@homeflare/alchemy 0.6.0 → 0.8.0

package/src/openbao/rename.ts

@@ -0,0 +1,166 @@
+/**
+ * Rename safety for the families whose identity is a name, a mount and a name, or a catalog key:
+ * the primitives. rename-identity.ts builds each family's diff and reconcile step from them, and
+ * REPLACE.md has the audit and what each answer does.
+ *
+ * ⛔ THE BUG THIS CLOSES, REPRODUCED 2026-09-21 AGAINST alchemy@2.0.0-beta.79's OWN PLAN AND APPLY
+ *   (fake-stack.ts): a Bao.Policy deployed as `old`, then redeclared as `new` under
+ *   `RemovalPolicy.destroy()`, planned `update` and left BOTH policies live. diff read the NEW
+ *   path, found nothing, answered `update`, and reconcile wrote the new object. The old one stayed
+ *   live under no state record, so no later plan would mention it, and not even `destroy` could
+ *   remove it.
+ * ★ A CHANGED IDENTITY IS A DIFFERENT OBJECT, SO THE ANSWER IS `replace`. Create-first
+ *   (`deleteFirst` false): the new path never collides with the old, the new generation is written,
+ *   dependents are updated in the same graph, and only then is the old generation deleted. The
+ *   engine hands that delete the OLD generation's attributes (Apply.ts deleteOldGenerations and the
+ *   GC pass both pass `output: old.attr`), and every delete here reads `output`, never `news`.
+ *   ⛔ A new path that collides with ANOTHER live object is refused at plan instead (`judgeMove`).
+ * ⚠️ UNDER `retain` THE OLD OBJECT STAYS LIVE. Apply.ts:2164-2173 skips the old generation's delete
+ *   and logs "Retaining replaced resource (removal policy: retain)". The plan still says `replace`
+ *   and the apply says what it kept, so it is no longer silent, but the old object is unmanaged
+ *   from then on. Remove it by hand, or opt into `RemovalPolicy.destroy()`.
+ */
+import * as Effect from 'effect/Effect';
+import { baoRead } from './bao-http.ts';
+
+const exact = (identity: string): string => identity;
+
+/**
+ * A string prop of a diff's `news`, once that one prop is resolved; `undefined` while it is still an
+ * Output of a changing upstream (a function-typed proxy) or an Effect.
+ *
+ * ★ THE IDENTITY IS JUDGED BEFORE `isResolved(news)`. That guard returns `undefined` when ANY prop is
+ *   pending, and the engine then falls back to `update` (Plan.ts, `havePropsChanged`). A rename that
+ *   lands in the same deploy as a pending `fragments` or `policies` Output would slip through as
+ *   `update`, which is the orphan again. launchd/host-effect.ts reads its identity the same way.
+ */
+export const declaredString = (news: unknown, key: string): string | undefined => {
+  if (typeof news !== 'object' || news === null) return undefined;
+  const value: unknown = (news as Record<string, unknown>)[key];
+  return typeof value === 'string' ? value : undefined;
+};
+
+/** True while an optional prop is declared but is not yet a value: an Output of a changing upstream. */
+export const isPendingProp = (news: unknown, key: string): boolean => {
+  if (typeof news !== 'object' || news === null) return false;
+  const value: unknown = (news as Record<string, unknown>)[key];
+  return value !== undefined && typeof value !== 'string';
+};
+
+/**
+ * An optional string prop: `fallback` when it is absent, undefined while it is still an Output.
+ * ⚠️ Not `declaredString(…) ?? fallback`, which would read a pending mount as the default mount.
+ */
+export const declaredOr = (news: unknown, key: string, fallback: string): string | undefined =>
+  isPendingProp(news, key) ? undefined : (declaredString(news, key) ?? fallback);
+
+/**
+ * A role's API path from a diff's `news`, once both `mount` and `name` are resolved. `defaultMount`
+ * is what an absent `mount` means; without one, an absent mount is unknown.
+ */
+export const declaredRolePath = (
+  news: unknown,
+  rolePath: (mount: string, name: string) => string,
+  defaultMount?: string,
+): string | undefined => {
+  const mount =
+    defaultMount === undefined
+      ? declaredString(news, 'mount')
+      : declaredOr(news, 'mount', defaultMount);
+  const name = declaredString(news, 'name');
+  return mount === undefined || name === undefined ? undefined : rolePath(mount, name);
+};
+
+/**
+ * How OpenBao keys an ACL policy: trimmed and lowercased. openbao v2.6.2
+ * vault/policy/policy_store.go:698-700 (`sanitizeName`), applied by SetPolicy (:268), GetPolicy
+ * (:378) and DeletePolicy (:562).
+ *
+ * ⛔ SO `Admin` → `admin` IS THE SAME POLICY, NOT A RENAME. A `replace` there would write it, and then,
+ *   under `destroy`, delete the old generation, which is that same policy. Every grant it carries
+ *   would be revoked by a change of case.
+ */
+export const policyKey = (name: string): string => name.trim().toLowerCase();
+
+/**
+ * Whether the declared identity names a different object than the one in state: `true` → moved (the
+ * diff asks `judgeMove`, which also reads the target); `false` → the same object; `undefined` → not
+ * knowable yet, because the declared side is still an Output. `key` is how the SERVER keys the object (`policyKey`); the default is exact,
+ * which is right for a mount path (vault/routing/router.go folds no case) and for both plugins'
+ * roles (each stores `roles/<name>` verbatim).
+ *
+ * ⛔ NEVER `replace` ON AN UNKNOWN IDENTITY. The Output may resolve to the same path, and a replace
+ *   onto the same path deletes, under `destroy`, the object it has just written. The diff defers
+ *   instead. If the engine then plans `update` and the identity turns out to have changed,
+ *   `refuseMovedUpdate` stops reconcile before it writes anything.
+ */
+export const isMoved = (
+  stored: string,
+  declared: string | undefined,
+  key: (identity: string) => string = exact,
+): boolean | undefined => (declared === undefined ? undefined : key(stored) !== key(declared));
+
+/**
+ * The diff's first question, asked before `isResolved(news)`: the move from the identity this
+ * resource last wrote or tried (`tried`) to the declared one, or undefined when both name the same
+ * object or either is still unknown. `pathOf` is the API path an identity is read at.
+ *
+ * ⛔ A MOVE ONTO AN OBJECT THAT ALREADY EXISTS FAILS THE PLAN. MEASURED 2026-09-21 through the engine
+ *   (rename-occupied.test.ts): two policies that swapped names under `RemovalPolicy.destroy()` each
+ *   planned `replace`, each new generation wrote over the other's live policy, and each old
+ *   generation's delete then removed the name the other had just written. The deploy was green and
+ *   both policies were gone, every grant revoked. A shift (a → b while b → c), and a move onto the
+ *   name of a resource leaving the stack, were measured ending the same way. So was reverting a
+ *   move whose new generation failed: the old generation still holds the name, and its delete runs
+ *   after the revert has rewritten it. That is why `tried` falls back to the props of an unfinished
+ *   write.
+ * ⚠️ THE DIFF CANNOT SEE THE REMOVAL POLICY, SO THIS REFUSES UNDER `retain` TOO, where a swap, or a
+ *   move back onto a retained old generation, would have been harmless. The cost is a move in two
+ *   deploys through a free name, or removing the target by hand. The alternative is a green deploy
+ *   that deletes what it has just written.
+ * ★ ONE PLAN-TIME READ, OF A PATH THE NEW GENERATION'S RECONCILE READS ANYWAY. A 404, a missing mount
+ *   included, is free; a refused read fails the plan, as any other diff read does.
+ */
+export const judgeMove = (
+  family: string,
+  tried: string | undefined,
+  declared: string | undefined,
+  pathOf: (identity: string) => string,
+  key: (identity: string) => string = exact,
+) =>
+  Effect.gen(function* () {
+    if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
+      return undefined;
+    }
+    if ((yield* baoRead(pathOf(declared))) === undefined) return { from: tried, to: declared };
+    return yield* Effect.die(
+      new Error(
+        `${family}: ${tried} → ${declared} would land on an object that already exists at ` +
+          `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` +
+          'shift, or a reverted move that did not finish) deletes it after this one writes it. ' +
+          'Nothing was written. Move through a name nothing holds, in two deploys, or remove ' +
+          `${declared} by hand first.`,
+      ),
+    );
+  });
+
+/**
+ * Reconcile's guard: an `update` whose prior attributes name another object.
+ *
+ * ★ REACHED ONLY WHEN THE DIFF COULD NOT SEE THE NEW IDENTITY at plan time. A fresh create, and the
+ *   new generation of a `replace`, both reach reconcile with `output` undefined (Apply.ts passes
+ *   `output: attr`, which is empty for a new generation). An `update` reaches it with the previous
+ *   generation's attributes.
+ * ★ THE FAILED DEPLOY SETTLES ITSELF. Apply has already committed the row as `updating`, with the new
+ *   props and the OLD attributes. By the next plan the upstream Output has landed, so the diff sees
+ *   both names and answers `replace` (or refuses, if the new name is already taken: `judgeMove`).
+ *   The old object is then deleted, or retained, by the removal policy, with no hand repair.
+ */
+export const refuseMovedUpdate = (family: string, from: string, to: string) =>
+  Effect.die(
+    new Error(
+      `${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` +
+        `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` +
+        'deploy again: once the value resolves at plan time it plans as a replace.',
+    ),
+  );

package/src/openbao/role-rename.test.ts

@@ -0,0 +1,205 @@
+/**
+ * Moving a Bao.CloudflareRole or a Bao.ProxmoxRole to a new `mount` or `name`, through Alchemy's own
+ * plan and apply (fake-stack.ts) against fakes of each engine's role store (fake-engines.ts). Before
+ * 2026-09-21 every move below planned `update` and left the old role minting.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Output from 'alchemy/Output';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import { groupKey } from './cloudflare-group-scope.ts';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+import type { BaoCloudflareRoleProps } from './cloudflare-role-form.ts';
+import type { Seen } from './fake-bao.ts';
+import { type Store, cloudflareRoles, proxmoxRoles } from './fake-engines.ts';
+import { type StackBody, withFakeStack, writesOf as writes } from './fake-stack.ts';
+import { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+import type { BaoProxmoxRoleProps } from './proxmox-role-form.ts';
+
+/** Every group resolves, to an id named after it — this file is about paths, not groups. */
+const groups = Layer.succeed(CloudflarePermissionGroups, {
+  resolve: (_mount, refs) =>
+    Effect.succeed(new Map(refs.map((ref) => [groupKey(ref.name, ref.scope), `id-${ref.name}`]))),
+});
+const providers = Layer.mergeAll(
+  BaoCloudflareRoleProvider().pipe(Layer.provide(groups)),
+  BaoProxmoxRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+type Removal = typeof RemovalPolicy.destroy;
+
+const withStack = (
+  store: Store,
+  body: (deploy: (body: StackBody) => Promise<unknown>, seen: Seen[]) => Promise<void>,
+) => withFakeStack(providers, store, (stack, bao) => body(stack.deploy, bao.seen));
+
+const livePaths = (store: Store) => [...store.live.keys()].sort();
+
+const CF: BaoCloudflareRoleProps = {
+  description: 'Read DNS records on one zone. (zone: example.com)',
+  maxTtl: '1h',
+  mount: 'cloudflare-acme-dns',
+  name: 'example-com-dns-read',
+  policies: [
+    {
+      effect: 'allow',
+      groupOrder: 'declared',
+      groups: ['DNS Read'],
+      resource: 'com.cloudflare.api.account.zone.z1',
+    },
+  ],
+  ttl: '5m',
+};
+const cf = (props: Partial<BaoCloudflareRoleProps>, removal: Removal = RemovalPolicy.retain) =>
+  Effect.asVoid(BaoCloudflareRole('Role', { ...CF, ...props }).pipe(removal()));
+
+describe('Bao.CloudflareRole move, through the engine', () => {
+  it('a new name plans replace and deletes the OLD path under destroy', async () => {
+    const store = cloudflareRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(cf({}, RemovalPolicy.destroy));
+      seen.length = 0;
+      assert.deepEqual(await deploy(cf({ name: 'example-com-dns-edit' }, RemovalPolicy.destroy)), {
+        Role: 'replace',
+      });
+      assert.deepEqual(writes(seen), [
+        'PUT /v1/cloudflare-acme-dns/roles/example-com-dns-edit',
+        'DELETE /v1/cloudflare-acme-dns/roles/example-com-dns-read',
+      ]);
+      assert.deepEqual(livePaths(store), ['cloudflare-acme-dns/roles/example-com-dns-edit']);
+    });
+  });
+
+  it('a new mount plans replace, and the default retain keeps the old role live', async () => {
+    const store = cloudflareRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(cf({}));
+      assert.deepEqual(await deploy(cf({ mount: 'cloudflare-other-dns' })), { Role: 'replace' });
+      assert.ok(!writes(seen).some((each) => each.startsWith('DELETE')));
+      assert.deepEqual(livePaths(store), [
+        'cloudflare-acme-dns/roles/example-com-dns-read',
+        'cloudflare-other-dns/roles/example-com-dns-read',
+      ]);
+    });
+  });
+
+  it('a trailing slash on the mount is the same path: noop, nothing deleted', async () => {
+    const store = cloudflareRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(cf({}, RemovalPolicy.destroy));
+      seen.length = 0;
+      const planned = await deploy(cf({ mount: 'cloudflare-acme-dns/' }, RemovalPolicy.destroy));
+      assert.deepEqual(planned, { Role: 'noop' });
+      assert.deepEqual(writes(seen), []);
+    });
+  });
+});
+
+const PVE: BaoProxmoxRoleProps = {
+  maxTtl: '6h',
+  mintUser: 'reader@pve',
+  mount: 'proxmox-lab',
+  name: 'read',
+  ttl: '1h',
+};
+const pve = (props: Partial<BaoProxmoxRoleProps>, removal: Removal = RemovalPolicy.retain) =>
+  Effect.asVoid(BaoProxmoxRole('Role', { ...PVE, ...props }).pipe(removal()));
+
+describe('Bao.ProxmoxRole move, through the engine', () => {
+  it('a new name plans replace and deletes the OLD path under destroy', async () => {
+    const store = proxmoxRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(pve({}, RemovalPolicy.destroy));
+      seen.length = 0;
+      assert.deepEqual(await deploy(pve({ name: 'reader' }, RemovalPolicy.destroy)), {
+        Role: 'replace',
+      });
+      assert.deepEqual(writes(seen), [
+        'PUT /v1/proxmox-lab/roles/reader',
+        'DELETE /v1/proxmox-lab/roles/read',
+      ]);
+      assert.deepEqual(livePaths(store), ['proxmox-lab/roles/reader']);
+    });
+  });
+
+  it('refuses a rename that also re-scopes mint_user, at plan, before any write', async () => {
+    const store = proxmoxRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(pve({}));
+      seen.length = 0;
+      const moved = pve({ mintUser: 'provisioner@pve', name: 'provision' });
+      await assert.rejects(deploy(moved), /allowMintUserChange: 'reader@pve'/);
+      assert.deepEqual(writes(seen), []);
+      assert.deepEqual(livePaths(store), ['proxmox-lab/roles/read']);
+    });
+  });
+
+  it('lets the re-scoping rename through when it names the mint user it replaces', async () => {
+    const store = proxmoxRoles();
+    await withStack(store, async (deploy) => {
+      await deploy(pve({}));
+      const allowed = pve({
+        allowMintUserChange: 'reader@pve',
+        mintUser: 'provisioner@pve',
+        name: 'provision',
+      });
+      assert.deepEqual(await deploy(allowed), { Role: 'replace' });
+      assert.equal(store.live.get('proxmox-lab/roles/provision')?.['mint_user'], 'provisioner@pve');
+    });
+  });
+
+  it('keeps a same-path mint_user change an update, refused at apply as before', async () => {
+    const store = proxmoxRoles();
+    await withStack(store, async (deploy, seen) => {
+      await deploy(pve({}));
+      seen.length = 0;
+      await assert.rejects(deploy(pve({ mintUser: 'provisioner@pve' })), /re-scopes mint_user/);
+      assert.deepEqual(writes(seen), []);
+    });
+  });
+});
+
+/**
+ * ★ The name is an Output of an upstream role whose `ttl` is changing, so no diff can see it at plan.
+ *   Reconcile refuses the `update`; the next deploy, with the value settled, plans `replace`.
+ */
+describe('an update across a move the diff could not see', () => {
+  it('Bao.CloudflareRole: refused before any write, then replaced', async () => {
+    const store = cloudflareRoles();
+    const body = (ttl: string): StackBody =>
+      Effect.gen(function* () {
+        const up = yield* BaoCloudflareRole('Upstream', { ...CF, name: 'upstream', ttl });
+        const name = Output.interpolate`role-${up.ttl}`;
+        yield* BaoCloudflareRole('Role', { ...CF, name }).pipe(RemovalPolicy.destroy());
+      });
+    await withStack(store, async (deploy) => {
+      await deploy(body('5m'));
+      await assert.rejects(deploy(body('10m')), /identity moved from .*role-300 to .*role-600/);
+      assert.ok(!store.live.has('cloudflare-acme-dns/roles/role-600'));
+      assert.deepEqual(await deploy(body('10m')), { Role: 'replace', Upstream: 'noop' });
+      assert.ok(!store.live.has('cloudflare-acme-dns/roles/role-300'));
+    });
+  });
+
+  it('Bao.ProxmoxRole: refused before any write, then replaced', async () => {
+    const store = proxmoxRoles();
+    const body = (ttl: string): StackBody =>
+      Effect.gen(function* () {
+        const up = yield* BaoProxmoxRole('Upstream', { ...PVE, name: 'upstream', ttl });
+        const name = Output.interpolate`r-${up.ttl}`;
+        yield* BaoProxmoxRole('Role', { ...PVE, name }).pipe(RemovalPolicy.destroy());
+      });
+    await withStack(store, async (deploy) => {
+      await deploy(body('1h'));
+      await assert.rejects(deploy(body('2h')), /identity moved from .*r-1h to .*r-2h/);
+      assert.ok(!store.live.has('proxmox-lab/roles/r-2h'));
+      assert.deepEqual(await deploy(body('2h')), { Role: 'replace', Upstream: 'noop' });
+      assert.deepEqual(livePaths(store), ['proxmox-lab/roles/r-2h', 'proxmox-lab/roles/upstream']);
+    });
+  });
+});

package/src/openbao/ssh-role-erase.ts

@@ -0,0 +1,50 @@
+/**
+ * Bao.SshRole's guard against its own full-replace write: the live fields a write would reset that
+ * the declaration does not model. Split from ssh-role.ts, whose reconcile calls it.
+ */
+import { extMap } from './ssh-role-form.ts';
+
+/**
+ * Fields this resource deliberately does not model, mapped to the value OpenBao's own write
+ * puts there when nobody says otherwise. The templating flags change how a principal is
+ * DERIVED at signing time, which is a different kind of decision from which principals
+ * exist; the rest are issuance mechanics. MEASURED against all three live roles — every one
+ * of them sits on exactly these values, so the guard below fires on nothing that exists.
+ */
+const UNMANAGED_DEFAULTS: Readonly<Record<string, unknown>> = {
+  algorithm_signer: 'default',
+  allow_commas_in_identity_templates: false,
+  allow_user_key_ids: false,
+  allowed_domains_template: false,
+  allowed_users_template: false,
+  default_extensions_template: false,
+  default_user_template: false,
+  issuer_ref: 'default',
+  key_id_format: '',
+  not_before_duration: 30,
+};
+
+/**
+ * ⚠️ ABSENT AND EMPTY BOTH COUNT AS "NEVER SET". A role this resource wrote omits these
+ *   fields entirely, so a stricter test would refuse on the provider's own output and
+ *   deadlock the update after next.
+ */
+const isDefault = (live: Record<string, unknown>, field: string) =>
+  live[field] === undefined || live[field] === '' || live[field] === UNMANAGED_DEFAULTS[field];
+
+/**
+ * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
+ *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
+ *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
+ *   survive clock skew, a non-default issuer — loses all of it the moment this resource
+ *   decides to update. A vanished key-length floor is a security regression that no plan
+ *   output would ever mention, and a vanished backdating window breaks signing on exactly
+ *   the skewed host it was added for. So reconcile refuses instead of writing.
+ */
+export const wouldErase = (live: Record<string, unknown>): readonly string[] => {
+  const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
+  if (Object.keys(extMap(live['allowed_user_key_lengths'])).length > 0) {
+    lost.push('allowed_user_key_lengths');
+  }
+  return lost.sort();
+};

package/src/openbao/ssh-role.ts

@@ -43,12 +43,13 @@ import {
   type BaoSshRoleProps,
   attributesOf,
   badDurations,
-  extMap,
   matches,
   readPath,
   resolve,
   writeBody,
 } from './ssh-role-form.ts';
+import { wouldErase } from './ssh-role-erase.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoSshRoleAttributes, BaoSshRoleProps };
 
@@ -64,6 +65,9 @@ export const BaoSshRole = Resource<BaoSshRole>('Bao.SshRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: the engine stores `roles/<name>` verbatim (builtin/logical/ssh/path_roles.go:602). */
+const IDENTITY = roleIdentity<BaoSshRoleAttributes>('Bao.SshRole', readPath, 'ssh');
+
 /** Live role, plus the raw body — reconcile needs the raw half to see what it would erase. */
 const readRole = (form: BaoSshRoleForm) =>
   Effect.gen(function* () {
@@ -72,51 +76,6 @@ const readRole = (form: BaoSshRoleForm) =>
     return { attributes: attributesOf(form, live), live };
   });
 
-/**
- * Fields this resource deliberately does not model, mapped to the value OpenBao's own write
- * puts there when nobody says otherwise. The templating flags change how a principal is
- * DERIVED at signing time, which is a different kind of decision from which principals
- * exist; the rest are issuance mechanics. MEASURED against all three live roles — every one
- * of them sits on exactly these values, so the guard below fires on nothing that exists.
- */
-const UNMANAGED_DEFAULTS: Readonly<Record<string, unknown>> = {
-  algorithm_signer: 'default',
-  allow_commas_in_identity_templates: false,
-  allow_user_key_ids: false,
-  allowed_domains_template: false,
-  allowed_users_template: false,
-  default_extensions_template: false,
-  default_user_template: false,
-  issuer_ref: 'default',
-  key_id_format: '',
-  not_before_duration: 30,
-};
-
-/**
- * ⚠️ ABSENT AND EMPTY BOTH COUNT AS "NEVER SET". A role this resource wrote omits these
- *   fields entirely, so a stricter test would refuse on the provider's own output and
- *   deadlock the update after next.
- */
-const isDefault = (live: Record<string, unknown>, field: string) =>
-  live[field] === undefined || live[field] === '' || live[field] === UNMANAGED_DEFAULTS[field];
-
-/**
- * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
- *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
- *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
- *   survive clock skew, a non-default issuer — loses all of it the moment this resource
- *   decides to update. A vanished key-length floor is a security regression that no plan
- *   output would ever mention, and a vanished backdating window breaks signing on exactly
- *   the skewed host it was added for. So reconcile refuses instead of writing.
- */
-const wouldErase = (live: Record<string, unknown>): readonly string[] => {
-  const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
-  if (Object.keys(extMap(live['allowed_user_key_lengths'])).length > 0) {
-    lost.push('allowed_user_key_lengths');
-  }
-  return lost.sort();
-};
-
 const refuse = (message: string) => Effect.die(new Error(message));
 
 export const BaoSshRoleProvider = () =>
@@ -147,18 +106,19 @@ export const BaoSshRoleProvider = () =>
          *   at risk when something actually writes; if every managed field already matches,
          *   the honest answer is `noop` and nothing gets destroyed.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
-          const form = resolve(news);
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
            * ⛔ A RENAMED ROLE IS A NEW PATH, NOT AN EDIT. `ssh/roles/x` and `ssh-host/roles/x`
            *   are different mounts with different CAs. Without this, changing `name` or
            *   `mount` would write the new role and leave the old one signing certificates
-           *   for as long as anyone remembered its name.
+           *   for as long as anyone remembered its name. Judged before `isResolved(news)`, and
+           *   ⛔ a move onto a role that exists fails the plan (rename-identity.ts).
            */
-          if (output.mount !== form.mount || output.name !== form.name) {
-            return { action: 'replace' } as const;
-          }
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
+          const form = resolve(news);
           const found = yield* readRole(form);
           if (found === undefined) return { action: 'update' } as const;
           return matches(found.attributes, form)
@@ -166,9 +126,11 @@ export const BaoSshRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ news, output }) {
           const form = resolve(news);
           const path = readPath(form.mount, form.name);
+          // ⛔ An `update` across a move the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
 
           const bad = badDurations(form);
           if (bad.length > 0) {