@homeflare/alchemy 0.6.0 → 0.7.0

package/src/openbao/proxmox-role-wire.ts

@@ -0,0 +1,24 @@
+/**
+ * The read Bao.ProxmoxRole makes of `<mount>/roles/<name>`, split from proxmox-role.ts so the diff,
+ * reconcile and the rename's re-scope check share one definition of "the live role".
+ */
+import * as Effect from 'effect/Effect';
+import { baoRead } from './bao-http.ts';
+import { type BaoProxmoxRoleProps, attributesOf, rolePath } from './proxmox-role-form.ts';
+
+/**
+ * The live role, or undefined when OpenBao answers 404.
+ *
+ * ⚠️ A missing MOUNT and a missing ROLE both read as undefined here, because both answer 404:
+ *   an absent role is a read that found nothing, and a path under no mount is OpenBao's
+ *   unsupported-path error, which is also a 404 (sdk/logical/response_util.go). They are not the
+ *   same failure — one is a typo in `mount`, the other is a role that has yet to be created — so
+ *   reconcile lets OpenBao's own `errors` through on the write rather than inventing a message.
+ *   A bad mount says "no handler for route".
+ */
+export const readRole = (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>) =>
+  Effect.gen(function* () {
+    const live = yield* baoRead(rolePath(props.mount, props.name));
+    if (live === undefined) return undefined;
+    return attributesOf(props, live);
+  });

package/src/openbao/proxmox-role.ts

@@ -40,15 +40,25 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
-import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
+import { baoDelete, baoWrite } from './bao-http.ts';
 import {
   type BaoProxmoxRoleAttributes,
   type BaoProxmoxRoleProps,
-  attributesOf,
   matches,
+  rescopeRefusal,
   rolePath,
   writeBody,
 } from './proxmox-role-form.ts';
+import { readRole } from './proxmox-role-wire.ts';
+import {
+  declaredRolePath,
+  declaredString,
+  isMoved,
+  isPendingProp,
+  judgeMove,
+  refuseMovedUpdate,
+  triedRolePath,
+} from './rename.ts';
 
 export type { BaoProxmoxRoleAttributes, BaoProxmoxRoleProps };
 
@@ -64,21 +74,6 @@ export const BaoProxmoxRole = Resource<BaoProxmoxRole>('Bao.ProxmoxRole', {
   defaultRemovalPolicy: 'retain',
 });
 
-/**
- * ⚠️ A missing MOUNT and a missing ROLE both read as undefined here, because both answer 404:
- *   an absent role is a read that found nothing, and a path under no mount is OpenBao's
- *   unsupported-path error, which is also a 404 (sdk/logical/response_util.go). They are not the
- *   same failure — one is a typo in `mount`, the other is a role that has yet to be created — so
- *   reconcile lets OpenBao's own `errors` through on the write rather than inventing a message.
- *   A bad mount says "no handler for route".
- */
-const readRole = (props: BaoProxmoxRoleProps) =>
-  Effect.gen(function* () {
-    const live = yield* baoRead(rolePath(props.mount, props.name));
-    if (live === undefined) return undefined;
-    return attributesOf(props, live);
-  });
-
 export const BaoProxmoxRoleProvider = () =>
   Provider.effect(
     BaoProxmoxRole,
@@ -103,8 +98,35 @@ export const BaoProxmoxRoleProvider = () =>
          *   says everything is fine — exactly the drift the hand-written check-* gates exist to
          *   catch, and exactly what a provider that trusted its own state would walk past.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+        diff: Effect.fn(function* ({ news, olds, output }) {
+          /**
+           * ⛔ A NEW `mount` OR `name` IS A `replace` (rename.ts). It is a DIFFERENT path, so none of
+           *   the reasons below apply. Until 2026-09-21 it planned `update` and left the old role
+           *   minting under no state record. Under the default `retain` the old role still mints;
+           *   under `destroy` its consumers fail at the delete (REPLACE.md). ⛔ A move onto a role
+           *   that already exists fails the plan (`judgeMove`).
+           * ⛔ THE RE-SCOPE GUARD TRAVELS WITH THE RENAME, checked here because the new generation's
+           *   reconcile finds no live role to compare. While `mintUser` or `allowMintUserChange` is
+           *   still an Output it cannot be checked, so the diff defers, and reconcile refuses the
+           *   resulting `update`.
+           */
+          const tried = triedRolePath(output, olds, rolePath);
+          const declared = declaredRolePath(news, rolePath);
+          const move = yield* judgeMove('Bao.ProxmoxRole', tried, declared, (path) => path);
+          if (output === undefined) return undefined;
+          if (move !== undefined) {
+            const mintUser = declaredString(news, 'mintUser');
+            if (mintUser === undefined || isPendingProp(news, 'allowMintUserChange'))
+              return undefined;
+            const from = (yield* readRole(output))?.mintUser ?? output.mintUser;
+            const allow = declaredString(news, 'allowMintUserChange');
+            const refusal = rescopeRefusal(from, mintUser, allow);
+            if (refusal === undefined) return { action: 'replace' } as const;
+            return yield* Effect.die(
+              new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal}`),
+            );
+          }
+          if (!isResolved(news)) return undefined;
           const live = yield* readRole(news);
           if (live === undefined) return { action: 'update' } as const;
           if (matches(live, news)) return { action: 'noop' } as const;
@@ -126,7 +148,13 @@ export const BaoProxmoxRoleProvider = () =>
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ news, output }) {
+          const path = rolePath(news.mount, news.name);
+          // ⛔ An `update` across a move the diff could not see — refused before any read or write.
+          const before = output === undefined ? path : rolePath(output.mount, output.name);
+          if (isMoved(before, path) === true) {
+            return yield* refuseMovedUpdate('Bao.ProxmoxRole', before, path);
+          }
           const live = yield* readRole(news);
           /**
            * ⛔ A mint_user CHANGE RE-SCOPES EVERY CREDENTIAL THE ROLE WILL EVER MINT, SILENTLY.
@@ -137,20 +165,15 @@ export const BaoProxmoxRoleProvider = () =>
            *   move unless the declaration NAMES THE VALUE IT IS REPLACING. Creating a role never
            *   trips this — there is nothing to re-scope — and the permission expires by itself
            *   once the change lands, because live then equals the declaration.
+           * ⚠️ A RENAME CREATES A NEW ROLE, SO IT NEVER REACHES THIS CHECK. The diff asks the same
+           *   question of the role being replaced (`rescopeRefusal`, proxmox-role-form.ts).
            */
-          if (
-            live !== undefined &&
-            live.mintUser !== news.mintUser &&
-            news.allowMintUserChange !== live.mintUser
-          ) {
-            return yield* Effect.die(
-              new Error(
-                `Bao.ProxmoxRole ${rolePath(news.mount, news.name)}: live mint_user ` +
-                  `${live.mintUser} != declared ${news.mintUser}. Every token this role mints ` +
-                  'inherits the ACL of that PVE user. To re-scope deliberately, declare ' +
-                  `allowMintUserChange: '${live.mintUser}'.`,
-              ),
-            );
+          const rescope =
+            live === undefined
+              ? undefined
+              : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
+          if (rescope !== undefined) {
+            return yield* Effect.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
           }
           if (live === undefined || !matches(live, news)) {
             const write = writeBody(news);
@@ -164,18 +187,18 @@ export const BaoProxmoxRoleProvider = () =>
             if (!write.ok) {
               return yield* Effect.die(
                 new Error(
-                  `Bao.ProxmoxRole ${rolePath(news.mount, news.name)}: unparseable duration ` +
+                  `Bao.ProxmoxRole ${path}: unparseable duration ` +
                     `${write.bad.join(', ')}. Use 30s / 5m / 1h / 1d, or 0.`,
                 ),
               );
             }
-            yield* baoWrite('PUT', rolePath(news.mount, news.name), write.body);
+            yield* baoWrite('PUT', path, write.body);
           }
           const after = yield* readRole(news);
           if (after === undefined) {
             return yield* Effect.die(
               new Error(
-                `Bao.ProxmoxRole ${rolePath(news.mount, news.name)}: write returned no error ` +
+                `Bao.ProxmoxRole ${path}: write returned no error ` +
                   'but the role is still absent.',
               ),
             );
@@ -197,7 +220,9 @@ export const BaoProxmoxRoleProvider = () =>
          *   So this is an availability change for every consumer of `creds/<name>` and NOT a
          *   containment action: to contain a leaked credential, revoke the lease (which deletes
          *   the PVE token) or delete the token in PVE. Deleting the role only hides the door it
-         *   came through. REASONED from Vault lease semantics; not exercised here.
+         *   came through. The plugin's own test pins this (homeflare-openbao-plugins,
+         *   TestDeletingARoleLeavesItsOutstandingLeasesRevocable): the delete is one storage
+         *   delete, and each lease stays revocable without the role.
          *
          * ⚠️ IDEMPOTENT AS ALCHEMY REQUIRES — already gone is success. It used to get that by
          *   going through `baoReadText`, which discarded the exit code entirely, so a REFUSED

package/src/openbao/rename-occupied.test.ts

@@ -0,0 +1,166 @@
+/**
+ * A move onto an object that already exists, through Alchemy's own plan and apply (fake-stack.ts).
+ * Before `judgeMove` read the target, the first test below was a GREEN deploy that deleted both
+ * policies: each new generation wrote over the other's, and each old generation's delete then
+ * removed what the other had just written (rename.ts has the measurement).
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Output from 'alchemy/Output';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { groupKey } from './cloudflare-group-scope.ts';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+import { aclPolicies, cloudflareRoles, fakePolicyProviders, proxmoxRoles } from './fake-engines.ts';
+import { type StackBody, withFakeStack, writesOf } from './fake-stack.ts';
+import { BaoPolicy } from './policy.ts';
+import { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+
+/** Two policies, `X` and `Y`, each with fragments named after its logical id, under destroy. */
+const pair = (x: string, y: string): StackBody =>
+  Effect.gen(function* () {
+    yield* BaoPolicy('X', { fragments: '/p/x', name: x }).pipe(RemovalPolicy.destroy());
+    yield* BaoPolicy('Y', { fragments: '/p/y', name: y }).pipe(RemovalPolicy.destroy());
+  });
+
+describe('Bao.Policy: a rename onto a policy that exists fails the plan', () => {
+  it('a swap under destroy writes nothing and deletes nothing', async () => {
+    const store = aclPolicies();
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(pair('a', 'b'));
+      const before = new Map(store.live);
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(pair('b', 'a')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.deepEqual(store.live, before);
+    });
+  });
+
+  it('a shift (a → b while b → c) is refused for the name still held', async () => {
+    const store = aclPolicies();
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(pair('a', 'b'));
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(pair('b', 'c')), /Bao\.Policy: a → b would land/);
+      assert.deepEqual(writesOf(bao.seen), []);
+    });
+  });
+
+  it('reverting a move whose new generation failed is refused while the old name is live', async () => {
+    const store = aclPolicies();
+    const one = (name: string, dir: string): StackBody =>
+      Effect.asVoid(BaoPolicy('X', { fragments: dir, name }).pipe(RemovalPolicy.destroy()));
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(one('a', '/p/x'));
+      await assert.rejects(stack.deploy(one('b', '/p/empty')), /carry no path grant/);
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(one('a', '/p/x')), /Bao\.Policy: b → a would land/);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.ok(store.live.has('sys/policies/acl/a'));
+      // ★ Finishing the move instead replaces cleanly and deletes the old name.
+      assert.deepEqual(await stack.deploy(one('b', '/p/x')), { X: 'replace' });
+      assert.deepEqual([...store.live.keys()], ['sys/policies/acl/b']);
+    });
+  });
+});
+
+/** Every group resolves, to an id named after it. */
+const groups = Layer.succeed(CloudflarePermissionGroups, {
+  resolve: (_mount, refs) =>
+    Effect.succeed(new Map(refs.map((ref) => [groupKey(ref.name, ref.scope), `id-${ref.name}`]))),
+});
+const roleProviders = Layer.mergeAll(
+  BaoCloudflareRoleProvider().pipe(Layer.provide(groups)),
+  BaoProxmoxRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+const cf = (id: string, name: string) =>
+  BaoCloudflareRole(id, {
+    description: 'Read DNS records on one zone. (zone: example.com)',
+    maxTtl: '1h',
+    mount: 'cloudflare-example',
+    name,
+    policies: [
+      {
+        effect: 'allow',
+        groupOrder: 'declared',
+        groups: ['DNS Read'],
+        resource: 'com.cloudflare.api.account.zone.z1',
+      },
+    ],
+    ttl: '5m',
+  }).pipe(RemovalPolicy.destroy());
+
+describe('the role families: a move onto a role that exists fails the plan', () => {
+  it('Bao.CloudflareRole: a swap under destroy writes nothing', async () => {
+    const store = cloudflareRoles();
+    const body = (x: string, y: string): StackBody =>
+      Effect.gen(function* () {
+        yield* cf('X', x);
+        yield* cf('Y', y);
+      });
+    await withFakeStack(roleProviders, store, async (stack, bao) => {
+      await stack.deploy(body('dns-read', 'dns-edit'));
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(body('dns-edit', 'dns-read')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.equal(store.live.size, 2);
+    });
+  });
+
+  it('Bao.ProxmoxRole: a rename onto a role made by hand writes nothing', async () => {
+    const store = proxmoxRoles();
+    const role = (name: string): StackBody =>
+      Effect.asVoid(
+        BaoProxmoxRole('Role', {
+          maxTtl: '6h',
+          mintUser: 'reader@pve',
+          mount: 'proxmox-lab',
+          name,
+          ttl: '1h',
+        }),
+      );
+    await withFakeStack(roleProviders, store, async (stack, bao) => {
+      await stack.deploy(role('read'));
+      store.live.set('proxmox-lab/roles/audit', { max_ttl: 0, mint_user: 'auditor@pve', ttl: 0 });
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(role('audit')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.equal(store.live.get('proxmox-lab/roles/audit')?.['mint_user'], 'auditor@pve');
+    });
+  });
+});
+
+describe('Bao.ProxmoxRole: a re-scoping rename whose allowance is still an Output', () => {
+  it('defers instead of refusing a value it cannot read yet, then checks it once resolved', async () => {
+    const store = proxmoxRoles();
+    const base = { maxTtl: '6h', mount: 'proxmox-lab', ttl: '1h' } as const;
+    const body = (ttl: string, name: string, mintUser: string): StackBody =>
+      Effect.gen(function* () {
+        const up = yield* BaoProxmoxRole('Upstream', {
+          ...base,
+          mintUser: 'up@pve',
+          name: 'up',
+          ttl,
+        });
+        const allowMintUserChange = Output.interpolate`reader-${up.ttl}@pve`;
+        yield* BaoProxmoxRole('Role', { ...base, allowMintUserChange, mintUser, name });
+      });
+    await withFakeStack(roleProviders, store, async (stack) => {
+      await stack.deploy(body('1h', 'read', 'reader@pve'));
+      // ★ Before the defer, this died at plan asking for the allowance it had been given.
+      await assert.rejects(stack.deploy(body('2h', 'reader', 'writer@pve')), /identity moved/);
+      await assert.rejects(
+        stack.deploy(body('2h', 'reader', 'writer@pve')),
+        /the rename re-scopes mint_user reader@pve/,
+      );
+      assert.ok(!store.live.has('proxmox-lab/roles/reader'));
+    });
+  });
+});

package/src/openbao/rename.ts

@@ -0,0 +1,162 @@
+/**
+ * Rename safety for the families whose identity is a name, or a mount and a name: Bao.Policy,
+ * Bao.CloudflareRole and Bao.ProxmoxRole. REPLACE.md has the audit and what each answer does.
+ *
+ * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
+ *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
+ *   `RemovalPolicy.destroy()`, planned `update` and left BOTH policies live. diff read the NEW
+ *   path, found nothing, answered `update`, and reconcile wrote the new object. The old one stayed
+ *   live under no state record, so no later plan would mention it, and not even `destroy` could
+ *   remove it.
+ * ★ A CHANGED IDENTITY IS A DIFFERENT OBJECT, SO THE ANSWER IS `replace`. Create-first
+ *   (`deleteFirst` false): the new path never collides with the old, the new generation is written,
+ *   dependents are updated in the same graph, and only then is the old generation deleted. The
+ *   engine hands that delete the OLD generation's attributes (Apply.ts deleteOldGenerations and the
+ *   GC pass both pass `output: old.attr`), and every delete here reads `output`, never `news`.
+ *   ⛔ A new path that collides with ANOTHER live object is refused at plan instead (`judgeMove`).
+ * ⚠️ UNDER `retain` THE OLD OBJECT STAYS LIVE. Apply.ts:2164-2173 skips the old generation's delete
+ *   and logs "Retaining replaced resource (removal policy: retain)". The plan still says `replace`
+ *   and the apply says what it kept, so it is no longer silent, but the old object is unmanaged
+ *   from then on. Remove it by hand, or opt into `RemovalPolicy.destroy()`.
+ */
+import * as Effect from 'effect/Effect';
+import { baoRead } from './bao-http.ts';
+
+const exact = (identity: string): string => identity;
+
+/**
+ * A string prop of a diff's `news`, once that one prop is resolved; `undefined` while it is still an
+ * Output of a changing upstream (a function-typed proxy) or an Effect.
+ *
+ * ★ THE IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns `undefined` when ANY prop is
+ *   pending, and the engine then falls back to `update` (Plan.ts, `havePropsChanged`). A rename that
+ *   lands in the same deploy as a pending `fragments` or `policies` Output would slip through as
+ *   `update`, which is the orphan again. launchd/host-effect.ts reads its identity the same way.
+ */
+export const declaredString = (news: unknown, key: string): string | undefined => {
+  if (typeof news !== 'object' || news === null) return undefined;
+  const value: unknown = (news as Record<string, unknown>)[key];
+  return typeof value === 'string' ? value : undefined;
+};
+
+/** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
+export const isPendingProp = (news: unknown, key: string): boolean => {
+  if (typeof news !== 'object' || news === null) return false;
+  const value: unknown = (news as Record<string, unknown>)[key];
+  return value !== undefined && typeof value !== 'string';
+};
+
+/** A role's API path from a diff's `news`, once both `mount` and `name` are resolved. */
+export const declaredRolePath = (
+  news: unknown,
+  rolePath: (mount: string, name: string) => string,
+): string | undefined => {
+  const mount = declaredString(news, 'mount');
+  const name = declaredString(news, 'name');
+  return mount === undefined || name === undefined ? undefined : rolePath(mount, name);
+};
+
+/**
+ * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
+ * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
+ * (:378) and DeletePolicy (:562).
+ *
+ * ⛔ SO `Admin` → `admin` IS THE SAME POLICY, NOT A RENAME. A `replace` there would write it, and then,
+ *   under `destroy`, delete the old generation, which is that same policy. Every grant it carries
+ *   would be revoked by a change of case.
+ */
+export const policyKey = (name: string): string => name.trim().toLowerCase();
+
+/**
+ * Whether the declared identity names a different object than the one in state: `true` → moved (the
+ * diff asks `judgeMove`, which also reads the target); `false` → the same object; `undefined` → not
+ * knowable yet, because the declared side is still an Output. `key` is how the SERVER keys the object (`policyKey`); the default is exact,
+ * which is right for a mount path (vault/routing/router.go folds no case) and for both plugins'
+ * roles (each stores `roles/<name>` verbatim).
+ *
+ * ⛔ NEVER `replace` ON AN UNKNOWN IDENTITY. The Output may resolve to the same path, and a replace
+ *   onto the same path deletes, under `destroy`, the object it has just written. The diff defers
+ *   instead. If the engine then plans `update` and the identity turns out to have changed,
+ *   `refuseMovedUpdate` stops reconcile before it writes anything.
+ */
+export const isMoved = (
+  stored: string,
+  declared: string | undefined,
+  key: (identity: string) => string = exact,
+): boolean | undefined => (declared === undefined ? undefined : key(stored) !== key(declared));
+
+/**
+ * The role path a resource last wrote, or last tried to: its attributes once a write finished, else
+ * the props of the create or replacement that did not (`output` is undefined for both).
+ */
+export const triedRolePath = (
+  output: { readonly mount: string; readonly name: string } | undefined,
+  olds: unknown,
+  rolePath: (mount: string, name: string) => string,
+): string | undefined =>
+  output === undefined ? declaredRolePath(olds, rolePath) : rolePath(output.mount, output.name);
+
+/**
+ * The diff's first question, asked before `isResolved(news)`: the move from the identity this
+ * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same
+ * object or either is still unknown. `pathOf` is the API path an identity is read at.
+ *
+ * ⛔ A MOVE ONTO AN OBJECT THAT ALREADY EXISTS FAILS THE PLAN. MEASURED 2026-09-21 through the engine
+ *   (rename-occupied.test.ts): two policies that swapped names under `RemovalPolicy.destroy()` each
+ *   planned `replace`, each new generation wrote over the other's live policy, and each old
+ *   generation's delete then removed the name the other had just written. The deploy was green and
+ *   both policies were gone, every grant revoked. A shift (a → b while b → c), and a move onto the
+ *   name of a resource leaving the stack, were measured ending the same way. So was reverting a
+ *   move whose new generation failed: the old generation still holds the name, and its delete runs
+ *   after the revert has rewritten it. That is why `tried` falls back to the props of an unfinished
+ *   write.
+ * ⚠️ THE DIFF CANNOT SEE THE REMOVAL POLICY, SO THIS REFUSES UNDER `retain` TOO, where a swap, or a
+ *   move back onto a retained old generation, would have been harmless. The cost is a move in two
+ *   deploys through a free name, or removing the target by hand. The alternative is a green deploy
+ *   that deletes what it has just written.
+ * ★ ONE PLAN-TIME READ, OF A PATH THE NEW GENERATION'S RECONCILE READS ANYWAY. A 404, a missing mount
+ *   included, is free; a refused read fails the plan, as any other diff read does.
+ */
+export const judgeMove = (
+  family: string,
+  tried: string | undefined,
+  declared: string | undefined,
+  pathOf: (identity: string) => string,
+  key: (identity: string) => string = exact,
+) =>
+  Effect.gen(function* () {
+    if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
+      return undefined;
+    }
+    if ((yield* baoRead(pathOf(declared))) === undefined) return { from: tried, to: declared };
+    return yield* Effect.die(
+      new Error(
+        `${family}: ${tried} → ${declared} would land on an object that already exists at ` +
+          `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` +
+          'shift, or a reverted move that did not finish) deletes it after this one writes it. ' +
+          'Nothing was written. Move through a name nothing holds, in two deploys, or remove ' +
+          `${declared} by hand first.`,
+      ),
+    );
+  });
+
+/**
+ * Reconcile's guard: an `update` whose prior attributes name another object.
+ *
+ * ★ REACHED ONLY WHEN THE DIFF COULD NOT SEE THE NEW IDENTITY at plan time. A fresh create, and the
+ *   new generation of a `replace`, both reach reconcile with `output` undefined (Apply.ts passes
+ *   `output: attr`, which is empty for a new generation). An `update` reaches it with the previous
+ *   generation's attributes.
+ * ★ THE FAILED DEPLOY SETTLES ITSELF. Apply has already committed the row as `updating`, with the new
+ *   props and the OLD attributes. By the next plan the upstream Output has landed, so the diff sees
+ *   both names and answers `replace` (or refuses, if the new name is already taken: `judgeMove`).
+ *   The old object is then deleted, or retained, by the removal policy, with no hand repair.
+ */
+export const refuseMovedUpdate = (family: string, from: string, to: string) =>
+  Effect.die(
+    new Error(
+      `${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` +
+        `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` +
+        'deploy again: once the value resolves at plan time it plans as a replace.',
+    ),
+  );