alchemy 2.0.0-beta.76 → 2.0.0-beta.77

package/src/Plan.ts

@@ -1,9 +1,13 @@
 /** @effect-diagnostics anyUnknownInErrorContext:off */
 /** @effect-diagnostics missingEffectError:off */
+import * as Cause from "effect/Cause";
 import * as Config from "effect/Config";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import * as Option from "effect/Option";
+import * as Ref from "effect/Ref";
+import { cachedInScope } from "./Util/Memoize.ts";
 import { asEffect } from ".//Util/types.ts";
 import { isAction, type ActionLike } from "./Action.ts";
 import {
@@ -13,6 +17,7 @@ import {
   Unowned,
 } from "./AdoptPolicy.ts";
 import { AlchemyContext } from "./AlchemyContext.ts";
+import { demandRemoteCredentials } from "./Auth/Demand.ts";
 import {
   Artifacts,
   ArtifactStore,
@@ -45,6 +50,12 @@ import {
   stampedMode,
   type ProviderMode,
 } from "./ProviderMode.ts";
+import {
+  Progress,
+  type PlannedAction,
+  type PlannedBinding,
+  type PlannedResource,
+} from "./Report.ts";
 import {
   isResource,
   missingImplementation,
@@ -71,17 +82,6 @@ import { hashInput } from "./Util/sha256.ts";
 
 export type PlanError = never;
 
-export const isCRUD = (node: any): node is CRUD => {
-  return (
-    node &&
-    typeof node === "object" &&
-    (node.action === "create" ||
-      node.action === "update" ||
-      node.action === "replace" ||
-      node.action === "noop")
-  );
-};
-
 /**
  * A node in the plan that represents a resource CRUD operation.
  */
@@ -132,6 +132,12 @@ export interface BaseNode<
 export interface ApplyNodeBase<
   R extends ResourceLike<string> = ResourceLike<string>,
 > extends BaseNode<R> {
+  /** Cloud attribute drift attached to synthetic drift-repair plans. */
+  drift?: {
+    readonly expected: unknown;
+    readonly actual: unknown;
+    readonly missing?: boolean;
+  };
   /**
    * Set when this resource's persisted row was found under former FQNs
    * (`renamedFrom(...)`) — the migration source (no row at the current FQN
@@ -155,7 +161,7 @@ export interface Create<
 export interface Update<
   R extends ResourceLike = ResourceLike,
 > extends ApplyNodeBase<R> {
-  action: "update";
+  action: "update" | "adopted";
   /** True while this is the first reconcile after a cold adoption. */
   adopting?: boolean;
   props: R["Props"];
@@ -171,7 +177,7 @@ export interface Update<
 export interface Delete<
   R extends ResourceLike = ResourceLike,
 > extends BaseNode<R> {
-  action: "delete";
+  action: "delete" | "orphaned";
   // a resource can be deleted no matter what state it's in
   state: ResourceState;
 }
@@ -285,6 +291,63 @@ export type Plan<Output = any> = {
   destroy?: boolean;
 };
 
+const describeBinding = (binding: BindingNode): PlannedBinding => ({
+  sid: binding.sid,
+  action: binding.action,
+});
+
+/** The serializable row view of one resource node (see {@link describePlan}). */
+export const describeResource = (node: CRUD): PlannedResource => ({
+  fqn: node.resource.FQN,
+  logicalId: node.resource.LogicalId,
+  resourceType: node.resource.Type,
+  action: node.action,
+  bindings: node.bindings.map(describeBinding),
+  providerMode: node.mode,
+  fromProviderMode:
+    node.action === "replace" &&
+    node.mode !== undefined &&
+    node.state.providerMode !== undefined &&
+    node.state.providerMode !== node.mode
+      ? node.state.providerMode
+      : undefined,
+});
+
+/** The serializable row view of one stack-action node. */
+export const describeAction = (
+  node: ActionApply | ActionDelete,
+): PlannedAction => ({
+  fqn: node.def.FQN,
+  logicalId: node.def.LogicalId,
+  actionType: node.def.Type,
+  action: node.action,
+});
+
+/**
+ * Serializable per-row views of a plan — everything a renderer or remote
+ * consumer needs without holding the native plan: resource rows with their
+ * bindings and provider modes, orphan deletions, and stack actions.
+ */
+export const describePlan = (
+  plan: Plan,
+): {
+  readonly resources: ReadonlyArray<PlannedResource>;
+  readonly actions: ReadonlyArray<PlannedAction>;
+} => ({
+  resources: [
+    ...Object.values(plan.resources),
+    ...Object.values(plan.deletions).filter(
+      (node): node is Delete => node !== undefined,
+    ),
+  ].map(describeResource),
+  actions: [
+    ...Object.values(plan.actions ?? {}),
+    ...Object.values(plan.actionDeletions ?? {}),
+  ]
+    .filter((node): node is ActionApply | ActionDelete => node !== undefined)
+    .map(describeAction),
+});
+
 export interface MakePlanOptions {
   force?: boolean;
 }
@@ -295,6 +358,14 @@ export const make = <A>(
 ): Effect.Effect<Plan<A>, never, State> =>
   // @ts-expect-error
   Effect.gen(function* () {
+    // Per-resource plan progress and phase markers are reported through
+    // the ambient Progress reporter as the work happens, so a renderer can show
+    // plan computation while it runs. The default reporter is a no-op.
+    const reportPlanned = yield* Progress;
+
+    // Resolving the state service may bootstrap a remote store, and the
+    // persisted-row snapshot below reads from it — both are "loading state".
+    yield* reportPlanned({ _tag: "plan.phase", phase: "loading-state" });
     const state = yield* yield* State;
 
     const resources = Object.values(stack.resources);
@@ -363,6 +434,20 @@ export const make = <A>(
       return { provider, mode };
     });
 
+    // Credential-free dev: the adoption probe below runs each new row's
+    // `read` — for `Alchemy.remote()` rows that is a real cloud call, and
+    // it happens before apply's demand gate. Demand those credentials up
+    // front so a dev plan with nothing configured fails with the typed
+    // CredentialsRequired rather than the first read's raw auth error.
+    if (runDefaultMode === "local") {
+      const remote: Array<{ Type: string; FQN: string }> = [];
+      for (const resource of resources) {
+        const { mode } = yield* resolveProviderAndMode(resource);
+        if (mode === "live") remote.push(resource);
+      }
+      if (remote.length > 0) yield* demandRemoteCredentials(remote);
+    }
+
     /**
      * Has this resource switched provider modes since it was last
      * reconciled? Rows without a persisted mode were written by a
@@ -401,6 +486,8 @@ export const make = <A>(
       resourceFqns.map((fqn, i) => [fqn, oldResources[i]]),
     );
 
+    yield* reportPlanned({ _tag: "plan.phase", phase: "computing-plan" });
+
     // ── FQN renames ──────────────────────────────────────────────────────
     // Map every former FQN claimed via `renamedFrom(...)` to its claimant's
     // current FQN. Two resources claiming the same former FQN is ambiguous
@@ -596,6 +683,10 @@ export const make = <A>(
       return { row, renamedFrom: undefined, renameMoved: false };
     });
 
+    // Shared resolutions run in fibers of the plan's own scope (see
+    // `cachedInScope`): a diff that fails or is cancelled must not take the
+    // resolution every other diff is waiting on down with it.
+    const memoScope = yield* Effect.scope;
     const resolvedResources: Record<string, Effect.Effect<any>> = {};
 
     const resolveResource = (
@@ -610,7 +701,7 @@ export const make = <A>(
         }
         // @ts-expect-error
         return yield* (resolvedResources[resourceExpr.src.FQN] ??=
-          yield* Effect.cached(
+          yield* cachedInScope(memoScope)(
             Effect.gen(function* () {
               const resource = resourceExpr.src;
 
@@ -1074,590 +1165,653 @@ export const make = <A>(
       ),
     ]);
 
-    const resourceGraph = Object.fromEntries(
-      (yield* Effect.all(
-        resources.map(
-          Effect.fn("plan.diff.resource")(function* (resource) {
-            const { provider, mode } = yield* resolveProviderAndMode(resource);
-            const id = resource.LogicalId;
-            const fqn = resource.FQN;
-            // Apply-facing props (stored on the plan node): whole-resource
-            // references to updating upstreams stay evaluable `ResourceExpr`s.
-            // Apply runs `Output.evaluate(node.props, outputs)` right before
-            // `reconcile`, so these references resolve to the upstream's
-            // fresh post-reconcile attributes.
-            const applyProps = yield* resolveInput(resource.Props);
-            // Diff-facing view of the same resolution: stable attributes
-            // materialized so their known values flow into `diff` /
-            // `havePropsChanged`.
-            const news = materializeStableRefs(applyProps);
-            const downstream = newDownstreamDependencies[fqn] ?? [];
-
-            // Apply-facing binding rows, mirroring `applyProps`: payloads
-            // whose data embeds a whole-resource reference to an updating
-            // upstream keep it as an evaluable `ResourceExpr`. Apply runs
-            // `Output.evaluate(node.bindings, outputs)` right before
-            // `reconcile`, so the host receives the upstream's fresh
-            // post-reconcile attributes. Collapse duplicates by sid so the
-            // binding set handed to `diff` matches what `reconcile` receives
-            // (see `dedupeBindings`).
-            const applyBindings: ResourceBinding[] = dedupeBindings(
-              yield* resolveInput(stack.bindings[fqn] ?? []),
+    const plannedCount = yield* Ref.make(0);
+    const resourcePlanned = (node: CRUD) =>
+      Ref.updateAndGet(plannedCount, (count) => count + 1).pipe(
+        Effect.flatMap((completed) =>
+          reportPlanned({
+            _tag: "plan.resource.completed",
+            ...describeResource(node),
+            completed,
+            total: resources.length,
+          }),
+        ),
+      );
+
+    const diffResource = Effect.fn("plan.diff.resource")(function* (
+      resource: ResourceLike,
+    ) {
+      const { provider, mode } = yield* resolveProviderAndMode(resource);
+      const id = resource.LogicalId;
+      const fqn = resource.FQN;
+      // Paired with the resource-planned completion below so renderers can
+      // show what is actually in flight (diffs may read the cloud and run
+      // concurrently — completions alone hide the slow tail).
+      yield* reportPlanned({
+        _tag: "plan.resource.started",
+        fqn,
+        logicalId: id,
+        resourceType: resource.Type,
+        total: resources.length,
+      });
+      // Apply-facing props (stored on the plan node): whole-resource
+      // references to updating upstreams stay evaluable `ResourceExpr`s.
+      // Apply runs `Output.evaluate(node.props, outputs)` right before
+      // `reconcile`, so these references resolve to the upstream's
+      // fresh post-reconcile attributes.
+      const applyProps = yield* resolveInput(resource.Props);
+      // Diff-facing view of the same resolution: stable attributes
+      // materialized so their known values flow into `diff` /
+      // `havePropsChanged`.
+      const news = materializeStableRefs(applyProps);
+      const downstream = newDownstreamDependencies[fqn] ?? [];
+
+      // Apply-facing binding rows, mirroring `applyProps`: payloads
+      // whose data embeds a whole-resource reference to an updating
+      // upstream keep it as an evaluable `ResourceExpr`. Apply runs
+      // `Output.evaluate(node.bindings, outputs)` right before
+      // `reconcile`, so the host receives the upstream's fresh
+      // post-reconcile attributes. Collapse duplicates by sid so the
+      // binding set handed to `diff` matches what `reconcile` receives
+      // (see `dedupeBindings`).
+      const applyBindings: ResourceBinding[] = dedupeBindings(
+        yield* resolveInput(stack.bindings[fqn] ?? []),
+      );
+      // Diff-facing view of the same rows: stable attributes
+      // materialized so `diffBindings` / `provider.diff` compare known
+      // values. Terminal commits still persist the payload the provider
+      // actually reconciled with (#874) — Apply commits the evaluated
+      // `bindingOutputs`, not these plan-time shapes.
+      const newBindings: ResourceBinding[] =
+        materializeStableRefs(applyBindings);
+      // The row is looked up at the resource's FQN with a fallback to
+      // its former FQNs (`renamedFrom`); a row found under a former
+      // FQN arrives here already remapped to the new identity, and
+      // `renamedFrom` rides onto the plan node so apply persists the
+      // move. (A Task previously holding this FQN is treated as no
+      // prior state — its row is reaped by `actionDeletions` below.)
+      const {
+        row: persistedRow,
+        renamedFrom,
+        renameMoved,
+      } = yield* getPersistedRow(resource);
+      let oldState: ResourceState | undefined = persistedRow;
+
+      // Engine-level adoption. When there is no prior state, always
+      // consult `provider.read` (if implemented) so the engine — not
+      // each lifecycle method — owns the existence/ownership decision.
+      //
+      // The provider returns one of:
+      //   - `undefined`        → resource doesn't exist; create it
+      //   - plain attrs        → exists and is owned by us; silent adopt
+      //   - `Unowned(attrs)`   → exists but is *not* ours
+      //
+      // Routing:
+      //   - owned                          → adopt the `created` state
+      //                                      from attrs and continue
+      //                                      through the normal diff
+      //                                      path (so subsequent props
+      //                                      drift produces an update).
+      //   - unowned + adopt enabled        → take over: adopt the
+      //                                      `created` state and let the
+      //                                      next update overwrite tags.
+      //   - unowned + adopt disabled       → fail with
+      //                                      `OwnedBySomeoneElse`.
+      //
+      // Plan construction is side-effect-free: the adopted `created`
+      // state is only held in-memory here (to drive the diff) and rides
+      // onto the plan node as `node.state`. Persisting it to the state
+      // store happens exclusively during APPLY of that node (the update
+      // lifecycle commits `updating` / `updated` carrying this state).
+      // If planning persisted here, a mere `alchemy plan` / `--dry-run`
+      // would claim ownership of an unowned cloud resource, arming a
+      // later unrelated deploy to orphan-delete it. See
+      // https://github.com/alchemy-run/alchemy/issues/793.
+      //
+      // After a cold-start adoption (engine just discovered an
+      // existing cloud resource via `read`), force the engine's
+      // normal `update` path so the provider can re-sync ownership
+      // tags, configuration, etc. against the desired props.
+      // Adoption carries state with `props: news`, so the default
+      // diff sees no drift and would noop — which would leave any
+      // foreign-owned tags / divergent config in place. Forcing
+      // update keeps the deploy idempotent: if cloud state already
+      // matches news, the provider's update is a no-op write.
+      //
+      // Skip the adoption probe entirely when `news` still contains
+      // unresolved upstream Outputs (e.g. a `streamArn` referencing
+      // a stream being created in the same plan). Calling `read` with
+      // an unresolved value would surface as `ParseError` from the
+      // SDK protocol layer. Resources whose props depend on
+      // not-yet-created upstreams cannot themselves be pre-existing
+      // — there's nothing to adopt.
+      // A resource declared at a former FQN whose row just migrated
+      // away is genuinely NEW by declaration — skip the probe. Its
+      // predecessor's physical resource still carries tags branded
+      // with THIS logical id (the migrated row's reconcile hasn't
+      // re-branded them yet), so a tag-based `read` would find it
+      // and silently adopt the very resource that was renamed away.
+      const reusesMigratedFqn = migratedRowFqns.has(fqn);
+      let forceUpdateAfterAdoption = false;
+      if (
+        oldState === undefined &&
+        provider.read &&
+        isResolved(news) &&
+        !reusesMigratedFqn
+      ) {
+        const adoptInstanceId = yield* generateInstanceId();
+        const readResult = yield* provider
+          .read({
+            id,
+            fqn,
+            instanceId: adoptInstanceId,
+            olds: news,
+            output: undefined,
+          })
+          .pipe(providePlanScope(fqn, adoptInstanceId));
+        if (readResult !== undefined) {
+          const isUnowned = Unowned.is(readResult);
+          // A resource-scoped `adopt(...)` (captured on the resource at
+          // registration) overrides the stack/CLI default.
+          const adoptThis = resource.Adopt ?? (yield* shouldAdopt);
+          if (isUnowned && !adoptThis) {
+            return yield* new OwnedBySomeoneElse({
+              message:
+                `Cannot adopt resource '${fqn}' (${resource.Type}): ` +
+                "it exists in the cloud but is not owned by this " +
+                "stack/stage/logical-id. Re-run with `--adopt` (or " +
+                "wrap the effect in `adopt(true)`) to take it over.",
+              resourceType: resource.Type,
+              logicalId: id,
+            });
+          }
+          const adoptedState = {
+            status: "created" as const,
+            fqn,
+            logicalId: id,
+            instanceId: adoptInstanceId,
+            namespace: resource.Namespace,
+            resourceType: resource.Type,
+            props: news,
+            attr: stripUnowned(readResult),
+            providerVersion: provider.version ?? 0,
+            bindings: [],
+            downstream,
+            removalPolicy: resource.RemovalPolicy,
+            providerMode: mode,
+          } satisfies CreatedResourceState;
+          // In-memory only — do NOT persist here. Plan.make runs for
+          // `alchemy plan` / `deploy --dry-run` too, so a `state.set`
+          // would mutate persistent state during a read-only preview.
+          // The adopted state rides onto the plan node via `oldState`
+          // (→ `node.state`) and is persisted at APPLY time by the
+          // update lifecycle's `updating` / `updated` commits. See
+          // https://github.com/alchemy-run/alchemy/issues/793.
+          oldState = adoptedState;
+          forceUpdateAfterAdoption = true;
+        }
+      }
+
+      // Sid-sorted like `newBindings` (see the resolveResource note).
+      const oldBindings = dedupeBindings(oldState?.bindings ?? []);
+      // Actions come from the materialized comparison (`newBindings`);
+      // the payloads the node carries into Apply come from the
+      // apply-faithful rows, joined by sid — both are views of the same
+      // deduped `stack.bindings[fqn]` rows, so action and payload can
+      // never drift. `delete` rows keep the persisted old data.
+      const applyBindingData = new Map(
+        applyBindings.map((b) => [b.sid, b.data]),
+      );
+      const bindingDiffs = diffBindings(oldBindings, newBindings).map((b) =>
+        b.action === "delete" || !applyBindingData.has(b.sid)
+          ? b
+          : { ...b, data: applyBindingData.get(b.sid) },
+      );
+
+      // Local ⇄ live switch: the persisted row was reconciled by a
+      // different provider mode than the one resolved for this run.
+      // The two runtimes host distinct physical instances, so this is
+      // always a replacement — the new instance is created with the
+      // new mode's provider, and Apply deletes the old generation
+      // with the provider of the mode that created it (see
+      // `deleteOldGenerations` / `collectGarbage`).
+      const modeSwitched = hasModeSwitched(mode, oldState);
+
+      const Node = <T extends Apply>(
+        node: Omit<
+          T,
+          "provider" | "resource" | "bindings" | "downstream" | "mode"
+        >,
+      ) =>
+        ({
+          ...node,
+          provider,
+          resource,
+          bindings: bindingDiffs,
+          downstream,
+          mode,
+          renamedFrom,
+        }) as any as T;
+
+      // Plan against the persisted state we have, not the ideal final state we
+      // hoped to reach last time. Recovery is expressed by mapping each
+      // intermediate state back onto a fresh CRUD action.
+      if (oldState === undefined) {
+        return Node<Create>({
+          action: "create",
+          props: applyProps,
+          state: oldState,
+        });
+      } else if (
+        !modeSwitched &&
+        oldState.status === "creating" &&
+        oldState.attr === undefined
+      ) {
+        // A create may have succeeded before state persistence failed. If the
+        // provider can recover an attribute snapshot, keep driving the same
+        // create instead of starting over blindly.
+        //
+        // `creating` state persists the RAW plan-time props, which may
+        // still contain unresolved Output expressions (e.g. a name
+        // referencing an upstream created in the same failed deploy).
+        // `read` implementations derive identity from `olds` when
+        // `output` is undefined (as it is here), so handing them
+        // unresolved exprs crashes. Skip the probe — same behavior as
+        // a read that found nothing — and re-drive the create.
+        if (provider.read && isResolved(oldState.props)) {
+          const attr = yield* provider
+            .read({
+              id,
+              fqn,
+              instanceId: oldState.instanceId,
+              olds: oldState.props,
+              output: oldState.attr,
+            })
+            .pipe(
+              providePlanScope(fqn, oldState.instanceId),
+              // `creating` props pass `isResolved` yet can still carry
+              // holes where unresolved Outputs were stripped at commit
+              // time (see stripUnresolved) — e.g. a parent reference
+              // persisted as `{}`. A provider that dereferences one
+              // crashes deep inside its SDK client (a SchemaError
+              // defect), which would brick every subsequent plan on
+              // the stage. Recovery is best-effort: degrade the defect
+              // to "nothing recovered" and re-drive the create (#995).
+              Effect.catchDefect((defect) =>
+                Effect.logWarning(
+                  `Recovery read for '${fqn}' crashed; treating the ` +
+                    "interrupted create as not recoverable and " +
+                    "re-driving it.",
+                  defect,
+                ).pipe(Effect.as(undefined)),
+              ),
             );
-            // Diff-facing view of the same rows: stable attributes
-            // materialized so `diffBindings` / `provider.diff` compare known
-            // values. Terminal commits still persist the payload the provider
-            // actually reconciled with (#874) — Apply commits the evaluated
-            // `bindingOutputs`, not these plan-time shapes.
-            const newBindings: ResourceBinding[] =
-              materializeStableRefs(applyBindings);
-            // The row is looked up at the resource's FQN with a fallback to
-            // its former FQNs (`renamedFrom`); a row found under a former
-            // FQN arrives here already remapped to the new identity, and
-            // `renamedFrom` rides onto the plan node so apply persists the
-            // move. (A Task previously holding this FQN is treated as no
-            // prior state — its row is reaped by `actionDeletions` below.)
-            const {
-              row: persistedRow,
-              renamedFrom,
-              renameMoved,
-            } = yield* getPersistedRow(resource);
-            let oldState: ResourceState | undefined = persistedRow;
-
-            // Engine-level adoption. When there is no prior state, always
-            // consult `provider.read` (if implemented) so the engine — not
-            // each lifecycle method — owns the existence/ownership decision.
-            //
-            // The provider returns one of:
-            //   - `undefined`        → resource doesn't exist; create it
-            //   - plain attrs        → exists and is owned by us; silent adopt
-            //   - `Unowned(attrs)`   → exists but is *not* ours
-            //
-            // Routing:
-            //   - owned                          → adopt the `created` state
-            //                                      from attrs and continue
-            //                                      through the normal diff
-            //                                      path (so subsequent props
-            //                                      drift produces an update).
-            //   - unowned + adopt enabled        → take over: adopt the
-            //                                      `created` state and let the
-            //                                      next update overwrite tags.
-            //   - unowned + adopt disabled       → fail with
-            //                                      `OwnedBySomeoneElse`.
-            //
-            // Plan construction is side-effect-free: the adopted `created`
-            // state is only held in-memory here (to drive the diff) and rides
-            // onto the plan node as `node.state`. Persisting it to the state
-            // store happens exclusively during APPLY of that node (the update
-            // lifecycle commits `updating` / `updated` carrying this state).
-            // If planning persisted here, a mere `alchemy plan` / `--dry-run`
-            // would claim ownership of an unowned cloud resource, arming a
-            // later unrelated deploy to orphan-delete it. See
-            // https://github.com/alchemy-run/alchemy/issues/793.
-            //
-            // After a cold-start adoption (engine just discovered an
-            // existing cloud resource via `read`), force the engine's
-            // normal `update` path so the provider can re-sync ownership
-            // tags, configuration, etc. against the desired props.
-            // Adoption carries state with `props: news`, so the default
-            // diff sees no drift and would noop — which would leave any
-            // foreign-owned tags / divergent config in place. Forcing
-            // update keeps the deploy idempotent: if cloud state already
-            // matches news, the provider's update is a no-op write.
-            //
-            // Skip the adoption probe entirely when `news` still contains
-            // unresolved upstream Outputs (e.g. a `streamArn` referencing
-            // a stream being created in the same plan). Calling `read` with
-            // an unresolved value would surface as `ParseError` from the
-            // SDK protocol layer. Resources whose props depend on
-            // not-yet-created upstreams cannot themselves be pre-existing
-            // — there's nothing to adopt.
-            // A resource declared at a former FQN whose row just migrated
-            // away is genuinely NEW by declaration — skip the probe. Its
-            // predecessor's physical resource still carries tags branded
-            // with THIS logical id (the migrated row's reconcile hasn't
-            // re-branded them yet), so a tag-based `read` would find it
-            // and silently adopt the very resource that was renamed away.
-            const reusesMigratedFqn = migratedRowFqns.has(fqn);
-            let forceUpdateAfterAdoption = false;
-            if (
-              oldState === undefined &&
-              provider.read &&
-              isResolved(news) &&
-              !reusesMigratedFqn
-            ) {
-              const adoptInstanceId = yield* generateInstanceId();
-              const readResult = yield* provider
-                .read({
-                  id,
-                  fqn,
-                  instanceId: adoptInstanceId,
-                  olds: news,
-                  output: undefined,
-                })
-                .pipe(providePlanScope(fqn, adoptInstanceId));
-              if (readResult !== undefined) {
-                const isUnowned = Unowned.is(readResult);
-                // A resource-scoped `adopt(...)` (captured on the resource at
-                // registration) overrides the stack/CLI default.
-                const adoptThis = resource.Adopt ?? (yield* shouldAdopt);
-                if (isUnowned && !adoptThis) {
-                  return yield* new OwnedBySomeoneElse({
-                    message:
-                      `Cannot adopt resource '${fqn}' (${resource.Type}): ` +
-                      "it exists in the cloud but is not owned by this " +
-                      "stack/stage/logical-id. Re-run with `--adopt` (or " +
-                      "wrap the effect in `adopt(true)`) to take it over.",
-                    resourceType: resource.Type,
-                    logicalId: id,
-                  });
-                }
-                const adoptedState = {
-                  status: "created" as const,
-                  fqn,
-                  logicalId: id,
-                  instanceId: adoptInstanceId,
-                  namespace: resource.Namespace,
+          if (attr !== undefined) {
+            // The recovered resource may be foreign: our interrupted
+            // create could have lost a name race, or died before
+            // stamping ownership. Route `Unowned` through the same
+            // adoption table as the cold-start probe above — never
+            // silently take over (and later mutate/delete) a resource
+            // we cannot prove we created.
+            if (Unowned.is(attr)) {
+              const adoptThis = resource.Adopt ?? (yield* shouldAdopt);
+              if (!adoptThis) {
+                return yield* new OwnedBySomeoneElse({
+                  message:
+                    `Cannot resume creating resource '${fqn}' ` +
+                    `(${resource.Type}): a resource with its physical ` +
+                    "identity exists in the cloud but is not owned by " +
+                    "this stack/stage/logical-id. Re-run with `--adopt` " +
+                    "(or wrap the effect in `adopt(true)`) to take it " +
+                    "over.",
                   resourceType: resource.Type,
-                  props: news,
-                  attr: stripUnowned(readResult),
-                  providerVersion: provider.version ?? 0,
-                  bindings: [],
-                  downstream,
-                  removalPolicy: resource.RemovalPolicy,
-                  providerMode: mode,
-                } satisfies CreatedResourceState;
-                // In-memory only — do NOT persist here. Plan.make runs for
-                // `alchemy plan` / `deploy --dry-run` too, so a `state.set`
-                // would mutate persistent state during a read-only preview.
-                // The adopted state rides onto the plan node via `oldState`
-                // (→ `node.state`) and is persisted at APPLY time by the
-                // update lifecycle's `updating` / `updated` commits. See
-                // https://github.com/alchemy-run/alchemy/issues/793.
-                oldState = adoptedState;
-                forceUpdateAfterAdoption = true;
+                  logicalId: id,
+                });
               }
             }
+            // Continue through the normal diff below with the recovered
+            // live snapshot. Desired props may have changed while the
+            // previous create was interrupted; bypassing diff here can
+            // drive an immutable change through reconcile and falsely
+            // persist the old physical resource as converged.
+            oldState = { ...oldState, attr: stripUnowned(attr) };
+          }
+        }
+      }
 
-            // Sid-sorted like `newBindings` (see the resolveResource note).
-            const oldBindings = dedupeBindings(oldState?.bindings ?? []);
-            // Actions come from the materialized comparison (`newBindings`);
-            // the payloads the node carries into Apply come from the
-            // apply-faithful rows, joined by sid — both are views of the same
-            // deduped `stack.bindings[fqn]` rows, so action and payload can
-            // never drift. `delete` rows keep the persisted old data.
-            const applyBindingData = new Map(
-              applyBindings.map((b) => [b.sid, b.data]),
-            );
-            const bindingDiffs = diffBindings(oldBindings, newBindings).map(
-              (b) =>
-                b.action === "delete" || !applyBindingData.has(b.sid)
-                  ? b
-                  : { ...b, data: applyBindingData.get(b.sid) },
-            );
+      // Diff against whatever props represent the best-known current attempt.
+      // For replacement recovery that means the top-level replacement props,
+      // not the older generations stored under `old`.
+      const oldProps = oldState.props;
+
+      // On a mode switch the provider diff is skipped entirely:
+      // comparing props across runtimes is meaningless (and the new
+      // mode's provider has never seen the old mode's state). The
+      // action is a replacement by definition.
+      const diff = modeSwitched
+        ? ({
+            action: "replace",
+            deleteFirst: false,
+          } satisfies ReplaceDiff)
+        : yield* asEffect(
+            provider
+              ?.diff?.({
+                id,
+                fqn,
+                olds: oldProps,
+                instanceId: oldState.instanceId,
+                output: oldState.attr,
+                news,
+                oldBindings,
+                newBindings,
+              })
+              .pipe(providePlanScope(fqn, oldState.instanceId)),
+          ).pipe(
+            Effect.map(
+              (diff) =>
+                diff ??
+                ({
+                  action:
+                    havePropsChanged(oldProps, news) ||
+                    bindingDiffs.some((b) => b.action !== "noop")
+                      ? "update"
+                      : "noop",
+                } as UpdateDiff | NoopDiff),
+            ),
+            Effect.map((diff) =>
+              options.force && diff.action === "noop"
+                ? ({
+                    action: "update",
+                  } satisfies UpdateDiff)
+                : diff,
+            ),
+            // After a cold-start adoption (silent or takeover), force at
+            // least an update so the provider re-syncs ownership tags /
+            // config against the desired props (otherwise the engine
+            // would noop and any drift between the existing cloud
+            // resource and `news` — including foreign-owned tags after a
+            // takeover — would persist).
+            //
+            // A row that just migrated from a former FQN (`renameMoved`)
+            // gets the same treatment: its cloud resource is still
+            // branded with the OLD logical id's tags, and if the old id
+            // is being reused by a new resource, leaving them stale
+            // would let the reuser's future adoption probes match the
+            // wrong physical resource.
+            Effect.map((diff) =>
+              (forceUpdateAfterAdoption || renameMoved) &&
+              diff.action === "noop"
+                ? ({ action: "update" } satisfies UpdateDiff)
+                : diff,
+            ),
+          );
 
-            // Local ⇄ live switch: the persisted row was reconciled by a
-            // different provider mode than the one resolved for this run.
-            // The two runtimes host distinct physical instances, so this is
-            // always a replacement — the new instance is created with the
-            // new mode's provider, and Apply deletes the old generation
-            // with the provider of the mode that created it (see
-            // `deleteOldGenerations` / `collectGarbage`).
-            const modeSwitched = hasModeSwitched(mode, oldState);
-
-            const Node = <T extends Apply>(
-              node: Omit<
-                T,
-                "provider" | "resource" | "bindings" | "downstream" | "mode"
-              >,
-            ) =>
-              ({
-                ...node,
-                provider,
-                resource,
-                bindings: bindingDiffs,
-                downstream,
-                mode,
-                renamedFrom,
-              }) as any as T;
-
-            // Plan against the persisted state we have, not the ideal final state we
-            // hoped to reach last time. Recovery is expressed by mapping each
-            // intermediate state back onto a fresh CRUD action.
-            if (oldState === undefined) {
-              return Node<Create>({
-                action: "create",
-                props: applyProps,
-                state: oldState,
-              });
-            } else if (
-              !modeSwitched &&
-              oldState.status === "creating" &&
-              oldState.attr === undefined
-            ) {
-              // A create may have succeeded before state persistence failed. If the
-              // provider can recover an attribute snapshot, keep driving the same
-              // create instead of starting over blindly.
-              //
-              // `creating` state persists the RAW plan-time props, which may
-              // still contain unresolved Output expressions (e.g. a name
-              // referencing an upstream created in the same failed deploy).
-              // `read` implementations derive identity from `olds` when
-              // `output` is undefined (as it is here), so handing them
-              // unresolved exprs crashes. Skip the probe — same behavior as
-              // a read that found nothing — and re-drive the create.
-              if (provider.read && isResolved(oldState.props)) {
-                const attr = yield* provider
-                  .read({
-                    id,
-                    fqn,
-                    instanceId: oldState.instanceId,
-                    olds: oldState.props,
-                    output: oldState.attr,
-                  })
-                  .pipe(
-                    providePlanScope(fqn, oldState.instanceId),
-                    // `creating` props pass `isResolved` yet can still carry
-                    // holes where unresolved Outputs were stripped at commit
-                    // time (see stripUnresolved) — e.g. a parent reference
-                    // persisted as `{}`. A provider that dereferences one
-                    // crashes deep inside its SDK client (a SchemaError
-                    // defect), which would brick every subsequent plan on
-                    // the stage. Recovery is best-effort: degrade the defect
-                    // to "nothing recovered" and re-drive the create (#995).
-                    Effect.catchDefect((defect) =>
-                      Effect.logWarning(
-                        `Recovery read for '${fqn}' crashed; treating the ` +
-                          "interrupted create as not recoverable and " +
-                          "re-driving it.",
-                        defect,
-                      ).pipe(Effect.as(undefined)),
-                    ),
-                  );
-                if (attr !== undefined) {
-                  // The recovered resource may be foreign: our interrupted
-                  // create could have lost a name race, or died before
-                  // stamping ownership. Route `Unowned` through the same
-                  // adoption table as the cold-start probe above — never
-                  // silently take over (and later mutate/delete) a resource
-                  // we cannot prove we created.
-                  if (Unowned.is(attr)) {
-                    const adoptThis = resource.Adopt ?? (yield* shouldAdopt);
-                    if (!adoptThis) {
-                      return yield* new OwnedBySomeoneElse({
-                        message:
-                          `Cannot resume creating resource '${fqn}' ` +
-                          `(${resource.Type}): a resource with its physical ` +
-                          "identity exists in the cloud but is not owned by " +
-                          "this stack/stage/logical-id. Re-run with `--adopt` " +
-                          "(or wrap the effect in `adopt(true)`) to take it " +
-                          "over.",
-                        resourceType: resource.Type,
-                        logicalId: id,
-                      });
-                    }
-                  }
-                  // Continue through the normal diff below with the recovered
-                  // live snapshot. Desired props may have changed while the
-                  // previous create was interrupted; bypassing diff here can
-                  // drive an immutable change through reconcile and falsely
-                  // persist the old physical resource as converged.
-                  oldState = { ...oldState, attr: stripUnowned(attr) };
-                }
-              }
-            }
+      if (oldState.status === "creating") {
+        if (diff.action === "noop") {
+          // we're in the creating state and props are un-changed
+          // let's just continue where we left off
+          return Node<Create>({
+            action: "create",
+            props: applyProps,
+            state: oldState,
+          });
+        } else if (diff.action === "update") {
+          // props have changed in a way that is updatable
+          // again, just continue with the create
+          // TODO(sam): should we maybe try an update instead?
+          return Node<Create>({
+            action: "create",
+            props: applyProps,
+            state: oldState,
+          });
+        } else {
+          // props have changed in an incompatible way
+          // because it's possible that an un-updatable resource has already been created
+          // we must use a replace step to create a new one and delete the potential old one
+          return Node<Replace>({
+            action: "replace",
+            props: applyProps,
+            deleteFirst: diff.deleteFirst ?? false,
+            state: oldState,
+          });
+        }
+      } else if (oldState.status === "updating") {
+        // Updating already targets the live resource, so noop/update both mean
+        // "finish the interrupted update". Only a replace diff escalates it
+        // into a fresh replacement.
+        if (diff.action === "update" || diff.action === "noop") {
+          // we can continue where we left off
+          return Node<Update>({
+            action: "update",
+            props: applyProps,
+            state: oldState,
+          });
+        } else {
+          // we started to update a resource but now believe we should replace it
+          return Node<Replace>({
+            action: "replace",
+            deleteFirst: diff.deleteFirst ?? false,
+            props: applyProps,
+            // TODO(sam): can Apply handle replacements when the oldState is UpdatingResourceState?
+            // -> or should we do a provider.read to try and reconcile back to UpdatedResourceState?
+            state: oldState,
+          });
+        }
+      } else if (oldState.status === "replacing") {
+        // The replacement candidate is still being created. Noop/update keep
+        // driving the same generation; replace means that candidate itself is
+        // now obsolete and must be wrapped in a new outer generation.
+        if (diff.action === "noop") {
+          // this is the stable case - noop means just continue with the replacement
+          return Node<Replace>({
+            action: "replace",
+            deleteFirst: oldState.deleteFirst,
+            props: applyProps,
+            state: oldState,
+          });
+        } else if (diff.action === "update") {
+          // potential problem here - the props have changed since we tried to replace,
+          // but not enough to trigger another replacement. the resource provider should
+          // be designed as idempotent to converge to the right state when creating the new resource
+          // the newly generated instanceId is intended to assist with this
+          return Node<Replace>({
+            action: "replace",
+            deleteFirst: oldState.deleteFirst,
+            props: applyProps,
+            state: oldState,
+          });
+        } else {
+          // The in-flight replacement candidate itself now needs replacement.
+          // Mark this as a restart so Apply creates a fresh generation instead
+          // of resuming the old replacement instance.
+          return Node<Replace>({
+            restart: true,
+            action: "replace",
+            deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
+            props: applyProps,
+            state: oldState,
+          });
+        }
+      } else if (oldState.status === "replaced") {
+        // The new resource already exists. Noop means "just let GC finish",
+        // update means "mutate the current replacement before GC finishes",
+        // and replace means "the current replacement also became obsolete".
+        if (diff.action === "noop") {
+          // this is the stable case - noop means just continue cleaning up the replacement
+          return Node<Replace>({
+            action: "replace",
+            deleteFirst: oldState.deleteFirst,
+            props: applyProps,
+            state: oldState,
+          });
+        } else if (diff.action === "update") {
+          // the replacement has been created but now also needs to be updated
+          // the resource provider should:
+          // 1. Update the newly created replacement resource
+          // 2. Then proceed as normal to delete the replaced resources (after all downstream references are updated)
+          return Node<Update>({
+            action: "update",
+            props: applyProps,
+            state: oldState,
+          });
+        } else {
+          // Cleanup is still pending, but the current "new" resource has already
+          // become obsolete. Start another replacement generation and preserve
+          // the existing replaced node as part of the recursive old chain.
+          return Node<Replace>({
+            restart: true,
+            action: "replace",
+            deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
+            props: applyProps,
+            state: oldState,
+          });
+        }
+      } else if (oldState.status === "deleting") {
+        // we're in a partially deleted state, it is unclear whether it was or was not deleted
+        // so continue by re-creating it with the same instanceId and desired props
+        return Node<Create>({
+          action: "create",
+          props: applyProps,
+          state: {
+            ...oldState,
+            status: "creating",
+            props: news,
+          },
+        });
+      } else if (diff.action === "update") {
+        // Stable created/updated resources follow the normal CRUD mapping.
+        return Node<Update>({
+          action: forceUpdateAfterAdoption ? "adopted" : "update",
+          adopting: forceUpdateAfterAdoption,
+          props: applyProps,
+          state: oldState,
+        });
+      } else if (diff.action === "replace") {
+        return Node<Replace>({
+          action: "replace",
+          props: applyProps,
+          state: oldState,
+          deleteFirst: diff?.deleteFirst ?? false,
+        });
+      } else {
+        return Node<NoopUpdate>({
+          action: "noop",
+          state: oldState,
+        });
+      }
+    });
 
-            // Diff against whatever props represent the best-known current attempt.
-            // For replacement recovery that means the top-level replacement props,
-            // not the older generations stored under `old`.
-            const oldProps = oldState.props;
-
-            // On a mode switch the provider diff is skipped entirely:
-            // comparing props across runtimes is meaningless (and the new
-            // mode's provider has never seen the old mode's state). The
-            // action is a replacement by definition.
-            const diff = modeSwitched
-              ? ({
-                  action: "replace",
-                  deleteFirst: false,
-                } satisfies ReplaceDiff)
-              : yield* asEffect(
-                  provider
-                    ?.diff?.({
-                      id,
-                      fqn,
-                      olds: oldProps,
-                      instanceId: oldState.instanceId,
-                      output: oldState.attr,
-                      news,
-                      oldBindings,
-                      newBindings,
-                    })
-                    .pipe(providePlanScope(fqn, oldState.instanceId)),
-                ).pipe(
-                  Effect.map(
-                    (diff) =>
-                      diff ??
-                      ({
-                        action:
-                          havePropsChanged(oldProps, news) ||
-                          bindingDiffs.some((b) => b.action !== "noop")
-                            ? "update"
-                            : "noop",
-                      } as UpdateDiff | NoopDiff),
-                  ),
-                  Effect.map((diff) =>
-                    options.force && diff.action === "noop"
-                      ? ({
-                          action: "update",
-                        } satisfies UpdateDiff)
-                      : diff,
-                  ),
-                  // After a cold-start adoption (silent or takeover), force at
-                  // least an update so the provider re-syncs ownership tags /
-                  // config against the desired props (otherwise the engine
-                  // would noop and any drift between the existing cloud
-                  // resource and `news` — including foreign-owned tags after a
-                  // takeover — would persist).
-                  //
-                  // A row that just migrated from a former FQN (`renameMoved`)
-                  // gets the same treatment: its cloud resource is still
-                  // branded with the OLD logical id's tags, and if the old id
-                  // is being reused by a new resource, leaving them stale
-                  // would let the reuser's future adoption probes match the
-                  // wrong physical resource.
-                  Effect.map((diff) =>
-                    (forceUpdateAfterAdoption || renameMoved) &&
-                    diff.action === "noop"
-                      ? ({ action: "update" } satisfies UpdateDiff)
-                      : diff,
-                  ),
-                );
-
-            if (oldState.status === "creating") {
-              if (diff.action === "noop") {
-                // we're in the creating state and props are un-changed
-                // let's just continue where we left off
-                return Node<Create>({
-                  action: "create",
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else if (diff.action === "update") {
-                // props have changed in a way that is updatable
-                // again, just continue with the create
-                // TODO(sam): should we maybe try an update instead?
-                return Node<Create>({
-                  action: "create",
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else {
-                // props have changed in an incompatible way
-                // because it's possible that an un-updatable resource has already been created
-                // we must use a replace step to create a new one and delete the potential old one
-                return Node<Replace>({
-                  action: "replace",
-                  props: applyProps,
-                  deleteFirst: diff.deleteFirst ?? false,
-                  state: oldState,
-                });
-              }
-            } else if (oldState.status === "updating") {
-              // Updating already targets the live resource, so noop/update both mean
-              // "finish the interrupted update". Only a replace diff escalates it
-              // into a fresh replacement.
-              if (diff.action === "update" || diff.action === "noop") {
-                // we can continue where we left off
-                return Node<Update>({
-                  action: "update",
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else {
-                // we started to update a resource but now believe we should replace it
-                return Node<Replace>({
-                  action: "replace",
-                  deleteFirst: diff.deleteFirst ?? false,
-                  props: applyProps,
-                  // TODO(sam): can Apply handle replacements when the oldState is UpdatingResourceState?
-                  // -> or should we do a provider.read to try and reconcile back to UpdatedResourceState?
-                  state: oldState,
-                });
-              }
-            } else if (oldState.status === "replacing") {
-              // The replacement candidate is still being created. Noop/update keep
-              // driving the same generation; replace means that candidate itself is
-              // now obsolete and must be wrapped in a new outer generation.
-              if (diff.action === "noop") {
-                // this is the stable case - noop means just continue with the replacement
-                return Node<Replace>({
-                  action: "replace",
-                  deleteFirst: oldState.deleteFirst,
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else if (diff.action === "update") {
-                // potential problem here - the props have changed since we tried to replace,
-                // but not enough to trigger another replacement. the resource provider should
-                // be designed as idempotent to converge to the right state when creating the new resource
-                // the newly generated instanceId is intended to assist with this
-                return Node<Replace>({
-                  action: "replace",
-                  deleteFirst: oldState.deleteFirst,
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else {
-                // The in-flight replacement candidate itself now needs replacement.
-                // Mark this as a restart so Apply creates a fresh generation instead
-                // of resuming the old replacement instance.
-                return Node<Replace>({
-                  restart: true,
-                  action: "replace",
-                  deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
-                  props: applyProps,
-                  state: oldState,
-                });
-              }
-            } else if (oldState.status === "replaced") {
-              // The new resource already exists. Noop means "just let GC finish",
-              // update means "mutate the current replacement before GC finishes",
-              // and replace means "the current replacement also became obsolete".
-              if (diff.action === "noop") {
-                // this is the stable case - noop means just continue cleaning up the replacement
-                return Node<Replace>({
-                  action: "replace",
-                  deleteFirst: oldState.deleteFirst,
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else if (diff.action === "update") {
-                // the replacement has been created but now also needs to be updated
-                // the resource provider should:
-                // 1. Update the newly created replacement resource
-                // 2. Then proceed as normal to delete the replaced resources (after all downstream references are updated)
-                return Node<Update>({
-                  action: "update",
-                  props: applyProps,
-                  state: oldState,
-                });
-              } else {
-                // Cleanup is still pending, but the current "new" resource has already
-                // become obsolete. Start another replacement generation and preserve
-                // the existing replaced node as part of the recursive old chain.
-                return Node<Replace>({
-                  restart: true,
-                  action: "replace",
-                  deleteFirst: diff.deleteFirst ?? oldState.deleteFirst,
-                  props: applyProps,
-                  state: oldState,
-                });
-              }
-            } else if (oldState.status === "deleting") {
-              // we're in a partially deleted state, it is unclear whether it was or was not deleted
-              // so continue by re-creating it with the same instanceId and desired props
-              return Node<Create>({
-                action: "create",
-                props: applyProps,
-                state: {
-                  ...oldState,
-                  status: "creating",
-                  props: news,
-                },
-              });
-            } else if (diff.action === "update") {
-              // Stable created/updated resources follow the normal CRUD mapping.
-              return Node<Update>({
-                action: "update",
-                adopting: forceUpdateAfterAdoption,
-                props: applyProps,
-                state: oldState,
-              });
-            } else if (diff.action === "replace") {
-              return Node<Replace>({
-                action: "replace",
-                props: applyProps,
-                state: oldState,
-                deleteFirst: diff?.deleteFirst ?? false,
-              });
-            } else {
-              return Node<NoopUpdate>({
-                action: "noop",
-                state: oldState,
-              });
-            }
-          }),
-        ),
-        { concurrency: "unbounded" },
-      )).map((update) => [update.resource.FQN, update]),
+    // Every diff runs to completion and every failure is reported. With
+    // fail-fast `Effect.all`, the first exit to arrive wins the aggregate
+    // cause — and when a diff is cancelled by a sibling's failure (or ends
+    // interrupt-only for any other reason) that can be a bare interruption,
+    // hiding the InvalidReferenceError or provider error that actually
+    // broke the plan.
+    const diffExits = yield* Effect.all(
+      resources.map((resource) =>
+        Effect.exit(Effect.tap(diffResource(resource), resourcePlanned)),
+      ),
+      { concurrency: "unbounded" },
+    );
+    const diffFailures = diffExits.filter(Exit.isFailure);
+    if (diffFailures.length > 0) {
+      const reasons = diffFailures.flatMap((exit) => exit.cause.reasons);
+      const failures = reasons.filter(
+        (reason) => !Cause.isInterruptReason(reason),
+      );
+      return yield* Effect.failCause(
+        Cause.fromReasons(failures.length > 0 ? failures : reasons),
+      );
+    }
+    const resourceGraph = Object.fromEntries(
+      diffExits
+        .filter(Exit.isSuccess)
+        .map((exit) => [exit.value.resource.FQN, exit.value]),
     ) as Plan["resources"];
 
     // ── Action plan nodes ────────────────────────────────────────────────
-    const actionGraph = Object.fromEntries(
-      (yield* Effect.all(
-        actions.map(
-          Effect.fn("plan.diff.action")(function* (action) {
-            const fqn = action.FQN;
-            const downstream = newDownstreamDependencies[fqn] ?? [];
-            // The node carries the RAW input expression (evaluated at apply);
-            // the drift hash uses the diff-facing view so stable upstream
-            // attributes hash as their known values.
-            const resolvedInput = materializeStableRefs(
-              yield* resolveInput(action.Input),
-            );
-            const inputHash = yield* hashInput(resolvedInput);
-            const oldState = yield* state.get({
-              stack: stackName,
-              stage,
-              fqn,
-            });
+    // Per-action plan progress, mirroring the resource pass.
+    const actionCount = yield* Ref.make(0);
+    const actionPlanned = (entry: readonly [string, ActionApply]) =>
+      Ref.updateAndGet(actionCount, (count) => count + 1).pipe(
+        Effect.flatMap((completed) =>
+          reportPlanned({
+            _tag: "plan.action.completed",
+            ...describeAction(entry[1]),
+            completed,
+            total: actions.length,
+          }),
+        ),
+      );
 
-            if (oldState && !isActionState(oldState)) {
-              // FQN collision with a resource — surface as a fatal error so
-              // the user resolves it before we touch anything.
-              return [
-                fqn,
-                {
-                  kind: "action",
-                  action: "run",
-                  def: action,
-                  input: action.Input,
-                  state: undefined,
-                  downstream,
-                  forced: false,
-                } satisfies ActionRun,
-              ] as const;
-            }
+    const diffAction = Effect.fn("plan.diff.action")(function* (
+      action: ActionLike,
+    ) {
+      const fqn = action.FQN;
+      const downstream = newDownstreamDependencies[fqn] ?? [];
+      // The node carries the RAW input expression (evaluated at apply);
+      // the drift hash uses the diff-facing view so stable upstream
+      // attributes hash as their known values.
+      const resolvedInput = materializeStableRefs(
+        yield* resolveInput(action.Input),
+      );
+      const inputHash = yield* hashInput(resolvedInput);
+      const oldState = yield* state.get({
+        stack: stackName,
+        stage,
+        fqn,
+      });
 
-            const prior = oldState as ActionState | undefined;
-            const sameInput =
-              prior?.status === "ran" && prior.inputHash === inputHash;
-            if (sameInput && !options.force) {
-              return [
-                fqn,
-                {
-                  kind: "action",
-                  action: "noop",
-                  def: action,
-                  state: prior as RanActionState,
-                  downstream,
-                } satisfies ActionNoop,
-              ] as const;
-            }
-            return [
-              fqn,
-              {
-                kind: "action",
-                action: "run",
-                def: action,
-                input: action.Input,
-                state: prior,
-                downstream,
-                forced: !!options.force,
-              } satisfies ActionRun,
-            ] as const;
-          }),
+      if (oldState && !isActionState(oldState)) {
+        // FQN collision with a resource — surface as a fatal error so
+        // the user resolves it before we touch anything.
+        return [
+          fqn,
+          {
+            kind: "action",
+            action: "run",
+            def: action,
+            input: action.Input,
+            state: undefined,
+            downstream,
+            forced: false,
+          } satisfies ActionRun,
+        ] as const;
+      }
+
+      const prior = oldState as ActionState | undefined;
+      const sameInput =
+        prior?.status === "ran" && prior.inputHash === inputHash;
+      if (sameInput && !options.force) {
+        return [
+          fqn,
+          {
+            kind: "action",
+            action: "noop",
+            def: action,
+            state: prior as RanActionState,
+            downstream,
+          } satisfies ActionNoop,
+        ] as const;
+      }
+      return [
+        fqn,
+        {
+          kind: "action",
+          action: "run",
+          def: action,
+          input: action.Input,
+          state: prior,
+          downstream,
+          forced: !!options.force,
+        } satisfies ActionRun,
+      ] as const;
+    });
+
+    const actionGraph = Object.fromEntries(
+      (yield* Effect.all(
+        actions.map((action) =>
+          diffAction(action).pipe(Effect.tap(actionPlanned)),
         ),
         { concurrency: "unbounded" },
       )) as ReadonlyArray<readonly [string, ActionApply]>,
@@ -1680,8 +1834,7 @@ export const make = <A>(
       const createReplaceNodes = new Set(
         Object.entries(resourceGraph)
           .filter(
-            ([_, node]) =>
-              node.action === "create" || node.action === "replace",
+            ([, node]) => node.action === "create" || node.action === "replace",
           )
           .map(([fqn]) => fqn),
       );
@@ -1730,138 +1883,191 @@ export const make = <A>(
       }
     }
 
+    // Both orphan passes (task rows below, resource rows further down)
+    // examine every persisted row of this stack instance.
+    const persistedFqns = yield* state.list({ stack: stackName, stage });
+
+    // Orphan progress mirrors the diff passes: every persisted row is
+    // examined, but only rows that actually become deletion nodes are
+    // reported — `completed` tracks examination so progress stays monotonic.
+    const actionExaminedCount = yield* Ref.make(0);
+    const actionDeletionPlanned = (
+      entry: readonly [string, ActionDelete] | undefined,
+    ) =>
+      Ref.updateAndGet(actionExaminedCount, (count) => count + 1).pipe(
+        Effect.flatMap((completed) =>
+          entry === undefined
+            ? Effect.void
+            : reportPlanned({
+                _tag: "plan.action.completed",
+                ...describeAction(entry[1]),
+                completed,
+                total: persistedFqns.length,
+              }),
+        ),
+      );
+
     // Task deletions: state rows previously written by tasks that no
     // longer appear in the stack. The body is NOT invoked — we just drop
     // the row.
+    const diffActionDeletion = Effect.fn("plan.diff.actionDeletion")(function* (
+      fqn: string,
+    ) {
+      if (newActionFqns.has(fqn) || newResourceFqns.has(fqn)) return;
+      const persisted = yield* state.get({
+        stack: stackName,
+        stage,
+        fqn,
+      });
+      if (!isActionState(persisted)) return;
+      const { logicalId } = parseFqn(fqn);
+      return [
+        fqn,
+        {
+          kind: "action",
+          action: "delete",
+          state: persisted,
+          downstream: persisted.downstream ?? [],
+          def: {
+            Kind: "action",
+            Namespace: persisted.namespace,
+            FQN: fqn,
+            LogicalId: logicalId,
+            Type: persisted.actionType,
+            Input: persisted.input,
+            Captures: {},
+            Run: () => undefined as any,
+            Output: undefined as any,
+          } satisfies ActionLike,
+        } satisfies ActionDelete,
+      ] as const;
+    });
+
     const actionDeletions: Plan["actionDeletions"] = Object.fromEntries(
       (yield* Effect.all(
-        (yield* state.list({ stack: stackName, stage })).map(
-          Effect.fn("plan.diff.actionDeletion")(function* (fqn) {
-            if (newActionFqns.has(fqn) || newResourceFqns.has(fqn)) return;
-            const persisted = yield* state.get({
-              stack: stackName,
-              stage,
-              fqn,
-            });
-            if (!isActionState(persisted)) return;
-            const { logicalId } = parseFqn(fqn);
-            return [
-              fqn,
-              {
-                kind: "action",
-                action: "delete",
-                state: persisted,
-                downstream: persisted.downstream ?? [],
-                def: {
-                  Kind: "action",
-                  Namespace: persisted.namespace,
-                  FQN: fqn,
-                  LogicalId: logicalId,
-                  Type: persisted.actionType,
-                  Input: persisted.input,
-                  Captures: {},
-                  Run: () => undefined as any,
-                  Output: undefined as any,
-                } satisfies ActionLike,
-              } satisfies ActionDelete,
-            ] as const;
-          }),
+        persistedFqns.map((fqn) =>
+          diffActionDeletion(fqn).pipe(
+            Effect.tap((entry) => actionDeletionPlanned(entry ?? undefined)),
+          ),
         ),
         { concurrency: "unbounded" },
       )).filter((v): v is NonNullable<typeof v> => !!v),
     );
 
+    // Deletion progress mirrors the resource pass: every persisted row is
+    // examined, but only rows that actually become deletion nodes are
+    // reported — `completed` tracks examination so progress stays monotonic.
+    const deletionCandidates = persistedFqns;
+    const examinedCount = yield* Ref.make(0);
+    const deletionPlanned = (entry: readonly [string, Delete] | undefined) =>
+      Ref.updateAndGet(examinedCount, (count) => count + 1).pipe(
+        Effect.flatMap((completed) =>
+          entry === undefined
+            ? Effect.void
+            : reportPlanned({
+                _tag: "plan.resource.completed",
+                ...describeResource(entry[1]),
+                completed,
+                total: deletionCandidates.length,
+              }),
+        ),
+      );
+
+    const diffDeletion = Effect.fn("plan.diff.deletion")(function* (
+      fqn: string,
+    ) {
+      if (newResourceFqns.has(fqn) || newActionFqns.has(fqn)) {
+        return;
+      }
+      const persisted = yield* state.get({
+        stack: stackName,
+        stage: stage,
+        fqn,
+      });
+      // Tasks are routed through `actionDeletions` above.
+      if (isActionState(persisted)) return;
+      const oldState = persisted as ResourceState | undefined;
+      if (oldState) {
+        // A row being migrated by a rename (`renameMigrations`) is
+        // moving, not orphaned — apply drops it state-only after
+        // committing the migrated row at its new FQN. Rows at former
+        // FQNs that did NOT migrate (foreign type, different
+        // instanceId, unclaimed) are absent from this set and fall
+        // through to normal orphan deletion.
+        if (migratedRowFqns.has(fqn)) {
+          return;
+        }
+        const { logicalId } = parseFqn(fqn);
+        const resourceType = oldState.resourceType;
+        // A "zombie" row references a type with no registered provider
+        // (removed from the program, or renamed without an alias).
+        // That is fatal: the program and state disagree, and without
+        // the provider the row's physical resource cannot be deleted
+        // anyway. Die at plan time with a typed error naming the row
+        // and the remediation instead of limping into a partial apply.
+        //
+        // Orphan deletes resolve the provider variant for the mode
+        // that created the row (`providerMode`, or the `dev:` marker
+        // inference for legacy unstamped rows), so e.g. a local dev
+        // worker's row is deleted by the local provider even during a
+        // live deploy — and vice versa. Unstamped rows are physically
+        // live unless their attrs carry the marker (see stampedMode),
+        // never the run default.
+        const rowMode = stampedMode(oldState);
+        const providerOption = yield* tryFindProviderByType(
+          resourceType,
+          rowMode,
+        );
+        if (Option.isNone(providerOption)) {
+          return yield* Effect.die(missingProviderError(resourceType, fqn));
+        }
+        const provider = providerOption.value;
+        // NOTE: an attr-less row (interrupted create) is NOT recovered
+        // here. Apply's `deleteResource` performs the authoritative
+        // read-then-delete recovery — it also covers replaced-chain
+        // old generations that never pass through plan, and routes
+        // `Unowned` results away from `provider.delete`.
+        return [
+          fqn,
+          {
+            action: oldState.removalPolicy === "retain" ? "orphaned" : "delete",
+            state: oldState,
+            provider: provider,
+            mode: oldState.providerMode,
+            resource: {
+              Namespace: oldState.namespace,
+              FQN: fqn,
+              LogicalId: logicalId,
+              Type: oldState.resourceType,
+              Attributes: oldState.attr,
+              Props: oldState.props,
+              Binding: undefined!,
+              Provider: Provider(resourceType),
+              RemovalPolicy: oldState.removalPolicy,
+              Adopt: undefined,
+              RequiresImplementation: undefined,
+              Mode: oldState.providerMode,
+              FormerFqns: undefined,
+              RuntimeContext: undefined!,
+              Providers: undefined,
+            } as ResourceLike,
+            downstream: oldDownstreamDependencies[fqn] ?? [],
+            bindings: oldState.bindings.map((binding) => ({
+              sid: binding.sid,
+              action: "delete" as const,
+              data: binding.data,
+            })),
+          } satisfies Delete,
+        ] as const;
+      }
+    });
+
     const deletions = Object.fromEntries(
       (yield* Effect.all(
-        (yield* state.list({ stack: stackName, stage: stage })).map(
-          Effect.fn("plan.diff.deletion")(function* (fqn) {
-            if (newResourceFqns.has(fqn) || newActionFqns.has(fqn)) {
-              return;
-            }
-            const persisted = yield* state.get({
-              stack: stackName,
-              stage: stage,
-              fqn,
-            });
-            // Tasks are routed through `actionDeletions` above.
-            if (isActionState(persisted)) return;
-            const oldState = persisted as ResourceState | undefined;
-            if (oldState) {
-              // A row being migrated by a rename (`renameMigrations`) is
-              // moving, not orphaned — apply drops it state-only after
-              // committing the migrated row at its new FQN. Rows at former
-              // FQNs that did NOT migrate (foreign type, different
-              // instanceId, unclaimed) are absent from this set and fall
-              // through to normal orphan deletion.
-              if (migratedRowFqns.has(fqn)) {
-                return;
-              }
-              const { logicalId } = parseFqn(fqn);
-              const resourceType = oldState.resourceType;
-              // A "zombie" row references a type with no registered provider
-              // (removed from the program, or renamed without an alias).
-              // That is fatal: the program and state disagree, and without
-              // the provider the row's physical resource cannot be deleted
-              // anyway. Die at plan time with a typed error naming the row
-              // and the remediation instead of limping into a partial apply.
-              //
-              // Orphan deletes resolve the provider variant for the mode
-              // that created the row (`providerMode`, or the `dev:` marker
-              // inference for legacy unstamped rows), so e.g. a local dev
-              // worker's row is deleted by the local provider even during a
-              // live deploy — and vice versa. Unstamped rows are physically
-              // live unless their attrs carry the marker (see stampedMode),
-              // never the run default.
-              const rowMode = stampedMode(oldState);
-              const providerOption = yield* tryFindProviderByType(
-                resourceType,
-                rowMode,
-              );
-              if (Option.isNone(providerOption)) {
-                return yield* Effect.die(
-                  missingProviderError(resourceType, fqn),
-                );
-              }
-              const provider = providerOption.value;
-              // NOTE: an attr-less row (interrupted create) is NOT recovered
-              // here. Apply's `deleteResource` performs the authoritative
-              // read-then-delete recovery — it also covers replaced-chain
-              // old generations that never pass through plan, and routes
-              // `Unowned` results away from `provider.delete`.
-              return [
-                fqn,
-                {
-                  action: "delete",
-                  state: oldState,
-                  provider: provider,
-                  mode: oldState.providerMode,
-                  resource: {
-                    Namespace: oldState.namespace,
-                    FQN: fqn,
-                    LogicalId: logicalId,
-                    Type: oldState.resourceType,
-                    Attributes: oldState.attr,
-                    Props: oldState.props,
-                    Binding: undefined!,
-                    Provider: Provider(resourceType),
-                    RemovalPolicy: oldState.removalPolicy,
-                    Adopt: undefined,
-                    RequiresImplementation: undefined,
-                    Mode: oldState.providerMode,
-                    FormerFqns: undefined,
-                    RuntimeContext: undefined!,
-                    Providers: undefined,
-                  } as ResourceLike,
-                  downstream: oldDownstreamDependencies[fqn] ?? [],
-                  bindings: oldState.bindings.map((binding) => ({
-                    sid: binding.sid,
-                    action: "delete" as const,
-                    data: binding.data,
-                  })),
-                } satisfies Delete,
-              ] as const;
-            }
-          }),
+        deletionCandidates.map((fqn) =>
+          diffDeletion(fqn).pipe(
+            Effect.tap((entry) => deletionPlanned(entry ?? undefined)),
+          ),
         ),
         { concurrency: "unbounded" },
       )).filter((v) => !!v),
@@ -1893,6 +2099,8 @@ export const make = <A>(
       defaultMode: runDefaultMode,
     } satisfies Plan<A> as Plan<A>;
   }).pipe(
+    // Owns the memoized resolutions' fibers for the plan's duration.
+    Effect.scoped,
     ensureArtifactStore,
     Effect.withSpan("plan.make", {
       attributes: {
@@ -1991,8 +2199,12 @@ export const printPlan = (plan: Plan): string => {
         return "+";
       case "update":
         return "~";
+      case "adopted":
+        return "(+)";
       case "delete":
         return "-";
+      case "orphaned":
+        return "(-)";
       case "replace":
         return "±";
       case "noop":