@homeflare/alchemy 0.7.0 → 0.10.0

package/src/openbao/ssh-role.ts

@@ -36,6 +36,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import {
   type BaoSshRoleAttributes,
@@ -43,12 +46,13 @@ import {
   type BaoSshRoleProps,
   attributesOf,
   badDurations,
-  extMap,
   matches,
   readPath,
   resolve,
   writeBody,
 } from './ssh-role-form.ts';
+import { wouldErase } from './ssh-role-erase.ts';
+import { guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
 
 export type { BaoSshRoleAttributes, BaoSshRoleProps };
 
@@ -64,6 +68,9 @@ export const BaoSshRole = Resource<BaoSshRole>('Bao.SshRole', {
   defaultRemovalPolicy: 'retain',
 });
 
+/** Exact: the engine stores `roles/<name>` verbatim (builtin/logical/ssh/path_roles.go:602). */
+const IDENTITY = roleIdentity<BaoSshRoleAttributes>('Bao.SshRole', readPath, 'ssh');
+
 /** Live role, plus the raw body — reconcile needs the raw half to see what it would erase. */
 const readRole = (form: BaoSshRoleForm) =>
   Effect.gen(function* () {
@@ -72,51 +79,6 @@ const readRole = (form: BaoSshRoleForm) =>
     return { attributes: attributesOf(form, live), live };
   });
 
-/**
- * Fields this resource deliberately does not model, mapped to the value OpenBao's own write
- * puts there when nobody says otherwise. The templating flags change how a principal is
- * DERIVED at signing time, which is a different kind of decision from which principals
- * exist; the rest are issuance mechanics. MEASURED against all three live roles — every one
- * of them sits on exactly these values, so the guard below fires on nothing that exists.
- */
-const UNMANAGED_DEFAULTS: Readonly<Record<string, unknown>> = {
-  algorithm_signer: 'default',
-  allow_commas_in_identity_templates: false,
-  allow_user_key_ids: false,
-  allowed_domains_template: false,
-  allowed_users_template: false,
-  default_extensions_template: false,
-  default_user_template: false,
-  issuer_ref: 'default',
-  key_id_format: '',
-  not_before_duration: 30,
-};
-
-/**
- * ⚠️ ABSENT AND EMPTY BOTH COUNT AS "NEVER SET". A role this resource wrote omits these
- *   fields entirely, so a stricter test would refuse on the provider's own output and
- *   deadlock the update after next.
- */
-const isDefault = (live: Record<string, unknown>, field: string) =>
-  live[field] === undefined || live[field] === '' || live[field] === UNMANAGED_DEFAULTS[field];
-
-/**
- * ⛔ THE FIELDS A WRITE WOULD SILENTLY DESTROY. Because the write is a full replace, a role
- *   someone tuned by hand — `allowed_user_key_lengths` (a minimum RSA size), a
- *   `key_id_format` the audit trail is grepped by, a `not_before_duration` widened to
- *   survive clock skew, a non-default issuer — loses all of it the moment this resource
- *   decides to update. A vanished key-length floor is a security regression that no plan
- *   output would ever mention, and a vanished backdating window breaks signing on exactly
- *   the skewed host it was added for. So reconcile refuses instead of writing.
- */
-const wouldErase = (live: Record<string, unknown>): readonly string[] => {
-  const lost = Object.keys(UNMANAGED_DEFAULTS).filter((field) => !isDefault(live, field));
-  if (Object.keys(extMap(live['allowed_user_key_lengths'])).length > 0) {
-    lost.push('allowed_user_key_lengths');
-  }
-  return lost.sort();
-};
-
 const refuse = (message: string) => Effect.die(new Error(message));
 
 export const BaoSshRoleProvider = () =>
@@ -132,9 +94,13 @@ export const BaoSshRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const found = yield* readRole(resolve(olds));
-          return found?.attributes;
+          const ours = Effect.sync(
+            () => found !== undefined && matches(found.attributes, resolve(olds)),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
         }),
 
         /**
@@ -147,18 +113,20 @@ export const BaoSshRoleProvider = () =>
          *   at risk when something actually writes; if every managed field already matches,
          *   the honest answer is `noop` and nothing gets destroyed.
          */
-        diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
-          const form = resolve(news);
+        diff: Effect.fn(function* ({ news, olds, output }) {
           /**
            * ⛔ A RENAMED ROLE IS A NEW PATH, NOT AN EDIT. `ssh/roles/x` and `ssh-host/roles/x`
            *   are different mounts with different CAs. Without this, changing `name` or
            *   `mount` would write the new role and leave the old one signing certificates
-           *   for as long as anyone remembered its name.
+           *   for as long as anyone remembered its name. Judged before `isResolved(news)`, and
+           *   ⛔ a move onto a role that exists fails the plan (rename-identity.ts).
            */
-          if (output.mount !== form.mount || output.name !== form.name) {
-            return { action: 'replace' } as const;
-          }
+          const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (move !== undefined) return { action: 'replace' } as const;
+          if (!isResolved(news)) return undefined;
+          const form = resolve(news);
           const found = yield* readRole(form);
           if (found === undefined) return { action: 'update' } as const;
           return matches(found.attributes, form)
@@ -166,9 +134,11 @@ export const BaoSshRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const form = resolve(news);
           const path = readPath(form.mount, form.name);
+          // ⛔ An `update` across a move the diff could not see — refused before any write.
+          yield* guardRename(IDENTITY, news, output);
 
           const bad = badDurations(form);
           if (bad.length > 0) {
@@ -195,6 +165,8 @@ export const BaoSshRoleProvider = () =>
           }
 
           const found = yield* readRole(form);
+          if (found !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.SshRole ${path}`);
           if (found === undefined || !matches(found.attributes, form)) {
             if (found !== undefined) {
               const lost = wouldErase(found.live);
@@ -235,5 +207,5 @@ export const BaoSshRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/ownership/adopt.ts

@@ -0,0 +1,122 @@
+/**
+ * Whether a live object this stack holds no state for may be written — the apply-time half of the
+ * house rule that NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21 for HostFile, LaunchdJob,
+ * CaddyConfig and every Bao.* family). probe.ts is the plan-time half.
+ *
+ * ★ FAMILY-NEUTRAL ON PURPOSE. The engine questions here — what `--adopt` resolves to for one FQN,
+ *   whether this apply resumes the resource's own interrupted create — are the same for a vault
+ *   role, a launchd plist and a Caddy config, so they live once, outside every subpath's directory.
+ */
+import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { AlchemyContext } from 'alchemy/AlchemyContext';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+import { resumes, unfinished } from './resume.ts';
+import { forgetRefusedCreate, isCreate } from './rows.ts';
+
+/**
+ * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
+ * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
+ * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
+ * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
+ *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
+ *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
+ *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
+ *   routes/stack.ts; Apply.ts reads the same Stack).
+ * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
+ *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
+ *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
+ *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
+ * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
+ *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
+ *   `Resource`, so an upgrade that stops recording it there fails the suite.
+ */
+export const adoptEnabled = (fqn: string): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    const stack = yield* Effect.serviceOption(Stack);
+    const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+    if (scoped !== undefined) return scoped;
+    const policy = yield* Effect.serviceOption(AdoptPolicy);
+    if (Option.isSome(policy)) return policy.value;
+    const context = yield* Effect.serviceOption(AlchemyContext);
+    return Option.isSome(context) ? context.value.adopt : false;
+  });
+
+/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */
+export type Owner = {
+  readonly fqn: string;
+  readonly instanceId: string;
+  /** The attributes state holds; `undefined` on a create. */
+  readonly output: unknown;
+};
+
+/**
+ * Whether `--adopt` may speak for this apply's generation: a CREATE (rows.ts isCreate), or an
+ * UNFINISHED generation whose row this plan's diff saw with no attributes (resume.ts) — the
+ * resume Alchemy itself offers `--adopt` for ("Cannot resume creating … Re-run with --adopt").
+ * ⛔ NOT A FRESH REPLACE'S NEW GENERATION. The planner never probes it and never offers it adoption,
+ *   so the identity it moves to was never asked about under `--adopt`: 🔴 MEASURED 2026-09-21
+ *   (launchd/adopt-apply.test.ts), a HostFile whose path changed onto a file it did not own
+ *   overwrote that file under a deploy-wide `--adopt` meant for something else. A Bao rename onto a
+ *   taken identity already fails the plan, `--adopt` or not (rename.ts judgeMove); this keeps the
+ *   apply to the same answer.
+ */
+const adoptable = (owner: Owner): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    if (yield* isCreate(owner.fqn, owner.instanceId)) return true;
+    return yield* unfinished(owner.instanceId);
+  });
+
+/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */
+export const adoptsAtApply = (owner: Owner): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    if (!(yield* adoptEnabled(owner.fqn))) return false;
+    return yield* adoptable(owner);
+  });
+
+/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */
+export type Claim = (what: string) => Effect.Effect<void>;
+
+/**
+ * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that
+ * object may be written. It may when state already vouches for it (`output`), when this apply
+ * resumes the resource's own interrupted create or replace and its diff proved the object that
+ * generation's (resume.ts), or when adoption is on for a create or an unfinished generation
+ * (adoptable).
+ * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds
+ *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear
+ *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded
+ *   as ours, and deleted with the stack under `destroy`.
+ * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run
+ *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing
+ *   between a read and a write can close that; declare each name once.
+ * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the
+ *   state row would claim it, and a later delete would remove what another owner still relies on.
+ * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's
+ *   recovery read would adopt the very object this refused.
+ */
+export const refuseTakeover = (owner: Owner, what: string): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    if (owner.output !== undefined) return;
+    if (yield* resumes(owner.instanceId)) return;
+    const may = yield* adoptable(owner);
+    if (may && (yield* adoptEnabled(owner.fqn))) return;
+    yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+    const remedy = may
+      ? 'Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first.'
+      : 'It is the new identity of a replace, which --adopt does not cover: remove it first.';
+    return yield* Effect.die(
+      new Error(
+        `${what}: already exists, and this stack holds no state for it — the plan could not ask ` +
+          'first (a prop was still an Output, a replace moved onto it, or it appeared after the ' +
+          `plan). Nothing was written. ${remedy}`,
+      ),
+    );
+  });
+
+/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */
+export const claimFor =
+  (owner: Owner): Claim =>
+  (what) =>
+    refuseTakeover(owner, what);

package/src/ownership/ownership.test.ts

@@ -0,0 +1,200 @@
+/**
+ * The engine-facing edges of ownership/: which instance a read is about, whether its row carries
+ * the whole declaration, what a resume note is worth without a shared bag or a proof, and that a
+ * `settled` check that cannot run never fails the plan. whole.test.ts has the hole walk itself;
+ * the families' end-to-end behaviour is pinned through the engine in openbao/adopt-*.test.ts.
+ */
+import { describe, expect, test } from 'bun:test';
+import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import { refuseTakeover } from './adopt.ts';
+import { ownedRead } from './probe.ts';
+import { noteResume, noteUnfinished, resumes } from './resume.ts';
+import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
+
+const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );
+
+describe('recordedInstance', () => {
+  test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {
+    const rows = { A: row('A', 'new', row('A', 'older')), X: row('X', 'moved') };
+    expect(await withStore(rows, recordedInstance('A', 'new'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('A', 'older'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('Z', 'moved'))).toBe('whole');
+  });
+
+  test("the probe's freshly minted instance is never recorded", async () => {
+    expect(await withStore({ A: row('A', 'mine') }, recordedInstance('A', 'probe'))).toBe('absent');
+    expect(await withStore({}, recordedInstance('A', 'mine'))).toBe('absent');
+  });
+
+  test('a row missing a declared prop (an Output stripped at commit) is partial', async () => {
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, recordedInstance('A', 'mine'))).toBe('partial');
+    // ★ No longer declared (an orphan's delete): nothing to compare, so never whole.
+    expect(await withStore({ C: row('C', 'mine') }, recordedInstance('C', 'mine'))).toBe('partial');
+  });
+
+  test('fails closed with no Stack or State in context', async () => {
+    expect(await Effect.runPromise(recordedInstance('A', 'mine'))).toBe('absent');
+  });
+});
+
+describe('isCreate', () => {
+  test("is this instance's `creating` row — never a replace's `replacing` one", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    expect(await withStore(rows, isCreate('A', 'mine'))).toBe(true);
+    expect(await withStore(rows, isCreate('B', 'new'))).toBe(false);
+    expect(await withStore(rows, isCreate('A', 'other'))).toBe(false);
+    expect(await Effect.runPromise(isCreate('A', 'mine'))).toBe(false);
+  });
+});
+
+describe('forgetRefusedCreate', () => {
+  test('drops only the creating row of this instance, with no attributes', async () => {
+    const rows: Record<string, ResourceState> = {
+      A: row('A', 'mine'),
+      B: row('B', 'mine', row('B', 'older')),
+      C: row('C', 'theirs'),
+      D: { ...row('D', 'mine'), attr: { name: 'd' } },
+    };
+    for (const fqn of ['A', 'B', 'C', 'D']) await withStore(rows, forgetRefusedCreate(fqn, 'mine'));
+    expect(Object.keys(rows).sort()).toEqual(['B', 'C', 'D']);
+  });
+});
+
+describe('ownedRead', () => {
+  const found = { name: 'a' };
+  const ask = (output?: unknown) => ({ fqn: 'A', instanceId: 'mine', output });
+  const rows = { A: row('A', 'mine') };
+
+  test('with state it is the object as found; absent is absent', async () => {
+    const plain = await Effect.runPromise(ownedRead(ask({}), found, Effect.succeed(false)));
+    expect(Unowned.is(plain)).toBe(false);
+    expect(await Effect.runPromise(ownedRead(ask(), undefined, Effect.succeed(true)))).toBe(
+      undefined,
+    );
+  });
+
+  test('the probe answers Unowned even when the object is settled', async () => {
+    const probed = await withStore({}, ownedRead(ask(), found, Effect.succeed(true)));
+    expect(Unowned.is(probed)).toBe(true);
+  });
+
+  test('the recovery read is ours only when settled, over a row with the whole declaration', async () => {
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      false,
+    );
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(false))))).toBe(
+      true,
+    );
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(Unowned.is(await withStore(holed, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      true,
+    );
+  });
+
+  test('a settled check that fails or dies is Unowned, never a failed plan', async () => {
+    const failing = Effect.fail(new Error('fragments directory moved'));
+    const dying = Effect.die(new TypeError('olds.tokenPolicies is undefined'));
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, failing)))).toBe(true);
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, dying)))).toBe(true);
+  });
+});
+
+describe('resume notes and refuseTakeover', () => {
+  const bag = makeScopedArtifacts(new Map(), 'A');
+  const inBag = <A>(effect: Effect.Effect<A>) =>
+    Effect.runPromise(effect.pipe(Effect.provideService(Artifacts, bag)));
+
+  const ours = Effect.succeed({ name: 'a' });
+
+  test('a note is read back for its own instance only, and nothing is noted without a bag', async () => {
+    await inBag(noteResume('mine', ours));
+    expect(await inBag(resumes('mine'))).toBe(true);
+    expect(await inBag(resumes('other'))).toBe(false);
+    await Effect.runPromise(noteResume('mine', ours));
+    expect(await Effect.runPromise(resumes('mine'))).toBe(false);
+  });
+
+  test('nothing is noted unless the read proves the object ours', async () => {
+    const fresh = makeScopedArtifacts(new Map(), 'A');
+    const unproven = [
+      Effect.succeed(undefined),
+      Effect.succeed(Unowned({ name: 'a' })),
+      Effect.fail(new Error('403')),
+      Effect.die(new TypeError('olds.name is undefined')),
+    ];
+    for (const read of unproven) {
+      await Effect.runPromise(
+        noteResume('mine', read).pipe(Effect.provideService(Artifacts, fresh)),
+      );
+    }
+    expect(
+      await Effect.runPromise(resumes('mine').pipe(Effect.provideService(Artifacts, fresh))),
+    ).toBe(false);
+  });
+
+  test('refuses a create with no note and no adoption; state or a note lets it through', async () => {
+    const owner = { fqn: 'A', instanceId: 'mine', output: undefined };
+    await expect(Effect.runPromise(refuseTakeover(owner, 'Thing a'))).rejects.toThrow(
+      /Thing a: already exists.*--adopt/s,
+    );
+    await Effect.runPromise(refuseTakeover({ ...owner, output: {} }, 'Thing a'));
+    await inBag(noteResume('mine', ours));
+    await inBag(refuseTakeover(owner, 'Thing a'));
+  });
+
+  test("--adopt covers a create or an unfinished generation, never a fresh replace's", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    const adopting = <A>(effect: Effect.Effect<A>, bag = makeScopedArtifacts(new Map(), 'B')) =>
+      withStore(
+        rows,
+        effect.pipe(
+          Effect.provideService(AdoptPolicy, true),
+          Effect.provideService(Artifacts, bag),
+        ),
+      );
+    await adopting(refuseTakeover({ fqn: 'A', instanceId: 'mine', output: undefined }, 'Thing a'));
+    const fresh = { fqn: 'B', instanceId: 'new', output: undefined };
+    await expect(adopting(refuseTakeover(fresh, 'Thing b'))).rejects.toThrow(
+      /Thing b: already exists.*new identity of a replace, which --adopt does not cover/s,
+    );
+    const seen = makeScopedArtifacts(new Map(), 'B');
+    await adopting(noteUnfinished('new'), seen);
+    await adopting(refuseTakeover(fresh, 'Thing b'), seen);
+  });
+});

package/src/ownership/probe.ts

@@ -0,0 +1,65 @@
+/**
+ * `read` with no attributes — the plan-time half of "nothing is adopted without `--adopt`"
+ * (adopt.ts has the apply-time half). Alchemy asks it in two situations and passes `output:
+ * undefined` in both (alchemy beta.79 Plan.ts):
+ *   · THE ADOPTION PROBE — no state row at all; `olds` is the declaration, `instanceId` fresh.
+ *   · THE RECOVERY READ — a `creating` row whose create was interrupted after its write and before
+ *     its commit; `olds` is that row's props, `instanceId` the row's. (Apply.ts asks the same for a
+ *     row it must delete that never recorded attributes.)
+ * The answer routes the plan: `undefined` → create; plain attributes → ours; `Unowned(…)` → the
+ * plan fails with OwnedBySomeoneElse unless `--adopt` / `adopt(true)` (AdoptPolicy.ts).
+ *
+ * ⛔ THE PROBE ALWAYS ANSWERS `Unowned` FOR A LIVE OBJECT, EVEN ONE IDENTICAL TO THE DECLARATION
+ *   (decided 2026-09-21). Identical is not ours: a name another stack, a person or an old script put
+ *   there reads the same, and once state claims it, a delete under `destroy` removes it from its
+ *   real owner. 🔴 Measured before the change (openbao/rename-adoption.test.ts): a new logical id
+ *   for a live Bao name adopted it silently, and the old id's delete then removed it, green.
+ * ★ THE RECOVERY READ STILL ADOPTS WHAT THE INTERRUPTED CREATE MADE — the instance is ours by the
+ *   state row, and the object is proven ours when it matches that row's props (`settled`). One that
+ *   does not match may have lost a race to someone else: `Unowned`, as Plan.ts itself asks.
+ * ⛔ ONLY WHEN THE ROW'S PROPS ARE THE WHOLE DECLARATION (whole.ts). A row written while a prop was
+ *   still an Output has a hole there, and "matches" against a hole proves nothing — nor had that
+ *   deploy's plan ever asked whose object it was, because Alchemy skips the probe for an Output.
+ *   Such a create resumes with `--adopt`.
+ */
+import { Unowned } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { recordedInstance } from './rows.ts';
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when the state store records this instance
+ * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
+ * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
+ *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
+ *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'partial') {
+      yield* Effect.logWarning(
+        `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
+          'was still an Output when it was written), so the live object is not proven ours',
+      );
+      return Unowned(found);
+    }
+    const unproven = (reason: unknown) =>
+      Effect.as(
+        Effect.logWarning(
+          `${ask.fqn}: the interrupted create's object could not be compared with its props ` +
+            `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`,
+        ),
+        false,
+      );
+    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+    return ours ? found : Unowned(found);
+  });

package/src/ownership/resume.ts

@@ -0,0 +1,118 @@
+/**
+ * Whether this apply RESUMES a create or replace the engine already started for this resource AND
+ * the live object it will find is proven that generation's own — the one case in which a stateless
+ * `reconcile` may write over a live object without `--adopt`.
+ *
+ * ★ HOW THE ENGINE TELLS US. Alchemy calls `diff` whenever a state row exists, and hands it `output`
+ *   = that row's attributes (alchemy beta.79 Plan.ts). A row with NO attributes is exactly an
+ *   unfinished generation: `creating` (a create interrupted after its write, before its commit),
+ *   `replacing` (the same for a replace), or `deleting` re-driven as a create. A fresh create is
+ *   never diffed at all. So the diff of such a row decides, and the apply that follows (the same
+ *   instance id: Apply.ts reuses the row's) finds the note.
+ * ⛔ A ROW PROVES NOTHING BY ITSELF (red team, 2026-09-21). Apply commits it BEFORE reconcile runs, so
+ *   a deploy killed before the claim — an upstream that failed, a Ctrl-C — leaves a row whose create
+ *   never asked whose object sat at its identity. 🔴 MEASURED (openbao/adopt-holes.test.ts): with the
+ *   name an Output, the next deploy "resumed" that create and wrote over another owner's role, in
+ *   every family that had a note on the row alone. So the note is left only when the family's own
+ *   `read`, asked as the recovery read (probe.ts ownedRead: a recorded instance, a row carrying the
+ *   whole declaration, and a live object that matches it), answers "ours". For a `creating` row
+ *   that is the question Plan.ts already asked; for a `replacing` row it is the only time it is asked.
+ * ⚠️ WHY NOT THE STATE STORE ALONE. At reconcile both look the same: Apply commits the fresh create's
+ *   `creating` row before calling reconcile, so a row with this instance id is always there.
+ * ★ THE CHANNEL IS ALCHEMY'S OWN: `Artifacts`, the per-FQN bag the engine shares between one plan
+ *   and its apply (Artifacts.ts: "diff computes … create / update reads the same artifact").
+ *   Deploy.ts and the Alchemist session both hold one store across the pair.
+ * ⚠️ IT FAILS CLOSED. No bag, a bag the plan never wrote, or an object the read cannot prove ours
+ *   reads as a fresh create, and adopt.ts then asks for `--adopt` — the safe direction.
+ * ★ AN UNPROVEN RESUME IS STILL MARKED UNFINISHED (`noteUnfinished`), so `--adopt` can take it over
+ *   the way Alchemy's own "Cannot resume creating … Re-run with --adopt" offers for a create — while
+ *   a FRESH replace's new generation, which no diff ever saw without attributes, stays unadoptable.
+ */
+import { Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts } from 'alchemy/Artifacts';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+
+const PROVEN = 'homeflare/ownership/resumes';
+const UNFINISHED = 'homeflare/ownership/unfinished';
+
+const note = (key: string, instanceId: string): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const bag = yield* Effect.serviceOption(Artifacts);
+    if (Option.isSome(bag)) yield* bag.value.set(key, instanceId);
+  });
+
+const noted = (key: string, instanceId: string): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    const bag = yield* Effect.serviceOption(Artifacts);
+    if (Option.isNone(bag)) return false;
+    return (yield* bag.value.get<string>(key)) === instanceId;
+  });
+
+/**
+ * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this
+ * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns
+ * `undefined`, a diff's "defer to the engine".
+ */
+export const noteUnfinished = (instanceId: string): Effect.Effect<undefined> =>
+  Effect.as(note(UNFINISHED, instanceId), undefined);
+
+/**
+ * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the
+ * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a
+ * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused
+ * at apply instead, unless `--adopt`.
+ */
+export const noteResume = <R>(
+  instanceId: string,
+  recovered: Effect.Effect<unknown, unknown, R>,
+): Effect.Effect<void, never, R> =>
+  Effect.gen(function* () {
+    yield* noteUnfinished(instanceId);
+    const unproven = () => Effect.succeed(undefined);
+    const found = yield* recovered.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+    if (found === undefined || found === null || Unowned.is(found)) return;
+    yield* note(PROVEN, instanceId);
+  });
+
+/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */
+export const resumes = (instanceId: string): Effect.Effect<boolean> => noted(PROVEN, instanceId);
+
+/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */
+export const unfinished = (instanceId: string): Effect.Effect<boolean> =>
+  noted(UNFINISHED, instanceId);
+
+/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */
+type Ask = {
+  readonly id: string;
+  readonly fqn: string;
+  readonly instanceId: string;
+  readonly olds: unknown;
+  readonly output: unknown;
+};
+type Hook = Effect.Effect<unknown, unknown, unknown>;
+
+/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */
+interface Resumable {
+  read?(input: Ask): Hook;
+  diff?(input: Ask): Hook;
+}
+
+/**
+ * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether
+ * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*
+ * family is built through it, so their diffs answer such a row with a plain `undefined`.
+ */
+export const provingResumes = <S extends Resumable>(service: S): S => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined) return service;
+  const proving: Resumable['diff'] = (input) =>
+    Effect.gen(function* () {
+      if (input.output === undefined) {
+        yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+      }
+      return yield* diff(input);
+    });
+  // ⚠️ The one cast: `diff` keeps the family's own signature — it is the family's diff, run after.
+  return { ...service, diff: proving } as S;
+};