@homeflare/alchemy 0.8.0 → 0.10.0

package/src/proxmox/lxc-judge.ts

@@ -0,0 +1,196 @@
+/**
+ * Declared against live: what a deploy would write to a container, and what it must refuse.
+ *
+ * ★ ONE PURE FUNCTION DECIDES FOR BOTH `diff` AND `reconcile`, so the plan and the write cannot
+ *   disagree about what is drift. This is resource.ts's `matches` guard grown up: an adopted guest
+ *   that already says what the declaration says produces an empty change, and an empty change is
+ *   not a write — adopting a running container must cost nothing.
+ *
+ * ⛔ SOME CHANGES NO API TOKEN CAN MAKE, AND THEY ARE REFUSED AT PLAN RATHER THAN 403'd MID-DEPLOY.
+ *   `PVE::LXC::check_ct_modify_config_perm` (pve-container 6.1.14) returns early only for
+ *   `$authuser eq 'root@pam'`, and a token's authuser is `root@pam!name` at best. So for a token:
+ *   - `devN` — "configuring device passthrough is only allowed for root@pam";
+ *   - a bind or device `mpN`/`rootfs` — "mount point type … is only allowed for root@pam";
+ *   - `features` on a privileged guest, or any feature but `nesting` — root@pam only.
+ *   Each refusal names the `pct set` to run on the node instead. After it, declare the value and
+ *   the next plan compares it like any other key.
+ */
+import {
+  type LxcProps,
+  declaredKeys,
+  declaredValue,
+  indexedKey,
+  isManagedKey,
+  wireValue,
+} from './lxc-props.ts';
+import { isHostPath, judgeVolume, parseVolume } from './lxc-volume.ts';
+import {
+  CLEARABLE,
+  SCALAR_DEFAULTS,
+  netMaps,
+  netWrite,
+  optionMap,
+  pairs,
+  sameMap,
+  scalarForm,
+  sortedForm,
+} from './lxc-wire.ts';
+import { bool, canonicalToken } from './values.ts';
+
+export type LxcChange = {
+  /** Keys to `PUT …/config`, as PVE's wire strings. */
+  readonly put: Record<string, string>;
+  /** Keys to remove with `delete=`. */
+  readonly clear: readonly string[];
+  /** Mount points to grow, one `PUT …/resize` each, after the config PUT. */
+  readonly resize: readonly { readonly disk: string; readonly size: string }[];
+  /** Why the change cannot be made as an update. Non-empty means nothing is written. */
+  readonly refuse: readonly string[];
+  /** Every declared key that differs from live, refused or not — what a plan should name. */
+  readonly drift: readonly string[];
+};
+
+const text = (value: unknown): string | undefined =>
+  value === undefined || value === null ? undefined : wireValue(value);
+
+/** A refusal naming the `pct set` to run instead. `''` is a removal, so it names `--delete`. */
+export const rootOnly = (vmid: number, key: string, value: string, why: string): string =>
+  `${key}: ${why} PVE lets only root@pam write it, and an API token is never root@pam. Run ` +
+  `\`pct set ${String(vmid)} ${value === '' ? `--delete ${key}` : `--${key} '${value}'`}\` ` +
+  'on the node, then plan again.';
+
+/** `features` parsed the way PVE's `parse_features` does: booleans as 1/0, nothing dropped. */
+const rawFeatures = (value: string) =>
+  new Map(
+    pairs(value).map(([key, entry]) => [key, key === 'mount' ? entry : canonicalToken(entry)]),
+  );
+
+/**
+ * PVE's own `features` rule, on the value actually SENT (`sent` undefined means `delete=features`):
+ * nesting alone needs `VM.Allocate`, anything else is root@pam's.
+ * ⚠️ MIRRORED KEY FOR KEY, DEFAULTS INCLUDED, because PVE does not drop them: a live `keyctl=0`
+ *   against a sent value without `keyctl` is a change to PVE (`'0' ne ''`) and makes the write
+ *   root-only. `scalarForm` drops off keys from what is sent for the same reason.
+ */
+export const featuresNeedRoot = (
+  live: string,
+  sent: string | undefined,
+  unprivileged: boolean,
+): boolean => {
+  if (!unprivileged) return true;
+  const have = rawFeatures(live);
+  if (sent === undefined) return !(have.size === 0 || (have.size === 1 && have.has('nesting')));
+  const want = rawFeatures(sent);
+  const keys = new Set([...have.keys(), ...want.keys()]);
+  return [...keys].some(
+    (key) => key !== 'nesting' && (have.get(key) ?? '') !== (want.get(key) ?? ''),
+  );
+};
+
+export const featureWhy = (unprivileged: boolean): string =>
+  unprivileged ? 'A feature other than nesting.' : 'Any feature on a privileged guest.';
+
+export const judge = (props: LxcProps, live: Record<string, unknown>): LxcChange => {
+  const put: Record<string, string> = {};
+  const clear: string[] = [];
+  const resize: { disk: string; size: string }[] = [];
+  const refuse: string[] = [];
+  const drift = new Set<string>();
+  const unprivileged = bool(live['unprivileged'], false);
+
+  for (const key of declaredKeys(props)) {
+    const want = wireValue(declaredValue(props, key));
+    const have = text(live[key]);
+    const indexed = indexedKey(key);
+
+    if (key === 'unprivileged') {
+      if (canonicalToken(want) !== canonicalToken(have ?? '0')) {
+        drift.add(key);
+        refuse.push(
+          `unprivileged: live ${have ?? '0'}, declared ${want}. PVE refuses to change it ("unable ` +
+            'to modify read-only option"); only a backup and restore can, and that is a new guest.',
+        );
+      }
+      continue;
+    }
+
+    if (key === 'rootfs' || indexed?.[0] === 'mp') {
+      if (want === '') {
+        if (have === undefined) continue;
+        drift.add(key);
+        refuse.push(
+          `${key}: detaching a mount point moves its volume to unusedN -- do it by hand.`,
+        );
+      } else if (have === undefined) {
+        drift.add(key);
+        if (isHostPath(parseVolume(want))) {
+          refuse.push(rootOnly(props.vmid, key, want, 'A bind or device mount point.'));
+        } else put[key] = want;
+      } else {
+        const verdict = judgeVolume(key, want, have);
+        if (verdict.refuse !== undefined) refuse.push(verdict.refuse);
+        if (verdict.rootOnly === true) {
+          refuse.push(rootOnly(props.vmid, key, want, 'A bind or device mount point.'));
+        }
+        if (verdict.put !== undefined) put[key] = verdict.put;
+        if (verdict.resize !== undefined) resize.push({ disk: key, size: verdict.resize });
+        if (Object.keys(verdict).length > 0) drift.add(key);
+      }
+      continue;
+    }
+
+    if (indexed?.[0] === 'dev') {
+      const same = want === '' ? have === undefined : have !== undefined && devSame(want, have);
+      if (!same) {
+        drift.add(key);
+        refuse.push(rootOnly(props.vmid, key, want, 'Device passthrough.'));
+      }
+      continue;
+    }
+
+    if (indexed?.[0] === 'net') {
+      if (want === '') {
+        if (have !== undefined) {
+          drift.add(key);
+          clear.push(key);
+        }
+      } else if (have === undefined) {
+        drift.add(key);
+        put[key] = want;
+      } else {
+        const maps = netMaps(want, have);
+        if (!sameMap(maps.want, maps.have)) {
+          drift.add(key);
+          put[key] = netWrite(want, have);
+        }
+      }
+      continue;
+    }
+
+    if (!isManagedKey(key)) {
+      drift.add(key);
+      refuse.push(`${key}: not a config key this resource manages.`);
+      continue;
+    }
+
+    const wanted = want === '' ? '' : scalarForm(key, want);
+    const current = have ?? SCALAR_DEFAULTS[key];
+    const had = current === undefined ? '' : scalarForm(key, current);
+    if (wanted === had) continue;
+    drift.add(key);
+    // ⚠️ `features` goes out with its off keys dropped — see `featuresNeedRoot`.
+    const next = key === 'features' ? wanted : want;
+    if (key === 'features' && featuresNeedRoot(have ?? '', next || undefined, unprivileged)) {
+      refuse.push(rootOnly(props.vmid, key, want, featureWhy(unprivileged)));
+    } else if (next === '' && CLEARABLE.has(key)) {
+      clear.push(key);
+    } else if (next === '') {
+      refuse.push(`${key}: cannot be removed; declare the value it should have.`);
+    } else put[key] = next;
+  }
+  return { clear, drift: [...drift].sort(), put, refuse, resize };
+};
+
+/** Two `devN` values as one device: same path, same options, `deny-write=0` meaning absent. */
+const devSame = (want: string, have: string) =>
+  sortedForm(optionMap(want, 'dev', 'path')) === sortedForm(optionMap(have, 'dev', 'path'));

package/src/proxmox/lxc-lifecycle.ts

@@ -0,0 +1,200 @@
+/**
+ * The calls a `Proxmox.Lxc` makes: read one config, create, update in place, grow, delete.
+ *
+ * ⛔ A READ FAILURE IS A FAILURE HERE, NOT "ABSENT" — THE ONE PLACE THIS PACKAGE DEPARTS FROM
+ *   resource.ts. `pveOperations.read` folds every error into `undefined`, which for a guest means a
+ *   403 or a node that did not answer plans a CREATE over a running container. PVE answers a
+ *   missing guest with HTTP 500, `Configuration file 'nodes/<node>/lxc/<vmid>.conf' does not
+ *   exist` (pve-guest-common `AbstractConfig::load_config`), so only a 500 may mean absent — and
+ *   even then only after the cluster says so, below. Anything else fails the plan.
+ *
+ * ⛔ "ABSENT" IS DECIDED BY THE WHOLE CLUSTER, NOT BY THE ERROR TEXT. A config lives under its
+ *   node, so a guest migrated to another node — or a QEMU VM holding the same cluster-wide vmid —
+ *   also reads as missing at the declared path. `GET /cluster/resources?type=vm` settles it: the
+ *   vmid nowhere is absent; the vmid anywhere else FAILS the read with where it is; the vmid on
+ *   the declared node fails with PVE's own error. ★ Keyed on the cluster rather than on matching
+ *   the message, so a PVE that words it differently still cannot turn into a create.
+ *
+ * ⚠️ CREATE, RESIZE AND DELETE ARE ASYNCHRONOUS; A CONFIG PUT IS NOT. The first three answer a
+ *   UPID the moment PVE forks the worker (`NodesNodeLxcPostReturn`, `…ResizePutReturn`,
+ *   `…VmidDeleteReturn` are all `string`), so each waits for its task's exitstatus. `PUT …/config`
+ *   answers `null` after writing (`…ConfigPutReturn`), so it needs no wait.
+ * ⛔ EACH TASK IS POLLED WITH THE CREDENTIAL THAT STARTED IT — see `awaitTask`: only the owner
+ *   skips `Sys.Audit`. A fresh `provision` mint per write gives the full 300s lease a create needs;
+ *   a cached lease can be handed out with 60s left (lease-cache.ts).
+ */
+import * as Effect from 'effect/Effect';
+import { PveError, pve, pveWith } from './client.ts';
+import { type PveTarget, mint } from './credentials.ts';
+import { createForm } from './lxc-create-form.ts';
+import { type LxcChange, judge } from './lxc-judge.ts';
+import type { LxcAttributes, LxcProps } from './lxc-props.ts';
+import { rawKeysOf, storedConfig } from './lxc-props.ts';
+import { awaitTask } from './network-apply-read.ts';
+import { text, withClears } from './values.ts';
+
+/** A plan-time or apply-time refusal. Nothing was written when one of these is raised. */
+export class LxcRefusedError extends Error {
+  override readonly name = 'LxcRefusedError';
+}
+
+/** Where one guest lives. Its identity, and nothing else. */
+export type LxcWhere = { readonly target: PveTarget; readonly node: string; readonly vmid: number };
+
+export const guestPath = (where: LxcWhere) => `nodes/${where.node}/lxc/${String(where.vmid)}`;
+
+/** How long each task may run, in one-second polls. ⚠️ A cap, not an estimate. */
+const CREATE_POLLS = 180;
+const TASK_POLLS = 60;
+
+const isServerError = (error: unknown): error is PveError =>
+  error instanceof PveError && error.status === 500;
+
+/** One `GET /cluster/resources?type=vm` row. */
+type GuestRow = { readonly vmid?: unknown; readonly node?: unknown; readonly type?: unknown };
+
+/** The live config, or undefined when no guest holds this vmid anywhere in the cluster. */
+export const readLive = (where: LxcWhere) =>
+  Effect.gen(function* () {
+    const answer = yield* pve<Record<string, unknown> | null>(
+      where.target,
+      'read',
+      'GET',
+      `${guestPath(where)}/config`,
+    ).pipe(
+      Effect.map((data) => ({ data, error: undefined })),
+      Effect.catchIf(isServerError, (error) => Effect.succeed({ data: undefined, error })),
+    );
+    if (answer.data !== undefined && answer.data !== null) return answer.data;
+    const rows = yield* pve<readonly GuestRow[]>(
+      where.target,
+      'read',
+      'GET',
+      'cluster/resources?type=vm',
+    );
+    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `"100"` would otherwise
+    //   match nothing, and "listed nowhere" is the one answer that turns into a create.
+    const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
+    if (found !== undefined && found.node === where.node && found.type === 'lxc') {
+      return yield* Effect.fail(
+        answer.error ??
+          new LxcRefusedError(`CT ${String(where.vmid)} is listed but its config read empty.`),
+      );
+    }
+    if (found !== undefined) {
+      return yield* Effect.fail(
+        new LxcRefusedError(
+          `vmid ${String(where.vmid)} is a ${text(found.type, 'guest')} on ` +
+            `${text(found.node, '?')}, not a container on ${where.node}. A migration is not an ` +
+            'update and vmids are cluster-wide: declare the node it is on, or pick a free vmid.',
+        ),
+      );
+    }
+    return undefined;
+  });
+
+export const attributesOf = (where: LxcWhere, live: Record<string, unknown>): LxcAttributes => ({
+  config: storedConfig(live),
+  node: where.node,
+  rawKeys: rawKeysOf(live),
+  vmid: where.vmid,
+});
+
+/** Run one task-starting call and wait for it on the same credential. Fails unless `OK`. */
+const task = (
+  where: LxcWhere,
+  method: 'POST' | 'PUT' | 'DELETE',
+  path: string,
+  what: string,
+  polls: number,
+  form?: Record<string, string>,
+) =>
+  Effect.gen(function* () {
+    const credential = yield* mint(where.target, 'provision');
+    const upid = text(yield* pveWith<string>(where.target, credential, method, path, form));
+    if (upid === '') {
+      return yield* Effect.fail(
+        new LxcRefusedError(
+          `${what}: PVE returned no task id, so the write cannot be confirmed and is not claimed.`,
+        ),
+      );
+    }
+    const exit = yield* awaitTask(where.target, credential, where.node, upid, polls);
+    if (exit !== 'OK') {
+      return yield* Effect.fail(
+        new LxcRefusedError(
+          `${what}: task ${upid} ended "${exit}". Read \`pvesh get /nodes/${where.node}/tasks/` +
+            `${upid}/log\` before running the deploy again.`,
+        ),
+      );
+    }
+  });
+
+/** POST the create and wait for the template to unpack. ⛔ Refusals are the caller's to check. */
+export const createGuest = (props: LxcProps) =>
+  task(
+    props,
+    'POST',
+    `nodes/${props.node}/lxc`,
+    `create CT ${String(props.vmid)}`,
+    CREATE_POLLS,
+    createForm(props),
+  );
+
+/**
+ * Apply a judged change: the config PUT first, then each resize.
+ * ⚠️ IN THAT ORDER BECAUSE A MOUNT POINT'S PUT CARRIES ITS LIVE `size=`, and the resize rewrites it.
+ * ⛔ THE PUT CARRIES THE `digest` OF THE CONFIG IT WAS JUDGED AGAINST. PVE refuses the write if the
+ *   file changed since (`assert_if_modified`), so an edit landing between reconcile's own read and
+ *   its PUT fails the deploy instead of being overwritten by a change computed from the older file.
+ * ⚠️ THE DIGEST IS THE DEPLOY'S READ, NOT THE PLAN'S. A hand edit between `plan` and `deploy` is
+ *   seen by reconcile's fresh judge instead: a declared key edited meanwhile is written back to the
+ *   declaration (even after a plan that warned of nothing), an undeclared one is left alone.
+ */
+export const updateGuest = (props: LxcProps, change: LxcChange, digest: string) =>
+  Effect.gen(function* () {
+    if (Object.keys(change.put).length > 0 || change.clear.length > 0) {
+      const form = withClears(
+        { ...change.put, ...(digest === '' ? {} : { digest }) },
+        change.clear,
+      );
+      yield* pve(props.target, 'provision', 'PUT', `${guestPath(props)}/config`, form);
+    }
+    for (const grow of change.resize) {
+      yield* task(
+        props,
+        'PUT',
+        `${guestPath(props)}/resize`,
+        `grow ${grow.disk} of CT ${String(props.vmid)} to ${grow.size}`,
+        TASK_POLLS,
+        { disk: grow.disk, size: grow.size },
+      );
+    }
+  });
+
+/**
+ * ⛔ NO `force`, NO `purge`, NO STOP FIRST. PVE refuses to destroy a running or protected guest,
+ *   and that refusal is kept: stopping a guest so a delete can proceed is an operator's decision.
+ *   Reached only under `RemovalPolicy.destroy()` — this resource retains by default.
+ * ⛔ AND ONLY THE GUEST THIS STACK DECLARED. State holds a vmid, and a vmid is reusable: after a
+ *   hand `pct destroy` and a new `pct create` at the same id, "delete CT 150" is somebody else's
+ *   container and all its volumes. So the live guest is judged against the last declaration
+ *   first; one that no longer matches is refused with the keys that differ, and deleting it (or
+ *   declaring it again) is the operator's call.
+ */
+export const destroyGuest = (where: LxcWhere, declared: LxcProps) =>
+  Effect.gen(function* () {
+    const live = yield* readLive(where);
+    if (live === undefined) return;
+    const drift = judge(declared, live).drift;
+    if (drift.length > 0) {
+      return yield* Effect.fail(
+        new LxcRefusedError(
+          `destroy CT ${String(where.vmid)}: the guest on ${where.node} no longer matches its last ` +
+            `declaration (${drift.join(', ')}), so it may not be the guest this stack made. ` +
+            'Nothing was deleted. Delete it by hand if it should go, or declare it again.',
+        ),
+      );
+    }
+    yield* task(where, 'DELETE', guestPath(where), `destroy CT ${String(where.vmid)}`, TASK_POLLS);
+  });

package/src/proxmox/lxc-ownership.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Whose guest it is — docs/ownership.md applied to `Proxmox.Lxc`, through the real engine over
+ * fake-pve-lxc.ts (placeholders only).
+ *
+ * ⛔ WHAT THESE PIN: with no state, no live guest is adopted without `--adopt` or `adopt(true)`,
+ *   not even one that matches the declaration; `adopt(false)` wins over the flag; a deploy that
+ *   planned a create refuses a guest it then finds, and forgets its `creating` row; under
+ *   `--adopt` it records a matching one with no write and still refuses one that differs; and a
+ *   create interrupted after its POST resumes WITHOUT `--adopt` when the guest is what it wrote,
+ *   and asks for `--adopt` when someone changed it meanwhile.
+ * ★ THE INTERRUPTION IS A CREATE TASK THAT ENDS IN AN ERROR AFTER THE FAKE BUILT THE GUEST — to the
+ *   engine the same as a deploy killed while it waited on the task: a live guest, and a
+ *   `creating` row with no attributes.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const NODE = 'pve1';
+const VMID = 100;
+const KEY = `${NODE}/${String(VMID)}`;
+const TAKEOVER = 'already exists, and this stack holds no state for it';
+
+const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
+  const { lxc: _raw, ...config } = LIVE;
+  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
+};
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const cluster = () => {
+  fake = fakePve();
+  return fake;
+};
+const live = () => {
+  const pve = cluster();
+  seed(pve, NODE, VMID);
+  return pve;
+};
+
+describe('with no state, a live guest is never adopted silently', () => {
+  test.each([
+    ['one that matches', 'ct-example'],
+    ['one that differs', 'somebody-else'],
+  ])('%s: the plan fails "Cannot adopt" and nothing is written', async (_, hostname) => {
+    const pve = live();
+    const run = await lxcEngine(pve).deploy(
+      ProxmoxLxc('ct', { hostname, node: NODE, target: TARGET, vmid: VMID }),
+    );
+    expect(run.failure).toContain('Cannot adopt');
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('--adopt takes a matching guest over with no write; the next plan is noop', async () => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const run = await stack.deploy(ProxmoxLxc('ct', pasted()), { adopt: true });
+    expect(run).toMatchObject({ actions: { ct: 'adopted' }, failure: '' });
+    expect(writesOf(pve)).toEqual([]);
+    expect((await stack.plan(ProxmoxLxc('ct', pasted()))).actions).toEqual({ ct: 'noop' });
+  });
+
+  test('adopt(false) wins over --adopt', async () => {
+    const pve = live();
+    const declared = ProxmoxLxc('ct', pasted()).pipe(adopt(false));
+    const run = await lxcEngine(pve).deploy(declared, { adopt: true });
+    expect(run.failure).toContain('Cannot adopt');
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('a create never takes over a guest it finds at apply', () => {
+  test('one that appears after the plan is refused, matching or not, and its row forgotten', async () => {
+    const pve = live();
+    pve.vanish.set(KEY, 2);
+    const stack = lxcEngine(pve);
+    expect((await stack.plan(ProxmoxLxc('ct', pasted()))).actions).toEqual({ ct: 'create' });
+    const run = await stack.deploy(ProxmoxLxc('ct', pasted()));
+    expect(run.failure).toContain(TAKEOVER);
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBeUndefined();
+    expect((await stack.plan(ProxmoxLxc('ct', pasted()))).failure).toContain('Cannot adopt');
+  });
+
+  test('under --adopt, one that matches is recorded with no write', async () => {
+    const pve = live();
+    pve.vanish.set(KEY, 1);
+    const stack = lxcEngine(pve);
+    const run = await stack.deploy(ProxmoxLxc('ct', pasted()), { adopt: true });
+    expect(run).toMatchObject({ actions: { ct: 'create' }, failure: '' });
+    expect(writesOf(pve)).toEqual([]);
+    expect((await stack.plan(ProxmoxLxc('ct', pasted()))).actions).toEqual({ ct: 'noop' });
+  });
+
+  test('under --adopt, one that differs is still refused until a plan can show it', async () => {
+    const pve = live();
+    pve.vanish.set(KEY, 2);
+    const stack = lxcEngine(pve);
+    const declared = () => ProxmoxLxc('ct', pasted({ memory: 1024 }));
+    expect((await stack.plan(declared())).actions).toEqual({ ct: 'create' });
+    const run = await stack.deploy(declared(), { adopt: true });
+    expect(run.failure).toContain('already exists on pve1 and differs in memory');
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('an interrupted create', () => {
+  const door = (over: Partial<LxcProps> = {}) =>
+    ProxmoxLxc('door', {
+      hostname: 'door-example',
+      node: NODE,
+      ostemplate: 'local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst',
+      rootfs: 'local-zfs:8',
+      target: TARGET,
+      vmid: 150,
+      ...over,
+    });
+  const interrupted = async () => {
+    const pve = cluster();
+    const stack = lxcEngine(pve);
+    pve.task.exit = 'interrupted';
+    expect((await stack.deploy(door())).failure).toContain('ended "interrupted"');
+    expect(stack.status('door')).toBe('creating');
+    pve.task.exit = 'OK';
+    return { pve, stack };
+  };
+
+  test('resumes without --adopt when the guest is what it wrote, and writes nothing more', async () => {
+    const { pve, stack } = await interrupted();
+    expect((await stack.deploy(door())).failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    expect((await stack.plan(door())).actions).toEqual({ door: 'noop' });
+  });
+
+  test('resumes when the plan reads no guest and the apply then finds it (diff noted it)', async () => {
+    const { pve, stack } = await interrupted();
+    pve.vanish.set(`${NODE}/150`, 1);
+    expect((await stack.deploy(door())).failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    expect(stack.status('door')).toBe('created');
+  });
+
+  test('asks for --adopt when the guest changed meanwhile, and resumes with it', async () => {
+    const { pve, stack } = await interrupted();
+    const guest = pve.guests.get(`${NODE}/150`) ?? {};
+    guest['hostname'] = 'someone-else';
+    expect((await stack.deploy(door())).failure).toContain('Cannot resume creating');
+    const resumed = await stack.deploy(door(), { adopt: true });
+    expect(resumed.failure).toBe('');
+    expect(resumed.warnings.join('\n')).toContain('differs from the declaration in hostname');
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-example');
+  });
+});