infraweaver 0.3.7 → 0.3.9

package/src/mcp/terraform/refactor/substitution.ts

@@ -1,13 +1,12 @@
 /**
- * The VALUE half of a refactor proof: did each relocated argument keep the value
- * it had?
+ * The VALUE half of a refactor proof: does every resource the change touches
+ * still say what it said?
  *
  * [[equivalence]] compares argument NAMES and never values, for a good reason —
- * the names are what survives being moved behind a module boundary, and a static
- * read cannot evaluate an expression. That reading is exactly right for a b.3
- * extraction whose arguments move verbatim. It is a HOLE the moment the refactor
- * PARAMETERISES those arguments, which is what consolidating N environments onto
- * one shared module does to every value that differs between them:
+ * the names are what survives being moved behind a module boundary. On its own
+ * that is a hole wherever the change PARAMETERISES a value, which is what
+ * consolidating N environments onto one shared module does to every value that
+ * differs between them:
  *
  *   before   env/dev/main.tf    bucket = "acme-dev-logs"
  *            env/prod/main.tf   bucket = "acme-prod-logs"
@@ -15,114 +14,112 @@
  *            env/dev/main.tf    module "logging" { bucket = "acme-prod-logs" }   ← swapped
  *            env/prod/main.tf   module "logging" { bucket = "acme-dev-logs"  }   ← swapped
  *
- * Every existing gate passes that tree. The resource set is identical, the
- * argument names are identical, the `moved {}` blocks are complete, `terraform
- * validate` is clean, and — because both roots still declare exactly one bucket
- * each — so is a plan. The apply destroys prod.
+ * Every name-level gate passes that tree, and so does a plan. The apply
+ * destroys prod. The same hole has other doors: a shared module whose body was
+ * edited on the way (every caller changes, moved or not), a nested block whose
+ * value now comes from a call input, a `dynamic` block fed one rule fewer, a
+ * data source the moved resource reads.
  *
- * WHAT THIS DOES, AND ONLY THIS. For an argument whose after-value is a single
- * bare `var.<X>`, it follows `X` back UP the call chain to the value written at
- * the call site, and compares that against the before-value as TEXT. Both sides
- * are then expressions in the SAME root's scope, so `var.bucket_name` on one
- * side and `var.bucket_name` on the other really are the same value — which is
- * why the walk stops the moment it reaches the root and never tries to resolve a
- * root variable further. Nothing is evaluated, here or anywhere else in the
- * proof.
+ * WHAT THIS DOES. Every resource present on both sides — matched through the
+ * relocations — is read into VALUES ([[expressions]]) and compared. A value is
+ * followed, never run: `var.x` back up the call chain to what the call site
+ * wrote (or the module's default), `local.x` to its definition, `module.m.o` to
+ * the output's expression, a `data` source to its body, a reference to another
+ * resource to that resource's identity (through the relocations, so
+ * `aws_s3_bucket.data.id` in the root and `aws_s3_bucket.this.id` in the module
+ * are the same value). A `dynamic` block is expanded when its `for_each`
+ * resolves to a literal collection; a conditional is folded when its condition
+ * does; a template whose parts are all literals is joined. Nothing else is
+ * evaluated — a function call or an operator is compared only as "the same
+ * code over the same values".
  *
- * AND WHAT IT REFUSES TO SAY. `null` is NOT CHECKED and is used freely: an
- * after-value that is not a bare `var.<X>`, an input the call site does not set
- * and the module does not default, a module whose directory does not resolve. A
- * mismatch is only ever reported when both sides were actually read — the trade
- * is missed instances, never false ones.
+ * AND WHAT IT REFUSES TO SAY. A comparison has three outcomes: equal, CHANGED,
+ * or NOT CHECKED. CHANGED is reported only when the difference is established
+ * — two literals that differ, a collection of a different length, a field one
+ * side lacks, a block that has no counterpart at all. Anything that would need
+ * evaluating is NOT CHECKED. The trade is missed instances, never false ones.
+ *
+ * Root-scoped values are never resolved further: `var.x` in a root means
+ * whatever tfvars says on both sides, so it is equal to itself and to nothing
+ * else.
  *
  * Pure: two already-read trees and the relocations in, findings out.
  */
 
 import { posix } from "node:path";
-import { isStringLiteral, parseBlocks, topLevelEntries } from "#app/mcp/terraform/hcl";
-import { addressKey, moduleHops, normaliseAddress } from "#app/mcp/terraform/refactor/addresses";
+import { matchBraceBody, parseBlocks, topLevelEntries } from "#app/mcp/terraform/hcl";
+import { moduleHops, normaliseAddress, stripIndices } from "#app/mcp/terraform/refactor/addresses";
+import { type Expr, parseExpression, type Step } from "#app/mcp/terraform/refactor/expressions";
 import type { MovedBlock } from "#app/mcp/terraform/refactor/movedBlocks";
 import type { SourceFile } from "#app/mcp/terraform/tree";
 
 interface ValueSubstitution {
-  /** the root the relocation happened in. */
+  /** the root module the resource belongs to. */
   root: string;
   /** the BEFORE address, as `expected_moves` spells it. */
   resource: string;
+  /** the argument, with a path into nested blocks: `versioning_configuration[0].status`. */
   argument: string;
-  /** the value the argument had before the refactor, in the root's scope. */
+  /** the value as the before tree writes it. */
   before: string;
-  /** the value written on the relocated resource — typically `var.<X>`. */
+  /** the value as the after tree writes it — often `var.<x>`. */
   after: string;
-  /** what `after` resolves to AT THE CALL SITE, i.e. back in the root's scope.
-   *  `null` means NOT CHECKED — see `not_checked` for which case. */
+  /** what `after` resolves to, followed back to the root's scope. `null` when
+   *  the comparison was NOT CHECKED. */
   after_resolved: string | null;
-  /** `true`/`false` only when both sides were read; `null` = NOT CHECKED. */
+  /** `true`/`false` only when the comparison settled; `null` = NOT CHECKED. */
   match: boolean | null;
-  /** why this argument was not checked, or null when it was. */
+  /** why this value was not checked, or null when it was. */
   not_checked: string | null;
 }
 
 export interface SubstitutionResult {
-  /** every argument considered, checked or not. `null` means the question did
-   *  not arise: no relocation put a resource inside a module call, so there was
-   *  no parameter substitution to verify. Distinct from `[]`, which means
-   *  relocations were examined and none had a comparable argument. */
+  /** every value compared on a RELOCATED resource, plus every established
+   *  change anywhere. `null` means the question did not arise: nothing moved
+   *  and nothing changed. */
   value_substitutions: ValueSubstitution[] | null;
-  /** the established mismatches — the subset with `match: false`. A non-empty
+  /** the established changes — the subset with `match: false`. A non-empty
    *  list is a violation, not a warning. */
   value_mismatches: ValueSubstitution[];
+  /** calls of a module this tree does not contain — a registry module, a git
+   *  module nothing fetched — whose `source` or `version` changed. The code the
+   *  resources come from was swapped outside the tree, so no comparison here
+   *  can say what changed: never a proof, in either direction. */
+  opaque_module_changes: { root: string; call: string; before: string; after: string }[];
   reasons: string[];
 }
 
-const NOT_APPLICABLE: SubstitutionResult = {
-  value_substitutions: null,
-  value_mismatches: [],
-  reasons: [],
-};
-
-/** whitespace-normalised comparison text. Two spellings of one value read as
- *  equal; two different values never do. Never evaluated. */
-function normaliseValue(value: string): string {
-  return value.trim().replace(/\s+/g, " ");
-}
-
-/** a single bare `var.<name>` and nothing else — the one substitution shape this
- *  check follows. `"${var.x}-suffix"` deliberately does not match: resolving it
- *  would mean evaluating a template. */
-const BARE_VAR = /^var\.([A-Za-z_][A-Za-z0-9_-]*)$/;
-
 // --- the tree, indexed by directory ------------------------------------------
 
-interface ModuleCallIndex {
+interface ModuleCall {
   /** repo-relative posix dir the source resolves to, or null when it does not
    *  resolve (a registry module, or a git module nothing fetched). */
   dir: string | null;
-  /** input name → raw value, whitespace-normalised. */
+  body: string;
+  /** input name → raw value. */
   inputs: Map<string, string>;
 }
 
 interface DirIndex {
-  /** `<type>.<name>` → argument → raw value. */
-  resources: Map<string, Map<string, string>>;
-  /** call name → the call. */
-  calls: Map<string, ModuleCallIndex>;
-  /** variable name → its `default`, or null when it declares none. */
+  /** `<type>.<name>` → block body. */
+  resources: Map<string, string>;
+  /** `<type>.<name>` → block body. */
+  data: Map<string, string>;
+  calls: Map<string, ModuleCall>;
+  /** variable name → its raw `default`, or null when it declares none. */
   variables: Map<string, string | null>;
+  locals: Map<string, string>;
+  /** output name → its raw `value`. */
+  outputs: Map<string, string>;
 }
 
-function emptyDir(): DirIndex {
-  return { resources: new Map(), calls: new Map(), variables: new Map() };
-}
-
-/** raw top-level attribute values of a block body, whitespace-normalised.
- *  Nested blocks and `dynamic` blocks have no single value to compare and are
- *  skipped; so is a value that did not parse to a close. */
-function attributeValues(body: string): Map<string, string> {
+/** complete top-level attributes of a block body, raw. */
+function attributes(body: string): Map<string, string> {
   const out = new Map<string, string>();
   for (const entry of topLevelEntries(body)) {
-    if (entry.kind !== "attr" || entry.value === null || !entry.complete) continue;
-    out.set(entry.name, normaliseValue(entry.value));
+    if (entry.kind === "attr" && entry.value !== null && entry.complete) {
+      out.set(entry.name, entry.value);
+    }
   }
   return out;
 }
@@ -136,130 +133,691 @@ function callTargetDir(
   source: string | undefined,
   fetchedBySource: Map<string, string> | undefined,
 ): string | null {
-  if (source === undefined) return null;
-  const literal = isStringLiteral(source) ? source.slice(1, -1) : null;
-  if (literal === null) return null;
+  const parsed = source === undefined ? null : parseExpression(source);
+  if (parsed?.kind !== "literal" || typeof parsed.value !== "string") return null;
+  const literal = parsed.value;
   if (literal.startsWith("./") || literal.startsWith("../")) {
     return posix.normalize(posix.join(callerDir, literal)).replace(/\/+$/, "");
   }
   return fetchedBySource?.get(literal) ?? null;
 }
 
+type Tree = Map<string, DirIndex>;
+
 function indexTree(
   files: readonly SourceFile[],
   fetchedBySource: Map<string, string> | undefined,
-): Map<string, DirIndex> {
-  const byDir = new Map<string, DirIndex>();
+): Tree {
+  const byDir: Tree = new Map();
   for (const file of files) {
     const dir = posix.dirname(file.path);
     let index = byDir.get(dir);
     if (!index) {
-      index = emptyDir();
+      index = {
+        resources: new Map(),
+        data: new Map(),
+        calls: new Map(),
+        variables: new Map(),
+        locals: new Map(),
+        outputs: new Map(),
+      };
       byDir.set(dir, index);
     }
-    for (const block of parseBlocks(file.hcl, ["resource", "module", "variable"])) {
-      if (block.keyword === "resource") {
-        const [type, name] = block.labels;
-        if (!type || !name) continue;
-        index.resources.set(`${type}.${name}`, attributeValues(block.body));
-        continue;
-      }
-      if (block.keyword === "module") {
-        const [name] = block.labels;
-        if (!name) continue;
-        const inputs = attributeValues(block.body);
-        index.calls.set(name, {
-          dir: callTargetDir(dir, inputs.get("source"), fetchedBySource),
-          inputs,
-        });
-        continue;
+    const blocks = parseBlocks(file.hcl, [
+      "resource",
+      "data",
+      "module",
+      "variable",
+      "locals",
+      "output",
+    ]);
+    for (const block of blocks) {
+      const [first, second] = block.labels;
+      switch (block.keyword) {
+        case "resource":
+        case "data":
+          if (first && second) {
+            (block.keyword === "data" ? index.data : index.resources).set(
+              `${first}.${second}`,
+              block.body,
+            );
+          }
+          break;
+        case "module":
+          if (first) {
+            const inputs = attributes(block.body);
+            index.calls.set(first, {
+              dir: callTargetDir(dir, inputs.get("source"), fetchedBySource),
+              body: block.body,
+              inputs,
+            });
+          }
+          break;
+        case "variable":
+          if (first) index.variables.set(first, attributes(block.body).get("default") ?? null);
+          break;
+        case "locals":
+          for (const [name, value] of attributes(block.body)) index.locals.set(name, value);
+          break;
+        case "output": {
+          const value = first ? attributes(block.body).get("value") : undefined;
+          if (first && value !== undefined) index.outputs.set(first, value);
+          break;
+        }
       }
-      const [name] = block.labels;
-      if (!name) continue;
-      index.variables.set(name, attributeValues(block.body).get("default") ?? null);
     }
   }
   return byDir;
 }
 
-/** walk a chain of module call names from `root`, returning the directory each
- *  level lives in — index 0 is the root itself. Stops (returns null) at the
- *  first hop that does not resolve. */
-function chainDirs(
-  tree: ReadonlyMap<string, DirIndex>,
-  root: string,
-  hops: readonly string[],
-): string[] | null {
-  const dirs = [root];
-  for (const hop of hops) {
-    const call = tree.get(dirs[dirs.length - 1] as string)?.calls.get(hop);
-    if (!call?.dir) return null;
-    dirs.push(call.dir);
+// --- values ------------------------------------------------------------------
+
+type Value =
+  | { k: "const"; v: string | number | boolean | null }
+  | { k: "tuple"; items: Value[] }
+  | { k: "object"; entries: Map<string, Value> }
+  /** a value with an identity but no readable content — another resource's
+   *  attribute, a root variable, `each.value`. Equal only to itself. */
+  | { k: "ref"; id: string; text: string }
+  /** a data source: its body, read like a resource, and the attribute taken.
+   *  `label` is for reporting only — two documents with different names and the
+   *  same body are one value. */
+  | { k: "data"; type: string; label: string; body: BlockValue; path: string }
+  /** code over values — a function call, an operator. Equal only to the same
+   *  code over equal values. */
+  | { k: "code"; shape: string; parts: Value[] }
+  | { k: "unread"; why: string };
+
+interface BlockValue {
+  attrs: Map<string, Value>;
+  /** the attributes as written, for reporting. */
+  raw: Map<string, string>;
+  /** block type → its blocks in order; null when a `dynamic` block of that
+   *  type could not be expanded, so the set of blocks is not known. */
+  blocks: Map<string, BlockValue[] | null>;
+}
+
+/** where a `code` value's parts sit in its shape — a character no code holds. */
+const HOLE = "";
+
+const unread = (why: string): Value => ({ k: "unread", why });
+const EVALUATING = "the value cannot be established without evaluating it";
+
+/** a scope-dependent reference, or a splat, still sitting in code text after
+ *  the traversals were lifted out of it. */
+const UNLIFTED_REFERENCE = /(?<![\w.])(?:var|local|module|data|each|count)\.|\[\s*\*\s*\]|\.\*/;
+
+interface Scope {
+  tree: Tree;
+  root: string;
+  /** the directory of each level, the root first. */
+  dirs: string[];
+  /** the call name of each module level. */
+  hops: string[];
+  /** BEFORE tree only: where a resource address went, so references to it name
+   *  the same identity on both sides. */
+  rename?: (root: string, address: string) => string;
+  /** iterator names bound by an enclosing `dynamic` block. */
+  bindings: Map<string, Value>;
+  depth: number;
+}
+
+/** a chain this deep is a reference cycle, not a configuration. */
+const MAX_DEPTH = 48;
+
+function prefixOf(hops: readonly string[]): string {
+  return hops.map((h) => `module.${h}.`).join("");
+}
+
+function render(v: Value): string {
+  switch (v.k) {
+    case "const":
+      return typeof v.v === "string" ? `"${v.v}"` : String(v.v);
+    case "tuple":
+      return `[${v.items.map(render).join(", ")}]`;
+    case "object":
+      return `{ ${[...v.entries].map(([k, x]) => `${k} = ${render(x)}`).join(", ")} }`;
+    case "ref":
+      return v.text;
+    case "data":
+      return `data.${v.type}.${v.label}${v.path}`;
+    case "code": {
+      return v.shape
+        .split(HOLE)
+        .map((text, i) => (i === 0 ? text : `${render(v.parts[i - 1] ?? unread(""))}${text}`))
+        .join("");
+    }
+    case "unread":
+      return "(not read)";
   }
-  return dirs;
 }
 
-/**
- * Resolve a module variable back to the expression written for it in the ROOT.
- *
- * Walks the call chain outward, one level per iteration. At each level the value
- * comes from the call site's own input; when the call site is the root, that
- * expression IS the root-scoped answer and the walk stops — resolving a root
- * `var.x` further would mean guessing at `terraform.tfvars`, a `-var` flag or an
- * environment variable, none of which the tree carries. An input the call site
- * omits falls back to the module's own `default`, which Terraform requires to be
- * a constant, so it needs no scope.
- *
- * Only a bare `var.<x>` continues the walk past an intermediate level: every
- * other expression there belongs to that module's scope and cannot be compared
- * with a root-scoped value at all.
- */
-function resolveToRootScope(
-  tree: ReadonlyMap<string, DirIndex>,
-  dirs: readonly string[],
-  hops: readonly string[],
-  variable: string,
-): { value: string } | { reason: string } {
-  let name = variable;
-  for (let level = dirs.length - 1; level >= 1; level--) {
-    // the call at this level is named by the hop that produced it — looked up by
-    // NAME rather than by target directory, since one root calling the same
-    // module twice has two calls with one dir and different inputs.
-    const call = tree.get(dirs[level - 1] as string)?.calls.get(hops[level - 1] as string);
-    const written = call?.inputs.get(name);
-    if (written === undefined) {
-      const fallback = tree.get(dirs[level] as string)?.variables.get(name);
-      if (fallback === undefined || fallback === null) {
-        return {
-          reason: `the module input \`${name}\` is not set at the call site and the module declares no default`,
-        };
+function renderSteps(steps: readonly Step[], scope: Scope): string {
+  return steps
+    .map((s) => ("attr" in s ? `.${s.attr}` : `[${render(evaluate(s.index, scope))}]`))
+    .join("");
+}
+
+function applySteps(value: Value, steps: readonly Step[], scope: Scope): Value {
+  let v = value;
+  for (const step of steps) {
+    const key: Value = "attr" in step ? { k: "const", v: step.attr } : evaluate(step.index, scope);
+    const label = "attr" in step ? `.${step.attr}` : `[${render(key)}]`;
+    if (v.k === "object" && key.k === "const" && typeof key.v === "string") {
+      v = v.entries.get(key.v) ?? unread(`the field \`${key.v}\` is not set`);
+    } else if (v.k === "tuple" && key.k === "const" && typeof key.v === "number") {
+      v = v.items[key.v] ?? unread(`index ${key.v} is out of range`);
+    } else if (v.k === "ref") {
+      v = { k: "ref", id: `${v.id}${label}`, text: `${v.text}${label}` };
+    } else if (v.k === "data") {
+      v = { ...v, path: `${v.path}${label}` };
+    } else if (v.k === "unread") {
+      return v;
+    } else {
+      v = { k: "code", shape: `${HOLE}${label}`, parts: [v] };
+    }
+  }
+  return v;
+}
+
+function deeper(scope: Scope, patch: Partial<Scope> = {}): Scope {
+  return { ...scope, ...patch, depth: scope.depth + 1 };
+}
+
+/** `var.<name>` at the current level, followed up to the root's scope. */
+function resolveVar(name: string, scope: Scope): Value {
+  const level = scope.dirs.length - 1;
+  if (level === 0) {
+    return { k: "ref", id: `${scope.root}|var.${name}`, text: `var.${name}` };
+  }
+  // looked up by call NAME, not target dir: one root calling the same module
+  // twice has two calls with one dir and different inputs.
+  const call = scope.tree
+    .get(scope.dirs[level - 1] as string)
+    ?.calls.get(scope.hops[level - 1] as string);
+  const written = call?.inputs.get(name);
+  if (written !== undefined) {
+    return evaluate(
+      parseExpression(written),
+      deeper(scope, {
+        dirs: scope.dirs.slice(0, -1),
+        hops: scope.hops.slice(0, -1),
+        bindings: new Map(),
+      }),
+    );
+  }
+  const fallback = scope.tree.get(scope.dirs[level] as string)?.variables.get(name);
+  if (fallback === undefined || fallback === null) {
+    return unread(
+      `the module input \`${name}\` is not set at the call site and the module declares no default`,
+    );
+  }
+  return evaluate(parseExpression(fallback), deeper(scope, { bindings: new Map() }));
+}
+
+function resolveTraversal(t: Expr & { kind: "traversal" }, scope: Scope): Value {
+  const bound = scope.bindings.get(t.root);
+  if (bound) return applySteps(bound, t.steps, scope);
+  const dir = scope.dirs[scope.dirs.length - 1] as string;
+  const index = scope.tree.get(dir);
+  const [first, second] = t.steps;
+  const name = first && "attr" in first ? first.attr : undefined;
+  const leaf = second && "attr" in second ? second.attr : undefined;
+  switch (t.root) {
+    case "var":
+      return name
+        ? applySteps(resolveVar(name, scope), t.steps.slice(1), scope)
+        : unread(EVALUATING);
+    case "local": {
+      const raw = name ? index?.locals.get(name) : undefined;
+      if (raw === undefined) return unread(`\`local.${name}\` is not defined here`);
+      return applySteps(evaluate(parseExpression(raw), deeper(scope)), t.steps.slice(1), scope);
+    }
+    case "data": {
+      const body = name && leaf ? index?.data.get(`${name}.${leaf}`) : undefined;
+      if (body === undefined) return unread(`\`data.${name}.${leaf}\` is not declared here`);
+      return {
+        k: "data",
+        type: name as string,
+        label: leaf as string,
+        body: evaluateBlock(body, deeper(scope)),
+        path: renderSteps(t.steps.slice(2), scope),
+      };
+    }
+    case "module": {
+      const call = name ? index?.calls.get(name) : undefined;
+      const output = call?.dir && leaf ? scope.tree.get(call.dir)?.outputs.get(leaf) : undefined;
+      if (call?.dir && output !== undefined) {
+        const inner = evaluate(
+          parseExpression(output),
+          deeper(scope, {
+            dirs: [...scope.dirs, call.dir],
+            hops: [...scope.hops, name as string],
+            bindings: new Map(),
+          }),
+        );
+        return applySteps(inner, t.steps.slice(2), scope);
+      }
+      const address = `${prefixOf(scope.hops)}module.${name}`;
+      const mapped = scope.rename ? scope.rename(scope.root, address) : address;
+      const rest = renderSteps(t.steps.slice(1), scope);
+      return { k: "ref", id: `${scope.root}|${mapped}${rest}`, text: `module.${name}${rest}` };
+    }
+    case "path":
+      return name === "module"
+        ? { k: "ref", id: `${dir}|path.module`, text: t.text }
+        : { k: "ref", id: t.text, text: t.text };
+    default: {
+      if (name && index?.resources.has(`${t.root}.${name}`)) {
+        const address = `${prefixOf(scope.hops)}${t.root}.${name}`;
+        const mapped = scope.rename ? scope.rename(scope.root, address) : address;
+        const rest = renderSteps(t.steps.slice(1), scope);
+        return { k: "ref", id: `${scope.root}|${mapped}${rest}`, text: t.text };
+      }
+      // `each`, `count`, `self`, a `for` expression's own symbol: the same text
+      // names the same thing on both sides
+      return { k: "ref", id: t.text, text: t.text };
+    }
+  }
+}
+
+function evaluate(expr: Expr, scope: Scope): Value {
+  if (scope.depth > MAX_DEPTH) return unread("the reference chain is too deep to follow");
+  switch (expr.kind) {
+    case "literal":
+      return { k: "const", v: expr.value };
+    case "template": {
+      const parts = expr.parts.map((p) =>
+        typeof p === "string" ? ({ k: "const", v: p } as Value) : evaluate(p, scope),
+      );
+      // `"${x}"` alone is x itself, whatever its type
+      if (expr.parts.length === 1 && typeof expr.parts[0] !== "string") return parts[0] as Value;
+      if (parts.every((p) => p.k === "const" && p.v !== null)) {
+        return { k: "const", v: parts.map((p) => String((p as { v: unknown }).v)).join("") };
       }
-      return { value: fallback };
+      // literal text goes into the shape as written and each interpolation is a
+      // `${…}` hole, so a template still compares part by part and renders as
+      // the template it is — `"${var.env}-boot"`, not `"var.env"-boot""`
+      const holes: Value[] = [];
+      const shape = expr.parts
+        .map((p, i) => {
+          if (typeof p === "string") return p;
+          holes.push(parts[i] as Value);
+          return `\${${HOLE}}`;
+        })
+        .join("");
+      return { k: "code", shape: `"${shape}"`, parts: holes };
     }
-    if (level === 1) return { value: written };
-    // MID-CHAIN, the walk may only continue through another bare `var.<x>`.
-    // Anything else — `"${var.x}"`, `local.y`, a literal-with-suffix — is written
-    // in the scope of an INTERMEDIATE module, not the root's, so returning it
-    // would compare two expressions from different scopes: textually equal ones
-    // would report a false match, and textually different ones a false mismatch.
-    // Both contradict this module's contract, so the chain stops NOT CHECKED.
-    const inner = BARE_VAR.exec(written);
-    if (inner?.[1] === undefined) {
+    case "tuple":
+      return { k: "tuple", items: expr.items.map((x) => evaluate(x, scope)) };
+    case "object":
+      return {
+        k: "object",
+        entries: new Map(expr.entries.map((e) => [e.key, evaluate(e.value, scope)])),
+      };
+    case "conditional": {
+      const cond = evaluate(expr.cond, scope);
+      if (cond.k === "const" && typeof cond.v === "boolean") {
+        return evaluate(cond.v ? expr.whenTrue : expr.whenFalse, scope);
+      }
       return {
-        reason:
-          `the input \`${name}\` is set to \`${written}\` at an intermediate module call, whose scope ` +
-          "is not the root's — resolving it further would mean evaluating it",
+        k: "code",
+        shape: `${HOLE} ? ${HOLE} : ${HOLE}`,
+        parts: [cond, evaluate(expr.whenTrue, scope), evaluate(expr.whenFalse, scope)],
       };
     }
-    name = inner[1];
+    case "traversal":
+      return resolveTraversal(expr, scope);
+    case "raw": {
+      // a reference left in the code text — under a splat or a unary minus,
+      // which the lifting does not follow — names something different in a
+      // different module, so identical text proves nothing about its value
+      if (expr.parts.some((p) => typeof p === "string" && UNLIFTED_REFERENCE.test(p))) {
+        return unread(
+          "the expression reads a value through a splat or an operator this check does not follow",
+        );
+      }
+      const parts: Value[] = [];
+      const shape = expr.parts
+        .map((p) => {
+          if (typeof p === "string") return p;
+          parts.push(evaluate(p, scope));
+          return HOLE;
+        })
+        .join("")
+        .replace(/\s+/g, " ")
+        .trim();
+      return { k: "code", shape, parts };
+    }
+    case "opaque":
+      return unread(EVALUATING);
+  }
+}
+
+/** a `dynamic` block's generated blocks, or null when `for_each` is not a
+ *  literal collection once followed. */
+function expandDynamic(label: string, body: string, scope: Scope): BlockValue[] | null {
+  const entries = topLevelEntries(body);
+  const forEach = entries.find((e) => e.kind === "attr" && e.name === "for_each")?.value;
+  const iterator = entries.find((e) => e.kind === "attr" && e.name === "iterator")?.value?.trim();
+  const content = entries.find((e) => e.kind === "block" && e.name === "content")?.value;
+  if (!forEach || content === null || content === undefined) return null;
+  const collection = evaluate(parseExpression(forEach), scope);
+  let elements: [Value, Value][];
+  if (collection.k === "tuple") {
+    elements = collection.items.map((v, i) => [{ k: "const", v: i }, v]);
+  } else if (collection.k === "object") {
+    // a map is iterated in key order
+    elements = [...collection.entries]
+      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+      .map(([key, v]) => [{ k: "const", v: key }, v]);
+  } else {
+    return null;
+  }
+  const name = iterator && /^[A-Za-z_][A-Za-z0-9_-]*$/.test(iterator) ? iterator : label;
+  return elements.map(([key, value]) =>
+    evaluateBlock(
+      content,
+      deeper(scope, {
+        bindings: new Map([
+          ...scope.bindings,
+          [
+            name,
+            {
+              k: "object",
+              entries: new Map([
+                ["key", key],
+                ["value", value],
+              ]),
+            },
+          ],
+        ]),
+      }),
+    ),
+  );
+}
+
+/** the body of the `dynamic "<label>"` block whose header is on `bodyLine`. */
+function dynamicBody(body: string, label: string, bodyLine: number): string | null {
+  let at = 0;
+  for (let line = 1; line < bodyLine && at !== -1; line++) at = body.indexOf("\n", at) + 1;
+  const header = body.indexOf(`"${label}"`, at);
+  const open = header === -1 ? -1 : body.indexOf("{", header);
+  return matchBraceBody(body, open)?.text ?? null;
+}
+
+function evaluateBlock(body: string, scope: Scope): BlockValue {
+  const block: BlockValue = { attrs: new Map(), raw: new Map(), blocks: new Map() };
+  const add = (type: string, generated: BlockValue[] | null) => {
+    const have = block.blocks.get(type);
+    if (have === null) return;
+    block.blocks.set(type, generated === null ? null : [...(have ?? []), ...generated]);
+  };
+  for (const entry of topLevelEntries(body)) {
+    if (entry.kind === "attr") {
+      block.raw.set(entry.name, (entry.value ?? "").replace(/\s+/g, " "));
+      block.attrs.set(
+        entry.name,
+        entry.value !== null && entry.complete
+          ? evaluate(parseExpression(entry.value), scope)
+          : unread("the value did not parse"),
+      );
+    } else if (entry.kind === "block") {
+      add(entry.name, [evaluateBlock(entry.value ?? "", scope)]);
+    } else {
+      const inner = dynamicBody(body, entry.name, entry.bodyLine);
+      add(entry.name, inner === null ? null : expandDynamic(entry.name, inner, scope));
+    }
+  }
+  return block;
+}
+
+// --- comparison --------------------------------------------------------------
+
+type Verdict = "equal" | "changed" | "unknown";
+
+function combine(verdicts: Iterable<Verdict>): Verdict {
+  let all: Verdict = "equal";
+  for (const v of verdicts) {
+    if (v === "changed") return "changed";
+    if (v === "unknown") all = "unknown";
+  }
+  return all;
+}
+
+const STRUCTURED = new Set(["const", "tuple", "object"]);
+
+function compareValues(a: Value, b: Value): Verdict {
+  if (a.k === "const" && b.k === "const") {
+    if (a.v === b.v) return "equal";
+    if (typeof a.v === typeof b.v || a.v === null || b.v === null) return "changed";
+    // `443` and `"443"` may convert to one another
+    return "unknown";
+  }
+  if (a.k === "tuple" && b.k === "tuple") {
+    if (a.items.length !== b.items.length) return "changed";
+    return combine(a.items.map((x, i) => compareValues(x, b.items[i] as Value)));
+  }
+  if (a.k === "object" && b.k === "object") {
+    const keys = new Set([...a.entries.keys(), ...b.entries.keys()]);
+    if ([...keys].some((k) => !a.entries.has(k) || !b.entries.has(k))) return "changed";
+    return combine(
+      [...keys].map((k) => compareValues(a.entries.get(k) as Value, b.entries.get(k) as Value)),
+    );
+  }
+  if (a.k === "ref" && b.k === "ref") return a.id === b.id ? "equal" : "unknown";
+  if (a.k === "data" && b.k === "data") {
+    if (a.type !== b.type || a.path !== b.path) return "unknown";
+    return compareBlocks(a.body, b.body, "", null);
+  }
+  if (a.k === "code" && b.k === "code") {
+    if (a.shape !== b.shape || a.parts.length !== b.parts.length) return "unknown";
+    return combine(a.parts.map((x, i) => compareValues(x, b.parts[i] as Value))) === "equal"
+      ? "equal"
+      : "unknown";
+  }
+  // a string where there was a list: no conversion makes those one value
+  if (STRUCTURED.has(a.k) && STRUCTURED.has(b.k)) return "changed";
+  return "unknown";
+}
+
+interface Finding {
+  argument: string;
+  before: string;
+  after: string;
+  after_resolved: string;
+  verdict: Verdict;
+  why: string | null;
+}
+
+/** the meta-arguments of a resource: compared by the multiplicity, provider and
+ *  dependency checks, not here. */
+const META = new Set(["count", "for_each", "provider", "depends_on"]);
+/** a module call's own: its identity, not its inputs. A version bump is the
+ *  version guard's question. */
+const CALL_META = new Set([...META, "source", "version", "providers"]);
+
+function whyNot(a: Value | undefined, b: Value | undefined): string {
+  if (a?.k === "unread") return a.why;
+  if (b?.k === "unread") return b.why;
+  return EVALUATING;
+}
+
+function compareBlocks(
+  before: BlockValue,
+  after: BlockValue,
+  path: string,
+  out: Finding[] | null,
+  meta: ReadonlySet<string> | null = null,
+): Verdict {
+  const verdicts: Verdict[] = [];
+  const record = (f: Finding) => {
+    verdicts.push(f.verdict);
+    out?.push(f);
+  };
+  const names = [...new Set([...before.attrs.keys(), ...after.attrs.keys()])].sort();
+  for (const name of names) {
+    if (meta?.has(name)) continue;
+    const b = before.attrs.get(name);
+    const a = after.attrs.get(name);
+    if (!b || !a) {
+      // at the top level a one-sided argument is argument DRIFT, which
+      // `arg_names_equivalent` already reports; nested, nothing else sees it,
+      // but the provider's default may equal what was written
+      if (meta) continue;
+      record({
+        argument: `${path}${name}`,
+        before: before.raw.get(name) ?? "(not set)",
+        after: after.raw.get(name) ?? "(not set)",
+        after_resolved: a ? render(a) : "(not set)",
+        verdict: "unknown",
+        why: "set on one side only, and the provider's default is not known here",
+      });
+      continue;
+    }
+    const verdict = compareValues(b, a);
+    record({
+      argument: `${path}${name}`,
+      before: before.raw.get(name) ?? render(b),
+      after: after.raw.get(name) ?? render(a),
+      after_resolved: render(a),
+      verdict,
+      why: verdict === "unknown" ? whyNot(b, a) : null,
+    });
+  }
+  const types = [...new Set([...before.blocks.keys(), ...after.blocks.keys()])].sort();
+  for (const type of types) {
+    const bs = before.blocks.has(type) ? (before.blocks.get(type) ?? null) : [];
+    const as = after.blocks.has(type) ? (after.blocks.get(type) ?? null) : [];
+    const argument = `${path}${type}`;
+    if (bs === null || as === null) {
+      record({
+        argument,
+        before: bs === null ? "dynamic" : `${bs.length} block(s)`,
+        after: as === null ? "dynamic" : `${as.length} block(s)`,
+        after_resolved: as === null ? "dynamic" : `${as.length} block(s)`,
+        verdict: "unknown",
+        why: "a `dynamic` block whose `for_each` is not a literal collection once followed",
+      });
+      continue;
+    }
+    if (bs.length !== as.length) {
+      record({
+        argument,
+        before: `${bs.length} block(s)`,
+        after: `${as.length} block(s)`,
+        after_resolved: `${as.length} block(s)`,
+        verdict: "changed",
+        why: null,
+      });
+      continue;
+    }
+    const inOrder = bs.map((b, i) => compareBlocks(b, as[i] as BlockValue, "", null));
+    if (inOrder.every((v) => v === "equal")) {
+      bs.forEach((b, i) => {
+        compareBlocks(b, as[i] as BlockValue, `${argument}[${i}].`, out);
+      });
+      verdicts.push("equal");
+      continue;
+    }
+    // one block with no counterpart that could be equal is an established
+    // change, whatever the order means for this block type
+    const orphan = bs.some((b) => as.every((a) => compareBlocks(b, a, "", null) === "changed"));
+    if (orphan) {
+      bs.forEach((b, i) => {
+        if (inOrder[i] !== "equal")
+          compareBlocks(b, as[i] as BlockValue, `${argument}[${i}].`, out);
+      });
+      verdicts.push("changed");
+      continue;
+    }
+    record({
+      argument,
+      before: `${bs.length} block(s)`,
+      after: `${as.length} block(s)`,
+      after_resolved: `${as.length} block(s)`,
+      verdict: "unknown",
+      why: inOrder.includes("changed")
+        ? "the same blocks in a different order, and whether order matters for this block type is the provider's to say"
+        : EVALUATING,
+    });
   }
-  return { reason: "the relocation crosses no module call" };
+  return combine(verdicts);
+}
+
+// --- what is compared --------------------------------------------------------
+
+interface Instance {
+  root: string;
+  address: string;
+  dirs: string[];
+  hops: string[];
+  body: string;
+  /** a module call nothing in the tree resolves: its inputs are its values. */
+  call: boolean;
 }
 
-// --- the check ----------------------------------------------------------------
+/** a call graph deeper than this is a cycle or past what the proof attributes. */
+const MAX_MODULE_DEPTH = 12;
+
+function instancesOf(tree: Tree, roots: readonly string[]): Map<string, Instance> {
+  const out = new Map<string, Instance>();
+  const visit = (dirs: string[], hops: string[], root: string) => {
+    const dir = dirs[dirs.length - 1] as string;
+    const index = tree.get(dir);
+    if (!index) return;
+    const prefix = prefixOf(hops);
+    for (const [key, body] of index.resources) {
+      const address = `${prefix}${key}`;
+      out.set(`${root}|${address}`, { root, address, dirs, hops, body, call: false });
+    }
+    for (const [name, call] of index.calls) {
+      if (call.dir && tree.has(call.dir)) {
+        if (dirs.includes(call.dir) || dirs.length > MAX_MODULE_DEPTH) continue;
+        visit([...dirs, call.dir], [...hops, name], root);
+        continue;
+      }
+      const address = `${prefix}module.${name}`;
+      out.set(`${root}|${address}`, { root, address, dirs, hops, body: call.body, call: true });
+    }
+  };
+  for (const root of roots) visit([root], [], root);
+  return out;
+}
+
+function rootsOf(tree: Tree, moduleDirs: ReadonlySet<string>): string[] {
+  return [...tree.keys()].filter((d) => !moduleDirs.has(d)).sort();
+}
+
+/** where each before address went, per root — a move of a whole module call
+ *  relocates everything under it. */
+function renamer(moves: readonly MovedBlock[]): (root: string, address: string) => string {
+  const exact = new Map<string, string>();
+  const prefixes: { root: string; from: string; to: string }[] = [];
+  for (const mv of moves) {
+    const root = mv.root === undefined || mv.root === "" ? "." : mv.root;
+    const from = normaliseAddress(mv.from);
+    const to = normaliseAddress(mv.to);
+    exact.set(`${root}|${from}`, to);
+    const base = `${root}|${stripIndices(from)}`;
+    if (!exact.has(base)) exact.set(base, stripIndices(to));
+    if (/^module\.[^.]+$/.test(stripIndices(from)))
+      prefixes.push({ root, from: stripIndices(from), to: stripIndices(to) });
+  }
+  return (root, address) => {
+    const hit = exact.get(`${root}|${address}`);
+    if (hit !== undefined) return hit;
+    for (const p of prefixes) {
+      if (p.root === root && address.startsWith(`${p.from}.`)) {
+        return `${p.to}${address.slice(p.from.length)}`;
+      }
+    }
+    return address;
+  };
+}
 
 /**
- * Verify that every relocated argument's value survived being parameterised.
+ * Compare the values of every resource present on both sides.
  *
  * `moves` is `computeEquivalence`'s `expected_moves` — the authoritative set of
  * relocations, so this check and the proof it augments always speak about the
@@ -271,111 +829,149 @@ export function verifyParameterSubstitution(
   moves: readonly MovedBlock[],
   opts: { fetchedBySource?: Map<string, string> } = {},
 ): SubstitutionResult {
-  // only relocations that put a resource INSIDE a module call parameterise
-  // anything; a rename within one directory moves values verbatim or not at all.
-  const relevant = moves.filter((mv) => moduleHops(mv.to).length > moduleHops(mv.from).length);
-  if (relevant.length === 0) return NOT_APPLICABLE;
-
   const before = indexTree(beforeFiles, opts.fetchedBySource);
   const after = indexTree(afterFiles, opts.fetchedBySource);
+  // a directory either tree instantiates is a module in both — see [[attributePair]]
+  const moduleDirs = new Set<string>();
+  for (const tree of [before, after])
+    for (const index of tree.values())
+      for (const call of index.calls.values()) if (call.dir) moduleDirs.add(call.dir);
+  const rename = renamer(moves);
+  const beforeInstances = instancesOf(before, rootsOf(before, moduleDirs));
+  const afterInstances = instancesOf(after, rootsOf(after, moduleDirs));
 
-  const substitutions: ValueSubstitution[] = [];
-  for (const mv of relevant) {
-    // an unqualified block (a single-root tree, or a hand-built one) acts in the
-    // repo root, which is how `posix.dirname` spells a top-level file's dir.
-    const root = mv.root === undefined || mv.root === "" ? "." : mv.root;
-    const fromAddress = normaliseAddress(mv.from);
-
-    const afterHops = moduleHops(mv.to);
-    const beforeDirs = chainDirs(before, root, moduleHops(fromAddress));
-    const afterDirs = chainDirs(after, root, afterHops);
-    const beforeValues = beforeDirs
-      ? before.get(beforeDirs[beforeDirs.length - 1] as string)?.resources.get(addressKey(mv.from))
-      : undefined;
-    const afterValues = afterDirs
-      ? after.get(afterDirs[afterDirs.length - 1] as string)?.resources.get(addressKey(mv.to))
-      : undefined;
-    if (!beforeValues || !afterValues || !afterDirs) {
-      substitutions.push({
-        root,
-        resource: fromAddress,
-        argument: "*",
-        before: "",
-        after: "",
-        after_resolved: null,
-        match: null,
-        not_checked:
-          "the resource could not be read on one side — its module source did not resolve (a " +
-          "registry module, or a git module nothing fetched), or the block itself was not found there",
-      });
-      continue;
+  const rows: ValueSubstitution[] = [];
+  const opaque: SubstitutionResult["opaque_module_changes"] = [];
+  const compared = new Set<string>();
+  const origin = (i: Instance) => {
+    const inputs = attributes(i.body);
+    const at = inputs.get("version");
+    return `${(inputs.get("source") ?? "").trim()}${at ? ` @ ${at.trim()}` : ""}`;
+  };
+  // a call whose code this tree cannot read that goes away, appears, or is
+  // renamed without a `moved` block destroys or creates everything inside it,
+  // and nothing here can see what that is
+  const reached = new Set<string>();
+  for (const b of beforeInstances.values()) {
+    const target = `${b.root}|${rename(b.root, b.address)}`;
+    reached.add(target);
+    if (b.call && afterInstances.get(target)?.call !== true) {
+      opaque.push({ root: b.root, call: b.address, before: origin(b), after: "(removed)" });
     }
-
-    for (const [argument, afterRaw] of [...afterValues].sort(([a], [b]) =>
-      a < b ? -1 : a > b ? 1 : 0,
-    )) {
-      const beforeRaw = beforeValues.get(argument);
-      // an argument present on only one side is argument DRIFT, which
-      // `arg_names_equivalent` already establishes. Saying it twice, in
-      // different words, would only make the reason list harder to act on.
-      if (beforeRaw === undefined) continue;
-
-      const row = (
-        after_resolved: string | null,
-        match: boolean | null,
-        not_checked: string | null,
-      ): ValueSubstitution => ({
-        root,
-        resource: fromAddress,
-        argument,
-        before: beforeRaw,
-        after: afterRaw,
-        after_resolved,
-        match,
-        not_checked,
-      });
-
-      const bare = BARE_VAR.exec(afterRaw);
-      if (bare?.[1] !== undefined) {
-        const resolved = resolveToRootScope(after, afterDirs, afterHops, bare[1]);
-        if ("reason" in resolved) {
-          substitutions.push(row(null, null, resolved.reason));
-          continue;
-        }
-        substitutions.push(
-          row(resolved.value, normaliseValue(resolved.value) === normaliseValue(beforeRaw), null),
-        );
-        continue;
-      }
-      if (afterRaw === beforeRaw) {
-        // copied verbatim into the module body — no substitution to follow, and
-        // the value demonstrably did not change.
-        substitutions.push(row(afterRaw, true, null));
-        continue;
+  }
+  for (const [key, a] of afterInstances) {
+    if (a.call && !reached.has(key)) {
+      opaque.push({ root: a.root, call: a.address, before: "(absent)", after: origin(a) });
+    }
+  }
+  let relocated = 0;
+  const keys = [...beforeInstances.keys()].sort();
+  for (const key of keys) {
+    const b = beforeInstances.get(key) as Instance;
+    const target = rename(b.root, b.address);
+    const a = afterInstances.get(`${b.root}|${target}`);
+    if (!a || a.call !== b.call) continue;
+    compared.add(`${b.root}|${b.address}`);
+    if (b.call) {
+      if (origin(b) !== origin(a)) {
+        opaque.push({ root: b.root, call: b.address, before: origin(b), after: origin(a) });
       }
-      if (isStringLiteral(beforeRaw) && isStringLiteral(afterRaw)) {
-        // two bare literals that differ is a value change, established without
-        // evaluating anything.
-        substitutions.push(row(afterRaw, false, null));
-        continue;
+    }
+    const scopeOf = (i: Instance, tree: Tree): Scope => ({
+      tree,
+      root: i.root,
+      dirs: i.dirs,
+      hops: i.hops,
+      bindings: new Map(),
+      depth: 0,
+      ...(tree === before ? { rename } : {}),
+    });
+    const findings: Finding[] = [];
+    const beforeBlock = evaluateBlock(b.body, scopeOf(b, before));
+    const afterBlock = evaluateBlock(a.body, scopeOf(a, after));
+    compareBlocks(beforeBlock, afterBlock, "", findings, b.call ? CALL_META : META);
+    // `each.value` and `count.index` read the resource's own repetition, and
+    // the same text means the same value only if that repetition is the same
+    // collection on both sides — `for_each = var.names` names a different one
+    // inside a module than in the root
+    const repetition = combine(
+      ["for_each", "count"].map((name) => {
+        const x = beforeBlock.attrs.get(name);
+        const y = afterBlock.attrs.get(name);
+        if (!x && !y) return "equal";
+        return x && y ? compareValues(x, y) : "unknown";
+      }),
+    );
+    if (repetition !== "equal") {
+      for (const f of findings) {
+        if (f.verdict === "equal" && /(?<![\w.])(?:each|count)\./.test(`${f.before} ${f.after}`)) {
+          f.verdict = "unknown";
+          f.why =
+            "it reads the resource's repetition, which could not be shown to be the same collection on both sides";
+        }
       }
-      substitutions.push(
-        row(
-          null,
-          null,
-          "the relocated value is neither a bare `var.<name>` nor a literal, so what it resolves to cannot be established without evaluating it",
-        ),
-      );
     }
+    const moved = target !== b.address;
+    if (moved) relocated++;
+    for (const f of findings) {
+      // an unmoved resource reports only what CHANGED: listing every value of
+      // every untouched resource would bury the one that matters
+      if (!moved && f.verdict !== "changed") continue;
+      rows.push({
+        root: b.root,
+        resource: b.address,
+        argument: f.argument,
+        before: f.before,
+        after: f.after,
+        after_resolved: f.verdict === "unknown" ? null : f.after_resolved,
+        match: f.verdict === "equal" ? true : f.verdict === "changed" ? false : null,
+        not_checked: f.verdict === "unknown" ? f.why : null,
+      });
+    }
+  }
+
+  // a relocation INTO a module whose content this tree cannot read (a registry
+  // module, a git module nothing fetched) is not compared at all — and says so
+  for (const mv of moves) {
+    if (moduleHops(mv.to).length <= moduleHops(mv.from).length) continue;
+    const root = mv.root === undefined || mv.root === "" ? "." : mv.root;
+    const from = normaliseAddress(mv.from);
+    if (compared.has(`${root}|${stripIndices(from)}`) || compared.has(`${root}|${from}`)) continue;
+    compared.add(`${root}|${from}`);
+    rows.push({
+      root,
+      resource: from,
+      argument: "*",
+      before: "",
+      after: "",
+      after_resolved: null,
+      match: null,
+      not_checked:
+        "the resource could not be read on one side — its module source did not resolve (a " +
+        "registry module, or a git module nothing fetched), or the block itself was not found there",
+    });
   }
 
-  const mismatches = substitutions.filter((s) => s.match === false);
+  const mismatches = rows.filter((s) => s.match === false);
   const reasons = mismatches.map(
     (s) =>
       `${s.resource}.${s.argument}${s.root === "." ? "" : ` in ${s.root}`}: the value CHANGED — was ` +
-      `${s.before}, the refactor resolves it to ${s.after_resolved}. A relocation must carry each ` +
-      "root's own value to its own call site; consolidating several roots, that means the value " +
-      "written at one member's call site is another member's.",
+      `${s.before}, the refactor resolves it to ${s.after_resolved}. A refactor must keep every ` +
+      "value; relocating a resource, each root's own value goes to its own call site, and a shared " +
+      "module's body changes every caller.",
   );
-  return { value_substitutions: substitutions, value_mismatches: mismatches, reasons };
+  return {
+    value_substitutions: rows.length === 0 && relocated === 0 ? null : rows,
+    value_mismatches: mismatches,
+    opaque_module_changes: opaque,
+    reasons: [
+      ...reasons,
+      ...opaque.map(
+        (o) =>
+          `${o.call}${o.root === "." ? "" : ` in ${o.root}`}: the module changed from ${o.before} to ` +
+          `${o.after}. Its resources come from code outside this tree, so this check cannot see what ` +
+          "the change does to them — it is not proven, and only a plan can prove it.",
+      ),
+    ],
+  };
 }