@homeflare/alchemy 0.8.0 → 0.10.0

package/src/openbao/rename-adoption.test.ts

@@ -1,15 +1,15 @@
 /**
- * The swap the plan-time guard cannot see: a NEW declaration of a name that is live. 🔴 MEASURED
- * 2026-09-21 through Alchemy's own plan and apply (fake-stack.ts). With no state row, the engine asks
- * `read`, which finds the object and answers plain attributes, so Alchemy silently adopts it
- * (alchemy@2.0.0-beta.79 Plan.ts, the adoption probe; AdoptPolicy.ts). Nothing moved, so
- * `judgeMove` never runs. Under `RemovalPolicy.destroy()` the old owner's delete then runs in
- * Apply's phase 2, after the adoption has written, and removes the object the new declaration now
- * claims. The deploy is green.
- *
- * ★ These pin that, and the two ways round it REPLACE.md gives: `renamedFrom` for a logical id that
- *   changes, and a second deploy for a name another resource is leaving. If one of the hazards stops
- *   reproducing, the engine changed: re-read REPLACE.md before relaxing it.
+ * The swap the plan-time rename guard cannot see: a NEW declaration of a name that is live.
+ * 🔴 MEASURED 2026-09-21 through Alchemy's own plan and apply (fake-stack.ts), before the ownership
+ * rule: with no state row the engine asked `read`, which answered plain attributes, so Alchemy
+ * silently adopted the object (alchemy@2.0.0-beta.79 Plan.ts, the adoption probe; AdoptPolicy.ts).
+ * Under `RemovalPolicy.destroy()` the old owner's delete then ran in Apply's phase 2 and removed the
+ * object the new declaration claimed — in a green deploy.
+ * ★ NOW (decided 2026-09-21): the probe answers `Unowned` for any live object (ownership/probe.ts),
+ *   so that plan FAILS before anything is written, and the takeover happens only when asked for —
+ *   which is exactly the old hazard, on purpose. These pin both, and the two ways round it
+ *   REPLACE.md gives: `renamedFrom` for a logical id that changes, and a second deploy for a name
+ *   another resource is leaving.
  *
  * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
  */
@@ -25,14 +25,25 @@ const { destroy } = RemovalPolicy;
 
 /** No delete endpoint (jwt-config.ts), and a delete the provider refuses (mfa-enforcement.ts). */
 const KEEPS = new Set(['Bao.JwtAuthConfig', 'Bao.MfaLoginEnforcement']);
-const REFUSES_DELETE = /Bao\.MfaLoginEnforcement/;
+const REFUSES_DELETE = /Bao\.MfaLoginEnforcement a: REFUSING to delete/;
+const NOT_OWNED = /Cannot adopt resource 'Z'.*--adopt/s;
 
 describe('a logical id changed without renamedFrom, under destroy', () => {
   for (const row of FAMILIES) {
-    it(`${row.family}: the orphan delete removes what the new id just adopted`, async () => {
+    it(`${row.family}: the plan refuses the live name, and nothing is written or deleted`, async () => {
+      await withEstate(async (stack, estate, seen) => {
+        await stack.deploy(row.declare('X', 'a', '15m', destroy));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', 'a', '15m', destroy)), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a'));
+      });
+    });
+
+    it(`${row.family}: --adopt is the takeover, and the old id's delete follows it`, async () => {
       await withEstate(async (stack, estate) => {
         await stack.deploy(row.declare('X', 'a', '15m', destroy));
-        const again = stack.deploy(row.declare('Z', 'a', '15m', destroy));
+        const again = stack.deploy(row.declare('Z', 'a', '15m', destroy), { adopt: true });
         if (row.family === 'Bao.MfaLoginEnforcement') await assert.rejects(again, REFUSES_DELETE);
         else assert.deepEqual(await again, { X: 'delete', Z: 'adopted' });
         assert.equal(row.has(estate, 'a'), KEEPS.has(row.family));
@@ -55,19 +66,21 @@ describe('the ways round it', () => {
     });
   });
 
-  it('a name another resource moves off is lost when taken in the same deploy', async () => {
-    await withEstate(async (stack, estate) => {
+  it('a name another resource moves off is refused when taken in the same deploy', async () => {
+    await withEstate(async (stack, estate, seen) => {
       await stack.deploy(row.declare('X', 'a', '15m', destroy));
+      seen.length = 0;
       const both = Effect.gen(function* () {
         yield* row.declare('X', 'b', '15m', destroy);
         yield* row.declare('Z', 'a', '30m', destroy);
       });
-      assert.deepEqual(await stack.deploy(both), { X: 'replace', Z: 'adopted' });
-      assert.ok(row.has(estate, 'b') && !row.has(estate, 'a'));
+      await assert.rejects(stack.deploy(both), NOT_OWNED);
+      assert.deepEqual(writesOf(seen), []);
+      assert.ok(row.has(estate, 'a') && !row.has(estate, 'b'));
     });
   });
 
-  it('and survives when taken in the deploy after the move', async () => {
+  it('and succeeds when taken in the deploy after the move', async () => {
     await withEstate(async (stack, estate) => {
       await stack.deploy(row.declare('X', 'a', '15m', destroy));
       await stack.deploy(row.declare('X', 'b', '15m', destroy));

package/src/openbao/role-reconcile.ts

@@ -15,6 +15,8 @@
  */
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { Claim, Owner } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
 import { baoRead, baoWrite } from './bao-http.ts';
 import type { BaoError } from './bao-status.ts';
 
@@ -40,6 +42,21 @@ export const readRoleAt = <A>(
     live === undefined ? undefined : { attributes: spec.attributesOf(live), live },
   );
 
+/**
+ * `read`: the live attributes — `Unowned` with no state unless our own interrupted create wrote
+ * them, which is `planRole`'s `noop` against that create's props (ownership/probe.ts).
+ */
+export const readOwnedRole = <A extends object>(
+  ask: Owner,
+  spec: RoleSpec<A>,
+): Effect.Effect<A | undefined, BaoError, HttpClient.HttpClient> =>
+  Effect.flatMap(readRoleAt(spec), (found) => {
+    const ours = Effect.sync(
+      () => found !== undefined && spec.problems.length === 0 && spec.matches(found.attributes),
+    );
+    return ownedRead(ask, found?.attributes, ours);
+  });
+
 /** `update` or `noop` — the part of a diff after the identity checks. */
 export const planRole = <A>(
   spec: RoleSpec<A>,
@@ -53,12 +70,18 @@ export const planRole = <A>(
 const refuse = (spec: { readonly family: string; readonly path: string }, message: string) =>
   Effect.die(new Error(`${spec.family} ${spec.path}: ${message}`));
 
+/**
+ * ⛔ `claim` — every provider passes it — refuses, before any write, a create that finds a live
+ *   object this stack holds no state for (ownership/adopt.ts).
+ */
 export const reconcileRole = <A>(
   spec: RoleSpec<A>,
+  claim?: Claim,
 ): Effect.Effect<A, BaoError, HttpClient.HttpClient> =>
   Effect.gen(function* () {
     if (spec.problems.length > 0) return yield* refuse(spec, spec.problems.join('; '));
     const found = yield* readRoleAt(spec);
+    if (found !== undefined && claim !== undefined) yield* claim(`${spec.family} ${spec.path}`);
     if (found === undefined || !spec.matches(found.attributes)) {
       const lost = found === undefined ? [] : (spec.wouldErase?.(found.live) ?? []);
       if (lost.length > 0) {

package/src/openbao/ssh-role.ts

@@ -36,6 +36,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete, baoRead, baoWrite } from './bao-http.ts';
 import {
   type BaoSshRoleAttributes,
@@ -91,9 +94,13 @@ export const BaoSshRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const found = yield* readRole(resolve(olds));
-          return found?.attributes;
+          const ours = Effect.sync(
+            () => found !== undefined && matches(found.attributes, resolve(olds)),
+          );
+          return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
         }),
 
         /**
@@ -115,6 +122,7 @@ export const BaoSshRoleProvider = () =>
            *   ⛔ a move onto a role that exists fails the plan (rename-identity.ts).
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -126,7 +134,7 @@ export const BaoSshRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const form = resolve(news);
           const path = readPath(form.mount, form.name);
           // ⛔ An `update` across a move the diff could not see — refused before any write.
@@ -157,6 +165,8 @@ export const BaoSshRoleProvider = () =>
           }
 
           const found = yield* readRole(form);
+          if (found !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.SshRole ${path}`);
           if (found === undefined || !matches(found.attributes, form)) {
             if (found !== undefined) {
               const lost = wouldErase(found.live);
@@ -197,5 +207,5 @@ export const BaoSshRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/ownership/adopt.ts

@@ -0,0 +1,122 @@
+/**
+ * Whether a live object this stack holds no state for may be written — the apply-time half of the
+ * house rule that NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21 for HostFile, LaunchdJob,
+ * CaddyConfig and every Bao.* family). probe.ts is the plan-time half.
+ *
+ * ★ FAMILY-NEUTRAL ON PURPOSE. The engine questions here — what `--adopt` resolves to for one FQN,
+ *   whether this apply resumes the resource's own interrupted create — are the same for a vault
+ *   role, a launchd plist and a Caddy config, so they live once, outside every subpath's directory.
+ */
+import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { AlchemyContext } from 'alchemy/AlchemyContext';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+import { resumes, unfinished } from './resume.ts';
+import { forgetRefusedCreate, isCreate } from './rows.ts';
+
+/**
+ * Whether the resource at `fqn` may be adopted, resolved exactly as the planner resolves it (alchemy
+ * beta.79 Plan.ts: `resource.Adopt ?? shouldAdopt`): a resource-scoped `adopt(…)`, else the
+ * `AdoptPolicy` service, else `AlchemyContext.adopt`, else off.
+ * ★ FOR A CREATE THE ENGINE NEVER PROBED. Alchemy skips the adoption probe while `news` holds an
+ *   Output, so an ownership check that must still honour `--adopt` can only run at apply. All three
+ *   reach the apply: Alchemist runs plan AND apply under the session context, which provides the
+ *   services from the CLI flag and the Stack the resources registered on (Alchemist/Session.ts,
+ *   routes/stack.ts; Apply.ts reads the same Stack).
+ * ⛔ THE RESOURCE-SCOPED SETTING WINS, BOTH WAYS. The engine captures `adopt(…)` on the resource at
+ *   registration (Resource.ts `Adopt`, into `Stack.resources[fqn]`) and never hands it to a
+ *   provider. Reading only the deploy-wide flag let `--adopt` take over a resource declared
+ *   `.pipe(adopt(false))` — which the planner refuses — and refused one declared `adopt(true)`.
+ * ⚠️ `resources` carries an `@internal` comment in Alchemy's source, but it is in the published types
+ *   and the planner reads `Adopt` from it. caddy/adopt-scope.test.ts registers through the real
+ *   `Resource`, so an upgrade that stops recording it there fails the suite.
+ */
+export const adoptEnabled = (fqn: string): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    const stack = yield* Effect.serviceOption(Stack);
+    const scoped = Option.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+    if (scoped !== undefined) return scoped;
+    const policy = yield* Effect.serviceOption(AdoptPolicy);
+    if (Option.isSome(policy)) return policy.value;
+    const context = yield* Effect.serviceOption(AlchemyContext);
+    return Option.isSome(context) ? context.value.adopt : false;
+  });
+
+/** The three fields of a `reconcile` (or `read`) call that say whose object this is. */
+export type Owner = {
+  readonly fqn: string;
+  readonly instanceId: string;
+  /** The attributes state holds; `undefined` on a create. */
+  readonly output: unknown;
+};
+
+/**
+ * Whether `--adopt` may speak for this apply's generation: a CREATE (rows.ts isCreate), or an
+ * UNFINISHED generation whose row this plan's diff saw with no attributes (resume.ts) — the
+ * resume Alchemy itself offers `--adopt` for ("Cannot resume creating … Re-run with --adopt").
+ * ⛔ NOT A FRESH REPLACE'S NEW GENERATION. The planner never probes it and never offers it adoption,
+ *   so the identity it moves to was never asked about under `--adopt`: 🔴 MEASURED 2026-09-21
+ *   (launchd/adopt-apply.test.ts), a HostFile whose path changed onto a file it did not own
+ *   overwrote that file under a deploy-wide `--adopt` meant for something else. A Bao rename onto a
+ *   taken identity already fails the plan, `--adopt` or not (rename.ts judgeMove); this keeps the
+ *   apply to the same answer.
+ */
+const adoptable = (owner: Owner): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    if (yield* isCreate(owner.fqn, owner.instanceId)) return true;
+    return yield* unfinished(owner.instanceId);
+  });
+
+/** Whether a stateless `reconcile` may take over a live object: adoption on, for an adoptable one. */
+export const adoptsAtApply = (owner: Owner): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    if (!(yield* adoptEnabled(owner.fqn))) return false;
+    return yield* adoptable(owner);
+  });
+
+/** A lifecycle helper's hook for refuseTakeover, bound to one call's Owner: `(what) => …`. */
+export type Claim = (what: string) => Effect.Effect<void>;
+
+/**
+ * `reconcile`'s check, called with the live object it found BEFORE any write: dies unless that
+ * object may be written. It may when state already vouches for it (`output`), when this apply
+ * resumes the resource's own interrupted create or replace and its diff proved the object that
+ * generation's (resume.ts), or when adoption is on for a create or an unfinished generation
+ * (adoptable).
+ * ⛔ WHY IT EXISTS AT ALL: THE PROBE DOES NOT GUARD EVERY CREATE. Alchemy skips it while `news` holds
+ *   an Output (Plan.ts), a new generation of a replace is never probed, and an object can appear
+ *   between plan and apply. Each of those used to be a silent takeover: written over, then recorded
+ *   as ours, and deleted with the stack under `destroy`.
+ * ⚠️ A CHECK, THEN A WRITE — NOT A LOCK. Two creates of one name in the same deploy run
+ *   concurrently, both read nothing, and both write (measured with the fakes, 2026-09-21). Nothing
+ *   between a read and a write can close that; declare each name once.
+ * ⚠️ AN IDENTICAL OBJECT IS STILL A TAKEOVER (decided 2026-09-21). Nothing would be written, but the
+ *   state row would claim it, and a later delete would remove what another owner still relies on.
+ * ⛔ A REFUSED CREATE FORGETS ITS `creating` ROW (rows.ts forgetRefusedCreate), or the next plan's
+ *   recovery read would adopt the very object this refused.
+ */
+export const refuseTakeover = (owner: Owner, what: string): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    if (owner.output !== undefined) return;
+    if (yield* resumes(owner.instanceId)) return;
+    const may = yield* adoptable(owner);
+    if (may && (yield* adoptEnabled(owner.fqn))) return;
+    yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+    const remedy = may
+      ? 'Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first.'
+      : 'It is the new identity of a replace, which --adopt does not cover: remove it first.';
+    return yield* Effect.die(
+      new Error(
+        `${what}: already exists, and this stack holds no state for it — the plan could not ask ` +
+          'first (a prop was still an Output, a replace moved onto it, or it appeared after the ' +
+          `plan). Nothing was written. ${remedy}`,
+      ),
+    );
+  });
+
+/** refuseTakeover bound to one call's Owner, for a lifecycle helper that finds the live object. */
+export const claimFor =
+  (owner: Owner): Claim =>
+  (what) =>
+    refuseTakeover(owner, what);

package/src/ownership/ownership.test.ts

@@ -0,0 +1,200 @@
+/**
+ * The engine-facing edges of ownership/: which instance a read is about, whether its row carries
+ * the whole declaration, what a resume note is worth without a shared bag or a proof, and that a
+ * `settled` check that cannot run never fails the plan. whole.test.ts has the hole walk itself;
+ * the families' end-to-end behaviour is pinned through the engine in openbao/adopt-*.test.ts.
+ */
+import { describe, expect, test } from 'bun:test';
+import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import { refuseTakeover } from './adopt.ts';
+import { ownedRead } from './probe.ts';
+import { noteResume, noteUnfinished, resumes } from './resume.ts';
+import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
+
+const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );
+
+describe('recordedInstance', () => {
+  test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {
+    const rows = { A: row('A', 'new', row('A', 'older')), X: row('X', 'moved') };
+    expect(await withStore(rows, recordedInstance('A', 'new'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('A', 'older'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('Z', 'moved'))).toBe('whole');
+  });
+
+  test("the probe's freshly minted instance is never recorded", async () => {
+    expect(await withStore({ A: row('A', 'mine') }, recordedInstance('A', 'probe'))).toBe('absent');
+    expect(await withStore({}, recordedInstance('A', 'mine'))).toBe('absent');
+  });
+
+  test('a row missing a declared prop (an Output stripped at commit) is partial', async () => {
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, recordedInstance('A', 'mine'))).toBe('partial');
+    // ★ No longer declared (an orphan's delete): nothing to compare, so never whole.
+    expect(await withStore({ C: row('C', 'mine') }, recordedInstance('C', 'mine'))).toBe('partial');
+  });
+
+  test('fails closed with no Stack or State in context', async () => {
+    expect(await Effect.runPromise(recordedInstance('A', 'mine'))).toBe('absent');
+  });
+});
+
+describe('isCreate', () => {
+  test("is this instance's `creating` row — never a replace's `replacing` one", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    expect(await withStore(rows, isCreate('A', 'mine'))).toBe(true);
+    expect(await withStore(rows, isCreate('B', 'new'))).toBe(false);
+    expect(await withStore(rows, isCreate('A', 'other'))).toBe(false);
+    expect(await Effect.runPromise(isCreate('A', 'mine'))).toBe(false);
+  });
+});
+
+describe('forgetRefusedCreate', () => {
+  test('drops only the creating row of this instance, with no attributes', async () => {
+    const rows: Record<string, ResourceState> = {
+      A: row('A', 'mine'),
+      B: row('B', 'mine', row('B', 'older')),
+      C: row('C', 'theirs'),
+      D: { ...row('D', 'mine'), attr: { name: 'd' } },
+    };
+    for (const fqn of ['A', 'B', 'C', 'D']) await withStore(rows, forgetRefusedCreate(fqn, 'mine'));
+    expect(Object.keys(rows).sort()).toEqual(['B', 'C', 'D']);
+  });
+});
+
+describe('ownedRead', () => {
+  const found = { name: 'a' };
+  const ask = (output?: unknown) => ({ fqn: 'A', instanceId: 'mine', output });
+  const rows = { A: row('A', 'mine') };
+
+  test('with state it is the object as found; absent is absent', async () => {
+    const plain = await Effect.runPromise(ownedRead(ask({}), found, Effect.succeed(false)));
+    expect(Unowned.is(plain)).toBe(false);
+    expect(await Effect.runPromise(ownedRead(ask(), undefined, Effect.succeed(true)))).toBe(
+      undefined,
+    );
+  });
+
+  test('the probe answers Unowned even when the object is settled', async () => {
+    const probed = await withStore({}, ownedRead(ask(), found, Effect.succeed(true)));
+    expect(Unowned.is(probed)).toBe(true);
+  });
+
+  test('the recovery read is ours only when settled, over a row with the whole declaration', async () => {
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      false,
+    );
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(false))))).toBe(
+      true,
+    );
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(Unowned.is(await withStore(holed, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      true,
+    );
+  });
+
+  test('a settled check that fails or dies is Unowned, never a failed plan', async () => {
+    const failing = Effect.fail(new Error('fragments directory moved'));
+    const dying = Effect.die(new TypeError('olds.tokenPolicies is undefined'));
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, failing)))).toBe(true);
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, dying)))).toBe(true);
+  });
+});
+
+describe('resume notes and refuseTakeover', () => {
+  const bag = makeScopedArtifacts(new Map(), 'A');
+  const inBag = <A>(effect: Effect.Effect<A>) =>
+    Effect.runPromise(effect.pipe(Effect.provideService(Artifacts, bag)));
+
+  const ours = Effect.succeed({ name: 'a' });
+
+  test('a note is read back for its own instance only, and nothing is noted without a bag', async () => {
+    await inBag(noteResume('mine', ours));
+    expect(await inBag(resumes('mine'))).toBe(true);
+    expect(await inBag(resumes('other'))).toBe(false);
+    await Effect.runPromise(noteResume('mine', ours));
+    expect(await Effect.runPromise(resumes('mine'))).toBe(false);
+  });
+
+  test('nothing is noted unless the read proves the object ours', async () => {
+    const fresh = makeScopedArtifacts(new Map(), 'A');
+    const unproven = [
+      Effect.succeed(undefined),
+      Effect.succeed(Unowned({ name: 'a' })),
+      Effect.fail(new Error('403')),
+      Effect.die(new TypeError('olds.name is undefined')),
+    ];
+    for (const read of unproven) {
+      await Effect.runPromise(
+        noteResume('mine', read).pipe(Effect.provideService(Artifacts, fresh)),
+      );
+    }
+    expect(
+      await Effect.runPromise(resumes('mine').pipe(Effect.provideService(Artifacts, fresh))),
+    ).toBe(false);
+  });
+
+  test('refuses a create with no note and no adoption; state or a note lets it through', async () => {
+    const owner = { fqn: 'A', instanceId: 'mine', output: undefined };
+    await expect(Effect.runPromise(refuseTakeover(owner, 'Thing a'))).rejects.toThrow(
+      /Thing a: already exists.*--adopt/s,
+    );
+    await Effect.runPromise(refuseTakeover({ ...owner, output: {} }, 'Thing a'));
+    await inBag(noteResume('mine', ours));
+    await inBag(refuseTakeover(owner, 'Thing a'));
+  });
+
+  test("--adopt covers a create or an unfinished generation, never a fresh replace's", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    const adopting = <A>(effect: Effect.Effect<A>, bag = makeScopedArtifacts(new Map(), 'B')) =>
+      withStore(
+        rows,
+        effect.pipe(
+          Effect.provideService(AdoptPolicy, true),
+          Effect.provideService(Artifacts, bag),
+        ),
+      );
+    await adopting(refuseTakeover({ fqn: 'A', instanceId: 'mine', output: undefined }, 'Thing a'));
+    const fresh = { fqn: 'B', instanceId: 'new', output: undefined };
+    await expect(adopting(refuseTakeover(fresh, 'Thing b'))).rejects.toThrow(
+      /Thing b: already exists.*new identity of a replace, which --adopt does not cover/s,
+    );
+    const seen = makeScopedArtifacts(new Map(), 'B');
+    await adopting(noteUnfinished('new'), seen);
+    await adopting(refuseTakeover(fresh, 'Thing b'), seen);
+  });
+});

package/src/ownership/probe.ts

@@ -0,0 +1,65 @@
+/**
+ * `read` with no attributes — the plan-time half of "nothing is adopted without `--adopt`"
+ * (adopt.ts has the apply-time half). Alchemy asks it in two situations and passes `output:
+ * undefined` in both (alchemy beta.79 Plan.ts):
+ *   · THE ADOPTION PROBE — no state row at all; `olds` is the declaration, `instanceId` fresh.
+ *   · THE RECOVERY READ — a `creating` row whose create was interrupted after its write and before
+ *     its commit; `olds` is that row's props, `instanceId` the row's. (Apply.ts asks the same for a
+ *     row it must delete that never recorded attributes.)
+ * The answer routes the plan: `undefined` → create; plain attributes → ours; `Unowned(…)` → the
+ * plan fails with OwnedBySomeoneElse unless `--adopt` / `adopt(true)` (AdoptPolicy.ts).
+ *
+ * ⛔ THE PROBE ALWAYS ANSWERS `Unowned` FOR A LIVE OBJECT, EVEN ONE IDENTICAL TO THE DECLARATION
+ *   (decided 2026-09-21). Identical is not ours: a name another stack, a person or an old script put
+ *   there reads the same, and once state claims it, a delete under `destroy` removes it from its
+ *   real owner. 🔴 Measured before the change (openbao/rename-adoption.test.ts): a new logical id
+ *   for a live Bao name adopted it silently, and the old id's delete then removed it, green.
+ * ★ THE RECOVERY READ STILL ADOPTS WHAT THE INTERRUPTED CREATE MADE — the instance is ours by the
+ *   state row, and the object is proven ours when it matches that row's props (`settled`). One that
+ *   does not match may have lost a race to someone else: `Unowned`, as Plan.ts itself asks.
+ * ⛔ ONLY WHEN THE ROW'S PROPS ARE THE WHOLE DECLARATION (whole.ts). A row written while a prop was
+ *   still an Output has a hole there, and "matches" against a hole proves nothing — nor had that
+ *   deploy's plan ever asked whose object it was, because Alchemy skips the probe for an Output.
+ *   Such a create resumes with `--adopt`.
+ */
+import { Unowned } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { recordedInstance } from './rows.ts';
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when the state store records this instance
+ * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
+ * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
+ *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
+ *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'partial') {
+      yield* Effect.logWarning(
+        `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
+          'was still an Output when it was written), so the live object is not proven ours',
+      );
+      return Unowned(found);
+    }
+    const unproven = (reason: unknown) =>
+      Effect.as(
+        Effect.logWarning(
+          `${ask.fqn}: the interrupted create's object could not be compared with its props ` +
+            `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`,
+        ),
+        false,
+      );
+    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+    return ours ? found : Unowned(found);
+  });