@homeflare/alchemy 0.8.0 → 0.10.1

package/src/ownership/ownership.test.ts

@@ -0,0 +1,200 @@
+/**
+ * The engine-facing edges of ownership/: which instance a read is about, whether its row carries
+ * the whole declaration, what a resume note is worth without a shared bag or a proof, and that a
+ * `settled` check that cannot run never fails the plan. whole.test.ts has the hole walk itself;
+ * the families' end-to-end behaviour is pinned through the engine in openbao/adopt-*.test.ts.
+ */
+import { describe, expect, test } from 'bun:test';
+import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import { refuseTakeover } from './adopt.ts';
+import { ownedRead } from './probe.ts';
+import { noteResume, noteUnfinished, resumes } from './resume.ts';
+import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
+
+const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );
+
+describe('recordedInstance', () => {
+  test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {
+    const rows = { A: row('A', 'new', row('A', 'older')), X: row('X', 'moved') };
+    expect(await withStore(rows, recordedInstance('A', 'new'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('A', 'older'))).toBe('whole');
+    expect(await withStore(rows, recordedInstance('Z', 'moved'))).toBe('whole');
+  });
+
+  test("the probe's freshly minted instance is never recorded", async () => {
+    expect(await withStore({ A: row('A', 'mine') }, recordedInstance('A', 'probe'))).toBe('absent');
+    expect(await withStore({}, recordedInstance('A', 'mine'))).toBe('absent');
+  });
+
+  test('a row missing a declared prop (an Output stripped at commit) is partial', async () => {
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, recordedInstance('A', 'mine'))).toBe('partial');
+    // ★ No longer declared (an orphan's delete): nothing to compare, so never whole.
+    expect(await withStore({ C: row('C', 'mine') }, recordedInstance('C', 'mine'))).toBe('partial');
+  });
+
+  test('fails closed with no Stack or State in context', async () => {
+    expect(await Effect.runPromise(recordedInstance('A', 'mine'))).toBe('absent');
+  });
+});
+
+describe('isCreate', () => {
+  test("is this instance's `creating` row — never a replace's `replacing` one", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    expect(await withStore(rows, isCreate('A', 'mine'))).toBe(true);
+    expect(await withStore(rows, isCreate('B', 'new'))).toBe(false);
+    expect(await withStore(rows, isCreate('A', 'other'))).toBe(false);
+    expect(await Effect.runPromise(isCreate('A', 'mine'))).toBe(false);
+  });
+});
+
+describe('forgetRefusedCreate', () => {
+  test('drops only the creating row of this instance, with no attributes', async () => {
+    const rows: Record<string, ResourceState> = {
+      A: row('A', 'mine'),
+      B: row('B', 'mine', row('B', 'older')),
+      C: row('C', 'theirs'),
+      D: { ...row('D', 'mine'), attr: { name: 'd' } },
+    };
+    for (const fqn of ['A', 'B', 'C', 'D']) await withStore(rows, forgetRefusedCreate(fqn, 'mine'));
+    expect(Object.keys(rows).sort()).toEqual(['B', 'C', 'D']);
+  });
+});
+
+describe('ownedRead', () => {
+  const found = { name: 'a' };
+  const ask = (output?: unknown) => ({ fqn: 'A', instanceId: 'mine', output });
+  const rows = { A: row('A', 'mine') };
+
+  test('with state it is the object as found; absent is absent', async () => {
+    const plain = await Effect.runPromise(ownedRead(ask({}), found, Effect.succeed(false)));
+    expect(Unowned.is(plain)).toBe(false);
+    expect(await Effect.runPromise(ownedRead(ask(), undefined, Effect.succeed(true)))).toBe(
+      undefined,
+    );
+  });
+
+  test('the probe answers Unowned even when the object is settled', async () => {
+    const probed = await withStore({}, ownedRead(ask(), found, Effect.succeed(true)));
+    expect(Unowned.is(probed)).toBe(true);
+  });
+
+  test('the recovery read is ours only when settled, over a row with the whole declaration', async () => {
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      false,
+    );
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, Effect.succeed(false))))).toBe(
+      true,
+    );
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(Unowned.is(await withStore(holed, ownedRead(ask(), found, Effect.succeed(true))))).toBe(
+      true,
+    );
+  });
+
+  test('a settled check that fails or dies is Unowned, never a failed plan', async () => {
+    const failing = Effect.fail(new Error('fragments directory moved'));
+    const dying = Effect.die(new TypeError('olds.tokenPolicies is undefined'));
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, failing)))).toBe(true);
+    expect(Unowned.is(await withStore(rows, ownedRead(ask(), found, dying)))).toBe(true);
+  });
+});
+
+describe('resume notes and refuseTakeover', () => {
+  const bag = makeScopedArtifacts(new Map(), 'A');
+  const inBag = <A>(effect: Effect.Effect<A>) =>
+    Effect.runPromise(effect.pipe(Effect.provideService(Artifacts, bag)));
+
+  const ours = Effect.succeed({ name: 'a' });
+
+  test('a note is read back for its own instance only, and nothing is noted without a bag', async () => {
+    await inBag(noteResume('mine', ours));
+    expect(await inBag(resumes('mine'))).toBe(true);
+    expect(await inBag(resumes('other'))).toBe(false);
+    await Effect.runPromise(noteResume('mine', ours));
+    expect(await Effect.runPromise(resumes('mine'))).toBe(false);
+  });
+
+  test('nothing is noted unless the read proves the object ours', async () => {
+    const fresh = makeScopedArtifacts(new Map(), 'A');
+    const unproven = [
+      Effect.succeed(undefined),
+      Effect.succeed(Unowned({ name: 'a' })),
+      Effect.fail(new Error('403')),
+      Effect.die(new TypeError('olds.name is undefined')),
+    ];
+    for (const read of unproven) {
+      await Effect.runPromise(
+        noteResume('mine', read).pipe(Effect.provideService(Artifacts, fresh)),
+      );
+    }
+    expect(
+      await Effect.runPromise(resumes('mine').pipe(Effect.provideService(Artifacts, fresh))),
+    ).toBe(false);
+  });
+
+  test('refuses a create with no note and no adoption; state or a note lets it through', async () => {
+    const owner = { fqn: 'A', instanceId: 'mine', output: undefined };
+    await expect(Effect.runPromise(refuseTakeover(owner, 'Thing a'))).rejects.toThrow(
+      /Thing a: already exists.*--adopt/s,
+    );
+    await Effect.runPromise(refuseTakeover({ ...owner, output: {} }, 'Thing a'));
+    await inBag(noteResume('mine', ours));
+    await inBag(refuseTakeover(owner, 'Thing a'));
+  });
+
+  test("--adopt covers a create or an unfinished generation, never a fresh replace's", async () => {
+    const rows = { A: row('A', 'mine'), B: row('B', 'new', row('B', 'older')) };
+    const adopting = <A>(effect: Effect.Effect<A>, bag = makeScopedArtifacts(new Map(), 'B')) =>
+      withStore(
+        rows,
+        effect.pipe(
+          Effect.provideService(AdoptPolicy, true),
+          Effect.provideService(Artifacts, bag),
+        ),
+      );
+    await adopting(refuseTakeover({ fqn: 'A', instanceId: 'mine', output: undefined }, 'Thing a'));
+    const fresh = { fqn: 'B', instanceId: 'new', output: undefined };
+    await expect(adopting(refuseTakeover(fresh, 'Thing b'))).rejects.toThrow(
+      /Thing b: already exists.*new identity of a replace, which --adopt does not cover/s,
+    );
+    const seen = makeScopedArtifacts(new Map(), 'B');
+    await adopting(noteUnfinished('new'), seen);
+    await adopting(refuseTakeover(fresh, 'Thing b'), seen);
+  });
+});

package/src/ownership/probe.ts

@@ -0,0 +1,65 @@
+/**
+ * `read` with no attributes — the plan-time half of "nothing is adopted without `--adopt`"
+ * (adopt.ts has the apply-time half). Alchemy asks it in two situations and passes `output:
+ * undefined` in both (alchemy beta.79 Plan.ts):
+ *   · THE ADOPTION PROBE — no state row at all; `olds` is the declaration, `instanceId` fresh.
+ *   · THE RECOVERY READ — a `creating` row whose create was interrupted after its write and before
+ *     its commit; `olds` is that row's props, `instanceId` the row's. (Apply.ts asks the same for a
+ *     row it must delete that never recorded attributes.)
+ * The answer routes the plan: `undefined` → create; plain attributes → ours; `Unowned(…)` → the
+ * plan fails with OwnedBySomeoneElse unless `--adopt` / `adopt(true)` (AdoptPolicy.ts).
+ *
+ * ⛔ THE PROBE ALWAYS ANSWERS `Unowned` FOR A LIVE OBJECT, EVEN ONE IDENTICAL TO THE DECLARATION
+ *   (decided 2026-09-21). Identical is not ours: a name another stack, a person or an old script put
+ *   there reads the same, and once state claims it, a delete under `destroy` removes it from its
+ *   real owner. 🔴 Measured before the change (openbao/rename-adoption.test.ts): a new logical id
+ *   for a live Bao name adopted it silently, and the old id's delete then removed it, green.
+ * ★ THE RECOVERY READ STILL ADOPTS WHAT THE INTERRUPTED CREATE MADE — the instance is ours by the
+ *   state row, and the object is proven ours when it matches that row's props (`settled`). One that
+ *   does not match may have lost a race to someone else: `Unowned`, as Plan.ts itself asks.
+ * ⛔ ONLY WHEN THE ROW'S PROPS ARE THE WHOLE DECLARATION (whole.ts). A row written while a prop was
+ *   still an Output has a hole there, and "matches" against a hole proves nothing — nor had that
+ *   deploy's plan ever asked whose object it was, because Alchemy skips the probe for an Output.
+ *   Such a create resumes with `--adopt`.
+ */
+import { Unowned } from 'alchemy/AdoptPolicy';
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { recordedInstance } from './rows.ts';
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when the state store records this instance
+ * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
+ * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
+ *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
+ *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'partial') {
+      yield* Effect.logWarning(
+        `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
+          'was still an Output when it was written), so the live object is not proven ours',
+      );
+      return Unowned(found);
+    }
+    const unproven = (reason: unknown) =>
+      Effect.as(
+        Effect.logWarning(
+          `${ask.fqn}: the interrupted create's object could not be compared with its props ` +
+            `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`,
+        ),
+        false,
+      );
+    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+    return ours ? found : Unowned(found);
+  });

package/src/ownership/resume.ts

@@ -0,0 +1,118 @@
+/**
+ * Whether this apply RESUMES a create or replace the engine already started for this resource AND
+ * the live object it will find is proven that generation's own — the one case in which a stateless
+ * `reconcile` may write over a live object without `--adopt`.
+ *
+ * ★ HOW THE ENGINE TELLS US. Alchemy calls `diff` whenever a state row exists, and hands it `output`
+ *   = that row's attributes (alchemy beta.79 Plan.ts). A row with NO attributes is exactly an
+ *   unfinished generation: `creating` (a create interrupted after its write, before its commit),
+ *   `replacing` (the same for a replace), or `deleting` re-driven as a create. A fresh create is
+ *   never diffed at all. So the diff of such a row decides, and the apply that follows (the same
+ *   instance id: Apply.ts reuses the row's) finds the note.
+ * ⛔ A ROW PROVES NOTHING BY ITSELF (red team, 2026-09-21). Apply commits it BEFORE reconcile runs, so
+ *   a deploy killed before the claim — an upstream that failed, a Ctrl-C — leaves a row whose create
+ *   never asked whose object sat at its identity. 🔴 MEASURED (openbao/adopt-holes.test.ts): with the
+ *   name an Output, the next deploy "resumed" that create and wrote over another owner's role, in
+ *   every family that had a note on the row alone. So the note is left only when the family's own
+ *   `read`, asked as the recovery read (probe.ts ownedRead: a recorded instance, a row carrying the
+ *   whole declaration, and a live object that matches it), answers "ours". For a `creating` row
+ *   that is the question Plan.ts already asked; for a `replacing` row it is the only time it is asked.
+ * ⚠️ WHY NOT THE STATE STORE ALONE. At reconcile both look the same: Apply commits the fresh create's
+ *   `creating` row before calling reconcile, so a row with this instance id is always there.
+ * ★ THE CHANNEL IS ALCHEMY'S OWN: `Artifacts`, the per-FQN bag the engine shares between one plan
+ *   and its apply (Artifacts.ts: "diff computes … create / update reads the same artifact").
+ *   Deploy.ts and the Alchemist session both hold one store across the pair.
+ * ⚠️ IT FAILS CLOSED. No bag, a bag the plan never wrote, or an object the read cannot prove ours
+ *   reads as a fresh create, and adopt.ts then asks for `--adopt` — the safe direction.
+ * ★ AN UNPROVEN RESUME IS STILL MARKED UNFINISHED (`noteUnfinished`), so `--adopt` can take it over
+ *   the way Alchemy's own "Cannot resume creating … Re-run with --adopt" offers for a create — while
+ *   a FRESH replace's new generation, which no diff ever saw without attributes, stays unadoptable.
+ */
+import { Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts } from 'alchemy/Artifacts';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+
+const PROVEN = 'homeflare/ownership/resumes';
+const UNFINISHED = 'homeflare/ownership/unfinished';
+
+const note = (key: string, instanceId: string): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const bag = yield* Effect.serviceOption(Artifacts);
+    if (Option.isSome(bag)) yield* bag.value.set(key, instanceId);
+  });
+
+const noted = (key: string, instanceId: string): Effect.Effect<boolean> =>
+  Effect.gen(function* () {
+    const bag = yield* Effect.serviceOption(Artifacts);
+    if (Option.isNone(bag)) return false;
+    return (yield* bag.value.get<string>(key)) === instanceId;
+  });
+
+/**
+ * `diff`'s note for a row with no attributes: `instanceId` is an unfinished generation of this
+ * resource's own, which `--adopt` may resume when nothing proves it (adopt.ts adoptable). Returns
+ * `undefined`, a diff's "defer to the engine".
+ */
+export const noteUnfinished = (instanceId: string): Effect.Effect<undefined> =>
+  Effect.as(note(UNFINISHED, instanceId), undefined);
+
+/**
+ * Note `instanceId` unfinished, and a proven resume when `recovered` — the family's `read` of the
+ * row's props, asked with no attributes — answers a plain object: ours. `Unowned`, nothing, or a
+ * read that fails or dies proves nothing. ⚠️ Never fails the plan: an unproven resume is refused
+ * at apply instead, unless `--adopt`.
+ */
+export const noteResume = <R>(
+  instanceId: string,
+  recovered: Effect.Effect<unknown, unknown, R>,
+): Effect.Effect<void, never, R> =>
+  Effect.gen(function* () {
+    yield* noteUnfinished(instanceId);
+    const unproven = () => Effect.succeed(undefined);
+    const found = yield* recovered.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+    if (found === undefined || found === null || Unowned.is(found)) return;
+    yield* note(PROVEN, instanceId);
+  });
+
+/** Whether the plan for this apply noted `instanceId` as a proven resumed create or replace. */
+export const resumes = (instanceId: string): Effect.Effect<boolean> => noted(PROVEN, instanceId);
+
+/** Whether the plan for this apply saw `instanceId` as an unfinished generation (proven or not). */
+export const unfinished = (instanceId: string): Effect.Effect<boolean> =>
+  noted(UNFINISHED, instanceId);
+
+/** The fields of a `read` or `diff` call provingResumes uses; a family's own input carries more. */
+type Ask = {
+  readonly id: string;
+  readonly fqn: string;
+  readonly instanceId: string;
+  readonly olds: unknown;
+  readonly output: unknown;
+};
+type Hook = Effect.Effect<unknown, unknown, unknown>;
+
+/** The two hooks provingResumes wraps, as Alchemy's ProviderService declares them. */
+interface Resumable {
+  read?(input: Ask): Hook;
+  diff?(input: Ask): Hook;
+}
+
+/**
+ * A provider whose `diff`, for a row with no attributes, first asks the provider's own `read` whether
+ * the live object is that unfinished generation's (noteResume), then runs as written. Every Bao.*
+ * family is built through it, so their diffs answer such a row with a plain `undefined`.
+ */
+export const provingResumes = <S extends Resumable>(service: S): S => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined) return service;
+  const proving: Resumable['diff'] = (input) =>
+    Effect.gen(function* () {
+      if (input.output === undefined) {
+        yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+      }
+      return yield* diff(input);
+    });
+  // ⚠️ The one cast: `diff` keeps the family's own signature — it is the family's diff, run after.
+  return { ...service, diff: proving } as S;
+};

package/src/ownership/rows.ts

@@ -0,0 +1,117 @@
+/**
+ * The questions ownership/ asks of Alchemy's state store: does a row record this instance, and with
+ * its whole declaration (probe.ts); is this apply a create rather than a replace's new generation
+ * (adopt.ts); and — when reconcile refuses a create — forget the row Apply committed for it
+ * (adopt.ts). Alchemy's own AWS.EC2.SecurityGroup provider reads the store the same way: the Stack
+ * service names the stack and stage, and `State` yields the store.
+ *
+ * ⚠️ WITHOUT A STACK OR STATE IN CONTEXT, or with a store that errors, a row reads as "not
+ *   recorded" — the object is then `Unowned`, the safe answer — and nothing is forgotten, which
+ *   leaves the one gap forgetRefusedCreate exists to close. `alchemy deploy` and the Alchemist
+ *   session provide both.
+ */
+import { Stack } from 'alchemy/Stack';
+import { State, type StateService, isActionState } from 'alchemy/State/State';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+import { wholeDeclaration } from './whole.ts';
+
+type Where = { readonly stack: string; readonly stage: string };
+
+/** The store, where this stack lives, and what it declares — or undefined outside a stack. */
+const storeOf = Effect.gen(function* () {
+  const stack = yield* Effect.serviceOption(Stack);
+  const state = yield* Effect.serviceOption(State);
+  if (Option.isNone(stack) || Option.isNone(state)) return undefined;
+  const store: StateService = yield* state.value;
+  const where: Where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+
+const rowAt = (store: StateService, where: Where, fqn: string) =>
+  store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));
+
+type Generation = {
+  readonly instanceId?: unknown;
+  readonly status?: unknown;
+  readonly props?: unknown;
+  readonly attr?: unknown;
+  readonly old?: unknown;
+};
+
+/** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */
+const generationOf = (row: unknown, instanceId: string): Generation | undefined => {
+  let at = row;
+  while (typeof at === 'object' && at !== null && !isActionState(at as never)) {
+    const generation = at as Generation;
+    if (generation.instanceId === instanceId) return generation;
+    at = generation.old;
+  }
+  return undefined;
+};
+
+/** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */
+const recordedGeneration = (fqn: string, instanceId: string) =>
+  Effect.gen(function* () {
+    const found = yield* storeOf;
+    if (found === undefined) return undefined;
+    for (const at of [fqn, ...(found.resources[fqn]?.FormerFqns ?? [])]) {
+      const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+      if (generation !== undefined) return generation;
+    }
+    return undefined;
+  });
+
+/**
+ * What the state store says of `instanceId` for this resource (at its FQN, or at a former FQN its
+ * `renamedFrom` names — the planner migrates that row before it recovers it):
+ *   · `absent`  — no row holds it. ★ This is what separates the probe from the recovery read: the
+ *     probe's instance id is minted for the probe (Plan.ts `generateInstanceId()`), 128 random bits
+ *     no row can hold.
+ *   · `partial` — a row holds it, but its props lack part of the declaration: a prop stripped at
+ *     commit because it was still an Output (whole.ts). Those props cannot prove an object ours.
+ *   · `whole`   — a row holds it with every prop the declaration names.
+ */
+export type Recorded = 'absent' | 'partial' | 'whole';
+
+export const recordedInstance = (fqn: string, instanceId: string): Effect.Effect<Recorded> =>
+  Effect.gen(function* () {
+    const generation = yield* recordedGeneration(fqn, instanceId);
+    if (generation === undefined) return 'absent';
+    return (yield* wholeDeclaration(fqn, generation.props)) ? 'whole' : 'partial';
+  });
+
+/**
+ * Whether this apply's `instanceId` is a CREATE: the row Apply committed for it is `creating`.
+ * ⛔ A REPLACE'S NEW GENERATION IS NOT ONE. Apply commits it as `replacing`, and the planner never
+ *   offers it adoption — the probe runs only for a resource with no state — so `--adopt` must not
+ *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).
+ */
+export const isCreate = (fqn: string, instanceId: string): Effect.Effect<boolean> =>
+  Effect.map(
+    recordedGeneration(fqn, instanceId),
+    (generation) => generation?.status === 'creating',
+  );
+
+/**
+ * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a
+ *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it
+ *   there. The next plan's recovery read would then find our instance id and an object that can
+ *   match its props — a prop that was an Output is stripped from the row, and an omitted prop is
+ *   "not managed" — and adopt exactly what this apply refused. 🔴 MEASURED 2026-09-21: Bao.Mount
+ *   and Bao.AuthMethod did (openbao/adopt-core.test.ts). So the row goes, and state reads as if
+ *   the create never started: the next plan probes, and the probe answers `Unowned`.
+ * ⚠️ ONLY a `creating` row of THIS instance with no attributes — the one Apply just wrote. A
+ *   `replacing` row carries the previous generation in `old` and is never touched.
+ */
+export const forgetRefusedCreate = (fqn: string, instanceId: string): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const found = yield* storeOf;
+    if (found === undefined) return;
+    const row = yield* rowAt(found.store, found.where, fqn);
+    const mine = row as { status?: unknown; instanceId?: unknown; attr?: unknown } | undefined;
+    if (mine?.status !== 'creating' || mine.instanceId !== instanceId || mine.attr !== undefined) {
+      return;
+    }
+    yield* found.store.delete({ ...found.where, fqn }).pipe(Effect.ignore);
+  });

package/src/ownership/whole.test.ts

@@ -0,0 +1,39 @@
+/**
+ * whole.ts `carries`: a state row's props against the declaration — every declared value, Outputs
+ * included, needs a value in the row; an optional prop left out of both is no hole.
+ */
+import { describe, expect, test } from 'bun:test';
+import { carries } from './whole.ts';
+
+/** Stands in for an Output: Alchemy's are function-typed proxies (Diff.ts stripUnresolved). */
+const output = Object.assign(() => undefined, { kind: 'Output' });
+
+describe('carries', () => {
+  test('a row with every declared value is whole; an omission from both is no hole', () => {
+    expect(carries({ name: 'a', ttl: output }, { name: 'a', ttl: '15m' })).toBe(true);
+    expect(carries({ name: 'a', ttl: undefined }, { name: 'a' })).toBe(true);
+    expect(carries(undefined, { name: 'a' })).toBe(true);
+  });
+
+  test('a declared value — an Output or a literal — missing from the row is a hole', () => {
+    expect(carries({ name: output, ttl: '15m' }, { ttl: '15m' })).toBe(false);
+    expect(carries({ name: 'a', ttl: '15m' }, { name: 'a' })).toBe(false);
+    expect(carries({ name: 'a' }, undefined)).toBe(false);
+  });
+
+  test('holes inside arrays and nested objects count, as JSON stores keep them (null)', () => {
+    expect(carries({ policies: ['a', output] }, { policies: ['a', null] })).toBe(false);
+    expect(carries({ policies: ['a', output] }, { policies: ['a'] })).toBe(false);
+    expect(carries({ policies: [{ groups: [output] }] }, { policies: [{ groups: [] }] })).toBe(
+      false,
+    );
+    expect(carries({ policies: [{ groups: ['g'] }] }, { policies: [{ groups: ['g'] }] })).toBe(
+      true,
+    );
+  });
+
+  test('a shape the row does not share is not the declaration', () => {
+    expect(carries({ policies: ['a'] }, { policies: 'a' })).toBe(false);
+    expect(carries({ tune: { ttl: '1h' } }, { tune: '1h' })).toBe(false);
+  });
+});

package/src/ownership/whole.ts

@@ -0,0 +1,60 @@
+/**
+ * Whether a state row's props say everything the declaration says — the test that separates a row
+ * whose props can prove an object ours from one that cannot (probe.ts, rows.ts).
+ *
+ * ★ WHY A ROW CAN BE MISSING PART OF ITS DECLARATION. Apply commits the `creating` (or `replacing`)
+ *   row BEFORE reconcile runs, and strips every prop still an Output at that moment (alchemy
+ *   beta.79 Apply.ts `commit` → Diff.ts `stripUnresolved`); a JSON store then drops the key. So a
+ *   row written while an upstream was still being created carries a HOLE where that prop was.
+ * ⛔ A HOLE IS "UNKNOWN", NOT "UNMANAGED". Most families read an absent prop as "not managed", so a
+ *   recovery read comparing the live object with holed props proves nothing: 🔴 MEASURED 2026-09-21
+ *   (openbao/adopt-holes.test.ts), a Bao.Mount whose `defaultLeaseTtl` was an Output, killed before
+ *   its reconcile ran, adopted — and tuned — another owner's mount on the next deploy; with the
+ *   NAME an Output, every role family read an empty name, found nothing, and the resumed create
+ *   wrote over another owner's role. Neither deploy had ever asked whose object it was.
+ * ★ THE DECLARATION IS WHAT TELLS A HOLE FROM AN OMISSION. It still holds the Output (or the literal)
+ *   the row lacks, while an optional prop left out is absent from both.
+ * ⚠️ CONSERVATIVE BY DESIGN: a prop added to the declaration after the crash also reads as a hole.
+ *   That costs one `--adopt`, never a takeover.
+ */
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import * as Option from 'effect/Option';
+
+const absent = (value: unknown): boolean => value === undefined || value === null;
+
+const isPlainObject = (value: unknown): value is Record<string, unknown> => {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;
+  const proto: unknown = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+
+/**
+ * Whether `recorded` carries a value everywhere `declared` does. Plain objects and arrays are
+ * walked; any other declared value — a literal, an Output, an Effect — needs a value in the row.
+ */
+export const carries = (declared: unknown, recorded: unknown): boolean => {
+  if (absent(declared)) return true;
+  if (absent(recorded)) return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded)) return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded)) return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+
+/**
+ * Whether `props` — one generation's, from the state store — carry the whole declaration of the
+ * resource at `fqn`. ⛔ FALSE WITH NOTHING TO COMPARE: no Stack in context, or a resource no longer
+ *   declared (an orphan's delete). That object then reads as `Unowned` and Apply leaves it in place
+ *   with a note, rather than deleting what it cannot prove it made.
+ */
+export const wholeDeclaration = (fqn: string, props: unknown): Effect.Effect<boolean> =>
+  Effect.map(Effect.serviceOption(Stack), (stack) => {
+    const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;
+    return declared !== undefined && carries(declared.Props, props);
+  });