stamp: retire the HCL rewrite and module_prefix; refusal registry re-measured (#644)

[lex00]

The shared-layer re-measure of the core set has NOT been run. No
gauntlet run, no emulator, no change to live/gauntlet.json or the
rendered progress pages, on the maintainer's instruction mid-unit. This PR
is the code half of #644 only, and it must not merge as progress until the
core set is re-measured by the nightly or a later pass. Everything below is
measured with instruments that need no cloud.

Closes the code half of #644.

The unit

Issue #644, ruled 2026-09-04 in the refactor-1500 epic (#831, see #825):
the stamp is retired, not split, once the live_plan.go split (#819) has
merged. #819 is closed. HANDOFF "The order" item 3 names the three pieces:
the HCL-rewriting stamp, module_prefix, and LayerStamp's refusals - and
says explicitly that the static evaluator does not retire.

929 insertions, 12,109 deletions across 59 files; the stamp package
itself goes from 15,758 lines across 62 files to 5,593 across 39.

Inventory: what the ruling retires

1. The HCL rewrite. internal/live/stamp/stamp.go (2633),
perinstance.go (358), sharedbody.go (143), and the 21 test files that
drive them. Stamp, Request, Result, Schemas, Skip, SkipReason
and its constants, Untagged, Stamped, and the whole stamper type:
markerObject, addressExpr, forEachLookupAddressExpr,
splitAddressMarker, templateChunkMarkers, chunkCount, slotExpr,
tagsWrite, mergeEntries, verify/verifyValue, mustStamp,
unstampable/unstampableAt, privateBody, moduleResources,
childExpansion. Every one of them was already dead on the default path:
#451 gated the pass off entirely when CHOUDOUFU_NODE_RESOLVE is on, which
it has been by default since 2026-08-25.

Its five copies of the config-subset evaluator (evalStatic,
staticValue, staticString, staticCount, staticForEachKeys) die with
it rather than migrating to internal/live/staticeval - the copies #934
deliberately left for this unit.

Callers, all updated:

caller	what it was	what it is now
live_plan.go statelessStamp	the pass, plus three no-estate-name warnings	statelessMarkerEstate - the warnings only
live_plan.go statelessStampGaps	re-read the pass's report for silent skips	gone; there is no report
live_plan.go statelessNeedsDiscovery, recordBackedNeedsDiscoveryBlocks	inputs to the two above	gone
live_mode.go	the same pass on the apply path	same
live_policy.go statelessPolicyUntagMap, statelessPolicyReport's stampRes	declared_tagged = "untag"'s released keys	gone - see "what this removes" below
internal/live/check	already off it (#454's nodestamp.go)	unchanged; uses the registry, the summaries and UnmarkedDiscoveryDetail
tools/refusal-probe/cause.go	UnmarkedDiscoveryDetail, SummaryUnmarkedApply	unchanged

2. module_prefix. markers.ModulePrefixAttr / ModulePrefixRef /
ModulePrefix (internal/live/markers/modulemarker.go); the
GetTerraformAttr arms in internal/configs/static_scope.go and
internal/tofu/evaluate.go; configs.StaticEvaluator.WithModuleInstance
and the moduleInstance/moduleInstanceSet pair that existed only to make
that arm answerable; lint's RuleReservedSymbol
(internal/live/lint/reserved_symbol.go) and its fixture; the two
internal/live/passthrough "Marker module prefix" entries.

The symbol existed for exactly one reader. A module call's several instances
share one *hclsyntax.Body, so #378 wrote a template over
${tofu.marker_module_prefix} because a configuration rewrite had no other
way to produce a different address per instance.
NodeResolver.AdjustConfigValue is handed one concrete
addrs.AbsResourceInstance and writes the escaped address as a plain
string.

Read before deleting, as the issue asks: internal/live/lint/module_instance_eval.go
(#580) does not use WithModuleInstance. It rebuilds a child's var.*
closure per instance through identity.ChildModuleRepetitionData and the
static evaluator's repetition axis, neither of which this PR touches.

Retiring the reservation is not a loss of protection: its purpose was to
keep a fork-added symbol out of a configuration's hands, and with the symbol
gone a configuration naming it gets stock OpenTofu's own "Unsupported
attribute", which is both correct and portable. Keeping the rule would mean
refusing a configuration for naming an attribute that does not exist.

3. LayerStamp's refusals. Five of eight retire, three stay:

summary	verdict	why
No configuration to stamp	retired	a guard on the rewrite's own Request struct. There is no Request.
No estate name to stamp with	retired	same
No provider schemas for marker stamping	retired	same
Two resources share one configuration body	retired	a diagnostic about the rewrite sharing one *hclsyntax.Body (#280). The node path is called once per concrete instance with its own value and rewrites no body; structurally absent, not merely unmeasured.
Ownership marker could not be checked	retired	"a tag is set to an expression this run cannot evaluate" is a property of reading HCL text statically. The node path receives the tag already evaluated, so the case does not exist: a disagreeing value is Ownership marker conflict, an agreeing one is a no-op.
Ownership marker conflict	stays	raised by internal/live/projection (SummaryMarkerConflict, matched text by construction) and surfaced under LayerStamp by check's port.
Ownership markers not stamped	stays	raised by check's nodeStampUnmarkedApply, and by statelessMarkerEstate's three no-estate warnings.
Unmarked apply of a marker-only resource	stays	raised by check's nodeStampUnmarkedApply. 55 corpus sites.

The registry stays in internal/live/stamp under RaisedByStamp, because
that is the layer a reader of live/LIMITATIONS.md looks the refusal up
under. refusals.go carries the per-entry account above.

What stays, and why

• The static evaluator does not retire. HANDOFF item 3 is explicit; it
  is the estate-wide demand computation live-import, live-mv, live-check,
  discovery and the instruments all consume.
• UnmarkedDiscoveryDetail (moved to unmarked.go) and its
  rendered-sentence tests. Two live callers, and the sentences are what an
  operator reads. discoverycause_test.go now drives it directly instead of
  through the deleted engine, keeping every wording assertion.
• The taggability pin - taggability_test.go,
  taggability_live_test.go, taggability_survey_test.go and the 30
  stamp_cohort_*_test.go files. It pins which admitted types have a
  settable tags map, which is the same question the node writer's
  markers.TagSurface asks per instance, and
  internal/live/harness/burndown.go cites the chain by name.
  markerlessdocs_test.go and markeronlysplit_test.go never called
  Stamp at all.

What this removes that was not already dead

Two things, both already inert on the default path before this PR, both
named rather than dropped quietly:

1. declared_tagged = "untag"'s marker suppression. It lived only in
   the HCL rewrite (stamp.Request.PolicyUntag), and the node writer has no
   equivalent, so it stopped happening on 2026-08-25 when
   CHOUDOUFU_NODE_RESOLVE defaulted on. The view's Untagged section has
   been empty for a fortnight. Porting it to AdjustConfigValue is real
   work with its own decision (a per-instance withhold, not a per-block one)
   and is not this issue's; live_policy.go carries the note.
2. statelessStampGaps' plan-time "Unstamped marker-only resource"
   error and its foundation: a universal per-instance record, so every type stock supports is admitted and rung is a metric #364 record-backed downgrade. The node path never raised
   either. internal/live/check still reports the same finding offline, at
   the same 55 sites.

The safety fix this deletion forced

Deleting the rewrite left CHOUDOUFU_NODE_RESOLVE=0 with no marker
writer at all - ConfigValueAdjuster nil, nothing stamping, every
resource created with no tofu-estate and no tofu-address. Silently. The
flag used to select two things at once, and only one of them still exists.

So the halves are separated (619a1f8): NodeResolver is built,
populated and installed as tofu.ConfigValueAdjuster for every run; the
flag governs only what it always named, whether identity resolution goes
through tofu.ResourceIdentityResolver. Two call sites used
resolver != nil as a stand-in for the flag and had to move to
nodeResolveEnabled(), because that expression is now always true:

• identity.DowngradeForNodeResolution. Caught by
  TestLivePlan_identityFatal's own opt-out subtest going exit 1 -> exit 0:
  the static "Identity argument not set" stopped being fatal and the run
  planned a CREATE for an instance nothing had identified. Exactly the
  failure that subtest exists to catch, caught by it.
• recordShrinkStore (foundation: the plan-node seam - identity resolved and markers stamped at NodePlannableResourceInstance from stock's evaluated values; the static evaluator and the HCL stamp retire #388 edge 3), whose contract is that a flag-off run
  sees a byte-identical marker-sweep demand.

Five-row table

difference	row	action
the HCL rewrite is a second implementation of what the node seam does per instance	not a stock difference - a foundation item (HANDOFF "The order" 3)	deleted
=0 would have had no marker writer	handling it would write a wrong marker (its write-side twin: no marker at all, silently)	the writer is unconditional; the flag keeps only the identity path
declared_tagged = "untag" has no node-path equivalent	handling it would write a wrong marker if guessed at	named, not guessed; unreachable implementation deleted, port left as its own work

The generic rule, and how many types it reaches

Zero hand-wired type names were added or removed in control flow. The
retired mechanism was never per type: mustStamp reads
identity.DiscoveryCause, taggability reads markers.Taggable /
markers.TagSurface off the provider schema, and the module-prefix template
was a property of module expansion, not of any resource type. The rule
that replaces the whole thing - "write the marker from the instance address
you already have" - reaches every admitted type: 1,699 rows in
identity.DefaultTable, of which the taggable population is what the
surviving pin in taggability_test.go covers.

live/derivation_guard_test.go's registry is unchanged, and correctly
so: it excludes _test.go files, and every type literal this PR deletes or
adds is in a test fixture or a pinned test table. Verified green.

Refusal registry, re-measured

refusal-probe -schemas -allow-partial-corpus, both runs in this worktree,
before at 22d9a3f099 and after at 0baf59209a.

The issue's baseline of sites 10363, instances 4912, blocked 203 at
5f2402e95a does not reproduce, and not because of this change: the
corpus manifest has moved since (228 entries reachable here, against the
250/259 the older figures were taken over, and 5 manifest sources whose
globs match a repository root with no top-level configuration). The new
baseline, measured at 22d9a3f099 before a line was deleted, is
sites 8247, instances 4632, blocked 193, 228 entries. Both runs are
partial in the identical way, which is what -diff checks before it will
compare them.

sites      8247 -> 8247  (+0)
instances  4632 -> 4632  (+0)
blocked     193 ->  193  (+0)
unresolved  126 ->  126  (+0) module calls
by refusal ID: (nothing)
entries improved: 0        entries WORSE: 0

Per entry, not aggregate - all 27, no entry got worse and none moved at
all:

Resolves at plan time via a data-source read     6073 -> 6073
unadmitted-type                                   651 ->  651
Unable to compute static value                    430 ->  430
logical-resource                                  295 ->  295
Dynamic value in static context                   208 ->  208
Non-static identity argument                       85 ->   85
Non-static for_each expression                     70 ->   70
Unresolvable identity                              64 ->   64
markerless-type                                    60 ->   60
Unmarked apply of a marker-only resource           55 ->   55
Ambiguous list-valued identity argument            55 ->   55
Non-static count expression                        52 ->   52
moved-block                                        37 ->   37
Identity not resolvable from configuration         32 ->   32
child-module                                       17 ->   17
Data source not readable before resolution         16 ->   16
count-index                                        11 ->   11
Data source provider not configurable              10 ->   10
Identity argument not set                           8 ->    8
Module output not supported in static context       5 ->    5
Invalid operand                                     4 ->    4
provisioner / module-providers / Null identity      2 ->    2  (each)
Two resources with the same identity                1 ->    1
Resource type outside the live-markers subset       1 ->    1
Sensitive count expression                          1 ->    1

The eight registry entries this PR deletes measured zero sites in the
before run and so appear in neither column: the five stamp caller-error
and rewrite-mechanism refusals, reserved-symbol, and the two
Marker module prefix passthrough entries. Unmarked apply of a marker-only resource - the one nonzero stamp entry - is unchanged at 55, which is the
number that had to hold.

live/LIMITATIONS.md regenerated (go run ./tools/limits-gen): 223
refusals -> 215, 28 lint rules -> 27.

TestIdentityGolden

It moved, by exactly two operations, and neither is a changed identity.
0 identities changed across the branch. Never -update: the golden was
edited by hand and the test verifies the whole file including its body
digest, so the result is byte-identical to what -update would have
written.

1 removed: live/e2e/limits/reserved-symbol aws_s3_bucket.reserved,
CONCRETE, tofu-stateless-limits-reserved-symbol,
bucket=tofu-stateless-limits-reserved-symbol. That directory existed only
to give RuleReservedSymbol something to refuse; the rule retires, and
TestLimitsDirsMatchTable requires every live/e2e/limits directory to map
to a rule, so the fixture goes with it. A bucket's identity is its own
bucket argument, which the retired symbol never touched.

2 added: internal/live/check/testdata/stamp-uniquename-exempt
aws_cloudfront_cache_policy.exempt and .refused, both NEEDS_DISCOVERY,
both rendering nothing - which is what a server-assigned type renders
in this sweep, and the point of the fixture is that the two differ by
cause, not by identity.

Net: instances 1107 -> 1108, dirs 624 -> 624, CONCRETE 607 -> 606,
NEEDS_DISCOVERY 411 -> 413. Pins, the body digest and HANDOFF.md's figure
table all updated with the reason attached.

Assertions on rendered identities, never on a predicate

• internal/live/stamp/discoverycause_test.go keeps every one of its
  sentence assertions on the string UnmarkedDiscoveryDetail returns, one
  per identity.DiscoveryCause, including the "six distinct sentences"
  check that catches a switch falling through.
• TestStampGate_UniqueNameCauseIsExemptFromTheUnmarkedApplyRefusal (new)
  asserts on the rendered finding, not on BindsByName(). It replaces
  the exemption half of the deleted
  TestUnmarkedDiscoveryDetail_uniqueNameIsNotRefused, which had been the
  only test that would have caught the exemption's removal.
• Both new guards were proved red on purpose:
  forcing mustStamp := true in nodeStampUnmarkedApply fails the
  exemption test with the exempt resource's own site quoted; re-gating the
  resolver population on r.nodeResolve fails
  TestStatelessBegin_nodeResolveOptOut with "the resolver was constructed
  but never given an estate name".

The exemption test's first draft used aws_cloudfront_origin_access_control
as its negative control and the control never fired - that type is
markerless-vetoed at LayerLint and never reaches the stamp layer. The test
said so rather than passing green, which is why the control is now the same
type on both sides: two aws_cloudfront_cache_policy instances, one stating
its documented account-unique name and one omitting it, one schema serving
both, so the only difference is the cause.

Tests

go build ./...                                              ok
gofmt -l <every .go file this branch touches>               clean
go vet ./internal/... ./tools/... ./live/...                clean
go test ./internal/live/...                                 ok   (incl. docrefs, marksafe,
                                                                  check, projection, identity,
                                                                  discovery, lint, stamp, harness)
go test ./internal/command/                                 ok   65s
go test ./internal/tofu/ ./internal/configs/                ok
go test ./live/                                             ok   (derivation registry, pins,
                                                                  golden pin, HANDOFF figures,
                                                                  ci coverage)
go test ./tools/... ./cmd/...                               ok

TestGodocCitationsResolve caught ten citations naming deleted symbols and
they were rewritten rather than de-bracketed (e070707).

Reproduce

git checkout live/stamp-retire-644
ln -s <a-tree-with>/.corpus .corpus
env -u PWD go run ./tools/refusal-probe -schemas -allow-partial-corpus -out after.json
git checkout 6e24aa99b4 -- . && env -u PWD go run ./tools/refusal-probe -schemas -allow-partial-corpus -out before.json
env -u PWD go run ./tools/refusal-probe -diff before.json,after.json
env -u PWD go test -count=1 ./internal/live/check -run TestIdentityGolden
env -u PWD go test -count=1 ./internal/live/check -run TestStampGate_UniqueNameCauseIsExempt
env -u PWD go test -count=1 ./internal/command -run TestStatelessBegin_nodeResolveOptOut

Not done, and why

• The core-set gauntlet re-measure. Withdrawn from this unit by the
  maintainer mid-run. live/gauntlet.json and every rendered progress page
  are untouched on this branch. The board line is whatever
  7841ac337f (gauntlet: carry plan_approval to the remaining 25 estates so stage 12 can be flipped active #903's 27-estate re-measure with plan_approval active)
  plus d8d7c84e87 (gauntlet: reference-ec2-vpc day2_crash regressed; destroying a deposed object records no tombstone, so its lingering tag is a second claimant #938's reference-ec2-vpc/day2_crash fail -> pass)
  left it at; this PR moves neither, and no claim about it is made here.
  Do not merge this as progress until that re-measure runs.
• declared_tagged = "untag"'s node-path port, above.

🤖 Generated with Claude Code

https://claude.ai/code/session_018QSftBd7j3Dp4mnB6feRKL