alchemy 2.0.0-beta.73 → 2.0.0-beta.75

package/src/AWS/ECS/FlociServiceProvider.ts

@@ -20,10 +20,16 @@
  *   content-addressed image pipeline pushes a new `<repositoryUri>:<hash>`
  *   tag, registers a new task definition revision, and `updateService`
  *   points the service at it. Floci swaps the service's task definition in
- *   place WITHOUT restarting running containers (probed), so the watcher
- *   then stops the old-revision tasks and the floci service scheduler
+ *   place WITHOUT restarting running containers (probed), so the
+ *   old-revision tasks are stopped and the floci service scheduler
  *   relaunches them on the new revision (~6s observed end-to-end for a
  *   container relaunch).
+ * - **Task roll** lives in the skeleton's `onReconciled` hook — NOT in the
+ *   watch loop — so it also fires for engine-driven reconciles. Prop-only
+ *   changes (an inline `dockerfile` edit, a new env var) never produce a
+ *   file event: before the hook, they registered a new revision and
+ *   `updateService`d onto it, but the running containers kept serving the
+ *   old one until the next source edit.
  */
 
 import * as Effect from "effect/Effect";
@@ -108,6 +114,39 @@ export const FlociServiceProvider = () =>
           }
           return undefined;
         }),
+      // Fires on every reconcile — watcher-triggered AND engine-driven
+      // (prop changes never produce a file event, so rolling only from the
+      // watch loop left the service's containers on the old revision).
+      onReconciled: ({ id, previous, attrs }) =>
+        Effect.gen(function* () {
+          if (
+            attrs.taskFamily === undefined ||
+            attrs.taskDefinitionArn === undefined ||
+            previous?.taskDefinitionArn === attrs.taskDefinitionArn
+          ) {
+            return;
+          }
+          const startedAt = Date.now();
+          // `updateService` (inside the reconcile) pointed the service at
+          // the new revision, but floci's in-place swap keeps the old
+          // containers running — stop them so the scheduler relaunches on
+          // the new revision.
+          const restarted = yield* restartFamilyTasks({
+            family: attrs.taskFamily,
+            nextTaskDefinitionArn: attrs.taskDefinitionArn,
+            serviceManaged: true,
+          });
+          yield* Effect.logInfo(
+            `[alchemy dev] ${attrs.serviceName}: task definition swapped (${restarted} service task(s) rolling) in ${Date.now() - startedAt}ms`,
+          );
+        }).pipe(
+          Effect.catchCause((cause) =>
+            Effect.logWarning(
+              `[alchemy dev] ${id}: service roll failed`,
+              cause,
+            ),
+          ),
+        ),
       startWatch: (ctx) =>
         Effect.gen(function* () {
           if (taskRefOf(ctx.news) !== undefined) {
@@ -121,31 +160,11 @@ export const FlociServiceProvider = () =>
             isExternal: ctx.news.isExternal,
           });
           yield* trigger.pipe(
+            // The reconcile registers the new revision and `updateService`s
+            // onto it; the `onReconciled` hook (shared with engine-driven
+            // updates) rolls the running tasks.
             Stream.runForEach(() =>
-              Effect.gen(function* () {
-                const startedAt = Date.now();
-                const previous = yield* ctx.currentAttrs;
-                const attrs = yield* ctx.rerunReconcile;
-                if (
-                  attrs.code?.hash === undefined ||
-                  attrs.code.hash === previous.code?.hash ||
-                  attrs.taskFamily === undefined
-                ) {
-                  return;
-                }
-                // `updateService` (inside the reconcile) pointed the service
-                // at the new revision, but floci's in-place swap keeps the
-                // old containers running — stop them so the scheduler
-                // relaunches on the new revision.
-                const restarted = yield* restartFamilyTasks({
-                  family: attrs.taskFamily,
-                  nextTaskDefinitionArn: attrs.taskDefinitionArn,
-                  serviceManaged: true,
-                });
-                yield* Effect.logInfo(
-                  `[alchemy dev] ${attrs.serviceName}: image swapped (${restarted} service task(s) rolling) in ${Date.now() - startedAt}ms`,
-                );
-              }).pipe(
+              ctx.rerunReconcile.pipe(
                 Effect.catchCause((cause) =>
                   Effect.logWarning(
                     `[alchemy dev] ${ctx.id}: image swap failed`,

package/src/AWS/ECS/FlociTaskProvider.ts

@@ -17,9 +17,14 @@
  *   the emulator: the image pipeline is content-addressed, so a real change
  *   builds and pushes a NEW `<repositoryUri>:<hash>` tag and registers a
  *   new task definition revision (an unchanged hash is a cheap no-op).
+ * - **Task restart** lives in the skeleton's `onReconciled` hook — NOT in
+ *   the watch loop — so it also fires for engine-driven reconciles.
+ *   Prop-only changes (an inline `dockerfile` edit, a new env var) never
+ *   produce a file event: before the hook, they registered a new revision
+ *   and running tasks kept serving the old one until the next source edit.
  *   RUNNING standalone tasks of the family (launched via `RunTask`) are
- *   then stopped and re-run on the new revision — service-managed tasks
- *   belong to [FlociServiceProvider](./FlociServiceProvider.ts).
+ *   stopped and re-run on the new revision — service-managed tasks belong
+ *   to [FlociServiceProvider](./FlociServiceProvider.ts).
  */
 
 import * as Effect from "effect/Effect";
@@ -64,6 +69,29 @@ export const FlociTaskProvider = () =>
             ? { action: "replace" as const }
             : undefined,
         ),
+      // Fires on every reconcile — watcher-triggered AND engine-driven
+      // (prop changes never produce a file event, so restarting only from
+      // the watch loop left running tasks on the old revision).
+      onReconciled: ({ id, previous, attrs }) =>
+        Effect.gen(function* () {
+          if (previous?.taskDefinitionArn === attrs.taskDefinitionArn) return;
+          const startedAt = Date.now();
+          const restarted = yield* restartFamilyTasks({
+            family: attrs.taskFamily,
+            nextTaskDefinitionArn: attrs.taskDefinitionArn,
+            serviceManaged: false,
+          });
+          yield* Effect.logInfo(
+            `[alchemy dev] ${attrs.taskFamily}: task definition swapped (${restarted} task(s) restarted) in ${Date.now() - startedAt}ms`,
+          );
+        }).pipe(
+          Effect.catchCause((cause) =>
+            Effect.logWarning(
+              `[alchemy dev] ${id}: task restart failed`,
+              cause,
+            ),
+          ),
+        ),
       startWatch: (ctx) =>
         Effect.gen(function* () {
           const trigger = yield* imageSourceTrigger({
@@ -72,21 +100,10 @@ export const FlociTaskProvider = () =>
             isExternal: ctx.news.isExternal,
           });
           yield* trigger.pipe(
+            // The reconcile registers the new revision; the `onReconciled`
+            // hook (shared with engine-driven updates) restarts the tasks.
             Stream.runForEach(() =>
-              Effect.gen(function* () {
-                const startedAt = Date.now();
-                const previous = yield* ctx.currentAttrs;
-                const attrs = yield* ctx.rerunReconcile;
-                if (attrs.code.hash === previous.code.hash) return;
-                const restarted = yield* restartFamilyTasks({
-                  family: attrs.taskFamily,
-                  nextTaskDefinitionArn: attrs.taskDefinitionArn,
-                  serviceManaged: false,
-                });
-                yield* Effect.logInfo(
-                  `[alchemy dev] ${attrs.taskFamily}: image swapped (${restarted} task(s) restarted) in ${Date.now() - startedAt}ms`,
-                );
-              }).pipe(
+              ctx.rerunReconcile.pipe(
                 Effect.catchCause((cause) =>
                   Effect.logWarning(
                     `[alchemy dev] ${ctx.id}: image swap failed`,

package/src/AWS/ECS/Service.ts

@@ -28,6 +28,7 @@ import { ScalableTarget } from "../ApplicationAutoScaling/ScalableTarget.ts";
 import { ScalingPolicy } from "../ApplicationAutoScaling/ScalingPolicy.ts";
 import { Service as CloudMapService } from "../CloudMap/Service.ts";
 import type { Credentials } from "../Credentials.ts";
+import { findPublicHostedZoneId } from "../Route53/HostedZoneLookup.ts";
 import { Record as Route53Record } from "../Route53/Record.ts";
 import {
   SecurityGroup,
@@ -1485,35 +1486,6 @@ const lookupDefaultNetwork = Effect.gen(function* () {
   return { vpcId: vpc.VpcId, subnets: subnetIds };
 });
 
-/**
- * Find the most specific PUBLIC Route 53 hosted zone containing
- * `domainName`, walking up its labels (`svc.api.example.com` →
- * `api.example.com` → `example.com`). Returns the bare zone id (no
- * `/hostedzone/` prefix), or undefined when no zone matches.
- */
-const findHostedZoneId = Effect.fn(function* (domainName: string) {
-  const labels = domainName
-    .replace(/\.$/, "")
-    .split(".")
-    .filter((label) => label.length > 0);
-  for (let i = 0; i < labels.length - 1; i++) {
-    const candidate = `${labels.slice(i).join(".")}.`;
-    const listed = yield* route53.listHostedZonesByName({
-      DNSName: candidate,
-      MaxItems: 1,
-    });
-    const zone = listed.HostedZones?.[0];
-    if (
-      zone?.Id !== undefined &&
-      zone.Name === candidate &&
-      zone.Config?.PrivateZone !== true
-    ) {
-      return zone.Id.replace(/^\/hostedzone\//, "");
-    }
-  }
-  return undefined;
-});
-
 const toValuesArray = (value: string | string[] | undefined) =>
   value === undefined ? undefined : Array.isArray(value) ? value : [value];
 
@@ -1847,7 +1819,7 @@ const composeManagedIngress = (
     const domainZones = new Map<string, string>();
     if (domain !== undefined) {
       for (const name of domainNames) {
-        const zoneId = yield* findHostedZoneId(name);
+        const zoneId = yield* findPublicHostedZoneId(name);
         if (zoneId === undefined) {
           return yield* Effect.fail(
             new ServiceHostedZoneNotFound({

package/src/AWS/Endpoint.ts

@@ -21,3 +21,15 @@ export const fromEnvironment: Layer.Layer<never, never, AWSEnvironment> =
       );
     }),
   );
+
+/**
+ * Explicitly "no custom endpoint" — the SDK falls back to its default
+ * endpoint resolver.
+ *
+ * Use this (never `Layer.empty`) when an AWS call is made from *inside*
+ * the construction of {@link AWSEnvironment}: leaving `Endpoint`
+ * unprovided lets the call fall through to {@link fromEnvironment},
+ * whose service Effect re-enters the in-flight `AWSEnvironment` cache and
+ * deadlocks the fiber with no I/O and no timer pending.
+ */
+export const none = Layer.succeed(Endpoint.Endpoint, Effect.succeed(undefined));

package/src/AWS/IAM/SAMLProvider.ts

@@ -3,6 +3,7 @@ import * as Effect from "effect/Effect";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
 import { createInternalTags, diffTags, hasTags } from "../../Tags.ts";
@@ -12,9 +13,10 @@ import { toTagRecord, unwrapRedactedString } from "./common.ts";
 
 export interface SAMLProviderProps {
   /**
-   * The friendly SAML provider name.
+   * The friendly SAML provider name. If omitted, a unique name is
+   * generated from the stack, stage, and logical id.
    */
-  name: string;
+  name?: string;
   /**
    * The provider metadata document.
    */
@@ -63,7 +65,6 @@ export interface SAMLProvider extends Resource<
  * **Example:** Create a SAML Identity Provider
  * ```typescript
  * const provider = yield* SAMLProvider("WorkforceSaml", {
- *   name: "workforce-saml",
  *   samlMetadataDocument: "<EntityDescriptor>...</EntityDescriptor>",
  * });
  * ```
@@ -82,18 +83,28 @@ const transientWriteSchedule = Schedule.max([
   Schedule.exponential(500).pipe(Schedule.jittered),
   Schedule.recurs(6),
 ]);
+const isEmptyUpdateError = (error: { _tag: string; message?: string }) =>
+  error._tag === "ValidationError" &&
+  (error.message?.includes("No updates are defined") ?? false);
+
 const isTransientWriteError = (error: {
   _tag: "ValidationError" | "ConcurrentModificationException" | (string & {});
+  message?: string;
 }) =>
-  error._tag === "ValidationError" ||
-  error._tag === "ConcurrentModificationException";
+  error._tag === "ConcurrentModificationException" ||
+  (error._tag === "ValidationError" && !isEmptyUpdateError(error));
+
+const toName = (id: string, props: { name?: string }) =>
+  props.name
+    ? Effect.succeed(props.name)
+    : createPhysicalName({ id, maxLength: 128 });
 
 export const SAMLProviderProvider = () =>
   Provider.succeed(SAMLProvider, {
-    stables: ["samlProviderArn"],
-    diff: Effect.fn(function* ({ olds, news }) {
+    stables: ["samlProviderArn", "name"],
+    diff: Effect.fn(function* ({ id, olds, news }) {
       if (!isResolved(news)) return;
-      if (olds.name !== news.name) {
+      if ((yield* toName(id, olds ?? {})) !== (yield* toName(id, news))) {
         return { action: "replace" } as const;
       }
     }),
@@ -169,10 +180,11 @@ export const SAMLProviderProvider = () =>
         ...internalTags,
         ...news.tags,
       };
+      const name = output?.name ?? (yield* toName(id, news));
       const accountId = (yield* AWSEnvironment.current).accountId;
       const samlProviderArn =
         output?.samlProviderArn ??
-        `arn:aws:iam::${accountId}:saml-provider/${news.name}`;
+        `arn:aws:iam::${accountId}:saml-provider/${name}`;
 
       // Observe — `getSAMLProvider` returns the metadata, encryption
       // mode, and UUID; absence is `NoSuchEntityException`.
@@ -189,7 +201,7 @@ export const SAMLProviderProvider = () =>
       if (!observed) {
         const created = yield* iam
           .createSAMLProvider({
-            Name: news.name,
+            Name: name,
             SAMLMetadataDocument: news.samlMetadataDocument,
             AssertionEncryptionMode: news.assertionEncryptionMode,
             AddPrivateKey: news.addPrivateKey
@@ -213,7 +225,7 @@ export const SAMLProviderProvider = () =>
                 if (!hasTags(internalTags, existingTags.Tags)) {
                   return yield* Effect.fail(
                     new Error(
-                      `SAML provider '${news.name}' already exists and is not managed by alchemy`,
+                      `SAML provider '${name}' already exists and is not managed by alchemy`,
                     ),
                   );
                 }
@@ -225,32 +237,42 @@ export const SAMLProviderProvider = () =>
           SAMLProviderArn: created.SAMLProviderArn ?? samlProviderArn,
         });
       } else {
-        // Sync metadata / encryption mode — `updateSAMLProvider` is a
-        // partial update; only push the doc when it actually differs.
-        if (
+        // Sync metadata / encryption mode — `updateSAMLProvider` rejects
+        // a call with no fields set ("No updates are defined…"). Only
+        // send fields that actually changed; skip the API on a no-op
+        // (greenfield adopt of a leftover provider, or a tags-only
+        // reconcile).
+        const metadataChanged =
           (observed.SAMLMetadataDocument ?? undefined) !==
-            news.samlMetadataDocument ||
-          observed.AssertionEncryptionMode !== news.assertionEncryptionMode ||
-          news.addPrivateKey !== undefined
+          news.samlMetadataDocument;
+        const encryptionChanged =
+          news.assertionEncryptionMode !== undefined &&
+          observed.AssertionEncryptionMode !== news.assertionEncryptionMode;
+        const addPrivateKey = news.addPrivateKey
+          ? unwrapRedactedString(news.addPrivateKey)
+          : undefined;
+        if (
+          metadataChanged ||
+          encryptionChanged ||
+          addPrivateKey !== undefined
         ) {
           yield* iam
             .updateSAMLProvider({
               SAMLProviderArn: samlProviderArn,
-              SAMLMetadataDocument:
-                (observed.SAMLMetadataDocument ?? undefined) !==
-                news.samlMetadataDocument
-                  ? news.samlMetadataDocument
-                  : undefined,
-              AssertionEncryptionMode: news.assertionEncryptionMode,
-              AddPrivateKey: news.addPrivateKey
-                ? unwrapRedactedString(news.addPrivateKey)
+              SAMLMetadataDocument: metadataChanged
+                ? news.samlMetadataDocument
+                : undefined,
+              AssertionEncryptionMode: encryptionChanged
+                ? news.assertionEncryptionMode
                 : undefined,
+              AddPrivateKey: addPrivateKey,
             })
             .pipe(
               Effect.retry({
                 while: isTransientWriteError,
                 schedule: transientWriteSchedule,
               }),
+              Effect.catchIf(isEmptyUpdateError, () => Effect.void),
             );
         }
       }
@@ -277,7 +299,7 @@ export const SAMLProviderProvider = () =>
       yield* session.note(samlProviderArn);
       return {
         samlProviderArn,
-        name: news.name,
+        name,
         samlProviderUUID:
           observed?.SAMLProviderUUID ?? output?.samlProviderUUID,
         samlMetadataDocument: news.samlMetadataDocument,

package/src/AWS/Lambda/DurableFunction.ts

@@ -12,6 +12,7 @@ import type { InputProps } from "../../Input.ts";
 import * as Output from "../../Output.ts";
 import type { PlatformServices } from "../../Platform.ts";
 import { toSeconds, toWireDays } from "../../Util/Duration.ts";
+import type { DistributiveOmit } from "../../Util/types.ts";
 import { effectClass, taggedFunction } from "../../Util/effect.ts";
 import type { DurableExecutionContext, DurableStep } from "./Durable.ts";
 import {
@@ -77,10 +78,8 @@ export type DurableFunctionInitServices =
  * durable-execution envelope — there is no HTTP surface), plus the
  * `DurableConfig` tuning knobs below.
  */
-export interface DurableFunctionProps extends Omit<
-  FunctionProps,
-  "functionUrl" | "durableConfig"
-> {
+/** The DurableConfig tuning knobs a DurableFunction adds to Function props. */
+export interface DurableFunctionTuning {
   /**
    * Maximum total duration of a durable execution, from start to terminal
    * state (minimum 60 seconds, maximum 1 year). Rounded up to whole seconds.
@@ -95,6 +94,28 @@ export interface DurableFunctionProps extends Omit<
   retentionPeriod?: Duration.Input;
 }
 
+/**
+ * Props of a {@link DurableFunction}: any Function props that carry a
+ * `main` — the orchestrator body is an Effect that has to be bundled into
+ * an entrypoint — minus `functionUrl` (every invocation arrives as the
+ * durable envelope, so there is no HTTP surface), plus the DurableConfig
+ * knobs.
+ *
+ * Selected by SHAPE (`Extract<…, { main: string }>`), not by packaging, so
+ * any future main-bearing variant is durable-capable automatically; a
+ * prebuilt `image` function is excluded because it has no `main` for the
+ * `impl` Effect to live in.
+ *
+ * The Omit DISTRIBUTES over the union: a bare `Omit` computes the COMMON
+ * keys and merges the members, which would make `main` optional and let
+ * `image` through alongside it.
+ */
+export type DurableFunctionProps = DistributiveOmit<
+  Extract<FunctionProps, { main: string }>,
+  "functionUrl" | "durableConfig"
+> &
+  DurableFunctionTuning;
+
 /**
  * Options for starting a durable execution.
  */

package/src/AWS/Lambda/FlociFunctionProvider.ts

@@ -16,7 +16,9 @@
  *   the emulator's assets bucket. The first swap repoints the function's
  *   code at that key with `UpdateFunctionCode`, which enrolls floci's
  *   reactive S3 sync; every later swap is a bare `PutObject` (measured
- *   111–138 ms re-extract, warm containers drained, no stale invoke).
+ *   111–138 ms re-extract, warm containers drained, no stale invoke) —
+ *   until an engine reconcile re-points the function at a content-addressed
+ *   key, after which the next swap re-enrolls it (see `enrolledAttrs`).
  *   `bundle: false` props fs-watch the prebuilt directory instead.
  * - **Replacement rules** — functionName and durableConfig-presence changes
  *   replace, mirroring the live diff.
@@ -43,6 +45,7 @@ import {
   Function,
   FunctionProvider,
   layerVersionArnOf,
+  type FunctionImageProps,
   type FunctionProps,
 } from "./Function.ts";
 import {
@@ -50,6 +53,10 @@ import {
   type FunctionBundleResult,
 } from "./FunctionBundle.ts";
 
+const isFunctionImageProps = (
+  props: FunctionProps,
+): props is FunctionImageProps => props.image !== undefined;
+
 export const FlociFunctionProvider = () =>
   makeDevWatchProvider<Function, FunctionProps, Function["Attributes"]>(
     Function,
@@ -64,17 +71,24 @@ export const FlociFunctionProvider = () =>
       // the watcher builds or WHERE it uploads. `build` may carry plugin
       // closures, which degrade to stable placeholders under canonical
       // hashing.
-      watchConfigOf: (news, attrs) => ({
-        functionName: attrs.functionName,
-        main: news.main,
-        handler: news.handler,
-        bundle: news.bundle,
-        isExternal: news.isExternal,
-        runtime: news.runtime,
-        architecture: news.architecture,
-        uploadSourceMap: news.uploadSourceMap,
-        build: news.build,
-      }),
+      watchConfigOf: (news, attrs) =>
+        isFunctionImageProps(news)
+          ? {
+              functionName: attrs.functionName,
+              image: news.image,
+              architecture: news.architecture,
+            }
+          : {
+              functionName: attrs.functionName,
+              main: news.main,
+              handler: news.handler,
+              bundle: news.bundle,
+              isExternal: news.isExternal,
+              runtime: news.runtime,
+              architecture: news.architecture,
+              uploadSourceMap: news.uploadSourceMap,
+              build: news.build,
+            },
       // Mirrors the live diff's replacement rules.
       replaceOn: ({ olds, news, output }) =>
         Effect.sync(() => {
@@ -82,35 +96,71 @@ export const FlociFunctionProvider = () =>
           if (output.functionName !== newFunctionName) {
             return { action: "replace" as const };
           }
-          if (!!olds.durableConfig !== !!news.durableConfig) {
-            return { action: "replace" as const };
+          if (isFunctionImageProps(olds) !== isFunctionImageProps(news)) {
+            return {
+              action: "replace" as const,
+              deleteFirst: news.functionName !== undefined,
+            };
+          }
+          if (
+            !isFunctionImageProps(olds) &&
+            !isFunctionImageProps(news) &&
+            !!olds.durableConfig !== !!news.durableConfig
+          ) {
+            return {
+              action: "replace" as const,
+              deleteFirst: news.functionName !== undefined,
+            };
           }
           return undefined;
         }),
-      normalizeProps: (props) => ({
-        ...props,
-        layers: (props.layers ?? []).map(layerVersionArnOf),
-      }),
+      normalizeProps: (props) =>
+        isFunctionImageProps(props)
+          ? props
+          : {
+              ...props,
+              layers: (props.layers ?? []).map(layerVersionArnOf),
+            },
       // Floci validates the Handler FILE against the package at
       // CreateFunction (AWS defers that to first invoke). The precreate 503
       // stub ships a single `index.*` module, so a `bundle: false` /
       // custom-handler props set (`handler.handler`) would be rejected — pin
       // the stub's handler-affecting props to the stub's own shape;
       // `reconcile` applies the real Handler together with the real package.
-      transformPrecreateNews: (news) => ({
-        ...news,
-        bundle: undefined,
-        isExternal: undefined,
-        handler: undefined,
-      }),
+      transformPrecreateNews: (news) =>
+        isFunctionImageProps(news)
+          ? news
+          : {
+              ...news,
+              bundle: undefined,
+              isExternal: undefined,
+              handler: undefined,
+            },
       startWatch: (ctx) =>
         Effect.gen(function* () {
           const props = ctx.news;
+          if (isFunctionImageProps(props)) {
+            // Image functions are converged by the delegated live provider.
+            // There is no ZIP module graph to watch or hot-swap.
+            return;
+          }
           const functionName = ctx.attrs.functionName;
           const bundler = yield* makeFunctionBundler;
           const assets = yield* Assets;
           let lastHash = ctx.attrs.code?.hash ?? "";
-          let enrolledKey: string | undefined;
+          // The attributes object that was current when the watch loop
+          // last pointed the function at the stable dev key. Every
+          // engine-driven reconcile (a binding added, an env var changed,
+          // …) re-uploads the bundle to a content-addressed key and
+          // re-points the function THERE, silently detaching it from the
+          // dev key: floci's reactive S3 sync only follows the key the
+          // function is enrolled at, so every later PutObject would be
+          // ignored and hot swap would be dead until the next engine
+          // update. The skeleton hands the watcher a fresh attrs object per
+          // reconcile, so identity (not the code hash — a source edited
+          // back to its original content hashes the same) is the signal
+          // that a re-point happened and the function must be re-enrolled.
+          let enrolledAttrs: Function["Attributes"] | undefined;
           let startedAt = Date.now();
 
           const swap = Effect.fn(function* (result: FunctionBundleResult) {
@@ -124,10 +174,12 @@ export const FlociFunctionProvider = () =>
               Body: archive,
               ContentType: "application/zip",
             });
-            if (enrolledKey !== key) {
-              // First swap: repoint the function's code at the stable dev
-              // key — floci's reactive S3 sync then re-extracts on every
-              // subsequent PutObject with no further Lambda API calls.
+            const current = yield* ctx.currentAttrs;
+            if (enrolledAttrs !== current) {
+              // First swap, or the engine re-pointed the function since the
+              // last one: (re)point its code at the stable dev key — floci's
+              // reactive S3 sync then re-extracts on every subsequent
+              // PutObject with no further Lambda API calls.
               yield* Lambda.updateFunctionCode({
                 FunctionName: functionName,
                 S3Bucket: bucket,
@@ -139,7 +191,7 @@ export const FlociFunctionProvider = () =>
                   times: 8,
                 }),
               );
-              enrolledKey = key;
+              enrolledAttrs = current;
             }
             lastHash = result.identityHash;
             yield* Effect.logInfo(