@homeflare/alchemy 0.7.0 → 0.10.0

package/src/openbao/pki-role.ts

@@ -43,8 +43,10 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
-import { mountPath } from './mount-form.ts';
 import {
   type BaoPkiRoleAttributes,
   type BaoPkiRoleProps,
@@ -54,6 +56,7 @@ import {
   rolePath,
   writeBody,
 } from './pki-role-form.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoPkiRoleAttributes, BaoPkiRoleProps };
 
@@ -69,6 +72,13 @@ export const BaoPkiRole = Resource<BaoPkiRole>('Bao.PkiRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: the engine stores `role/<name>` verbatim (builtin/logical/pki/path_roles.go:963). */
+const IDENTITY = roleIdentity<BaoPkiRoleAttributes>(
+  'Bao.PkiRole',
+  (mount, name) => rolePath({ mount, name }),
+  'pki',
+);
+
 const readRole = (props: BaoPkiRoleProps) =>
   Effect.gen(function* () {
     const live = yield* baoRead(rolePath(props));
@@ -88,8 +98,13 @@ export const BaoPkiRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(
+            () => found !== undefined && problems(olds).length === 0 && matches(found, olds),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -100,18 +115,22 @@ export const BaoPkiRoleProvider = () =>
          *   fields is also what stops a field being added to props and quietly forgotten in
          *   the comparison.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
            * ⚠️ A ROLE IS IDENTIFIED BY MOUNT **AND** NAME. Moving a declaration to another
            *   engine is a different object under a different CA, never an in-place edit —
-           *   `replace`, so Alchemy creates the new one and retires the old.
+           *   `replace`, so Alchemy creates the new one and retires the old. Judged before
+           *   `isResolved(news)`, and ⛔ a move onto a role that exists fails the plan
+           *   (rename-identity.ts).
            * ⛔ A RENAME WAS NOT CAUGHT UNTIL 2026-09-21 (REPLACE.md): only the mount was compared,
            *   so a new `name` read nothing at the new path, planned `update`, wrote the new role,
            *   and left the old one issuing certificates under no state record at all.
            */
-          if (mountPath(news.mount ?? 'pki') !== output.mount || news.name !== output.name)
-            return { action: 'replace' } as const;
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
           /**
            * ⚠️ A DECLARATION reconcile WOULD REFUSE MUST NEVER PLAN AS noop. An empty
            *   allowedDomains, or a duration OpenBao cannot parse, can compare equal to a
@@ -127,8 +146,10 @@ export const BaoPkiRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news);
+          // ⛔ An `update` across a move the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
           /**
            * ⛔ AN EMPTY allowedDomains IS A REFUSAL, NOT AN EMPTY ROLE. `allow_any_name` is
            *   false on every live role, so a role with no allowed domains can issue NOTHING —
@@ -141,6 +162,8 @@ export const BaoPkiRoleProvider = () =>
             return yield* Effect.die(new Error(`Bao.PkiRole ${path}: ${bad.join(' ')}`));
           }
           const live = yield* readRole(news);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.PkiRole ${path}`);
           if (live === undefined || !matches(live, news)) {
             yield* baoWrite('PUT', path, writeBody(news));
           }
@@ -183,5 +206,5 @@ export const BaoPkiRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/plugin-reconcile.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {
   type BaoPluginAttributes,
@@ -39,18 +40,25 @@ const refuse = (form: BaoPluginForm, message: string) =>
  *   nothing, or finds an OLDER genuinely-unversioned entry. The Cloudflare engine reports one
  *   (`framework.Backend.RunningVersion`). REASONED FROM SOURCE, not measured against a server.
  * ⚠️ THE WRITE HAS ALREADY LANDED when this fires, so the catalog holds a registration no state
- *   record names. Declaring the reported version adopts it on the next deploy (same sha256 and
- *   command, so reconcile matches and writes nothing); declaring a DIFFERENT version is refused by
- *   the server itself (setInternal :1219-1221, "plugin version mismatch").
+ *   record names. Declaring the reported version and deploying once with `--adopt` adopts it (same
+ *   sha256 and command, so reconcile matches and writes nothing); declaring a DIFFERENT version is
+ *   refused by the server itself (setInternal :1219-1221, "plugin version mismatch").
+ * ⚠️ `--adopt`, NOT A SILENT RESUME (2026-09-21): the row this create left names the UNVERSIONED
+ *   entry, so it cannot prove the versioned one ours (docs/ownership.md).
  */
 const SELF_REPORTED =
   'the write succeeded but the read-back does not match. If the binary reports its own version, ' +
   'OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` ' +
-  'as exactly the version the binary reports; that adopts the entry this write just made.';
+  'as exactly the version the binary reports, and deploy once with --adopt: that adopts the ' +
+  'entry this write just made.';
 
-/** Register when the live entry differs, then prove it by reading back. Dies on a refusal. */
+/**
+ * Register when the live entry differs, then prove it by reading back. Dies on a refusal.
+ * ⛔ `claim` (the provider passes it): a create never takes over an entry already registered.
+ */
 export const reconcilePlugin = (
   props: BaoPluginProps,
+  claim?: Claim,
 ): Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const form = resolve(props);
@@ -58,6 +66,9 @@ export const reconcilePlugin = (
     if (bad.length > 0) return yield* refuse(form, bad.join('; '));
 
     const found = yield* readEntry(form);
+    if (found !== undefined && claim !== undefined) {
+      yield* claim(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}`);
+    }
     if (found !== undefined && !matches(found.attributes, form)) {
       /**
        * ⛔ A DECLARATIVE OR OCI ENTRY BELONGS TO THE SERVER'S CONFIG FILE (`plugin` stanzas with

package/src/openbao/plugin.ts

@@ -24,9 +24,22 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
-import { type BaoPluginAttributes, type BaoPluginProps, matches, resolve } from './plugin-form.ts';
+import { claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
+import {
+  type BaoPluginAttributes,
+  type BaoPluginProps,
+  type BaoPluginType,
+  matches,
+  problems,
+  resolve,
+  versionedPath,
+} from './plugin-form.ts';
 import { readEntry, reconcilePlugin } from './plugin-reconcile.ts';
 import { deregisterPlugin } from './plugin-wire.ts';
+import { declaredOr, declaredString } from './rename.ts';
+import { type Identity, guardRename, judgeRename } from './rename-identity.ts';
 
 export type { BaoPluginAttributes, BaoPluginProps, BaoPluginType } from './plugin-form.ts';
 
@@ -42,6 +55,24 @@ export const BaoPlugin = Resource<BaoPlugin>('Bao.Plugin', {
   defaultRemovalPolicy: 'retain',
 });
 
+/**
+ * ⛔ NAME, TYPE AND VERSION ARE THE CATALOG KEY, so the identity is the versioned path a read and a
+ *   delete address. Exact: the catalog stores `<type>/<name>/<version>` as given, and the version
+ *   is already canonical (`problems`). ⚠️ An unversioned name that is a builtin reads back as
+ *   present (plugin-wire.ts), so a move onto one fails the plan, as reconcile would refuse anyway.
+ */
+const IDENTITY: Identity<BaoPluginAttributes> = {
+  declared: (props) => {
+    const type = declaredString(props, 'type') as BaoPluginType | undefined;
+    const name = declaredString(props, 'name');
+    const version = declaredOr(props, 'version', '');
+    if (type === undefined || name === undefined || version === undefined) return undefined;
+    return versionedPath(type, name, version);
+  },
+  family: 'Bao.Plugin',
+  recorded: (output) => versionedPath(output.type, output.name, output.version),
+};
+
 export const BaoPluginProvider = () =>
   Provider.effect(
     BaoPlugin,
@@ -54,27 +85,31 @@ export const BaoPluginProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          const found = yield* readEntry(resolve(olds));
-          return found?.attributes;
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const form = resolve(olds);
+          const found = yield* readEntry(form);
+          const ours = Effect.sync(
+            () =>
+              found !== undefined && problems(form).length === 0 && matches(found.attributes, form),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
         }),
 
         /** ⛔ IT COMPARES THE LIVE ENTRY, NOT THE STORED DIGEST — a hand re-register is drift. */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
-          const form = resolve(news);
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
-           * ⛔ NAME, TYPE AND VERSION ARE THE CATALOG KEY, so changing one is a different entry,
-           *   not an edit. Writing the new key would leave the old registration in place under a
-           *   state record that no longer names it.
+           * ⛔ A NEW NAME, TYPE OR VERSION IS A DIFFERENT ENTRY, not an edit: `replace`, judged
+           *   before `isResolved(news)`. Writing the new key in place would leave the old
+           *   registration under a state record that no longer names it. ⛔ A move onto an entry
+           *   that is already registered fails the plan (rename-identity.ts).
            */
-          if (
-            output.name !== form.name ||
-            output.type !== form.type ||
-            output.version !== form.version
-          ) {
-            return { action: 'replace' } as const;
-          }
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
+          const form = resolve(news);
           const found = yield* readEntry(form);
           if (found === undefined) return { action: 'update' } as const;
           return matches(found.attributes, form)
@@ -83,8 +118,10 @@ export const BaoPluginProvider = () =>
         }),
 
         /** The refusals — declarative, builtin, self-reported version — live in plugin-reconcile.ts. */
-        reconcile: Effect.fn(function* ({ news }) {
-          return yield* reconcilePlugin(news);
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+          // ⛔ An `update` across a move the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
+          return yield* reconcilePlugin(news, claimFor({ fqn, instanceId, output }));
         }),
 
         /**
@@ -96,5 +133,5 @@ export const BaoPluginProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/policy.ts

@@ -5,10 +5,14 @@ import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Path from 'effect/Path';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { sha256 } from './digest.ts';
 import { isEmptyAssembly } from './policy-assembly.ts';
 import { deletePolicy, policyPath, readPolicy, writePolicy } from './policy-wire.ts';
-import { declaredString, isMoved, judgeMove, policyKey, refuseMovedUpdate } from './rename.ts';
+import { policyKey } from './rename.ts';
+import { guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
 
 /**
  * An OpenBao ACL policy, assembled from the HCL fragments that declare it.
@@ -99,6 +103,9 @@ export const BaoPolicy = Resource<BaoPolicy>('Bao.Policy', {
   defaultRemovalPolicy: 'retain',
 });
 
+/** A policy is its name, keyed as OpenBao keys it (`policyKey`). */
+const IDENTITY = nameIdentity<BaoPolicyAttributes>('Bao.Policy', policyPath, policyKey);
+
 /** `path "..."` grant count — the same number the apply script prints. */
 const grantsOf = (hcl: string) => (hcl.match(/^path /gm) ?? []).length;
 
@@ -134,9 +141,16 @@ export const BaoPolicyProvider = () =>
         list: () => Effect.succeed([]),
 
         // ★ '' means genuinely absent (a 404); a refusal fails. policy-wire.ts has the history.
-        read: Effect.fn(function* ({ olds }) {
+        // ⛔ With no attributes in state, a live policy is `Unowned` unless it is the one our own
+        //   interrupted create wrote: these fragments, byte for byte (ownership/probe.ts).
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const live = yield* readPolicy(olds.name);
-          return live.length === 0 ? undefined : attributesOf(olds.name, live, 0);
+          const found = live.length === 0 ? undefined : attributesOf(olds.name, live, 0);
+          const ours = Effect.map(
+            assemble(olds.fragments),
+            (a) => sha256(a.joined) === found?.digest,
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -156,9 +170,8 @@ export const BaoPolicyProvider = () =>
            *   delete, so a role outside this graph that names the old policy must move in the same
            *   PR (REPLACE.md).
            */
-          const tried = output?.name ?? declaredString(olds, 'name');
-          const declared = declaredString(news, 'name');
-          const move = yield* judgeMove('Bao.Policy', tried, declared, policyPath, policyKey);
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           // ⚠️ A prop can still be an unresolved Output or Config at plan time. Docker's
@@ -172,12 +185,10 @@ export const BaoPolicyProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const name = news.name;
           // ⛔ An `update` across a rename the diff could not see — refused before any write.
-          if (output !== undefined && isMoved(output.name, name, policyKey) === true) {
-            return yield* refuseMovedUpdate(`Bao.Policy ${name}`, output.name, name);
-          }
+          yield* guardRename(IDENTITY, news, output);
           const { joined, parts } = yield* assemble(news.fragments);
           /**
            * ⛔ AN EMPTY ASSEMBLY IS A REFUSAL, NOT AN EMPTY POLICY. `bao policy write` with
@@ -207,6 +218,8 @@ export const BaoPolicyProvider = () =>
            *   sibling PVE provider does exactly this in pveOperations.reconcile.
            */
           const current = yield* readPolicy(name);
+          if (current.length > 0)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.Policy ${name}`);
           if (current.length > 0 && sha256(current) === sha256(joined)) {
             return attributesOf(name, joined, parts);
           }
@@ -231,5 +244,5 @@ export const BaoPolicyProvider = () =>
           return undefined;
         }),
       });
-    }),
+    }).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/proxmox-role.ts

@@ -40,6 +40,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoWrite } from './bao-http.ts';
 import {
   type BaoProxmoxRoleAttributes,
@@ -50,15 +53,8 @@ import {
   writeBody,
 } from './proxmox-role-form.ts';
 import { readRole } from './proxmox-role-wire.ts';
-import {
-  declaredRolePath,
-  declaredString,
-  isMoved,
-  isPendingProp,
-  judgeMove,
-  refuseMovedUpdate,
-  triedRolePath,
-} from './rename.ts';
+import { declaredString, isPendingProp } from './rename.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoProxmoxRoleAttributes, BaoProxmoxRoleProps };
 
@@ -74,6 +70,9 @@ export const BaoProxmoxRole = Resource<BaoProxmoxRole>('Bao.ProxmoxRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: the plugin stores `roles/<name>` verbatim. */
+const IDENTITY = roleIdentity<BaoProxmoxRoleAttributes>('Bao.ProxmoxRole', rolePath);
+
 export const BaoProxmoxRoleProvider = () =>
   Provider.effect(
     BaoProxmoxRole,
@@ -88,8 +87,11 @@ export const BaoProxmoxRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -110,9 +112,8 @@ export const BaoProxmoxRoleProvider = () =>
            *   still an Output it cannot be checked, so the diff defers, and reconcile refuses the
            *   resulting `update`.
            */
-          const tried = triedRolePath(output, olds, rolePath);
-          const declared = declaredRolePath(news, rolePath);
-          const move = yield* judgeMove('Bao.ProxmoxRole', tried, declared, (path) => path);
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) {
             const mintUser = declaredString(news, 'mintUser');
@@ -148,14 +149,13 @@ export const BaoProxmoxRoleProvider = () =>
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news.mount, news.name);
           // ⛔ An `update` across a move the diff could not see — refused before any read or write.
-          const before = output === undefined ? path : rolePath(output.mount, output.name);
-          if (isMoved(before, path) === true) {
-            return yield* refuseMovedUpdate('Bao.ProxmoxRole', before, path);
-          }
+          yield* guardRename(IDENTITY, news, output);
           const live = yield* readRole(news);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.ProxmoxRole ${path}`);
           /**
            * ⛔ A mint_user CHANGE RE-SCOPES EVERY CREDENTIAL THE ROLE WILL EVER MINT, SILENTLY.
            *   The minted token inherits that PVE user's standing ACL and nothing else, so
@@ -235,5 +235,5 @@ export const BaoProxmoxRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/rename-adoption.test.ts

@@ -0,0 +1,95 @@
+/**
+ * The swap the plan-time rename guard cannot see: a NEW declaration of a name that is live.
+ * 🔴 MEASURED 2026-09-21 through Alchemy's own plan and apply (fake-stack.ts), before the ownership
+ * rule: with no state row the engine asked `read`, which answered plain attributes, so Alchemy
+ * silently adopted the object (alchemy@2.0.0-beta.79 Plan.ts, the adoption probe; AdoptPolicy.ts).
+ * Under `RemovalPolicy.destroy()` the old owner's delete then ran in Apply's phase 2 and removed the
+ * object the new declaration claimed — in a green deploy.
+ * ★ NOW (decided 2026-09-21): the probe answers `Unowned` for any live object (ownership/probe.ts),
+ *   so that plan FAILS before anything is written, and the takeover happens only when asked for —
+ *   which is exactly the old hazard, on purpose. These pin both, and the two ways round it
+ *   REPLACE.md gives: `renamedFrom` for a logical id that changes, and a second deploy for a name
+ *   another resource is leaving.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { renamedFrom } from 'alchemy';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import { FAMILIES, rowOf, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const { destroy } = RemovalPolicy;
+
+/** No delete endpoint (jwt-config.ts), and a delete the provider refuses (mfa-enforcement.ts). */
+const KEEPS = new Set(['Bao.JwtAuthConfig', 'Bao.MfaLoginEnforcement']);
+const REFUSES_DELETE = /Bao\.MfaLoginEnforcement a: REFUSING to delete/;
+const NOT_OWNED = /Cannot adopt resource 'Z'.*--adopt/s;
+
+describe('a logical id changed without renamedFrom, under destroy', () => {
+  for (const row of FAMILIES) {
+    it(`${row.family}: the plan refuses the live name, and nothing is written or deleted`, async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(row.declare('X', 'a', '15m', destroy));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', 'a', '15m', destroy)), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a'));
+      });
+    });
+
+    it(`${row.family}: --adopt is the takeover, and the old id's delete follows it`, async () => {
+      await withEstate(async (stack, estate) => {
+        await stack.deploy(row.declare('X', 'a', '15m', destroy));
+        const again = stack.deploy(row.declare('Z', 'a', '15m', destroy), { adopt: true });
+        if (row.family === 'Bao.MfaLoginEnforcement') await assert.rejects(again, REFUSES_DELETE);
+        else assert.deepEqual(await again, { X: 'delete', Z: 'adopted' });
+        assert.equal(row.has(estate, 'a'), KEEPS.has(row.family));
+      });
+    });
+  }
+});
+
+describe('the ways round it', () => {
+  const row = rowOf('Bao.AuthRole');
+
+  it('renamedFrom migrates the state row instead: an update that deletes nothing', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(row.declare('X', 'a', '15m', destroy));
+      seen.length = 0;
+      const moved = row.declare('Z', 'a', '15m', destroy).pipe(renamedFrom('X'));
+      assert.deepEqual(await stack.deploy(moved), { Z: 'update' });
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(row.has(estate, 'a'));
+    });
+  });
+
+  it('a name another resource moves off is refused when taken in the same deploy', async () => {
+    await withEstate(async (stack, estate, seen) => {
+      await stack.deploy(row.declare('X', 'a', '15m', destroy));
+      seen.length = 0;
+      const both = Effect.gen(function* () {
+        yield* row.declare('X', 'b', '15m', destroy);
+        yield* row.declare('Z', 'a', '30m', destroy);
+      });
+      await assert.rejects(stack.deploy(both), NOT_OWNED);
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(row.has(estate, 'a') && !row.has(estate, 'b'));
+    });
+  });
+
+  it('and succeeds when taken in the deploy after the move', async () => {
+    await withEstate(async (stack, estate) => {
+      await stack.deploy(row.declare('X', 'a', '15m', destroy));
+      await stack.deploy(row.declare('X', 'b', '15m', destroy));
+      const both = Effect.gen(function* () {
+        yield* row.declare('X', 'b', '15m', destroy);
+        yield* row.declare('Z', 'a', '30m', destroy);
+      });
+      assert.deepEqual(await stack.deploy(both), { X: 'noop', Z: 'create' });
+      assert.ok(row.has(estate, 'a') && row.has(estate, 'b'));
+    });
+  });
+});