@homeflare/alchemy 0.10.0 → 0.11.0

package/src/proxmox/lxc-adoption.ts

@@ -0,0 +1,50 @@
+/**
+ * The strict adoption gate for `Proxmox.Lxc`: AN ADOPTION NEVER CHANGES A GUEST (decided
+ * 2026-09-21). A guest this stack adopts — no recorded instance, or one the plan only kept because
+ * `--adopt` said so (ownership/adopting.ts) — is taken over exactly as it runs, or not at all.
+ *
+ * ⛔ ANY DIFFERENCE FAILS, AT PLAN AND AGAIN AT APPLY. Before this, a cold adoption planned `adopted`
+ *   whatever it would write (alchemy beta.79 prints no property diff for it) and only LOGGED the
+ *   keys; `deploy --adopt --yes` then wrote them. A `net0` pasted without the live `tag=` moved the
+ *   guest off its VLAN on the deploy that was meant to change nothing. Now the plan fails naming
+ *   the keys, and reconcile re-asks against a fresh read, so a hand edit between plan and deploy
+ *   is refused too rather than written back.
+ * ⛔ KEYS ONLY, NEVER VALUES. The refusal names what differs and nothing it differs by: a live
+ *   config can carry anything (`description` is where people paste credentials), and plan output
+ *   lands in CI logs.
+ * ★ ASKED BEFORE `judge`'s OWN REFUSALS. Those name a declared value (the `pct set` to run), and
+ *   for an adoption the fix is the other direction: declare what is live.
+ * ★ THE STORE IS READ ONLY WHEN SOMETHING DIFFERS. A clean adoption — the only kind that proceeds
+ *   — costs nothing here.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from '../ownership/adopt.ts';
+import { adopting } from '../ownership/adopting.ts';
+import { type LxcChange, judge } from './lxc-judge.ts';
+import { LxcRefusedError } from './lxc-lifecycle.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+/** The refusal: keys, where, and what to do — never a value. */
+export const adoptionRefusal = (props: LxcProps, drift: readonly string[]): string =>
+  `CT ${String(props.vmid)} on ${props.node}: adopting it would change ${drift.join(', ')}. An ` +
+  'adoption never changes a guest, so nothing is written. Declare what is live for these keys ' +
+  '(the plan names keys, never values) and plan again; change them after the adoption, as an ' +
+  'update.';
+
+/**
+ * Fails with `adoptionRefusal` when `change` would write to a guest `owner`'s call adopts.
+ * `settled` for a recovered create is the same judge, of the recording row's props against `live`.
+ */
+export const refuseAdoptedDrift = (
+  owner: Owner,
+  props: LxcProps,
+  live: Record<string, unknown>,
+  change: LxcChange,
+): Effect.Effect<void, LxcRefusedError> =>
+  Effect.gen(function* () {
+    if (change.drift.length === 0) return;
+    const settled = (recorded: unknown) =>
+      Effect.sync(() => judge(recorded as LxcProps, live).drift.length === 0);
+    if (!(yield* adopting(owner, settled))) return;
+    return yield* Effect.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
+  });

package/src/proxmox/lxc-guards.test.ts

@@ -11,19 +11,12 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { KEY, NODE, TARGET, VMID, adoptedAsIs, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-const KEY = `${NODE}/${String(VMID)}`;
 const TEMPLATE = 'local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst';
-
-const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
-};
+const ct = (props: LxcProps) => ProxmoxLxc('ct', props).pipe(adopt(true));
 
 let fake: FakePve | undefined;
 afterEach(() => {
@@ -113,10 +106,9 @@ describe('a write is claimed only when PVE says it finished', () => {
   test('a config write PVE accepted but did not store fails the read-back', async () => {
     const pve = cluster();
     seed(pve, NODE, VMID);
+    const stack = await adoptedAsIs(pve);
     pve.ignore.add('memory');
-    const run = await lxcEngine(pve).deploy(
-      ProxmoxLxc('ct', pasted({ memory: 4096 })).pipe(adopt(true)),
-    );
+    const run = await stack.deploy(ct(pasted({ memory: 4096 })));
     expect(run.failure).toContain('memory still differ');
   });
 });
@@ -137,8 +129,9 @@ describe('identity and volumes', () => {
   test('options and growth on one volume: the PUT keeps the live size, the resize follows', async () => {
     const pve = cluster();
     seed(pve, NODE, VMID);
+    const stack = await adoptedAsIs(pve);
     const mp0 = 'tank:subvol-100-disk-0,mp=/data,backup=1,size=300G';
-    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted({ mp0 })).pipe(adopt(true)));
+    const run = await stack.deploy(ct(pasted({ mp0 })));
     expect(run.failure).toBe('');
     const path = `nodes/${NODE}/lxc/${String(VMID)}`;
     expect(writesOf(pve)).toEqual([`PUT ${path}/config`, `PUT ${path}/resize`]);

package/src/proxmox/lxc-harness.ts

@@ -13,7 +13,7 @@
  * ★ ONE ARTIFACT STORE ACROSS A PLAN AND ITS APPLY, and `--adopt` as the AdoptPolicy service, as
  *   openbao/fake-stack.ts provides them: the ownership rule reads both (src/ownership/).
  */
-import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { AdoptPolicy, adopt } from 'alchemy/AdoptPolicy';
 import { apply } from 'alchemy/Apply';
 import { provideFreshArtifactStore } from 'alchemy/Artifacts';
 import * as Plan from 'alchemy/Plan';
@@ -29,7 +29,8 @@ import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 import type { PveTarget } from './credentials.ts';
 import { withFakeBao } from './fake-bao-env.ts';
 import { FAKE_BAO, FAKE_MEMBER, type FakePve } from './fake-pve-lxc.ts';
-import { ProxmoxLxcProvider } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+import { ProxmoxLxc, ProxmoxLxcProvider } from './lxc.ts';
 
 export const TARGET: PveTarget = {
   members: [FAKE_MEMBER],
@@ -68,6 +69,17 @@ export const LIVE: Readonly<Record<string, unknown>> = {
   unprivileged: 1,
 };
 
+/** Where `seed` puts the production-shaped guest by default, and its `node/vmid` key. */
+export const NODE = 'pve1';
+export const VMID = 100;
+export const KEY = `${NODE}/${String(VMID)}`;
+
+/** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
+export const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
+  const { lxc: _raw, ...config } = LIVE;
+  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
+};
+
 /** Put `config` live on the fake as `node/vmid`, with a digest as PVE would add. */
 export const seed = (fake: FakePve, node: string, vmid: number, config = LIVE) => {
   fake.guests.set(`${node}/${String(vmid)}`, { ...config, digest: 'digest-live' });
@@ -148,3 +160,14 @@ export const lxcEngine = (fake: FakePve) => {
     status: (fqn: string) => rows['lxc']?.['test']?.[fqn]?.status,
   };
 };
+
+/**
+ * The engine, with the guest `seed` put at NODE/VMID adopted exactly as it runs — the only adoption
+ * that proceeds (lxc-adoption.ts) — so a test can go on to change it, as an ordinary update.
+ */
+export const adoptedAsIs = async (pve: FakePve): Promise<ReturnType<typeof lxcEngine>> => {
+  const stack = lxcEngine(pve);
+  const run = await stack.deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)));
+  if (run.failure !== '') throw new Error(`the clean adoption failed: ${run.failure}`);
+  return stack;
+};

package/src/proxmox/lxc-ownership.test.ts

@@ -7,7 +7,8 @@
  *   planned a create refuses a guest it then finds, and forgets its `creating` row; under
  *   `--adopt` it records a matching one with no write and still refuses one that differs; and a
  *   create interrupted after its POST resumes WITHOUT `--adopt` when the guest is what it wrote,
- *   and asks for `--adopt` when someone changed it meanwhile.
+ *   and asks for `--adopt` when someone changed it meanwhile — which then adopts it only as it
+ *   now runs, never writing the declaration back over the change (lxc-adoption.ts).
  * ★ THE INTERRUPTION IS A CREATE TASK THAT ENDS IN AN ERROR AFTER THE FAKE BUILT THE GUEST — to the
  *   engine the same as a deploy killed while it waited on the task: a live guest, and a
  *   `creating` row with no attributes.
@@ -15,20 +16,12 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { KEY, NODE, TARGET, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-const KEY = `${NODE}/${String(VMID)}`;
 const TAKEOVER = 'already exists, and this stack holds no state for it';
 
-const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
-};
-
 let fake: FakePve | undefined;
 afterEach(() => {
   fake?.stop();
@@ -146,14 +139,26 @@ describe('an interrupted create', () => {
     expect(stack.status('door')).toBe('created');
   });
 
-  test('asks for --adopt when the guest changed meanwhile, and resumes with it', async () => {
+  test('is our own guest, not an adoption: a declaration changed meanwhile is written', async () => {
+    const { pve, stack } = await interrupted();
+    const run = await stack.deploy(door({ hostname: 'door-renamed' }));
+    expect(run.failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`, `PUT nodes/${NODE}/lxc/150/config`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-renamed');
+  });
+
+  test('asks for --adopt when the guest changed meanwhile, and adopts it only as it runs', async () => {
     const { pve, stack } = await interrupted();
     const guest = pve.guests.get(`${NODE}/150`) ?? {};
     guest['hostname'] = 'someone-else';
     expect((await stack.deploy(door())).failure).toContain('Cannot resume creating');
-    const resumed = await stack.deploy(door(), { adopt: true });
+    const refused = await stack.deploy(door(), { adopt: true });
+    expect(refused.failure).toContain('adopting it would change hostname');
+    expect(refused.failure).not.toContain('someone-else');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    const resumed = await stack.deploy(door({ hostname: 'someone-else' }), { adopt: true });
     expect(resumed.failure).toBe('');
-    expect(resumed.warnings.join('\n')).toContain('differs from the declaration in hostname');
-    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-example');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('someone-else');
   });
 });

package/src/proxmox/lxc-strict-adopt.test.ts

@@ -0,0 +1,104 @@
+/**
+ * AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts), through Alchemy's real plan and apply over
+ * fake-pve-lxc.ts (placeholders only).
+ *
+ * ⛔ WHAT THESE PIN: a cold adoption that differs from the live guest in ANY key fails the plan —
+ *   under `adopt(true)` and under `--adopt` alike — naming the keys and none of the values, before
+ *   `judge`'s own refusals (which print a declared value); nothing is written and no row is left.
+ *   A hand edit between the plan and the deploy is refused at apply with nothing written; the
+ *   adoption row it leaves keeps refusing until the declaration says what is live, and then adopts
+ *   with no write. An interrupted create that `--adopt` resumes is held to the same rule:
+ *   lxc-ownership.test.ts.
+ * ★ MUTATION-CHECKED 2026-09-21: removing either `refuseAdoptedDrift` call in lxc.ts, or any one of
+ *   the three adoption answers in ownership/adopting.ts, fails a test here or in
+ *   lxc-ownership.test.ts.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { KEY, NODE, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const REFUSAL = 'adopting it would change';
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const live = () => {
+  fake = fakePve();
+  seed(fake, NODE, VMID);
+  return fake;
+};
+
+const drifted = (): LxcProps =>
+  pasted({ memory: 4096, net1: 'name=eth1,bridge=vmbr1,ip=198.51.100.4/24,mtu=9000' });
+
+describe('a cold adoption that differs from the live guest fails the plan', () => {
+  test.each([
+    ['adopt(true)', () => ProxmoxLxc('ct', drifted()).pipe(adopt(true)), {}],
+    ['--adopt', () => ProxmoxLxc('ct', drifted()), { adopt: true }],
+  ])('under %s: keys named, values never, nothing written', async (_, declare, options) => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const planned = await stack.plan(declare(), options);
+    expect(planned.failure).toContain(`CT ${String(VMID)} on ${NODE}: ${REFUSAL} memory, net1.`);
+    for (const value of ['4096', '8192', '9000', '1500']) {
+      expect(planned.failure).not.toContain(value);
+    }
+    const deployed = await stack.deploy(declare(), options);
+    expect(deployed.failure).toContain(`${REFUSAL} memory, net1`);
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBeUndefined();
+  });
+
+  test.each([
+    ['a device passthrough', { dev1: '/dev/fuse' }, 'dev1', ['/dev/fuse', 'pct set']],
+    ['an unprivileged flip', { unprivileged: 0 as const }, 'unprivileged', ['live 1']],
+    [
+      'a smaller mount point',
+      { mp0: 'tank:subvol-100-disk-0,mp=/data,size=100G' },
+      'mp0',
+      ['100G'],
+    ],
+  ])('%s is the adoption refusal, not the update one', async (_, change, key, hidden) => {
+    const pve = live();
+    const run = await lxcEngine(pve).plan(ProxmoxLxc('ct', pasted(change)).pipe(adopt(true)));
+    expect(run.failure).toContain(`${REFUSAL} ${key}.`);
+    for (const value of hidden) expect(run.failure).not.toContain(value);
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('an exact match still adopts, with no write and no warning', async () => {
+    const pve = live();
+    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)));
+    expect(run).toEqual({ actions: { ct: 'adopted' }, failure: '', warnings: [] });
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('a hand edit between the plan and the deploy', () => {
+  test('is refused at apply, and the adoption holds until the declaration says what is live', async () => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const declare = (over: Partial<LxcProps> = {}) =>
+      ProxmoxLxc('ct', pasted(over)).pipe(adopt(true));
+    // ★ Two config reads plan a cold adoption — the probe's and diff's — so the edit lands after
+    //   the plan said `adopted` and before reconcile reads.
+    pve.edits.set(KEY, { after: 2, set: { memory: 4096 } });
+    const raced = await stack.deploy(declare());
+    expect(raced.failure).toContain(`${REFUSAL} memory.`);
+    expect(raced.failure).not.toContain('4096');
+    expect(writesOf(pve)).toEqual([]);
+    expect(pve.guests.get(KEY)?.['memory']).toBe(4096);
+    expect(stack.status('ct')).toBe('updating');
+    expect((await stack.plan(declare())).failure).toContain(`${REFUSAL} memory.`);
+    const caughtUp = await stack.deploy(declare({ memory: 4096 }));
+    expect(caughtUp.failure).toBe('');
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBe('updated');
+    expect((await stack.plan(declare({ memory: 4096 }))).actions).toEqual({ ct: 'noop' });
+  });
+});

package/src/proxmox/lxc.ts

@@ -17,11 +17,11 @@
  * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only
  *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.
  *
- * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a
- *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)
- *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name
- *   (never by value), as a warning — the only place a plan can say the declaration is not the live
- *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).
+ * ⛔ AND AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts). A guest this stack adopts is taken
+ *   over exactly as it runs: any key the declaration says otherwise FAILS the plan, by name (never
+ *   by value), and reconcile asks again before it would write. Only an exact match adopts.
+ * ⚠️ AN UPDATE STILL PLANS `update` WITHOUT A PROPERTY DIFF, so `diff` LOGS the keys a deploy would
+ *   write, by name, as a warning — the only place a plan says what the deploy will change.
  *
  * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for
  *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.
@@ -36,6 +36,7 @@ import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { createRefusals } from './lxc-create-form.ts';
 import { identityRefusals } from './lxc-identity.ts';
+import { refuseAdoptedDrift } from './lxc-adoption.ts';
 import { judge } from './lxc-judge.ts';
 import {
   LxcRefusedError,
@@ -75,8 +76,9 @@ const refused = (reasons: readonly string[]) =>
  *   that follows, so reconcile can tell our own interrupted create from a guest somebody else put
  *   at this vmid.
  */
-const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | undefined) =>
+const diff = (owner: LxcOwner, news: Input<LxcProps>, olds: LxcProps) =>
   Effect.gen(function* () {
+    const { output } = owner;
     const identity = identityRefusals(news, olds, output);
     if (identity.length > 0) return yield* refused(identity);
     if (output === undefined) return undefined;
@@ -96,6 +98,7 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
       return { action: 'update' } as const;
     }
     const change = judge(news, live);
+    yield* refuseAdoptedDrift(owner, news, live, change);
     if (change.refuse.length > 0) return yield* refused(change.refuse);
     const moved = news.node !== output.node;
     if (change.drift.length === 0 && !moved) return { action: 'noop' } as const;
@@ -112,7 +115,8 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
 /**
  * ⛔ THE SAME JUDGE AS `diff`, RE-RUN AGAINST A FRESH READ, AND AN EMPTY CHANGE WRITES NOTHING.
  *   Apply routes `adopted` through reconcile (resource.ts has the Apply.ts lines), so this is what
- *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs.
+ *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs,
+ *   and for one edited since the plan it is a refusal, never a write (lxc-adoption.ts).
  * ⛔ AND IT READS BACK AND JUDGES AGAIN. PVE answers 200 on writes that did nothing, so a change
  *   that did not land is a failure here, not a state row claiming it did. ⚠️ A change PVE parked
  *   as pending on a running guest DOES read back (GET config merges `[pending]` unless asked for
@@ -148,6 +152,7 @@ const reconcile = (owner: LxcOwner, news: LxcProps) =>
             'onto an existing guest: plan again, so the plan can show it and adopt it.',
         ]);
       }
+      yield* refuseAdoptedDrift(owner, news, live, change);
       if (change.refuse.length > 0) return yield* refused(change.refuse);
       if (change.drift.length > 0) yield* updateGuest(news, change, text(live['digest']));
     }
@@ -208,14 +213,13 @@ const handlers = {
   delete: ({ olds, output }: { olds: LxcProps; output: LxcAttributes }) =>
     destroyGuest(whereOf(olds, output), olds),
   diff: ({
+    fqn,
+    instanceId,
     news,
     olds,
     output,
-  }: {
-    news: Input<LxcProps>;
-    olds: LxcProps;
-    output: LxcAttributes | undefined;
-  }) => diff(news, olds, output),
+  }: Asked & { news: Input<LxcProps>; olds: LxcProps; output: LxcAttributes | undefined }) =>
+    diff({ fqn, instanceId, output }, news, olds),
   list: () => Effect.succeed([]),
   read: ({
     fqn,

package/src/verify/fake-engine.ts

@@ -33,6 +33,14 @@ export const Thing = Alchemy.Resource<Thing>('Test.Thing');
 export interface Blind extends Alchemy.Resource<'Test.Blind', ThingProps, ThingAttributes> {}
 export const Blind = Alchemy.Resource<Blind>('Test.Blind');
 
+/**
+ * The same object with a `diff` that compares the RECORDED props with the declaration and never
+ * the live object — the shape of Alchemy's own `Cloudflare.R2Bucket` diff (beta.79
+ * Cloudflare/R2/Bucket.ts: `olds.domains` against `news.domains`). recheck.ts exists for it.
+ */
+export interface Recorded extends Alchemy.Resource<'Test.Recorded', ThingProps, ThingAttributes> {}
+export const Recorded = Alchemy.Resource<Recorded>('Test.Recorded');
+
 /** The fake cloud: what exists, what is someone else's, and every call made to it, in order. */
 export interface Cloud {
   readonly live: Map<string, string>;
@@ -93,6 +101,22 @@ export const thingProviders = (cloud: Cloud) =>
       ),
     ),
     Provider.effect(Blind, Effect.succeed(Blind.Provider.of(lifecycle(cloud)))),
+    Provider.effect(
+      Recorded,
+      Effect.succeed(
+        Recorded.Provider.of({
+          ...lifecycle(cloud),
+          diff: ({ news, olds }) =>
+            Effect.sync(() => {
+              if (!isResolved(news)) return undefined;
+              cloud.calls.push(`diff ${news.name}`);
+              return (olds.comment ?? '') === (news.comment ?? '')
+                ? ({ action: 'noop' } as const)
+                : ({ action: 'update' } as const);
+            }),
+        }),
+      ),
+    ),
   );
 
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */

package/src/verify/index.ts

@@ -22,6 +22,7 @@ export {
   type DiffAnswer,
   type Observations,
   type ReadAnswer,
+  type RecheckAnswer,
   type Seen,
   WRITE_REFUSED,
   spyContext,

package/src/verify/plan-scope.ts

@@ -0,0 +1,34 @@
+/**
+ * The scope Plan.ts gives every provider call it makes, for the calls the verifier makes itself
+ * after the plan: `--all`'s reads (verify.ts) and the recheck's diffs (recheck.ts).
+ *
+ * ⚠️ RE-CREATED, BECAUSE Plan.ts DOES NOT EXPORT IT (`providePlanScope`, alchemy beta.79): a scoped
+ *   `Artifacts` bag over the run's `ArtifactStore` (a fresh one when none is provided) and the row's
+ *   `InstanceId`. A kit family that consults either — the ownership helpers do — sees what it
+ *   would see under `alchemy plan`. Moved here from verify.ts once a second caller needed it.
+ */
+import {
+  ArtifactStore,
+  Artifacts,
+  createArtifactStore,
+  makeScopedArtifacts,
+} from 'alchemy/Artifacts';
+import { InstanceId } from 'alchemy/InstanceId';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+
+export const inPlanScope =
+  (fqn: string, instanceId: string) =>
+  <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>> =>
+    Effect.gen(function* () {
+      const store = Option.getOrElse(
+        yield* Effect.serviceOption(ArtifactStore),
+        createArtifactStore,
+      );
+      return yield* effect.pipe(
+        Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),
+        Effect.provideService(InstanceId, instanceId),
+      );
+    }) as Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>>;

package/src/verify/recheck.test.ts

@@ -0,0 +1,56 @@
+/**
+ * An adopted row whose provider's `diff` never looks at the live object (recheck.ts).
+ *
+ * 🔴 THE FALSE PASS THIS PINS (red-teamed 2026-09-21). Plan.ts hands an adopted row's diff
+ *   `olds: news`, so a diff that compares recorded props with the declaration answers `noop`
+ *   whatever the cloud holds. The verifier printed `ok` and exited 0 over a drift it had itself
+ *   listed under `changed`, and the deploy then wrote it. The first test fails that way on the
+ *   verifier without recheck.ts.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { Recorded, Thing, cloudOf, fakeEngine, writesOf } from './fake-engine.ts';
+import { exitCodeOf } from './report.ts';
+
+const recorded = (name: string, comment: string) => Recorded(name, { comment, name });
+
+describe('an adopted row whose diff compares recorded props', () => {
+  test('that drifted: asked again with the live value, it says update, and the row fails', async () => {
+    const cloud = cloudOf({ drifted: 'old' });
+    const engine = fakeEngine(cloud);
+    const report = await engine.verify(recorded('drifted', 'new'));
+    expect(report.rows).toEqual([
+      expect.objectContaining({
+        changed: ['comment'],
+        diff: 'noop',
+        ok: false,
+        planned: 'adopted',
+        recheck: 'update',
+      }),
+    ]);
+    expect(report.rows[0]?.why).toContain('recorded props');
+    expect(exitCodeOf(report)).toBe(1);
+    expect(writesOf(cloud)).toEqual([]);
+
+    // ★ And the verdict is the deploy's: the forced reconcile writes the drift the diff hid.
+    expect(await engine.deploy(recorded('drifted', 'new'))).toEqual({ drifted: 'adopted' });
+    expect(cloud.live.get('drifted')).toBe('new');
+  });
+
+  test('that matches: nothing differs, so it is not asked again and passes', async () => {
+    const cloud = cloudOf({ same: 'x' });
+    const report = await fakeEngine(cloud).verify(recorded('same', 'x'));
+    expect(report.rows[0]).toMatchObject({ changed: [], diff: 'noop', ok: true });
+    expect(report.rows[0]?.recheck).toBeUndefined();
+    expect(cloud.calls.filter((call) => call.startsWith('diff'))).toEqual(['diff same']);
+  });
+
+  test('a diff that reads the live object is not asked again when it already said update', async () => {
+    const cloud = cloudOf({ drifted: 'old' });
+    const report = await fakeEngine(cloud).verify(
+      Effect.all([Thing('drifted', { comment: 'new', name: 'drifted' })]),
+    );
+    expect(report.rows[0]).toMatchObject({ diff: 'update', ok: false });
+    expect(report.rows[0]?.recheck).toBeUndefined();
+  });
+});

package/src/verify/recheck.ts

@@ -0,0 +1,71 @@
+/**
+ * Ask an adopted row's `diff` a second time, with the live values as its recorded props, when its
+ * first `noop` sits beside a read that differs from the declaration.
+ *
+ * 🔴 WHY (red-teamed 2026-09-21). Plan.ts hands an adopted row's diff `olds: news`, because the
+ *   adopted state carries `props: news`. A diff that compares the RECORDED props with the
+ *   declaration therefore answers `noop` whatever the cloud holds, and the forced reconcile then
+ *   writes. Alchemy's own `Cloudflare.R2Bucket` diff is that shape (beta.79
+ *   Cloudflare/R2/Bucket.ts, `olds.domains` against `news.domains`). The verifier said `ok`,
+ *   exited 0, and listed the drift under `changed` on the same line. rows.ts already refused to
+ *   trust a MISSING diff for this reason; a diff that never looks at the live object is the same
+ *   blind spot one level down.
+ *
+ * ★ THE QUESTION IS "WOULD YOU STILL SAY noop IF STATE HAD RECORDED WHAT THE READ FOUND?" It is the
+ *   planner's own input, replayed with one change: `olds` carries the read's value for each field
+ *   in `changed`. A diff that reads the live object ignores `olds` and answers as before. Every kit
+ *   PVE/PBS family re-reads (`pveOperations.diff`), so a field its `matches` leaves out, such as
+ *   CephPool's autoscaled `pg_num`, still passes. A diff that compares `olds` now sees the drift.
+ *
+ * ⛔ ONLY `diff`, a read by Alchemy's contract, and through the WATCHED provider, so every write
+ *   path still answers with spy.ts's refusal. The first answer is put back afterwards: the report's
+ *   `diff` column stays what the planner heard.
+ * ⚠️ IT CAN ONLY TURN A PASS INTO A FAIL. It runs on a row that would otherwise pass (adopted,
+ *   `noop`, something in `changed`), and anything but a second `noop`, a failure included, fails it.
+ * ⚠️ SAME-NAMED FIELDS ONLY, like `changed`: a drift in a field whose attribute has another name is
+ *   invisible to both. Whether a `reconcile` PUTs identical values anyway is still up to the
+ *   provider (docs/adopt-verify.md, Limits).
+ */
+import type { ProviderService } from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { inPlanScope } from './plan-scope.ts';
+import { changedFields } from './rows.ts';
+import { type Observations, type RecheckAnswer, diffAnswer } from './spy.ts';
+
+/** The plan-node fields a recheck needs. */
+export interface RecheckNode {
+  readonly action: string;
+  readonly provider?: ProviderService;
+  readonly state?: { readonly instanceId: string };
+}
+
+/** Recheck one planned row if it needs it; the answer lands in `seen` as `recheck`. */
+export const recheck = (fqn: string, node: RecheckNode, seen: Observations): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const observed = seen.get(fqn);
+    const first = observed?.diff;
+    const input = first?.input;
+    const diff = node.provider?.diff;
+    if (node.action !== 'adopted' || first?.answer !== 'noop' || input === undefined) return;
+    const live = observed?.read?.attributes as Record<string, unknown> | undefined;
+    const changed = changedFields(input.news, live);
+    if (live === undefined || changed.length === 0) return;
+    if (diff === undefined || node.state === undefined) return;
+    const olds = {
+      ...(input.olds as object),
+      ...Object.fromEntries(changed.map((key) => [key, live[key]])),
+    };
+    // ⚠️ THE CAST IS THE ENGINE'S BOUNDARY, as in verify.ts: the diff's requirements are the
+    //   session's, which verifySession provides around this call.
+    const asked = diff({ ...input, olds } as typeof input) as Effect.Effect<unknown>;
+    const answer: RecheckAnswer = yield* asked.pipe(
+      inPlanScope(fqn, node.state.instanceId),
+      Effect.map(diffAnswer),
+      Effect.catchCause(() => Effect.succeed('failed' as const)),
+    );
+    // The watched diff recorded the replay over the planner's answer; put the planner's back.
+    if (observed !== undefined) {
+      observed.diff = first;
+      observed.recheck = answer;
+    }
+  });