@homeflare/alchemy 0.10.1 → 0.11.0

package/dist/proxmox/lxc-adoption.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The strict adoption gate for `Proxmox.Lxc`: AN ADOPTION NEVER CHANGES A GUEST (decided
+ * 2026-09-21). A guest this stack adopts — no recorded instance, or one the plan only kept because
+ * `--adopt` said so (ownership/adopting.ts) — is taken over exactly as it runs, or not at all.
+ *
+ * ⛔ ANY DIFFERENCE FAILS, AT PLAN AND AGAIN AT APPLY. Before this, a cold adoption planned `adopted`
+ *   whatever it would write (alchemy beta.79 prints no property diff for it) and only LOGGED the
+ *   keys; `deploy --adopt --yes` then wrote them. A `net0` pasted without the live `tag=` moved the
+ *   guest off its VLAN on the deploy that was meant to change nothing. Now the plan fails naming
+ *   the keys, and reconcile re-asks against a fresh read, so a hand edit between plan and deploy
+ *   is refused too rather than written back.
+ * ⛔ KEYS ONLY, NEVER VALUES. The refusal names what differs and nothing it differs by: a live
+ *   config can carry anything (`description` is where people paste credentials), and plan output
+ *   lands in CI logs.
+ * ★ ASKED BEFORE `judge`'s OWN REFUSALS. Those name a declared value (the `pct set` to run), and
+ *   for an adoption the fix is the other direction: declare what is live.
+ * ★ THE STORE IS READ ONLY WHEN SOMETHING DIFFERS. A clean adoption — the only kind that proceeds
+ *   — costs nothing here.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from '../ownership/adopt.ts';
+import { type LxcChange } from './lxc-judge.ts';
+import { LxcRefusedError } from './lxc-lifecycle.ts';
+import type { LxcProps } from './lxc-props.ts';
+/** The refusal: keys, where, and what to do — never a value. */
+export declare const adoptionRefusal: (props: LxcProps, drift: readonly string[]) => string;
+/**
+ * Fails with `adoptionRefusal` when `change` would write to a guest `owner`'s call adopts.
+ * `settled` for a recovered create is the same judge, of the recording row's props against `live`.
+ */
+export declare const refuseAdoptedDrift: (owner: Owner, props: LxcProps, live: Record<string, unknown>, change: LxcChange) => Effect.Effect<void, LxcRefusedError>;
+//# sourceMappingURL=lxc-adoption.d.ts.map

package/dist/proxmox/lxc-adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lxc-adoption.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,eAAe,UAAW,QAAQ,SAAS,SAAS,MAAM,EAAE,KAAG,MAIjE,CAAC;AAEZ;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UACtB,KAAK,SACL,QAAQ,QACT,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,UACrB,SAAS,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAOlC,CAAC"}

package/dist/proxmox/lxc-harness.d.ts

@@ -1,6 +1,7 @@
 import * as Effect from 'effect/Effect';
 import type { PveTarget } from './credentials.ts';
 import { type FakePve } from './fake-pve-lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
 export declare const TARGET: PveTarget;
 /**
  * A PRODUCTION-SHAPED config — the same keys and the same spellings pvesh printed, PVE's defaults
@@ -10,6 +11,12 @@ export declare const TARGET: PveTarget;
  *   the estate's real topology — sizes, VLANs and bridges included, not only addresses.
  */
 export declare const LIVE: Readonly<Record<string, unknown>>;
+/** Where `seed` puts the production-shaped guest by default, and its `node/vmid` key. */
+export declare const NODE = "pve1";
+export declare const VMID = 100;
+export declare const KEY: string;
+/** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
+export declare const pasted: (over?: Partial<LxcProps>) => LxcProps;
 /** Put `config` live on the fake as `node/vmid`, with a digest as PVE would add. */
 export declare const seed: (fake: FakePve, node: string, vmid: number, config?: Readonly<Record<string, unknown>>) => void;
 /** What the CLI would set for one run: `adopt` is `--adopt`. */
@@ -31,4 +38,9 @@ export declare const lxcEngine: (fake: FakePve) => {
     /** The stored row's status, or undefined when there is none. */
     status: (fqn: string) => "created" | "creating" | "deleting" | "replaced" | "replacing" | "updated" | "updating" | undefined;
 };
+/**
+ * The engine, with the guest `seed` put at NODE/VMID adopted exactly as it runs — the only adoption
+ * that proceeds (lxc-adoption.ts) — so a test can go on to change it, as an ordinary update.
+ */
+export declare const adoptedAsIs: (pve: FakePve) => Promise<ReturnType<typeof lxcEngine>>;
 //# sourceMappingURL=lxc-harness.d.ts.map

package/dist/proxmox/lxc-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc-harness.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-harness.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGxE,eAAO,MAAM,MAAM,EAAE,SAIpB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBlD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,IAAI,SAAU,OAAO,QAAQ,MAAM,QAAQ,MAAM,qDAE7D,CAAC;AAQF,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,GAAG,GAAG;IAChB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAIF,eAAO,MAAM,SAAS,SAAU,OAAO;IA8CnC,yFAAyF;IACzF,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE7E,wBAAwB;IACxB,MAAM,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE/E,gEAAgE;IAChE,MAAM,QAAQ,MAAM;CAEvB,CAAC"}
+{"version":3,"file":"lxc-harness.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc-harness.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C,eAAO,MAAM,MAAM,EAAE,SAIpB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBlD,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,IAAI,SAAS,CAAC;AAC3B,eAAO,MAAM,IAAI,MAAM,CAAC;AACxB,eAAO,MAAM,GAAG,QAA4B,CAAC;AAE7C,6FAA6F;AAC7F,eAAO,MAAM,MAAM,UAAU,OAAO,CAAC,QAAQ,CAAC,KAAQ,QAGrD,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,IAAI,SAAU,OAAO,QAAQ,MAAM,QAAQ,MAAM,qDAE7D,CAAC;AAQF,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,GAAG,GAAG;IAChB,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAIF,eAAO,MAAM,SAAS,SAAU,OAAO;IA8CnC,yFAAyF;IACzF,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE7E,wBAAwB;IACxB,MAAM,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,YAAW,UAAU;IAE/E,gEAAgE;IAChE,MAAM,QAAQ,MAAM;CAEvB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAe,OAAO,KAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAKpF,CAAC"}

package/dist/proxmox/lxc.d.ts

@@ -17,11 +17,11 @@
  * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only
  *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.
  *
- * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a
- *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)
- *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name
- *   (never by value), as a warning — the only place a plan can say the declaration is not the live
- *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).
+ * ⛔ AND AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts). A guest this stack adopts is taken
+ *   over exactly as it runs: any key the declaration says otherwise FAILS the plan, by name (never
+ *   by value), and reconcile asks again before it would write. Only an exact match adopts.
+ * ⚠️ AN UPDATE STILL PLANS `update` WITHOUT A PROPERTY DIFF, so `diff` LOGS the keys a deploy would
+ *   write, by name, as a warning — the only place a plan says what the deploy will change.
  *
  * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for
  *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.

package/dist/proxmox/lxc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAiB7C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,6CAA0E,CAAC;AA4KlG,eAAO,MAAM,kBAAkB,gIAI5B,CAAC"}
+{"version":3,"file":"lxc.d.ts","sourceRoot":"","sources":["../../src/proxmox/lxc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAkB7C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,8FAA8F;AAC9F,eAAO,MAAM,UAAU,6CAA0E,CAAC;AA+KlG,eAAO,MAAM,kBAAkB,gIAI5B,CAAC"}

package/docs/adopted-deploys.md

@@ -57,8 +57,10 @@ lease (`readRole`, resource.ts). That is still a read.
 ² The PVE notification endpoints: `smtp` (the mail target), `sendmail`, `gotify`, `webhook`. The
 secrets are never props (notification-target.ts), so no write is ever needed to "reset" them.
 ³ Rewritten 2026-09-21 (PR 80, [proxmox-lxc.md](./proxmox-lxc.md)): its own reconcile, and its
-probe answers `Unowned`, so the deploy needs `--adopt`. Its `diff` also logs the keys a deploy
-would write, by name. Pinned by `src/proxmox/lxc-adopt.test.ts` ("deploys with no write").
+probe answers `Unowned`, so the deploy needs `--adopt`. An adoption that would write fails the
+plan instead, naming the keys ([proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md)), so only the
+no-write row applies. Pinned by `src/proxmox/lxc-adopt.test.ts` ("deploys with no write") and
+`src/proxmox/lxc-strict-adopt.test.ts`.
 ⁴ `updateBody` sends `target_size_ratio`, but `matches` does not compare it (float equality). A
 declared ratio that differs from the live one is never written on a no-op adoption and never
 reported as a diff.

package/docs/ownership.md

@@ -108,6 +108,6 @@ a declaration, so Apply leaves its object in place with a note instead of deleti
 - ⚠️ **`CaddyConfig` keeps its own probe.** A running config identical to the declaration reads as
   ours, because adopting it changes nothing Caddy serves ([caddy.md](./caddy.md#adoption)).
   `ProxmoxLxc` does not share that exception: its delete removes a guest and its volumes
-  ([proxmox-lxc.md](./proxmox-lxc.md#adopting-what-the-plan-says)).
+  ([proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md)).
 - ⚠️ **The other `@homeflare/alchemy/proxmox` resources do not follow this rule yet.** Those built
   on `pveHandlers` (`src/proxmox/resource.ts`) still read a live object with no state as ours.

package/docs/proxmox-lxc-adopt.md

@@ -0,0 +1,83 @@
+# Proxmox.Lxc — adopting a live guest
+
+The adoption half of [proxmox-lxc.md](./proxmox-lxc.md). Two rules, both decided 2026-09-21:
+
+1. ⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, not even one that matches the
+   declaration** — the kit-wide rule in [ownership.md](./ownership.md). Without either, the plan
+   fails with "Cannot adopt" and nothing is written. Matching is not proof the guest is yours: a
+   pasted config or a mistyped vmid reads the same, and once state claims a guest,
+   `RemovalPolicy.destroy()` deletes it and its volumes. `.pipe(adopt(false))` stays refused
+   under `--adopt`.
+2. ⛔ **An adoption never changes a guest.** It is taken over exactly as it runs, or not at all.
+   With adoption on, a declaration that differs from the live config in any key fails the plan:
+
+```
+CT 100 on pve1: adopting it would change memory, net1. An adoption never changes a guest, so
+nothing is written. Declare what is live for these keys (the plan names keys, never values) and
+plan again; change them after the adoption, as an update.
+```
+
+- **Keys are named, values never.** A live config can carry anything (`description` is where
+  people paste credentials), and plan output lands in CI logs.
+- **The fix is the declaration.** Copy the live value for each named key and plan again. A plan
+  that says `adopted` and fails nothing is the zero-change check: the deploy writes nothing (two
+  GETs), and the next plan is `noop`.
+- **To change the guest, adopt it first.** Once state holds it, a changed declaration is an
+  ordinary `update`, and its plan warns with each key the deploy writes:
+
+```
+Proxmox.Lxc pve1/100: live config differs from the declaration in memory -- a deploy writes these.
+```
+
+- **The deploy asks again.** A key edited by hand between the plan and the deploy is refused at
+  apply, with nothing written. The adoption's state row stays, and every plan refuses the same way
+  until the declaration says what is live. Then it adopts with no write.
+- **It comes before the other refusals.** A root@pam-only key, a smaller disk or an unprivileged
+  flip would print a declared value and a `pct set` to run. For an adoption the fix runs the other
+  way, so the adoption refusal is the one you see.
+
+★ **Why it is strict.** Alchemy 2.0.0-beta.79 plans a cold adoption as `adopted` whatever it would
+write, and prints no property diff for it. Until this rule, `diff` only logged the keys, and
+`deploy --adopt --yes` then wrote them: a `net0` pasted without the live `tag=` took the guest off
+its VLAN on the deploy that was meant to change nothing.
+
+⚠️ **`alchemy plan` has no `--adopt` flag** (2.0.0-beta.79: only `deploy` declares it). Without
+adoption on, the plan stops at "Cannot adopt" before the adoption check runs. To read the
+adoption's plan, run `alchemy deploy --adopt --dry-run`, or declare `.pipe(adopt(true))` and run
+`alchemy plan`.
+
+## What counts as an adoption
+
+State says, at plan and at apply alike (`src/ownership/adopting.ts`):
+
+| the guest reached state…                                                        | adoption? |
+| ------------------------------------------------------------------------------- | --------- |
+| through the adoption probe: no state for it, found live                         | yes       |
+| on the deploy after that probe, until the adoption commits                      | yes       |
+| through an interrupted create the plan could not prove its own, under `--adopt` | yes       |
+| through an interrupted create whose guest still matches what it wrote           | no        |
+| through this resource's own create, or an adoption that has committed           | no        |
+
+An interrupted create proven its own is not an adoption. If its declaration changed meanwhile, the
+deploy writes the change.
+
+## Creates that find a guest
+
+A deploy that planned a **create** never takes over a guest it then finds at that vmid (the plan
+skips its adoption read while a prop is an unresolved Output, and a guest can appear after the
+plan). Without adoption on, the deploy fails and forgets its `creating` row, so the next plan asks.
+With it on, a matching guest is recorded with no write; any other fails until a plan can show it.
+
+A create interrupted after its POST resumes on the next deploy **without** `--adopt` when the guest
+still matches what it declared. If someone changed it meanwhile, the plan says "Cannot resume
+creating". `--adopt` then adopts it as it now runs: declare what is live first.
+
+A guest the cluster no longer lists at all, with state still held, plans `update` and warns that
+the deploy **creates it again** from `ostemplate`, with new volumes. The plan fails instead when
+there is no `ostemplate`, or when `rootfs`/`mpN` are declared by live volume id (as a paste is):
+a create never reuses a volume.
+
+## Leases
+
+`GET …/config` needs `VM.Audit`, which the `read` lease has. A config PUT uses the cached
+`provision` lease. A create, resize or delete mints a fresh one and polls its task with it.

package/docs/proxmox-lxc.md

@@ -90,7 +90,8 @@ Every prop is the key and spelling PVE uses in `/nodes/{node}/lxc/{vmid}/config`
 
 The `digest` makes PVE refuse the write if the config changed since the deploy read it. ⚠️ That
 read is the deploy's, not the plan's: a declared key edited by hand between `plan` and `deploy`
-is written back to the declaration, even after a plan that warned of nothing.
+is written back to the declaration, even after a plan that warned of nothing. (An adoption
+refuses it instead.)
 
 On a running guest, PVE may keep a change as pending until the next restart. A read returns the
 pending value, so the plan still converges.
@@ -141,51 +142,12 @@ guest that needs `/dev/net/tun` (a Mesh door) or `/dev/dri` is created in two st
 - **Pool membership, HA, firewall rules, snapshots, replication** are not declared here. Use their
   own resources, or manage them by hand.
 
-## Adopting: what the plan says
+## Adopting
 
-⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, not even one that matches the
-declaration** — the kit-wide rule in [ownership.md](./ownership.md). Without either, the plan fails
-with "Cannot adopt" and nothing is written. Matching is not proof the guest is yours: a pasted
-config or a mistyped vmid reads the same, and once state claims a guest, `RemovalPolicy.destroy()`
-deletes it and its volumes. `.pipe(adopt(false))` stays refused under `--adopt`.
-
-With adoption on, a cold adoption plans **`adopted`** even when the deploy would write. Alchemy
-2.0.0-beta.79 forces an update after it adopts, and prints no property diff for that update. So
-`diff` logs a warning naming each key a deploy would write:
-
-```
-Proxmox.Lxc pve1/100: live config differs from the declaration in memory, net1 -- a deploy writes these.
-```
-
-- **No warning** means the declaration is the live config. The deploy writes nothing (two GETs),
-  and the next plan is `noop`. ★ That is the zero-change adoption check: read the plan first.
-- **A warning** means fix the declaration, or accept the named writes. Keys are named, values are
-  not.
-
-⛔ **A warning does not stop the deploy.** `deploy --adopt --yes` writes each named key onto the
-live guest. A `net0` declared without the live `tag=` is written without it, and the guest leaves
-its VLAN. Only the plan you read makes an adoption zero-change.
-
-⚠️ **`alchemy plan` has no `--adopt` flag** (2.0.0-beta.79: only `deploy` declares it). Without
-adoption on, the plan stops at "Cannot adopt" before `diff` can warn. To read the adoption's plan,
-run `alchemy deploy --adopt --dry-run`, or declare `.pipe(adopt(true))` and run `alchemy plan`.
-
-A deploy that planned a **create** never takes over a guest it then finds at that vmid (the plan
-skips its adoption read while a prop is an unresolved Output, and a guest can appear after the
-plan). Without adoption on, the deploy fails and forgets its `creating` row, so the next plan asks.
-With it on, a matching guest is recorded with no write; any other fails until a plan can show it.
-
-A create interrupted after its POST resumes on the next deploy **without** `--adopt` when the guest
-still matches what it declared. If someone changed it meanwhile, the plan says "Cannot resume
-creating", and `--adopt` resumes it (the warning names the keys it writes back).
-
-A guest the cluster no longer lists at all, with state still held, plans `update` and warns that
-the deploy **creates it again** from `ostemplate`, with new volumes. The plan fails instead when
-there is no `ostemplate`, or when `rootfs`/`mpN` are declared by live volume id (as a paste is):
-a create never reuses a volume.
-
-`GET …/config` needs `VM.Audit`, which the `read` lease has. A config PUT uses the cached
-`provision` lease. A create, resize or delete mints a fresh one and polls its task with it.
+⛔ **No live guest is adopted without `adopt(true)` or `--adopt`, and an adoption never changes
+a guest.** It is taken over exactly as it runs, or the plan fails naming each key that differs.
+What the plan says, what counts as an adoption, and the leases each step uses:
+[proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md).
 
 ## Removing
 

package/docs/proxmox.md

@@ -8,5 +8,7 @@ or creates one from a template.
   flip or another template fails the plan. Destroy retains unless `RemovalPolicy.destroy()`.
 - ⛔ **It adopts nothing without `--adopt` or `adopt(true)`**, a matching guest included
   ([ownership.md](./ownership.md)): under `destroy`, a claimed guest's disks go with it.
+- ⛔ **An adoption never changes a guest.** Any key that differs from the live config fails the
+  plan, named without its value ([proxmox-lxc-adopt.md](./proxmox-lxc-adopt.md)).
 - ⛔ **root@pam-only keys** (`devN`, bind mounts, features beyond `nesting`) are refused at plan,
   with the `pct set` to run instead. Guide: [proxmox-lxc.md](./proxmox-lxc.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/ownership/adopting.test.ts

@@ -0,0 +1,63 @@
+/**
+ * `adopting` answer by answer, against a store fixture: which rows make a call with attributes an
+ * adoption. `Proxmox.Lxc` pins the same answers end to end through the engine
+ * (proxmox/lxc-strict-adopt.test.ts, proxmox/lxc-ownership.test.ts).
+ */
+import { describe, expect, test } from 'bun:test';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import * as Effect from 'effect/Effect';
+import { adopting } from './adopting.ts';
+import { row, withStore } from './store-fixture.ts';
+
+const matches = () => Effect.succeed(true);
+const differs = () => Effect.succeed(false);
+const held = { name: 'a' };
+const owner = (instanceId: string, output: unknown = held) => ({ fqn: 'A', instanceId, output });
+const creating = { fqn: 'A', instanceId: 'probe', output: undefined };
+
+const recorded = (status: string, extra: Record<string, unknown> = {}): ResourceState =>
+  ({ ...row('A', 'mine'), attr: held, status, ...extra }) as unknown as ResourceState;
+
+describe('adopting', () => {
+  test("the probe's instance, which no row holds, is an adoption", async () => {
+    expect(await withStore({ A: recorded('created') }, adopting(owner('probe'), matches))).toBe(
+      true,
+    );
+  });
+
+  test("Apply's adoption row, and an interrupted one, stay adoptions until they commit", async () => {
+    const rows = { A: recorded('updating', { adopting: true }) };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('a row with attributes and no flag is state vouching for the object', async () => {
+    for (const status of ['created', 'updated', 'updating']) {
+      expect(await withStore({ A: recorded(status) }, adopting(owner('mine'), differs))).toBe(
+        false,
+      );
+    }
+  });
+
+  test('a recovered create is ours only when its whole row matches live', async () => {
+    const rows = { A: row('A', 'mine') };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(false);
+    expect(await withStore(rows, adopting(owner('mine'), differs))).toBe(true);
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('`settled` is asked with the props of the row that recorded the create', async () => {
+    const seen: unknown[] = [];
+    const spy = (props: unknown) => Effect.sync(() => (seen.push(props), true));
+    await withStore({ A: row('A', 'mine') }, adopting(owner('mine'), spy));
+    expect(seen).toEqual([{ name: 'a' }]);
+  });
+
+  test('a create (no attributes held) is never one; reconcile has its own rule', async () => {
+    expect(await withStore({}, adopting(creating, differs))).toBe(false);
+  });
+
+  test('outside a stack every call with attributes is an adoption — the strict answer', async () => {
+    expect(await Effect.runPromise(adopting(owner('mine'), matches))).toBe(true);
+  });
+});

package/src/ownership/adopting.ts

@@ -0,0 +1,46 @@
+/**
+ * Whether a `diff` or `reconcile` that holds attributes is looking at an ADOPTION — a live object
+ * that reached this stack's state by being FOUND, not by this resource's own create — so a family
+ * whose adoption must never change what it takes over (`Proxmox.Lxc`) can refuse any difference
+ * instead of writing it. adopt.ts and probe.ts decide WHETHER an object may be claimed; this says,
+ * once it is claimed, whether the claim is an adoption.
+ *
+ * ★ STATE ALREADY SAYS WHICH, AT BOTH HALVES OF A DEPLOY (alchemy 2.0.0-beta.79):
+ *   · PLAN, A COLD ADOPTION. The probe mints an instance id no row can hold (Plan.ts
+ *     `generateInstanceId()`), and `diff` then runs with that id and the attributes the probe
+ *     read. So no row holds the id.
+ *   · APPLY, THE SAME ADOPTION. Apply commits an `updating` row with `adopting: true` under that id
+ *     BEFORE it calls reconcile, and the flag stays until the update commits (Apply.ts). An
+ *     adoption whose apply was interrupted keeps it, so the next plan's `diff` sees it too.
+ *   · A RECOVERED CREATE. A `creating` row with no attributes, whose live object the recovery read
+ *     found. It is this resource's own create when the row proves it (probe.ts `provenOurs`, the
+ *     same proof the read asked). Otherwise the plan went on only because `--adopt` said so — an
+ *     adoption like any other.
+ *   · Any other row with attributes is state vouching for the object: not an adoption.
+ * ⚠️ OUTSIDE A STACK — no Stack or State in context, or a store that errors (rows.ts) — no row
+ *   holds anything, so every call is an adoption: the strict answer, never the permissive one. A
+ *   family then refuses an ordinary update's write as if it were an adoption's. `alchemy deploy`
+ *   and the Alchemist session provide both services.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { provenOurs } from './probe.ts';
+import { recordedGeneration } from './rows.ts';
+
+/**
+ * Whether `owner`'s call is an adoption (header). `settled` is the family's "live matches these
+ * props", asked only for a recovered create, with the props of the row that recorded it.
+ * ⛔ A CREATE IS NEVER ONE HERE. `output` undefined is reconcile's create path, which has its own
+ *   rule for a live object it finds (adopt.ts `refuseTakeover`).
+ */
+export const adopting = <E, R>(
+  owner: Owner,
+  settled: (recorded: unknown) => Effect.Effect<boolean, E, R>,
+): Effect.Effect<boolean, never, R> =>
+  Effect.gen(function* () {
+    if (owner.output === undefined) return false;
+    const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
+    if (generation === undefined || generation.adopting === true) return true;
+    if (generation.attr !== undefined && generation.attr !== null) return false;
+    return !(yield* provenOurs(owner, settled(generation.props)));
+  });

package/src/ownership/ownership.test.ts

@@ -7,46 +7,13 @@
 import { describe, expect, test } from 'bun:test';
 import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
 import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
-import { InMemoryService } from 'alchemy/State/InMemoryState';
 import type { ResourceState } from 'alchemy/State/ResourceState';
-import { State } from 'alchemy/State/State';
-import { Stack } from 'alchemy/Stack';
 import * as Effect from 'effect/Effect';
 import { refuseTakeover } from './adopt.ts';
 import { ownedRead } from './probe.ts';
 import { noteResume, noteUnfinished, resumes } from './resume.ts';
 import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
-
-const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
-  ({
-    fqn,
-    instanceId,
-    old,
-    props,
-    status: old === undefined ? 'creating' : 'replacing',
-  }) as unknown as ResourceState;
-
-/**
- * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
- * declared `renamedFrom('X')`.
- */
-const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
-  Effect.runPromise(
-    effect.pipe(
-      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
-      Effect.provideService(Stack, {
-        actions: {},
-        bindings: {},
-        name: 's',
-        resources: {
-          A: { Props: { name: 'a' } },
-          B: { Props: { name: 'b' } },
-          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
-        },
-        stage: 'test',
-      } as never),
-    ),
-  );
+import { row, withStore } from './store-fixture.ts';
 
 describe('recordedInstance', () => {
   test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {

package/src/ownership/probe.ts

@@ -28,29 +28,28 @@ import type { Owner } from './adopt.ts';
 import { recordedInstance } from './rows.ts';
 
 /**
- * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
- * or the recovery read (header): `found` is ours only when the state store records this instance
- * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
- * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ * Whether the state store proves the live object this instance's own: a row records `ask.instanceId`
+ * with its whole declaration (whole.ts) AND `settled` — the family's own "live matches these props"
+ * — says so. The one proof ownership/ accepts for a live object state holds no attributes for; the
+ * recovery read (`ownedRead`) and an adoption check (adopting.ts) both ask it.
+ * ⛔ `settled` NEVER FAILS THE CALLER. The recovery read runs with the INTERRUPTED deploy's props, so
  *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
  *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
- *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ *   ours" instead, with the reason logged.
  */
-export const ownedRead = <A extends object, E, R>(
-  ask: Owner,
-  found: A | undefined,
+export const provenOurs = <E, R>(
+  ask: { readonly fqn: string; readonly instanceId: string },
   settled: Effect.Effect<boolean, E, R>,
-): Effect.Effect<A | undefined, never, R> =>
+): Effect.Effect<boolean, never, R> =>
   Effect.gen(function* () {
-    if (found === undefined || ask.output !== undefined) return found;
     const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
-    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'absent') return false;
     if (recorded === 'partial') {
       yield* Effect.logWarning(
         `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
           'was still an Output when it was written), so the live object is not proven ours',
       );
-      return Unowned(found);
+      return false;
     }
     const unproven = (reason: unknown) =>
       Effect.as(
@@ -60,6 +59,20 @@ export const ownedRead = <A extends object, E, R>(
         ),
         false,
       );
-    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
-    return ours ? found : Unowned(found);
+    return yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+  });
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when `provenOurs` says so, else `Unowned`,
+ * which `--adopt` resolves.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    return (yield* provenOurs(ask, settled)) ? found : Unowned(found);
   });

package/src/ownership/rows.ts

@@ -31,12 +31,15 @@ const storeOf = Effect.gen(function* () {
 const rowAt = (store: StateService, where: Where, fqn: string) =>
   store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));
 
-type Generation = {
+/** One generation of a persisted row, as far as ownership/ reads it. */
+export type Generation = {
   readonly instanceId?: unknown;
   readonly status?: unknown;
   readonly props?: unknown;
   readonly attr?: unknown;
   readonly old?: unknown;
+  /** Set by Apply on the `updating` row of an adoption, until that update commits (Apply.ts). */
+  readonly adopting?: unknown;
 };
 
 /** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */
@@ -51,7 +54,10 @@ const generationOf = (row: unknown, instanceId: string): Generation | undefined
 };
 
 /** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */
-const recordedGeneration = (fqn: string, instanceId: string) =>
+export const recordedGeneration = (
+  fqn: string,
+  instanceId: string,
+): Effect.Effect<Generation | undefined> =>
   Effect.gen(function* () {
     const found = yield* storeOf;
     if (found === undefined) return undefined;

package/src/ownership/store-fixture.ts

@@ -0,0 +1,50 @@
+/**
+ * A state store and a Stack for the ownership/ unit tests — the two services rows.ts reads.
+ *
+ * ⛔ TEST-ONLY. No provider imports this file and it is not on any barrel.
+ */
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+
+/** A row with no attributes: `creating`, or `replacing` when it carries an `old` generation. */
+export const row = (
+  fqn: string,
+  instanceId: string,
+  old?: unknown,
+  props: unknown = { name: 'a' },
+): ResourceState =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+export const withStore = <A>(
+  rows: Record<string, ResourceState>,
+  effect: Effect.Effect<A>,
+): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );