@homeflare/alchemy 0.8.0 → 0.10.1

package/src/launchd/sudo-modes.test.ts

@@ -0,0 +1,135 @@
+/**
+ * sudoRunner's 2026-09-21 refusals, over the fake host (fake-sudo.ts): no group/world-writable,
+ * setuid or setgid root-owned file under a prefix, and no directory from the prefix down that root
+ * does not own alone. Each is refused before anything is staged or run as root — and, through
+ * `checkWrite`, at PLAN time, still without sudo.
+ */
+import { describe, expect, test } from 'bun:test';
+import { OPERATOR, fakeSudoHost } from './fake-sudo.ts';
+import { diffFile, reconcileFile } from './host-file-lifecycle.ts';
+import type { LaunchdJobProps } from './job-form.ts';
+import { diffJob, reconcileJob } from './job-lifecycle.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+import { modeProblem } from './sudo-guard.ts';
+
+const CONF = '/opt/example/app/a.conf';
+const bytes = (text: string) => new TextEncoder().encode(text);
+type Host = ReturnType<typeof fakeSudoHost>;
+const dir = (mode: number, uid = 0) => ({
+  bytes: bytes(''),
+  gid: 0,
+  kind: 'directory' as const,
+  mode,
+  uid,
+});
+
+describe('modeProblem', () => {
+  test.each([
+    ['0644 root', { mode: 0o644, uid: 0 }, undefined],
+    ['0755 with the owner omitted (root under a prefix)', { mode: 0o755 }, undefined],
+    ['0640 root', { mode: 0o640, uid: 0 }, undefined],
+    ['sticky 1755 changes nothing on a file', { mode: 0o1755 }, undefined],
+    ['0664 root is group-writable', { mode: 0o664 }, 'writable by group or other'],
+    ['0646 root is world-writable', { mode: 0o646, uid: 0 }, 'writable by group or other'],
+    ['4755 root is setuid', { mode: 0o4755 }, 'setuid/setgid'],
+    ['2755 root is setgid', { mode: 0o2755, uid: 0 }, 'setuid/setgid'],
+    ['6777 root is both', { mode: 0o6777 }, 'setuid/setgid and writable by group or other'],
+    ['0664 handed to another user is theirs to change', { mode: 0o664, uid: OPERATOR }, undefined],
+  ] as const)('%s', (_name, options, found) => {
+    const problem = modeProblem(options);
+    if (found === undefined) expect(problem).toBeUndefined();
+    else expect(problem).toContain(found);
+  });
+});
+
+describe('a root-owned install under a prefix', () => {
+  test.each([0o664, 0o646, 0o4755, 0o2755])(
+    'mode %o is refused before staging or sudo',
+    async (mode) => {
+      const host = fakeSudoHost();
+      const write = host.runner.writeFileAtomic(CONF, bytes('x'), { mode });
+      await expect(write).rejects.toBeInstanceOf(SudoRefusedError);
+      await expect(write).rejects.toThrow('on a root-owned file');
+      expect(host.state.stagedCount).toBe(0);
+      expect(host.sudoCalls).toEqual([]);
+    },
+  );
+
+  test('an omitted-owner 0644 still installs, as root', async () => {
+    const host = fakeSudoHost();
+    await host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o644 });
+    expect(host.fake.files.get(CONF)).toMatchObject({ mode: 0o644, uid: 0 });
+  });
+});
+
+describe('every directory from the prefix down to the file', () => {
+  const below: [string, (h: Host) => void, string][] = [
+    ['owned by the operator', (h) => h.fake.dirs.set('/opt/example/app', OPERATOR), 'uid 501'],
+    ['group-writable', (h) => h.fake.files.set('/opt/example/app', dir(0o775)), '0775'],
+    ['world-writable', (h) => h.fake.files.set('/opt/example/app', dir(0o757)), '0757'],
+  ];
+
+  test.each(below)('%s is refused for a write, before staging or sudo', async (_n, setup, says) => {
+    const host = fakeSudoHost();
+    setup(host);
+    const write = host.runner.writeFileAtomic(CONF, bytes('x'), { mode: 0o644 });
+    await expect(write).rejects.toBeInstanceOf(SudoRefusedError);
+    await expect(write).rejects.toThrow(
+      /\/opt\/example\/app is .*(uid 501|0775|0757).*Every directory from the prefix/s,
+    );
+    await expect(write).rejects.toThrow(says);
+    expect(host.state.stagedCount).toBe(0);
+    expect(host.sudoCalls).toEqual([]);
+  });
+
+  test.each(below)('%s is refused for a remove too', async (_n, setup, says) => {
+    const host = fakeSudoHost();
+    host.fake.files.set(CONF, { ...dir(0o644), kind: 'file' });
+    setup(host);
+    await expect(host.runner.removeFile(CONF)).rejects.toThrow(says);
+    expect(host.sudoCalls).toEqual([]);
+  });
+});
+
+describe('at plan time, through checkWrite — reads only, never sudo', () => {
+  test('HostFile: a diff that would write a setuid root file fails the plan', async () => {
+    const host = fakeSudoHost();
+    const output = await reconcileFile(host.runner, { content: 'x', mode: 0o755, path: CONF });
+    const before = host.sudoCalls.length;
+    const plan = diffFile(host.runner, { content: 'x', mode: 0o4755, path: CONF }, output);
+    await expect(plan).rejects.toThrow('setuid/setgid');
+    expect(host.sudoCalls).toHaveLength(before);
+    // ★ A converged file plans noop and asks nothing, so an unrelated plan is never blocked by it.
+    expect(await diffFile(host.runner, { content: 'x', mode: 0o755, path: CONF }, output)).toEqual({
+      action: 'noop',
+    });
+  });
+
+  test('HostFile: a new path under a directory another user may write fails the plan', async () => {
+    const host = fakeSudoHost();
+    const output = await reconcileFile(host.runner, { content: 'x', path: CONF });
+    host.fake.dirs.set('/opt/example/other', OPERATOR);
+    const moved = { content: 'x', path: '/opt/example/other/a.conf' };
+    await expect(diffFile(host.runner, moved, output)).rejects.toThrow('uid 501');
+  });
+
+  test.each([
+    ['an update', { runAtLoad: true }],
+    ['a rename (the delete-first replace)', { label: 'com.example.renamed' }],
+  ] as const)(
+    'LaunchdJob: %s into a group-writable LaunchDaemons fails the plan',
+    async (_n, change) => {
+      const job: LaunchdJobProps = {
+        domain: 'system',
+        label: 'com.example.job',
+        programArguments: ['/usr/local/bin/job'],
+      };
+      const host = fakeSudoHost();
+      const attrs = await reconcileJob(host.runner, job, undefined);
+      host.fake.files.set('/Library/LaunchDaemons', dir(0o775));
+      const before = host.sudoCalls.length;
+      await expect(diffJob(host.runner, { ...job, ...change }, attrs)).rejects.toThrow('0775');
+      expect(host.sudoCalls).toHaveLength(before);
+    },
+  );
+});

package/src/launchd/sudo-runner.ts

@@ -21,12 +21,12 @@
  * ★ `install -S`: install(1) on macOS 27.2 (read 2026-09-21) always writes a temp file in the
  *   target directory and renames it, so the file is never torn, and -S adds the fsync that
  *   localRunner's `handle.sync()` does.
- * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow
- *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 ("a password is required": -n was given but a
- *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text (sudo-said.ts has the strings and their sources).
+ * ⛔ EVERY CHECK BEFORE SUDO ALSO RUNS AT PLAN TIME (`checkWrite`, 2026-09-21): the mode, the
+ *   directories from the prefix down, the read-back. Reads only, as the operator — never sudo.
  */
-import { type LocalRunnerOptions, errnoCode, localRunner } from './local-runner.ts';
-import type { ExecResult, HostRunner } from './runner.ts';
+import { type LocalRunnerOptions, localRunner } from './local-runner.ts';
+import type { ExecResult, HostRunner, WriteOptions } from './runner.ts';
 import {
   INSTALL,
   RM,
@@ -38,7 +38,8 @@ import {
   privilegedProblem,
   routeExec,
 } from './sudo-allowlist.ts';
-import { assertPlainPath, assertReadableBack, operatorGroups } from './sudo-guard.ts';
+import { assertInstallable, assertPlainPath, operatorGroups } from './sudo-guard.ts';
+import { sudoRefusal, undeclared } from './sudo-said.ts';
 import { type Staged, stageFile } from './sudo-stage.ts';
 
 export { SudoRefusedError };
@@ -66,31 +67,6 @@ export type SudoDeps = {
   readonly log: (line: string) => void;
 };
 
-/**
- * ⚠️ ANCHORED TO sudo'S OWN MESSAGE FORMS (`sudo: …` lines, `Sorry, user …`), so a launchctl or
- *   install error that happens to say "not allowed" is never reported as "the command did not run".
- *   The refusals are the three a sudoers denial prints: the command not allowed, the user not in
- *   sudoers, and the user not allowed on this host (`<user> is not allowed to run sudo on <host>.`).
- *   REASONED from sudo 1.9's sudoers plugin, like the rest (header).
- */
-const PASSWORD =
-  /^sudo: (?:a password is required|a terminal is required|sorry, you must have a tty)/m;
-const NOT_ALLOWED =
-  /^(?:Sorry, user \S+ (?:is not allowed to execute|may not run sudo)|\S+ is not (?:in the sudoers file|allowed to run sudo on ))/m;
-
-/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */
-const undeclared =
-  (path: string, prefixes: readonly string[]) =>
-  (cause: unknown): never => {
-    const code = errnoCode(cause);
-    if (code !== 'EACCES' && code !== 'EPERM') throw cause;
-    throw new Error(
-      `sudoRunner ${path}: ${code} as the deploying user, and the path is under no declared prefix ` +
-        `(${prefixes.join(', ')}). If root owns its directory, declare that directory as a prefix.`,
-      { cause },
-    );
-  };
-
 export const makeSudoRunner = (prefixList: readonly string[], deps: SudoDeps): HostRunner => {
   const prefixes = checkPrefixes(prefixList);
   const { base } = deps;
@@ -113,22 +89,35 @@ export const makeSudoRunner = (prefixList: readonly string[], deps: SudoDeps): H
     await before?.();
     deps.log(`homeflare/launchd sudo -n ${shown}`);
     const result = await base.exec([SUDO, '-n', '--', ...argv]);
-    if (result.exitCode !== 1) return result;
-    if (PASSWORD.test(result.stderr)) {
-      throw new SudoRefusedError(
-        `sudo -n ${shown}: a password is required, and this runner never prompts. Run \`sudo -v\` ` +
-          'in the deploying terminal just before the deploy, or grant exactly these commands ' +
-          'NOPASSWD (docs/launchd-sudo.md). The command did not run.',
-      );
-    }
-    if (NOT_ALLOWED.test(result.stderr)) {
-      throw new SudoRefusedError(
-        `sudo -n ${shown}: sudoers does not let the deploying user run this. The command did not run.`,
-      );
-    }
+    const refused = sudoRefusal(shown, result);
+    if (refused !== undefined) throw refused;
     return result;
   };
 
+  /**
+   * Every refusal a write can meet before sudo is asked — as the deploying user, reading only — so
+   * the same checks run at plan time (`checkWrite`) and at the write. `undefined` outside every
+   * prefix, where the operator writes; else the prefix and the mode as `install -m` takes it.
+   */
+  const vetWrite = async (path: string, options: WriteOptions) => {
+    const prefix = prefixOf(path, prefixes);
+    const operator = base.effectiveUid();
+    if (prefix === undefined) {
+      if (options.uid !== undefined && options.uid !== operator && operator !== 0) {
+        throw new SudoRefusedError(
+          `sudoRunner ${path}: owner ${String(options.uid)} needs root, and the path is under no ` +
+            `declared prefix (${prefixes.join(', ')}). Declare its directory, or deploy as root. ` +
+            'Nothing was written.',
+        );
+      }
+      return undefined;
+    }
+    const mode = octalMode(options.mode);
+    if (mode === undefined) throw new SudoRefusedError(`sudoRunner ${path}: mode must be 0–0o7777`);
+    await assertInstallable(base, prefix, path, options, await deps.groups());
+    return { mode, prefix };
+  };
+
   /** A privileged file operation: anything but exit 0 is an error. ⚠️ stderr names paths only. */
   const mustSucceed = async (argv: readonly string[], staged?: string): Promise<void> => {
     const result = await elevate(argv, staged === undefined ? {} : { staged });
@@ -139,6 +128,10 @@ export const makeSudoRunner = (prefixList: readonly string[], deps: SudoDeps): H
   };
 
   return {
+    // ★ The plan-time half of vetWrite: the providers' diffs call it, and it never elevates.
+    checkWrite: async (path, options) => {
+      await vetWrite(path, options);
+    },
     effectiveUid: () => base.effectiveUid(),
     exec: async (argv) => {
       const route = routeExec(argv, base.effectiveUid());
@@ -177,23 +170,11 @@ export const makeSudoRunner = (prefixList: readonly string[], deps: SudoDeps): H
     sleep: (ms) => base.sleep(ms),
     stat: (path) => base.stat(path),
     writeFileAtomic: async (path, bytes, options) => {
-      const prefix = prefixOf(path, prefixes);
-      const operator = base.effectiveUid();
-      if (prefix === undefined) {
-        if (options.uid !== undefined && options.uid !== operator && operator !== 0) {
-          throw new SudoRefusedError(
-            `sudoRunner ${path}: owner ${String(options.uid)} needs root, and the path is under no ` +
-              `declared prefix (${prefixes.join(', ')}). Declare its directory, or deploy as root. ` +
-              'Nothing was written.',
-          );
-        }
+      const vetted = await vetWrite(path, options);
+      if (vetted === undefined) {
         return base.writeFileAtomic(path, bytes, options).catch(undeclared(path, prefixes));
       }
-      const mode = octalMode(options.mode);
-      if (mode === undefined)
-        throw new SudoRefusedError(`sudoRunner ${path}: mode must be 0–0o7777`);
-      await assertPlainPath(base, prefix, path, 'file-or-absent');
-      await assertReadableBack(base, path, options, await deps.groups());
+      const { mode } = vetted;
       const staged = await deps.stage(bytes);
       try {
         await mustSucceed(

package/src/launchd/sudo-said.ts

@@ -0,0 +1,58 @@
+/**
+ * What sudo's own failure means, for sudo-runner.ts: which exit-1 answers are sudo refusing to run
+ * the command (so NOTHING ran as root), and what an EACCES outside every prefix most likely means.
+ * Split out of sudo-runner.ts, which keeps only the runner.
+ *
+ * ⚠️ REASONED, NOT MEASURED: sudo's failure text. The kit never runs sudo. The strings below follow
+ *   sudoers(5) for sudo 1.9.17p2 on macOS 27.2 ("a password is required": -n was given but a
+ *   password was needed) and sudo(8) (sudo exits 1 when it fails itself).
+ */
+import { errnoCode } from './local-runner.ts';
+import type { ExecResult } from './runner.ts';
+import { SudoRefusedError } from './sudo-allowlist.ts';
+
+/**
+ * ⚠️ ANCHORED TO sudo'S OWN MESSAGE FORMS (`sudo: …` lines, `Sorry, user …`), so a launchctl or
+ *   install error that happens to say "not allowed" is never reported as "the command did not run".
+ *   The refusals are the three a sudoers denial prints: the command not allowed, the user not in
+ *   sudoers, and the user not allowed on this host (`<user> is not allowed to run sudo on <host>.`).
+ *   REASONED from sudo 1.9's sudoers plugin, like the rest (header).
+ */
+const PASSWORD =
+  /^sudo: (?:a password is required|a terminal is required|sorry, you must have a tty)/m;
+const NOT_ALLOWED =
+  /^(?:Sorry, user \S+ (?:is not allowed to execute|may not run sudo)|\S+ is not (?:in the sudoers file|allowed to run sudo on ))/m;
+
+/** ★ An EACCES outside every prefix is almost always a directory the stack forgot to declare. */
+export const undeclared =
+  (path: string, prefixes: readonly string[]) =>
+  (cause: unknown): never => {
+    const code = errnoCode(cause);
+    if (code !== 'EACCES' && code !== 'EPERM') throw cause;
+    throw new Error(
+      `sudoRunner ${path}: ${code} as the deploying user, and the path is under no declared prefix ` +
+        `(${prefixes.join(', ')}). If root owns its directory, declare that directory as a prefix.`,
+      { cause },
+    );
+  };
+
+/**
+ * The refusal sudo itself answered for `shown` (the argv as JSON), or `undefined` when the command
+ * ran — whatever its own exit code. ★ `SudoRefusedError` always means nothing ran as root.
+ */
+export const sudoRefusal = (shown: string, result: ExecResult): SudoRefusedError | undefined => {
+  if (result.exitCode !== 1) return undefined;
+  if (PASSWORD.test(result.stderr)) {
+    return new SudoRefusedError(
+      `sudo -n ${shown}: a password is required, and this runner never prompts. Run \`sudo -v\` ` +
+        'in the deploying terminal just before the deploy, or grant exactly these commands ' +
+        'NOPASSWD (docs/launchd-sudo.md). The command did not run.',
+    );
+  }
+  if (NOT_ALLOWED.test(result.stderr)) {
+    return new SudoRefusedError(
+      `sudo -n ${shown}: sudoers does not let the deploying user run this. The command did not run.`,
+    );
+  }
+  return undefined;
+};

package/src/openbao/README.md

@@ -17,8 +17,11 @@ plus `FetchHttpClient.layer`.
 - ⛔ A rename or move onto a name or path that already exists fails the plan, before anything is
   written (every family but the mounts, whose moves are below). Move through a free name, in two
   deploys, or remove the target first.
-- ⚠️ A NEW logical id for a live name adopts it, and under `destroy` the old id's delete then
-  removes it. Change a logical id with Alchemy's `renamedFrom` (REPLACE.md).
+- ⛔ **Nothing is adopted without `--adopt`** (0.9.0), not even an object identical to the
+  declaration: a live name with no state fails the plan, or the apply when a prop was an Output.
+  Our own interrupted create still resumes when its row can prove it — not one killed while a
+  prop was still an Output. [docs/ownership.md](../../docs/ownership.md). Change
+  a logical id with Alchemy's `renamedFrom` (REPLACE.md), never by adopting.
 
 ## assertBaoIdentity: call it first
 

package/src/openbao/REPLACE.md

@@ -139,17 +139,19 @@ retained."). It is live and unmanaged from then on:
 `declareCloudflareRoles` does, never reaches the `replace`: the old id leaves the stack as an
 orphan delete, which `retain` also keeps live.
 
-## A new declaration of a live name: the swap the guard cannot see
-
-⚠️ A NEW logical id whose name already exists takes that object over and rewrites it: these
-families' `read` never answers `Unowned`, so Alchemy silently adopts it. Nothing moved, so
-`judgeMove` never runs. 🔴 Measured (`rename-adoption.test.ts`): under `destroy` the old owner's
-delete then runs after the adoption wrote, and removes the object the new id now claims, in a
-green deploy. It happened when a logical id changed with the name kept, to each of the nine
-batch-2 families whose delete runs (a TOTP method and its enrolments included), and when a new
-`Bao.AuthRole` took a name another one moved off in the same deploy. Change a logical id with
-Alchemy's `renamedFrom('<old id>')`, which migrates the state row and plans an `update`. Take a
-freed name in the deploy after the move.
+## A new declaration of a live name: refused unless adopted
+
+⛔ A NEW logical id whose name already exists now FAILS THE PLAN (0.9.0): with no state, `read`
+answers `Unowned` for any live object, identical or not (`src/ownership/probe.ts`,
+[docs/ownership.md](../../docs/ownership.md)). Nothing moved, so `judgeMove` never runs; the
+probe is what catches it. 🔴 Measured before (`rename-adoption.test.ts`): the families' `read`
+answered plain attributes, so Alchemy silently adopted the object, and under `destroy` the old
+owner's delete then ran after the adoption wrote and removed the object the new id claimed, in a
+green deploy — for each of the nine batch-2 families whose delete runs (a TOTP method and its
+enrolments included), and when a new `Bao.AuthRole` took a name another one moved off in the same
+deploy. ⚠️ `--adopt` is exactly that takeover again, on purpose. Change a logical id with Alchemy's
+`renamedFrom('<old id>')`, which migrates the state row and plans an `update`. Take a freed name
+in the deploy after the move.
 
 ## Why the moves fail instead of replacing
 

package/src/openbao/adopt-core.test.ts

@@ -0,0 +1,119 @@
+/**
+ * The ownership rule for the five families fake-core.ts carries — Bao.Policy, Bao.CloudflareRole,
+ * Bao.ProxmoxRole, Bao.Mount and Bao.AuthMethod — through Alchemy's own plan and apply: the same
+ * claims adopt-families.test.ts and adopt-recovery.test.ts make for the other nine.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import * as Effect from 'effect/Effect';
+import { BaoAuthRole } from './auth-role.ts';
+import { crashAfterWrite } from './fake-bao.ts';
+import { CORE, type CoreRow, withCore } from './fake-core.ts';
+import { writesOf } from './fake-stack.ts';
+import { BaoMount } from './mount.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+
+/** `Z`, with its knob an Output until apply: an upstream AppRole's `tokenTtl`, created with it. */
+const pending = (row: CoreRow) =>
+  Effect.gen(function* () {
+    const up = yield* BaoAuthRole('Upstream', {
+      name: 'upstream',
+      secretIdTtl: '24h',
+      tokenMaxTtl: '1h',
+      tokenPolicies: ['default'],
+      tokenTtl: '15m',
+    });
+    yield* row.declare('Z', up.tokenTtl);
+  });
+
+for (const row of CORE) {
+  describe(`${row.family}: ownership`, () => {
+    it('a live object another stack owns, identical, fails the plan; nothing is written', async () => {
+      await withCore(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate));
+        assert.deepEqual(await stack.deploy(row.declare('Z', '15m'), { adopt: true }), {
+          Z: 'adopted',
+        });
+        assert.deepEqual(writesOf(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, the apply refuses it; the next plan refuses too', async () => {
+      await withCore(async (stack, _estate, seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), NOT_OWNED);
+        assert.deepEqual(
+          writesOf(seen).filter((line) => !line.endsWith('/upstream')),
+          [],
+        );
+      });
+    });
+
+    it('with a prop still an Output, --adopt takes it over at apply', async () => {
+      await withCore(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', '15m'));
+        assert.deepEqual(await stack.deploy(pending(row), { adopt: true }), {
+          Upstream: 'create',
+          Z: 'create',
+        });
+      });
+    });
+
+    it('an interrupted create is resumed without --adopt, and nothing is rewritten', async () => {
+      const fault = crashAfterWrite();
+      await withCore(async (stack, estate, seen) => {
+        // ★ Bao.Policy reads nothing back after its write, so the crash is the write's own reply.
+        fault.crashNext(row.family === 'Bao.Policy' ? 'write' : 'read-back');
+        await assert.rejects(stack.deploy(row.declare('X', '15m')), /injected/);
+        assert.ok(row.has(estate));
+        seen.length = 0;
+        assert.deepEqual(await stack.deploy(row.declare('X', '15m')), { X: 'create' });
+        assert.deepEqual(writesOf(seen), []);
+      }, fault.wrap);
+    });
+  });
+}
+
+describe('Bao.Mount: remountFrom on a create', () => {
+  const moved = BaoMount('Kv', { path: 'kv-moved', remountFrom: 'kv', type: 'kv' });
+  const SOURCE = /Bao\.Mount kv \(the remountFrom source\): already exists/;
+
+  it('moving a live mount this stack holds no state for is refused before the move', async () => {
+    await withCore(async (stack, estate, seen, owner) => {
+      await owner.deploy(BaoMount('Src', { path: 'kv', type: 'kv' }));
+      seen.length = 0;
+      // ★ The probe reads only the target, which is free: the plan says create.
+      await assert.rejects(stack.deploy(moved), SOURCE);
+      assert.deepEqual(writesOf(seen), []);
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv/']);
+      assert.deepEqual(await stack.deploy(moved, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual([...estate.mounts.table.keys()], ['kv-moved/']);
+    });
+  });
+});
+
+describe('Bao.Mount: a create interrupted between its enable and its tune', () => {
+  it('is not proven ours — the mount is not what was declared — so it resumes with --adopt', async () => {
+    const fault = crashAfterWrite();
+    const kv = BaoMount('Kv', { defaultLeaseTtl: '15m', path: 'kv', type: 'kv' });
+    await withCore(async (stack, estate) => {
+      fault.crashNext('write');
+      await assert.rejects(stack.deploy(kv), /injected/);
+      assert.ok(estate.mounts.table.has('kv/'));
+      await assert.rejects(stack.deploy(kv), /Cannot resume creating resource 'Kv'.*--adopt/s);
+      assert.deepEqual(await stack.deploy(kv, { adopt: true }), { Kv: 'create' });
+      assert.deepEqual(await stack.deploy(kv), { Kv: 'noop' });
+    }, fault.wrap);
+  });
+});

package/src/openbao/adopt-families.test.ts

@@ -0,0 +1,97 @@
+/**
+ * NOTHING IS ADOPTED WITHOUT `--adopt` (decided 2026-09-21), for the nine batch-2 families, through
+ * Alchemy's own plan and apply (fake-stack.ts). The object is put there by ANOTHER stack over the
+ * same fake (`owner`) — the case the rule exists for: identical to this declaration, and still
+ * not ours.
+ *   · plan time: the adoption probe answers `Unowned` (ownership/probe.ts);
+ *   · apply time: where the probe never ran — a prop still an Output — reconcile refuses before any
+ *     write (ownership/adopt.ts).
+ * adopt-recovery.test.ts pins the other side: our own interrupted create is still resumed.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Seen } from './fake-bao.ts';
+import { FAMILIES, type Family, upstream, withEstate } from './fake-families.ts';
+import { writesOf } from './fake-stack.ts';
+
+const NOT_OWNED = /Cannot adopt resource 'Z'.*not owned by this stack.*--adopt/s;
+const TAKEOVER = /: already exists, and this stack holds no state for it.*Nothing was written/s;
+const STILL_REFUSED = /Cannot adopt resource 'Z'.*--adopt/s;
+
+/** `Z` names `a`, with its knob an Output until apply: the upstream AppRole is created with it. */
+const pending = (row: Family, scoped?: boolean) =>
+  Effect.gen(function* () {
+    const up = yield* upstream('15m');
+    const declared = row.declare('Z', 'a', up.tokenTtl);
+    yield* scoped === undefined ? declared : declared.pipe(adopt(scoped));
+  });
+
+/** Writes other than the upstream AppRole's own create. */
+const writesToA = (seen: readonly Seen[]) =>
+  writesOf(seen).filter((line) => !line.endsWith('/upstream'));
+
+for (const row of FAMILIES) {
+  describe(`${row.family}: a live object another stack owns`, () => {
+    it('identical to the declaration, still fails the plan; nothing is written', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(row.declare('Z', 'a', '15m')), NOT_OWNED);
+        assert.deepEqual(writesOf(seen), []);
+        assert.ok(row.has(estate, 'a'));
+      });
+    });
+
+    it('is adopted with --adopt, and with adopt(true) — identical, so nothing is written', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          seen.length = 0;
+          const body =
+            deploy === 'flag'
+              ? stack.deploy(row.declare('Z', 'a', '15m'), { adopt: true })
+              : stack.deploy(row.declare('Z', 'a', '15m').pipe(adopt(true)));
+          assert.deepEqual(await body, { Z: 'adopted' });
+          assert.deepEqual(writesOf(seen), []);
+        });
+      }
+    });
+
+    it('with a prop still an Output, the plan cannot ask, so the apply refuses', async () => {
+      await withEstate(async (stack, estate, seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        seen.length = 0;
+        await assert.rejects(stack.deploy(pending(row)), TAKEOVER);
+        assert.deepEqual(writesToA(seen), []);
+        assert.ok(row.has(estate, 'a'));
+        // ★ The refused create forgot its `creating` row, so the next plan probes: still refused.
+        await assert.rejects(stack.deploy(pending(row)), STILL_REFUSED);
+        assert.deepEqual(writesToA(seen), []);
+      });
+    });
+
+    it('with a prop still an Output, --adopt and adopt(true) take it over at apply', async () => {
+      for (const deploy of ['flag', 'scope'] as const) {
+        await withEstate(async (stack, _estate, _seen, owner) => {
+          await owner.deploy(row.declare('X', 'a', '15m'));
+          const planned =
+            deploy === 'flag'
+              ? await stack.deploy(pending(row), { adopt: true })
+              : await stack.deploy(pending(row, true));
+          assert.deepEqual(planned, { Upstream: 'create', Z: 'create' });
+        });
+      }
+    });
+
+    it('adopt(false) on the resource wins over --adopt, at apply as at plan', async () => {
+      await withEstate(async (stack, _estate, _seen, owner) => {
+        await owner.deploy(row.declare('X', 'a', '15m'));
+        await assert.rejects(stack.deploy(pending(row, false), { adopt: true }), TAKEOVER);
+      });
+    });
+  });
+}