@homeflare/alchemy 0.8.0 → 0.10.0

package/dist/openbao/index.js

@@ -297,7 +297,202 @@ var revokeSelf = (token, env) => runWith(env, revokeSelfEffect(token));
 import { Resource } from "alchemy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
+import * as Effect12 from "effect/Effect";
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect6 from "effect/Effect";
+import * as Option5 from "effect/Option";
+
+// src/ownership/resume.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect3 from "effect/Effect";
+import * as Option2 from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect3.gen(function* () {
+  const bag = yield* Effect3.serviceOption(Artifacts);
+  if (Option2.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect3.gen(function* () {
+  const bag = yield* Effect3.serviceOption(Artifacts);
+  if (Option2.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect3.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect3.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect3.succeed(undefined);
+  const found = yield* recovered.pipe(Effect3.catch(unproven), Effect3.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect3.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect5 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect4 from "effect/Effect";
+import * as Option3 from "effect/Option";
+var absent = (value) => value === undefined || value === null;
+var isPlainObject = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect4.map(Effect4.serviceOption(Stack), (stack) => {
+  const declared = Option3.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect5.gen(function* () {
+  const stack = yield* Effect5.serviceOption(Stack2);
+  const state = yield* Effect5.serviceOption(State);
+  if (Option4.isNone(stack) || Option4.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect5.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect5.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect5.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect5.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var forgetRefusedCreate = (fqn, instanceId) => Effect5.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect5.ignore);
+});
+
+// src/ownership/adopt.ts
+var adoptEnabled = (fqn) => Effect6.gen(function* () {
+  const stack = yield* Effect6.serviceOption(Stack3);
+  const scoped = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect6.serviceOption(AdoptPolicy);
+  if (Option5.isSome(policy))
+    return policy.value;
+  const context = yield* Effect6.serviceOption(AlchemyContext);
+  return Option5.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect6.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect6.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect6.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect6.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/ownership/probe.ts
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import * as Effect7 from "effect/Effect";
+var ownedRead = (ask, found, settled) => Effect7.gen(function* () {
+  if (found === undefined || ask.output !== undefined)
+    return found;
+  const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+  if (recorded === "absent")
+    return Unowned2(found);
+  if (recorded === "partial") {
+    yield* Effect7.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    return Unowned2(found);
+  }
+  const unproven = (reason) => Effect7.as(Effect7.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  const ours = yield* settled.pipe(Effect7.catch(unproven), Effect7.catchDefect(unproven));
+  return ours ? found : Unowned2(found);
+});
 
 // src/openbao/digest.ts
 var canonical = (text) => text.trimEnd();
@@ -438,24 +633,24 @@ var matches2 = (attributes, props) => attributes.type === props.type && (props.d
 var wantsTune2 = (props) => props.description !== undefined || props.defaultLeaseTtl !== undefined || props.maxLeaseTtl !== undefined;
 
 // src/openbao/auth-method-reconcile.ts
-import * as Effect6 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/openbao/auth-method-wire.ts
-import * as Effect3 from "effect/Effect";
-var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect3.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect8 from "effect/Effect";
+var absentFromTable = (path, asked) => baoRead("sys/auth").pipe(Effect8.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/auth could not confirm the method is absent: ${listing.message}`
-])), Effect3.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect3.succeed(undefined) : Effect3.fail(asked)));
-var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect3.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
+])), Effect8.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${authPath(path)}/`) ? Effect8.succeed(undefined) : Effect8.fail(asked)));
+var readAuthMethodData = (path) => baoRead(readPath2(path)).pipe(Effect8.catchIf((error) => error.status === 400, (error) => absentFromTable(path, error)));
 var enableAuthMethod = (props) => baoWrite("POST", readPath2(props.path), enableBody2(props));
 var tuneAuthMethod = (props) => baoWrite("POST", tunePath2(props.path), tuneBody2(props));
 var disableAuthMethod = (path) => baoDelete(readPath2(path));
 
 // src/openbao/mount-move.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/openbao/remount-wire.ts
-import * as Effect4 from "effect/Effect";
+import * as Effect9 from "effect/Effect";
 class RemountError extends Error {
   constructor(message) {
     super(message);
@@ -463,17 +658,17 @@ class RemountError extends Error {
   }
 }
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-var startRemount = (from, to) => Effect4.flatMap(baoCall("write", "POST", "sys/remount", { from, to }), (body) => {
+var startRemount = (from, to) => Effect9.flatMap(baoCall("write", "POST", "sys/remount", { from, to }), (body) => {
   const id = record(body?.["data"])?.["migration_id"];
-  return typeof id === "string" && id !== "" ? Effect4.succeed(id) : Effect4.fail(new RemountError(`sys/remount ${from} -> ${to} answered no migration_id.`));
+  return typeof id === "string" && id !== "" ? Effect9.succeed(id) : Effect9.fail(new RemountError(`sys/remount ${from} -> ${to} answered no migration_id.`));
 });
-var remountStatus = (id) => Effect4.map(baoRead(`sys/remount/status/${encodeURIComponent(id)}`), (data) => {
+var remountStatus = (id) => Effect9.map(baoRead(`sys/remount/status/${encodeURIComponent(id)}`), (data) => {
   if (data === undefined)
     return;
   const status = record(data["migration_info"])?.["status"];
   return typeof status === "string" ? status : "unknown";
 });
-var remountAndWait = (from, to, confirm, options = {}) => Effect4.gen(function* () {
+var remountAndWait = (from, to, confirm, options = {}) => Effect9.gen(function* () {
   const interval = options.intervalMillis ?? 1000;
   const attempts = Math.max(1, options.attempts ?? 120);
   const id = yield* startRemount(from, to);
@@ -483,17 +678,17 @@ var remountAndWait = (from, to, confirm, options = {}) => Effect4.gen(function*
     if (status === "success")
       return;
     if (status === "failure") {
-      return yield* Effect4.fail(new RemountError(`${named} FAILED. The server log carries the reason, tagged with that migration_id. ` + "Read sys/mounts (or sys/auth) before retrying: the source may be tainted."));
+      return yield* Effect9.fail(new RemountError(`${named} FAILED. The server log carries the reason, tagged with that migration_id. ` + "Read sys/mounts (or sys/auth) before retrying: the source may be tainted."));
     }
     if (status === undefined) {
       if (yield* confirm)
         return;
-      return yield* Effect4.fail(new RemountError(`${named}: the server no longer knows the migration (its tracker is in memory, lost ` + "on a restart or leader change), and the mount table does not show the move done."));
+      return yield* Effect9.fail(new RemountError(`${named}: the server no longer knows the migration (its tracker is in memory, lost ` + "on a restart or leader change), and the mount table does not show the move done."));
     }
     if (attempt < attempts)
-      yield* Effect4.sleep(interval);
+      yield* Effect9.sleep(interval);
   }
-  return yield* Effect4.fail(new RemountError(`${named} is still in progress after ${String(attempts)} status reads. Do not re-run ` + `until sys/remount/status/${id} settles.`));
+  return yield* Effect9.fail(new RemountError(`${named} is still in progress after ${String(attempts)} status reads. Do not re-run ` + `until sys/remount/status/${id} settles.`));
 });
 
 // src/openbao/mount-move.ts
@@ -520,8 +715,8 @@ var planMove = (family, stated, path, remountFrom) => {
   }
   return { kind: "move", from };
 };
-var refuse = (message) => Effect5.die(new Error(message));
-var performMove = (target, from, options) => Effect5.gen(function* () {
+var refuse = (message) => Effect10.die(new Error(message));
+var performMove = (target, from, options) => Effect10.gen(function* () {
   const to = mountPath(target.path);
   const source = yield* target.read(from);
   const landed = yield* target.read(to);
@@ -536,12 +731,12 @@ var performMove = (target, from, options) => Effect5.gen(function* () {
   if (source.type !== target.type) {
     return yield* refuse(`${target.family}: ${from} is type ${source.type}, not ${target.type}. A remount keeps the ` + "type; fix the declaration first.");
   }
-  const confirm = Effect5.map(Effect5.all([target.read(from), target.read(to)]), ([gone, there]) => gone === undefined && there !== undefined);
+  const confirm = Effect10.map(Effect10.all([target.read(from), target.read(to)]), ([gone, there]) => gone === undefined && there !== undefined);
   yield* remountAndWait(target.wire(from), target.wire(to), confirm, options);
 });
 
 // src/openbao/auth-method-reconcile.ts
-var readMethod = (props) => Effect6.gen(function* () {
+var readMethod = (props) => Effect11.gen(function* () {
   const live = yield* readAuthMethodData(props.path);
   if (live === undefined)
     return;
@@ -554,10 +749,16 @@ var moveTarget = (props) => ({
   type: props.type,
   wire: (path) => `auth/${authPath(path)}`
 });
-var reconcileAuthMethod = (news, stated, options) => Effect6.gen(function* () {
+var reconcileAuthMethod = (news, stated, options, claim) => Effect11.gen(function* () {
   const move = planMove("Bao.AuthMethod", stated, news.path, news.remountFrom);
   if (move.kind === "refuse")
-    return yield* Effect6.die(new Error(move.message));
+    return yield* Effect11.die(new Error(move.message));
+  const first = stated === undefined ? claim : undefined;
+  if (first !== undefined && move.kind === "move") {
+    const source = yield* readMethod({ ...news, path: move.from });
+    if (source !== undefined)
+      yield* first(`Bao.AuthMethod ${move.from} (the remountFrom source)`);
+  }
   if (move.kind === "move")
     yield* performMove(moveTarget(news), move.from, options);
   let live = yield* readMethod(news);
@@ -565,15 +766,18 @@ var reconcileAuthMethod = (news, stated, options) => Effect6.gen(function* () {
     yield* enableAuthMethod(news);
     if (wantsTune2(news))
       yield* tuneAuthMethod(news);
-  } else if (!matches2(live, news)) {
+  } else {
     if (live.type !== news.type) {
-      return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
+      return yield* Effect11.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Auth method type is immutable — replace manually."));
     }
-    yield* tuneAuthMethod(news);
+    if (first !== undefined)
+      yield* first(`Bao.AuthMethod ${authPath(news.path)}`);
+    if (!matches2(live, news))
+      yield* tuneAuthMethod(news);
   }
   live = yield* readMethod(news);
   if (live === undefined) {
-    return yield* Effect6.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
+    return yield* Effect11.die(new Error(`Bao.AuthMethod ${authPath(news.path)}: write returned no error but the method is still absent.`));
   }
   return live;
 });
@@ -582,17 +786,21 @@ var reconcileAuthMethod = (news, stated, options) => Effect6.gen(function* () {
 var BaoAuthMethod = Resource("Bao.AuthMethod", {
   defaultRemovalPolicy: "retain"
 });
-var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect7.succeed(BaoAuthMethod.Provider.of({
-  list: () => Effect7.succeed([]),
-  read: Effect7.fn(function* ({ olds }) {
-    return yield* readMethod(olds);
+var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect12.succeed(BaoAuthMethod.Provider.of({
+  list: () => Effect12.succeed([]),
+  read: Effect12.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readMethod(olds);
+    const ours = Effect12.sync(() => found !== undefined && matches2(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect7.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved(news))
+  diff: Effect12.fn(function* ({ news, output }) {
+    if (output === undefined)
+      return;
+    if (!isResolved(news))
       return;
     const move = planMove("Bao.AuthMethod", output.path, news.path, news.remountFrom);
     if (move.kind === "refuse")
-      return yield* Effect7.die(new Error(move.message));
+      return yield* Effect12.die(new Error(move.message));
     if (move.kind === "move")
       return { action: "update" };
     const live = yield* readMethod(news);
@@ -604,19 +812,20 @@ var BaoAuthMethodProvider = () => Provider.effect(BaoAuthMethod, Effect7.succeed
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect7.fn(function* ({ news, output }) {
-    return yield* reconcileAuthMethod(news, output?.path);
+  reconcile: Effect12.fn(function* ({ fqn, instanceId, news, output }) {
+    const claim = claimFor({ fqn, instanceId, output });
+    return yield* reconcileAuthMethod(news, output?.path, undefined, claim);
   }),
-  delete: Effect7.fn(function* ({ output }) {
+  delete: Effect12.fn(function* ({ output }) {
     yield* disableAuthMethod(output.path);
     return;
   })
-})));
+})).pipe(Effect12.map(provingResumes)));
 // src/openbao/auth-role.ts
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 
 // src/openbao/auth-role-form.ts
 var policiesOf = (live) => {
@@ -677,10 +886,10 @@ var matches3 = (attributes, props) => {
 };
 
 // src/openbao/rename-identity.ts
-import * as Effect9 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 
 // src/openbao/rename.ts
-import * as Effect8 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 var exact = (identity) => identity;
 var declaredString = (news, key) => {
   if (typeof news !== "object" || news === null)
@@ -702,15 +911,15 @@ var declaredRolePath = (news, rolePath, defaultMount) => {
 };
 var policyKey = (name) => name.trim().toLowerCase();
 var isMoved = (stored, declared, key = exact) => declared === undefined ? undefined : key(stored) !== key(declared);
-var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect8.gen(function* () {
+var judgeMove = (family, tried, declared, pathOf, key = exact) => Effect13.gen(function* () {
   if (tried === undefined || declared === undefined || key(tried) === key(declared)) {
     return;
   }
   if ((yield* baoRead(pathOf(declared))) === undefined)
     return { from: tried, to: declared };
-  return yield* Effect8.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
+  return yield* Effect13.die(new Error(`${family}: ${tried} → ${declared} would land on an object that already exists at ` + `${declared}. Under RemovalPolicy.destroy() a resource moving off that name (a swap, a ` + "shift, or a reverted move that did not finish) deletes it after this one writes it. " + "Nothing was written. Move through a name nothing holds, in two deploys, or remove " + `${declared} by hand first.`));
 });
-var refuseMovedUpdate = (family, from, to) => Effect8.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
+var refuseMovedUpdate = (family, from, to) => Effect13.die(new Error(`${family}: planned as an update, but its identity moved from ${from} to ${to}. Writing ` + `${to} now would leave ${from} live with no state record. Nothing was written. Run the ` + "deploy again: once the value resolves at plan time it plans as a replace."));
 
 // src/openbao/rename-identity.ts
 var nameIdentity = (family, pathOf, key) => ({
@@ -730,10 +939,10 @@ var foldName = (path) => path.replace(/[^/]+$/, (name) => name.toLowerCase());
 var judgeRename = (identity, olds, news, output) => judgeMove(identity.family, output === undefined ? identity.declared(olds) : identity.recorded(output), identity.declared(news), identity.pathOf ?? ((path) => path), identity.key);
 var guardRename = (identity, news, output) => {
   if (output === undefined)
-    return Effect9.void;
+    return Effect14.void;
   const from = identity.recorded(output);
   const to = identity.declared(news);
-  return to !== undefined && isMoved(from, to, identity.key) === true ? refuseMovedUpdate(identity.family, from, to) : Effect9.void;
+  return to !== undefined && isMoved(from, to, identity.key) === true ? refuseMovedUpdate(identity.family, from, to) : Effect14.void;
 };
 
 // src/openbao/auth-role.ts
@@ -741,18 +950,20 @@ var BaoAuthRole = Resource2("Bao.AuthRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY = nameIdentity("Bao.AuthRole", readPath3, foldName);
-var readRole = (props) => Effect10.gen(function* () {
+var readRole = (props) => Effect15.gen(function* () {
   const live = yield* baoRead(readPath3(props.name));
   if (live === undefined)
     return;
   return attributesOf3(props, live);
 });
-var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect10.succeed(BaoAuthRole.Provider.of({
-  list: () => Effect10.succeed([]),
-  read: Effect10.fn(function* ({ olds }) {
-    return yield* readRole(olds);
+var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect15.succeed(BaoAuthRole.Provider.of({
+  list: () => Effect15.succeed([]),
+  read: Effect15.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readRole(olds);
+    const ours = Effect15.sync(() => found !== undefined && matches3(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect10.fn(function* ({ news, olds, output }) {
+  diff: Effect15.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY, olds, news, output);
     if (output === undefined)
       return;
@@ -767,25 +978,28 @@ var BaoAuthRoleProvider = () => Provider2.effect(BaoAuthRole, Effect10.succeed(B
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect10.fn(function* ({ news, output }) {
+  reconcile: Effect15.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY, news, output);
     const live = yield* readRole(news);
+    const path = readPath3(news.name);
+    if (live !== undefined)
+      yield* refuseTakeover({ fqn, instanceId, output }, `Bao.AuthRole ${path}`);
     if (live === undefined || !matches3(live, news)) {
       yield* baoWrite("PUT", readPath3(news.name), writeBody(news));
     }
     const after = yield* readRole(news);
     if (after === undefined) {
-      return yield* Effect10.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
+      return yield* Effect15.die(new Error(`Bao.AuthRole ${news.name}: write returned no error but the role is still absent.`));
     }
     return after;
   }),
-  delete: Effect10.fn(function* ({ output }) {
+  delete: Effect15.fn(function* ({ output }) {
     yield* baoDelete(readPath3(output.name));
     return;
   })
-})));
+})).pipe(Effect15.map(provingResumes)));
 // src/openbao/bao-identity.ts
-import * as Effect11 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 import * as FetchHttpClient3 from "effect/unstable/http/FetchHttpClient";
 
 // src/openbao/bao-namespace.ts
@@ -833,42 +1047,42 @@ var checkHealth = (address, expectedCluster, body) => {
   }
   return { clusterId: text3(body["cluster_id"]), version: text3(body["version"]) };
 };
-var assertBaoIdentityEffect = (expected) => Effect11.gen(function* () {
+var assertBaoIdentityEffect = (expected) => Effect16.gen(function* () {
   const env = yield* BaoEnv;
   const address = addressOf(env);
   const clusterName = expected.clusterName.trim();
   if (clusterName === "") {
-    return yield* Effect11.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
+    return yield* Effect16.fail(new BaoIdentityError("input", "clusterName is empty, so there is nothing to compare."));
   }
   const namespace = canonicalNamespace(expected.namespace);
   const sent = envNamespace(env);
   if (sent !== namespace) {
-    return yield* Effect11.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
+    return yield* Effect16.fail(new BaoIdentityError("mismatch", `BAO_NAMESPACE resolves to \`${namespaceLabel(sent)}\`, but this stack expects ` + `\`${namespaceLabel(namespace)}\`.`));
   }
   const anonymous = { ...env, BAO_NAMESPACE: "", BAO_TOKEN: "" };
-  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect11.provideService(BaoEnv, anonymous), Effect11.mapError(unreachable(address, "sys/health")));
+  const body = yield* baoCall("read", "GET", HEALTH_PATH).pipe(Effect16.provideService(BaoEnv, anonymous), Effect16.mapError(unreachable(address, "sys/health")));
   const health = checkHealth(address, clusterName, body);
   if (health instanceof BaoIdentityError)
-    return yield* Effect11.fail(health);
+    return yield* Effect16.fail(health);
   if (namespace !== "") {
     const scoped = { ...env, BAO_NAMESPACE: namespace, BAO_TOKEN: "" };
-    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect11.provideService(BaoEnv, scoped), Effect11.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
+    const probe = yield* baoCall("read", "GET", NAMESPACE_PROBE_PATH).pipe(Effect16.provideService(BaoEnv, scoped), Effect16.mapError(unreachable(address, `the namespace probe for \`${namespace}\``)));
     if (probe === undefined) {
-      return yield* Effect11.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
+      return yield* Effect16.fail(new BaoIdentityError("mismatch", `cluster \`${clusterName}\` at ${address} has no namespace \`${namespace}\`.`));
     }
   }
   return { address, clusterName, namespace, ...health };
 });
 var assertBaoIdentity = (input) => {
   const effect3 = assertBaoIdentityEffect(input);
-  const scoped = input.env === undefined ? effect3 : Effect11.provideService(effect3, BaoEnv, input.env);
-  return Effect11.runPromise(scoped.pipe(Effect11.provide(FetchHttpClient3.layer)));
+  const scoped = input.env === undefined ? effect3 : Effect16.provideService(effect3, BaoEnv, input.env);
+  return Effect16.runPromise(scoped.pipe(Effect16.provide(FetchHttpClient3.layer)));
 };
 // src/openbao/cloudflare-role.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect14 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 
 // src/openbao/cloudflare-group-scope.ts
 var zoneResource = (zoneId) => `com.cloudflare.api.account.zone.${zoneId}`;
@@ -888,7 +1102,7 @@ var groupKey = (name, scope) => `${scope} ${name}`;
 
 // src/openbao/cloudflare-permission-groups.ts
 import * as Context2 from "effect/Context";
-import * as Effect13 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 
 // src/openbao/cloudflare-permission-groups-solve.ts
 var observationsOf = (declared, live) => declared.flatMap((role) => {
@@ -1058,7 +1272,7 @@ var samePolicies2 = (want, have) => want.length === have.length && want.every((w
 });
 
 // src/openbao/cloudflare-role-wire.ts
-import * as Effect12 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/openbao/cloudflare-role-form.ts
 var rolePath = (mount, name) => `${mountPath(mount)}/roles/${name}`;
@@ -1123,7 +1337,7 @@ var differences = (props, policies, live) => {
 };
 
 // src/openbao/cloudflare-role-wire.ts
-var readCloudflareRole = (mount, name) => Effect12.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
+var readCloudflareRole = (mount, name) => Effect17.map(baoRead(rolePath(mount, name)), (data) => data === undefined ? undefined : liveRoleOf(data));
 var writeCloudflareRole = (mount, name, body) => baoWrite("PUT", rolePath(mount, name), body);
 var deleteCloudflareRole = (mount, name) => baoDelete(rolePath(mount, name));
 
@@ -1145,9 +1359,9 @@ var pick = (mount, groups, refs, hint) => {
   const unknown = refs.filter((ref) => !groups.has(groupKey(ref.name, ref.scope)));
   if (unknown.length > 0) {
     const problems = unknown.map((ref) => `unknown group ${JSON.stringify(ref.name)} at scope ${ref.scope} — ${hint}`);
-    return Effect13.fail(new CloudflareGroupsError(mount, problems));
+    return Effect18.fail(new CloudflareGroupsError(mount, problems));
   }
-  return Effect13.succeed(new Map(refs.flatMap((ref) => {
+  return Effect18.succeed(new Map(refs.flatMap((ref) => {
     const key = groupKey(ref.name, ref.scope);
     const id = groups.get(key);
     return id === undefined ? [] : [[key, id]];
@@ -1155,15 +1369,15 @@ var pick = (mount, groups, refs, hint) => {
 };
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var deniedHint = (mount) => `GET ${mountPath(mount)}/permission-groups answered 403 — this token's policy carries no ` + `\`path "${mountPath(mount)}/permission-groups" { capabilities = ["read"] }\` grant. ` + "It is declared in ../platform/secrets/vault/policies/homeflare-admin/" + "20-cloudflare-permission-groups.hcl and applies with `alchemy deploy` of this stack";
-var deniedNamed = (mount, read) => Effect13.catchIf(read, (error) => error.status === 403, () => Effect13.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
-var engineGroups = (mount) => Effect13.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
+var deniedNamed = (mount, read) => Effect18.catchIf(read, (error) => error.status === 403, () => Effect18.fail(new CloudflareGroupsError(mount, [deniedHint(mount)])));
+var engineGroups = (mount) => Effect18.flatMap(deniedNamed(mount, baoRead(`${mountPath(mount)}/permission-groups`)), (data) => {
   const list = data?.["permission_groups"];
   if (data === undefined) {
     const why = "GET <mount>/permission-groups answered 404 — the endpoint is not deployed here";
-    return Effect13.fail(new CloudflareGroupsError(mount, [why]));
+    return Effect18.fail(new CloudflareGroupsError(mount, [why]));
   }
   if (!Array.isArray(list)) {
-    return Effect13.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
+    return Effect18.fail(new CloudflareGroupsError(mount, ["no permission_groups array in reply"]));
   }
   const scoped = new Map;
   const idsOf = new Map;
@@ -1190,24 +1404,24 @@ var engineGroups = (mount) => Effect13.flatMap(deniedNamed(mount, baoRead(`${mou
     const only = [...ids];
     return ids.size === 1 && only[0] !== undefined ? [[name, only[0]]] : [];
   }));
-  return problems.length > 0 ? Effect13.fail(new CloudflareGroupsError(mount, problems)) : Effect13.succeed(new Map([...atEveryScope(sole), ...scoped]));
+  return problems.length > 0 ? Effect18.fail(new CloudflareGroupsError(mount, problems)) : Effect18.succeed(new Map([...atEveryScope(sole), ...scoped]));
 });
-var permissionGroupsFromEngine = () => Effect13.sync(() => {
+var permissionGroupsFromEngine = () => Effect18.sync(() => {
   const cache = new Map;
-  const cachedFor = (mount) => Effect13.suspend(() => {
+  const cachedFor = (mount) => Effect18.suspend(() => {
     const hit = cache.get(mountPath(mount));
     if (hit !== undefined)
       return hit;
-    return Effect13.flatMap(Effect13.cached(engineGroups(mount)), (lookup) => {
+    return Effect18.flatMap(Effect18.cached(engineGroups(mount)), (lookup) => {
       cache.set(mountPath(mount), lookup);
       return lookup;
     });
   });
   return CloudflarePermissionGroups.of({
-    resolve: (mount, refs) => Effect13.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
+    resolve: (mount, refs) => Effect18.flatMap(cachedFor(mount), (groups) => pick(mount, groups, refs, "the engine does not list it for this account at that scope"))
   });
 });
-var permissionGroupsFromLiveRoles = (declared) => Effect13.gen(function* () {
+var permissionGroupsFromLiveRoles = (declared) => Effect18.gen(function* () {
   const accountOf = new Map;
   const byAccount = new Map;
   for (const [mount, roles] of declared) {
@@ -1218,9 +1432,9 @@ var permissionGroupsFromLiveRoles = (declared) => Effect13.gen(function* () {
   }
   const solved = new Map;
   for (const [account, roles] of byAccount) {
-    const solve = Effect13.gen(function* () {
+    const solve = Effect18.gen(function* () {
       const live = new Map;
-      yield* Effect13.all(roles.map((role) => Effect13.map(readCloudflareRole(role.mount, role.name), (read) => {
+      yield* Effect18.all(roles.map((role) => Effect18.map(readCloudflareRole(role.mount, role.name), (read) => {
         if (read?.policies !== undefined) {
           live.set(`${role.mount}/${role.name}`, read.policies);
         }
@@ -1228,11 +1442,11 @@ var permissionGroupsFromLiveRoles = (declared) => Effect13.gen(function* () {
       const result = solveGroups(observationsOf(roles, live));
       const problems = describeProblems(result);
       if (problems.length > 0) {
-        return yield* Effect13.fail(new CloudflareGroupsError(`account ${account}`, problems));
+        return yield* Effect18.fail(new CloudflareGroupsError(`account ${account}`, problems));
       }
       return atEveryScope(result.groups);
     });
-    solved.set(account, yield* Effect13.cached(solve));
+    solved.set(account, yield* Effect18.cached(solve));
   }
   return CloudflarePermissionGroups.of({
     resolve: (mount, refs) => {
@@ -1240,10 +1454,10 @@ var permissionGroupsFromLiveRoles = (declared) => Effect13.gen(function* () {
       const lookup = account === undefined ? undefined : solved.get(account);
       if (account === undefined || lookup === undefined) {
         const why = "no declared role on this mount, so no live role can vouch for its groups";
-        return Effect13.fail(new CloudflareGroupsError(mount, [why]));
+        return Effect18.fail(new CloudflareGroupsError(mount, [why]));
       }
       const hint = `no live role on account ${account} carries it; a NEW group needs the engine endpoint`;
-      return Effect13.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
+      return Effect18.flatMap(lookup, (groups) => pick(mount, groups, refs, hint));
     }
   });
 });
@@ -1253,9 +1467,9 @@ var BaoCloudflareRole = Resource3("Bao.CloudflareRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY2 = roleIdentity("Bao.CloudflareRole", rolePath);
-var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect14.gen(function* () {
+var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect19.gen(function* () {
   const groups = yield* CloudflarePermissionGroups;
-  const resolved = (props) => Effect14.gen(function* () {
+  const resolved = (props) => Effect19.gen(function* () {
     const refs = new Map;
     for (const policy of props.policies) {
       const scope = policy.scope ?? scopeOfResource(policy.resource);
@@ -1265,17 +1479,23 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
     const ids = yield* groups.resolve(props.mount, [...refs.values()]);
     const { missing, policies } = resolvePolicies(props.policies, ids);
     if (missing.length > 0) {
-      return yield* Effect14.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
+      return yield* Effect19.die(new Error(`Bao.CloudflareRole ${rolePath(props.mount, props.name)}: groups ` + `${missing.join(", ")} came back unresolved from a lookup that reported success.`));
     }
     return policies;
   });
   return BaoCloudflareRole.Provider.of({
-    list: () => Effect14.succeed([]),
-    read: Effect14.fn(function* ({ olds }) {
+    list: () => Effect19.succeed([]),
+    read: Effect19.fn(function* ({ fqn, instanceId, olds, output }) {
       const live = yield* readCloudflareRole(olds.mount, olds.name);
-      return live === undefined ? undefined : attributesOf4(olds, live);
+      const found = live === undefined ? undefined : attributesOf4(olds, live);
+      const ours = Effect19.gen(function* () {
+        if (live === undefined || refusalOf(olds) !== undefined)
+          return false;
+        return differences(olds, yield* resolved(olds), live).length === 0;
+      });
+      return yield* ownedRead({ fqn, instanceId, output }, found, ours);
     }),
-    diff: Effect14.fn(function* ({ news, olds, output }) {
+    diff: Effect19.fn(function* ({ news, olds, output }) {
       const move = yield* judgeRename(IDENTITY2, olds, news, output);
       if (output === undefined)
         return;
@@ -1291,34 +1511,37 @@ var BaoCloudflareRoleProvider = () => Provider3.effect(BaoCloudflareRole, Effect
         return { action: "update" };
       return differences(news, policies, live).length === 0 ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect14.fn(function* ({ news, output }) {
+    reconcile: Effect19.fn(function* ({ fqn, instanceId, news, output }) {
       const path = rolePath(news.mount, news.name);
       yield* guardRename(IDENTITY2, news, output);
       const refusal2 = refusalOf(news);
       if (refusal2 !== undefined) {
-        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
+        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: ${refusal2}.`));
       }
       const policies = yield* resolved(news);
       const live = yield* readCloudflareRole(news.mount, news.name);
+      if (live !== undefined) {
+        yield* refuseTakeover({ fqn, instanceId, output }, `Bao.CloudflareRole ${path}`);
+      }
       if (live === undefined || differences(news, policies, live).length > 0) {
         yield* writeCloudflareRole(news.mount, news.name, writeBody2(news, policies));
       }
       const after = yield* readCloudflareRole(news.mount, news.name);
       if (after === undefined) {
-        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
+        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: the write succeeded but the role is absent.`));
       }
       const left = differences(news, policies, after);
       if (left.length > 0) {
-        return yield* Effect14.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
+        return yield* Effect19.die(new Error(`Bao.CloudflareRole ${path}: wrote cleanly but reads back different in ` + `${left.map((d) => d.field).join(", ")}. Inspect the role before retrying.`));
       }
       return attributesOf4(news, after);
     }),
-    delete: Effect14.fn(function* ({ output }) {
+    delete: Effect19.fn(function* ({ output }) {
       yield* deleteCloudflareRole(output.mount, output.name);
       return;
     })
   });
-}));
+}).pipe(Effect19.map(provingResumes)));
 // src/openbao/cloudflare-roles-expand.ts
 var slug = (name) => trimRuns(name.toLowerCase().replace(/[^a-z0-9]+/g, "-"), "-");
 var zoneSlug = (zone) => `${slug(zone.name)}${zone.internal ? "-internal" : ""}`;
@@ -1565,7 +1788,7 @@ var hostAppRoles = (input) => {
 import { Resource as Resource4 } from "alchemy";
 import { isResolved as isResolved4 } from "alchemy/Diff";
 import * as Provider4 from "alchemy/Provider";
-import * as Effect16 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 
 // src/openbao/jwt-config-form.ts
 var text5 = (value) => typeof value === "string" ? value.trim() : "";
@@ -1655,19 +1878,25 @@ var problems = (props) => {
 };
 
 // src/openbao/role-reconcile.ts
-import * as Effect15 from "effect/Effect";
-var readRoleAt = (spec) => Effect15.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
-var planRole = (spec) => Effect15.gen(function* () {
+import * as Effect20 from "effect/Effect";
+var readRoleAt = (spec) => Effect20.map(baoRead(spec.path), (live) => live === undefined ? undefined : { attributes: spec.attributesOf(live), live });
+var readOwnedRole = (ask, spec) => Effect20.flatMap(readRoleAt(spec), (found) => {
+  const ours = Effect20.sync(() => found !== undefined && spec.problems.length === 0 && spec.matches(found.attributes));
+  return ownedRead(ask, found?.attributes, ours);
+});
+var planRole = (spec) => Effect20.gen(function* () {
   if (spec.problems.length > 0)
     return "update";
   const found = yield* readRoleAt(spec);
   return found !== undefined && spec.matches(found.attributes) ? "noop" : "update";
 });
-var refuse2 = (spec, message) => Effect15.die(new Error(`${spec.family} ${spec.path}: ${message}`));
-var reconcileRole = (spec) => Effect15.gen(function* () {
+var refuse2 = (spec, message) => Effect20.die(new Error(`${spec.family} ${spec.path}: ${message}`));
+var reconcileRole = (spec, claim) => Effect20.gen(function* () {
   if (spec.problems.length > 0)
     return yield* refuse2(spec, spec.problems.join("; "));
   const found = yield* readRoleAt(spec);
+  if (found !== undefined && claim !== undefined)
+    yield* claim(`${spec.family} ${spec.path}`);
   if (found === undefined || !spec.matches(found.attributes)) {
     const lost = found === undefined ? [] : spec.wouldErase?.(found.live) ?? [];
     if (lost.length > 0) {
@@ -1705,13 +1934,12 @@ var jwtConfigSpec = (props) => ({
   problems: problems(props),
   wouldErase
 });
-var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect16.succeed(BaoJwtAuthConfig.Provider.of({
-  list: () => Effect16.succeed([]),
-  read: Effect16.fn(function* ({ olds }) {
-    const found = yield* readRoleAt(jwtConfigSpec(olds));
-    return found?.attributes;
+var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect21.succeed(BaoJwtAuthConfig.Provider.of({
+  list: () => Effect21.succeed([]),
+  read: Effect21.fn(function* ({ fqn, instanceId, olds, output }) {
+    return yield* readOwnedRole({ fqn, instanceId, output }, jwtConfigSpec(olds));
   }),
-  diff: Effect16.fn(function* ({ news, olds, output }) {
+  diff: Effect21.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY3, olds, news, output);
     if (output === undefined)
       return;
@@ -1721,17 +1949,17 @@ var BaoJwtAuthConfigProvider = () => Provider4.effect(BaoJwtAuthConfig, Effect16
       return;
     return { action: yield* planRole(jwtConfigSpec(news)) };
   }),
-  reconcile: Effect16.fn(function* ({ news, output }) {
+  reconcile: Effect21.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY3, news, output);
-    return yield* reconcileRole(jwtConfigSpec(news));
+    return yield* reconcileRole(jwtConfigSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: () => Effect16.void
-})));
+  delete: () => Effect21.void
+})).pipe(Effect21.map(provingResumes)));
 // src/openbao/jwt-role.ts
 import { Resource as Resource5 } from "alchemy";
 import { isResolved as isResolved5 } from "alchemy/Diff";
 import * as Provider5 from "alchemy/Provider";
-import * as Effect17 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 
 // src/openbao/auth-token-form.ts
 var sortedSet2 = (values) => [...new Set(values)].sort();
@@ -1942,13 +2170,12 @@ var jwtRoleSpec = (props) => ({
   path: rolePath2(props),
   problems: problems2(props)
 });
-var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect17.succeed(BaoJwtRole.Provider.of({
-  list: () => Effect17.succeed([]),
-  read: Effect17.fn(function* ({ olds }) {
-    const found = yield* readRoleAt(jwtRoleSpec(olds));
-    return found?.attributes;
+var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect22.succeed(BaoJwtRole.Provider.of({
+  list: () => Effect22.succeed([]),
+  read: Effect22.fn(function* ({ fqn, instanceId, olds, output }) {
+    return yield* readOwnedRole({ fqn, instanceId, output }, jwtRoleSpec(olds));
   }),
-  diff: Effect17.fn(function* ({ news, olds, output }) {
+  diff: Effect22.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY4, olds, news, output);
     if (output === undefined)
       return;
@@ -1958,20 +2185,20 @@ var BaoJwtRoleProvider = () => Provider5.effect(BaoJwtRole, Effect17.succeed(Bao
       return;
     return { action: yield* planRole(jwtRoleSpec(news)) };
   }),
-  reconcile: Effect17.fn(function* ({ news, output }) {
+  reconcile: Effect22.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY4, news, output);
-    return yield* reconcileRole(jwtRoleSpec(news));
+    return yield* reconcileRole(jwtRoleSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect17.fn(function* ({ output }) {
+  delete: Effect22.fn(function* ({ output }) {
     yield* baoDelete(rolePath2(output));
     return;
   })
-})));
+})).pipe(Effect22.map(provingResumes)));
 // src/openbao/kubernetes-role.ts
 import { Resource as Resource6 } from "alchemy";
 import { isResolved as isResolved6 } from "alchemy/Diff";
 import * as Provider6 from "alchemy/Provider";
-import * as Effect18 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 
 // src/openbao/kubernetes-role-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -2049,13 +2276,12 @@ var kubernetesRoleSpec = (props) => ({
   path: rolePath3(props),
   problems: problems3(props)
 });
-var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect18.succeed(BaoKubernetesRole.Provider.of({
-  list: () => Effect18.succeed([]),
-  read: Effect18.fn(function* ({ olds }) {
-    const found = yield* readRoleAt(kubernetesRoleSpec(olds));
-    return found?.attributes;
+var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect23.succeed(BaoKubernetesRole.Provider.of({
+  list: () => Effect23.succeed([]),
+  read: Effect23.fn(function* ({ fqn, instanceId, olds, output }) {
+    return yield* readOwnedRole({ fqn, instanceId, output }, kubernetesRoleSpec(olds));
   }),
-  diff: Effect18.fn(function* ({ news, olds, output }) {
+  diff: Effect23.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY5, olds, news, output);
     if (output === undefined)
       return;
@@ -2065,20 +2291,20 @@ var BaoKubernetesRoleProvider = () => Provider6.effect(BaoKubernetesRole, Effect
       return;
     return { action: yield* planRole(kubernetesRoleSpec(news)) };
   }),
-  reconcile: Effect18.fn(function* ({ news, output }) {
+  reconcile: Effect23.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY5, news, output);
-    return yield* reconcileRole(kubernetesRoleSpec(news));
+    return yield* reconcileRole(kubernetesRoleSpec(news), claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect18.fn(function* ({ output }) {
+  delete: Effect23.fn(function* ({ output }) {
     yield* baoDelete(rolePath3(output));
     return;
   })
-})));
+})).pipe(Effect23.map(provingResumes)));
 // src/openbao/mfa-enforcement.ts
 import { Resource as Resource7 } from "alchemy";
 import { isResolved as isResolved7 } from "alchemy/Diff";
 import * as Provider7 from "alchemy/Provider";
-import * as Effect20 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 
 // src/openbao/mfa-enforcement-form.ts
 var sortedSet5 = (values) => [...new Set(values.map((value) => value.trim()))].filter((value) => value !== "").sort();
@@ -2146,16 +2372,16 @@ var problems4 = (props, missingPaths) => {
 };
 
 // src/openbao/mfa-wire.ts
-import * as Effect19 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 var TOTP_PATH = "identity/mfa/method/totp";
 var METHODS_PATH = "identity/mfa/method";
 var enforcementPath = (name) => `identity/mfa/login-enforcement/${name}`;
 var record4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-var ownNamespacePath = Effect19.gen(function* () {
+var ownNamespacePath = Effect24.gen(function* () {
   const env = yield* BaoEnv;
   return namespacePath(envNamespace(env));
 });
-var findTotp = (name) => Effect19.gen(function* () {
+var findTotp = (name) => Effect24.gen(function* () {
   const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
   const info = record4(listing?.["key_info"]) ?? {};
   const own = yield* ownNamespacePath;
@@ -2164,17 +2390,17 @@ var findTotp = (name) => Effect19.gen(function* () {
     if (live === undefined || live["name"] !== name || live["namespace_path"] !== own)
       continue;
     if (live["type"] !== "totp") {
-      return yield* Effect19.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
+      return yield* Effect24.die(new Error(`Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live["type"])} method ` + `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`));
     }
     return { id, live };
   }
   return;
 });
-var writeTotp = (body) => Effect19.asVoid(baoCall("write", "POST", TOTP_PATH, body));
+var writeTotp = (body) => Effect24.asVoid(baoCall("write", "POST", TOTP_PATH, body));
 var deleteTotp = (id) => baoDelete(`${TOTP_PATH}/${id}`);
 var readEnforcement = (name) => baoRead(enforcementPath(name));
-var writeEnforcement = (name, body) => Effect19.asVoid(baoCall("write", "POST", enforcementPath(name), body));
-var authAccessors = (paths) => Effect19.gen(function* () {
+var writeEnforcement = (name, body) => Effect24.asVoid(baoCall("write", "POST", enforcementPath(name), body));
+var authAccessors = (paths) => Effect24.gen(function* () {
   if (paths.length === 0)
     return { accessors: [], missing: [] };
   const table = (yield* baoRead("sys/auth")) ?? {};
@@ -2195,24 +2421,27 @@ var BaoMfaLoginEnforcement = Resource7("Bao.MfaLoginEnforcement", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY6 = nameIdentity("Bao.MfaLoginEnforcement", enforcementPath);
-var refuse3 = (name, message) => Effect20.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
-var resolveTargets = (props) => Effect20.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
+var refuse3 = (name, message) => Effect25.die(new Error(`Bao.MfaLoginEnforcement ${name}: ${message}`));
+var resolveTargets = (props) => Effect25.map(authAccessors(props.authMethodPaths ?? []), ({ accessors, missing }) => ({
   bad: problems4(props, missing),
   resolved: accessors
 }));
-var readLive = (name) => Effect20.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
-var planEnforcement = (props) => Effect20.gen(function* () {
+var readLive = (name) => Effect25.map(readEnforcement(name), (live) => live === undefined ? undefined : attributesOf8(name, live));
+var planEnforcement = (props) => Effect25.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return "update";
   const live = yield* readLive(props.name);
   return live !== undefined && matches7(live, props, resolved) ? "noop" : "update";
 });
-var reconcileEnforcement = (props) => Effect20.gen(function* () {
+var reconcileEnforcement = (props, claim) => Effect25.gen(function* () {
   const { bad, resolved } = yield* resolveTargets(props);
   if (bad.length > 0)
     return yield* refuse3(props.name, bad.join("; "));
   const live = yield* readLive(props.name);
+  if (live !== undefined && claim !== undefined) {
+    yield* claim(`Bao.MfaLoginEnforcement ${props.name}`);
+  }
   if (live === undefined || !matches7(live, props, resolved)) {
     yield* writeEnforcement(props.name, writeBody6(canonicalFromProps4(props, resolved)));
   }
@@ -2224,12 +2453,14 @@ var reconcileEnforcement = (props) => Effect20.gen(function* () {
   }
   return after;
 });
-var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect20.succeed(BaoMfaLoginEnforcement.Provider.of({
-  list: () => Effect20.succeed([]),
-  read: Effect20.fn(function* ({ olds }) {
-    return yield* readLive(olds.name);
+var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforcement, Effect25.succeed(BaoMfaLoginEnforcement.Provider.of({
+  list: () => Effect25.succeed([]),
+  read: Effect25.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readLive(olds.name);
+    const ours = Effect25.map(planEnforcement(olds), (plan) => plan === "noop");
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect20.fn(function* ({ news, olds, output }) {
+  diff: Effect25.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY6, olds, news, output);
     if (output === undefined)
       return;
@@ -2239,19 +2470,19 @@ var BaoMfaLoginEnforcementProvider = () => Provider7.effect(BaoMfaLoginEnforceme
       return;
     return { action: yield* planEnforcement(news) };
   }),
-  reconcile: Effect20.fn(function* ({ news, output }) {
+  reconcile: Effect25.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY6, news, output);
-    return yield* reconcileEnforcement(news);
+    return yield* reconcileEnforcement(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect20.fn(function* ({ output }) {
+  delete: Effect25.fn(function* ({ output }) {
     return yield* refuse3(output.name, "REFUSING to delete: OpenBao 2.6.2 drops a login enforcement from memory only, and it " + "returns on the next unseal (openbao/openbao#4030). Set this resource back to " + "retain to drop it from state; remove it for good only once the server is fixed.");
   })
-})));
+})).pipe(Effect25.map(provingResumes)));
 // src/openbao/mfa-totp.ts
 import { Resource as Resource8 } from "alchemy";
 import { isResolved as isResolved8 } from "alchemy/Diff";
 import * as Provider8 from "alchemy/Provider";
-import * as Effect21 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 
 // src/openbao/mfa-totp-form.ts
 var canonical6 = (input) => ({
@@ -2332,19 +2563,21 @@ var problems5 = (props) => {
 var BaoMfaTotpMethod = Resource8("Bao.MfaTotpMethod", {
   defaultRemovalPolicy: "retain"
 });
-var refuse4 = (name, message) => Effect21.die(new Error(`Bao.MfaTotpMethod ${name}: ${message}`));
-var readTotp = (props) => Effect21.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
-var planTotp = (props) => Effect21.gen(function* () {
+var refuse4 = (name, message) => Effect26.die(new Error(`Bao.MfaTotpMethod ${name}: ${message}`));
+var readTotp = (props) => Effect26.map(findTotp(props.name), (found) => found === undefined ? undefined : attributesOf9(found.id, found.live));
+var planTotp = (props) => Effect26.gen(function* () {
   if (problems5(props).length > 0)
     return "update";
   const live = yield* readTotp(props);
   return live !== undefined && matches8(live, props) ? "noop" : "update";
 });
-var reconcileTotp = (props) => Effect21.gen(function* () {
+var reconcileTotp = (props, claim) => Effect26.gen(function* () {
   const bad = problems5(props);
   if (bad.length > 0)
     return yield* refuse4(props.name, bad.join("; "));
   const live = yield* readTotp(props);
+  if (live !== undefined && claim !== undefined)
+    yield* claim(`Bao.MfaTotpMethod ${props.name}`);
   if (live === undefined || !matches8(live, props))
     yield* writeTotp(writeBody7(props));
   const after = yield* readTotp(props);
@@ -2354,55 +2587,59 @@ var reconcileTotp = (props) => Effect21.gen(function* () {
     return yield* refuse4(props.name, "the method read back different.");
   return after;
 });
-var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect21.succeed(BaoMfaTotpMethod.Provider.of({
-  list: () => Effect21.succeed([]),
-  read: Effect21.fn(function* ({ olds }) {
-    return yield* readTotp(olds);
+var BaoMfaTotpMethodProvider = () => Provider8.effect(BaoMfaTotpMethod, Effect26.succeed(BaoMfaTotpMethod.Provider.of({
+  list: () => Effect26.succeed([]),
+  read: Effect26.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readTotp(olds);
+    const ours = Effect26.sync(() => found !== undefined && problems5(olds).length === 0 && matches8(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect21.fn(function* ({ news, output }) {
+  diff: Effect26.fn(function* ({ news, output }) {
     const name = declaredString(news, "name");
     if (output !== undefined && name !== undefined) {
       const rename = renameProblem(output.name, name);
       if (rename !== undefined)
         return yield* refuse4(name, rename);
     }
-    if (output === undefined || !isResolved8(news))
+    if (output === undefined)
+      return;
+    if (!isResolved8(news))
       return;
     return { action: yield* planTotp(news) };
   }),
-  reconcile: Effect21.fn(function* ({ news, output }) {
+  reconcile: Effect26.fn(function* ({ fqn, instanceId, news, output }) {
     const rename = output === undefined ? undefined : renameProblem(output.name, news.name);
     if (rename !== undefined)
       return yield* refuse4(news.name, rename);
-    return yield* reconcileTotp(news);
+    return yield* reconcileTotp(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect21.fn(function* ({ output }) {
+  delete: Effect26.fn(function* ({ output }) {
     yield* deleteTotp(output.methodId);
     return;
   })
-})));
+})).pipe(Effect26.map(provingResumes)));
 // src/openbao/mount.ts
 import { Resource as Resource9 } from "alchemy";
 import { isResolved as isResolved9 } from "alchemy/Diff";
 import * as Provider9 from "alchemy/Provider";
-import * as Effect24 from "effect/Effect";
+import * as Effect29 from "effect/Effect";
 
 // src/openbao/mount-reconcile.ts
-import * as Effect23 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 
 // src/openbao/mount-wire.ts
-import * as Effect22 from "effect/Effect";
-var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect22.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
+import * as Effect27 from "effect/Effect";
+var absentFromTable2 = (path, asked) => baoRead("sys/mounts").pipe(Effect27.mapError((listing) => new BaoError(asked.status, asked.method, asked.path, [
   ...asked.errors,
   `sys/mounts could not confirm the mount is absent: ${listing.message}`
-])), Effect22.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect22.succeed(undefined) : Effect22.fail(asked)));
-var readMountData = (path) => baoRead(readPath(path)).pipe(Effect22.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
+])), Effect27.flatMap((table) => table !== undefined && !Object.hasOwn(table, `${mountPath(path)}/`) ? Effect27.succeed(undefined) : Effect27.fail(asked)));
+var readMountData = (path) => baoRead(readPath(path)).pipe(Effect27.catchIf((error) => error.status === 400, (error) => absentFromTable2(path, error)));
 var enableMount = (props) => baoWrite("POST", readPath(props.path), enableBody(props));
 var tuneMount = (props) => baoWrite("POST", tunePath(props.path), tuneBody(props));
 var disableMount = (path) => baoDelete(readPath(path));
 
 // src/openbao/mount-reconcile.ts
-var readMount = (props) => Effect23.gen(function* () {
+var readMount = (props) => Effect28.gen(function* () {
   const live = yield* readMountData(props.path);
   if (live === undefined)
     return;
@@ -2415,10 +2652,16 @@ var moveTarget2 = (props) => ({
   type: props.type,
   wire: mountPath
 });
-var reconcileMount = (news, stated, options) => Effect23.gen(function* () {
+var reconcileMount = (news, stated, options, claim) => Effect28.gen(function* () {
   const move = planMove("Bao.Mount", stated, news.path, news.remountFrom);
   if (move.kind === "refuse")
-    return yield* Effect23.die(new Error(move.message));
+    return yield* Effect28.die(new Error(move.message));
+  const first = stated === undefined ? claim : undefined;
+  if (first !== undefined && move.kind === "move") {
+    const source = yield* readMount({ ...news, path: move.from });
+    if (source !== undefined)
+      yield* first(`Bao.Mount ${move.from} (the remountFrom source)`);
+  }
   if (move.kind === "move")
     yield* performMove(moveTarget2(news), move.from, options);
   let live = yield* readMount(news);
@@ -2426,15 +2669,18 @@ var reconcileMount = (news, stated, options) => Effect23.gen(function* () {
     yield* enableMount(news);
     if (wantsTune(news))
       yield* tuneMount(news);
-  } else if (!matches(live, news)) {
+  } else {
     if (live.type !== news.type) {
-      return yield* Effect23.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
+      return yield* Effect28.die(new Error(`Bao.Mount ${mountPath(news.path)}: live type ${live.type} != ${news.type}. ` + "Secrets engine type is immutable — replace manually."));
     }
-    yield* tuneMount(news);
+    if (first !== undefined)
+      yield* first(`Bao.Mount ${mountPath(news.path)}`);
+    if (!matches(live, news))
+      yield* tuneMount(news);
   }
   live = yield* readMount(news);
   if (live === undefined) {
-    return yield* Effect23.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
+    return yield* Effect28.die(new Error(`Bao.Mount ${mountPath(news.path)}: write returned no error but the mount is still absent.`));
   }
   return live;
 });
@@ -2443,17 +2689,21 @@ var reconcileMount = (news, stated, options) => Effect23.gen(function* () {
 var BaoMount = Resource9("Bao.Mount", {
   defaultRemovalPolicy: "retain"
 });
-var BaoMountProvider = () => Provider9.effect(BaoMount, Effect24.succeed(BaoMount.Provider.of({
-  list: () => Effect24.succeed([]),
-  read: Effect24.fn(function* ({ olds }) {
-    return yield* readMount(olds);
+var BaoMountProvider = () => Provider9.effect(BaoMount, Effect29.succeed(BaoMount.Provider.of({
+  list: () => Effect29.succeed([]),
+  read: Effect29.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readMount(olds);
+    const ours = Effect29.sync(() => found !== undefined && matches(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect24.fn(function* ({ news, output }) {
-    if (output === undefined || !isResolved9(news))
+  diff: Effect29.fn(function* ({ news, output }) {
+    if (output === undefined)
+      return;
+    if (!isResolved9(news))
       return;
     const move = planMove("Bao.Mount", output.path, news.path, news.remountFrom);
     if (move.kind === "refuse")
-      return yield* Effect24.die(new Error(move.message));
+      return yield* Effect29.die(new Error(move.message));
     if (move.kind === "move")
       return { action: "update" };
     const live = yield* readMount(news);
@@ -2465,19 +2715,20 @@ var BaoMountProvider = () => Provider9.effect(BaoMount, Effect24.succeed(BaoMoun
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect24.fn(function* ({ news, output }) {
-    return yield* reconcileMount(news, output?.path);
+  reconcile: Effect29.fn(function* ({ fqn, instanceId, news, output }) {
+    const claim = claimFor({ fqn, instanceId, output });
+    return yield* reconcileMount(news, output?.path, undefined, claim);
   }),
-  delete: Effect24.fn(function* ({ output }) {
+  delete: Effect29.fn(function* ({ output }) {
     yield* disableMount(output.path);
     return;
   })
-})));
+})).pipe(Effect29.map(provingResumes)));
 // src/openbao/pki-role.ts
 import { Resource as Resource10 } from "alchemy";
 import { isResolved as isResolved10 } from "alchemy/Diff";
 import * as Provider10 from "alchemy/Provider";
-import * as Effect25 from "effect/Effect";
+import * as Effect30 from "effect/Effect";
 
 // src/openbao/pki-role-canonical.ts
 var DEFAULT_KEY_USAGE = [
@@ -2644,18 +2895,20 @@ var BaoPkiRole = Resource10("Bao.PkiRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY7 = roleIdentity("Bao.PkiRole", (mount, name) => rolePath4({ mount, name }), "pki");
-var readRole2 = (props) => Effect25.gen(function* () {
+var readRole2 = (props) => Effect30.gen(function* () {
   const live = yield* baoRead(rolePath4(props));
   if (live === undefined)
     return;
   return attributesOf10(props, live);
 });
-var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect25.succeed(BaoPkiRole.Provider.of({
-  list: () => Effect25.succeed([]),
-  read: Effect25.fn(function* ({ olds }) {
-    return yield* readRole2(olds);
+var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect30.succeed(BaoPkiRole.Provider.of({
+  list: () => Effect30.succeed([]),
+  read: Effect30.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readRole2(olds);
+    const ours = Effect30.sync(() => found !== undefined && problems6(olds).length === 0 && matches9(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect25.fn(function* ({ news, olds, output }) {
+  diff: Effect30.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY7, olds, news, output);
     if (output === undefined)
       return;
@@ -2670,36 +2923,38 @@ var BaoPkiRoleProvider = () => Provider10.effect(BaoPkiRole, Effect25.succeed(Ba
       return { action: "update" };
     return matches9(live, news) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect25.fn(function* ({ news, output }) {
+  reconcile: Effect30.fn(function* ({ fqn, instanceId, news, output }) {
     const path = rolePath4(news);
     yield* guardRename(IDENTITY7, news, output);
     const bad = problems6(news);
     if (bad.length > 0) {
-      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
+      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: ${bad.join(" ")}`));
     }
     const live = yield* readRole2(news);
+    if (live !== undefined)
+      yield* refuseTakeover({ fqn, instanceId, output }, `Bao.PkiRole ${path}`);
     if (live === undefined || !matches9(live, news)) {
       yield* baoWrite("PUT", path, writeBody8(news));
     }
     const after = yield* readRole2(news);
     if (after === undefined) {
-      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
+      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: write reported success but the role is absent.`));
     }
     if (!matches9(after, news)) {
-      return yield* Effect25.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
+      return yield* Effect30.die(new Error(`Bao.PkiRole ${path}: wrote cleanly but the role read back different. ` + "OpenBao stored something other than what was declared — inspect with " + `\`bao read ${path}\` before retrying.`));
     }
     return after;
   }),
-  delete: Effect25.fn(function* ({ output }) {
+  delete: Effect30.fn(function* ({ output }) {
     yield* baoDelete(rolePath4(output));
     return;
   })
-})));
+})).pipe(Effect30.map(provingResumes)));
 // src/openbao/plugin.ts
 import { Resource as Resource11 } from "alchemy";
 import { isResolved as isResolved11 } from "alchemy/Diff";
 import * as Provider11 from "alchemy/Provider";
-import * as Effect27 from "effect/Effect";
+import * as Effect32 from "effect/Effect";
 
 // src/openbao/plugin-form.ts
 var resolve = (props) => ({
@@ -2755,7 +3010,7 @@ var sameArgs = (want, have) => want.length === have.length && want.every((entry,
 var matches10 = (attributes, form) => !attributes.builtin && attributes.version === form.version && attributes.sha256 === form.sha256 && attributes.command === form.command && sameArgs(form.args, attributes.args);
 
 // src/openbao/plugin-reconcile.ts
-import * as Effect26 from "effect/Effect";
+import * as Effect31 from "effect/Effect";
 
 // src/openbao/plugin-wire.ts
 var readPluginData = (form) => baoRead(versionedPath(form.type, form.name, form.version));
@@ -2763,15 +3018,18 @@ var registerPlugin = (form) => baoWrite("PUT", catalogPath(form.type, form.name)
 var deregisterPlugin = (type, name, version) => baoDelete(versionedPath(type, name, version));
 
 // src/openbao/plugin-reconcile.ts
-var readEntry = (form) => Effect26.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
-var refuse5 = (form, message) => Effect26.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
-var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports; that adopts the entry this write just made.";
-var reconcilePlugin = (props) => Effect26.gen(function* () {
+var readEntry = (form) => Effect31.map(readPluginData(form), (live) => live === undefined ? undefined : { attributes: attributesOf11(form, live), live });
+var refuse5 = (form, message) => Effect31.die(new Error(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}: ${message}`));
+var SELF_REPORTED = "the write succeeded but the read-back does not match. If the binary reports its own version, " + "OpenBao filed the registration under it (plugin_catalog.go setInternal) — declare `version` " + "as exactly the version the binary reports, and deploy once with --adopt: that adopts the " + "entry this write just made.";
+var reconcilePlugin = (props, claim) => Effect31.gen(function* () {
   const form = resolve(props);
   const bad = problems7(form);
   if (bad.length > 0)
     return yield* refuse5(form, bad.join("; "));
   const found = yield* readEntry(form);
+  if (found !== undefined && claim !== undefined) {
+    yield* claim(`Bao.Plugin ${versionedPath(form.type, form.name, form.version)}`);
+  }
   if (found !== undefined && !matches10(found.attributes, form)) {
     if (found.live["declarative"] === true || found.live["oci"] === true) {
       return yield* refuse5(form, "the live entry is declarative/OCI; manage it in server config.");
@@ -2805,13 +3063,15 @@ var IDENTITY8 = {
   family: "Bao.Plugin",
   recorded: (output) => versionedPath(output.type, output.name, output.version)
 };
-var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect27.succeed(BaoPlugin.Provider.of({
-  list: () => Effect27.succeed([]),
-  read: Effect27.fn(function* ({ olds }) {
-    const found = yield* readEntry(resolve(olds));
-    return found?.attributes;
+var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect32.succeed(BaoPlugin.Provider.of({
+  list: () => Effect32.succeed([]),
+  read: Effect32.fn(function* ({ fqn, instanceId, olds, output }) {
+    const form = resolve(olds);
+    const found = yield* readEntry(form);
+    const ours = Effect32.sync(() => found !== undefined && problems7(form).length === 0 && matches10(found.attributes, form));
+    return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
   }),
-  diff: Effect27.fn(function* ({ news, olds, output }) {
+  diff: Effect32.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY8, olds, news, output);
     if (output === undefined)
       return;
@@ -2825,20 +3085,20 @@ var BaoPluginProvider = () => Provider11.effect(BaoPlugin, Effect27.succeed(BaoP
       return { action: "update" };
     return matches10(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect27.fn(function* ({ news, output }) {
+  reconcile: Effect32.fn(function* ({ fqn, instanceId, news, output }) {
     yield* guardRename(IDENTITY8, news, output);
-    return yield* reconcilePlugin(news);
+    return yield* reconcilePlugin(news, claimFor({ fqn, instanceId, output }));
   }),
-  delete: Effect27.fn(function* ({ output }) {
+  delete: Effect32.fn(function* ({ output }) {
     yield* deregisterPlugin(output.type, output.name, output.version);
     return;
   })
-})));
+})).pipe(Effect32.map(provingResumes)));
 // src/openbao/policy.ts
 import { Resource as Resource12 } from "alchemy";
 import { isResolved as isResolved12 } from "alchemy/Diff";
 import * as Provider12 from "alchemy/Provider";
-import * as Effect29 from "effect/Effect";
+import * as Effect34 from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 
@@ -2846,13 +3106,13 @@ import * as Path from "effect/Path";
 var isEmptyAssembly = (parts, joined) => parts === 0 || !/^\s*path\s+"/m.test(joined);
 
 // src/openbao/policy-wire.ts
-import * as Effect28 from "effect/Effect";
+import * as Effect33 from "effect/Effect";
 var policyPath = (name) => `sys/policies/acl/${name}`;
-var readPolicy = (name) => Effect28.flatMap(baoRead(policyPath(name)), (data) => {
+var readPolicy = (name) => Effect33.flatMap(baoRead(policyPath(name)), (data) => {
   if (data === undefined)
-    return Effect28.succeed("");
+    return Effect33.succeed("");
   const text11 = data["policy"];
-  return typeof text11 === "string" ? Effect28.succeed(text11) : Effect28.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
+  return typeof text11 === "string" ? Effect33.succeed(text11) : Effect33.fail(new BaoError(200, "GET", policyPath(name), ["no data.policy in the response"]));
 });
 var writePolicy = (name, hcl) => baoWrite("PUT", policyPath(name), { policy: hcl });
 var deletePolicy = (name) => baoDelete(policyPath(name));
@@ -2869,10 +3129,10 @@ var attributesOf12 = (name, hcl, parts) => ({
   grants: grantsOf(hcl),
   parts
 });
-var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect29.gen(function* () {
+var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect34.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const assemble = (dir) => Effect29.gen(function* () {
+  const assemble = (dir) => Effect34.gen(function* () {
     const entries2 = (yield* fs.readDirectory(dir)).filter((f) => f.endsWith(".hcl")).sort();
     let joined = "";
     for (const f of entries2)
@@ -2881,12 +3141,14 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect29.gen(function
     return { joined, parts: entries2.length };
   });
   return BaoPolicy.Provider.of({
-    list: () => Effect29.succeed([]),
-    read: Effect29.fn(function* ({ olds }) {
+    list: () => Effect34.succeed([]),
+    read: Effect34.fn(function* ({ fqn, instanceId, olds, output }) {
       const live = yield* readPolicy(olds.name);
-      return live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
+      const found = live.length === 0 ? undefined : attributesOf12(olds.name, live, 0);
+      const ours = Effect34.map(assemble(olds.fragments), (a) => sha256(a.joined) === found?.digest);
+      return yield* ownedRead({ fqn, instanceId, output }, found, ours);
     }),
-    diff: Effect29.fn(function* ({ news, olds, output }) {
+    diff: Effect34.fn(function* ({ news, olds, output }) {
       const move = yield* judgeRename(IDENTITY9, olds, news, output);
       if (output === undefined)
         return;
@@ -2898,30 +3160,32 @@ var BaoPolicyProvider = () => Provider12.effect(BaoPolicy, Effect29.gen(function
       const live = yield* readPolicy(news.name);
       return live.length > 0 && sha256(live) === sha256(joined) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: Effect29.fn(function* ({ news, output }) {
+    reconcile: Effect34.fn(function* ({ fqn, instanceId, news, output }) {
       const name = news.name;
       yield* guardRename(IDENTITY9, news, output);
       const { joined, parts } = yield* assemble(news.fragments);
       if (isEmptyAssembly(parts, joined))
-        return yield* Effect29.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
+        return yield* Effect34.die(new Error(`Bao.Policy ${name}: the fragments under ${news.fragments} carry no path grant ` + `(${String(parts)} file(s)). Writing it would revoke every grant the policy carries.`));
       const current = yield* readPolicy(name);
+      if (current.length > 0)
+        yield* refuseTakeover({ fqn, instanceId, output }, `Bao.Policy ${name}`);
       if (current.length > 0 && sha256(current) === sha256(joined)) {
         return attributesOf12(name, joined, parts);
       }
       yield* writePolicy(name, joined);
       return attributesOf12(name, joined, parts);
     }),
-    delete: Effect29.fn(function* ({ output }) {
+    delete: Effect34.fn(function* ({ output }) {
       yield* deletePolicy(output.name);
       return;
     })
   });
-}));
+}).pipe(Effect34.map(provingResumes)));
 // src/openbao/proxmox-role.ts
 import { Resource as Resource13 } from "alchemy";
 import { isResolved as isResolved13 } from "alchemy/Diff";
 import * as Provider13 from "alchemy/Provider";
-import * as Effect31 from "effect/Effect";
+import * as Effect36 from "effect/Effect";
 
 // src/openbao/proxmox-role-form.ts
 var text11 = (value) => typeof value === "string" ? value : "";
@@ -2971,8 +3235,8 @@ var rescopeRefusal = (before, mintUser, allowMintUserChange) => before === mintU
 var matches11 = (attributes, props) => attributes.mintUser === props.mintUser && sameTtl5(props.ttl, attributes.ttl) && sameTtl5(props.maxTtl, attributes.maxTtl);
 
 // src/openbao/proxmox-role-wire.ts
-import * as Effect30 from "effect/Effect";
-var readRole3 = (props) => Effect30.gen(function* () {
+import * as Effect35 from "effect/Effect";
+var readRole3 = (props) => Effect35.gen(function* () {
   const live = yield* baoRead(rolePath5(props.mount, props.name));
   if (live === undefined)
     return;
@@ -2984,12 +3248,14 @@ var BaoProxmoxRole = Resource13("Bao.ProxmoxRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY10 = roleIdentity("Bao.ProxmoxRole", rolePath5);
-var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect31.succeed(BaoProxmoxRole.Provider.of({
-  list: () => Effect31.succeed([]),
-  read: Effect31.fn(function* ({ olds }) {
-    return yield* readRole3(olds);
+var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect36.succeed(BaoProxmoxRole.Provider.of({
+  list: () => Effect36.succeed([]),
+  read: Effect36.fn(function* ({ fqn, instanceId, olds, output }) {
+    const found = yield* readRole3(olds);
+    const ours = Effect36.sync(() => found !== undefined && matches11(found, olds));
+    return yield* ownedRead({ fqn, instanceId, output }, found, ours);
   }),
-  diff: Effect31.fn(function* ({ news, olds, output }) {
+  diff: Effect36.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY10, olds, news, output);
     if (output === undefined)
       return;
@@ -3002,7 +3268,7 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect31.su
       const refusal2 = rescopeRefusal(from, mintUser, allow);
       if (refusal2 === undefined)
         return { action: "replace" };
-      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
+      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${move.from} → ${move.to}: the rename ${refusal2}`));
     }
     if (!isResolved13(news))
       return;
@@ -3013,37 +3279,39 @@ var BaoProxmoxRoleProvider = () => Provider13.effect(BaoProxmoxRole, Effect31.su
       return { action: "noop" };
     return { action: "update" };
   }),
-  reconcile: Effect31.fn(function* ({ news, output }) {
+  reconcile: Effect36.fn(function* ({ fqn, instanceId, news, output }) {
     const path = rolePath5(news.mount, news.name);
     yield* guardRename(IDENTITY10, news, output);
     const live = yield* readRole3(news);
+    if (live !== undefined)
+      yield* refuseTakeover({ fqn, instanceId, output }, `Bao.ProxmoxRole ${path}`);
     const rescope = live === undefined ? undefined : rescopeRefusal(live.mintUser, news.mintUser, news.allowMintUserChange);
     if (rescope !== undefined) {
-      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
+      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: ${rescope}`));
     }
     if (live === undefined || !matches11(live, news)) {
       const write = writeBody9(news);
       if (!write.ok) {
-        return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
+        return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: unparseable duration ` + `${write.bad.join(", ")}. Use 30s / 5m / 1h / 1d, or 0.`));
       }
       yield* baoWrite("PUT", path, write.body);
     }
     const after = yield* readRole3(news);
     if (after === undefined) {
-      return yield* Effect31.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
+      return yield* Effect36.die(new Error(`Bao.ProxmoxRole ${path}: write returned no error ` + "but the role is still absent."));
     }
     return after;
   }),
-  delete: Effect31.fn(function* ({ output }) {
+  delete: Effect36.fn(function* ({ output }) {
     yield* baoDelete(rolePath5(output.mount, output.name));
     return;
   })
-})));
+})).pipe(Effect36.map(provingResumes)));
 // src/openbao/ssh-role.ts
 import { Resource as Resource14 } from "alchemy";
 import { isResolved as isResolved14 } from "alchemy/Diff";
 import * as Provider14 from "alchemy/Provider";
-import * as Effect32 from "effect/Effect";
+import * as Effect37 from "effect/Effect";
 
 // src/openbao/ssh-role-form.ts
 var readPath4 = (mount, name) => `${sshMountOf(mount)}/roles/${name}`;
@@ -3104,7 +3372,7 @@ var attributesOf14 = (form, live) => {
   };
   return { ...attrs, digest: sha256(JSON.stringify(attrs)) };
 };
-var mapValue = (map10) => extMap(map10);
+var mapValue = (map23) => extMap(map23);
 var writeBody10 = (form) => ({
   key_type: "ca",
   allowed_users: form.allowedUsers.join(","),
@@ -3158,20 +3426,21 @@ var BaoSshRole = Resource14("Bao.SshRole", {
   defaultRemovalPolicy: "retain"
 });
 var IDENTITY11 = roleIdentity("Bao.SshRole", readPath4, "ssh");
-var readRole4 = (form) => Effect32.gen(function* () {
+var readRole4 = (form) => Effect37.gen(function* () {
   const live = yield* baoRead(readPath4(form.mount, form.name));
   if (live === undefined)
     return;
   return { attributes: attributesOf14(form, live), live };
 });
-var refuse6 = (message) => Effect32.die(new Error(message));
-var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect32.succeed(BaoSshRole.Provider.of({
-  list: () => Effect32.succeed([]),
-  read: Effect32.fn(function* ({ olds }) {
+var refuse6 = (message) => Effect37.die(new Error(message));
+var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect37.succeed(BaoSshRole.Provider.of({
+  list: () => Effect37.succeed([]),
+  read: Effect37.fn(function* ({ fqn, instanceId, olds, output }) {
     const found = yield* readRole4(resolve2(olds));
-    return found?.attributes;
+    const ours = Effect37.sync(() => found !== undefined && matches12(found.attributes, resolve2(olds)));
+    return yield* ownedRead({ fqn, instanceId, output }, found?.attributes, ours);
   }),
-  diff: Effect32.fn(function* ({ news, olds, output }) {
+  diff: Effect37.fn(function* ({ news, olds, output }) {
     const move = yield* judgeRename(IDENTITY11, olds, news, output);
     if (output === undefined)
       return;
@@ -3185,7 +3454,7 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect32.succeed(Ba
       return { action: "update" };
     return matches12(found.attributes, form) ? { action: "noop" } : { action: "update" };
   }),
-  reconcile: Effect32.fn(function* ({ news, output }) {
+  reconcile: Effect37.fn(function* ({ fqn, instanceId, news, output }) {
     const form = resolve2(news);
     const path = readPath4(form.mount, form.name);
     yield* guardRename(IDENTITY11, news, output);
@@ -3197,6 +3466,8 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect32.succeed(Ba
       return yield* refuse6(`Bao.SshRole ${path}: allowUserCertificates with an empty allowedUsers and ` + "allowEmptyPrincipals false. Every sign request against it would be rejected.");
     }
     const found = yield* readRole4(form);
+    if (found !== undefined)
+      yield* refuseTakeover({ fqn, instanceId, output }, `Bao.SshRole ${path}`);
     if (found === undefined || !matches12(found.attributes, form)) {
       if (found !== undefined) {
         const lost = wouldErase2(found.live);
@@ -3212,11 +3483,11 @@ var BaoSshRoleProvider = () => Provider14.effect(BaoSshRole, Effect32.succeed(Ba
     }
     return after.attributes;
   }),
-  delete: Effect32.fn(function* ({ output }) {
+  delete: Effect37.fn(function* ({ output }) {
     yield* baoDelete(readPath4(output.mount, output.name));
     return;
   })
-})));
+})).pipe(Effect37.map(provingResumes)));
 export {
   BaoAuthMethod,
   BaoAuthMethodProvider,
@@ -3266,5 +3537,5 @@ export {
   revokeSelfEffect
 };
 
-//# debugId=B83B2582FB998CE264756E2164756E21
+//# debugId=9AA407497A9014D964756E2164756E21
 //# sourceMappingURL=index.js.map