@homeflare/alchemy 0.10.0 → 0.11.0

package/docs/ownership.md

@@ -108,6 +108,6 @@ a declaration, so Apply leaves its object in place with a note instead of deleti
 - ⚠️ **`CaddyConfig` keeps its own probe.** A running config identical to the declaration reads as
   ours, because adopting it changes nothing Caddy serves ([caddy.md](./caddy.md#adoption)).
   `ProxmoxLxc` does not share that exception: its delete removes a guest and its volumes
-  ([proxmox-lxc.md](./proxmox-lxc.md#adopting-what-the-plan-says)).
+  ([proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md)).
 - ⚠️ **The other `@homeflare/alchemy/proxmox` resources do not follow this rule yet.** Those built
   on `pveHandlers` (`src/proxmox/resource.ts`) still read a live object with no state as ours.

package/docs/proxmox-lxc-adopt.md

@@ -0,0 +1,83 @@
+# Proxmox.Lxc — adopting a live guest
+
+The adoption half of [proxmox-lxc.md](./proxmox-lxc.md). Two rules, both decided 2026-09-21:
+
+1. ⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, not even one that matches the
+   declaration** — the kit-wide rule in [ownership.md](./ownership.md). Without either, the plan
+   fails with "Cannot adopt" and nothing is written. Matching is not proof the guest is yours: a
+   pasted config or a mistyped vmid reads the same, and once state claims a guest,
+   `RemovalPolicy.destroy()` deletes it and its volumes. `.pipe(adopt(false))` stays refused
+   under `--adopt`.
+2. ⛔ **An adoption never changes a guest.** It is taken over exactly as it runs, or not at all.
+   With adoption on, a declaration that differs from the live config in any key fails the plan:
+
+```
+CT 100 on pve1: adopting it would change memory, net1. An adoption never changes a guest, so
+nothing is written. Declare what is live for these keys (the plan names keys, never values) and
+plan again; change them after the adoption, as an update.
+```
+
+- **Keys are named, values never.** A live config can carry anything (`description` is where
+  people paste credentials), and plan output lands in CI logs.
+- **The fix is the declaration.** Copy the live value for each named key and plan again. A plan
+  that says `adopted` and fails nothing is the zero-change check: the deploy writes nothing (two
+  GETs), and the next plan is `noop`.
+- **To change the guest, adopt it first.** Once state holds it, a changed declaration is an
+  ordinary `update`, and its plan warns with each key the deploy writes:
+
+```
+Proxmox.Lxc pve1/100: live config differs from the declaration in memory -- a deploy writes these.
+```
+
+- **The deploy asks again.** A key edited by hand between the plan and the deploy is refused at
+  apply, with nothing written. The adoption's state row stays, and every plan refuses the same way
+  until the declaration says what is live. Then it adopts with no write.
+- **It comes before the other refusals.** A root@pam-only key, a smaller disk or an unprivileged
+  flip would print a declared value and a `pct set` to run. For an adoption the fix runs the other
+  way, so the adoption refusal is the one you see.
+
+★ **Why it is strict.** Alchemy 2.0.0-beta.79 plans a cold adoption as `adopted` whatever it would
+write, and prints no property diff for it. Until this rule, `diff` only logged the keys, and
+`deploy --adopt --yes` then wrote them: a `net0` pasted without the live `tag=` took the guest off
+its VLAN on the deploy that was meant to change nothing.
+
+⚠️ **`alchemy plan` has no `--adopt` flag** (2.0.0-beta.79: only `deploy` declares it). Without
+adoption on, the plan stops at "Cannot adopt" before the adoption check runs. To read the
+adoption's plan, run `alchemy deploy --adopt --dry-run`, or declare `.pipe(adopt(true))` and run
+`alchemy plan`.
+
+## What counts as an adoption
+
+State says, at plan and at apply alike (`src/ownership/adopting.ts`):
+
+| the guest reached state…                                                        | adoption? |
+| ------------------------------------------------------------------------------- | --------- |
+| through the adoption probe: no state for it, found live                         | yes       |
+| on the deploy after that probe, until the adoption commits                      | yes       |
+| through an interrupted create the plan could not prove its own, under `--adopt` | yes       |
+| through an interrupted create whose guest still matches what it wrote           | no        |
+| through this resource's own create, or an adoption that has committed           | no        |
+
+An interrupted create proven its own is not an adoption. If its declaration changed meanwhile, the
+deploy writes the change.
+
+## Creates that find a guest
+
+A deploy that planned a **create** never takes over a guest it then finds at that vmid (the plan
+skips its adoption read while a prop is an unresolved Output, and a guest can appear after the
+plan). Without adoption on, the deploy fails and forgets its `creating` row, so the next plan asks.
+With it on, a matching guest is recorded with no write; any other fails until a plan can show it.
+
+A create interrupted after its POST resumes on the next deploy **without** `--adopt` when the guest
+still matches what it declared. If someone changed it meanwhile, the plan says "Cannot resume
+creating". `--adopt` then adopts it as it now runs: declare what is live first.
+
+A guest the cluster no longer lists at all, with state still held, plans `update` and warns that
+the deploy **creates it again** from `ostemplate`, with new volumes. The plan fails instead when
+there is no `ostemplate`, or when `rootfs`/`mpN` are declared by live volume id (as a paste is):
+a create never reuses a volume.
+
+## Leases
+
+`GET …/config` needs `VM.Audit`, which the `read` lease has. A config PUT uses the cached
+`provision` lease. A create, resize or delete mints a fresh one and polls its task with it.

package/docs/proxmox-lxc.md

@@ -90,7 +90,8 @@ Every prop is the key and spelling PVE uses in `/nodes/{node}/lxc/{vmid}/config`
 
 The `digest` makes PVE refuse the write if the config changed since the deploy read it. ⚠️ That
 read is the deploy's, not the plan's: a declared key edited by hand between `plan` and `deploy`
-is written back to the declaration, even after a plan that warned of nothing.
+is written back to the declaration, even after a plan that warned of nothing. (An adoption
+refuses it instead.)
 
 On a running guest, PVE may keep a change as pending until the next restart. A read returns the
 pending value, so the plan still converges.
@@ -141,51 +142,12 @@ guest that needs `/dev/net/tun` (a Mesh door) or `/dev/dri` is created in two st
 - **Pool membership, HA, firewall rules, snapshots, replication** are not declared here. Use their
   own resources, or manage them by hand.
 
-## Adopting: what the plan says
+## Adopting
 
-⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, not even one that matches the
-declaration** — the kit-wide rule in [ownership.md](./ownership.md). Without either, the plan fails
-with "Cannot adopt" and nothing is written. Matching is not proof the guest is yours: a pasted
-config or a mistyped vmid reads the same, and once state claims a guest, `RemovalPolicy.destroy()`
-deletes it and its volumes. `.pipe(adopt(false))` stays refused under `--adopt`.
-
-With adoption on, a cold adoption plans **`adopted`** even when the deploy would write. Alchemy
-2.0.0-beta.79 forces an update after it adopts, and prints no property diff for that update. So
-`diff` logs a warning naming each key a deploy would write:
-
-```
-Proxmox.Lxc pve1/100: live config differs from the declaration in memory, net1 -- a deploy writes these.
-```
-
-- **No warning** means the declaration is the live config. The deploy writes nothing (two GETs),
-  and the next plan is `noop`. ★ That is the zero-change adoption check: read the plan first.
-- **A warning** means fix the declaration, or accept the named writes. Keys are named, values are
-  not.
-
-⛔ **A warning does not stop the deploy.** `deploy --adopt --yes` writes each named key onto the
-live guest. A `net0` declared without the live `tag=` is written without it, and the guest leaves
-its VLAN. Only the plan you read makes an adoption zero-change.
-
-⚠️ **`alchemy plan` has no `--adopt` flag** (2.0.0-beta.79: only `deploy` declares it). Without
-adoption on, the plan stops at "Cannot adopt" before `diff` can warn. To read the adoption's plan,
-run `alchemy deploy --adopt --dry-run`, or declare `.pipe(adopt(true))` and run `alchemy plan`.
-
-A deploy that planned a **create** never takes over a guest it then finds at that vmid (the plan
-skips its adoption read while a prop is an unresolved Output, and a guest can appear after the
-plan). Without adoption on, the deploy fails and forgets its `creating` row, so the next plan asks.
-With it on, a matching guest is recorded with no write; any other fails until a plan can show it.
-
-A create interrupted after its POST resumes on the next deploy **without** `--adopt` when the guest
-still matches what it declared. If someone changed it meanwhile, the plan says "Cannot resume
-creating", and `--adopt` resumes it (the warning names the keys it writes back).
-
-A guest the cluster no longer lists at all, with state still held, plans `update` and warns that
-the deploy **creates it again** from `ostemplate`, with new volumes. The plan fails instead when
-there is no `ostemplate`, or when `rootfs`/`mpN` are declared by live volume id (as a paste is):
-a create never reuses a volume.
-
-`GET …/config` needs `VM.Audit`, which the `read` lease has. A config PUT uses the cached
-`provision` lease. A create, resize or delete mints a fresh one and polls its task with it.
+⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, and an adoption never changes
+a guest.** It is taken over exactly as it runs, or the plan fails naming each key that differs.
+What the plan says, what counts as an adoption, and the leases each step uses:
+[proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md).
 
 ## Removing
 

package/docs/proxmox.md

@@ -8,5 +8,7 @@ or creates one from a template.
   flip or another template fails the plan. Destroy retains unless `RemovalPolicy.destroy()`.
 - ⛔ **It adopts nothing without `--adopt` or `adopt(true)`**, a matching guest included
   ([ownership.md](./ownership.md)): under `destroy`, a claimed guest's disks go with it.
+- ⛔ **An adoption never changes a guest.** Any key that differs from the live config fails the
+  plan, named without its value ([proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md)).
 - ⛔ **root@pam-only keys** (`devN`, bind mounts, features beyond `nesting`) are refused at plan,
   with the `pct set` to run instead. Guide: [proxmox-lxc.md](./proxmox-lxc.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/ownership/adopting.test.ts

@@ -0,0 +1,63 @@
+/**
+ * `adopting` answer by answer, against a store fixture: which rows make a call with attributes an
+ * adoption. `Proxmox.Lxc` pins the same answers end to end through the engine
+ * (proxmox/lxc-strict-adopt.test.ts, proxmox/lxc-ownership.test.ts).
+ */
+import { describe, expect, test } from 'bun:test';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import * as Effect from 'effect/Effect';
+import { adopting } from './adopting.ts';
+import { row, withStore } from './store-fixture.ts';
+
+const matches = () => Effect.succeed(true);
+const differs = () => Effect.succeed(false);
+const held = { name: 'a' };
+const owner = (instanceId: string, output: unknown = held) => ({ fqn: 'A', instanceId, output });
+const creating = { fqn: 'A', instanceId: 'probe', output: undefined };
+
+const recorded = (status: string, extra: Record<string, unknown> = {}): ResourceState =>
+  ({ ...row('A', 'mine'), attr: held, status, ...extra }) as unknown as ResourceState;
+
+describe('adopting', () => {
+  test("the probe's instance, which no row holds, is an adoption", async () => {
+    expect(await withStore({ A: recorded('created') }, adopting(owner('probe'), matches))).toBe(
+      true,
+    );
+  });
+
+  test("Apply's adoption row, and an interrupted one, stay adoptions until they commit", async () => {
+    const rows = { A: recorded('updating', { adopting: true }) };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('a row with attributes and no flag is state vouching for the object', async () => {
+    for (const status of ['created', 'updated', 'updating']) {
+      expect(await withStore({ A: recorded(status) }, adopting(owner('mine'), differs))).toBe(
+        false,
+      );
+    }
+  });
+
+  test('a recovered create is ours only when its whole row matches live', async () => {
+    const rows = { A: row('A', 'mine') };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(false);
+    expect(await withStore(rows, adopting(owner('mine'), differs))).toBe(true);
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('`settled` is asked with the props of the row that recorded the create', async () => {
+    const seen: unknown[] = [];
+    const spy = (props: unknown) => Effect.sync(() => (seen.push(props), true));
+    await withStore({ A: row('A', 'mine') }, adopting(owner('mine'), spy));
+    expect(seen).toEqual([{ name: 'a' }]);
+  });
+
+  test('a create (no attributes held) is never one; reconcile has its own rule', async () => {
+    expect(await withStore({}, adopting(creating, differs))).toBe(false);
+  });
+
+  test('outside a stack every call with attributes is an adoption — the strict answer', async () => {
+    expect(await Effect.runPromise(adopting(owner('mine'), matches))).toBe(true);
+  });
+});

package/src/ownership/adopting.ts

@@ -0,0 +1,46 @@
+/**
+ * Whether a `diff` or `reconcile` that holds attributes is looking at an ADOPTION — a live object
+ * that reached this stack's state by being FOUND, not by this resource's own create — so a family
+ * whose adoption must never change what it takes over (`Proxmox.Lxc`) can refuse any difference
+ * instead of writing it. adopt.ts and probe.ts decide WHETHER an object may be claimed; this says,
+ * once it is claimed, whether the claim is an adoption.
+ *
+ * ★ STATE ALREADY SAYS WHICH, AT BOTH HALVES OF A DEPLOY (alchemy 2.0.0-beta.79):
+ *   · PLAN, A COLD ADOPTION. The probe mints an instance id no row can hold (Plan.ts
+ *     `generateInstanceId()`), and `diff` then runs with that id and the attributes the probe
+ *     read. So no row holds the id.
+ *   · APPLY, THE SAME ADOPTION. Apply commits an `updating` row with `adopting: true` under that id
+ *     BEFORE it calls reconcile, and the flag stays until the update commits (Apply.ts). An
+ *     adoption whose apply was interrupted keeps it, so the next plan's `diff` sees it too.
+ *   · A RECOVERED CREATE. A `creating` row with no attributes, whose live object the recovery read
+ *     found. It is this resource's own create when the row proves it (probe.ts `provenOurs`, the
+ *     same proof the read asked). Otherwise the plan went on only because `--adopt` said so — an
+ *     adoption like any other.
+ *   · Any other row with attributes is state vouching for the object: not an adoption.
+ * ⚠️ OUTSIDE A STACK — no Stack or State in context, or a store that errors (rows.ts) — no row
+ *   holds anything, so every call is an adoption: the strict answer, never the permissive one. A
+ *   family then refuses an ordinary update's write as if it were an adoption's. `alchemy deploy`
+ *   and the Alchemist session provide both services.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { provenOurs } from './probe.ts';
+import { recordedGeneration } from './rows.ts';
+
+/**
+ * Whether `owner`'s call is an adoption (header). `settled` is the family's "live matches these
+ * props", asked only for a recovered create, with the props of the row that recorded it.
+ * ⛔ A CREATE IS NEVER ONE HERE. `output` undefined is reconcile's create path, which has its own
+ *   rule for a live object it finds (adopt.ts `refuseTakeover`).
+ */
+export const adopting = <E, R>(
+  owner: Owner,
+  settled: (recorded: unknown) => Effect.Effect<boolean, E, R>,
+): Effect.Effect<boolean, never, R> =>
+  Effect.gen(function* () {
+    if (owner.output === undefined) return false;
+    const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
+    if (generation === undefined || generation.adopting === true) return true;
+    if (generation.attr !== undefined && generation.attr !== null) return false;
+    return !(yield* provenOurs(owner, settled(generation.props)));
+  });

package/src/ownership/ownership.test.ts

@@ -7,46 +7,13 @@
 import { describe, expect, test } from 'bun:test';
 import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
 import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
-import { InMemoryService } from 'alchemy/State/InMemoryState';
 import type { ResourceState } from 'alchemy/State/ResourceState';
-import { State } from 'alchemy/State/State';
-import { Stack } from 'alchemy/Stack';
 import * as Effect from 'effect/Effect';
 import { refuseTakeover } from './adopt.ts';
 import { ownedRead } from './probe.ts';
 import { noteResume, noteUnfinished, resumes } from './resume.ts';
 import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
-
-const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
-  ({
-    fqn,
-    instanceId,
-    old,
-    props,
-    status: old === undefined ? 'creating' : 'replacing',
-  }) as unknown as ResourceState;
-
-/**
- * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
- * declared `renamedFrom('X')`.
- */
-const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
-  Effect.runPromise(
-    effect.pipe(
-      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
-      Effect.provideService(Stack, {
-        actions: {},
-        bindings: {},
-        name: 's',
-        resources: {
-          A: { Props: { name: 'a' } },
-          B: { Props: { name: 'b' } },
-          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
-        },
-        stage: 'test',
-      } as never),
-    ),
-  );
+import { row, withStore } from './store-fixture.ts';
 
 describe('recordedInstance', () => {
   test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {

package/src/ownership/probe.ts

@@ -28,29 +28,28 @@ import type { Owner } from './adopt.ts';
 import { recordedInstance } from './rows.ts';
 
 /**
- * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
- * or the recovery read (header): `found` is ours only when the state store records this instance
- * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
- * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ * Whether the state store proves the live object this instance's own: a row records `ask.instanceId`
+ * with its whole declaration (whole.ts) AND `settled` — the family's own "live matches these props"
+ * — says so. The one proof ownership/ accepts for a live object state holds no attributes for; the
+ * recovery read (`ownedRead`) and an adoption check (adopting.ts) both ask it.
+ * ⛔ `settled` NEVER FAILS THE CALLER. The recovery read runs with the INTERRUPTED deploy's props, so
  *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
  *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
- *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ *   ours" instead, with the reason logged.
  */
-export const ownedRead = <A extends object, E, R>(
-  ask: Owner,
-  found: A | undefined,
+export const provenOurs = <E, R>(
+  ask: { readonly fqn: string; readonly instanceId: string },
   settled: Effect.Effect<boolean, E, R>,
-): Effect.Effect<A | undefined, never, R> =>
+): Effect.Effect<boolean, never, R> =>
   Effect.gen(function* () {
-    if (found === undefined || ask.output !== undefined) return found;
     const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
-    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'absent') return false;
     if (recorded === 'partial') {
       yield* Effect.logWarning(
         `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
           'was still an Output when it was written), so the live object is not proven ours',
       );
-      return Unowned(found);
+      return false;
     }
     const unproven = (reason: unknown) =>
       Effect.as(
@@ -60,6 +59,20 @@ export const ownedRead = <A extends object, E, R>(
         ),
         false,
       );
-    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
-    return ours ? found : Unowned(found);
+    return yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+  });
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when `provenOurs` says so, else `Unowned`,
+ * which `--adopt` resolves.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    return (yield* provenOurs(ask, settled)) ? found : Unowned(found);
   });

package/src/ownership/rows.ts

@@ -31,12 +31,15 @@ const storeOf = Effect.gen(function* () {
 const rowAt = (store: StateService, where: Where, fqn: string) =>
   store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));
 
-type Generation = {
+/** One generation of a persisted row, as far as ownership/ reads it. */
+export type Generation = {
   readonly instanceId?: unknown;
   readonly status?: unknown;
   readonly props?: unknown;
   readonly attr?: unknown;
   readonly old?: unknown;
+  /** Set by Apply on the `updating` row of an adoption, until that update commits (Apply.ts). */
+  readonly adopting?: unknown;
 };
 
 /** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */
@@ -51,7 +54,10 @@ const generationOf = (row: unknown, instanceId: string): Generation | undefined
 };
 
 /** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */
-const recordedGeneration = (fqn: string, instanceId: string) =>
+export const recordedGeneration = (
+  fqn: string,
+  instanceId: string,
+): Effect.Effect<Generation | undefined> =>
   Effect.gen(function* () {
     const found = yield* storeOf;
     if (found === undefined) return undefined;

package/src/ownership/store-fixture.ts

@@ -0,0 +1,50 @@
+/**
+ * A state store and a Stack for the ownership/ unit tests — the two services rows.ts reads.
+ *
+ * ⛔ TEST-ONLY. No provider imports this file and it is not on any barrel.
+ */
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+
+/** A row with no attributes: `creating`, or `replacing` when it carries an `old` generation. */
+export const row = (
+  fqn: string,
+  instanceId: string,
+  old?: unknown,
+  props: unknown = { name: 'a' },
+): ResourceState =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+export const withStore = <A>(
+  rows: Record<string, ResourceState>,
+  effect: Effect.Effect<A>,
+): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );

package/src/proxmox/ceph-pool-adopt.test.ts

@@ -73,6 +73,38 @@ describe('adopting a Ceph pool', () => {
     expect(fake.calls.every((call) => call.path === STATUS)).toBe(true);
   });
 
+  /**
+   * ★ THE RECHECK MUST NOT FAIL A FIELD THE FAMILY DOES NOT MANAGE. `pg_num` is create-time only and
+   *   the autoscaler owns it, so a declared birth size differs from the live count and shows under
+   *   `changed`. recheck.ts asks the diff again with the live value as recorded props; this diff
+   *   re-reads the cluster and ignores `olds`, so it says `noop` again, and the deploy only reads.
+   */
+  test('declaring a field it does not manage: rechecked, still noop, and the deploy only reads', async () => {
+    const fake = cluster(3);
+    const birth = () =>
+      ProxmoxCephPool('cephtb4', {
+        min_size: 2,
+        name: 'cephtb4',
+        node: 'n2',
+        pg_num: 32,
+        size: 3,
+        target: FAKE_TARGET,
+      });
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(birth());
+      expect(report.rows[0]).toMatchObject({
+        changed: ['pg_num'],
+        diff: 'noop',
+        ok: true,
+        recheck: 'noop',
+      });
+      expect(report.rows[0]?.why).toContain('does not manage');
+      expect(await engine.deploy(birth())).toEqual({ cephtb4: 'adopted' });
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
   test('that drifted: the verifier names the field, and the deploy PUTs once', async () => {
     const fake = cluster(2);
     await withoutBao(async () => {

package/src/proxmox/fake-pve-lxc.ts

@@ -34,6 +34,11 @@ export type FakePve = {
    * keyed `node/vmid` — a guest that appears between a plan and its deploy.
    */
   readonly vanish: Map<string, number>;
+  /**
+   * Hand edits that land mid-deploy, keyed `node/vmid`: once that guest's config has been read
+   * `after` more times, `set` is merged into it — a change made between a plan and its apply.
+   */
+  readonly edits: Map<string, { after: number; readonly set: Record<string, unknown> }>;
   /** Config keys a `PUT …/config` accepts with 200 and then does not store. */
   readonly ignore: Set<string>;
   /** How every task ends, and whether a task-starting call answers with no UPID at all. */
@@ -90,6 +95,7 @@ export const fakePve = (): FakePve => {
   const others: { vmid: number | string; node: string; type: string }[] = [];
   const configErrors = new Map<string, { status: number; body: unknown }>();
   const vanish = new Map<string, number>();
+  const edits: FakePve['edits'] = new Map();
   const ignore = new Set<string>();
   const task = { exit: 'OK', noUpid: false };
   const seen: Seen[] = [];
@@ -148,7 +154,12 @@ export const fakePve = (): FakePve => {
       const message = `Configuration file 'nodes/${node}/lxc/${vmid}.conf' does not exist\n`;
       return json({ data: null, message }, 500);
     }
-    if (tail === '/config' && request.method === 'GET') return json({ data: config });
+    if (tail === '/config' && request.method === 'GET') {
+      const answer = json({ data: config });
+      const edit = edits.get(`${node}/${vmid}`);
+      if (edit !== undefined && --edit.after === 0) Object.assign(config, edit.set);
+      return answer;
+    }
     if (tail === '/config' && request.method === 'PUT') {
       const digest = form.get('digest');
       if (digest !== null && digest !== config['digest']) {
@@ -192,6 +203,7 @@ export const fakePve = (): FakePve => {
   };
   return {
     configErrors,
+    edits,
     fetch: Object.assign(remapped, { preconnect: globalThis.fetch.preconnect }),
     guests,
     ignore,

package/src/proxmox/lxc-adopt.test.ts

@@ -4,28 +4,20 @@
  *
  * ⛔ WHAT THESE PIN: a declaration pasted from the live config plans `adopted` with no warning,
  *   its deploy writes NOTHING, and the next plan is `noop`; the create spellings (`storage:size`,
- *   a NIC without its MAC) adopt as cleanly; drift is named at plan and written as one PUT that
- *   keeps the live MAC and carries the digest; and every change PVE cannot make in place fails the
- *   plan with nothing written. Deleting both empty-change guards (reconcile's in lxc.ts and
- *   `updateGuest`'s in lxc-lifecycle.ts), or the hwaddr carry in lxc-wire.ts, fails a test here —
- *   each MEASURED by making that edit and running this file, 2026-09-21.
+ *   a NIC without its MAC) adopt as cleanly; after that adoption, drift is named at plan and
+ *   written as one PUT that keeps the live MAC and carries the digest; and every change PVE cannot
+ *   make in place fails the plan with nothing written. Deleting both empty-change guards
+ *   (reconcile's in lxc.ts and `updateGuest`'s in lxc-lifecycle.ts), or the hwaddr carry in
+ *   lxc-wire.ts, fails a test here — each MEASURED by making that edit and running this file,
+ *   2026-09-21. An adoption that WOULD write fails instead: lxc-strict-adopt.test.ts.
  */
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { NODE, TARGET, VMID, adoptedAsIs, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-
-/** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
-const pasted = (): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID };
-};
-
 const ct = (props: LxcProps) => ProxmoxLxc('ct', props).pipe(adopt(true));
 
 let fake: FakePve | undefined;
@@ -84,17 +76,17 @@ describe('adopting a live container', () => {
   });
 });
 
-describe('drift at adoption is named at plan and written once', () => {
+describe('drift after the adoption is named at plan and written once', () => {
   test('memory and an MTU change: one PUT, the live MAC kept, the digest carried', async () => {
     const pve = live();
-    const stack = lxcEngine(pve);
+    const stack = await adoptedAsIs(pve);
     const props: LxcProps = {
       ...pasted(),
       memory: 4096,
       net1: 'name=eth1,bridge=vmbr1,ip=198.51.100.4/24,mtu=9000',
     };
     const planned = await stack.plan(ct(props));
-    expect(planned.actions).toEqual({ ct: 'adopted' });
+    expect(planned.actions).toEqual({ ct: 'update' });
     expect(planned.warnings.join('\n')).toContain('differs from the declaration in memory, net1');
     expect((await stack.deploy(ct(props))).failure).toBe('');
     expect(writesOf(pve)).toEqual([`PUT nodes/${NODE}/lxc/${String(VMID)}/config`]);
@@ -107,7 +99,7 @@ describe('drift at adoption is named at plan and written once', () => {
 
   test('a larger rootfs is a resize after the config, never a new volume', async () => {
     const pve = live();
-    const stack = lxcEngine(pve);
+    const stack = await adoptedAsIs(pve);
     const props: LxcProps = { ...pasted(), rootfs: 'local-zfs:subvol-100-disk-0,size=64G' };
     expect((await stack.deploy(ct(props))).failure).toBe('');
     expect(writesOf(pve)).toEqual([`PUT nodes/${NODE}/lxc/${String(VMID)}/resize`]);
@@ -125,7 +117,8 @@ describe('changes PVE cannot make in place fail the plan and write nothing', ()
     ['detaching a mount point', { mp0: '' }, /unusedN/],
   ])('%s', async (_, change, reason) => {
     const pve = live();
-    const run = await lxcEngine(pve).deploy(ct({ ...pasted(), ...change } as LxcProps));
+    const stack = await adoptedAsIs(pve);
+    const run = await stack.deploy(ct({ ...pasted(), ...change } as LxcProps));
     expect(run.failure).toMatch(reason);
     expect(writesOf(pve)).toEqual([]);
   });