alchemy 2.0.0-beta.64 → 2.0.0-beta.66

package/lib/Apply.js

@@ -1,4 +1,5 @@
 import * as Cause from "effect/Cause";
+import * as Data from "effect/Data";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
@@ -10,9 +11,8 @@ import { Cli, } from "./Cli/Cli.js";
 import { havePropsChanged, stripUnresolved } from "./Diff.js";
 import { generateInstanceId, InstanceId } from "./InstanceId.js";
 import * as Output from "./Output.js";
-import * as Data from "effect/Data";
 import {} from "./Plan.js";
-import { missingProviderError, tryFindProviderByType } from "./Provider.js";
+import { findProviderByType, missingProviderError, tryFindProviderByType, } from "./Provider.js";
 import { Stack } from "./Stack.js";
 import { Stage } from "./Stage.js";
 import { State, StateStoreError, } from "./State/index.js";
@@ -55,6 +55,15 @@ export const apply = (plan) => Effect.gen(function* () {
     yield* converge(plan, tracker, terminalStatuses, session, state, stackName, stage);
     yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ id, type, status }) => session.emit({ kind: "status-change", id, type, status }), { concurrency: "unbounded" });
     yield* session.done();
+    if (plan.destroy) {
+        // The destroy converged: every resource row was deleted above. Drop
+        // the rest of the stage's persisted state — notably the stack output
+        // record written by the last deploy — so `getOutput` returns
+        // undefined and `listStages` no longer reports the stage.
+        // https://github.com/alchemy-run/alchemy/issues/961
+        yield* state.deleteStack({ stack: stackName, stage });
+        return undefined;
+    }
     if (!plan.output) {
         return undefined;
     }
@@ -236,6 +245,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                 resourceType: node.resource.Type,
                 bindings: excludeDeletedBindings(node.bindings),
                 removalPolicy: node.resource.RemovalPolicy,
+                providerMode: node.mode,
             });
             return id;
         }
@@ -261,6 +271,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                 old: node.state,
                 deleteFirst: node.deleteFirst,
                 removalPolicy: node.resource.RemovalPolicy,
+                providerMode: node.mode,
             });
             return id;
         }
@@ -289,6 +300,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     bindings: excludeDeletedBindings(node.bindings),
                     downstream: node.downstream,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             }
             let attr = node.state?.attr;
@@ -328,6 +340,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     bindings: excludeDeletedBindings(node.bindings),
                     downstream: node.downstream,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
                 yield* storeAndSignal({
                     output: attr,
@@ -378,6 +391,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                 providerVersion: node.provider.version ?? 0,
                 downstream: node.downstream,
                 removalPolicy: node.resource.RemovalPolicy,
+                providerMode: node.mode,
             });
             tracker[fqn] = {
                 output: attr,
@@ -418,6 +432,8 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
             yield* waitForDeps(allUpstreamFqns());
             const outputs = getOutputs();
             const news = (yield* Output.evaluate(node.props, outputs));
+            const adopting = node.adopting === true ||
+                (node.state.status === "updating" && node.state.adopting === true);
             yield* node.state.status === "replaced"
                 ? commit({
                     // Keep the replacement wrapper intact while changing the live
@@ -425,6 +441,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     ...node.state,
                     attr: node.state.attr,
                     props: news,
+                    providerMode: node.mode,
                 })
                 : commit({
                     // For ordinary updates we snapshot the previously stable props/attrs
@@ -440,14 +457,18 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     bindings: excludeDeletedBindings(node.bindings),
                     downstream: node.downstream,
                     old: node.state.status === "updating" ? node.state.old : node.state,
+                    adopting: adopting ? true : undefined,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             yield* report("updating");
-            const previousProps = node.state.status === "created" ||
-                node.state.status === "updated" ||
-                node.state.status === "replaced"
-                ? node.state.props
-                : node.state.old.props;
+            const previousProps = adopting
+                ? undefined
+                : node.state.status === "created" ||
+                    node.state.status === "updated" ||
+                    node.state.status === "replaced"
+                    ? node.state.props
+                    : node.state.old.props;
             // Providers receive the resolved binding payload for this exact pass, while
             // `previousProps` tells them what state the live resource is being updated from.
             const bindingOutputs = excludeDeletedBindings(yield* Output.evaluate(node.bindings, outputs));
@@ -470,6 +491,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     ...node.state,
                     attr,
                     props: news,
+                    providerMode: node.mode,
                 });
             }
             else {
@@ -486,6 +508,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     providerVersion: node.provider.version ?? 0,
                     downstream: node.downstream,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             }
             tracker[fqn] = {
@@ -536,6 +559,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     old: node.state,
                     downstream: node.downstream,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             }
             else {
@@ -560,7 +584,14 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
             const deleteOldGenerations = (old) => Effect.gen(function* () {
                 const retain = node.resource.RemovalPolicy === "retain";
                 if (old.attr !== undefined && !retain) {
-                    yield* node.provider
+                    // Delete each old generation with the provider variant of the
+                    // mode that created it — after a local ⇄ live switch,
+                    // `node.provider` (the new mode) cannot tear down the other
+                    // runtime's instance. `providerMode: undefined` (legacy row or
+                    // mode-agnostic provider) resolves to the provider as
+                    // registered.
+                    const oldProvider = yield* findProviderByType(node.resource.Type, old.providerMode);
+                    yield* oldProvider
                         .delete({
                         id: logicalId,
                         fqn,
@@ -617,6 +648,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     old: replState.old,
                     deleteFirst: node.deleteFirst,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
                 yield* storeAndSignal({
                     output: attr,
@@ -664,6 +696,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     bindings: bindingOutputs,
                     downstream: node.downstream,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             }
             else {
@@ -686,6 +719,7 @@ const executeNode = (fqn, node, tracker, ready, readyStable, terminalStatuses, s
                     old: replState.old,
                     deleteFirst: node.deleteFirst,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 });
             }
             tracker[fqn] = {
@@ -938,6 +972,7 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
                     downstream: node.downstream,
                     namespace,
                     removalPolicy: node.resource.RemovalPolicy,
+                    providerMode: node.mode,
                 },
             });
             terminalStatuses.set(fqn, {
@@ -1013,26 +1048,30 @@ const converge = Effect.fn(function* (plan, tracker, terminalStatuses, session,
             break;
     }
 });
-// ── Phase 2: delete orphans and old replaced resources ─────────────────────
 /**
- * Internal marker: this node's deletion was skipped because a DEPENDENT
- * resource (one that still references it) failed to delete. The dependent's
- * own failure is already recorded in the GC failure list, so nodes failing
- * with ONLY this marker are not re-recorded — they just keep their state so
- * the next destroy retries the whole chain.
+ * Aggregate raised at the end of the deletion phase when one or more
+ * resource deletes failed. Every resource whose delete did not depend on a
+ * failed one was still attempted — a single failure no longer strands
+ * unrelated siblings.
  */
-class DependentDeletionFailed extends Data.TaggedError("DependentDeletionFailed") {
+export class DestroyError extends Data.TaggedError("DestroyError") {
+    get message() {
+        return [
+            `Failed to delete ${this.failures.length} resource(s)` +
+                (this.blocked.length > 0
+                    ? ` (${this.blocked.length} more skipped because a dependent's delete failed)`
+                    : "") +
+                ":",
+            ...this.failures.map((f) => `  ✗ ${f.fqn} (${f.resourceType}): ${Cause.pretty(f.cause)}`),
+            ...this.blocked.map((b) => `  ⊘ ${b.fqn} (${b.resourceType}): skipped — blocked by failed delete of ${b.blockedBy.join(", ")}`),
+        ].join("\n");
+    }
 }
 const collectGarbage = Effect.fn(function* (plan, session) {
     const state = yield* yield* State;
     const stack = yield* Stack;
     const stackName = stack.name;
     const stage = yield* Stage;
-    // GC failures are aggregated, never fail-fast: one resource that refuses
-    // to delete must not interrupt sibling deletions mid-flight (which would
-    // leave THEIR physical resources behind too). Every deletable resource is
-    // deleted, then the combined cause is raised at the end.
-    const failures = [];
     // Task deletions are pure state drops — no body is invoked. Run them in
     // parallel before resource GC; tasks never have provider-side dependencies
     // to wait on.
@@ -1053,11 +1092,19 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                 status: "deleted",
             });
         })), { concurrency: "unbounded" });
+    // Failures are collected — not propagated — so one bad delete never
+    // strands unrelated siblings. `unresolved` tracks every FQN whose delete
+    // failed or was blocked this run: later passes must not retry them (a
+    // still-`replaced` row would otherwise spin the drain loop forever) and
+    // dependencies scheduled in later passes must observe them as blocking.
+    const failures = [];
+    const blockedDeletes = [];
+    const unresolved = new Set();
     const deleteGraph = Effect.fn(function* (deletionGraph) {
         const deletions = {};
         const deleteResource = (node, ancestors = new Set()) => Effect.gen(function* () {
             const isDeleteNode = (node) => "action" in node;
-            const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider, } = isDeleteNode(node)
+            const { fqn, logicalId, namespace, resourceType, instanceId, downstream, props, attr: persistedAttr, provider, providerMode, } = isDeleteNode(node)
                 ? {
                     // Use the persisted FQN verbatim — never recompute it from
                     // `toFqn(namespace, logicalId)`. A logical ID may legitimately
@@ -1073,7 +1120,10 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                     downstream: node.downstream,
                     props: node.state.props,
                     attr: node.state.attr,
+                    // Plan resolved this provider for the row's persisted
+                    // `providerMode` (see the deletions builder in Plan.ts).
                     provider: node.provider,
+                    providerMode: node.state.providerMode,
                 }
                 : {
                     fqn: node.fqn,
@@ -1086,11 +1136,14 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                     attr: node.old.attr,
                     // A missing provider is fatal — plan already dies on zombie
                     // rows (see the deletions builder in Plan.ts); this guards
-                    // the replaced-chain generations that bypass plan.
-                    provider: yield* tryFindProviderByType(node.old.resourceType).pipe(Effect.flatMap(Option.match({
+                    // the replaced-chain generations that bypass plan. The old
+                    // generation is torn down with the provider variant of the
+                    // mode that created it (local ⇄ live replacements).
+                    provider: yield* tryFindProviderByType(node.old.resourceType, node.old.providerMode).pipe(Effect.flatMap(Option.match({
                         onNone: () => Effect.die(missingProviderError(node.old.resourceType, node.fqn)),
                         onSome: Effect.succeed,
                     }))),
+                    providerMode: node.old.providerMode,
                 };
             // Mutable: an attr-less row (interrupted create) may recover its
             // attributes from `provider.read` below, right before deletion.
@@ -1124,196 +1177,222 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                 }),
             };
             return yield* (deletions[fqn] ??= yield* Effect.cached(Effect.gen(function* () {
-                // Dependents (downstream) delete first. When one of them fails,
-                // this resource cannot safely be deleted this pass — its
-                // physical delete would hit a dependency violation. Replace the
-                // propagated cause with the DependentDeletionFailed marker so
-                // the catch below skips the delete WITHOUT re-recording the
-                // dependent's failure (it already recorded itself).
-                yield* Effect.all(downstream.map((dep) => dep !== fqn && dep in deletionGraph && !ancestors.has(dep)
-                    ? deleteResource(deletionGraph[dep], nextAncestors)
-                    : Effect.void), { concurrency: "unbounded" }).pipe(Effect.catchCause(() => Effect.fail(new DependentDeletionFailed({ fqn }))));
-                if (isDeleteNode(node)) {
-                    yield* report("deleting");
-                    if (node.resource.RemovalPolicy === "retain") {
-                        yield* state.delete({
-                            stack: stackName,
-                            stage,
-                            fqn,
-                        });
-                        yield* report("retained");
-                        return;
-                    }
-                }
-                // Honor `retain` for the old generation of a replacement, mirroring
-                // the orphan-delete path above. Delete-node retain is already
-                // handled with an early return; this guards the replaced
-                // old-generation physical delete.
-                const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
-                if (retainOldGeneration) {
-                    yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
-                }
-                // A row can reach deletion with `attr === undefined` when a create
-                // was interrupted after the cloud-side call succeeded but before
-                // `reconcile` returned Attributes (a `creating` row — or the old
-                // generation of a replacement chain in the same predicament).
-                // Skipping the provider's delete outright would silently orphan
-                // the physical resource, so ask `read` to look it up from the
-                // persisted props (providers derive the deterministic physical
-                // name from id/props):
-                //   - plain attrs    → exists and is ours; proceed to delete
-                //   - Unowned(attrs) → exists but is NOT ours (e.g. our create
-                //                      actually lost a name race, or died before
-                //                      stamping ownership) — never delete a
-                //                      foreign resource; drop our state and say so
-                //   - undefined      → nothing exists; dropping state is safe
-                if (attr === undefined && !retainOldGeneration) {
-                    if (provider.read) {
-                        const recovered = yield* provider
-                            .read({
-                            id: logicalId,
-                            fqn,
-                            instanceId,
-                            olds: props,
-                            output: undefined,
-                        })
-                            .pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
-                        if (recovered !== undefined) {
-                            if (Unowned.is(recovered)) {
-                                yield* scopedSession.note("Resource exists in the cloud but is not owned by this " +
-                                    "stack — leaving it in place (re-deploy with --adopt " +
-                                    "to take ownership, then destroy).");
-                            }
-                            else {
-                                attr = stripUnowned(recovered);
-                            }
-                        }
-                    }
-                    else {
-                        yield* scopedSession.note("No attributes were recorded for this resource (its create " +
-                            "was interrupted) and the provider does not implement " +
-                            "`read` — if a physical resource was created, it must be " +
-                            "cleaned up manually.");
-                    }
-                }
-                if (isDeleteNode(node)) {
-                    yield* commit({
-                        status: "deleting",
+                // Dependents (`downstream`) are deleted before this resource. A
+                // dependent whose delete failed (or was itself blocked) may make
+                // this resource legitimately undeletable (dependency violation),
+                // so it is skipped with a "blocked by" note instead of surfacing
+                // a spurious second error.
+                const dependents = yield* Effect.all(downstream.map((dep) => dep !== fqn && !ancestors.has(dep)
+                    ? dep in deletionGraph
+                        ? deleteResource(deletionGraph[dep], nextAncestors).pipe(Effect.map((outcome) => ({ dep, outcome })))
+                        : // Not in this pass's graph — but it may have failed in
+                            // an earlier drain pass of the same destroy.
+                            Effect.sync(() => ({
+                                dep,
+                                outcome: unresolved.has(dep)
+                                    ? "failed"
+                                    : "deleted",
+                            }))
+                    : Effect.succeed({ dep, outcome: "deleted" })), { concurrency: "unbounded" });
+                const blockedBy = dependents
+                    .filter(({ outcome }) => outcome !== "deleted")
+                    .map(({ dep }) => dep);
+                if (blockedBy.length > 0) {
+                    unresolved.add(fqn);
+                    blockedDeletes.push({
                         fqn,
                         logicalId,
-                        instanceId,
                         resourceType,
-                        props,
-                        attr,
-                        downstream,
-                        providerVersion: provider.version ?? 0,
-                        bindings: excludeDeletedBindings(node.bindings),
-                        removalPolicy: node.resource.RemovalPolicy,
-                    });
-                }
-                if (attr !== undefined && !retainOldGeneration) {
-                    yield* provider
-                        .delete({
-                        id: logicalId,
-                        fqn,
-                        instanceId,
-                        olds: props,
-                        output: attr,
-                        session: scopedSession,
-                        bindings: [],
-                    })
-                        .pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
-                }
-                if (isDeleteNode(node)) {
-                    yield* state.delete({
-                        stack: stackName,
-                        stage,
-                        fqn,
+                        blockedBy,
                     });
-                    yield* report("deleted");
+                    yield* scopedSession.note(`Skipping delete — blocked by failed delete of ${blockedBy.join(", ")}.`);
+                    yield* report("skipped");
+                    return "blocked";
                 }
-                else {
-                    if (!retainOldGeneration) {
-                        yield* scopedSession.note("Cleaning up replaced resource...");
+                return yield* deleteResourceBody().pipe(Effect.catchCause((cause) => Effect.gen(function* () {
+                    unresolved.add(fqn);
+                    failures.push({ fqn, logicalId, resourceType, cause });
+                    yield* report("fail");
+                    return "failed";
+                })));
+            })));
+            function deleteResourceBody() {
+                return Effect.gen(function* () {
+                    if (isDeleteNode(node)) {
+                        yield* report("deleting");
+                        if (node.resource.RemovalPolicy === "retain") {
+                            yield* state.delete({
+                                stack: stackName,
+                                stage,
+                                fqn,
+                            });
+                            yield* report("retained");
+                            // Retention is intentional — it never blocks dependencies.
+                            return "deleted";
+                        }
+                    }
+                    // Honor `retain` for the old generation of a replacement, mirroring
+                    // the orphan-delete path above. Delete-node retain is already
+                    // handled with an early return; this guards the replaced
+                    // old-generation physical delete.
+                    const retainOldGeneration = !isDeleteNode(node) && node.removalPolicy === "retain";
+                    if (retainOldGeneration) {
+                        yield* scopedSession.note("Retaining replaced resource (removal policy: retain)...");
                     }
-                    if (node.old.status === "replacing" ||
-                        node.old.status === "replaced") {
-                        // We only deleted the outermost old generation. A nested replacement
-                        // chain still exists, so stay in `replaced` and pop the chain forward
-                        // one level. The outer loop will pick this resource up again.
+                    // A row can reach deletion with `attr === undefined` when a create
+                    // was interrupted after the cloud-side call succeeded but before
+                    // `reconcile` returned Attributes (a `creating` row — or the old
+                    // generation of a replacement chain in the same predicament).
+                    // Skipping the provider's delete outright would silently orphan
+                    // the physical resource, so ask `read` to look it up from the
+                    // persisted props (providers derive the deterministic physical
+                    // name from id/props):
+                    //   - plain attrs    → exists and is ours; proceed to delete
+                    //   - Unowned(attrs) → exists but is NOT ours (e.g. our create
+                    //                      actually lost a name race, or died before
+                    //                      stamping ownership) — never delete a
+                    //                      foreign resource; drop our state and say so
+                    //   - undefined      → nothing exists; dropping state is safe
+                    if (attr === undefined && !retainOldGeneration) {
+                        if (provider.read) {
+                            const recovered = yield* provider
+                                .read({
+                                id: logicalId,
+                                fqn,
+                                instanceId,
+                                olds: props,
+                                output: undefined,
+                            })
+                                .pipe(instrumentLifecycle("read", fqn, resourceType, logicalId, instanceId));
+                            if (recovered !== undefined) {
+                                if (Unowned.is(recovered)) {
+                                    yield* scopedSession.note("Resource exists in the cloud but is not owned by this " +
+                                        "stack — leaving it in place (re-deploy with --adopt " +
+                                        "to take ownership, then destroy).");
+                                }
+                                else {
+                                    attr = stripUnowned(recovered);
+                                }
+                            }
+                        }
+                        else {
+                            yield* scopedSession.note("No attributes were recorded for this resource (its create " +
+                                "was interrupted) and the provider does not implement " +
+                                "`read` — if a physical resource was created, it must be " +
+                                "cleaned up manually.");
+                        }
+                    }
+                    if (isDeleteNode(node)) {
                         yield* commit({
-                            status: "replaced",
+                            status: "deleting",
                             fqn,
-                            logicalId: node.logicalId,
-                            instanceId: node.instanceId,
-                            resourceType: node.resourceType,
-                            props: node.props,
-                            attr: node.attr,
-                            providerVersion: node.providerVersion,
-                            downstream: node.downstream,
+                            logicalId,
+                            instanceId,
+                            resourceType,
+                            props,
+                            attr,
+                            downstream,
+                            providerVersion: provider.version ?? 0,
                             bindings: excludeDeletedBindings(node.bindings),
-                            old: node.old.old,
-                            deleteFirst: node.deleteFirst,
-                            removalPolicy: node.removalPolicy,
+                            removalPolicy: node.resource.RemovalPolicy,
+                            providerMode,
                         });
                     }
-                    else {
-                        // The old chain is fully drained, so the current replacement is now
-                        // the stable resource and we can collapse back to a terminal state.
-                        yield* commit({
-                            status: "created",
+                    if (attr !== undefined && !retainOldGeneration) {
+                        yield* provider
+                            .delete({
+                            id: logicalId,
+                            fqn,
+                            instanceId,
+                            olds: props,
+                            output: attr,
+                            session: scopedSession,
+                            bindings: [],
+                        })
+                            .pipe(instrumentLifecycle("delete", fqn, resourceType, logicalId, instanceId));
+                    }
+                    if (isDeleteNode(node)) {
+                        yield* state.delete({
+                            stack: stackName,
+                            stage,
                             fqn,
-                            logicalId: node.logicalId,
-                            instanceId: node.instanceId,
-                            resourceType: node.resourceType,
-                            props: node.props,
-                            attr: node.attr,
-                            providerVersion: node.providerVersion,
-                            downstream: node.downstream,
-                            bindings: excludeDeletedBindings(node.bindings),
-                            removalPolicy: node.removalPolicy,
                         });
+                        yield* report("deleted");
                     }
-                    yield* scopedSession.note(retainOldGeneration
-                        ? "Replaced resource retained."
-                        : "Replaced resource cleanup complete.");
-                }
-            }).pipe(Effect.catchCause((cause) => Effect.gen(function* () {
-                // Record only DIRECT failures. A cause consisting solely of
-                // the DependentDeletionFailed marker means the real failure
-                // was already recorded by the dependent that produced it.
-                const dependentOnly = cause.reasons.every((reason) => Cause.isFailReason(reason) &&
-                    reason.error instanceof DependentDeletionFailed);
-                if (!dependentOnly) {
-                    failures.push({
-                        fqn,
-                        logicalId,
-                        type: resourceType,
-                        cause,
-                    });
-                }
-                yield* report("fail");
-                // Keep the cached effect failed so resources that depend on
-                // this one skip their own physical delete too.
-                return yield* Effect.failCause(cause);
-            })))));
+                    else {
+                        if (!retainOldGeneration) {
+                            yield* scopedSession.note("Cleaning up replaced resource...");
+                        }
+                        if (node.old.status === "replacing" ||
+                            node.old.status === "replaced") {
+                            // We only deleted the outermost old generation. A nested replacement
+                            // chain still exists, so stay in `replaced` and pop the chain forward
+                            // one level. The outer loop will pick this resource up again.
+                            yield* commit({
+                                status: "replaced",
+                                fqn,
+                                logicalId: node.logicalId,
+                                instanceId: node.instanceId,
+                                resourceType: node.resourceType,
+                                props: node.props,
+                                attr: node.attr,
+                                providerVersion: node.providerVersion,
+                                downstream: node.downstream,
+                                bindings: excludeDeletedBindings(node.bindings),
+                                old: node.old.old,
+                                deleteFirst: node.deleteFirst,
+                                removalPolicy: node.removalPolicy,
+                                providerMode: node.providerMode,
+                            });
+                        }
+                        else {
+                            // The old chain is fully drained, so the current replacement is now
+                            // the stable resource and we can collapse back to a terminal state.
+                            yield* commit({
+                                status: "created",
+                                fqn,
+                                logicalId: node.logicalId,
+                                instanceId: node.instanceId,
+                                resourceType: node.resourceType,
+                                props: node.props,
+                                attr: node.attr,
+                                providerVersion: node.providerVersion,
+                                downstream: node.downstream,
+                                bindings: excludeDeletedBindings(node.bindings),
+                                removalPolicy: node.removalPolicy,
+                                providerMode: node.providerMode,
+                            });
+                        }
+                        yield* scopedSession.note(retainOldGeneration
+                            ? "Replaced resource retained."
+                            : "Replaced resource cleanup complete.");
+                    }
+                    return "deleted";
+                });
+            }
         });
         // Attempt every root. Per-node failures were recorded (and their state
-        // retained) by the catch above — swallow them here so one bad resource
-        // never interrupts sibling deletions mid-flight.
+        // retained) inside each node's delete effect — the effects resolve to
+        // outcomes and never fail, so one bad resource never interrupts sibling
+        // deletions mid-flight.
         yield* Effect.all(Object.values(deletionGraph)
             .filter((node) => node !== undefined)
-            .map((node) => deleteResource(node).pipe(Effect.ignore)), { concurrency: "unbounded" });
+            .map((node) => deleteResource(node)), { concurrency: "unbounded" });
     });
     // The first pass handles both planned deletions and any top-level replaced
     // resources already present in state. Later passes only drain replacement
     // chains that were re-committed as `replaced` while deleting older generations.
     let first = true;
     while (true) {
-        const remainingReplacedResources = yield* state.getReplacedResources({
+        const remainingReplacedResources = (yield* state.getReplacedResources({
             stack: stackName,
             stage,
-        });
+        }))
+            // A row whose drain already failed (or was blocked) this run stays
+            // `replaced` in state — retrying it in a later pass would loop forever.
+            // It stays behind for the next destroy; the aggregate error below
+            // reports it.
+            .filter((replaced) => !unresolved.has(replaced.fqn));
         if (!first && remainingReplacedResources.length === 0) {
             break;
         }
@@ -1328,15 +1407,12 @@ const collectGarbage = Effect.fn(function* (plan, session) {
             ])),
         });
         first = false;
-        // A failed pass cannot make further progress — the failing rows stay
-        // `replaced`/`deleting` in state, so looping again would spin on the
-        // same failures forever. Stop and surface the aggregate below.
-        if (failures.length > 0) {
-            break;
-        }
     }
     if (failures.length > 0) {
-        return yield* Effect.failCause(failures.map((f) => f.cause).reduce(Cause.combine));
+        // Every independent delete was still attempted; now surface everything
+        // that went wrong (and everything skipped as a consequence) as one
+        // typed aggregate. The destroy as a whole still fails.
+        return yield* Effect.fail(new DestroyError({ failures, blocked: blockedDeletes }));
     }
 });
 const excludeDeletedBindings = (bindings) => bindings.flatMap(({ action, sid, data }) => action === "delete" ? [] : [{ sid, data }]);