@homeflare/alchemy 0.46.1 → 0.47.0

package/src/openbao/adopt-recovery.test.ts

@@ -69,3 +69,27 @@ for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')
     });
   });
 }
+
+/**
+ * 🔴 A DESTROY AFTER A CRASHED CREATE MUST STILL DELETE (red team, kit PR 359, 2026-10-06). The
+ * engine's deletion-recovery read (Apply.ts, a row with no attributes) shares alchemy beta.81's
+ * `provider.read` span with the create-time deferred-adoption read. Answering `Unowned` to both
+ * made the engine skip `provider.delete` and erase the row: a live object nothing tracked.
+ */
+/** Bao.JwtAuthConfig's delete writes nothing and Bao.MfaLoginEnforcement's refuses: no object goes. */
+const DELETES_NOTHING = ['Bao.JwtAuthConfig', 'Bao.MfaLoginEnforcement'];
+for (const row of FAMILIES.filter((each) => !DELETES_NOTHING.includes(each.family))) {
+  describe(`${row.family}: a destroy after an interrupted create`, () => {
+    it('deletes the object the crashed create wrote', async () => {
+      await withCrashes((crashNext) => async (stack, estate) => {
+        crashNext();
+        const destroy = RemovalPolicy.destroy;
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m', destroy)), /injected/);
+        assert.ok(row.has(estate, 'a'));
+        const declared = row.declare('X', 'a', '15m', destroy);
+        assert.deepEqual(await stack.destroy(declared), { X: 'delete' });
+        assert.ok(!row.has(estate, 'a'), 'the destroy left the object it was asked to delete');
+      });
+    });
+  });
+}

package/src/openbao/approle-login.ts

@@ -18,8 +18,8 @@
  *   consolidation plan; not re-measured here). Give each host its own secret_id.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoEnvironment } from './bao-address.ts';
 import { BaoEnv, baoCall } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';

package/src/openbao/auth-method-reconcile.ts

@@ -5,7 +5,7 @@
  * to a non-auth path, and `token/` cannot move at all).
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import {
   type BaoAuthMethodAttributes,

package/src/openbao/auth-method.ts

@@ -18,7 +18,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/auth-role-sdk.test.ts

@@ -5,7 +5,7 @@ import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Test from 'alchemy/Test/Bun';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 import { BaoEnv } from './bao-http.ts';
 import { type Reply, fakeBao } from './fake-bao.ts';

package/src/openbao/auth-role.ts

@@ -13,7 +13,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/bao-http.test.ts

@@ -6,9 +6,9 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import * as Effect from 'effect/Effect';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { BaoEnv, baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import { BaoError } from './bao-status.ts';
 import { fakeBao, run, runFailure, withFake } from './fake-bao.ts';

package/src/openbao/bao-http.ts

@@ -17,10 +17,10 @@ import * as Effect from 'effect/Effect';
 import * as Option from 'effect/Option';
 import * as Schedule from 'effect/Schedule';
 import * as Semaphore from 'effect/Semaphore';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientRequest from 'effect/http/HttpClientRequest';
 import { type BaoEnvironment, headersFor, resolveAddress } from './bao-address.ts';
 import { BaoError, type BaoIntent, settle } from './bao-status.ts';
 

package/src/openbao/bao-identity.ts

@@ -32,8 +32,8 @@
  *   point: a standby forwards to the same vault.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type BaoEnvironment, resolveAddress } from './bao-address.ts';
 import { BaoEnv, baoCall } from './bao-http.ts';
 import { canonicalNamespace, envNamespace, namespaceLabel } from './bao-namespace.ts';

package/src/openbao/cloudflare-permission-groups.ts

@@ -32,7 +32,7 @@
  */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoRead } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import { groupKey } from './cloudflare-group-scope.ts';

package/src/openbao/cloudflare-role-wire.ts

@@ -3,7 +3,7 @@
  * of `<mount>/roles/<name>`. Split out so each can be tested against fake-bao.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import { type LiveCloudflareRole, liveRoleOf, rolePath } from './cloudflare-role-form.ts';

package/src/openbao/cloudflare-role.ts

@@ -20,7 +20,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/distilled-retry.test.ts

@@ -1,9 +1,9 @@
 import { expect, test } from 'bun:test';
 import { policiesReadAclPolicy } from '@distilled.cloud/openbao/policies';
 import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import { HttpClientError, TransportError } from 'effect/unstable/http/HttpClientError';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as HttpClient from 'effect/http/HttpClient';
+import { HttpClientError, TransportError } from 'effect/http/HttpClientError';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { readAuthRole, writeAuthRole } from './auth-role-wire.ts';
 import { BaoEnv } from './bao-http.ts';
 import { BaoError } from './bao-status.ts';

package/src/openbao/distilled.test.ts

@@ -5,9 +5,9 @@ import { join } from 'node:path';
 import { policiesReadAclPolicy, policiesWriteAclPolicy } from '@distilled.cloud/openbao/policies';
 import * as Effect from 'effect/Effect';
 import * as Semaphore from 'effect/Semaphore';
-import * as Headers from 'effect/unstable/http/Headers';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
-import * as HttpClientResponse from 'effect/unstable/http/HttpClientResponse';
+import * as Headers from 'effect/http/Headers';
+import * as HttpClient from 'effect/http/HttpClient';
+import * as HttpClientResponse from 'effect/http/HttpClientResponse';
 import { BaoEnv, BaoGate, MAX_IN_FLIGHT, baoRead } from './bao-http.ts';
 import { runBao } from './distilled.ts';
 import { fakeBao, run, runFailure, withFake } from './fake-bao.ts';

package/src/openbao/distilled.ts

@@ -14,8 +14,8 @@ import type * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Redacted from 'effect/Redacted';
 import * as Semaphore from 'effect/Semaphore';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
-import { isHttpClientError } from 'effect/unstable/http/HttpClientError';
+import type * as HttpClient from 'effect/http/HttpClient';
+import { isHttpClientError } from 'effect/http/HttpClientError';
 import { readBaoVariable, resolveAddress } from './bao-address.ts';
 import {
   BAO_TIMEOUT,

package/src/openbao/fake-bao.ts

@@ -7,8 +7,8 @@
  *   BAO_TOKEN in the shell running the tests can never be read or contacted.
  */
 import * as Effect from 'effect/Effect';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoEnvironment } from './bao-address.ts';
 import { BaoEnv } from './bao-http.ts';
 

package/src/openbao/fake-core.ts

@@ -9,7 +9,7 @@
  */
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import type * as Output from 'alchemy/Output';
 import { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
 import { BaoAuthRoleProvider } from './auth-role.ts';

package/src/openbao/fake-engines.ts

@@ -10,7 +10,7 @@ import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Layer from 'effect/Layer';
 import * as Path from 'effect/Path';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import type { Reply, Seen } from './fake-bao.ts';
 import { parseDuration } from './mount-form.ts';
 import { trimTrailing } from './mount-path.ts';

package/src/openbao/fake-families.ts

@@ -11,7 +11,7 @@ import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import type * as Output from 'alchemy/Output';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
 import type { Reply, Seen } from './fake-bao.ts';
 import { type Estate, fakeEstate } from './fake-engines-roles.ts';

package/src/openbao/fake-stack.ts

@@ -36,6 +36,11 @@ export type DeployOptions = { readonly adopt?: boolean };
 export interface FakeStack {
   /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
   readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
+  /**
+   * `alchemy destroy` of `body`: the body is still evaluated (its declarations stay in the Stack
+   * service), and the plan is Alchemy's own `Plan.destroy`. Resolves to the plan's actions.
+   */
+  readonly destroy: (body: StackBody) => Promise<Planned>;
 }
 
 type Node = { readonly action: string };
@@ -82,11 +87,14 @@ export const fakeStack = <ROut, E, RIn>(
    *   diff uses to tell reconcile it resumes an interrupted create (ownership/resume.ts).
    * ★ `--adopt` reaches registration, plan and apply alike, as the Alchemist session provides it.
    */
-  const deploy = (body: StackBody, options: DeployOptions = {}) =>
+  const destroying = Alchemy.Plan.destroy as unknown as (
+    compiled: unknown,
+  ) => Effect.Effect<PlanView, unknown, never>;
+  const run = (body: StackBody, options: DeployOptions, planner: typeof plan) =>
     Effect.gen(function* () {
       const compiled = yield* stack(name, { providers, state }, body);
       return yield* Effect.gen(function* () {
-        const planned = yield* plan(compiled);
+        const planned = yield* planner(compiled);
         yield* apply(planned);
         return actionsOf(planned);
       }).pipe(provideFreshArtifactStore, Effect.provide(Layer.succeedContext(compiled.services)));
@@ -99,7 +107,9 @@ export const fakeStack = <ROut, E, RIn>(
     );
 
   return {
-    deploy: (body, options) => Effect.runPromise(deploy(body, options) as Effect.Effect<Planned>),
+    deploy: (body, options) =>
+      Effect.runPromise(run(body, options ?? {}, plan) as Effect.Effect<Planned>),
+    destroy: (body) => Effect.runPromise(run(body, {}, destroying) as Effect.Effect<Planned>),
   };
 };
 

package/src/openbao/jwt-config.ts

@@ -20,7 +20,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import {

package/src/openbao/jwt-role.ts

@@ -22,7 +22,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';

package/src/openbao/kubernetes-role.ts

@@ -16,7 +16,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';

package/src/openbao/mfa-enforcement.ts

@@ -30,7 +30,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type Claim, claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/mfa-totp.ts

@@ -19,7 +19,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { type Claim, claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/mfa-wire.ts

@@ -25,7 +25,7 @@
  *   (identity/mfa.go:172-183), which HTTP answers 204. So this never writes by id.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { BaoEnv, baoCall, baoDelete, baoRead } from './bao-http.ts';
 import { envNamespace, namespacePath } from './bao-namespace.ts';
 import type { BaoError } from './bao-status.ts';

package/src/openbao/mount-move.ts

@@ -13,7 +13,7 @@
  *   neither, is a refusal — "neither" in particular is exactly the empty-mount failure above.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { BaoError } from './bao-status.ts';
 import { mountPath } from './mount-form.ts';
 import { type RemountError, type RemountOptions, remountAndWait } from './remount-wire.ts';

package/src/openbao/mount-reconcile.ts

@@ -3,7 +3,7 @@
  * refusals) run against a fake server, not only in a reviewer's head.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/mount.ts

@@ -21,7 +21,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/pki-role.ts

@@ -42,7 +42,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/plugin-reconcile.ts

@@ -3,7 +3,7 @@
  * be run against a fake server rather than only reasoned about.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/plugin-wire.ts

@@ -12,7 +12,7 @@
  *   token without it reads as 403, which is an error here, never "absent".
  */
 import type * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 import {

package/src/openbao/plugin.ts

@@ -23,7 +23,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { claimFor } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/policy.ts

@@ -4,7 +4,7 @@ import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Path from 'effect/Path';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/proxmox-role.ts

@@ -39,7 +39,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/openbao/remount-wire.ts

@@ -18,7 +18,7 @@
  * ⛔ POLICIES ARE NOT REWRITTEN. Every ACL path naming the old mount keeps naming it.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { baoCall, baoRead } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 

package/src/openbao/rename-occupied.test.ts

@@ -10,7 +10,7 @@ import * as Output from 'alchemy/Output';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { groupKey } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
 import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';

package/src/openbao/role-reconcile.ts

@@ -14,7 +14,7 @@
  *   so the refusal is seen at the next deploy instead of hiding behind a clean plan.
  */
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { Claim, Owner } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { baoRead, baoWrite } from './bao-http.ts';

package/src/openbao/role-rename.test.ts

@@ -9,7 +9,7 @@ import * as Output from 'alchemy/Output';
 import * as RemovalPolicy from 'alchemy/RemovalPolicy';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { groupKey } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
 import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';

package/src/openbao/ssh-role.ts

@@ -35,7 +35,7 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { refuseTakeover } from '../ownership/adopt.ts';
 import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';

package/src/opnsense/fake-opnsense.ts

@@ -11,7 +11,7 @@
  */
 import { type Credentials, credentials } from '@distilled.cloud/opnsense/Credentials';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 
 export const FAKE_BASE = 'https://opnsense.example.com';
 export const FAKE_KEY = 'placeholder-opnsense-key';

package/src/opnsense/resource.ts

@@ -28,7 +28,7 @@ import { isResolved } from 'alchemy/Diff';
 import type { Input } from 'alchemy/Input';
 import type { OpnsenseOpContext } from '@distilled.cloud/opnsense/Protocol';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import { CredentialsFromEnv } from './credentials.ts';
 import { refuseWrite } from './policy.ts';
 

package/src/ownership/probe.ts

@@ -24,8 +24,50 @@
  */
 import { Unowned } from 'alchemy/AdoptPolicy';
 import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+import type * as Tracer from 'effect/Tracer';
 import type { Owner } from './adopt.ts';
-import { recordedInstance } from './rows.ts';
+import { resumes } from './resume.ts';
+import { forgetRefusedCreate, recordedInstance } from './rows.ts';
+
+/**
+ * Whether this read is APPLY's own (Apply.ts `instrumentLifecycle` wraps every apply-time lifecycle
+ * call in a `provider.read` span; the plan's reads run outside one).
+ * ⛔ AN APPLY-TIME READ WITH NO ATTRIBUTES PROVES NOTHING. 🔴 MEASURED 2026-10-06 (alchemy
+ *   2.0.0-beta.81, openbao/adopt-core.test.ts and nine more suites): beta.81 asks the provider to
+ *   read at APPLY for a create whose props were still Outputs at plan (Plan.ts `deferredAdoption`),
+ *   and first overwrites the `creating` row with the NOW-RESOLVED props (Apply.ts `checkpoint`). That
+ *   row is whole, so `provenOurs` read the live object as matching it, and another owner's object
+ *   was taken over with no `--adopt`. Answering `Unowned` here hands the decision back to the engine,
+ *   which refuses it ("Cannot adopt resource … Re-run with `--adopt`") unless adoption is on.
+ * ★ THE ONE PROOF AN APPLY-TIME READ MAY USE IS THE PLAN'S: the diff's own recovery read noted this
+ *   instance as a proven resume (resume.ts), and that note is what `resumes` answers.
+ * ⛔ ONLY THE CREATE'S OWN READ, NOT THE DELETE PATH'S. beta.81 wraps BOTH in a `provider.read`
+ *   span: the deferred-adoption read runs inside `apply.resource` (the create's span), while the
+ *   deletion recovery read (Apply.ts, a row to delete that never recorded attributes) runs in
+ *   collectGarbage, under no such span. 🔴 Treating the second as the first answered `Unowned` for
+ *   our own interrupted create: the engine skipped `provider.delete` and erased the row, leaving a
+ *   live object nothing tracked (red team, kit PR 359, 2026-10-06; adopt-recovery.test.ts). The
+ *   delete's recovery read keeps the state-row proof (`recordedInstance` + `settled`), as before.
+ */
+const inApplyResource = (span: Tracer.AnySpan | undefined): boolean => {
+  let at = span;
+  while (at !== undefined && at._tag === 'Span') {
+    if (at.name === 'apply.resource') return true;
+    at = Option.getOrUndefined(at.parent);
+  }
+  return false;
+};
+
+const isCreatesRead = (span: Option.Option<Tracer.Span>): boolean => {
+  const current = Option.getOrUndefined(span);
+  return current?.name === 'provider.read' && inApplyResource(current);
+};
+
+const readsAtApply: Effect.Effect<boolean> = Effect.map(
+  Effect.option(Effect.currentSpan),
+  isCreatesRead,
+);
 
 /**
  * Whether the state store proves the live object this instance's own: a row records `ask.instanceId`
@@ -42,6 +84,7 @@ export const provenOurs = <E, R>(
   settled: Effect.Effect<boolean, E, R>,
 ): Effect.Effect<boolean, never, R> =>
   Effect.gen(function* () {
+    if (yield* readsAtApply) return yield* resumes(ask.instanceId);
     const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
     if (recorded === 'absent') return false;
     if (recorded === 'partial') {
@@ -74,5 +117,11 @@ export const ownedRead = <A extends object, E, R>(
 ): Effect.Effect<A | undefined, never, R> =>
   Effect.gen(function* () {
     if (found === undefined || ask.output !== undefined) return found;
-    return (yield* provenOurs(ask, settled)) ? found : Unowned(found);
+    if (yield* provenOurs(ask, settled)) return found;
+    // ⛔ THE ENGINE'S OWN REFUSAL LEAVES ITS `creating` CHECKPOINT BEHIND (Apply.ts), now holding the
+    //   RESOLVED props: a whole row, which the next plan's recovery read would take as proof and
+    //   adopt exactly what was refused. Forgotten here, as adopt.ts refuseTakeover does for its own
+    //   refusal; under --adopt the engine's later `created` commit writes the row again.
+    if (yield* readsAtApply) yield* forgetRefusedCreate(ask.fqn, ask.instanceId);
+    return Unowned(found);
   });

package/src/paperless/fake-paperless.ts

@@ -18,7 +18,7 @@ import { type Credentials, credentials } from '@distilled.cloud/paperless-ngx/Cr
 import type { PaperlessNgxOpContext } from '@distilled.cloud/paperless-ngx/Protocol';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 
 export const FAKE_BASE = 'https://paperless.example.com';
 export const FAKE_TOKEN = 'placeholder-paperless-token';

package/src/paperless/matching-types.ts

@@ -14,7 +14,7 @@
  */
 import type { PaperlessNgxOpContext } from '@distilled.cloud/paperless-ngx/Protocol';
 import type * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
 import type { EndpointKey, PaperlessBody } from './constraints.ts';
 
 /**

package/src/postgres/connection.ts

@@ -17,7 +17,7 @@ import * as PgClient from '@effect/sql-pg/PgClient';
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
-import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { SqlError } from 'effect/sql/SqlError';
 import type { PgExecutor } from './database-sql.ts';
 import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
 import { pinnedSocketExecutor } from './search-path.ts';