@homeflare/alchemy 0.10.1 → 0.11.0

package/src/proxmox/fake-pve-lxc.ts

@@ -34,6 +34,11 @@ export type FakePve = {
    * keyed `node/vmid` — a guest that appears between a plan and its deploy.
    */
   readonly vanish: Map<string, number>;
+  /**
+   * Hand edits that land mid-deploy, keyed `node/vmid`: once that guest's config has been read
+   * `after` more times, `set` is merged into it — a change made between a plan and its apply.
+   */
+  readonly edits: Map<string, { after: number; readonly set: Record<string, unknown> }>;
   /** Config keys a `PUT …/config` accepts with 200 and then does not store. */
   readonly ignore: Set<string>;
   /** How every task ends, and whether a task-starting call answers with no UPID at all. */
@@ -90,6 +95,7 @@ export const fakePve = (): FakePve => {
   const others: { vmid: number | string; node: string; type: string }[] = [];
   const configErrors = new Map<string, { status: number; body: unknown }>();
   const vanish = new Map<string, number>();
+  const edits: FakePve['edits'] = new Map();
   const ignore = new Set<string>();
   const task = { exit: 'OK', noUpid: false };
   const seen: Seen[] = [];
@@ -148,7 +154,12 @@ export const fakePve = (): FakePve => {
       const message = `Configuration file 'nodes/${node}/lxc/${vmid}.conf' does not exist\n`;
       return json({ data: null, message }, 500);
     }
-    if (tail === '/config' && request.method === 'GET') return json({ data: config });
+    if (tail === '/config' && request.method === 'GET') {
+      const answer = json({ data: config });
+      const edit = edits.get(`${node}/${vmid}`);
+      if (edit !== undefined && --edit.after === 0) Object.assign(config, edit.set);
+      return answer;
+    }
     if (tail === '/config' && request.method === 'PUT') {
       const digest = form.get('digest');
       if (digest !== null && digest !== config['digest']) {
@@ -192,6 +203,7 @@ export const fakePve = (): FakePve => {
   };
   return {
     configErrors,
+    edits,
     fetch: Object.assign(remapped, { preconnect: globalThis.fetch.preconnect }),
     guests,
     ignore,

package/src/proxmox/lxc-adopt.test.ts

@@ -4,28 +4,20 @@
  *
  * ⛔ WHAT THESE PIN: a declaration pasted from the live config plans `adopted` with no warning,
  *   its deploy writes NOTHING, and the next plan is `noop`; the create spellings (`storage:size`,
- *   a NIC without its MAC) adopt as cleanly; drift is named at plan and written as one PUT that
- *   keeps the live MAC and carries the digest; and every change PVE cannot make in place fails the
- *   plan with nothing written. Deleting both empty-change guards (reconcile's in lxc.ts and
- *   `updateGuest`'s in lxc-lifecycle.ts), or the hwaddr carry in lxc-wire.ts, fails a test here —
- *   each MEASURED by making that edit and running this file, 2026-09-21.
+ *   a NIC without its MAC) adopt as cleanly; after that adoption, drift is named at plan and
+ *   written as one PUT that keeps the live MAC and carries the digest; and every change PVE cannot
+ *   make in place fails the plan with nothing written. Deleting both empty-change guards
+ *   (reconcile's in lxc.ts and `updateGuest`'s in lxc-lifecycle.ts), or the hwaddr carry in
+ *   lxc-wire.ts, fails a test here — each MEASURED by making that edit and running this file,
+ *   2026-09-21. An adoption that WOULD write fails instead: lxc-strict-adopt.test.ts.
  */
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { NODE, TARGET, VMID, adoptedAsIs, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-
-/** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
-const pasted = (): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID };
-};
-
 const ct = (props: LxcProps) => ProxmoxLxc('ct', props).pipe(adopt(true));
 
 let fake: FakePve | undefined;
@@ -84,17 +76,17 @@ describe('adopting a live container', () => {
   });
 });
 
-describe('drift at adoption is named at plan and written once', () => {
+describe('drift after the adoption is named at plan and written once', () => {
   test('memory and an MTU change: one PUT, the live MAC kept, the digest carried', async () => {
     const pve = live();
-    const stack = lxcEngine(pve);
+    const stack = await adoptedAsIs(pve);
     const props: LxcProps = {
       ...pasted(),
       memory: 4096,
       net1: 'name=eth1,bridge=vmbr1,ip=198.51.100.4/24,mtu=9000',
     };
     const planned = await stack.plan(ct(props));
-    expect(planned.actions).toEqual({ ct: 'adopted' });
+    expect(planned.actions).toEqual({ ct: 'update' });
     expect(planned.warnings.join('\n')).toContain('differs from the declaration in memory, net1');
     expect((await stack.deploy(ct(props))).failure).toBe('');
     expect(writesOf(pve)).toEqual([`PUT nodes/${NODE}/lxc/${String(VMID)}/config`]);
@@ -107,7 +99,7 @@ describe('drift at adoption is named at plan and written once', () => {
 
   test('a larger rootfs is a resize after the config, never a new volume', async () => {
     const pve = live();
-    const stack = lxcEngine(pve);
+    const stack = await adoptedAsIs(pve);
     const props: LxcProps = { ...pasted(), rootfs: 'local-zfs:subvol-100-disk-0,size=64G' };
     expect((await stack.deploy(ct(props))).failure).toBe('');
     expect(writesOf(pve)).toEqual([`PUT nodes/${NODE}/lxc/${String(VMID)}/resize`]);
@@ -125,7 +117,8 @@ describe('changes PVE cannot make in place fail the plan and write nothing', ()
     ['detaching a mount point', { mp0: '' }, /unusedN/],
   ])('%s', async (_, change, reason) => {
     const pve = live();
-    const run = await lxcEngine(pve).deploy(ct({ ...pasted(), ...change } as LxcProps));
+    const stack = await adoptedAsIs(pve);
+    const run = await stack.deploy(ct({ ...pasted(), ...change } as LxcProps));
     expect(run.failure).toMatch(reason);
     expect(writesOf(pve)).toEqual([]);
   });

package/src/proxmox/lxc-adoption.ts

@@ -0,0 +1,50 @@
+/**
+ * The strict adoption gate for `Proxmox.Lxc`: AN ADOPTION NEVER CHANGES A GUEST (decided
+ * 2026-09-21). A guest this stack adopts — no recorded instance, or one the plan only kept because
+ * `--adopt` said so (ownership/adopting.ts) — is taken over exactly as it runs, or not at all.
+ *
+ * ⛔ ANY DIFFERENCE FAILS, AT PLAN AND AGAIN AT APPLY. Before this, a cold adoption planned `adopted`
+ *   whatever it would write (alchemy beta.79 prints no property diff for it) and only LOGGED the
+ *   keys; `deploy --adopt --yes` then wrote them. A `net0` pasted without the live `tag=` moved the
+ *   guest off its VLAN on the deploy that was meant to change nothing. Now the plan fails naming
+ *   the keys, and reconcile re-asks against a fresh read, so a hand edit between plan and deploy
+ *   is refused too rather than written back.
+ * ⛔ KEYS ONLY, NEVER VALUES. The refusal names what differs and nothing it differs by: a live
+ *   config can carry anything (`description` is where people paste credentials), and plan output
+ *   lands in CI logs.
+ * ★ ASKED BEFORE `judge`'s OWN REFUSALS. Those name a declared value (the `pct set` to run), and
+ *   for an adoption the fix is the other direction: declare what is live.
+ * ★ THE STORE IS READ ONLY WHEN SOMETHING DIFFERS. A clean adoption — the only kind that proceeds
+ *   — costs nothing here.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from '../ownership/adopt.ts';
+import { adopting } from '../ownership/adopting.ts';
+import { type LxcChange, judge } from './lxc-judge.ts';
+import { LxcRefusedError } from './lxc-lifecycle.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+/** The refusal: keys, where, and what to do — never a value. */
+export const adoptionRefusal = (props: LxcProps, drift: readonly string[]): string =>
+  `CT ${String(props.vmid)} on ${props.node}: adopting it would change ${drift.join(', ')}. An ` +
+  'adoption never changes a guest, so nothing is written. Declare what is live for these keys ' +
+  '(the plan names keys, never values) and plan again; change them after the adoption, as an ' +
+  'update.';
+
+/**
+ * Fails with `adoptionRefusal` when `change` would write to a guest `owner`'s call adopts.
+ * `settled` for a recovered create is the same judge, of the recording row's props against `live`.
+ */
+export const refuseAdoptedDrift = (
+  owner: Owner,
+  props: LxcProps,
+  live: Record<string, unknown>,
+  change: LxcChange,
+): Effect.Effect<void, LxcRefusedError> =>
+  Effect.gen(function* () {
+    if (change.drift.length === 0) return;
+    const settled = (recorded: unknown) =>
+      Effect.sync(() => judge(recorded as LxcProps, live).drift.length === 0);
+    if (!(yield* adopting(owner, settled))) return;
+    return yield* Effect.fail(new LxcRefusedError(adoptionRefusal(props, change.drift)));
+  });

package/src/proxmox/lxc-guards.test.ts

@@ -11,19 +11,12 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { KEY, NODE, TARGET, VMID, adoptedAsIs, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-const KEY = `${NODE}/${String(VMID)}`;
 const TEMPLATE = 'local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst';
-
-const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
-};
+const ct = (props: LxcProps) => ProxmoxLxc('ct', props).pipe(adopt(true));
 
 let fake: FakePve | undefined;
 afterEach(() => {
@@ -113,10 +106,9 @@ describe('a write is claimed only when PVE says it finished', () => {
   test('a config write PVE accepted but did not store fails the read-back', async () => {
     const pve = cluster();
     seed(pve, NODE, VMID);
+    const stack = await adoptedAsIs(pve);
     pve.ignore.add('memory');
-    const run = await lxcEngine(pve).deploy(
-      ProxmoxLxc('ct', pasted({ memory: 4096 })).pipe(adopt(true)),
-    );
+    const run = await stack.deploy(ct(pasted({ memory: 4096 })));
     expect(run.failure).toContain('memory still differ');
   });
 });
@@ -137,8 +129,9 @@ describe('identity and volumes', () => {
   test('options and growth on one volume: the PUT keeps the live size, the resize follows', async () => {
     const pve = cluster();
     seed(pve, NODE, VMID);
+    const stack = await adoptedAsIs(pve);
     const mp0 = 'tank:subvol-100-disk-0,mp=/data,backup=1,size=300G';
-    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted({ mp0 })).pipe(adopt(true)));
+    const run = await stack.deploy(ct(pasted({ mp0 })));
     expect(run.failure).toBe('');
     const path = `nodes/${NODE}/lxc/${String(VMID)}`;
     expect(writesOf(pve)).toEqual([`PUT ${path}/config`, `PUT ${path}/resize`]);

package/src/proxmox/lxc-harness.ts

@@ -13,7 +13,7 @@
  * ★ ONE ARTIFACT STORE ACROSS A PLAN AND ITS APPLY, and `--adopt` as the AdoptPolicy service, as
  *   openbao/fake-stack.ts provides them: the ownership rule reads both (src/ownership/).
  */
-import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { AdoptPolicy, adopt } from 'alchemy/AdoptPolicy';
 import { apply } from 'alchemy/Apply';
 import { provideFreshArtifactStore } from 'alchemy/Artifacts';
 import * as Plan from 'alchemy/Plan';
@@ -29,7 +29,8 @@ import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 import type { PveTarget } from './credentials.ts';
 import { withFakeBao } from './fake-bao-env.ts';
 import { FAKE_BAO, FAKE_MEMBER, type FakePve } from './fake-pve-lxc.ts';
-import { ProxmoxLxcProvider } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+import { ProxmoxLxc, ProxmoxLxcProvider } from './lxc.ts';
 
 export const TARGET: PveTarget = {
   members: [FAKE_MEMBER],
@@ -68,6 +69,17 @@ export const LIVE: Readonly<Record<string, unknown>> = {
   unprivileged: 1,
 };
 
+/** Where `seed` puts the production-shaped guest by default, and its `node/vmid` key. */
+export const NODE = 'pve1';
+export const VMID = 100;
+export const KEY = `${NODE}/${String(VMID)}`;
+
+/** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */
+export const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
+  const { lxc: _raw, ...config } = LIVE;
+  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
+};
+
 /** Put `config` live on the fake as `node/vmid`, with a digest as PVE would add. */
 export const seed = (fake: FakePve, node: string, vmid: number, config = LIVE) => {
   fake.guests.set(`${node}/${String(vmid)}`, { ...config, digest: 'digest-live' });
@@ -148,3 +160,14 @@ export const lxcEngine = (fake: FakePve) => {
     status: (fqn: string) => rows['lxc']?.['test']?.[fqn]?.status,
   };
 };
+
+/**
+ * The engine, with the guest `seed` put at NODE/VMID adopted exactly as it runs — the only adoption
+ * that proceeds (lxc-adoption.ts) — so a test can go on to change it, as an ordinary update.
+ */
+export const adoptedAsIs = async (pve: FakePve): Promise<ReturnType<typeof lxcEngine>> => {
+  const stack = lxcEngine(pve);
+  const run = await stack.deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)));
+  if (run.failure !== '') throw new Error(`the clean adoption failed: ${run.failure}`);
+  return stack;
+};

package/src/proxmox/lxc-ownership.test.ts

@@ -7,7 +7,8 @@
  *   planned a create refuses a guest it then finds, and forgets its `creating` row; under
  *   `--adopt` it records a matching one with no write and still refuses one that differs; and a
  *   create interrupted after its POST resumes WITHOUT `--adopt` when the guest is what it wrote,
- *   and asks for `--adopt` when someone changed it meanwhile.
+ *   and asks for `--adopt` when someone changed it meanwhile — which then adopts it only as it
+ *   now runs, never writing the declaration back over the change (lxc-adoption.ts).
  * ★ THE INTERRUPTION IS A CREATE TASK THAT ENDS IN AN ERROR AFTER THE FAKE BUILT THE GUEST — to the
  *   engine the same as a deploy killed while it waited on the task: a live guest, and a
  *   `creating` row with no attributes.
@@ -15,20 +16,12 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { KEY, NODE, TARGET, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-const KEY = `${NODE}/${String(VMID)}`;
 const TAKEOVER = 'already exists, and this stack holds no state for it';
 
-const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
-};
-
 let fake: FakePve | undefined;
 afterEach(() => {
   fake?.stop();
@@ -146,14 +139,26 @@ describe('an interrupted create', () => {
     expect(stack.status('door')).toBe('created');
   });
 
-  test('asks for --adopt when the guest changed meanwhile, and resumes with it', async () => {
+  test('is our own guest, not an adoption: a declaration changed meanwhile is written', async () => {
+    const { pve, stack } = await interrupted();
+    const run = await stack.deploy(door({ hostname: 'door-renamed' }));
+    expect(run.failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`, `PUT nodes/${NODE}/lxc/150/config`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-renamed');
+  });
+
+  test('asks for --adopt when the guest changed meanwhile, and adopts it only as it runs', async () => {
     const { pve, stack } = await interrupted();
     const guest = pve.guests.get(`${NODE}/150`) ?? {};
     guest['hostname'] = 'someone-else';
     expect((await stack.deploy(door())).failure).toContain('Cannot resume creating');
-    const resumed = await stack.deploy(door(), { adopt: true });
+    const refused = await stack.deploy(door(), { adopt: true });
+    expect(refused.failure).toContain('adopting it would change hostname');
+    expect(refused.failure).not.toContain('someone-else');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    const resumed = await stack.deploy(door({ hostname: 'someone-else' }), { adopt: true });
     expect(resumed.failure).toBe('');
-    expect(resumed.warnings.join('\n')).toContain('differs from the declaration in hostname');
-    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-example');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('someone-else');
   });
 });

package/src/proxmox/lxc-strict-adopt.test.ts

@@ -0,0 +1,104 @@
+/**
+ * AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts), through Alchemy's real plan and apply over
+ * fake-pve-lxc.ts (placeholders only).
+ *
+ * ⛔ WHAT THESE PIN: a cold adoption that differs from the live guest in ANY key fails the plan —
+ *   under `adopt(true)` and under `--adopt` alike — naming the keys and none of the values, before
+ *   `judge`'s own refusals (which print a declared value); nothing is written and no row is left.
+ *   A hand edit between the plan and the deploy is refused at apply with nothing written; the
+ *   adoption row it leaves keeps refusing until the declaration says what is live, and then adopts
+ *   with no write. An interrupted create that `--adopt` resumes is held to the same rule:
+ *   lxc-ownership.test.ts.
+ * ★ MUTATION-CHECKED 2026-09-21: removing either `refuseAdoptedDrift` call in lxc.ts, or any one of
+ *   the three adoption answers in ownership/adopting.ts, fails a test here or in
+ *   lxc-ownership.test.ts.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { KEY, NODE, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const REFUSAL = 'adopting it would change';
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const live = () => {
+  fake = fakePve();
+  seed(fake, NODE, VMID);
+  return fake;
+};
+
+const drifted = (): LxcProps =>
+  pasted({ memory: 4096, net1: 'name=eth1,bridge=vmbr1,ip=198.51.100.4/24,mtu=9000' });
+
+describe('a cold adoption that differs from the live guest fails the plan', () => {
+  test.each([
+    ['adopt(true)', () => ProxmoxLxc('ct', drifted()).pipe(adopt(true)), {}],
+    ['--adopt', () => ProxmoxLxc('ct', drifted()), { adopt: true }],
+  ])('under %s: keys named, values never, nothing written', async (_, declare, options) => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const planned = await stack.plan(declare(), options);
+    expect(planned.failure).toContain(`CT ${String(VMID)} on ${NODE}: ${REFUSAL} memory, net1.`);
+    for (const value of ['4096', '8192', '9000', '1500']) {
+      expect(planned.failure).not.toContain(value);
+    }
+    const deployed = await stack.deploy(declare(), options);
+    expect(deployed.failure).toContain(`${REFUSAL} memory, net1`);
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBeUndefined();
+  });
+
+  test.each([
+    ['a device passthrough', { dev1: '/dev/fuse' }, 'dev1', ['/dev/fuse', 'pct set']],
+    ['an unprivileged flip', { unprivileged: 0 as const }, 'unprivileged', ['live 1']],
+    [
+      'a smaller mount point',
+      { mp0: 'tank:subvol-100-disk-0,mp=/data,size=100G' },
+      'mp0',
+      ['100G'],
+    ],
+  ])('%s is the adoption refusal, not the update one', async (_, change, key, hidden) => {
+    const pve = live();
+    const run = await lxcEngine(pve).plan(ProxmoxLxc('ct', pasted(change)).pipe(adopt(true)));
+    expect(run.failure).toContain(`${REFUSAL} ${key}.`);
+    for (const value of hidden) expect(run.failure).not.toContain(value);
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('an exact match still adopts, with no write and no warning', async () => {
+    const pve = live();
+    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)));
+    expect(run).toEqual({ actions: { ct: 'adopted' }, failure: '', warnings: [] });
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('a hand edit between the plan and the deploy', () => {
+  test('is refused at apply, and the adoption holds until the declaration says what is live', async () => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const declare = (over: Partial<LxcProps> = {}) =>
+      ProxmoxLxc('ct', pasted(over)).pipe(adopt(true));
+    // ★ Two config reads plan a cold adoption — the probe's and diff's — so the edit lands after
+    //   the plan said `adopted` and before reconcile reads.
+    pve.edits.set(KEY, { after: 2, set: { memory: 4096 } });
+    const raced = await stack.deploy(declare());
+    expect(raced.failure).toContain(`${REFUSAL} memory.`);
+    expect(raced.failure).not.toContain('4096');
+    expect(writesOf(pve)).toEqual([]);
+    expect(pve.guests.get(KEY)?.['memory']).toBe(4096);
+    expect(stack.status('ct')).toBe('updating');
+    expect((await stack.plan(declare())).failure).toContain(`${REFUSAL} memory.`);
+    const caughtUp = await stack.deploy(declare({ memory: 4096 }));
+    expect(caughtUp.failure).toBe('');
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBe('updated');
+    expect((await stack.plan(declare({ memory: 4096 }))).actions).toEqual({ ct: 'noop' });
+  });
+});

package/src/proxmox/lxc.ts

@@ -17,11 +17,11 @@
  * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only
  *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.
  *
- * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a
- *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)
- *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name
- *   (never by value), as a warning — the only place a plan can say the declaration is not the live
- *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).
+ * ⛔ AND AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts). A guest this stack adopts is taken
+ *   over exactly as it runs: any key the declaration says otherwise FAILS the plan, by name (never
+ *   by value), and reconcile asks again before it would write. Only an exact match adopts.
+ * ⚠️ AN UPDATE STILL PLANS `update` WITHOUT A PROPERTY DIFF, so `diff` LOGS the keys a deploy would
+ *   write, by name, as a warning — the only place a plan says what the deploy will change.
  *
  * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for
  *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.
@@ -36,6 +36,7 @@ import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { createRefusals } from './lxc-create-form.ts';
 import { identityRefusals } from './lxc-identity.ts';
+import { refuseAdoptedDrift } from './lxc-adoption.ts';
 import { judge } from './lxc-judge.ts';
 import {
   LxcRefusedError,
@@ -75,8 +76,9 @@ const refused = (reasons: readonly string[]) =>
  *   that follows, so reconcile can tell our own interrupted create from a guest somebody else put
  *   at this vmid.
  */
-const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | undefined) =>
+const diff = (owner: LxcOwner, news: Input<LxcProps>, olds: LxcProps) =>
   Effect.gen(function* () {
+    const { output } = owner;
     const identity = identityRefusals(news, olds, output);
     if (identity.length > 0) return yield* refused(identity);
     if (output === undefined) return undefined;
@@ -96,6 +98,7 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
       return { action: 'update' } as const;
     }
     const change = judge(news, live);
+    yield* refuseAdoptedDrift(owner, news, live, change);
     if (change.refuse.length > 0) return yield* refused(change.refuse);
     const moved = news.node !== output.node;
     if (change.drift.length === 0 && !moved) return { action: 'noop' } as const;
@@ -112,7 +115,8 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
 /**
  * ⛔ THE SAME JUDGE AS `diff`, RE-RUN AGAINST A FRESH READ, AND AN EMPTY CHANGE WRITES NOTHING.
  *   Apply routes `adopted` through reconcile (resource.ts has the Apply.ts lines), so this is what
- *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs.
+ *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs,
+ *   and for one edited since the plan it is a refusal, never a write (lxc-adoption.ts).
  * ⛔ AND IT READS BACK AND JUDGES AGAIN. PVE answers 200 on writes that did nothing, so a change
  *   that did not land is a failure here, not a state row claiming it did. ⚠️ A change PVE parked
  *   as pending on a running guest DOES read back (GET config merges `[pending]` unless asked for
@@ -148,6 +152,7 @@ const reconcile = (owner: LxcOwner, news: LxcProps) =>
             'onto an existing guest: plan again, so the plan can show it and adopt it.',
         ]);
       }
+      yield* refuseAdoptedDrift(owner, news, live, change);
       if (change.refuse.length > 0) return yield* refused(change.refuse);
       if (change.drift.length > 0) yield* updateGuest(news, change, text(live['digest']));
     }
@@ -208,14 +213,13 @@ const handlers = {
   delete: ({ olds, output }: { olds: LxcProps; output: LxcAttributes }) =>
     destroyGuest(whereOf(olds, output), olds),
   diff: ({
+    fqn,
+    instanceId,
     news,
     olds,
     output,
-  }: {
-    news: Input<LxcProps>;
-    olds: LxcProps;
-    output: LxcAttributes | undefined;
-  }) => diff(news, olds, output),
+  }: Asked & { news: Input<LxcProps>; olds: LxcProps; output: LxcAttributes | undefined }) =>
+    diff({ fqn, instanceId, output }, news, olds),
   list: () => Effect.succeed([]),
   read: ({
     fqn,