alchemy 2.0.0-beta.84 → 2.0.0-beta.85

package/lib/Apply.js

@@ -2,28 +2,30 @@ import * as Cause from "effect/Cause";
 import * as Data from "effect/Data";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
-import * as Exit from "effect/Exit";
+import * as Formatter from "effect/Formatter";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Predicate from "effect/Predicate";
 import { makeResolveContext } from "./ActionRuntimeContext.js";
-import { OwnedBySomeoneElse, stripUnowned, Unowned } from "./AdoptPolicy.js";
+import { OwnedBySomeoneElse, stripUnowned, Unowned, Unresolved, UnverifiableReplacement, } from "./AdoptPolicy.js";
 import { AlchemyContext } from "./AlchemyContext.js";
 import { Artifacts, ArtifactStore, createArtifactStore, ensureArtifactStore, makeScopedArtifacts, } from "./Artifacts.js";
 import { failCredentialsRequired, demandPlanCredentials, } from "./Auth/Demand.js";
-import { havePropsChanged, stripUnresolved } from "./Diff.js";
+import { havePropsChanged, isResolved, stripEffects, stripUnresolved } from "./Diff.js";
+import { captureEmit } from "./Events.js";
 import { generateInstanceId } from "./InstanceId.js";
 import * as Output from "./Output.js";
 import {} from "./Plan.js";
 import { findProviderByType, missingProviderError, tryFindProviderByType, } from "./Provider.js";
 import { stampedMode } from "./ProviderMode.js";
-import { Cli, noopSession, } from "./Report.js";
+import { resourceSession } from "./Report.js";
 import { ResourceContext } from "./ResourceContext.js";
 import { RuntimeContext } from "./RuntimeContext.js";
 import { Stack } from "./Stack.js";
 import { Stage } from "./Stage.js";
 import { State, StateStoreError, } from "./State/index.js";
 import { recordResourceOp } from "./Telemetry/Metrics.js";
+import { LogAnnotation } from "./Util/LogAnnotation.js";
 import { hashInput } from "./Util/sha256.js";
 /**
  * Record a resource's result in `tracker` and its output in `outputs`, the
@@ -35,6 +37,20 @@ const track = (tracker, outputs, fqn, entry) => {
     tracker[fqn] = entry;
     outputs[fqn] = entry.output;
 };
+/**
+ * Whether an attr-less checkpoint lost props to `stripUnresolved`. Its stored
+ * props no longer identify the physical resource it was creating (e.g. a
+ * stripped namespace makes a name match a different resource), so recovery
+ * must not look the resource up from them.
+ *
+ * Effect-valued props don't count: `Output.evaluate` passes them through
+ * untouched, so even fully resolved props carry them (a Function's runtime
+ * wiring). They never name a physical resource, and treating them as holes
+ * would mark every create of such a resource and orphan it on interruption.
+ */
+const propsIncomplete = (value) => value.attr === undefined && (value.propsIncomplete || !isResolved(stripEffects(value.props)))
+    ? true
+    : undefined;
 const provideLifecycleScope = (resource) => (effect) => Effect.serviceOption(ArtifactStore).pipe(Effect.map(Option.getOrElse(createArtifactStore)), Effect.flatMap((store) => effect.pipe(failCredentialsRequired(resource.fqn), Effect.provide([
     Layer.succeed(Artifacts, makeScopedArtifacts(store, resource.fqn)),
     Layer.succeed(ResourceContext, resource),
@@ -49,7 +65,9 @@ const provideLifecycleScope = (resource) => (effect) => Effect.serviceOption(Art
  * are dispatched, so wrapping it here gives us a fully-instrumented
  * toolchain without touching any individual provider implementation.
  */
-const instrumentLifecycle = (op, fqn, resourceType, logicalId, instanceId) => (effect) => effect.pipe(provideLifecycleScope({ logicalId, fqn, instanceId, type: resourceType }), recordResourceOp(resourceType, op), Effect.withSpan(`provider.${op}`, {
+const instrumentLifecycle = (op, fqn, resourceType, logicalId, instanceId) => (effect) => effect.pipe(provideLifecycleScope({ logicalId, fqn, instanceId, type: resourceType }), 
+// Every log a provider writes during the op carries its resource.
+Effect.annotateLogs(LogAnnotation.fqn, fqn), recordResourceOp(resourceType, op), Effect.withSpan(`provider.${op}`, {
     attributes: {
         "alchemy.resource.fqn": fqn,
         "alchemy.resource.type": resourceType,
@@ -58,7 +76,64 @@ const instrumentLifecycle = (op, fqn, resourceType, logicalId, instanceId) => (e
         "alchemy.resource.op": op,
     },
 }));
-export const apply = (plan, options = {}) => Effect.gen(function* () {
+/**
+ * A dependency cycle precreates on raw props, before `read` can check
+ * ownership. Ask the provider's `observe` what exists at the identity
+ * precreate would claim, and refuse a foreign resource unless adoption is
+ * allowed. A provider without `observe` precreates `unchecked`; one whose
+ * identity has not resolved yet reports it `unresolved`, so the engine must
+ * check the resolved identity before reconcile claims it.
+ */
+const observeBeforePrecreate = Effect.fn(function* (node, news, fqn, logicalId, instanceId, previous) {
+    if (node.provider.observe === undefined || node.deferredAdoption === undefined) {
+        return "unchecked";
+    }
+    const observed = yield* node.provider
+        .observe({ id: logicalId, fqn, instanceId, news, previous })
+        .pipe(instrumentLifecycle("observe", fqn, node.resource.Type, logicalId, instanceId));
+    if (observed === Unresolved)
+        return "unresolved";
+    if (observed !== undefined && Unowned.is(observed) && !node.deferredAdoption.adopt) {
+        return yield* new OwnedBySomeoneElse({
+            message: `Cannot pre-create resource '${fqn}' (${node.resource.Type}): ` +
+                "it exists in the cloud but is not owned by this " +
+                "stack/stage/logical-id. Re-run with `--adopt` (or " +
+                "wrap the effect in `adopt(true)`) to take it over.",
+            resourceType: node.resource.Type,
+            logicalId,
+        });
+    }
+    return "admitted";
+});
+/** A provider's `observe` reported `Unresolved` for fully resolved props. */
+class UnresolvedObservation extends Data.TaggedError("UnresolvedObservation") {
+}
+/**
+ * Reports what exists at the resolved identity reconcile will claim: `read`
+ * when the provider implements it, `observe` otherwise. A replacement passes
+ * its `previous` generation's attributes, so the provider can recognize it.
+ */
+const observeResolved = Effect.fn(function* (node, news, fqn, logicalId, instanceId, previous) {
+    if (node.provider.read) {
+        return yield* node.provider
+            .read({ id: logicalId, fqn, instanceId, olds: news, output: undefined, previous })
+            .pipe(instrumentLifecycle("read", fqn, node.resource.Type, logicalId, instanceId));
+    }
+    const observed = yield* node.provider.observe({
+        id: logicalId,
+        fqn,
+        instanceId,
+        news,
+        previous,
+    }).pipe(instrumentLifecycle("observe", fqn, node.resource.Type, logicalId, instanceId));
+    if (observed === Unresolved) {
+        return yield* Effect.die(new UnresolvedObservation({
+            message: `The provider for '${fqn}' (${node.resource.Type}) reported its identity as Unresolved, but its props are resolved.`,
+        }));
+    }
+    return observed;
+});
+export const apply = (plan) => Effect.gen(function* () {
     // Credential-free dev: a dev-mode plan that needs the real cloud
     // (`Alchemy.remote()` rows, remote-proxied bindings, deletions of rows
     // stamped `providerMode: "live"`) demands cloud credentials exactly
@@ -72,93 +147,99 @@ export const apply = (plan, options = {}) => Effect.gen(function* () {
     if (Option.isSome(alchemy) && alchemy.value.dev) {
         yield* demandPlanCredentials(plan);
     }
-    // Renderer resolution: an explicit session wins, then the ambient Cli
-    // renderer service (the bundled CLI, LoggingCli in tests, or a custom
-    // implementation), else events are dropped.
-    const session = options.session ??
-        (yield* Effect.serviceOption(Cli).pipe(Effect.flatMap(Option.match({
-            onNone: () => Effect.succeed(noopSession),
-            onSome: (cli) => cli.startApplySession(plan, options.planDisplay),
-        }))));
-    // The nested gen exists so `onExit` can settle the session on every
-    // exit path without introducing a scope: local dev providers start
-    // long-running processes in the AMBIENT scope during reconcile, so
-    // wrapping this body in Effect.scoped would kill them when apply
-    // returns.
-    return yield* Effect.gen(function* () {
-        const state = yield* yield* State;
-        const stack = yield* Stack;
-        const stage = yield* Stage;
-        const stackName = stack.name;
-        const tracker = {};
-        const outputs = {};
-        const terminalStatuses = new Map();
-        // ── FQN migrations (renamedFrom) ──
-        // Persist renames before any lifecycle operation runs: a node whose row
-        // was found under a former FQN carries that row pre-remapped in
-        // `node.state` (see Plan's rename resolution). Commit it at the current
-        // FQN FIRST, then drop the former row — in that order, so an
-        // interruption leaves rows at both FQNs with the same instanceId, which
-        // the next plan recognizes as an in-flight migration (and never as an
-        // orphan to delete).
-        //
-        // In a same-deploy shift (A→B while B→C), C's former FQN `B` is
-        // simultaneously B's migration TARGET. C must NOT delete it: B's own
-        // `state.set` supersedes the stale copy, and the migrations run
-        // concurrently — the delete could land after B's write and destroy the
-        // freshly migrated row.
-        const migrationTargets = new Set(Object.values(plan.resources)
-            .filter((node) => node.renamedFrom?.length && node.state !== undefined)
-            .map((node) => node.resource.FQN));
-        yield* Effect.forEach(Object.values(plan.resources), (node) => {
-            const { renamedFrom, state: row } = node;
-            return renamedFrom === undefined || renamedFrom.length === 0 || row === undefined
-                ? Effect.void
-                : Effect.gen(function* () {
-                    yield* state.set({ stack: stackName, stage, fqn: node.resource.FQN, value: row });
-                    yield* Effect.forEach(renamedFrom.filter((formerFqn) => !migrationTargets.has(formerFqn)), (formerFqn) => state.delete({ stack: stackName, stage, fqn: formerFqn }), { concurrency: "unbounded" });
-                });
-        }, { concurrency: "unbounded" });
-        yield* executePlan(plan, tracker, outputs, terminalStatuses, session, state, stackName, stage);
-        // TODO(sam): support roll back to previous state if errors occur during expansion
-        // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
-        // TODO(sam): should pivot be done separately? E.g shift traffic?
-        yield* collectGarbage(plan, session);
-        yield* converge(plan, tracker, outputs, terminalStatuses, session, state, stackName, stage);
-        yield* Effect.forEach(Array.from(terminalStatuses.values()), ({ fqn, id, type, status, providerMode }) => session.emit({ _tag: "apply.resource.status", fqn, id, type, status, providerMode }), { concurrency: "unbounded" });
-        if (plan.destroy) {
-            // The destroy converged: every resource row was deleted above. Drop
-            // the rest of the stage's persisted state — notably the stack output
-            // record written by the last deploy — so `getOutput` returns
-            // undefined and `listStages` no longer reports the stage.
-            // https://github.com/alchemy-run/alchemy/issues/961
-            yield* state.deleteStack({ stack: stackName, stage });
-            // Invariant: a successful destroy leaves the stage EMPTY. If rows
-            // survive, this destroy session could not actually see (or delete)
-            // the stack's state — e.g. its plan listed an empty store while
-            // committed rows existed — and reporting success here would silently
-            // leak every cloud resource those rows track. Fail loudly instead so
-            // the leak surfaces in the run that caused it.
-            const remaining = yield* state.list({ stack: stackName, stage });
-            if (remaining.length > 0) {
-                return yield* new StateStoreError({
-                    message: `destroy of ${stackName}/${stage} reported success but ${remaining.length} ` +
-                        `state row(s) remain (${remaining.join(", ")}) — the destroy session could ` +
-                        `not see the stack's persisted state, so its cloud resources were NOT deleted`,
-                });
-            }
-            return undefined;
-        }
-        if (plan.selectedFqns !== undefined || !plan.output) {
-            return undefined;
+    const emitEvent = yield* captureEmit;
+    // The last status each resource announced, so the post-convergence
+    // flush below re-emits only what is still unannounced (cycle members).
+    const announced = new Map();
+    const reportEvent = (event) => {
+        if (event.type === "apply.resource.status")
+            announced.set(event.fqn, event.status);
+        return emitEvent(event);
+    };
+    // No Effect.scoped around apply: local dev providers start long-running
+    // processes in the AMBIENT scope during reconcile, which a scope here
+    // would kill when apply returns.
+    const state = yield* yield* State;
+    const stack = yield* Stack;
+    const stage = yield* Stage;
+    const stackName = stack.name;
+    const tracker = {};
+    const outputs = {};
+    const terminalStatuses = new Map();
+    // ── FQN migrations (renamedFrom) ──
+    // Persist renames before any lifecycle operation runs: a node whose row
+    // was found under a former FQN carries that row pre-remapped in
+    // `node.state` (see Plan's rename resolution). Commit it at the current
+    // FQN FIRST, then drop the former row — in that order, so an
+    // interruption leaves rows at both FQNs with the same instanceId, which
+    // the next plan recognizes as an in-flight migration (and never as an
+    // orphan to delete).
+    //
+    // In a same-deploy shift (A→B while B→C), C's former FQN `B` is
+    // simultaneously B's migration TARGET. C must NOT delete it: B's own
+    // `state.set` supersedes the stale copy, and the migrations run
+    // concurrently — the delete could land after B's write and destroy the
+    // freshly migrated row.
+    const migrationTargets = new Set(Object.values(plan.resources)
+        .filter((node) => node.renamedFrom?.length && node.state !== undefined)
+        .map((node) => node.resource.FQN));
+    yield* Effect.forEach(Object.values(plan.resources), (node) => {
+        const { renamedFrom, state: row } = node;
+        return renamedFrom === undefined || renamedFrom.length === 0 || row === undefined
+            ? Effect.void
+            : Effect.gen(function* () {
+                yield* state.set({ stack: stackName, stage, fqn: node.resource.FQN, value: row });
+                yield* Effect.forEach(renamedFrom.filter((formerFqn) => !migrationTargets.has(formerFqn)), (formerFqn) => state.delete({ stack: stackName, stage, fqn: formerFqn }), { concurrency: "unbounded" });
+            });
+    }, { concurrency: "unbounded" });
+    yield* executePlan(plan, tracker, outputs, terminalStatuses, reportEvent, state, stackName, stage);
+    // TODO(sam): support roll back to previous state if errors occur during expansion
+    // -> RISK: some UPDATEs may not be reversible (i.e. trigger replacements)
+    // TODO(sam): should pivot be done separately? E.g shift traffic?
+    yield* collectGarbage(plan, reportEvent);
+    yield* converge(plan, tracker, outputs, terminalStatuses, reportEvent, state, stackName, stage);
+    // Cycle members hold their terminal status until `converge` settles
+    // it; everything else announced it as it finished.
+    yield* Effect.forEach(Array.from(terminalStatuses.values()).filter(({ fqn, status }) => announced.get(fqn) !== status), ({ fqn, id, type, status, providerMode }) => reportEvent({
+        type: "apply.resource.status",
+        fqn,
+        id,
+        resourceType: type,
+        status,
+        providerMode,
+    }), { concurrency: "unbounded" });
+    if (plan.destroy) {
+        // The destroy converged: every resource row was deleted above. Drop
+        // the rest of the stage's persisted state — notably the stack output
+        // record written by the last deploy — so `getOutput` returns
+        // undefined and `listStages` no longer reports the stage.
+        // https://github.com/alchemy-run/alchemy/issues/961
+        yield* state.deleteStack({ stack: stackName, stage });
+        // Invariant: a successful destroy leaves the stage EMPTY. If rows
+        // survive, this destroy session could not actually see (or delete)
+        // the stack's state — e.g. its plan listed an empty store while
+        // committed rows existed — and reporting success here would silently
+        // leak every cloud resource those rows track. Fail loudly instead so
+        // the leak surfaces in the run that caused it.
+        const remaining = yield* state.list({ stack: stackName, stage });
+        if (remaining.length > 0) {
+            return yield* new StateStoreError({
+                message: `destroy of ${stackName}/${stage} reported success but ${remaining.length} ` +
+                    `state row(s) remain (${remaining.join(", ")}) — the destroy session could ` +
+                    `not see the stack's persisted state, so its cloud resources were NOT deleted`,
+            });
         }
-        const resolved = yield* Output.evaluate(plan.output, outputs);
-        // Persist the stack's evaluated outputs so cross-stack references
-        // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
-        // can read them back out of the state store.
-        yield* state.setOutput({ stack: stackName, stage, value: resolved });
-        return resolved;
-    }).pipe(Effect.onExit((exit) => session.done(Exit.isSuccess(exit) ? "success" : "failure")));
+        return undefined;
+    }
+    if (plan.selectedFqns !== undefined || !plan.output) {
+        return undefined;
+    }
+    const resolved = yield* Output.evaluate(plan.output, outputs);
+    // Persist the stack's evaluated outputs so cross-stack references
+    // (`yield* OtherStack` / `OtherStack.stage.<name>` / `Output.stackRef`)
+    // can read them back out of the state store.
+    yield* state.setOutput({ stack: stackName, stage, value: resolved });
+    return resolved;
 }).pipe(ensureArtifactStore, Effect.withSpan("apply", {
     attributes: {
         "alchemy.resources.count": Object.keys(plan.resources).length,
@@ -171,20 +252,18 @@ export const apply = (plan, options = {}) => Effect.gen(function* () {
 // available in `tracker`." Resources with `precreate` signal early so that
 // downstream resources can resolve stable identifiers without deadlocking.
 // The actual output lives in the mutable `tracker` map, not in the Deferred.
-const executePlan = Effect.fn(function* (plan, tracker, outputs, terminalStatuses, session, state, stackName, stage) {
+const executePlan = Effect.fn(function* (plan, tracker, outputs, terminalStatuses, reportEvent, state, stackName, stage) {
     // Resources and tasks share the same FQN namespace and DAG, so the
     // scheduler tracks them together. Each entry gets a single Deferred that
     // signals "my output is available in `tracker`."
     const allNodes = { ...plan.resources, ...plan.actions };
-    const ready = Object.fromEntries(yield* Effect.all(Object.keys(allNodes).map((fqn) => Effect.map(Deferred.make(), (d) => [fqn, d]))));
+    const ready = Object.fromEntries(yield* Effect.forEach(Object.keys(allNodes), (fqn) => Effect.map(Deferred.make(), (d) => [fqn, d])));
     // `readyStable` fires only when a node has reached its TERMINAL output —
     // resources after `reconcile`, tasks after the body completes. Resource
     // precreate stubs do NOT signal `readyStable`, so any consumer that
     // requires stable inputs (e.g. Tasks) waits past the precreate phase.
-    const readyStable = Object.fromEntries(yield* Effect.all(Object.keys(allNodes).map((fqn) => Effect.map(Deferred.make(), (d) => [fqn, d]))));
-    const waitForDeps = (downstreamFqn, fqns) => Effect.all(fqns
-        .filter((fqn) => fqn in ready)
-        .map((fqn) => 
+    const readyStable = Object.fromEntries(yield* Effect.forEach(Object.keys(allNodes), (fqn) => Effect.map(Deferred.make(), (d) => [fqn, d])));
+    const waitForDeps = (downstreamFqn, fqns) => Effect.forEach(fqns.filter((fqn) => fqn in ready), (fqn) => 
     // Non-cycle upstreams must be observed at their TERMINAL output
     // (`readyStable`), not their early precreate signal (`ready`). This
     // is what makes a failed upstream actually interrupt its downstream:
@@ -202,12 +281,12 @@ const executePlan = Effect.fn(function* (plan, tracker, outputs, terminalStatuse
     // consumer cannot attach to a Worker's fetch-only precreate stub.
     plan.cycleMembers.has(downstreamFqn) && plan.cycleMembers.has(fqn)
         ? Deferred.await(ready[fqn])
-        : Deferred.await(readyStable[fqn])), { concurrency: "unbounded" });
-    const waitForStableDeps = (fqns) => Effect.all(fqns.filter((fqn) => fqn in readyStable).map((fqn) => Deferred.await(readyStable[fqn])), { concurrency: "unbounded" });
+        : Deferred.await(readyStable[fqn]), { concurrency: "unbounded" });
+    const waitForStableDeps = (fqns) => Effect.forEach(fqns.filter((fqn) => fqn in readyStable), (fqn) => Deferred.await(readyStable[fqn]), { concurrency: "unbounded" });
     const failures = [];
-    yield* Effect.all(Object.entries(allNodes).map(([fqn, node]) => node.kind === "action"
-        ? executeActionNode(fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, session, state, stackName, stage, waitForStableDeps, failures)
-        : executeNode(fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, session, state, stackName, stage, (fqns) => waitForDeps(fqn, fqns), failures, plan.cycleMembers.has(fqn))), { concurrency: "unbounded" });
+    yield* Effect.forEach(Object.entries(allNodes), ([fqn, node]) => node.kind === "action"
+        ? executeActionNode(fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, reportEvent, state, stackName, stage, waitForStableDeps, failures)
+        : executeNode(fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, reportEvent, state, stackName, stage, (fqns) => waitForDeps(fqn, fqns), failures, plan.cycleMembers), { concurrency: "unbounded" });
     if (failures.length > 0) {
         // Aggregate every collected lifecycle failure into a single parallel Cause
         // so the apply ends with one combined error containing every distinct
@@ -237,13 +316,16 @@ const failureMessage = (cause) => {
             : undefined;
         const message = Predicate.hasProperty(error, "message") && typeof error.message === "string"
             ? error.message
-            : String(error);
+            : typeof error === "string"
+                ? error
+                : Formatter.format(error);
         const line = message.split("\n", 1)[0];
         return tag !== undefined && !line.includes(tag) ? `${tag}: ${line}` : line;
     }
     return undefined;
 };
-const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, session, state, stackName, stage, waitForDeps, failures, inCycle) => Effect.gen(function* () {
+const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, reportEvent, state, stackName, stage, waitForDeps, failures, cycleMembers) => Effect.gen(function* () {
+    const inCycle = cycleMembers.has(fqn);
     const logicalId = node.resource.LogicalId;
     const namespace = node.resource.Namespace;
     const commit = (value) => state.set({
@@ -266,21 +348,13 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         value: {
             ...value,
             adoptionBlocked: value.adoptionBlocked ?? node.adoptionBlocked,
+            propsIncomplete: propsIncomplete(value),
             props: stripUnresolved(value.props),
             bindings: stripUnresolved(value.bindings),
             namespace,
         },
     });
-    const scopedSession = {
-        ...session,
-        note: (note, options) => session.emit({
-            fqn,
-            id: logicalId,
-            _tag: "apply.resource.note",
-            message: note,
-            kind: options?.kind,
-        }),
-    };
+    const scopedSession = resourceSession(reportEvent, fqn, logicalId);
     // On a mode-switch replacement (local ⇄ live) surface the transition:
     // the old generation's stamped mode → the mode resolved for this run.
     const fromProviderMode = node.action === "replace" &&
@@ -289,11 +363,11 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         node.state.providerMode !== node.mode
         ? node.state.providerMode
         : undefined;
-    const report = (status) => session.emit({
-        _tag: "apply.resource.status",
+    const report = (status) => reportEvent({
+        type: "apply.resource.status",
         fqn,
         id: logicalId,
-        type: node.resource.Type,
+        resourceType: node.resource.Type,
         status,
         providerMode: node.mode,
         fromProviderMode,
@@ -330,11 +404,11 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         // `terminalStatuses` after `converge` completes.
         if (inCycle)
             return;
-        yield* session.emit({
-            _tag: "apply.resource.status",
+        yield* reportEvent({
+            type: "apply.resource.status",
             fqn,
             id: logicalId,
-            type: node.resource.Type,
+            resourceType: node.resource.Type,
             status,
             providerMode: node.mode,
         });
@@ -400,6 +474,17 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         const bindingDeps = Object.keys(Output.resolveUpstream(node.bindings));
         return [...new Set([...propDeps, ...bindingDeps])];
     };
+    // A cycle precreates before its peers reconcile. An upstream outside the
+    // cycle cannot depend on it, so wait for those upstreams and resolve the
+    // props they determine: only values derived from cycle peers stay
+    // unresolved when precreate and `observe` run.
+    const resolvePrecreateProps = Effect.gen(function* () {
+        const outside = allUpstreamFqns().filter((upstream) => !cycleMembers.has(upstream));
+        yield* waitForDeps(outside);
+        return yield* Output.evaluateAvailable(node.props, Object.fromEntries(outside
+            .filter((upstream) => Object.hasOwn(outputs, upstream))
+            .map((upstream) => [upstream, outputs[upstream]])));
+    });
     // ── instance ID ──
     const resolveInstanceId = Effect.gen(function* () {
         if (node.action === "create" && !node.state?.instanceId) {
@@ -475,6 +560,8 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
             });
         }
         let attr = node.state?.attr;
+        // Whether the identity reconcile claims has passed the ownership check.
+        let admitted = node.deferredAdoption === undefined;
         if (attr !== undefined) {
             // Precreate/read may already have produced a usable output snapshot. Publish
             // it early so downstream resources can start resolving against it.
@@ -486,6 +573,10 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         // Durable Object classes are empty) can serve traffic while the real
         // version propagates.
         if (inCycle && node.provider.precreate && attr === undefined) {
+            const props = yield* resolvePrecreateProps;
+            // Without `observe`, precreate and reconcile claim the identity unchecked.
+            admitted =
+                (yield* observeBeforePrecreate(node, props, fqn, logicalId, instanceId)) !== "unresolved";
             // Some resources need a placeholder physical resource before their real
             // create can finish. Persist that stub so downstream evaluation can proceed.
             yield* report("pre-creating");
@@ -493,7 +584,7 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 .precreate({
                 id: logicalId,
                 fqn,
-                news: node.props,
+                news: props,
                 session: scopedSession,
                 instanceId,
                 bindings: excludeDeletedBindings(node.bindings),
@@ -506,7 +597,9 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 instanceId,
                 resourceType: node.resource.Type,
                 props: node.props,
-                attr,
+                // A stub for an unresolved identity claims nothing. Leave the
+                // checkpoint without it, so a retry checks the identity again.
+                attr: admitted ? attr : undefined,
                 providerVersion: node.provider.version ?? 0,
                 bindings: excludeDeletedBindings(node.bindings),
                 downstream: node.downstream,
@@ -526,8 +619,8 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         yield* report("creating");
         const news = (yield* Output.evaluate(node.props, outputs));
         const bindingOutputs = excludeDeletedBindings(yield* Output.evaluate(node.bindings, outputs));
-        if (attr === undefined && node.deferredAdoption && node.provider.read) {
-            const checkpoint = () => commit({
+        if (!admitted) {
+            const checkpoint = (attr) => commit({
                 status: "creating",
                 fqn,
                 logicalId,
@@ -542,13 +635,12 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 providerMode: node.mode,
                 adoptionBlocked: node.adoptionBlocked,
             });
-            // Refusal or interruption must retain identity, never foreign attributes.
-            yield* checkpoint();
-            const observed = yield* node.provider
-                .read({ id: logicalId, fqn, instanceId, olds: news, output: undefined })
-                .pipe(instrumentLifecycle("read", fqn, node.resource.Type, logicalId, instanceId));
+            // Refusal or interruption must retain identity, never foreign
+            // attributes, nor a stub for an identity not yet checked.
+            yield* checkpoint(undefined);
+            const observed = yield* observeResolved(node, news, fqn, logicalId, instanceId);
             if (observed !== undefined) {
-                if (Unowned.is(observed) && !node.deferredAdoption.adopt) {
+                if (Unowned.is(observed) && !node.deferredAdoption?.adopt) {
                     return yield* new OwnedBySomeoneElse({
                         message: `Cannot adopt resource '${fqn}' (${node.resource.Type}): ` +
                             "it exists in the cloud but is not owned by this " +
@@ -558,9 +650,10 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                         logicalId,
                     });
                 }
-                attr = stripUnowned(observed);
+                // Reconcile keeps a precreated stub as its output.
+                attr ??= stripUnowned(observed);
                 // A creating checkpoint retains olds: undefined on retry.
-                yield* checkpoint();
+                yield* checkpoint(attr);
             }
         }
         attr = yield* node.provider
@@ -824,11 +917,76 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 yield* deleteOldGenerations(old.old);
             }
         });
-        if (node.deleteFirst) {
+        const deleteFirst = Effect.fn(function* () {
             yield* scopedSession.note("Deleting previous resource before creating its replacement (deleteFirst)...");
             yield* deleteOldGenerations(replState.old);
-        }
+        });
         let attr = replState.attr;
+        // ── replacement admission ──
+        //
+        // The replacement may resolve to a physical identity that already
+        // exists and belongs to someone else (e.g. a renamed Worker pointing at
+        // a foreign script). Read it before anything is mutated — before
+        // precreate, reconcile, and delete-first cleanup of the previous
+        // generation — and refuse an unowned target unless adoption is allowed,
+        // exactly like a fresh create.
+        let admitted = attr !== undefined || node.deferredAdoption === undefined;
+        const admit = Effect.fn(function* (props) {
+            admitted = true;
+            const observed = yield* observeResolved(node, props, fqn, logicalId, instanceId, replState.old?.attr);
+            if (observed === undefined)
+                return;
+            if (Unowned.is(observed) && !node.deferredAdoption?.adopt) {
+                return yield* new OwnedBySomeoneElse({
+                    message: `Cannot replace resource '${fqn}' (${node.resource.Type}): ` +
+                        "its replacement exists in the cloud but is not owned by this " +
+                        "stack/stage/logical-id. Re-run with `--adopt` (or " +
+                        "wrap the effect in `adopt(true)`) to take it over.",
+                    resourceType: node.resource.Type,
+                    logicalId,
+                });
+            }
+            // A delete-first target may be the previous generation itself, which
+            // is about to be deleted — never hand its attributes to reconcile.
+            // Reconcile keeps a precreated stub as its output.
+            if (!node.deleteFirst)
+                attr ??= stripUnowned(observed);
+        });
+        // A cycle precreates on the props its upstreams outside the cycle
+        // determine; anything else waits for every upstream.
+        const precreateProps = inCycle ? yield* resolvePrecreateProps : node.props;
+        if (!admitted && isResolved(precreateProps)) {
+            yield* admit(precreateProps);
+        }
+        // A cycle precreates before its props resolve, so `observe` admits the
+        // identity precreate will claim — before delete-first, too. Without
+        // `observe`, precreate and reconcile claim it unchecked. An unresolved
+        // identity is admitted once it resolves, before reconcile.
+        if (!admitted && inCycle) {
+            const observation = yield* observeBeforePrecreate(node, precreateProps, fqn, logicalId, instanceId, replState.old?.attr);
+            admitted = observation !== "unresolved";
+            if (!admitted && node.deleteFirst && !node.deferredAdoption?.adopt) {
+                return yield* new UnverifiableReplacement({
+                    message: `Cannot replace resource '${fqn}' (${node.resource.Type}): ` +
+                        "it must be deleted before its replacement is pre-created, but " +
+                        "the replacement's identity depends on outputs that are not " +
+                        "resolved yet, so its ownership cannot be checked first. Re-run " +
+                        "with `--adopt` (or wrap the effect in `adopt(true)`) to replace it anyway.",
+                    resourceType: node.resource.Type,
+                    logicalId,
+                });
+            }
+        }
+        // A cycle must delete before precreate claims the identity. Plan has
+        // already refused one whose identity could not be admitted first
+        // without `observe`; the check above refuses an unresolved one.
+        // Otherwise the previous generation survives until reconcile is
+        // about to run, so a failed upstream never leaves the resource missing.
+        let deletedFirst = false;
+        if (node.deleteFirst && inCycle) {
+            yield* deleteFirst();
+            deletedFirst = true;
+        }
         if (attr !== undefined) {
             // If precreate already ran, expose that intermediate output immediately so
             // downstream resources can resolve against the same in-flight replacement.
@@ -840,7 +998,7 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 .precreate({
                 id: logicalId,
                 fqn,
-                news: node.props,
+                news: precreateProps,
                 session: scopedSession,
                 instanceId,
                 bindings: excludeDeletedBindings(node.bindings),
@@ -853,7 +1011,9 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
                 instanceId,
                 resourceType: node.resource.Type,
                 props: node.props,
-                attr,
+                // A stub for an unresolved identity claims nothing. Leave the
+                // checkpoint without it, so a retry checks the identity again.
+                attr: admitted ? attr : undefined,
                 providerVersion: node.provider.version ?? 0,
                 bindings: excludeDeletedBindings(node.bindings),
                 downstream: node.downstream,
@@ -873,6 +1033,12 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
         yield* report("creating replacement");
         const news = (yield* Output.evaluate(node.props, outputs));
         const bindingOutputs = excludeDeletedBindings(yield* Output.evaluate(node.bindings, outputs));
+        if (!admitted) {
+            yield* admit(news);
+        }
+        if (node.deleteFirst && !deletedFirst) {
+            yield* deleteFirst();
+        }
         attr = yield* node.provider
             .reconcile({
             id: logicalId,
@@ -945,18 +1111,18 @@ const executeNode = (fqn, node, tracker, outputs, ready, readyStable, terminalSt
 }).pipe(Effect.catchCause((cause) => 
 // Record the failure, propagate it to any downstream resources waiting on
 // our Deferred (so their waitForDeps short-circuits instead of deadlocking),
-// emit a "fail" status to the session, and resolve to void so Effect.all
+// emit a "fail" status, and resolve to void so Effect.all
 // does not interrupt sibling fibers. The aggregated cause is raised at
 // the end of executePlan.
 Effect.gen(function* () {
     failures.push({ fqn, logicalId: node.resource.LogicalId, type: node.resource.Type, cause });
     yield* Deferred.failCause(ready[fqn], cause);
     yield* Deferred.failCause(readyStable[fqn], cause);
-    yield* session.emit({
-        _tag: "apply.resource.status",
+    yield* reportEvent({
+        type: "apply.resource.status",
         fqn,
         id: node.resource.LogicalId,
-        type: node.resource.Type,
+        resourceType: node.resource.Type,
         status: "fail",
         message: failureMessage(cause),
         providerMode: node.mode,
@@ -989,12 +1155,18 @@ const runAction = Effect.fn("apply.runAction")(function* (task, input, outputs)
         .Run(input)
         .pipe(Effect.provideService(RuntimeContext, makeResolveContext(resolved)));
 });
-const executeActionNode = (fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, session, state, stackName, stage, waitForDeps, failures) => Effect.gen(function* () {
+const executeActionNode = (fqn, node, tracker, outputs, ready, readyStable, terminalStatuses, reportEvent, state, stackName, stage, waitForDeps, failures) => Effect.gen(function* () {
     const task = node.def;
     const logicalId = task.LogicalId;
     const namespace = task.Namespace;
     const commit = (value) => state.set({ stack: stackName, stage, fqn, value: { ...value, namespace } });
-    const report = (status) => session.emit({ _tag: "apply.resource.status", fqn, id: logicalId, type: task.Type, status });
+    const report = (status) => reportEvent({
+        type: "apply.resource.status",
+        fqn,
+        id: logicalId,
+        resourceType: task.Type,
+        status,
+    });
     const signalReady = Deferred.succeed(ready[fqn], void 0);
     const signalReadyStable = Deferred.succeed(readyStable[fqn], void 0);
     const skip = (state) => Effect.gen(function* () {
@@ -1070,11 +1242,11 @@ const executeActionNode = (fqn, node, tracker, outputs, ready, readyStable, term
     failures.push({ fqn, logicalId: node.def.LogicalId, type: node.def.Type, cause });
     yield* Deferred.failCause(ready[fqn], cause);
     yield* Deferred.failCause(readyStable[fqn], cause);
-    yield* session.emit({
-        _tag: "apply.resource.status",
+    yield* reportEvent({
+        type: "apply.resource.status",
         fqn,
         id: node.def.LogicalId,
-        type: node.def.Type,
+        resourceType: node.def.Type,
         status: "fail",
         message: failureMessage(cause),
     });
@@ -1094,7 +1266,7 @@ const executeActionNode = (fqn, node, tracker, outputs, ready, readyStable, term
 // against the current tracker outputs. Call provider.reconcile for any
 // resource whose resolved inputs differ from what it was last applied with.
 // Repeat until no resource needs updating.
-const converge = Effect.fn(function* (plan, tracker, outputs, terminalStatuses, session, state, stackName, stage) {
+const converge = Effect.fn(function* (plan, tracker, outputs, terminalStatuses, reportEvent, state, stackName, stage) {
     for (;;) {
         let anyUpdated = false;
         for (const [fqn, node] of Object.entries(plan.resources)) {
@@ -1114,16 +1286,24 @@ const converge = Effect.fn(function* (plan, tracker, outputs, terminalStatuses,
             const logicalId = node.resource.LogicalId;
             const namespace = node.resource.Namespace;
             const instanceId = tracker[fqn].instanceId;
-            const scopedSession = {
-                ...session,
-                note: (note, options) => session.emit({
-                    fqn,
-                    id: logicalId,
-                    _tag: "apply.resource.note",
-                    message: note,
-                    kind: options?.kind,
-                }),
-            };
+            const scopedSession = resourceSession(reportEvent, fqn, logicalId);
+            // A cycle peer resolves against its peers' first outputs, so an
+            // identity checked then may resolve differently now. Check the identity
+            // these props resolve to before reconcile claims it.
+            const deferredAdoption = "deferredAdoption" in node ? node.deferredAdoption : undefined;
+            if (propsChanged && deferredAdoption !== undefined) {
+                const observed = yield* observeResolved(node, newProps, fqn, logicalId, instanceId, tracker[fqn].output);
+                if (observed !== undefined && Unowned.is(observed) && !deferredAdoption.adopt) {
+                    return yield* new OwnedBySomeoneElse({
+                        message: `Cannot converge resource '${fqn}' (${node.resource.Type}): ` +
+                            "its final identity exists in the cloud but is not owned by this " +
+                            "stack/stage/logical-id. Re-run with `--adopt` (or " +
+                            "wrap the effect in `adopt(true)`) to take it over.",
+                        resourceType: node.resource.Type,
+                        logicalId,
+                    });
+                }
+            }
             const attr = yield* node.provider
                 .reconcile({
                 id: logicalId,
@@ -1264,7 +1444,7 @@ export class DestroyError extends Data.TaggedError("DestroyError") {
         ].join("\n");
     }
 }
-const collectGarbage = Effect.fn(function* (plan, session) {
+const collectGarbage = Effect.fn(function* (plan, reportEvent) {
     const state = yield* yield* State;
     const stack = yield* Stack;
     const stackName = stack.name;
@@ -1272,25 +1452,25 @@ const collectGarbage = Effect.fn(function* (plan, session) {
     // Task deletions are pure state drops — no body is invoked. Run them in
     // parallel before resource GC; tasks never have provider-side dependencies
     // to wait on.
-    yield* Effect.all(Object.entries(plan.actionDeletions ?? {}).map(([fqn, node]) => node === undefined
+    yield* Effect.forEach(Object.entries(plan.actionDeletions ?? {}), ([fqn, node]) => node === undefined
         ? Effect.void
         : Effect.gen(function* () {
-            yield* session.emit({
-                _tag: "apply.resource.status",
+            yield* reportEvent({
+                type: "apply.resource.status",
                 fqn,
                 id: node.def.LogicalId,
-                type: node.def.Type,
+                resourceType: node.def.Type,
                 status: "deleting",
             });
             yield* state.delete({ stack: stackName, stage, fqn });
-            yield* session.emit({
-                _tag: "apply.resource.status",
+            yield* reportEvent({
+                type: "apply.resource.status",
                 fqn,
                 id: node.def.LogicalId,
-                type: node.def.Type,
+                resourceType: node.def.Type,
                 status: "deleted",
             });
-        })), { concurrency: "unbounded" });
+        }), { concurrency: "unbounded" });
     // Failures are collected — not propagated — so one bad delete never
     // strands unrelated siblings. `unresolved` tracks every FQN whose delete
     // failed or was blocked this run: later passes must not retry them (a
@@ -1356,6 +1536,9 @@ const collectGarbage = Effect.fn(function* (plan, session) {
             const adoptionBlocked = isDeleteNode(node)
                 ? node.state.adoptionBlocked
                 : generation.adoptionBlocked;
+            const incompleteProps = isDeleteNode(node)
+                ? node.state.propsIncomplete
+                : generation.propsIncomplete;
             // Mutable: an attr-less row (interrupted create) may recover its
             // attributes from `provider.read` below, right before deletion.
             let attr = persistedAttr;
@@ -1375,31 +1558,22 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                     namespace,
                 },
             });
-            const report = (status) => session.emit({
-                _tag: "apply.resource.status",
+            const report = (status) => reportEvent({
+                type: "apply.resource.status",
                 fqn,
                 id: logicalId,
-                type: resourceType,
+                resourceType,
                 status,
                 providerMode,
             });
-            const scopedSession = {
-                ...session,
-                note: (note, options) => session.emit({
-                    fqn,
-                    id: logicalId,
-                    _tag: "apply.resource.note",
-                    message: note,
-                    kind: options?.kind,
-                }),
-            };
+            const scopedSession = resourceSession(reportEvent, fqn, logicalId);
             return yield* (deletions[fqn] ??= yield* Effect.cached(Effect.gen(function* () {
                 // Dependents (`downstream`) are deleted before this resource. A
                 // dependent whose delete failed (or was itself blocked) may make
                 // this resource legitimately undeletable (dependency violation),
                 // so it is skipped with a "blocked by" note instead of surfacing
                 // a spurious second error.
-                const dependents = yield* Effect.all(downstream.map((dep) => dep !== fqn && !ancestors.has(dep)
+                const dependents = yield* Effect.forEach(downstream, (dep) => dep !== fqn && !ancestors.has(dep)
                     ? dep in deletionGraph
                         ? deleteResource(deletionGraph[dep], nextAncestors).pipe(Effect.map((outcome) => ({ dep, outcome })))
                         : // Not in this pass's graph — but it may have failed in
@@ -1408,7 +1582,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                                 dep,
                                 outcome: unresolved.has(dep) ? "failed" : "deleted",
                             }))
-                    : Effect.succeed({ dep, outcome: "deleted" })), { concurrency: "unbounded" });
+                    : Effect.succeed({ dep, outcome: "deleted" }), { concurrency: "unbounded" });
                 const blockedBy = dependents
                     .filter(({ outcome }) => outcome === "failed" || outcome === "blocked")
                     .map(({ dep }) => dep);
@@ -1470,6 +1644,12 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                                 "migrated predecessor. Any interrupted new physical " +
                                 "resource must be identified and cleaned up manually.");
                         }
+                        else if (incompleteProps) {
+                            yield* scopedSession.note("Skipping recovery: unresolved properties were omitted from " +
+                                "this interrupted create's state, so they cannot identify it. " +
+                                "Any interrupted physical resource must be identified and " +
+                                "cleaned up manually.");
+                        }
                         else if (provider.read) {
                             const recovered = yield* provider
                                 .read({ id: logicalId, fqn, instanceId, olds: props, output: undefined })
@@ -1522,6 +1702,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                             removalPolicy: node.resource.RemovalPolicy,
                             providerMode,
                             adoptionBlocked,
+                            propsIncomplete: incompleteProps,
                         });
                     }
                     if (attr !== undefined && !retainOldGeneration) {
@@ -1583,6 +1764,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
                                 bindings: excludeDeletedBindings(node.bindings),
                                 removalPolicy: node.removalPolicy,
                                 providerMode: node.providerMode,
+                                propsIncomplete: node.propsIncomplete,
                             });
                         }
                         yield* scopedSession.note(retainOldGeneration
@@ -1605,9 +1787,7 @@ const collectGarbage = Effect.fn(function* (plan, session) {
         // retained) inside each node's delete effect — the effects resolve to
         // outcomes and never fail, so one bad resource never interrupts sibling
         // deletions mid-flight.
-        yield* Effect.all(Object.values(deletionGraph)
-            .filter((node) => node !== undefined)
-            .map((node) => deleteResource(node)), { concurrency: "unbounded" });
+        yield* Effect.forEach(Object.values(deletionGraph).filter((node) => node !== undefined), (node) => deleteResource(node), { concurrency: "unbounded" });
     });
     // Drain one old generation per FQN per pass, preserving that generation's
     // dependency edges. Planned deletions remain queued until their chains drain.