@homeflare/alchemy 0.8.0 → 0.10.0

package/src/launchd/sudo-said.ts

@@ -0,0 +1,58 @@
+/**
+ * What sudo's own failure means, for sudo-runner.ts: which exit-1 answers are sudo refusing to run
+ * the command (so NOTHING ran as root), and what an EACCES outside every prefix most likely means.
+ * Split out of sudo-runner.ts, which keeps only the runner.
+ *
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow
+ *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 ("a password is required": -n was given but a
+ *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).
+ */
+import { errnoCode } from './local-runner.ts';
+import type { ExecResult } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+
+/**
+ * ⚠️ ANCHORED TO sudo'S OWN MESSAGE FORMS (`sudo: …` lines, `Sorry, user …`), so a launchctl or
+ *   install error that happens to say "not allowed" is never reported as "the command did not run".
+ *   The refusals are the three a sudoers denial prints: the command not allowed, the user not in
+ *   sudoers, and the user not allowed on this host (`<user> is not allowed to run sudo on <host>.`).
+ *   REASONED from sudo 1.9's sudoers plugin, like the rest (header).
+ */
+const PASSWORD =
+  /^sudo: (?:a password is required|a terminal is required|sorry, you must have a tty)/m;
+const NOT_ALLOWED =
+  /^(?:Sorry, user \S+ (?:is not allowed to execute|may not run sudo)|\S+ is not (?:in the sudoers file|allowed to run sudo on ))/m;
+
+/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */
+export const undeclared =
+  (path: string, prefixes: readonly string[]) =>
+  (cause: unknown): never => {
+    const code = errnoCode(cause);
+    if (code !== 'EACCES' && code !== 'EPERM') throw cause;
+    throw new Error(
+      `sudoRunner ${path}: ${code} as the deploying user, and the path is under no declared prefix ` +
+        `(${prefixes.join(', ')}). If root owns its directory, declare that directory as a prefix.`,
+      { cause },
+    );
+  };
+
+/**
+ * The refusal sudo itself answered for `shown` (the argv as JSON), or `undefined` when the command
+ * ran — whatever its own exit code. ★ `SudoRefusedError` always means nothing ran as root.
+ */
+export const sudoRefusal = (shown: string, result: ExecResult): SudoRefusedError | undefined => {
+  if (result.exitCode !== 1) return undefined;
+  if (PASSWORD.test(result.stderr)) {
+    return new SudoRefusedError(
+      `sudo -n ${shown}: a password is required, and this runner never prompts. Run \`sudo -v\` ` +
+        'in the deploying terminal just before the deploy, or grant exactly these commands ' +
+        'NOPASSWD (docs/launchd-sudo.md). The command did not run.',
+    );
+  }
+  if (NOT_ALLOWED.test(result.stderr)) {
+    return new SudoRefusedError(
+      `sudo -n ${shown}: sudoers does not let the deploying user run this. The command did not run.`,
+    );
+  }
+  return undefined;
+};

package/src/openbao/README.md

@@ -17,8 +17,11 @@ plus `FetchHttpClient.layer`.
 - ⛔ A rename or move onto a name or path that already exists fails the plan, before anything is
   written (every family but the mounts, whose moves are below). Move through a free name, in two
   deploys, or remove the target first.
-- ⚠️ A NEW logical id for a live name adopts it, and under `destroy` the old id's delete then
-  removes it. Change a logical id with Alchemy's `renamedFrom` (REPLACE.md).
+- ⛔ **Nothing is adopted without `--adopt`** (0.9.0), not even an object identical to the
+  declaration: a live name with no state fails the plan, or the apply when a prop was an Output.
+  Our own interrupted create still resumes when its row can prove it — not one killed while a
+  prop was still an Output. [docs/ownership.md](../../docs/ownership.md). Change
+  a logical id with Alchemy's `renamedFrom` (REPLACE.md), never by adopting.
 
 ## assertBaoIdentity: call it first
 

package/src/openbao/REPLACE.md

@@ -139,17 +139,19 @@ retained."). It is live and unmanaged from then on:
 `declareCloudflareRoles` does, never reaches the `replace`: the old id leaves the stack as an
 orphan delete, which `retain` also keeps live.
 
-## A new declaration of a live name: the swap the guard cannot see
-
-⚠️ A NEW logical id whose name already exists takes that object over and rewrites it: these
-families' `read` never answers `Unowned`, so Alchemy silently adopts it. Nothing moved, so
-`judgeMove` never runs. 🔴 Measured (`rename-adoption.test.ts`): under `destroy` the old owner's
-delete then runs after the adoption wrote, and removes the object the new id now claims, in a
-green deploy. It happened when a logical id changed with the name kept, to each of the nine
-batch-2 families whose delete runs (a TOTP method and its enrolments included), and when a new
-`Bao.AuthRole` took a name another one moved off in the same deploy. Change a logical id with
-Alchemy's `renamedFrom('<old id>')`, which migrates the state row and plans an `update`. Take a
-freed name in the deploy after the move.
+## A new declaration of a live name: refused unless adopted
+
+⛔ A NEW logical id whose name already exists now FAILS THE PLAN (0.9.0): with no state, `read`
+answers `Unowned` for any live object, identical or not (`src/ownership/probe.ts`,
+[docs/ownership.md](../../docs/ownership.md)). Nothing moved, so `judgeMove` never runs; the
+probe is what catches it. 🔴 Measured before (`rename-adoption.test.ts`): the families' `read`
+answered plain attributes, so Alchemy silently adopted the object, and under `destroy` the old
+owner's delete then ran after the adoption wrote and removed the object the new id claimed, in a
+green deploy — for each of the nine batch-2 families whose delete runs (a TOTP method and its
+enrolments included), and when a new `Bao.AuthRole` took a name another one moved off in the same
+deploy. ⚠️ `--adopt` is exactly that takeover again, on purpose. Change a logical id with Alchemy's
+`renamedFrom('<old id>')`, which migrates the state row and plans an `update`. Take a freed name
+in the deploy after the move.
 
 ## Why the moves fail instead of replacing
 

package/src/openbao/adopt-core.test.ts

@@ -0,0 +1,119 @@
+/**
+ * The ownership rule for the five families fake-core.ts carries — Bao.Policy, Bao.CloudflareRole,
+ * Bao.ProxmoxRole, Bao.Mount and Bao.AuthMethod — through Alchemy's own plan and apply: the same
+ * claims adopt-families.test.ts and adopt-recovery.test.ts make for the other nine.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import { BaoAuthRole } from './auth-role.ts';
+import { crashAfterWrite } from './fake-bao.ts';
+import { CORE, type CoreRow, withCore } from './fake-core.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+
+/** `Z`, with its knob an Output until apply: an upstream AppRole's `tokenTtl`, created with it. */
+const pending = (row: CoreRow) =>
+  Effect.gen(function* () {
+    const up = yield* BaoAuthRole('Upstream', {
+      name: 'upstream',
+      secretIdTtl: '24h',
+      tokenMaxTtl: '1h',
+      tokenPolicies: ['default'],
+      tokenTtl: '15m',
+    });
+    yield* row.declare('Z', up.tokenTtl);
+  });
+
+for (const row of CORE) {
+  describe(`${row.family}: ownership`, () => {
+    it('a live object another stack owns, identical, fails the plan; nothing is written', async () => {
+      await withCore(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate));
+        assert.deepEqual(await stack.deploy(row.declare('Z', '15m'), { adopt: true }), {
+          Z: 'adopted',
+        });
+        assert.deepEqual(writesOf(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, the apply refuses it; the next plan refuses too', async () => {
+      await withCore(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), NOT_OWNED);
+        assert.deepEqual(
+          writesOf(seen).filter((line) => !line.endsWith('/upstream')),
+          [],
+        );
+      });
+    });
+
+    it('with a prop still an Output, --adopt takes it over at apply', async () => {
+      await withCore(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        assert.deepEqual(await stack.deploy(pending(row), { adopt: true }), {
+          Upstream: 'create',
+          Z: 'create',
+        });
+      });
+    });
+
+    it('an interrupted create is resumed without --adopt, and nothing is rewritten', async () => {
+      const fault = crashAfterWrite();
+      await withCore(async (stack, estate, seen) => {
+        // ★ Bao.Policy reads nothing back after its write, so the crash is the write's own reply.
+        fault.crashNext(row.family === 'Bao.Policy' ? 'write' : 'read-back');
+        await assert.rejects(stack.deploy(row.declare('X', '15m')), /injected/);
+        assert.ok(row.has(estate));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(row.declare('X', '15m')), { X: 'create' });
+        assert.deepEqual(writesOf(seen), []);
+      }, fault.wrap);
+    });
+  });
+}
+
+describe('Bao.Mount: remountFrom on a create', () => {
+  const moved = BaoMount('Kv', { path: 'kv-moved', remountFrom: 'kv', type: 'kv' });
+  const SOURCE = /Bao\.Mount kv \(the remountFrom source\): already exists/;
+
+  it('moving a live mount this stack holds no state for is refused before the move', async () => {
+    await withCore(async (stack, estate, seen, owner) => {
+      await owner.deploy(BaoMount('Src', { path: 'kv', type: 'kv' }));
+      seen.length = 0;
+      // ★ The probe reads only the target, which is free: the plan says create.
+      await assert.rejects(stack.deploy(moved), SOURCE);
+      assert.deepEqual(writesOf(seen), []);
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv/']);
+      assert.deepEqual(await stack.deploy(moved, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv-moved/']);
+    });
+  });
+});
+
+describe('Bao.Mount: a create interrupted between its enable and its tune', () => {
+  it('is not proven ours — the mount is not what was declared — so it resumes with --adopt', async () => {
+    const fault = crashAfterWrite();
+    const kv = BaoMount('Kv', { defaultLeaseTtl: '15m', path: 'kv', type: 'kv' });
+    await withCore(async (stack, estate) => {
+      fault.crashNext('write');
+      await assert.rejects(stack.deploy(kv), /injected/);
+      assert.ok(estate.mounts.table.has('kv/'));
+      await assert.rejects(stack.deploy(kv), /Cannot resume creating resource 'Kv'.*--adopt/s);
+      assert.deepEqual(await stack.deploy(kv, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual(await stack.deploy(kv), { Kv: 'noop' });
+    }, fault.wrap);
+  });
+});

package/src/openbao/adopt-families.test.ts

@@ -0,0 +1,97 @@
+/**
+ * NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21), for the nine batch-2 families, through
+ * Alchemy's own plan and apply (fake-stack.ts). The object is put there by ANOTHER stack over the
+ * same fake (`owner`) — the case the rule exists for: identical to this declaration, and still
+ * not ours.
+ *   · plan time: the adoption probe answers `Unowned` (ownership/probe.ts);
+ *   · apply time: where the probe never ran — a prop still an Output — reconcile refuses before any
+ *     write (ownership/adopt.ts).
+ * adopt-recovery.test.ts pins the other side: our own interrupted create is still resumed.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Seen } from './fake-bao.ts';
+import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+const STILL_REFUSED = /Cannot adopt resource 'Z'.*--adopt/s;
+
+/** `Z` names `a`, with its knob an Output until apply: the upstream AppRole is created with it. */
+const pending = (row: Family, scoped?: boolean) =>
+  Effect.gen(function* () {
+    const up = yield* upstream('15m');
+    const declared = row.declare('Z', 'a', up.tokenTtl);
+    yield* scoped === undefined ? declared : declared.pipe(adopt(scoped));
+  });
+
+/** Writes other than the upstream AppRole's own create. */
+const writesToA = (seen: readonly Seen[]) =>
+  writesOf(seen).filter((line) => !line.endsWith('/upstream'));
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a live object another stack owns`, () => {
+    it('identical to the declaration, still fails the plan; nothing is written', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', 'a', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a'));
+      });
+    });
+
+    it('is adopted with --adopt, and with adopt(true) — identical, so nothing is written', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          seen.length = 0;
+          const body =
+            deploy === 'flag'
+              ? stack.deploy(row.declare('Z', 'a', '15m'), { adopt: true })
+              : stack.deploy(row.declare('Z', 'a', '15m').pipe(adopt(true)));
+          assert.deepEqual(await body, { Z: 'adopted' });
+          assert.deepEqual(writesOf(seen), []);
+        });
+      }
+    });
+
+    it('with a prop still an Output, the plan cannot ask, so the apply refuses', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        assert.deepEqual(writesToA(seen), []);
+        assert.ok(row.has(estate, 'a'));
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), STILL_REFUSED);
+        assert.deepEqual(writesToA(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, --adopt and adopt(true) take it over at apply', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, _seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          const planned =
+            deploy === 'flag'
+              ? await stack.deploy(pending(row), { adopt: true })
+              : await stack.deploy(pending(row, true));
+          assert.deepEqual(planned, { Upstream: 'create', Z: 'create' });
+        });
+      }
+    });
+
+    it('adopt(false) on the resource wins over --adopt, at apply as at plan', async () => {
+      await withEstate(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        await assert.rejects(stack.deploy(pending(row, false), { adopt: true }), TAKEOVER);
+      });
+    });
+  });
+}

package/src/openbao/adopt-holes.test.ts

@@ -0,0 +1,168 @@
+/**
+ * A deploy killed BEFORE a create's claim ran leaves a `creating` (or `replacing`) row that proves
+ * nothing: its create never asked whose object sat at its identity. Found by the red team on
+ * 2026-09-21, through Alchemy's own plan and apply, before ownership/whole.ts and the proof in
+ * ownership/resume.ts:
+ *   · an Output IDENTITY — every role family read an empty name, found nothing, "resumed" the create
+ *     and wrote over another owner's object;
+ *   · an Output KNOB — Bao.Mount and Bao.AuthMethod read the hole as "not managed", adopted another
+ *     owner's mount in the recovery read and tuned it;
+ *   · a REPLACE killed before its write — the next deploy wrote over whatever another owner had put
+ *     at the new identity since.
+ * Each is now refused, writing nothing; `--adopt` resumes it, as Alchemy offers for a create.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import { BaoAuthRole } from './auth-role.ts';
+import { type Seen, refuseWriteOnce } from './fake-bao.ts';
+import { CORE, type CoreRow, withCore } from './fake-core.ts';
+import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+import { BaoPkiRole } from './pki-role.ts';
+
+const REFUSED =
+  /Cannot resume creating resource 'Z'|: already exists, and this stack holds no state/s;
+const RESUME_REFUSED = /already exists, and this stack holds no state.*Deploy with --adopt/s;
+
+/** Writes other than the upstream's. */
+const writesBut = (seen: readonly Seen[], upstreamPath: string) =>
+  writesOf(seen).filter((line) => !line.endsWith(upstreamPath));
+
+/**
+ * `Z`'s NAME is an Output: an upstream named `a` hands it over. An AppRole, or — for Bao.AuthRole,
+ * whose own `a` that would be — a PKI role.
+ */
+const namedByUpstream = (row: Family) => {
+  const approle = row.family !== 'Bao.AuthRole';
+  const path = approle ? '/auth/approle/role/a' : '/pki/roles/a';
+  const body = Effect.gen(function* () {
+    const up = approle
+      ? yield* BaoAuthRole('Upstream', {
+          name: 'a',
+          secretIdTtl: '24h',
+          tokenMaxTtl: '1h',
+          tokenPolicies: ['default'],
+          tokenTtl: '15m',
+        })
+      : yield* BaoPkiRole('Upstream', {
+          allowedDomains: ['x.test'],
+          maxTtl: '1h',
+          name: 'a',
+          ttl: '30m',
+        });
+    yield* row.declare('Z', up.name, '15m');
+  });
+  return { body, path };
+};
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a create killed before its claim, its name an Output`, () => {
+    it('never writes over the object another stack owns; --adopt takes it over', async () => {
+      const { body, path } = namedByUpstream(row);
+      const fault = refuseWriteOnce(path);
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '30m'));
+        await assert.rejects(stack.deploy(body), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(body), REFUSED);
+        assert.deepEqual(writesBut(seen, path), []);
+        await stack.deploy(body, { adopt: true });
+      }, fault);
+    });
+  });
+
+  describe(`${row.family}: a create killed before its claim, a knob an Output`, () => {
+    it('never adopts the object another stack owns', async () => {
+      const fault = refuseWriteOnce('/upstream');
+      const body = Effect.gen(function* () {
+        yield* row.declare('Z', 'a', (yield* upstream('15m')).tokenTtl);
+      });
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '30m'));
+        await assert.rejects(stack.deploy(body), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(body), REFUSED);
+        assert.deepEqual(writesBut(seen, '/upstream'), []);
+      }, fault);
+    });
+  });
+}
+
+/** `Z` at the row's fixed identity, its knob an upstream AppRole's `tokenTtl`. */
+const pendingCore = (row: CoreRow) =>
+  Effect.gen(function* () {
+    const up = yield* BaoAuthRole('Upstream', {
+      name: 'upstream',
+      secretIdTtl: '24h',
+      tokenMaxTtl: '1h',
+      tokenPolicies: ['default'],
+      tokenTtl: '15m',
+    });
+    yield* row.declare('Z', up.tokenTtl);
+  });
+
+for (const row of CORE) {
+  describe(`${row.family}: a create killed before its claim, a knob an Output`, () => {
+    it('never adopts — or tunes — the object another stack owns; --adopt takes it over', async () => {
+      const fault = refuseWriteOnce('/upstream');
+      await withCore(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '30m'));
+        await assert.rejects(stack.deploy(pendingCore(row)), /injected/);
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pendingCore(row)), REFUSED);
+        assert.deepEqual(writesBut(seen, '/upstream'), []);
+        await stack.deploy(pendingCore(row), { adopt: true });
+      }, fault);
+    });
+  });
+}
+
+describe('Bao.Mount: a create killed before its claim, its path an Output', () => {
+  it('never tunes the mount another stack owns; --adopt takes it over', async () => {
+    const fault = refuseWriteOnce('/auth/approle/role/kv');
+    const body = Effect.gen(function* () {
+      const up = yield* BaoAuthRole('Upstream', {
+        name: 'kv',
+        secretIdTtl: '24h',
+        tokenMaxTtl: '1h',
+        tokenPolicies: ['default'],
+        tokenTtl: '15m',
+      });
+      yield* BaoMount('Z', { defaultLeaseTtl: '15m', path: up.name, type: 'kv' });
+    });
+    await withCore(async (stack, _estate, seen, owner) => {
+      await owner.deploy(BaoMount('X', { defaultLeaseTtl: '30m', path: 'kv', type: 'kv' }));
+      await assert.rejects(stack.deploy(body), /injected/);
+      seen.length = 0;
+      await assert.rejects(stack.deploy(body), REFUSED);
+      assert.deepEqual(writesBut(seen, '/auth/approle/role/kv'), []);
+      await stack.deploy(body, { adopt: true });
+    }, fault);
+  });
+});
+
+/** Bao.MfaTotpMethod never renames (mfa-totp.ts), so it has no replace to interrupt. */
+for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')) {
+  describe(`${row.family}: a replace killed before its write`, () => {
+    it('never writes over what another stack put at the new identity since; --adopt does', async () => {
+      const suffix = row.family === 'Bao.JwtAuthConfig' ? '/b/config' : '/b';
+      const fault = refuseWriteOnce(suffix);
+      const { retain } = RemovalPolicy;
+      await withEstate(async (stack, _estate, seen, owner) => {
+        await stack.deploy(row.declare('X', 'a', '15m', retain));
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), /injected/);
+        await owner.deploy(row.declare('O', 'b', '30m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), RESUME_REFUSED);
+        assert.deepEqual(writesOf(seen), []);
+        await stack.deploy(row.declare('X', 'b', '15m', retain), { adopt: true });
+        assert.notDeepEqual(writesOf(seen), []);
+      }, fault);
+    });
+  });
+}

package/src/openbao/adopt-recovery.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Crash recovery survives the ownership rule: a deploy that dies after its write and before its
+ * commit leaves a `creating` (or `replacing`) row and a live object, and the next deploy must
+ * finish it WITHOUT `--adopt` — the object is ours (ownership/probe.ts, ownership/resume.ts).
+ * The crash is injected: the first read after a write answers 500, which is exactly a reconcile
+ * whose write landed and whose read-back, and so its commit, never did.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import { type Seen, crashAfterWrite } from './fake-bao.ts';
+import type { Estate } from './fake-engines-roles.ts';
+import { FAMILIES, withEstate } from './fake-families.ts';
+import { type FakeStack, writesOf } from './fake-stack.ts';
+
+const RESUME_REFUSED = /Cannot resume creating resource 'X'.*--adopt/s;
+
+type Run = (stack: FakeStack, estate: Estate, seen: Seen[], owner: FakeStack) => Promise<void>;
+const withCrashes = (body: (crashNext: () => void) => Run) => {
+  const fault = crashAfterWrite();
+  return withEstate(body(fault.crashNext), fault.wrap);
+};
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: an interrupted create`, () => {
+    it('is resumed without --adopt when the object is what it wrote; nothing is rewritten', async () => {
+      await withCrashes((crashNext) => async (stack, estate, seen) => {
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), /injected/);
+        assert.ok(row.has(estate, 'a'));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(row.declare('X', 'a', '15m')), { X: 'create' });
+        assert.deepEqual(writesOf(seen), []);
+        assert.deepEqual(await stack.deploy(row.declare('X', 'a', '15m')), { X: 'noop' });
+      });
+    });
+
+    it('is refused when the object has since changed, and resumed with --adopt', async () => {
+      await withCrashes((crashNext) => async (stack, _estate, _seen, owner) => {
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), /injected/);
+        // ★ Someone else rewrites it in between: another stack, taking it over with --adopt.
+        await owner.deploy(row.declare('O', 'a', '30m'), { adopt: true });
+        await assert.rejects(stack.deploy(row.declare('X', 'a', '15m')), RESUME_REFUSED);
+        const resumed = await stack.deploy(row.declare('X', 'a', '15m'), { adopt: true });
+        assert.deepEqual(resumed, { X: 'create' });
+      });
+    });
+  });
+}
+
+/** Bao.MfaTotpMethod never renames (mfa-totp.ts), so it has no replace to interrupt. */
+for (const row of FAMILIES.filter((each) => each.family !== 'Bao.MfaTotpMethod')) {
+  describe(`${row.family}: an interrupted replace`, () => {
+    it('is resumed without --adopt: the new generation it wrote is not taken over', async () => {
+      await withCrashes((crashNext) => async (stack, estate) => {
+        const { retain } = RemovalPolicy;
+        await stack.deploy(row.declare('X', 'a', '15m', retain));
+        crashNext();
+        await assert.rejects(stack.deploy(row.declare('X', 'b', '15m', retain)), /injected/);
+        assert.ok(row.has(estate, 'b'));
+        assert.deepEqual(await stack.deploy(row.declare('X', 'b', '15m', retain)), {
+          X: 'replace',
+        });
+        assert.deepEqual(await stack.deploy(row.declare('X', 'b', '15m', retain)), { X: 'noop' });
+      });
+    });
+  });
+}

package/src/openbao/auth-method-reconcile.ts

@@ -6,6 +6,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import {
   type BaoAuthMethodAttributes,
   type BaoAuthMethodProps,
@@ -36,22 +37,32 @@ const moveTarget = (props: BaoAuthMethodProps): MoveTarget => ({
   wire: (path) => `auth/${authPath(path)}`,
 });
 
-/** Converge one auth method. `stated` is the path in Alchemy's state, if any. */
+/**
+ * Converge one auth method. `stated` is the path in Alchemy's state, if any.
+ * ⛔ `claim`: the same first-reconcile takeover refusal as reconcileMount's (auth-method.ts passes it).
+ */
 export const reconcileAuthMethod = (
   news: BaoAuthMethodProps,
   stated: string | undefined,
   options?: RemountOptions,
+  claim?: Claim,
 ): Effect.Effect<BaoAuthMethodAttributes, BaoError | RemountError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const move = planMove('Bao.AuthMethod', stated, news.path, news.remountFrom);
     if (move.kind === 'refuse') return yield* Effect.die(new Error(move.message));
+    const first = stated === undefined ? claim : undefined;
+    if (first !== undefined && move.kind === 'move') {
+      const source = yield* readMethod({ ...news, path: move.from });
+      if (source !== undefined)
+        yield* first(`Bao.AuthMethod ${move.from} (the remountFrom source)`);
+    }
     if (move.kind === 'move') yield* performMove(moveTarget(news), move.from, options);
 
     let live = yield* readMethod(news);
     if (live === undefined) {
       yield* enableAuthMethod(news);
       if (wantsTune(news)) yield* tuneAuthMethod(news);
-    } else if (!matches(live, news)) {
+    } else {
       if (live.type !== news.type) {
         return yield* Effect.die(
           new Error(
@@ -60,7 +71,8 @@ export const reconcileAuthMethod = (
           ),
         );
       }
-      yield* tuneAuthMethod(news);
+      if (first !== undefined) yield* first(`Bao.AuthMethod ${authPath(news.path)}`);
+      if (!matches(live, news)) yield* tuneAuthMethod(news);
     }
     live = yield* readMethod(news);
     if (live === undefined) {