@patronage/factory-ci 1.0.0-alpha.32 → 1.0.0-alpha.34

package/dist/alchemy/index.js

@@ -1,4 +1,4 @@
-import { i as isLocalPreviewStage, n as executeAlchemyEntry, r as resolveAlchemyChildCwd, s as ALCHEMY_BASELINE } from "../execute-alchemy-entry-Dbna-8xq.js";
+import { i as isLocalPreviewStage, n as executeAlchemyEntry, r as resolveAlchemyChildCwd, s as ALCHEMY_BASELINE } from "../execute-alchemy-entry-BZpk0eOQ.js";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { createHash } from "node:crypto";
@@ -9,6 +9,8 @@ import { tryFindProviderByType } from "alchemy/Provider";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import { State } from "alchemy/State";
+import { allStages, deleteState } from "alchemy/State/Tree";
 import { isDeepStrictEqual } from "node:util";
 //#region src/alchemy/evaluate-stack.ts
 var EvaluationProviders = class extends Alchemy.ProviderCollection()("factory-ci/evaluate-stack") {};
@@ -90,15 +92,14 @@ var RetainedIdentityError = class extends Error {
 	}
 };
 /**
-* Read `alchemy state export` output into a snapshot of one stage.
+* Read a persisted-state document into a snapshot of one stage.
 *
-* `alchemy state export` prints one document holding every record in scope
-* (`{ resources: [{ stack, stage, fqn, state }] }`); `alchemy state get`
-* prints a single record and is not this shape. Run without `--stack` the
-* command exports the whole estate, so one fqn appears once per stage and a
-* marker naming it would match whichever record sorted first — a `prod`
-* identity asserted against a `dev` record. `scope` narrows the document to
-* the stack and stage the markers are about.
+* The persisted-state document holds every record in scope
+* (`{ resources: [{ stack, stage, fqn, state }] }`); a single-record document
+* is not this shape. A document covering the whole estate holds one fqn once
+* per stage, so a marker naming it would match whichever record sorted
+* first — a `prod` identity asserted against a `dev` record. `scope` narrows
+* the document to the stack and stage the markers are about.
 *
 * Throws on anything that is not a resource inventory, and on a scoped
 * document that still records one fqn twice. A state this module cannot read
@@ -162,113 +163,6 @@ const assertRetainedIdentities = ({ after, before, markers }) => {
 	if (violations.length > 0) throw new RetainedIdentityError(violations);
 };
 //#endregion
-//#region src/alchemy/stage-policy.ts
-/**
-* Stage and stack pairing, and protected-stage policy, from a project-supplied
-* table (#991).
-*
-* Two projects wrote the same three questions twice — is this stage protected,
-* is it disposable, and may this stack run it — and each answered them with its
-* own stage names hard-coded into the answer. The names differ; the questions
-* do not. This module owns the questions. A project supplies the table and gets
-* decisions back, so no project, stack, or stage name appears here.
-*
-* The disposable grammar this package already owns (`disposable-stage.ts`) is
-* available as a matcher rather than assumed, because a project's disposable
-* set is wider than that one grammar.
-*/
-/** Every stage the shared disposable grammar recognises. */
-const LOCAL_PREVIEW_STAGES = (stage) => isLocalPreviewStage(stage);
-/**
-* Test a pattern without carrying state between calls.
-*
-* A `RegExp` with `g` or `y` advances `lastIndex` on every match, so the same
-* pattern answers "yes" and then "no" for the same stage. A policy that
-* alternates is worse than one that always refuses, so a flagged pattern is
-* tested through a fresh copy whose `lastIndex` starts at zero. The copy
-* carries the complete flags: `y` anchors the match at `lastIndex`, so
-* dropping it would let `/prod/y` accept a stage named `pre-prod` that the
-* project's own pattern rejects. The caller's own `RegExp` is never written
-* to, so a frozen one still works.
-*/
-const statelessTest$1 = (pattern, stage) => pattern.global || pattern.sticky ? new RegExp(pattern.source, pattern.flags).test(stage) : pattern.test(stage);
-const stageMatches = (matcher, stage) => {
-	if (typeof matcher === "function") return matcher(stage);
-	if (Array.isArray(matcher)) return matcher.includes(stage);
-	return statelessTest$1(matcher, stage);
-};
-/** A matcher that accepts a stage any of `matchers` accepts. */
-const anyStage = (...matchers) => (stage) => matchers.some((matcher) => stageMatches(matcher, stage));
-/**
-* A policy refusal. The `code` is the stable part: a project maps it onto its
-* own lifecycle failure envelope, and the message is for a human.
-*/
-var StagePolicyError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "StagePolicyError";
-		this.code = code;
-	}
-};
-const assertTable = (table) => {
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of table.stacks ?? []) {
-		if (!entry.stack) throw new TypeError("Every stack ownership entry needs a stack name.");
-		if (seen.has(entry.stack)) throw new TypeError(`Stack "${entry.stack}" appears twice in the stack registry.`);
-		seen.add(entry.stack);
-	}
-};
-/**
-* Read a project's stage table and answer the stage questions from it.
-*
-* A stage the table classifies as both protected and disposable is a table
-* defect, not a stage a caller may act on, so every query on it throws.
-*/
-const stagePolicy = (table) => {
-	assertTable(table);
-	const classify = (stage) => {
-		const isProtected = stageMatches(table.stages.protected, stage);
-		const isDisposable = stageMatches(table.stages.disposable, stage);
-		if (isProtected && isDisposable) throw new StagePolicyError("AMBIGUOUS_STAGE", `Stage "${stage}" is declared both protected and disposable.`);
-		return {
-			isDisposable,
-			isProtected
-		};
-	};
-	const isProtectedStage = (stage) => classify(stage).isProtected;
-	const isDisposableStage = (stage) => classify(stage).isDisposable;
-	const isKnownStage = (stage) => {
-		const { isDisposable, isProtected } = classify(stage);
-		return isProtected || isDisposable;
-	};
-	const assertKnownStage = (stage) => {
-		if (!isKnownStage(stage)) throw new StagePolicyError("UNKNOWN_STAGE", `Unsupported Alchemy stage: ${stage}`);
-	};
-	const assertDestructiveStage = (stage) => {
-		assertKnownStage(stage);
-		if (isProtectedStage(stage)) throw new StagePolicyError("PROTECTED_STAGE", `Refusing destructive operation for protected stage: ${stage}`);
-	};
-	const assertStackOwnsStage = (stack, stage) => {
-		assertKnownStage(stage);
-		const registry = table.stacks;
-		if (registry === void 0) return;
-		const entry = registry.find((candidate) => candidate.stack === stack);
-		if (entry === void 0) throw new StagePolicyError("UNKNOWN_STACK", `Unsupported Alchemy stack: ${stack}`);
-		const owner = registry.find((candidate) => candidate.stack !== stack && candidate.claims !== void 0 && stageMatches(candidate.claims, stage));
-		if (owner !== void 0) throw new StagePolicyError("STAGE_NOT_OWNED", `Stage ${stage} belongs only to stack ${owner.stack}, not ${stack}.`);
-		if (entry.stages !== void 0 && !stageMatches(entry.stages, stage)) throw new StagePolicyError("STAGE_NOT_OWNED", `Stack ${stack} does not run stage ${stage}.`);
-	};
-	return {
-		assertDestructiveStage,
-		assertKnownStage,
-		assertStackOwnsStage,
-		isDisposableStage,
-		isKnownStage,
-		isProtectedStage
-	};
-};
-//#endregion
 //#region src/alchemy/credential-preflight.ts
 /**
 * Cloudflare credential preflight for an Alchemy deploy.
@@ -437,6 +331,201 @@ const credentialPreflight = async ({ accountId, environment, fetchImplementation
 	};
 };
 //#endregion
+//#region src/alchemy/stage-policy.ts
+/**
+* Stage and stack pairing, and protected-stage policy, from a project-supplied
+* table (#991).
+*
+* Two projects wrote the same three questions twice — is this stage protected,
+* is it disposable, and may this stack run it — and each answered them with its
+* own stage names hard-coded into the answer. The names differ; the questions
+* do not. This module owns the questions. A project supplies the table and gets
+* decisions back, so no project or stack name appears here.
+*
+* One stage name does appear: `local`. It names the local emulator rather than
+* any project's estate, every project spells it the same way, and the question
+* it answers — is this the emulated stage — has one answer for the whole fleet.
+* See {@link isLocalEmulationStage}.
+*
+* The disposable grammar this package already owns (`disposable-stage.ts`) is
+* available as a matcher rather than assumed, because a project's disposable
+* set is wider than that one grammar.
+*/
+/** Every stage the shared disposable grammar recognises. */
+const LOCAL_PREVIEW_STAGES = (stage) => isLocalPreviewStage(stage);
+/**
+* Test a pattern without carrying state between calls.
+*
+* A `RegExp` with `g` or `y` advances `lastIndex` on every match, so the same
+* pattern answers "yes" and then "no" for the same stage. A policy that
+* alternates is worse than one that always refuses, so a flagged pattern is
+* tested through a fresh copy whose `lastIndex` starts at zero. The copy
+* carries the complete flags: `y` anchors the match at `lastIndex`, so
+* dropping it would let `/prod/y` accept a stage named `pre-prod` that the
+* project's own pattern rejects. The caller's own `RegExp` is never written
+* to, so a frozen one still works.
+*/
+const statelessTest$1 = (pattern, stage) => pattern.global || pattern.sticky ? new RegExp(pattern.source, pattern.flags).test(stage) : pattern.test(stage);
+const stageMatches = (matcher, stage) => {
+	if (typeof matcher === "function") return matcher(stage);
+	if (Array.isArray(matcher)) return matcher.includes(stage);
+	return statelessTest$1(matcher, stage);
+};
+/** A matcher that accepts a stage any of `matchers` accepts. */
+const anyStage = (...matchers) => (stage) => matchers.some((matcher) => stageMatches(matcher, stage));
+/**
+* A policy refusal. The `code` is the stable part: a project maps it onto its
+* own lifecycle failure envelope, and the message is for a human.
+*/
+var StagePolicyError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "StagePolicyError";
+		this.code = code;
+	}
+};
+const assertTable = (table) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of table.stacks ?? []) {
+		if (!entry.stack) throw new TypeError("Every stack ownership entry needs a stack name.");
+		if (seen.has(entry.stack)) throw new TypeError(`Stack "${entry.stack}" appears twice in the stack registry.`);
+		seen.add(entry.stack);
+	}
+};
+/**
+* Is this the stage that runs against the local emulator?
+*
+* True for the literal `local` and nothing else (#991). Two projects and HQ
+* each answered this with their own rule — a refusal list, a constant, and
+* `$(whoami)` — and all three meant the same single name, so the answer is one
+* literal rather than a pattern or a table. A disposable preview stage such as
+* `local-pr-1-abcdef0` shares the prefix but runs against a real account, so it
+* is false here. The comparison is exact: no trim and no case folding, because
+* a stage name reaches Alchemy exactly as it is spelled.
+*
+* This question is deliberately outside {@link stagePolicy}: a project's table
+* classifies the stages of its own estate, and the emulated stage belongs to
+* no estate.
+*/
+const isLocalEmulationStage = (stage) => stage === "local";
+/**
+* Read a project's stage table and answer the stage questions from it.
+*
+* A stage the table classifies as both protected and disposable is a table
+* defect, not a stage a caller may act on, so every query on it throws.
+*/
+const stagePolicy = (table) => {
+	assertTable(table);
+	const classify = (stage) => {
+		const isProtected = stageMatches(table.stages.protected, stage);
+		const isDisposable = stageMatches(table.stages.disposable, stage);
+		if (isProtected && isDisposable) throw new StagePolicyError("AMBIGUOUS_STAGE", `Stage "${stage}" is declared both protected and disposable.`);
+		return {
+			isDisposable,
+			isProtected
+		};
+	};
+	const isProtectedStage = (stage) => classify(stage).isProtected;
+	const isDisposableStage = (stage) => classify(stage).isDisposable;
+	const isKnownStage = (stage) => {
+		const { isDisposable, isProtected } = classify(stage);
+		return isProtected || isDisposable;
+	};
+	const assertKnownStage = (stage) => {
+		if (!isKnownStage(stage)) throw new StagePolicyError("UNKNOWN_STAGE", `Unsupported Alchemy stage: ${stage}`);
+	};
+	const assertDestructiveStage = (stage) => {
+		assertKnownStage(stage);
+		if (isProtectedStage(stage)) throw new StagePolicyError("PROTECTED_STAGE", `Refusing destructive operation for protected stage: ${stage}`);
+	};
+	const assertStackOwnsStage = (stack, stage) => {
+		assertKnownStage(stage);
+		const registry = table.stacks;
+		if (registry === void 0) return;
+		const entry = registry.find((candidate) => candidate.stack === stack);
+		if (entry === void 0) throw new StagePolicyError("UNKNOWN_STACK", `Unsupported Alchemy stack: ${stack}`);
+		const owner = registry.find((candidate) => candidate.stack !== stack && candidate.claims !== void 0 && stageMatches(candidate.claims, stage));
+		if (owner !== void 0) throw new StagePolicyError("STAGE_NOT_OWNED", `Stage ${stage} belongs only to stack ${owner.stack}, not ${stack}.`);
+		if (entry.stages !== void 0 && !stageMatches(entry.stages, stage)) throw new StagePolicyError("STAGE_NOT_OWNED", `Stack ${stack} does not run stage ${stage}.`);
+	};
+	return {
+		assertDestructiveStage,
+		assertKnownStage,
+		assertStackOwnsStage,
+		isDisposableStage,
+		isKnownStage,
+		isProtectedStage
+	};
+};
+//#endregion
+//#region src/alchemy/local-emulation.ts
+/**
+* The child environment a local-emulation Alchemy run needs (#1168).
+*
+* Alchemy refuses to start when `CLOUDFLARE_ACCOUNT_ID` is missing or
+* malformed, even for a run that only drives the local emulator and calls no
+* Cloudflare API. Every project worked around that by handing the child a real
+* account id and a real token, so a purely local run carried live credentials.
+* This module hands it a sentinel pair instead: a well-formed account id that
+* addresses no account, and a token that is not a token.
+*
+* The helper never reads a real credential. It reads one variable — the
+* live-binding opt-in — and nothing else. The presence of a real credential in
+* the parent environment is never the signal: a developer who is logged in to
+* Cloudflare still gets the sentinel pair unless the opt-in says otherwise.
+*
+* Scrubbing an ambient token out of the child is the launcher's job, not this
+* module's. This module owns the environment shape only.
+*/
+const [ACCOUNT_ID_NAME, API_TOKEN_NAME] = HOSTED_CLOUDFLARE_CREDENTIAL_NAMES;
+/**
+* A well-formed Cloudflare account id that addresses no account.
+*
+* Alchemy validates the value against `/^[0-9a-f]{32}$/i` and rejects
+* placeholders such as `""` or `dummy` with an authentication error before any
+* run starts. The check is `validateAccountId`, in
+* `alchemy/lib/Cloudflare/Auth/AuthProvider.js` at 2.0.0-beta.76 and in
+* `alchemy/lib/Cloudflare/Auth/AuthConfig.js` at 2.0.0-beta.77. The file name
+* moves; the pattern is the same in both. Thirty-two zeros pass that shape
+* check and route to nothing.
+*/
+const SENTINEL_ACCOUNT_ID = "0".repeat(32);
+/**
+* A token that is not a token. It is spelled as words, so no secret scanner
+* reads it as a credential and no reader mistakes it for one. Any API call
+* made with it fails, which is the intended outcome: a local-emulation run
+* must reach no Cloudflare account.
+*/
+const SENTINEL_API_TOKEN = "factory-ci-local-emulation-no-cloudflare-token";
+/**
+* The one way a real credential reaches a local-emulation child. Set it to a
+* non-empty value and this helper returns no sentinel, so whatever
+* `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN` the parent carries pass
+* through untouched and the run may bind a live Cloudflare resource.
+*/
+const LIVE_BINDING_OPT_IN = "FACTORY_CI_LIVE_CLOUDFLARE_BINDING";
+/**
+* Build the Cloudflare variables a local-emulation child is launched with.
+*
+* Returns exactly two variables for the local-emulation stage, or no variables
+* when the live-binding opt-in is set. The result is an overlay: merge it over
+* the child environment the launcher has otherwise assembled.
+*
+* Throws for any other stage. A non-local stage deploys to a real account, so
+* a sentinel there would break that deploy, and returning nothing instead
+* would let a caller believe a local run was protected when it was not.
+*/
+const localEmulationEnvironment = (options) => {
+	const { environment = process.env, stage } = options;
+	if (!isLocalEmulationStage(stage)) throw new Error(`localEmulationEnvironment is only for the local-emulation stage, not "${stage}".`);
+	if ((environment[LIVE_BINDING_OPT_IN] ?? "").trim().length > 0) return {};
+	return {
+		[ACCOUNT_ID_NAME]: SENTINEL_ACCOUNT_ID,
+		[API_TOKEN_NAME]: SENTINEL_API_TOKEN
+	};
+};
+//#endregion
 //#region src/alchemy/destroy-postcondition.ts
 /**
 * Read the state store through the project's reader.
@@ -475,6 +564,370 @@ const assertDestroyLeftNothing = async ({ stack, stage, stateReader }) => {
 	if (remaining.length > 0) throw new Error(`Alchemy destroy left ${remaining.length} resource registered for ${stack} in ${stage}: ${remaining.join(", ")}`);
 };
 //#endregion
+//#region src/alchemy/plan-effects.ts
+/**
+* The plan-output adapter (#1077): the one reader of what the installed
+* Alchemy CLI prints for a plan.
+*
+* Alchemy has no structured plan output at the fleet baseline, so the plan
+* is read from the lines `formatPlanLines` in `alchemy/src/Cli/LoggingCli.ts`
+* prints: one `Plan:` summary, one `[fqn] action` line per resource, one
+* `[fqn/name] action` line per binding of that resource, and one
+* `[fqn] run|drop [action]` line per task. Paitronage and HQ each wrote this
+* reader; this is the one copy, and it is bound to the Alchemy version whose
+* renderer it reads. A consumer running a different Alchemy is refused by
+* `runAlchemyLifecycle` before any child runs, so a renderer change cannot
+* be read as a plan with different effects.
+*
+* The renderer logs every line through Effect's pretty console logger, so a
+* line arrives as `[HH:MM:SS.mmm] INFO (#1): <line>`, and coloured when the
+* child inherits `FORCE_COLOR`. Both wrappers are stripped before a line is
+* read. The captured output under `tests/fixtures/plan-output/beta-77/` is
+* the evidence for every shape this file reads.
+*
+* The adapter fails on anything it does not recognise: no summary, two
+* summaries, an action outside the known set, a summary it cannot parse, a
+* summary whose counts do not equal the lines under it, or rows the summary
+* can place in more than one way. An effect it could not account for is
+* never reported as zero.
+*
+* Two readings share that work. `parsePlanEffects` answers what the plan
+* does, which is what the lifecycle's admission rules read. `canonicalPlan`
+* answers what the plan *is*, as a stable string: the rows the renderer
+* printed and the reading of them, with the per-run logger metadata it also
+* prints left out. `firstDeployPlanHash` hashes that string, so a plan
+* reviewed at one moment and deployed at another is the same plan (#1232).
+*/
+/** The Alchemy version whose plan renderer this adapter reads. */
+const PLAN_OUTPUT_ALCHEMY_VERSION = ALCHEMY_BASELINE.alchemy;
+/**
+* Every action a resource row can carry. The first six are the actions the
+* summary counts, in the order the renderer prints them; `noop` rows print
+* under the summary but are never counted in it.
+*/
+const PLAN_ACTIONS = [
+	"create",
+	"update",
+	"adopted",
+	"replace",
+	"delete",
+	"orphaned",
+	"noop"
+];
+/** The actions the summary counts. */
+const SUMMARY_ACTIONS = PLAN_ACTIONS.filter((action) => action !== "noop");
+/** The adapter could not read the output. `reason` is the whole detail. */
+var PlanEffectsError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`Alchemy plan output was not readable: ${reason}.`);
+		this.name = "PlanEffectsError";
+		this.reason = reason;
+	}
+};
+const ACTION_SET = new Set(PLAN_ACTIONS);
+const BINDING_ACTIONS = new Set([
+	"create",
+	"noop",
+	"unbind",
+	"update"
+]);
+const TASK_ACTIONS = new Set(["drop", "run"]);
+const ansiPattern = new RegExp(`${String.fromCodePoint(27)}\\[[0-?]*[ -/]*[@-~]`, "gu");
+/**
+* The prefix Effect's pretty console logger puts before every line the
+* renderer logs. Optional, so output that was not logged through it (an
+* apply session's stack output, a scripted CLI in a test) reads the same.
+*/
+const EFFECT_LOG_PREFIX = /^\[\d{2}:\d{2}:\d{2}\.\d{3}\] (?:ALL|TRACE|DEBUG|INFO|WARN|ERROR|FATAL|NONE) \(#\d+\)(?: [^:]+)?:(?: |$)/u;
+const ROW_PATTERN = /^\[(?<tag>[^\]]+)\]\s+(?<action>\S+)/u;
+const TASK_ROW_PATTERN = /^\[(?<tag>[^\]]+)\]\s+(?<action>\S+)\s+\[action\]$/u;
+const SUMMARY_PREFIX = "Plan:";
+/** Every resource row is `noop`; there may be rows. */
+const NO_CHANGES = "Plan: no changes";
+/** The stack declares nothing and persists nothing; there are no rows. */
+const NO_RESOURCES = "Plan: no resources";
+const SUMMARY_ACTION_ITEM = /^(?<count>\d+) to (?<action>create|update|adopted|replace|delete|orphaned)$/u;
+const SUMMARY_BINDINGS_ITEM = /^(?<count>\d+) binding changes$/u;
+const SUMMARY_TASKS_ITEM = /^(?<count>\d+) tasks$/u;
+const zeroCounts = () => ({
+	adopted: 0,
+	create: 0,
+	delete: 0,
+	noop: 0,
+	orphaned: 0,
+	replace: 0,
+	update: 0
+});
+const isPlanAction = (action) => ACTION_SET.has(action);
+const isTaskAction = (action) => TASK_ACTIONS.has(action);
+/**
+* The rows under the summary, up to the first line that is not a row. An
+* apply session prints its progress after a blank line, so that line ends
+* the plan. A task row is told apart by its `[action]` suffix; a resource
+* row and a binding row are told apart by `readRows` below.
+*/
+const rowsUnder = (lines, summaryIndex) => {
+	const rows = [];
+	const tasks = [];
+	for (const line of lines.slice(summaryIndex + 1)) {
+		const task = TASK_ROW_PATTERN.exec(line)?.groups;
+		if (task?.tag !== void 0 && task.action !== void 0) {
+			if (!isTaskAction(task.action)) throw new PlanEffectsError("unknown-action");
+			tasks.push({
+				action: task.action,
+				id: task.tag
+			});
+			continue;
+		}
+		const row = ROW_PATTERN.exec(line)?.groups;
+		if (row?.tag === void 0 || row.action === void 0) break;
+		if (!(isPlanAction(row.action) || BINDING_ACTIONS.has(row.action))) throw new PlanEffectsError("unknown-action");
+		rows.push({
+			action: row.action,
+			tag: row.tag
+		});
+	}
+	return {
+		rows,
+		tasks
+	};
+};
+/**
+* The one reading of the rows as resources and bindings whose counts equal
+* the summary. No such reading is a count mismatch; two are refused as
+* ambiguous rather than guessed.
+*
+* A binding row is tagged `<resource fqn>/<name>` and printed directly under
+* its resource, so it always extends the FQN of the last resource row. A
+* resource inside a namespace is tagged the same way, and when it follows a
+* resource whose FQN is its namespace path the two rows look alike:
+* `prefix/plan.txt` under the fixtures prints `[Parent/bound] create` and
+* `[Parent/Zed] create` under `[Parent] create`. The renderer gives no other
+* evidence, so a row that extends the last resource's FQN is read both ways
+* and the summary decides: it counts resources per action and the binding
+* rows with a change, and only a reading that adds up to it survives.
+*
+* A `noop` row is counted by neither, so the summary cannot place it. Such a
+* row extending the last resource's FQN is read as a binding: a `noop` row
+* drives no decision (`runAlchemyLifecycle` reads only rows with work), and
+* a plan's bindings are far more often `noop` than its namespaced resources
+* are named after a sibling. `prefix/noop.txt` is that residual.
+*
+* The search counts readings, stopping at two, and is memoised on what the
+* rest of the rows can depend on: the position, the last resource's FQN,
+* and the `create` and `update` resources read so far (every other counted
+* row is a resource, `unbind` is a binding, and `noop` is placed by rule, so
+* those tallies follow from the position). A plan with many resources each
+* followed by rows that extend its FQN then costs the product of the row
+* count and the two tallies, not the product of the readings of each group.
+* The first reading found is kept; every branch is on a row with work, so a
+* second reading always places a row with work differently.
+*/
+const readRows = (rows, stated) => {
+	const seen = zeroCounts();
+	const resources = [];
+	let bindingChanges = 0;
+	let first;
+	const memo = /* @__PURE__ */ new Map();
+	const visit = (index, owner) => {
+		const row = rows[index];
+		if (row === void 0) {
+			if (bindingChanges !== stated.bindingChanges || SUMMARY_ACTIONS.some((action) => seen[action] !== stated.counts[action])) return 0;
+			first ??= [...resources];
+			return 1;
+		}
+		const key = JSON.stringify([
+			index,
+			owner,
+			seen.create,
+			seen.update
+		]);
+		const known = memo.get(key);
+		if (known !== void 0) return known;
+		let readings = 0;
+		const { action, tag } = row;
+		if (owner !== void 0 && tag.startsWith(`${owner}/`) && BINDING_ACTIONS.has(action)) {
+			if (action === "noop") return visit(index + 1, owner);
+			bindingChanges += 1;
+			if (bindingChanges <= stated.bindingChanges) readings += visit(index + 1, owner);
+			bindingChanges -= 1;
+		}
+		if (readings < 2 && isPlanAction(action)) {
+			seen[action] += 1;
+			resources.push({
+				action,
+				id: tag
+			});
+			if (action === "noop" || seen[action] <= stated.counts[action]) readings += visit(index + 1, tag);
+			resources.pop();
+			seen[action] -= 1;
+		}
+		const capped = Math.min(readings, 2);
+		memo.set(key, capped);
+		return capped;
+	};
+	const readings = visit(0);
+	if (first === void 0 || readings === 0) throw new PlanEffectsError("count-mismatch");
+	if (readings > 1) throw new PlanEffectsError("ambiguous-rows");
+	return {
+		bindingChanges: stated.bindingChanges,
+		resources: first
+	};
+};
+/**
+* The counts the summary states, in the order Alchemy prints them: the six
+* actions, then `N binding changes`, then `N tasks`, each only when non-zero.
+* The summary is rebuilt from what was read and must equal the line, so a
+* summary with an extra clause, a repeated part, or a different order is
+* refused instead of partially read.
+*/
+const countsStated = (summary) => {
+	const counts = zeroCounts();
+	let bindingChanges = 0;
+	let tasks = 0;
+	for (const item of summary.slice(5).trim().split(", ")) {
+		const action = SUMMARY_ACTION_ITEM.exec(item)?.groups;
+		const bindings = SUMMARY_BINDINGS_ITEM.exec(item)?.groups;
+		const taskCount = SUMMARY_TASKS_ITEM.exec(item)?.groups;
+		if (action?.action && isPlanAction(action.action)) counts[action.action] = Number(action.count);
+		else if (bindings) bindingChanges = Number(bindings.count);
+		else if (taskCount) tasks = Number(taskCount.count);
+		else throw new PlanEffectsError("summary-unrecognized");
+	}
+	const canonical = [
+		...SUMMARY_ACTIONS.filter((action) => counts[action] > 0).map((action) => `${counts[action]} to ${action}`),
+		...bindingChanges > 0 ? [`${bindingChanges} binding changes`] : [],
+		...tasks > 0 ? [`${tasks} tasks`] : []
+	].join(", ");
+	if (canonical === "" || `${SUMMARY_PREFIX} ${canonical}` !== summary) throw new PlanEffectsError("summary-unrecognized");
+	return {
+		bindingChanges,
+		counts,
+		tasks
+	};
+};
+/**
+* Split the output into the one summary line and the rows under it. This is
+* the whole of what the renderer's output is read as; `planEffects` below
+* interprets it, and `canonicalPlan` serialises it.
+*/
+const planLines = (output) => {
+	const lines = output.replaceAll(ansiPattern, "").split("\n").map((line) => line.replace(EFFECT_LOG_PREFIX, "").trim());
+	const summaryIndexes = lines.flatMap((line, index) => line.startsWith(SUMMARY_PREFIX) ? [index] : []);
+	if (summaryIndexes.length === 0) throw new PlanEffectsError("no-summary");
+	if (summaryIndexes.length > 1) throw new PlanEffectsError("multiple-summaries");
+	const summaryIndex = summaryIndexes[0] ?? 0;
+	return {
+		summary: lines[summaryIndex] ?? "",
+		...rowsUnder(lines, summaryIndex)
+	};
+};
+/** What the summary and the rows under it say the plan does. */
+const planEffects = ({ rows, summary, tasks }) => {
+	if (summary === NO_RESOURCES) {
+		if (rows.length > 0 || tasks.length > 0) throw new PlanEffectsError("effects-under-no-changes");
+		return {
+			bindingChanges: 0,
+			counts: zeroCounts(),
+			resources: [],
+			tasks: []
+		};
+	}
+	const stated = summary === NO_CHANGES ? {
+		bindingChanges: 0,
+		counts: zeroCounts(),
+		tasks: 0
+	} : countsStated(summary);
+	if (tasks.length !== stated.tasks) throw new PlanEffectsError("count-mismatch");
+	const { bindingChanges, resources } = readRows(rows, stated);
+	const counts = zeroCounts();
+	for (const { action } of resources) counts[action] += 1;
+	return {
+		bindingChanges,
+		counts,
+		resources,
+		tasks
+	};
+};
+/**
+* Read one plan from Alchemy CLI output.
+*
+* Throws `PlanEffectsError` on output the adapter cannot account for. The
+* output itself never appears in the error.
+*/
+const parsePlanEffects = (output) => planEffects(planLines(output));
+const compareText = (left, right) => {
+	if (left < right) return -1;
+	return left > right ? 1 : 0;
+};
+const compareCanonicalRows = (left, right) => compareText(left.kind, right.kind) || compareText(left.tag, right.tag) || compareText(left.action, right.action);
+const compareResources = (left, right) => compareText(left.id, right.id) || compareText(left.action, right.action);
+/**
+* The plan as a stable string: what the renderer said about the plan, with
+* what it said about the run that printed it left out.
+*
+* A plan carries no resource properties — the renderer prints a summary and
+* one `[tag] action` row per resource, binding and task, and nothing else.
+* So the canonical form is the summary line, every row under it as
+* `{ action, kind, tag }`, and the reading of those rows `parsePlanEffects`
+* arrives at (`resources` and `bindingChanges`). What is left out is the
+* logger's timestamps and fiber ids, the `Plan ready (2.9s)` duration, ANSI
+* colour, and everything after the rows: per-run facts about the process,
+* not about the plan, and hashing them is why a reviewed plan could never be
+* deployed (#1232).
+*
+* The rows and the reading each say something the other does not, so both
+* are kept:
+*
+* - Every row is kept, including binding rows and `noop` rows, because
+*   `PlanEffects` reduces bindings to a count. A binding renamed with the
+*   count unchanged is one `PlanEffects` value and two row multisets.
+* - The reading is kept because the rows alone do not say which of them are
+*   resources. A binding row and a namespaced resource row print alike —
+*   `[Parent/bound] create` and `[Parent/Zed] create` under
+*   `[Parent] create` — and only print order and the summary's counts tell
+*   them apart. Sorting the rows drops the order, so swapping those two rows
+*   is two plans creating different resources over one row multiset. The
+*   resource list the summary forces is what separates them.
+*
+* Together they pin the bindings too: the rows are the whole multiset and
+* the resources are a sub-multiset of it, so the bindings are what remains.
+*
+* Rows and resources are both sorted, keeping duplicates, because print
+* order is the renderer's traversal and authorizes nothing on its own: a
+* plan that printed the same resources and bindings in another order must
+* not read as a different plan.
+*
+* The full `parsePlanEffects` validation runs first, so anything the adapter
+* refuses is refused here too (`PlanEffectsError`). Output it cannot account
+* for is never canonicalised, and so is never authorized. `rowsUnder` stops
+* at the first line that is not a row, so a log line interleaved into the
+* rows on a chattier run drops the rows after it: an uncounted (`noop`) row
+* lost that way changes the hash, and a row with work lost that way fails
+* the summary's counts (`count-mismatch`). Either way the run is refused
+* rather than admitted on less than the plan.
+*/
+const canonicalPlan = (output) => {
+	const lines = planLines(output);
+	const { bindingChanges, resources } = planEffects(lines);
+	const rows = [...lines.rows.map(({ action, tag }) => ({
+		action,
+		kind: "row",
+		tag
+	})), ...lines.tasks.map(({ action, id }) => ({
+		action,
+		kind: "task",
+		tag: id
+	}))].toSorted(compareCanonicalRows);
+	return JSON.stringify({
+		bindingChanges,
+		resources: resources.toSorted(compareResources),
+		rows,
+		summary: lines.summary
+	});
+};
+//#endregion
 //#region src/alchemy/first-deploy-authorization.ts
 /**
 * First-deploy authorization by plan hash.
@@ -491,16 +944,51 @@ const assertDestroyLeftNothing = async ({ stack, stage, stateReader }) => {
 * with the project. This function answers one question: does this exact plan
 * appear on the list the project authorized?
 *
-* It fails closed. An empty list, a malformed list entry, an empty plan, and
-* an unlisted hash are all refusals.
+* It fails closed. An empty list, a malformed list entry, an empty plan, plan
+* output the plan adapter cannot read, and an unlisted hash are all refusals.
+*
+* What the hash binds is the plan, not the run that printed it: the summary
+* line and every row's tag and action, with the target and the reviewed
+* source. Alchemy's renderer logs each line through Effect's pretty console
+* logger and prints its own elapsed duration, so the verbatim output carries
+* a timestamp per line, a fiber id, `Plan ready (2.9s)`, and colour when the
+* child inherits `FORCE_COLOR` — all facts about one process, none about the
+* plan. Hashing them meant a reviewed plan could never be redeployed at its
+* reviewed hash (#1232), so `canonicalPlan` is hashed instead.
 */
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+/**
+* Which plan representation the payload hashes. It is part of the payload so
+* a hash can never be read as one of a different shape.
+*/
+const PLAN_HASH_FORMAT = "canonical-plan-v1";
 const HASH_PATTERN = /^[0-9a-f]{64}$/u;
 const SOURCE_SHA_PATTERN = /^[0-9a-f]{40}$/u;
 /**
-* The hash a first deploy is authorized by: the plan text, the target, and
-* the reviewed source, in one payload. The plan text is hashed before it
-* enters the payload so the value that is compared never embeds plan output.
+* The hash a first deploy is authorized by: the plan, the target, and the
+* reviewed source, in one payload.
+*
+* The plan enters the payload as the sha256 of `canonicalPlan`, so the value
+* that is compared never embeds plan output, and two runs of one plan agree.
+* Bound: the summary line, every row's tag and action (resource, binding and
+* task rows alike, `noop` included), which of those rows are resources and
+* which are bindings, the stack, the stage, and the source SHA. Not bound:
+* logger timestamps and fiber ids, the run's elapsed durations, ANSI colour,
+* progress lines, and the order the rows were printed in.
+*
+* Row order is not bound but the reading of the rows is, because they are
+* not the same fact. Order alone used to carry which rows are a resource's
+* bindings and which are resources inside its namespace; the canonical form
+* states that outright, so two plans creating different resources can never
+* agree merely by printing one multiset of rows two ways.
+*
+* `planFormat` names that shape. A hash issued by an earlier version of this
+* function, which hashed the verbatim output, can never equal one issued
+* now — those hashes were not reproducible in the first place, so they
+* authorized nothing that could be deployed.
+*
+* Throws a `PlanEffectsError` when the plan adapter cannot account for the
+* output: an unreadable plan is refused, never hashed.
 */
 const firstDeployPlanHash = ({ planText, sourceSha, stack, stage }) => {
 	if (!(stack.trim() && stage.trim())) throw new Error("First-deploy authorization requires a stack and a stage.");
@@ -510,7 +998,8 @@ const firstDeployPlanHash = ({ planText, sourceSha, stack, stage }) => {
 	if (!planText.isWellFormed()) throw new Error("First-deploy authorization requires well-formed plan output.");
 	return sha256(JSON.stringify({
 		operation: "deploy",
-		planTextSha256: sha256(planText),
+		planFormat: PLAN_HASH_FORMAT,
+		planSha256: sha256(canonicalPlan(planText)),
 		sourceSha,
 		stack,
 		stage
@@ -775,121 +1264,108 @@ var AlchemyLifecycleError = class extends Error {
 };
 const isAlchemyLifecycleError = (error) => error instanceof AlchemyLifecycleError;
 //#endregion
-//#region src/alchemy/plan-effects.ts
+//#region src/alchemy/state-tree.ts
 /**
-* The plan-output adapter (#1077): the one reader of what the installed
-* Alchemy CLI prints for a plan.
+* One read and delete surface over a state layer.
 *
-* Alchemy has no structured plan output at the fleet baseline, so the plan
-* is read from the lines `formatPlanLines` in `alchemy/src/Cli/LoggingCli.ts`
-* prints: one `Plan:` summary and one `[id] action` line per resource.
-* Paitronage and HQ each wrote this reader; this is the one copy, and it is
-* bound to the Alchemy version whose renderer it reads. A consumer running a
-* different Alchemy is refused by `runAlchemyLifecycle` before any child
-* runs, so a renderer change cannot be read as a plan with different effects.
+* Alchemy's `State/Tree` module answers "which `(stack, stage)` pairs does
+* this store hold" and "remove one stage" against the `State` service
+* interface, so it works over any state layer a consumer configured,
+* including `@patronage/alchemy-d1-state`. This module is the typed entry to
+* those two operations plus the record read, and it launches no child
+* process: every answer comes from the state layer the caller passes in.
 *
-* The adapter fails on anything it does not recognise: no summary, two
-* summaries, an action outside the known set, a summary it cannot parse, or
-* a summary whose counts do not equal the lines under it. An effect it could
-* not account for is never reported as zero.
+* The caller owns the state layer and the policy. This module owns the
+* address: a `(stack, stage)` pair is one stack and one stage, and nothing
+* else. `Tree` addresses a stage by the path `stack/stage`, so an empty or
+* padded stage collapses that path to the stack and a delete meant for one
+* stage removes every stage of the stack. `assertStageAddress` refuses those
+* inputs before any path is built.
+*
+* Which stages a consumer may delete stays with the consumer: this module
+* deletes the stage it is given.
 */
-/** The Alchemy version whose plan renderer this adapter reads. */
-const PLAN_OUTPUT_ALCHEMY_VERSION = ALCHEMY_BASELINE.alchemy;
-const PLAN_ACTIONS = [
-	"create",
-	"update",
-	"replace",
-	"delete",
-	"noop"
-];
-/** The adapter could not read the output. `reason` is the whole detail. */
-var PlanEffectsError = class extends Error {
-	reason;
-	constructor(reason) {
-		super(`Alchemy plan output was not readable: ${reason}.`);
-		this.name = "PlanEffectsError";
-		this.reason = reason;
-	}
-};
-const ACTION_SET = new Set(PLAN_ACTIONS);
-const ansiPattern = new RegExp(`${String.fromCodePoint(27)}\\[[0-?]*[ -/]*[@-~]`, "gu");
-const ROW_PATTERN = /^\[(?<tag>[^\]]+)\]\s+(?<action>\S+)/u;
-const SUMMARY_PREFIX = "Plan:";
-const NO_CHANGES = "Plan: no changes";
-const SUMMARY_ITEM = /^(?<count>\d+) to (?<action>create|update|replace|delete|noop)$/u;
-const zeroCounts = () => ({
-	create: 0,
-	delete: 0,
-	noop: 0,
-	replace: 0,
-	update: 0
-});
-const isPlanAction = (action) => ACTION_SET.has(action);
-/** The rows under the summary, up to the first line that is not a row. */
-const rowsUnder = (lines, summaryIndex) => {
-	const rows = [];
-	for (const line of lines.slice(summaryIndex + 1)) {
-		const match = ROW_PATTERN.exec(line);
-		if (match?.groups === void 0) break;
-		const { action, tag } = match.groups;
-		if (action === void 0 || tag === void 0 || !isPlanAction(action)) throw new PlanEffectsError("unknown-action");
-		if (!tag.includes("/")) rows.push({
-			action,
-			id: tag
-		});
-	}
-	return rows;
+const isRecord$1 = (value) => typeof value === "object" && value !== null;
+/**
+* Refuse a stack or stage name that does not address exactly one scope.
+*
+* `Tree` splits a path on `/` and drops empty and `.` segments, so `""`,
+* `"."`, a padded name and a name holding a separator all address something
+* other than the one stage the caller named. A stage read from an
+* environment variable carries a trailing newline often enough to matter.
+*/
+const assertStageAddress = (field, value) => {
+	if (value !== value.trim() || value === "") throw new Error(`A state ${field} must be a non-empty name with no surrounding whitespace.`);
+	if (value.includes("/") || value === "." || value === "..") throw new Error(`A state ${field} must name one scope: '/', '.' and '..' are not allowed.`);
 };
+/** Run one `Tree` effect over the caller's state layer. */
+const overState = (state, effect) => Effect.runPromise(Effect.provideService(effect, State, Effect.succeed(state)));
 /**
-* The counts the summary states, in the order Alchemy prints them. The
-* summary is rebuilt from what was read and must equal the line, so a
-* summary with an extra clause, a repeated action, or a different order is
-* refused instead of partially read.
+* Every `(stack, stage)` pair the state layer holds, or the subset a filter
+* pins. Ordered by stack then stage.
+*
+* The pairs come from the store's own `listStacks` and `listStages`, so an
+* empty result is the store reporting nothing, never a read this module
+* could not make: a state layer that cannot be read fails instead.
 */
-const countsStated = (summary) => {
-	const counts = zeroCounts();
-	const stated = [];
-	for (const item of summary.slice(5).trim().split(", ")) {
-		const match = SUMMARY_ITEM.exec(item);
-		const action = match?.groups?.action;
-		const count = Number(match?.groups?.count);
-		if (action === void 0 || !isPlanAction(action) || !Number.isSafeInteger(count) || stated.includes(action)) throw new PlanEffectsError("summary-unrecognized");
-		counts[action] = count;
-		stated.push(action);
-	}
-	const canonical = PLAN_ACTIONS.filter((action) => counts[action] > 0).map((action) => `${counts[action]} to ${action}`).join(", ");
-	if (stated.length === 0 || `${SUMMARY_PREFIX} ${canonical}` !== summary) throw new PlanEffectsError("summary-unrecognized");
-	return counts;
+const inventoryStages = async (state, filter = {}) => {
+	if (filter.stack !== void 0) assertStageAddress("stack", filter.stack);
+	if (filter.stage !== void 0) assertStageAddress("stage", filter.stage);
+	return (await overState(state, allStages(filter))).map(({ stack, stage }) => ({
+		stack,
+		stage
+	}));
 };
 /**
-* Read one plan from Alchemy CLI output.
+* The persisted-state document for one stage, as `parseStateSnapshot` reads
+* it: `{ resources: [{ stack, stage, fqn, state }] }`, ordered by fqn.
 *
-* Throws `PlanEffectsError` on output the adapter cannot account for. The
-* output itself never appears in the error.
+* The read is the one `runAlchemyLifecycle` already makes — the atomic stage
+* view, then each listed resource record — so a caller holding the document
+* and a caller holding the lifecycle see the same records. A listed resource
+* with no readable record fails the read; it is never left out, because a
+* short document reads as a stage with less in it than it has.
+*
+* A stage the store does not hold reads as a document with no resource in
+* it, the same reading the lifecycle takes for a first deploy. Only a stage
+* the store cannot read fails. `deleteStageRows` answers an absent stage the
+* other way, because it addresses a path rather than a stage view.
 */
-const parsePlanEffects = (output) => {
-	const lines = output.replaceAll(ansiPattern, "").split("\n").map((line) => line.trim());
-	const summaryIndexes = lines.flatMap((line, index) => line.startsWith(SUMMARY_PREFIX) ? [index] : []);
-	if (summaryIndexes.length === 0) throw new PlanEffectsError("no-summary");
-	if (summaryIndexes.length > 1) throw new PlanEffectsError("multiple-summaries");
-	const summaryIndex = summaryIndexes[0] ?? 0;
-	const summary = lines[summaryIndex] ?? "";
-	const resources = rowsUnder(lines, summaryIndex);
-	if (summary === NO_CHANGES) {
-		if (resources.length > 0) throw new PlanEffectsError("effects-under-no-changes");
-		return {
-			counts: zeroCounts(),
-			resources
-		};
-	}
-	const counts = countsStated(summary);
-	const seen = zeroCounts();
-	for (const { action } of resources) seen[action] += 1;
-	if (PLAN_ACTIONS.some((action) => seen[action] !== counts[action])) throw new PlanEffectsError("count-mismatch");
-	return {
-		counts,
-		resources
+const readStageSnapshot = async (state, target) => {
+	assertStageAddress("stack", target.stack);
+	assertStageAddress("stage", target.stage);
+	const scope = {
+		stack: target.stack,
+		stage: target.stage
 	};
+	const view = await Effect.runPromise(state.snapshotStage(scope));
+	if (!Array.isArray(view.resources) || view.resources.some((fqn) => typeof fqn !== "string" || fqn === "")) throw new Error(`The state layer returned no resource list for ${target.stack} in ${target.stage}.`);
+	const resources = await Promise.all([...view.resources].toSorted().map(async (fqn) => ({
+		...scope,
+		fqn,
+		state: await Effect.runPromise(state.get({
+			...scope,
+			fqn
+		}))
+	})));
+	if (resources.some((resource) => !isRecord$1(resource.state))) throw new Error(`The state layer listed a resource it could not read for ${target.stack} in ${target.stage}.`);
+	return JSON.stringify({ resources });
+};
+/**
+* Remove every row the state layer holds for one stage. Other stages of the
+* same stack keep every row.
+*
+* A stage the store does not hold is refused by the state layer rather than
+* reported as removed, so a caller never reads a mistyped stage as a stage
+* that was already empty.
+*/
+const deleteStageRows = async (state, target) => {
+	assertStageAddress("stack", target.stack);
+	assertStageAddress("stage", target.stage);
+	await overState(state, deleteState({
+		path: `${target.stack}/${target.stage}`,
+		recursive: true
+	}));
 };
 //#endregion
 //#region src/alchemy/lifecycle.ts
@@ -962,25 +1438,26 @@ const persistedToSnapshot = (target, persisted) => ({ resources: persisted.resou
 */
 const IN_FLIGHT_STATUSES = new Set(["creating", "deleting"]);
 const statusOf = (record) => isRecord(record.state) ? record.state.status : void 0;
-/** The leaf of a persisted FQN: what Alchemy prints as a plan row's tag. */
-const leafOf = (fqn) => fqn.slice(fqn.lastIndexOf("/") + 1);
 /**
-* Resolve plan rows, which carry Alchemy's rendered logical id, onto
-* persisted FQNs. A rendered id is not an identity: `old/Worker` and
-* `new/Worker` both print as `[Worker]`. A row resolves only when exactly one
-* candidate FQN has that leaf; zero or several is `undefined`, and the
-* caller refuses rather than guessing.
+* Resolve plan rows onto persisted FQNs. A row's `id` is the FQN Alchemy
+* printed in its tag, which is the identity the resource is persisted under
+* (epic #1165, D1), so a row resolves only to the candidate that is that
+* FQN exactly. A row with no candidate is `undefined`, and the caller
+* refuses rather than guessing.
 */
 const resolveRows = (rows, candidates) => {
 	const resolved = [];
 	for (const { id } of rows) {
-		const matches = candidates.filter((fqn) => leafOf(fqn) === id);
-		if (matches.length !== 1 || matches[0] === void 0) return;
-		resolved.push(matches[0]);
+		if (!candidates.includes(id)) return;
+		resolved.push(id);
 	}
 	return resolved;
 };
-/** A plan whose rows print one id twice cannot name its resources. */
+/**
+* Two rows with one FQN name one persisted identity twice. Alchemy keys a
+* plan by FQN, so its renderer cannot print this; output that does is not a
+* plan this operation can bind to, and is refused rather than read.
+*/
 const hasRepeatedIds = (effects) => new Set(effects.resources.map(({ id }) => id)).size !== effects.resources.length;
 /** Whether a lease still fences the stage, by the store's own fenced renewal. */
 const fenceState = async (lease) => {
@@ -1180,9 +1657,6 @@ var LifecycleRun = class {
 			resources: records
 		};
 	}
-	profileArgs() {
-		return this.policy.profile === void 0 ? [] : ["--profile", this.policy.profile];
-	}
 	stageArgs() {
 		return ["--stage", this.request.stage];
 	}
@@ -1232,7 +1706,6 @@ var LifecycleRun = class {
 			"deploy",
 			"--dry-run",
 			...adopt ? ["--adopt"] : [],
-			...this.profileArgs(),
 			...this.stageArgs()
 		];
 	}
@@ -1296,7 +1769,7 @@ var LifecycleRun = class {
 		};
 	}
 	admitFirstDeploy(effects, text) {
-		if (effects.counts.update + effects.counts.replace + effects.counts.delete > 0) throw this.fail("EFFECT_NOT_PERMITTED", "admission");
+		if (effects.counts.update + effects.counts.replace + effects.counts.delete + effects.counts.orphaned > 0) throw this.fail("EFFECT_NOT_PERMITTED", "admission");
 		const planHash = this.planHashOf(text);
 		const { firstDeploy } = this.policy;
 		if (firstDeploy === void 0 || planHash === void 0) throw this.fail("FIRST_DEPLOY_UNAUTHORIZED", "admission");
@@ -1336,7 +1809,7 @@ var LifecycleRun = class {
 			return;
 		}
 		if (!isProtected) return;
-		if (effects.counts.replace + effects.counts.delete > 0) throw this.fail("EFFECT_NOT_PERMITTED", "admission");
+		if (effects.counts.replace + effects.counts.delete + effects.counts.orphaned > 0) throw this.fail("EFFECT_NOT_PERMITTED", "admission");
 		this.assertRetained(persistedToSnapshot(this.target, before), void 0, "admission");
 	}
 	/**
@@ -1348,14 +1821,11 @@ var LifecycleRun = class {
 	* FQN, and that recovery is the ordinary accident this operation exists
 	* for.
 	*
-	* A plan row carries Alchemy's rendered logical id and no namespace, so
-	* the only FQN a row names exactly is a top-level one, where
-	* `toFqn(undefined, id) === id`. That equality cannot collide. An
-	* in-flight record under a namespace (`other/Worker`) is not the FQN a
-	* `[Worker]` row names, so it never qualifies as a recovery, even when its
-	* leaf matches; a nested recovery is therefore refused rather than
-	* guessed. Zero candidates is a create that did not happen; several is an
-	* identity the plan cannot name.
+	* A plan row carries the resource's FQN, so a row names one persisted
+	* identity exactly, under any namespace. An in-flight record at another
+	* FQN (`other/Worker` for a `[Worker]` row) is not the one the row names,
+	* so it never qualifies as a recovery. No candidate is a create that did
+	* not happen.
 	*/
 	createdFqns(before, after, effects) {
 		const planned = effects.resources.filter(({ action }) => action === "create");
@@ -1368,6 +1838,8 @@ var LifecycleRun = class {
 	}
 	assertConverged(effects, after) {
 		const tolerated = new Set(this.policy.nonConvergentResources);
+		if (effects.bindingChanges > 0) throw this.fail("NOT_CONVERGED", "postcondition");
+		if (effects.tasks.length > 0) throw this.fail("NOT_CONVERGED", "postcondition");
 		const pending = effects.resources.filter(({ action }) => action !== "noop");
 		const fqns = resolveRows(pending, after.resources.map(({ fqn }) => fqn));
 		if (fqns === void 0) throw this.fail("NOT_CONVERGED", "postcondition");
@@ -1382,7 +1854,6 @@ var LifecycleRun = class {
 			await this.runChild("deploy", [
 				"deploy",
 				...adopt ? ["--adopt"] : [],
-				...this.profileArgs(),
 				...this.stageArgs(),
 				"--yes"
 			], lease);
@@ -1415,7 +1886,6 @@ var LifecycleRun = class {
 		const { cleanup, effects } = await this.withLease("state", "postcondition", async (lease, accept) => {
 			const text = await this.runChild("destroy", [
 				"destroy",
-				...this.profileArgs(),
 				...this.stageArgs(),
 				"--yes"
 			], lease);
@@ -1457,7 +1927,8 @@ var LifecycleRun = class {
 * apply child, then the persisted state again: it must record what the plan
 * created and, on a protected stage, the same identities as before. Then a
 * second dry-run plan, which must be a no-op except an `update` on a resource
-* the policy names non-convergent.
+* the policy names non-convergent. A binding change or a task row in that
+* plan is work left behind, and no policy tolerates it.
 *
 * `destroy`: refused on a protected stage. Then, under the stage lease, the
 * destroy child, then the atomic stage view must be empty and the empty
@@ -1505,4 +1976,4 @@ const runAlchemyLifecycle = async (options) => {
 /** The specifier a consumer imports this surface by. */
 const ALCHEMY_SUBPATH = "@patronage/factory-ci/alchemy";
 //#endregion
-export { ALCHEMY_SUBPATH, AlchemyLifecycleError, CloudflareCredentialUnavailableError, HOSTED_CLOUDFLARE_CREDENTIAL_NAMES, LIFECYCLE_FAILURE_MESSAGES, LOCAL_PREVIEW_STAGES, MINIMUM_REDACTABLE_SECRET_LENGTH, PLAN_ACTIONS, PLAN_OUTPUT_ALCHEMY_VERSION, PlanEffectsError, RetainedIdentityError, SECRET_REDACTION_PLACEHOLDER, StagePolicyError, UrlImpliesAuthError, anyStage, assertDestroyLeftNothing, assertRetainedIdentities, assertUrlImpliesAuth, credentialPreflight, evaluateStack, firstDeployAuthorization, firstDeployPlanHash, isAlchemyLifecycleError, parsePlanEffects, parseStateSnapshot, runAlchemyLifecycle, secretNamePolicy, stagePolicy };
+export { ALCHEMY_SUBPATH, AlchemyLifecycleError, CloudflareCredentialUnavailableError, HOSTED_CLOUDFLARE_CREDENTIAL_NAMES, LIFECYCLE_FAILURE_MESSAGES, LOCAL_PREVIEW_STAGES, MINIMUM_REDACTABLE_SECRET_LENGTH, PLAN_ACTIONS, PLAN_OUTPUT_ALCHEMY_VERSION, PlanEffectsError, RetainedIdentityError, SECRET_REDACTION_PLACEHOLDER, StagePolicyError, UrlImpliesAuthError, anyStage, assertDestroyLeftNothing, assertRetainedIdentities, assertUrlImpliesAuth, credentialPreflight, deleteStageRows, evaluateStack, firstDeployAuthorization, firstDeployPlanHash, inventoryStages, isAlchemyLifecycleError, isLocalEmulationStage, localEmulationEnvironment, parsePlanEffects, parseStateSnapshot, readStageSnapshot, runAlchemyLifecycle, secretNamePolicy, stagePolicy };