@homeflare/alchemy 0.6.0 → 0.8.0

package/src/openbao/rename-families.test.ts

@@ -0,0 +1,122 @@
+/**
+ * The nine batch-2 families, renamed through Alchemy's own plan and apply (fake-stack.ts), one row
+ * each (fake-families.ts). 🔴 Before rename-identity.ts, MEASURED 2026-09-21 against these fakes:
+ *   · a swap under destroy was a GREEN deploy that deleted both objects, for Bao.AuthRole,
+ *     Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole and Bao.Plugin, and a shift left
+ *     only `c`. Bao.JwtAuthConfig wrote each config over the other (it has no delete), and
+ *     Bao.MfaLoginEnforcement did the same, then stopped on its two refused deletes;
+ *   · a rename landing with another pending Output planned `update` for all nine and left the old
+ *     object live and unrecorded; for Bao.MfaTotpMethod that wrote a second method;
+ *   · with the identity itself pending, all nine wrote the new object and kept the old.
+ * What each family's identity folds or defaults is pinned in rename-identity.test.ts.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Output from 'alchemy/Output';
+import * as Effect from 'effect/Effect';
+import type { Estate } from './fake-engines-roles.ts';
+import { FAMILIES, type Family, pairOf, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+/** Bao.MfaTotpMethod never replaces: every rename is refused (mfa-totp.ts). */
+const STRANDS = /would strand every enrolled secret/;
+const isTotp = (row: Family) => row.family === 'Bao.MfaTotpMethod';
+
+const snapshot = (estate: Estate) => [
+  new Map(estate.roles.live),
+  new Map(estate.plugins.live),
+  new Map(estate.totp.live),
+];
+
+/** Another prop of the row pending: the upstream's `tokenTtl` changes in the same deploy. */
+const pendingKnob = (row: Family) => (ttl: string, name: string) =>
+  Effect.gen(function* () {
+    const up = yield* upstream(ttl);
+    yield* row.declare('Subject', name, up.tokenTtl);
+  });
+
+/** The identity itself pending: `r-15m`, then `r-30m`. */
+const pendingName = (row: Family) => (ttl: string) =>
+  Effect.gen(function* () {
+    const up = yield* upstream(ttl);
+    yield* row.declare('Subject', Output.interpolate`r-${up.tokenTtl}`, '15m');
+  });
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a rename`, () => {
+    const pair = pairOf(row);
+    const refusal = isTotp(row) ? STRANDS : OCCUPIED;
+
+    /**
+     * ★ THE CONTROL: the identity a generation RECORDS must be the one its props DECLARE. If the two
+     *   spellings drift apart (a default mount, a version, a trailing `/`), every later plan reads as
+     *   a move onto the resource's own object and fails, or replaces it, under destroy, onto itself.
+     */
+    it('redeployed unchanged is a noop that writes nothing', async () => {
+      await withEstate(async (stack, _estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(pair('a', 'b')), { X: 'noop', Y: 'noop' });
+        assert.deepEqual(writesOf(seen), []);
+      });
+    });
+
+    it('onto a name its sibling holds (a swap, under destroy) writes and deletes nothing', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        const before = snapshot(estate);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pair('b', 'a')), refusal);
+        assert.deepEqual(writesOf(seen), []);
+        assert.deepEqual(snapshot(estate), before);
+      });
+    });
+
+    it('onto a name still held while that one moves on (a shift) writes nothing', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(pair('a', 'b'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pair('b', 'c')), refusal);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a') && row.has(estate, 'b') && !row.has(estate, 'c'));
+      });
+    });
+
+    it('that lands with another prop pending is judged at plan, not planned as update', async () => {
+      await withEstate(async (stack, estate, seen) => {
+        const body = pendingKnob(row);
+        await stack.deploy(body('15m', 'a'));
+        if (isTotp(row)) {
+          seen.length = 0;
+          await assert.rejects(stack.deploy(body('30m', 'b')), STRANDS);
+          // ★ At plan: not even the upstream's update is applied.
+          assert.deepEqual(writesOf(seen), []);
+          return;
+        }
+        assert.deepEqual(await stack.deploy(body('30m', 'b')), {
+          Subject: 'replace',
+          Upstream: 'update',
+        });
+        // ★ The default retain keeps the old generation; the new one is written.
+        assert.ok(row.has(estate, 'a') && row.has(estate, 'b'));
+      });
+    });
+
+    it('to a name not known until apply is refused before any write, then judged', async () => {
+      await withEstate(async (stack, estate) => {
+        const body = pendingName(row);
+        await stack.deploy(body('15m'));
+        const moved = isTotp(row) ? /renaming from `r-15m`/ : /identity moved from \S*r-15m\S* to/;
+        await assert.rejects(stack.deploy(body('30m')), moved);
+        assert.ok(!row.has(estate, 'r-30m'));
+        if (isTotp(row)) {
+          await assert.rejects(stack.deploy(body('30m')), STRANDS);
+          return;
+        }
+        assert.deepEqual(await stack.deploy(body('30m')), { Subject: 'replace', Upstream: 'noop' });
+        assert.ok(row.has(estate, 'r-30m'));
+      });
+    });
+  });
+}

package/src/openbao/rename-identity.test.ts

@@ -0,0 +1,129 @@
+/**
+ * What each family counts as "the same object": the case the server folds, the mount an absent prop
+ * means, a trailing `/`, and a plugin's version. rename-identity.ts spells an identity twice, as the
+ * diff's props DECLARE it and as a generation's attributes RECORD it, and the two must agree, or a
+ * plan reads a resource's own object as a move onto somebody else's. Run through Alchemy's own plan
+ * and apply (fake-stack.ts) against fake-engines-roles.ts.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { rowOf, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoJwtAuthConfig } from './jwt-config.ts';
+import { BaoPkiRole } from './pki-role.ts';
+import { BaoPlugin } from './plugin.ts';
+import { foldName } from './rename-identity.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+
+describe('a change of case the server folds away is not a rename', () => {
+  it('foldName lowercases the name segment only; a mount path keeps its case', () => {
+    assert.equal(foldName('Host-Cert'), 'host-cert');
+    assert.equal(foldName('auth/K8s/role/App'), 'auth/K8s/role/app');
+  });
+
+  it('Bao.AuthRole: `Host-A` after `host-a` under destroy is a noop, nothing deleted', async () => {
+    const row = rowOf('Bao.AuthRole');
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(row.declare('Role', 'host-a', '15m', RemovalPolicy.destroy));
+      seen.length = 0;
+      const plan = await stack.deploy(row.declare('Role', 'Host-A', '15m', RemovalPolicy.destroy));
+      assert.deepEqual(plan, { Role: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(row.has(estate, 'host-a'));
+    });
+  });
+
+  /**
+   * ★ Both refuse an upper-case name (`problems`), so the change is refused either way. Folded, it is
+   *   refused for what it is; compared exactly, the plan read `role/App`, the server folded that to
+   *   the role's own `role/app`, and the move was refused as landing on an object that exists.
+   */
+  for (const family of ['Bao.JwtRole', 'Bao.KubernetesRole']) {
+    it(`${family}: \`App\` after \`app\` is the same role, refused only for its case`, async () => {
+      const row = rowOf(family);
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(row.declare('Role', 'app', '15m', RemovalPolicy.destroy));
+        seen.length = 0;
+        const again = stack.deploy(row.declare('Role', 'App', '15m', RemovalPolicy.destroy));
+        await assert.rejects(again, /must be lower case/);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'app'));
+      });
+    });
+  }
+});
+
+describe('the mount an absent prop means, and a trailing `/`, are the same mount', () => {
+  it('Bao.JwtAuthConfig with no `mount` redeploys as a noop: the default is `jwt`', async () => {
+    const config = () =>
+      BaoJwtAuthConfig('Config', {
+        boundIssuer: 'https://issuer.example.com',
+        jwksUrl: 'https://issuer.example.com/keys',
+      });
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(config());
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(config()), { Config: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(estate.roles.live.has('auth/jwt/config'));
+    });
+  });
+
+  it('Bao.PkiRole: `pki/` after the default mount is the same role, a noop', async () => {
+    const role = (mount?: string) =>
+      BaoPkiRole('Role', {
+        allowedDomains: ['example.com'],
+        maxTtl: '8760h',
+        name: 'web',
+        ttl: '15m',
+        ...(mount === undefined ? {} : { mount }),
+      }).pipe(RemovalPolicy.destroy());
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(role());
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(role('pki/')), { Role: 'noop' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(estate.roles.live.has('pki/roles/web'));
+    });
+  });
+});
+
+describe('Bao.Plugin: the version is part of the catalog key', () => {
+  const CATALOG = 'sys/plugins/catalog/secret/example';
+  const plugin = (version: string) =>
+    BaoPlugin('Plugin', {
+      command: 'plugin-example',
+      name: 'example',
+      sha256: 'a'.repeat(64),
+      type: 'secret',
+      version,
+    }).pipe(RemovalPolicy.destroy());
+
+  it('a bump registers the new version, then deregisters the old one', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(plugin('v1.0.0'));
+      seen.length = 0;
+      assert.deepEqual(await stack.deploy(plugin('v1.1.0')), { Plugin: 'replace' });
+      assert.deepEqual(writesOf(seen), [
+        `PUT /v1/${CATALOG}`,
+        `DELETE /v1/${CATALOG}?version=v1.0.0`,
+      ]);
+      assert.deepEqual([...estate.plugins.live.keys()], [`${CATALOG}?version=v1.1.0`]);
+    });
+  });
+
+  it('a bump onto a version already registered by hand fails the plan', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(plugin('v1.0.0'));
+      const byHand = { builtin: false, command: 'plugin-example', version: 'v1.1.0' };
+      estate.plugins.live.set(`${CATALOG}?version=v1.1.0`, byHand);
+      seen.length = 0;
+      await assert.rejects(stack.deploy(plugin('v1.1.0')), OCCUPIED);
+      assert.deepEqual(writesOf(seen), []);
+    });
+  });
+});

package/src/openbao/rename-identity.ts

@@ -0,0 +1,117 @@
+/**
+ * The rename guard every Bao.* family whose identity is a name, a mount, or a catalog key shares:
+ * one `Identity` per family, and two steps built from rename.ts, `judgeRename` at the top of `diff`
+ * and `guardRename` at the top of `reconcile`. REPLACE.md has the audit behind both.
+ *
+ * ★ ONE DESCRIPTION OF "WHICH OBJECT", NOT TWELVE COPIES OF THE CHECK. The rename-safety fix went
+ *   in family by family, and the families it skipped were the ones that kept the bug: nine of them
+ *   judged the identity only after `isResolved(news)` and never asked whether the new path was
+ *   taken. 🔴 MEASURED 2026-09-21 through the engine (rename-families.test.ts): two Bao.AuthRole,
+ *   Bao.PkiRole, Bao.JwtRole, Bao.KubernetesRole, Bao.SshRole or Bao.Plugin resources that swapped
+ *   names under `RemovalPolicy.destroy()` both planned `replace`, each wrote over the other, and
+ *   both old deletes then removed what had just been written: a green deploy, both objects gone.
+ *   With any other prop still an Output, all nine planned `update` and left the old object live
+ *   under no state record; for Bao.MfaTotpMethod that wrote a second method and stranded every
+ *   enrolment.
+ */
+import * as Effect from 'effect/Effect';
+import {
+  declaredRolePath,
+  declaredString,
+  isMoved,
+  judgeMove,
+  refuseMovedUpdate,
+} from './rename.ts';
+
+/** How one family names the object it manages — the thing a rename changes. */
+export interface Identity<A> {
+  /** `Bao.JwtRole` etc., for messages. */
+  readonly family: string;
+  /** The identity a set of props declares; undefined while any part of it is still an Output. */
+  readonly declared: (props: unknown) => string | undefined;
+  /** The identity a generation's attributes record. */
+  readonly recorded: (output: A) => string;
+  /** The API path an identity is read at, for the occupied check. Default: the identity. */
+  readonly pathOf?: ((identity: string) => string) | undefined;
+  /** How the server keys it (`policyKey`). Default: exact. */
+  readonly key?: ((identity: string) => string) | undefined;
+}
+
+/** A family keyed by `name` alone, read at `pathOf(name)`. */
+export const nameIdentity = <A extends { readonly name: string }>(
+  family: string,
+  pathOf: (name: string) => string,
+  key?: (name: string) => string,
+): Identity<A> => ({
+  declared: (props) => declaredString(props, 'name'),
+  family,
+  key,
+  pathOf,
+  recorded: (output) => output.name,
+});
+
+/**
+ * A role at `rolePath(mount, name)`; the identity is that path. `defaultMount` is what an absent
+ * `mount` prop means — undefined when `mount` is required.
+ */
+export const roleIdentity = <A extends { readonly mount: string; readonly name: string }>(
+  family: string,
+  rolePath: (mount: string, name: string) => string,
+  defaultMount?: string,
+  key?: (path: string) => string,
+): Identity<A> => ({
+  declared: (props) => declaredRolePath(props, rolePath, defaultMount),
+  family,
+  key,
+  recorded: (output) => rolePath(output.mount, output.name),
+});
+
+/**
+ * ⚠️ THE LAST SEGMENT LOWERCASED: a role store that folds the name and not the mount. openbao v2.6.2
+ *   AppRole (builtin/credential/approle/path_role.go:1485, :1537) and Kubernetes
+ *   (builtin/credential/kubernetes/backend.go:362, path_role.go:396) both store `role/<lowercased
+ *   name>`, and JWT reads its `name` as a TypeLowerCaseString (builtin/credential/jwt/path_role.go:77),
+ *   while the router folds no case in a mount path. So `Host` → `host` is the same role, never a
+ *   replace that would delete, under `destroy`, the role it had just written.
+ */
+export const foldName = (path: string): string =>
+  path.replace(/[^/]+$/, (name) => name.toLowerCase());
+
+/**
+ * `diff`'s first step, before `isResolved(news)`: the move from the identity this resource last
+ * wrote or tried to the declared one, or undefined when both name the same object or either is not
+ * known yet. ⛔ Fails the plan when the new identity is already taken (`judgeMove`).
+ *
+ * ★ `olds` STANDS IN FOR `output` WHILE A CREATE OR A REPLACEMENT IS UNFINISHED, which is what
+ *   catches reverting a move whose new generation failed (rename.ts, `judgeMove`).
+ */
+export const judgeRename = <A>(
+  identity: Identity<A>,
+  olds: unknown,
+  news: unknown,
+  output: A | undefined,
+) =>
+  judgeMove(
+    identity.family,
+    output === undefined ? identity.declared(olds) : identity.recorded(output),
+    identity.declared(news),
+    identity.pathOf ?? ((path) => path),
+    identity.key,
+  );
+
+/**
+ * `reconcile`'s first step: an `update` whose prior attributes name another object dies before any
+ * read or write (`refuseMovedUpdate`). Only reached when the diff could not see the new identity.
+ */
+export const guardRename = <A>(
+  identity: Identity<A>,
+  news: unknown,
+  output: A | undefined,
+): Effect.Effect<void> => {
+  if (output === undefined) return Effect.void;
+  const from = identity.recorded(output);
+  const to = identity.declared(news);
+  return to !== undefined && isMoved(from, to, identity.key) === true
+    ? refuseMovedUpdate(identity.family, from, to)
+    : Effect.void;
+};

package/src/openbao/rename-occupied.test.ts

@@ -0,0 +1,166 @@
+/**
+ * A move onto an object that already exists, through Alchemy's own plan and apply (fake-stack.ts).
+ * Before `judgeMove` read the target, the first test below was a GREEN deploy that deleted both
+ * policies: each new generation wrote over the other's, and each old generation's delete then
+ * removed what the other had just written (rename.ts has the measurement).
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Output from 'alchemy/Output';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { groupKey } from './cloudflare-group-scope.ts';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+import { aclPolicies, cloudflareRoles, fakePolicyProviders, proxmoxRoles } from './fake-engines.ts';
+import { type StackBody, withFakeStack, writesOf } from './fake-stack.ts';
+import { BaoPolicy } from './policy.ts';
+import { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+
+const OCCUPIED = /would land on an object that already exists/;
+
+/** Two policies, `X` and `Y`, each with fragments named after its logical id, under destroy. */
+const pair = (x: string, y: string): StackBody =>
+  Effect.gen(function* () {
+    yield* BaoPolicy('X', { fragments: '/p/x', name: x }).pipe(RemovalPolicy.destroy());
+    yield* BaoPolicy('Y', { fragments: '/p/y', name: y }).pipe(RemovalPolicy.destroy());
+  });
+
+describe('Bao.Policy: a rename onto a policy that exists fails the plan', () => {
+  it('a swap under destroy writes nothing and deletes nothing', async () => {
+    const store = aclPolicies();
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(pair('a', 'b'));
+      const before = new Map(store.live);
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(pair('b', 'a')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.deepEqual(store.live, before);
+    });
+  });
+
+  it('a shift (a → b while b → c) is refused for the name still held', async () => {
+    const store = aclPolicies();
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(pair('a', 'b'));
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(pair('b', 'c')), /Bao\.Policy: a → b would land/);
+      assert.deepEqual(writesOf(bao.seen), []);
+    });
+  });
+
+  it('reverting a move whose new generation failed is refused while the old name is live', async () => {
+    const store = aclPolicies();
+    const one = (name: string, dir: string): StackBody =>
+      Effect.asVoid(BaoPolicy('X', { fragments: dir, name }).pipe(RemovalPolicy.destroy()));
+    await withFakeStack(fakePolicyProviders, store, async (stack, bao) => {
+      await stack.deploy(one('a', '/p/x'));
+      await assert.rejects(stack.deploy(one('b', '/p/empty')), /carry no path grant/);
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(one('a', '/p/x')), /Bao\.Policy: b → a would land/);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.ok(store.live.has('sys/policies/acl/a'));
+      // ★ Finishing the move instead replaces cleanly and deletes the old name.
+      assert.deepEqual(await stack.deploy(one('b', '/p/x')), { X: 'replace' });
+      assert.deepEqual([...store.live.keys()], ['sys/policies/acl/b']);
+    });
+  });
+});
+
+/** Every group resolves, to an id named after it. */
+const groups = Layer.succeed(CloudflarePermissionGroups, {
+  resolve: (_mount, refs) =>
+    Effect.succeed(new Map(refs.map((ref) => [groupKey(ref.name, ref.scope), `id-${ref.name}`]))),
+});
+const roleProviders = Layer.mergeAll(
+  BaoCloudflareRoleProvider().pipe(Layer.provide(groups)),
+  BaoProxmoxRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+const cf = (id: string, name: string) =>
+  BaoCloudflareRole(id, {
+    description: 'Read DNS records on one zone. (zone: example.com)',
+    maxTtl: '1h',
+    mount: 'cloudflare-example',
+    name,
+    policies: [
+      {
+        effect: 'allow',
+        groupOrder: 'declared',
+        groups: ['DNS Read'],
+        resource: 'com.cloudflare.api.account.zone.z1',
+      },
+    ],
+    ttl: '5m',
+  }).pipe(RemovalPolicy.destroy());
+
+describe('the role families: a move onto a role that exists fails the plan', () => {
+  it('Bao.CloudflareRole: a swap under destroy writes nothing', async () => {
+    const store = cloudflareRoles();
+    const body = (x: string, y: string): StackBody =>
+      Effect.gen(function* () {
+        yield* cf('X', x);
+        yield* cf('Y', y);
+      });
+    await withFakeStack(roleProviders, store, async (stack, bao) => {
+      await stack.deploy(body('dns-read', 'dns-edit'));
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(body('dns-edit', 'dns-read')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.equal(store.live.size, 2);
+    });
+  });
+
+  it('Bao.ProxmoxRole: a rename onto a role made by hand writes nothing', async () => {
+    const store = proxmoxRoles();
+    const role = (name: string): StackBody =>
+      Effect.asVoid(
+        BaoProxmoxRole('Role', {
+          maxTtl: '6h',
+          mintUser: 'reader@pve',
+          mount: 'proxmox-lab',
+          name,
+          ttl: '1h',
+        }),
+      );
+    await withFakeStack(roleProviders, store, async (stack, bao) => {
+      await stack.deploy(role('read'));
+      store.live.set('proxmox-lab/roles/audit', { max_ttl: 0, mint_user: 'auditor@pve', ttl: 0 });
+      bao.seen.length = 0;
+      await assert.rejects(stack.deploy(role('audit')), OCCUPIED);
+      assert.deepEqual(writesOf(bao.seen), []);
+      assert.equal(store.live.get('proxmox-lab/roles/audit')?.['mint_user'], 'auditor@pve');
+    });
+  });
+});
+
+describe('Bao.ProxmoxRole: a re-scoping rename whose allowance is still an Output', () => {
+  it('defers instead of refusing a value it cannot read yet, then checks it once resolved', async () => {
+    const store = proxmoxRoles();
+    const base = { maxTtl: '6h', mount: 'proxmox-lab', ttl: '1h' } as const;
+    const body = (ttl: string, name: string, mintUser: string): StackBody =>
+      Effect.gen(function* () {
+        const up = yield* BaoProxmoxRole('Upstream', {
+          ...base,
+          mintUser: 'up@pve',
+          name: 'up',
+          ttl,
+        });
+        const allowMintUserChange = Output.interpolate`reader-${up.ttl}@pve`;
+        yield* BaoProxmoxRole('Role', { ...base, allowMintUserChange, mintUser, name });
+      });
+    await withFakeStack(roleProviders, store, async (stack) => {
+      await stack.deploy(body('1h', 'read', 'reader@pve'));
+      // ★ Before the defer, this died at plan asking for the allowance it had been given.
+      await assert.rejects(stack.deploy(body('2h', 'reader', 'writer@pve')), /identity moved/);
+      await assert.rejects(
+        stack.deploy(body('2h', 'reader', 'writer@pve')),
+        /the rename re-scopes mint_user reader@pve/,
+      );
+      assert.ok(!store.live.has('proxmox-lab/roles/reader'));
+    });
+  });
+});