = null;
+  let holder: string | null = fileHolder;
   let heredoc: string | null = null;
   let inComment = false;
   const lines = hcl.split("\n");
@@ -132,12 +225,30 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
       continue;
     }
     if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
-    const header = HEADER.exec(line);
+    // a comment opened mid-line hides the lines after it; this line's code still counts
+    if (opensBlockComment(line)) inComment = true;
+    const header = fileHolder === null ? HEADER.exec(line) : null;
     if (header) {
       holder = `${header[1]}${(header[2] as string).trimEnd() ? ` ${(header[2] as string).trim()}` : ""}`;
+      // a block written on one line, `resource "a" "b" { password = "…" }`, carries its body
+      const rest = header[3] as string;
+      const opens = HEREDOC.exec(rest);
+      if (opens) heredoc = opens[1] as string;
+      if (!holder.startsWith("output ") && !holder.startsWith("terraform")) {
+        for (const pair of rest.matchAll(INLINE_PAIR)) {
+          const key = (pair[1] ?? pair[2]) as string;
+          const isVariable = holder.startsWith("variable ");
+          if (isVariable && key !== "default") continue;
+          const name = isVariable ? variableName(holder) : key;
+          if (isSecretName(name) && literalValue(name, pair[3] as string)) {
+            out.push({ name, holder, line: i + 1 });
+          }
+        }
+      }
+      if (closesOnLine(rest)) holder = null;
       continue;
     }
-    if (line.startsWith("}")) {
+    if (fileHolder === null && line.startsWith("}")) {
       holder = null;
       continue;
     }
@@ -150,21 +261,21 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
     const value = m[3] as string;
     if (holder.startsWith("variable ")) {
       // a variable's literal is its default, and the variable's name says what it holds
-      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
-      if (name === "default" && isSecretName(variable) && literalValue(value)) {
+      const variable = variableName(holder);
+      if (name === "default" && isSecretName(variable) && literalValue(variable, value)) {
         out.push({ name: variable, holder, line: i + 1 });
       }
       continue;
     }
     if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
-    if (isSecretName(name) && literalValue(value)) {
+    if (isSecretName(name) && literalValue(name, value)) {
       out.push({ name, holder, line: i + 1 });
       continue;
     }
     // an object written on one line holds its own pairs: `{ "DB_PASSWORD" = "…" }`
     for (const pair of value.matchAll(INLINE_PAIR)) {
       const key = (pair[1] ?? pair[2]) as string;
-      if (isSecretName(key) && literalValue(pair[3] as string)) {
+      if (isSecretName(key) && literalValue(key, pair[3] as string)) {
         out.push({ name: key, holder, line: i + 1 });
       }
     }
@@ -172,11 +283,21 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
   return out;
 }
 
-/** Scan an already-read tree into native concerns. Pure; no I/O of its own. */
-export function scanHardcodedSecrets(files: readonly SourceFile[]): Concern[] {
+/**
+ * Scan an already-read tree into native concerns. Pure; no I/O of its own.
+ * `tfvarsFiles` are the `.tfvars` inputs, read as assignments rather than blocks.
+ */
+export function scanHardcodedSecrets(
+  files: readonly SourceFile[],
+  tfvarsFiles: readonly SourceFile[] = [],
+): Concern[] {
   const concerns: Concern[] = [];
-  for (const { path, hcl } of files) {
-    for (const hit of findHardcodedSecrets(hcl)) {
+  const hits = [
+    ...files.map((f) => ({ path: f.path, found: findHardcodedSecrets(f.hcl) })),
+    ...tfvarsFiles.map((f) => ({ path: f.path, found: findTfvarsSecrets(f.hcl, f.path) })),
+  ];
+  for (const { path, found } of hits) {
+    for (const hit of found) {
       concerns.push(
         buildConcern({
           source: NATIVE_SOURCE,

package/src/mcp/terraform/nativeRuleScanners.ts

@@ -131,7 +131,8 @@ export const NATIVE_RULE_SCANNERS: readonly NativeRuleScanner[] = [
     name: "hardcoded-secrets",
     rules: [HARDCODED_SECRET_ARGUMENT],
     // Per file: the argument's name and its literal are both on the line itself.
-    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) }),
+    // The only rule that reads `.tfvars`: an input file holds values, not config.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files, ctx.tfvarsFiles) }),
   },
   {
     name: "write-only",

package/src/mcp/terraform/nativeScan.ts

@@ -26,6 +26,7 @@ import {
   describeOversize,
   describeTruncation,
   readTfTree,
+  readTfvarsTree,
   readTofuTree,
   type SourceTree,
 } from "#app/mcp/terraform/tree";
@@ -74,6 +75,9 @@ export function scanNative(cwd: string, opts: NativeScanOptions = {}): ScannerOu
     // walk over a suffix most repos do not use at all, and threading it through
     // the context keeps the scanners uniform.
     tofuFiles: readTofuTree(cwd).files,
+    // likewise only for the hardcoded-secret rule: a value kept out of the `.tf`
+    // source is most often committed here instead
+    tfvarsFiles: readTfvarsTree(cwd).files,
     truncated: tree.truncated,
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? DEFAULT_REPEAT_THRESHOLD,
   });

package/src/mcp/terraform/refactor/equivalence.ts

@@ -31,14 +31,17 @@ import { describeMissingMoves, type PairAnalysis } from "#app/mcp/terraform/plan
 import {
   instanceKeysOf,
   isModuleAddress,
+  moduleHops,
   normaliseAddress,
   qualify,
   stripIndices,
+  stripModuleHops,
 } from "#app/mcp/terraform/refactor/addresses";
 import { type MovedBlock, moveId } from "#app/mcp/terraform/refactor/movedBlocks";
 import {
   describeMultiplicity,
   enumerateInstanceKeys,
+  type Multiplicity,
   type ResourceRef,
   sameMultiplicity,
   sameMultiplicityLevels,
@@ -384,10 +387,11 @@ function correspond(
  * than sending a correct refactor away for a plan it does not need.
  *
  * Abstains (null) on anything it cannot read exactly: a chain of more than one
- * repetition, an expression that is not a literal collection, or a declared block
- * that names no single instance. Extra blocks naming keys the collection does not
- * contain are NOT an error — a `moved` block whose source never existed is a
- * no-op, and a mistyped key shows up as the missing one it left behind.
+ * repetition, an expression that is not a literal collection, a declared block
+ * that names no single instance, or one whose key level cannot be located.
+ * Extra blocks naming keys the collection does not contain are NOT an error — a
+ * `moved` block whose source never existed is a no-op, and a mistyped key shows
+ * up as the missing one it left behind.
  */
 function uncoveredInstanceKeys(p: Pairing): string[] | null {
   const level = p.before.multiplicity;
@@ -400,25 +404,54 @@ function uncoveredInstanceKeys(p: Pairing): string[] | null {
   // is their exact spelling.
   const kind = level[0].kind;
   const written = (k: string) => (kind === "count" ? k : `"${k}"`);
+  const fromAt = level[0].at;
+  const toAt = p.after.multiplicity[0]?.at;
+  if (fromAt === undefined || toAt === undefined) return null;
   const declared = new Set<string>();
   for (const blk of p.blocks) {
+    // a chain hop or a module-level block names an address neither tree
+    // attributes, so where its repetition sits is unknown
+    if (
+      stripIndices(normaliseAddress(blk.from)) !== p.before.address ||
+      stripIndices(normaliseAddress(blk.to)) !== p.after.address
+    )
+      return null;
     // A relevelling repeats BOTH sides, at different levels: the instance is
     // `aws_s3_bucket.data["logs"]` before and `module.data["logs"].…` after, so a
-    // block covers it only when each side names that same key. A key on one side
-    // alone (`aws_s3_bucket.data["logs"]` → `module.data.aws_s3_bucket.this`)
-    // points at an address the repetition no longer has, and Terraform plans it
-    // as a destroy and a create.
+    // block covers it only when each side names that same key, at the level that
+    // side repeats. A key on one side alone (`aws_s3_bucket.data["logs"]` →
+    // `module.data.aws_s3_bucket.this`), or on the wrong level
+    // (`module.data.aws_s3_bucket.this["logs"]`), points at an address the
+    // repetition does not have, and Terraform plans it as a destroy and a create.
     const from = instanceKeysOf(blk.from);
     const to = instanceKeysOf(blk.to);
     // more than one key per side is a chain this proof does not read; no key on
     // either side names no single instance
     if (from.length > 1 || to.length > 1) return null;
     if (from.length === 0 && to.length === 0) return null;
-    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared.add(from[0] as string);
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) continue;
+    const fromPlaced = keyAtLevel(blk.from, fromAt);
+    const toPlaced = keyAtLevel(blk.to, toAt);
+    // a side on the wrong level covers nothing, whatever the other side says
+    if (fromPlaced === false || toPlaced === false) continue;
+    if (fromPlaced === null || toPlaced === null) return null;
+    declared.add(from[0] as string);
   }
   return expected.filter((k) => !declared.has(written(k)));
 }
 
+/**
+ * Whether the one instance key `address` writes sits on the level `at` that
+ * repeats, or null when that level cannot be located: a module repetition on a
+ * path through several calls is on one of them, and the chain does not say which.
+ */
+function keyAtLevel(address: string, at: NonNullable<Multiplicity["at"]>): boolean | null {
+  const onResource = instanceKeysOf(stripModuleHops(normaliseAddress(address))).length > 0;
+  if (at === "resource") return onResource;
+  if (onResource) return false;
+  return moduleHops(address).length === 1 ? true : null;
+}
+
 /**
  * Compute the keys-free equivalence verdict from the before/after resource
  * address sets and the `moved {}` blocks present in the after tree. Validate/fmt