@homeflare/alchemy 0.7.0 → 0.10.0

package/src/openbao/README.md

@@ -14,6 +14,14 @@ plus `FetchHttpClient.layer`.
   secret, a CA key, a plugin `env` or an OIDC client secret.
 - Every family defaults to `retain` on destroy. For what a rename does, read
   [REPLACE.md](./REPLACE.md) before you change any resource's path or name.
+- ⛔ A rename or move onto a name or path that already exists fails the plan, before anything is
+  written (every family but the mounts, whose moves are below). Move through a free name, in two
+  deploys, or remove the target first.
+- ⛔ **Nothing is adopted without `--adopt`** (0.9.0), not even an object identical to the
+  declaration: a live name with no state fails the plan, or the apply when a prop was an Output.
+  Our own interrupted create still resumes when its row can prove it — not one killed while a
+  prop was still an Output. [docs/ownership.md](../../docs/ownership.md). Change
+  a logical id with Alchemy's `renamedFrom` (REPLACE.md), never by adopting.
 
 ## assertBaoIdentity: call it first
 
@@ -70,9 +78,10 @@ export const hostRoles = Effect.gen(function* () {
 - A role is named `<class>--<host>`. Class and host names may contain only lowercase letters,
   digits and single hyphens.
 - It refuses `secretIdTtl` 0 (a secret_id that never expires), empty policies, `root`, unknown
-  classes and duplicate hosts.
+  classes and a host listed twice in one class. A host in several classes gets one role per class.
 - ⚠️ Renaming a host or class makes a new role. Under `retain` the old one stays live and keeps
-  admitting its secret_ids (REPLACE.md).
+  admitting its secret_ids (REPLACE.md). Under `destroy` its secret_ids go, but tokens it already
+  issued run to their TTL: deleting a role revokes no token.
 
 ## BaoJwtRole / BaoKubernetesRole / BaoJwtAuthConfig
 

package/src/openbao/REPLACE.md

@@ -4,9 +4,10 @@ Audited 2026-09-21, against `alchemy@2.0.0-beta.79` and OpenBao v2.6.2 source, i
 Every kit provider must answer `replace` correctly (vault consolidation plan, "Replace freely").
 
 ★ **Measured, not only read.** `fake-stack.ts` runs beta.79's own `Plan.make` and `apply` over an
-in-memory state store against the fake engines in `fake-engines.ts`. `policy-rename.test.ts`,
-`role-rename.test.ts` and `rename-occupied.test.ts` deploy, rename, and deploy again, then check
-the plan and every call that reached the fake.
+in-memory state store against the fake engines in `fake-engines.ts` and `fake-engines-roles.ts`.
+`policy-rename.test.ts`, `role-rename.test.ts`, `rename-occupied.test.ts`,
+`rename-families.test.ts`, `rename-identity.test.ts` and `rename-adoption.test.ts` deploy, rename,
+and deploy again, then check the plan and every call that reached the fake.
 
 ## What Alchemy does with each answer
 
@@ -44,46 +45,60 @@ stayed live. `destroy` could not help, because nothing recorded the old one.
 
 ## Answers, by resource
 
-| Resource                  | Identity change | Answer now                                                                                                                                                                         | Other changes                                                                               |
-| ------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
-| `Bao.Mount`               | `path`          | ⛔ **fails the plan**, unless `remountFrom` names the old path. Then it is an in-place `update` that moves the mount with `sys/remount`.                                           | `type` → `replace` that **fails at apply** (below). Description and TTLs → `update` (tune). |
-| `Bao.AuthMethod`          | `path`          | Same as `Bao.Mount` (`auth/` prefix). The accessor survives the move.                                                                                                              | `type` → `replace` that **fails at apply** (below)                                          |
-| `Bao.AuthRole`            | `name`          | `replace`. Before 2026-09-21 it was `update`, and the old role was orphaned.                                                                                                       | `update`                                                                                    |
-| `Bao.PkiRole`             | `mount`, `name` | `replace`. Before, only a `mount` change was caught; a `name` change orphaned the old role.                                                                                        | `update` (full-replace write)                                                               |
-| `Bao.JwtRole`             | `mount`, `name` | `replace`                                                                                                                                                                          | `update` (merge write; every managed field is sent)                                         |
-| `Bao.KubernetesRole`      | `mount`, `name` | `replace`                                                                                                                                                                          | `update`                                                                                    |
-| `Bao.JwtAuthConfig`       | `mount`         | `replace`. The old delete is a no-op because there is no delete endpoint.                                                                                                          | `update` (full-replace write)                                                               |
-| `Bao.MfaTotpMethod`       | `name`          | ⛔ **fails the plan**: a new id would strand every enrolled secret                                                                                                                 | `update` (the upsert keeps the id)                                                          |
-| `Bao.MfaLoginEnforcement` | `name`          | `replace`. Its delete is **refused** (openbao#4030)                                                                                                                                | `update`                                                                                    |
-| `Bao.Policy`              | `name`          | `replace` (batch 3A). Compared as OpenBao keys it, trimmed and lowercased, so `Admin` → `admin` is the same policy: `noop`. ⛔ **Fails the plan** onto a name that exists (below). | `update` (fragments digest)                                                                 |
-| `Bao.CloudflareRole`      | `mount`, `name` | `replace` (batch 3A). Exact; a trailing `/` on the mount is the same path. ⛔ **Fails the plan** onto a role that exists (below).                                                  | `update`                                                                                    |
-| `Bao.ProxmoxRole`         | `mount`, `name` | `replace` (batch 3A). ⛔ **Fails the plan** onto a role that exists, or if the rename also changes `mintUser` unless `allowMintUserChange` names the old one.                      | `update`. A `mintUser` change at the same path is refused at apply, never replaced.         |
+⛔ Every family below except `Bao.Mount` and `Bao.AuthMethod` judges its identity **before**
+`isResolved(news)`, and **fails the plan** on a move onto an object that already exists
+(`rename-identity.ts`, below). Names compare as the server keys them: exact, except where a row
+says folded.
+
+| Resource                  | Identity change           | Answer now                                                                                                                                                            | Other changes                                                                               |
+| ------------------------- | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `Bao.Mount`               | `path`                    | ⛔ **fails the plan**, unless `remountFrom` names the old path. Then it is an in-place `update` that moves the mount with `sys/remount`.                              | `type` → `replace` that **fails at apply** (below). Description and TTLs → `update` (tune). |
+| `Bao.AuthMethod`          | `path`                    | Same as `Bao.Mount` (`auth/` prefix). The accessor survives the move.                                                                                                 | `type` → `replace` that **fails at apply** (below)                                          |
+| `Bao.AuthRole`            | `name` (folded)           | `replace`. Before 2026-09-21 it was `update`, and the old role was orphaned. Its delete clears the secret_ids; issued tokens run to their TTL (below).                | `update`                                                                                    |
+| `Bao.PkiRole`             | `mount`, `name`           | `replace`. Before, only a `mount` change was caught; a `name` change orphaned the old role.                                                                           | `update` (full-replace write)                                                               |
+| `Bao.JwtRole`             | `mount`, `name` (folded)  | `replace`. The name is folded: the server reads it lowercased (TypeLowerCaseString).                                                                                  | `update` (merge write; every managed field is sent)                                         |
+| `Bao.KubernetesRole`      | `mount`, `name` (folded)  | `replace`. The name is folded, as the server stores it.                                                                                                               | `update`                                                                                    |
+| `Bao.JwtAuthConfig`       | `mount`                   | `replace`. The old delete is a no-op because there is no delete endpoint. A move onto a mount with a config fails the plan too: it would rewrite that mount's logins. | `update` (full-replace write)                                                               |
+| `Bao.MfaTotpMethod`       | `name`                    | ⛔ **fails the plan**: a new id would strand every enrolled secret. Reconcile refuses it too, when the name was an Output.                                            | `update` (the upsert keeps the id)                                                          |
+| `Bao.MfaLoginEnforcement` | `name`                    | `replace`. Its delete is **refused** (openbao#4030)                                                                                                                   | `update`                                                                                    |
+| `Bao.SshRole`             | `mount`, `name`           | `replace`                                                                                                                                                             | `update` (full-replace write)                                                               |
+| `Bao.Plugin`              | `type`, `name`, `version` | `replace`: a version bump is a new catalog entry, and `retain` keeps the old version registered.                                                                      | `update` (full-replace register)                                                            |
+| `Bao.Policy`              | `name`                    | `replace` (batch 3A). Compared as OpenBao keys it, trimmed and lowercased, so `Admin` → `admin` is the same policy: `noop`.                                           | `update` (fragments digest)                                                                 |
+| `Bao.CloudflareRole`      | `mount`, `name`           | `replace` (batch 3A). Exact; a trailing `/` on the mount is the same path.                                                                                            | `update`                                                                                    |
+| `Bao.ProxmoxRole`         | `mount`, `name`           | `replace` (batch 3A). ⛔ **Fails the plan** if the rename also changes `mintUser`, unless `allowMintUserChange` names the old one.                                    | `update`. A `mintUser` change at the same path is refused at apply, never replaced.         |
 
 `hostAppRoles` makes no resources, but its names are identities: renaming a host or a class
 renames the role. With the logical id taken from the role name, as the README does, the old id
 leaves the stack: that is an orphan delete, not a `replace`. With a stable logical id,
-`Bao.AuthRole` plans a `replace`. Under the default `retain`, both leave the old role live.
+`Bao.AuthRole` plans a `replace`. Under the default `retain`, both leave the old role live. A
+host may sit in several classes: it gets one role per class, and only the same host twice in one
+class is refused.
 
 ## When the new identity is not known at plan
 
 - **Only another prop is pending** (say `fragments` is an Output of an upstream that is also
-  changing). `Bao.Policy`, `Bao.CloudflareRole` and `Bao.ProxmoxRole` judge the identity props
-  before `isResolved(news)` (`rename.ts`), so the rename still plans `replace`. Measured.
+  changing). Every family judges the identity props before `isResolved(news)`
+  (`rename-identity.ts`), so the rename still plans `replace`. Measured for all twelve. Before
+  2026-09-21 the nine batch-2 families planned `update` here and orphaned the old object.
 - **The identity itself is pending.** Then the diff defers: it never answers `replace` on an
   unknown identity, because under `destroy` a replace onto the same path deletes what it just
   wrote. The engine plans `update`, and reconcile, seeing the old attributes name another
   object, **refuses before any write**. The row is left `updating`, with the new props and the
-  old attributes. The next deploy sees both names and plans `replace`. Measured, for all three.
+  old attributes. The next deploy sees both names and plans `replace`. Measured for all twelve.
+  `Bao.MfaTotpMethod` refuses there with its rename refusal, and its next plan fails the same way.
 - `Bao.ProxmoxRole` defers the same way while `mintUser` or `allowMintUserChange` is pending on a
   rename, because the re-scope guard cannot be checked. Measured for `allowMintUserChange`.
 
 ## A move onto an object that already exists fails the plan
 
-⛔ All three read the new path at plan (`judgeMove`, `rename.ts`) and refuse the move if anything
-is there. 🔴 Measured before the guard: two policies that swapped names under
+⛔ Every family in the table reads the new path at plan (`judgeMove`, `rename.ts`) and refuses the
+move if anything is there. 🔴 Measured before the guard: two policies that swapped names under
 `RemovalPolicy.destroy()` both planned `replace`. Each new generation wrote over the other's live
 policy, and each old generation's delete then removed the name the other had just written. The
-deploy was green, and both policies were gone, every grant revoked. Measured the same way:
+deploy was green, and both policies were gone, every grant revoked. The same swap deleted both
+objects for `Bao.AuthRole`, `Bao.PkiRole`, `Bao.JwtRole`, `Bao.KubernetesRole`, `Bao.SshRole` and
+`Bao.Plugin`. `Bao.JwtAuthConfig` (no delete) and `Bao.MfaLoginEnforcement` (delete refused) lost
+nothing, but each new generation silently rewrote the other's live object. Measured the same way:
 
 - a shift (`a → b` while `b → c`) deleted `b`, and a move onto the name of a resource leaving the
   stack deleted the name it moved onto;
@@ -94,10 +109,12 @@ deploy was green, and both policies were gone, every grant revoked. Measured the
 
 ⚠️ The diff cannot see the removal policy, so this refuses under `retain` too, where a swap would
 have been harmless. So would a move back onto a retained old generation. Move in two deploys
-through a name nothing holds, or remove the target by hand first. A change of policy-name case, or
-a trailing `/` on a mount, is the same object, so it is not a move and is never refused.
+through a name nothing holds, or remove the target by hand first. For `Bao.Plugin` that includes a
+version bump onto a version already registered by hand. A change of case the server folds (policy,
+AppRole, JWT and Kubernetes role names), or a trailing `/` on a mount, is the same object, so it is
+not a move and is never refused (`rename-identity.test.ts`).
 
-## What `retain` means for these three
+## What `retain` means for batch 3A and AppRole
 
 Under the default `retain` the old generation is kept, and the apply says so ("Replaced resource
 retained."). It is live and unmanaged from then on:
@@ -112,13 +129,29 @@ retained."). It is live and unmanaged from then on:
 - **`Bao.ProxmoxRole`**: the same, and the old role keeps minting under its old `mint_user`. The
   plugin's delete leaves outstanding leases revocable (its own
   `TestDeletingARoleLeavesItsOutstandingLeasesRevocable`).
+- **`Bao.AuthRole`**: the old role keeps admitting its secret_ids. Under `destroy` the delete
+  removes every secret_id and the role_id, so no new login succeeds, but it revokes no token:
+  tokens already issued live to their TTL and only fail to renew (openbao v2.6.2 approle
+  `pathRoleDelete`, path_role.go:1858-1902; `pathLoginRenew`, path_login.go:414-438). Revoke by
+  accessor to contain one.
 
 ★ A stack that puts `mount` and `name` in the logical id, as homeflare-openbao's
 `declareCloudflareRoles` does, never reaches the `replace`: the old id leaves the stack as an
 orphan delete, which `retain` also keeps live.
 
-⚠️ A NEW declaration (a new logical id) of a name that already exists still takes that object over
-and rewrites it: these families' `read` never answers `Unowned`, so Alchemy adopts it.
+## A new declaration of a live name: refused unless adopted
+
+⛔ A NEW logical id whose name already exists now FAILS THE PLAN (0.9.0): with no state, `read`
+answers `Unowned` for any live object, identical or not (`src/ownership/probe.ts`,
+[docs/ownership.md](../../docs/ownership.md)). Nothing moved, so `judgeMove` never runs; the
+probe is what catches it. 🔴 Measured before (`rename-adoption.test.ts`): the families' `read`
+answered plain attributes, so Alchemy silently adopted the object, and under `destroy` the old
+owner's delete then ran after the adoption wrote and removed the object the new id claimed, in a
+green deploy — for each of the nine batch-2 families whose delete runs (a TOTP method and its
+enrolments included), and when a new `Bao.AuthRole` took a name another one moved off in the same
+deploy. ⚠️ `--adopt` is exactly that takeover again, on purpose. Change a logical id with Alchemy's
+`renamedFrom('<old id>')`, which migrates the state row and plans an `update`. Take a freed name
+in the deploy after the move.
 
 ## Why the moves fail instead of replacing
 
@@ -152,12 +185,9 @@ take every secret with it. (Corrected 2026-09-21: the first audit listed this as
 3. **Unique names need `deleteFirst`.** Only a mount's `type` change keeps its unique path, and
    it fails on purpose instead (above).
 
-## Open
+## Closed
 
-- ⚠️ **Nine families still check the identity after `isResolved(news)`**: `Bao.AuthRole`,
-  `Bao.PkiRole`, `Bao.JwtRole`, `Bao.KubernetesRole`, `Bao.JwtAuthConfig`, `Bao.MfaTotpMethod`,
-  `Bao.MfaLoginEnforcement`, `Bao.SshRole` and `Bao.Plugin`. A rename that lands in the same
-  deploy as any pending Output plans `update`, and none of their reconciles has the moved-update
-  guard. For `Bao.MfaTotpMethod` that writes a second method and strands every enrolment. The
-  helpers in `rename.ts` close it the same way. (`Bao.Mount` and `Bao.AuthMethod` are safe: their
-  reconcile re-plans the move from the stated path.)
+- ✅ **Nine families checked the identity after `isResolved(news)`** and never read the target
+  (closed 2026-09-21 by `rename-identity.ts`, measured in `rename-families.test.ts`).
+  `Bao.Mount` and `Bao.AuthMethod` never needed it: their reconcile re-plans the move from the
+  stated path.

package/src/openbao/adopt-core.test.ts

@@ -0,0 +1,119 @@
+/**
+ * The ownership rule for the five families fake-core.ts carries — Bao.Policy, Bao.CloudflareRole,
+ * Bao.ProxmoxRole, Bao.Mount and Bao.AuthMethod — through Alchemy's own plan and apply: the same
+ * claims adopt-families.test.ts and adopt-recovery.test.ts make for the other nine.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import { BaoAuthRole } from './auth-role.ts';
+import { crashAfterWrite } from './fake-bao.ts';
+import { CORE, type CoreRow, withCore } from './fake-core.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+
+/** `Z`, with its knob an Output until apply: an upstream AppRole's `tokenTtl`, created with it. */
+const pending = (row: CoreRow) =>
+  Effect.gen(function* () {
+    const up = yield* BaoAuthRole('Upstream', {
+      name: 'upstream',
+      secretIdTtl: '24h',
+      tokenMaxTtl: '1h',
+      tokenPolicies: ['default'],
+      tokenTtl: '15m',
+    });
+    yield* row.declare('Z', up.tokenTtl);
+  });
+
+for (const row of CORE) {
+  describe(`${row.family}: ownership`, () => {
+    it('a live object another stack owns, identical, fails the plan; nothing is written', async () => {
+      await withCore(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate));
+        assert.deepEqual(await stack.deploy(row.declare('Z', '15m'), { adopt: true }), {
+          Z: 'adopted',
+        });
+        assert.deepEqual(writesOf(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, the apply refuses it; the next plan refuses too', async () => {
+      await withCore(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), NOT_OWNED);
+        assert.deepEqual(
+          writesOf(seen).filter((line) => !line.endsWith('/upstream')),
+          [],
+        );
+      });
+    });
+
+    it('with a prop still an Output, --adopt takes it over at apply', async () => {
+      await withCore(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        assert.deepEqual(await stack.deploy(pending(row), { adopt: true }), {
+          Upstream: 'create',
+          Z: 'create',
+        });
+      });
+    });
+
+    it('an interrupted create is resumed without --adopt, and nothing is rewritten', async () => {
+      const fault = crashAfterWrite();
+      await withCore(async (stack, estate, seen) => {
+        // ★ Bao.Policy reads nothing back after its write, so the crash is the write's own reply.
+        fault.crashNext(row.family === 'Bao.Policy' ? 'write' : 'read-back');
+        await assert.rejects(stack.deploy(row.declare('X', '15m')), /injected/);
+        assert.ok(row.has(estate));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(row.declare('X', '15m')), { X: 'create' });
+        assert.deepEqual(writesOf(seen), []);
+      }, fault.wrap);
+    });
+  });
+}
+
+describe('Bao.Mount: remountFrom on a create', () => {
+  const moved = BaoMount('Kv', { path: 'kv-moved', remountFrom: 'kv', type: 'kv' });
+  const SOURCE = /Bao\.Mount kv \(the remountFrom source\): already exists/;
+
+  it('moving a live mount this stack holds no state for is refused before the move', async () => {
+    await withCore(async (stack, estate, seen, owner) => {
+      await owner.deploy(BaoMount('Src', { path: 'kv', type: 'kv' }));
+      seen.length = 0;
+      // ★ The probe reads only the target, which is free: the plan says create.
+      await assert.rejects(stack.deploy(moved), SOURCE);
+      assert.deepEqual(writesOf(seen), []);
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv/']);
+      assert.deepEqual(await stack.deploy(moved, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv-moved/']);
+    });
+  });
+});
+
+describe('Bao.Mount: a create interrupted between its enable and its tune', () => {
+  it('is not proven ours — the mount is not what was declared — so it resumes with --adopt', async () => {
+    const fault = crashAfterWrite();
+    const kv = BaoMount('Kv', { defaultLeaseTtl: '15m', path: 'kv', type: 'kv' });
+    await withCore(async (stack, estate) => {
+      fault.crashNext('write');
+      await assert.rejects(stack.deploy(kv), /injected/);
+      assert.ok(estate.mounts.table.has('kv/'));
+      await assert.rejects(stack.deploy(kv), /Cannot resume creating resource 'Kv'.*--adopt/s);
+      assert.deepEqual(await stack.deploy(kv, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual(await stack.deploy(kv), { Kv: 'noop' });
+    }, fault.wrap);
+  });
+});

package/src/openbao/adopt-families.test.ts

@@ -0,0 +1,97 @@
+/**
+ * NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21), for the nine batch-2 families, through
+ * Alchemy's own plan and apply (fake-stack.ts). The object is put there by ANOTHER stack over the
+ * same fake (`owner`) — the case the rule exists for: identical to this declaration, and still
+ * not ours.
+ *   · plan time: the adoption probe answers `Unowned` (ownership/probe.ts);
+ *   · apply time: where the probe never ran — a prop still an Output — reconcile refuses before any
+ *     write (ownership/adopt.ts).
+ * adopt-recovery.test.ts pins the other side: our own interrupted create is still resumed.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Seen } from './fake-bao.ts';
+import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+const STILL_REFUSED = /Cannot adopt resource 'Z'.*--adopt/s;
+
+/** `Z` names `a`, with its knob an Output until apply: the upstream AppRole is created with it. */
+const pending = (row: Family, scoped?: boolean) =>
+  Effect.gen(function* () {
+    const up = yield* upstream('15m');
+    const declared = row.declare('Z', 'a', up.tokenTtl);
+    yield* scoped === undefined ? declared : declared.pipe(adopt(scoped));
+  });
+
+/** Writes other than the upstream AppRole's own create. */
+const writesToA = (seen: readonly Seen[]) =>
+  writesOf(seen).filter((line) => !line.endsWith('/upstream'));
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a live object another stack owns`, () => {
+    it('identical to the declaration, still fails the plan; nothing is written', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', 'a', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a'));
+      });
+    });
+
+    it('is adopted with --adopt, and with adopt(true) — identical, so nothing is written', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          seen.length = 0;
+          const body =
+            deploy === 'flag'
+              ? stack.deploy(row.declare('Z', 'a', '15m'), { adopt: true })
+              : stack.deploy(row.declare('Z', 'a', '15m').pipe(adopt(true)));
+          assert.deepEqual(await body, { Z: 'adopted' });
+          assert.deepEqual(writesOf(seen), []);
+        });
+      }
+    });
+
+    it('with a prop still an Output, the plan cannot ask, so the apply refuses', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        assert.deepEqual(writesToA(seen), []);
+        assert.ok(row.has(estate, 'a'));
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), STILL_REFUSED);
+        assert.deepEqual(writesToA(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, --adopt and adopt(true) take it over at apply', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, _seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          const planned =
+            deploy === 'flag'
+              ? await stack.deploy(pending(row), { adopt: true })
+              : await stack.deploy(pending(row, true));
+          assert.deepEqual(planned, { Upstream: 'create', Z: 'create' });
+        });
+      }
+    });
+
+    it('adopt(false) on the resource wins over --adopt, at apply as at plan', async () => {
+      await withEstate(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        await assert.rejects(stack.deploy(pending(row, false), { adopt: true }), TAKEOVER);
+      });
+    });
+  });
+}

package/src/openbao/adopt-holes.test.ts

@@ -0,0 +1,168 @@
+/**
+ * A deploy killed BEFORE a create's claim ran leaves a `creating` (or `replacing`) row that proves
+ * nothing: its create never asked whose object sat at its identity. Found by the red team on
+ * 2026-09-21, through Alchemy's own plan and apply, before ownership/whole.ts and the proof in
+ * ownership/resume.ts:
+ *   · an Output IDENTITY — every role family read an empty name, found nothing, "resumed" the create
+ *     and wrote over another owner's object;
+ *   · an Output KNOB — Bao.Mount and Bao.AuthMethod read the hole as "not managed", adopted another
+ *     owner's mount in the recovery read and tuned it;
+ *   · a REPLACE killed before its write — the next deploy wrote over whatever another owner had put
+ *     at the new identity since.
+ * Each is now refused, writing nothing; `--adopt` resumes it, as Alchemy offers for a create.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import { BaoAuthRole } from './auth-role.ts';
+import { type Seen, refuseWriteOnce } from './fake-bao.ts';
+import { CORE, type CoreRow, withCore } from './fake-core.ts';
+import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+import { BaoPkiRole } from './pki-role.ts';
+
+const REFUSED =
+  /Cannot resume creating resource 'Z'|: already exists, and this stack holds no state/s;
+const RESUME_REFUSED = /already exists, and this stack holds no state.*Deploy with --adopt/s;
+
+/** Writes other than the upstream's. */
+const writesBut = (seen: readonly Seen[], upstreamPath: string) =>
+  writesOf(seen).filter((line) => !line.endsWith(upstreamPath));
+
+/**
+ * `Z`'s NAME is an Output: an upstream named `a` hands it over. An AppRole, or — for Bao.AuthRole,
+ * whose own `a` that would be — a PKI role.
+ */
+const namedByUpstream = (row: Family) => {
+  const approle = row.family !== 'Bao.AuthRole';
+  const path = approle ? '/auth/approle/role/a' : '/pki/roles/a';
+  const body = Effect.gen(function* () {
+    const up = approle
+      ? yield* BaoAuthRole('Upstream', {
+          name: 'a',
+          secretIdTtl: '24h',
+          tokenMaxTtl: '1h',
+          tokenPolicies: ['default'],
+          tokenTtl: '15m',
+        })
+      : yield* BaoPkiRole('Upstream', {
+          allowedDomains: ['x.test'],
+          maxTtl: '1h',
+          name: 'a',
+          ttl: '30m',
+        });
+    yield* row.declare('Z', up.name, '15m');
+  });
+  return { body, path };
+};
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a create killed before its claim, its name an Output`, () => {
+    it('never writes over the object another stack owns; --adopt takes it over', async () => {
+      const { body, path } = namedByUpstream(row);
+      const fault = refuseWriteOnce(path);
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '30m'));
+        await assert.rejects(stack.deploy(body), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(body), REFUSED);
+        assert.deepEqual(writesBut(seen, path), []);
+        await stack.deploy(body, { adopt: true });
+      }, fault);
+    });
+  });
+
+  describe(`${row.family}: a create killed before its claim, a knob an Output`, () => {
+    it('never adopts the object another stack owns', async () => {
+      const fault = refuseWriteOnce('/upstream');
+      const body = Effect.gen(function* () {
+        yield* row.declare('Z', 'a', (yield* upstream('15m')).tokenTtl);
+      });
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '30m'));
+        await assert.rejects(stack.deploy(body), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(body), REFUSED);
+        assert.deepEqual(writesBut(seen, '/upstream'), []);
+      }, fault);
+    });
+  });
+}
+
+/** `Z` at the row's fixed identity, its knob an upstream AppRole's `tokenTtl`. */
+const pendingCore = (row: CoreRow) =>
+  Effect.gen(function* () {
+    const up = yield* BaoAuthRole('Upstream', {
+      name: 'upstream',
+      secretIdTtl: '24h',
+      tokenMaxTtl: '1h',
+      tokenPolicies: ['default'],
+      tokenTtl: '15m',
+    });
+    yield* row.declare('Z', up.tokenTtl);
+  });
+
+for (const row of CORE) {
+  describe(`${row.family}: a create killed before its claim, a knob an Output`, () => {
+    it('never adopts — or tunes — the object another stack owns; --adopt takes it over', async () => {
+      const fault = refuseWriteOnce('/upstream');
+      await withCore(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '30m'));
+        await assert.rejects(stack.deploy(pendingCore(row)), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pendingCore(row)), REFUSED);
+        assert.deepEqual(writesBut(seen, '/upstream'), []);
+        await stack.deploy(pendingCore(row), { adopt: true });
+      }, fault);
+    });
+  });
+}
+
+describe('Bao.Mount: a create killed before its claim, its path an Output', () => {
+  it('never tunes the mount another stack owns; --adopt takes it over', async () => {
+    const fault = refuseWriteOnce('/auth/approle/role/kv');
+    const body = Effect.gen(function* () {
+      const up = yield* BaoAuthRole('Upstream', {
+        name: 'kv',
+        secretIdTtl: '24h',
+        tokenMaxTtl: '1h',
+        tokenPolicies: ['default'],
+        tokenTtl: '15m',
+      });
+      yield* BaoMount('Z', { defaultLeaseTtl: '15m', path: up.name, type: 'kv' });
+    });
+    await withCore(async (stack, _estate, seen, owner) => {
+      await owner.deploy(BaoMount('X', { defaultLeaseTtl: '30m', path: 'kv', type: 'kv' }));
+      await assert.rejects(stack.deploy(body), /injected/);
+      seen.length = 0;
+      await assert.rejects(stack.deploy(body), REFUSED);
+      assert.deepEqual(writesBut(seen, '/auth/approle/role/kv'), []);
+      await stack.deploy(body, { adopt: true });
+    }, fault);
+  });
+});
+
+/** Bao.MfaTotpMethod never renames (mfa-totp.ts), so it has no replace to interrupt. */
+for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')) {
+  describe(`${row.family}: a replace killed before its write`, () => {
+    it('never writes over what another stack put at the new identity since; --adopt does', async () => {
+      const suffix = row.family === 'Bao.JwtAuthConfig' ? '/b/config' : '/b';
+      const fault = refuseWriteOnce(suffix);
+      const { retain } = RemovalPolicy;
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await stack.deploy(row.declare('X', 'a', '15m', retain));
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), /injected/);
+        await owner.deploy(row.declare('O', 'b', '30m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), RESUME_REFUSED);
+        assert.deepEqual(writesOf(seen), []);
+        await stack.deploy(row.declare('X', 'b', '15m', retain), { adopt: true });
+        assert.notDeepEqual(writesOf(seen), []);
+      }, fault);
+    });
+  });
+}