@homeflare/alchemy 0.8.0 → 0.10.0

package/src/openbao/kubernetes-role.ts

@@ -17,6 +17,8 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';
 import {
   type BaoKubernetesRoleAttributes,
@@ -28,7 +30,7 @@ import {
   writeBody,
 } from './kubernetes-role-form.ts';
 import { foldName, guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
-import { type RoleSpec, planRole, readRoleAt, reconcileRole } from './role-reconcile.ts';
+import { type RoleSpec, planRole, readOwnedRole, reconcileRole } from './role-reconcile.ts';
 
 export type {
   BaoKubernetesAliasSource,
@@ -75,25 +77,29 @@ export const BaoKubernetesRoleProvider = () =>
         /** ⛔ The mount's role listing is not a list of things this owns. */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          const found = yield* readRoleAt(kubernetesRoleSpec(olds));
-          return found?.attributes;
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          return yield* readOwnedRole({ fqn, instanceId, output }, kubernetesRoleSpec(olds));
         }),
 
         /** ⛔ IT COMPARES THE LIVE ROLE, NOT THE STORED DIGEST. */
         diff: Effect.fn(function* ({ news, olds, output }) {
           // ⛔ The identity first, before isResolved; onto a role that exists fails the plan.
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
           return { action: yield* planRole(kubernetesRoleSpec(news)) } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
-          return yield* reconcileRole(kubernetesRoleSpec(news));
+          return yield* reconcileRole(
+            kubernetesRoleSpec(news),
+            claimFor({ fqn, instanceId, output }),
+          );
         }),
 
         /** Idempotent as Alchemy requires — a missing role deletes as success. */
@@ -102,5 +108,5 @@ export const BaoKubernetesRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/mfa-enforcement.ts

@@ -31,6 +31,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim, claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import type { BaoError } from './bao-status.ts';
 import {
   type BaoMfaLoginEnforcementAttributes,
@@ -96,14 +99,21 @@ export const planEnforcement = (
     return live !== undefined && matches(live, props, resolved) ? 'noop' : 'update';
   });
 
-/** Write when live differs, then prove it by reading back. */
+/**
+ * Write when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over an enforcement it finds by name.
+ */
 export const reconcileEnforcement = (
   props: BaoMfaLoginEnforcementProps,
+  claim?: Claim,
 ): Effect.Effect<BaoMfaLoginEnforcementAttributes, BaoError, Env> =>
   Effect.gen(function* () {
     const { bad, resolved } = yield* resolveTargets(props);
     if (bad.length > 0) return yield* refuse(props.name, bad.join('; '));
     const live = yield* readLive(props.name);
+    if (live !== undefined && claim !== undefined) {
+      yield* claim(`Bao.MfaLoginEnforcement ${props.name}`);
+    }
     if (live === undefined || !matches(live, props, resolved)) {
       yield* writeEnforcement(props.name, writeBody(canonicalFromProps(props, resolved)));
     }
@@ -124,24 +134,28 @@ export const BaoMfaLoginEnforcementProvider = () =>
         /** ⛔ The namespace's enforcement listing is not a list of things this owns. */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readLive(olds.name);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readLive(olds.name);
+          const ours = Effect.map(planEnforcement(olds), (plan) => plan === 'noop');
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /** ⛔ IT COMPARES THE LIVE ENFORCEMENT — a target removed by hand is drift, not a noop. */
         diff: Effect.fn(function* ({ news, olds, output }) {
           // ⛔ The name first, before isResolved; onto an enforcement that exists fails the plan.
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
           return { action: yield* planEnforcement(news) } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a rename the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
-          return yield* reconcileEnforcement(news);
+          return yield* reconcileEnforcement(news, claimFor({ fqn, instanceId, output }));
         }),
 
         /** ⛔ REFUSED — read the header: in 2.6.2 the delete does not survive a restart. */
@@ -154,5 +168,5 @@ export const BaoMfaLoginEnforcementProvider = () =>
           );
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/mfa-totp.ts

@@ -20,6 +20,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { type Claim, claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import type { BaoError } from './bao-status.ts';
 import {
   type BaoMfaTotpMethodAttributes,
@@ -70,14 +73,19 @@ export const planTotp = (
     return live !== undefined && matches(live, props) ? 'noop' : 'update';
   });
 
-/** Upsert by name when live differs, then prove it by reading back. */
+/**
+ * Upsert by name when live differs, then prove it by reading back.
+ * ⛔ `claim` (the provider passes it): a create never takes over a method it finds by that name.
+ */
 export const reconcileTotp = (
   props: BaoMfaTotpMethodProps,
+  claim?: Claim,
 ): Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const bad = problems(props);
     if (bad.length > 0) return yield* refuse(props.name, bad.join('; '));
     const live = yield* readTotp(props);
+    if (live !== undefined && claim !== undefined) yield* claim(`Bao.MfaTotpMethod ${props.name}`);
     if (live === undefined || !matches(live, props)) yield* writeTotp(writeBody(props));
     const after = yield* readTotp(props);
     if (after === undefined)
@@ -94,8 +102,13 @@ export const BaoMfaTotpMethodProvider = () =>
         /** ⛔ The namespace's method listing is not a list of things this owns. */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readTotp(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readTotp(olds);
+          const ours = Effect.sync(
+            () => found !== undefined && problems(olds).length === 0 && matches(found, olds),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -110,15 +123,17 @@ export const BaoMfaTotpMethodProvider = () =>
             const rename = renameProblem(output.name, name);
             if (rename !== undefined) return yield* refuse(name, rename);
           }
-          if (output === undefined || !isResolved(news)) return undefined;
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (!isResolved(news)) return undefined;
           return { action: yield* planTotp(news) } as const;
         }),
 
         /** ⛔ A rename the diff could not see (the name was an Output), refused before any write. */
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const rename = output === undefined ? undefined : renameProblem(output.name, news.name);
           if (rename !== undefined) return yield* refuse(news.name, rename);
-          return yield* reconcileTotp(news);
+          return yield* reconcileTotp(news, claimFor({ fqn, instanceId, output }));
         }),
 
         /** ⛔ Read the header first. Idempotent: an unknown id deletes as success. */
@@ -127,5 +142,5 @@ export const BaoMfaTotpMethodProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/mount-move.test.ts

@@ -5,7 +5,8 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import { reconcileAuthMethod } from './auth-method-reconcile.ts';
-import { type Reply, type Seen, run, withFake } from './fake-bao.ts';
+import { type Seen, run, withFake } from './fake-bao.ts';
+import { liveTable } from './fake-mounts.ts';
 import { planMove } from './mount-move.ts';
 import { reconcileMount } from './mount-reconcile.ts';
 
@@ -32,40 +33,6 @@ describe('planMove', () => {
   });
 });
 
-/** A fake with a live table under `prefix` (`sys/mounts` or `sys/auth`) that sys/remount edits. */
-const liveTable = (prefix: string, initial: Record<string, string>) => {
-  const table = new Map(Object.entries(initial).map(([path, type]) => [`${path}/`, type]));
-  const entry = (type: string) => ({ config: { default_lease_ttl: 0, max_lease_ttl: 0 }, type });
-  const answer = (seen: Seen): Reply => {
-    const path = seen.path.replace(/^\/v1\//, '');
-    if (path === 'sys/remount' && seen.method === 'POST') {
-      const { from, to } = JSON.parse(seen.body) as { from: string; to: string };
-      const key = `${from.replace(/^auth\//, '')}/`;
-      const type = table.get(key);
-      if (type === undefined) return { json: { errors: ['no matching mount'] }, status: 400 };
-      table.delete(key);
-      table.set(`${to.replace(/^auth\//, '')}/`, type);
-      return { json: { data: { migration_id: 'm-1' } }, status: 200 };
-    }
-    if (path.startsWith('sys/remount/status/')) {
-      return { json: { data: { migration_info: { status: 'success' } } }, status: 200 };
-    }
-    if (path === prefix) {
-      return { json: { data: Object.fromEntries(table) }, status: 200 };
-    }
-    const mount = path.slice(prefix.length + 1).replace(/\/tune$/, '');
-    if (seen.method === 'POST') {
-      if (!path.endsWith('/tune')) table.set(`${mount}/`, 'enabled-by-test');
-      return { status: 204 };
-    }
-    const type = table.get(`${mount}/`);
-    return type === undefined
-      ? { json: { errors: [`No secret engine mount at ${mount}/`] }, status: 400 }
-      : { json: { data: entry(type) }, status: 200 };
-  };
-  return { answer, table };
-};
-
 const posts = (seen: Seen[]) =>
   seen.filter((each) => each.method === 'POST').map((each) => each.path);
 

package/src/openbao/mount-reconcile.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {
   type BaoMountAttributes,
@@ -37,22 +38,31 @@ const moveTarget = (props: BaoMountProps): MoveTarget => ({
 /**
  * Converge one mount. `stated` is the path in Alchemy's state (undefined on a first reconcile).
  * Dies on a refusal; fails with OpenBao's own error on a refused call.
+ * ⛔ `claim` (mount.ts always passes it) refuses, before any write, a first reconcile that would take
+ *   over a live mount: the one at the path, or the `remountFrom` source it would move
+ *   (ownership/adopt.ts).
  */
 export const reconcileMount = (
   news: BaoMountProps,
   stated: string | undefined,
   options?: RemountOptions,
+  claim?: Claim,
 ): Effect.Effect<BaoMountAttributes, BaoError | RemountError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const move = planMove('Bao.Mount', stated, news.path, news.remountFrom);
     if (move.kind === 'refuse') return yield* Effect.die(new Error(move.message));
+    const first = stated === undefined ? claim : undefined;
+    if (first !== undefined && move.kind === 'move') {
+      const source = yield* readMount({ ...news, path: move.from });
+      if (source !== undefined) yield* first(`Bao.Mount ${move.from} (the remountFrom source)`);
+    }
     if (move.kind === 'move') yield* performMove(moveTarget(news), move.from, options);
 
     let live = yield* readMount(news);
     if (live === undefined) {
       yield* enableMount(news);
       if (wantsTune(news)) yield* tuneMount(news);
-    } else if (!matches(live, news)) {
+    } else {
       if (live.type !== news.type) {
         return yield* Effect.die(
           new Error(
@@ -61,7 +71,8 @@ export const reconcileMount = (
           ),
         );
       }
-      yield* tuneMount(news);
+      if (first !== undefined) yield* first(`Bao.Mount ${mountPath(news.path)}`);
+      if (!matches(live, news)) yield* tuneMount(news);
     }
     live = yield* readMount(news);
     if (live === undefined) {

package/src/openbao/mount.ts

@@ -22,6 +22,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { type BaoMountAttributes, type BaoMountProps, matches } from './mount-form.ts';
 import { planMove } from './mount-move.ts';
 import { readMount, reconcileMount } from './mount-reconcile.ts';
@@ -55,12 +58,17 @@ export const BaoMountProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readMount(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readMount(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (!isResolved(news)) return undefined;
           /**
            * ⛔ A CHANGED PATH IS DECIDED HERE, BEFORE ANY READ OF THE NEW PATH — reading it would
            *   find nothing and plan `update`, which is how an empty mount used to get enabled.
@@ -98,8 +106,9 @@ export const BaoMountProvider = () =>
          *   method and path — the job the per-command exit-code checks used to do by hand.
          *   The body, and the move, live in mount-reconcile.ts.
          */
-        reconcile: Effect.fn(function* ({ news, output }) {
-          return yield* reconcileMount(news, output?.path);
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+          const claim = claimFor({ fqn, instanceId, output });
+          return yield* reconcileMount(news, output?.path, undefined, claim);
         }),
 
         /**
@@ -111,5 +120,5 @@ export const BaoMountProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/pki-role.ts

@@ -43,6 +43,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import {
   type BaoPkiRoleAttributes,
@@ -95,8 +98,13 @@ export const BaoPkiRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(
+            () => found !== undefined && problems(olds).length === 0 && matches(found, olds),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -119,6 +127,7 @@ export const BaoPkiRoleProvider = () =>
            *   and left the old one issuing certificates under no state record at all.
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -137,7 +146,7 @@ export const BaoPkiRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news);
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
@@ -153,6 +162,8 @@ export const BaoPkiRoleProvider = () =>
             return yield* Effect.die(new Error(`Bao.PkiRole ${path}: ${bad.join(' ')}`));
           }
           const live = yield* readRole(news);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.PkiRole ${path}`);
           if (live === undefined || !matches(live, news)) {
             yield* baoWrite('PUT', path, writeBody(news));
           }
@@ -195,5 +206,5 @@ export const BaoPkiRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/plugin-reconcile.ts

@@ -4,6 +4,7 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim } from '../ownership/adopt.ts';
 import type { BaoError } from './bao-status.ts';
 import {
   type BaoPluginAttributes,
@@ -39,18 +40,25 @@ const refuse = (form: BaoPluginForm, message: string) =>
  *   nothing, or finds an OLDER genuinely-unversioned entry. The Cloudflare engine reports one
  *   (`framework.Backend.RunningVersion`). REASONED FROM SOURCE, not measured against a server.
  * ⚠️ THE WRITE HAS ALREADY LANDED when this fires, so the catalog holds a registration no state
- *   record names. Declaring the reported version adopts it on the next deploy (same sha256 and
- *   command, so reconcile matches and writes nothing); declaring a DIFFERENT version is refused by
- *   the server itself (setInternal :1219-1221, "plugin version mismatch").
+ *   record names. Declaring the reported version and deploying once with `--adopt` adopts it (same
+ *   sha256 and command, so reconcile matches and writes nothing); declaring a DIFFERENT version is
+ *   refused by the server itself (setInternal :1219-1221, "plugin version mismatch").
+ * ⚠️ `--adopt`, NOT A SILENT RESUME (2026-09-21): the row this create left names the UNVERSIONED
+ *   entry, so it cannot prove the versioned one ours (docs/ownership.md).
  */
 const SELF_REPORTED =
   'the write succeeded but the read-back does not match. If the binary reports its own version, ' +
   'OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` ' +
-  'as exactly the version the binary reports; that adopts the entry this write just made.';
+  'as exactly the version the binary reports, and deploy once with --adopt: that adopts the ' +
+  'entry this write just made.';
 
-/** Register when the live entry differs, then prove it by reading back. Dies on a refusal. */
+/**
+ * Register when the live entry differs, then prove it by reading back. Dies on a refusal.
+ * ⛔ `claim` (the provider passes it): a create never takes over an entry already registered.
+ */
 export const reconcilePlugin = (
   props: BaoPluginProps,
+  claim?: Claim,
 ): Effect.Effect<BaoPluginAttributes, BaoError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     const form = resolve(props);
@@ -58,6 +66,9 @@ export const reconcilePlugin = (
     if (bad.length > 0) return yield* refuse(form, bad.join('; '));
 
     const found = yield* readEntry(form);
+    if (found !== undefined && claim !== undefined) {
+      yield* claim(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}`);
+    }
     if (found !== undefined && !matches(found.attributes, form)) {
       /**
        * ⛔ A DECLARATIVE OR OCI ENTRY BELONGS TO THE SERVER'S CONFIG FILE (`plugin` stanzas with

package/src/openbao/plugin.ts

@@ -24,11 +24,15 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoPluginAttributes,
   type BaoPluginProps,
   type BaoPluginType,
   matches,
+  problems,
   resolve,
   versionedPath,
 } from './plugin-form.ts';
@@ -81,9 +85,15 @@ export const BaoPluginProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          const found = yield* readEntry(resolve(olds));
-          return found?.attributes;
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const form = resolve(olds);
+          const found = yield* readEntry(form);
+          const ours = Effect.sync(
+            () =>
+              found !== undefined && problems(form).length === 0 && matches(found.attributes, form),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
         }),
 
         /** ⛔ IT COMPARES THE LIVE ENTRY, NOT THE STORED DIGEST — a hand re-register is drift. */
@@ -95,6 +105,7 @@ export const BaoPluginProvider = () =>
            *   that is already registered fails the plan (rename-identity.ts).
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -107,10 +118,10 @@ export const BaoPluginProvider = () =>
         }),
 
         /** The refusals — declarative, builtin, self-reported version — live in plugin-reconcile.ts. */
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
-          return yield* reconcilePlugin(news);
+          return yield* reconcilePlugin(news, claimFor({ fqn, instanceId, output }));
         }),
 
         /**
@@ -122,5 +133,5 @@ export const BaoPluginProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/policy.ts

@@ -5,6 +5,9 @@ import * as Effect from 'effect/Effect';
 import * as FileSystem from 'effect/FileSystem';
 import * as Path from 'effect/Path';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { sha256 } from './digest.ts';
 import { isEmptyAssembly } from './policy-assembly.ts';
 import { deletePolicy, policyPath, readPolicy, writePolicy } from './policy-wire.ts';
@@ -138,9 +141,16 @@ export const BaoPolicyProvider = () =>
         list: () => Effect.succeed([]),
 
         // ★ '' means genuinely absent (a 404); a refusal fails. policy-wire.ts has the history.
-        read: Effect.fn(function* ({ olds }) {
+        // ⛔ With no attributes in state, a live policy is `Unowned` unless it is the one our own
+        //   interrupted create wrote: these fragments, byte for byte (ownership/probe.ts).
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const live = yield* readPolicy(olds.name);
-          return live.length === 0 ? undefined : attributesOf(olds.name, live, 0);
+          const found = live.length === 0 ? undefined : attributesOf(olds.name, live, 0);
+          const ours = Effect.map(
+            assemble(olds.fragments),
+            (a) => sha256(a.joined) === found?.digest,
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -161,6 +171,7 @@ export const BaoPolicyProvider = () =>
            *   PR (REPLACE.md).
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           // ⚠️ A prop can still be an unresolved Output or Config at plan time. Docker's
@@ -174,7 +185,7 @@ export const BaoPolicyProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const name = news.name;
           // ⛔ An `update` across a rename the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
@@ -207,6 +218,8 @@ export const BaoPolicyProvider = () =>
            *   sibling PVE provider does exactly this in pveOperations.reconcile.
            */
           const current = yield* readPolicy(name);
+          if (current.length > 0)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.Policy ${name}`);
           if (current.length > 0 && sha256(current) === sha256(joined)) {
             return attributesOf(name, joined, parts);
           }
@@ -231,5 +244,5 @@ export const BaoPolicyProvider = () =>
           return undefined;
         }),
       });
-    }),
+    }).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/proxmox-role.ts

@@ -40,6 +40,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoWrite } from './bao-http.ts';
 import {
   type BaoProxmoxRoleAttributes,
@@ -84,8 +87,11 @@ export const BaoProxmoxRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -107,6 +113,7 @@ export const BaoProxmoxRoleProvider = () =>
            *   resulting `update`.
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) {
             const mintUser = declaredString(news, 'mintUser');
@@ -142,11 +149,13 @@ export const BaoProxmoxRoleProvider = () =>
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news.mount, news.name);
           // ⛔ An `update` across a move the diff could not see — refused before any read or write.
           yield* guardRename(IDENTITY, news, output);
           const live = yield* readRole(news);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.ProxmoxRole ${path}`);
           /**
            * ⛔ A mint_user CHANGE RE-SCOPES EVERY CREDENTIAL THE ROLE WILL EVER MINT, SILENTLY.
            *   The minted token inherits that PVE user's standing ACL and nothing else, so
@@ -226,5 +235,5 @@ export const BaoProxmoxRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );