Account for deferred retirements in apply budget

tests/test_cli_reconcile.py

@@ -220,6 +220,7 @@ class ReconcileCliTests(unittest.TestCase):
         execution = SimpleNamespace(
             applied=(),
             skipped=(),
+            retired=(),
         )
 
         with tempfile.TemporaryDirectory() as directory:
@@ -255,11 +256,14 @@ class ReconcileCliTests(unittest.TestCase):
             stdout.getvalue(),
         )
         self.assertIn(
-            "APPLY COMPLETE: 0 action(s) applied and verified",
+            "APPLY COMPLETE: 0 action(s) applied and verified; "
+            "0 retirement(s) completed",
             stdout.getvalue(),
         )
 
-    def test_apply_budget_blocks_executor_before_mutation(self):
+    def test_apply_budget_counts_planned_retirement_before_mutation(
+        self,
+    ):
         config = SimpleNamespace(
             target_ip="192.168.1.101",
             include_disabled=False,
@@ -267,10 +271,18 @@ class ReconcileCliTests(unittest.TestCase):
             domain=None,
         )
         adapter = object()
-        action = SimpleNamespace(
-            operation=SimpleNamespace(value="create"),
+
+        retirement = SimpleNamespace(
+            object=SimpleNamespace(
+                object_type="certificates",
+                logical_key="app.example.com",
+                local_key="63",
+            )
+        )
+        plan = SimpleNamespace(
+            actions=(),
+            retirements=(retirement,),
         )
-        plan = SimpleNamespace(actions=(action,))
         reconciliation = SimpleNamespace(
             observations=(),
             desired=(),
@@ -298,7 +310,64 @@ class ReconcileCliTests(unittest.TestCase):
                 with self.assertRaisesRegex(
                     RuntimeError,
                     (
-                        r"Refusing to apply 1 change\(s\); "
+                        r"Refusing to apply 1 mutation\(s\); "
+                        r"--max-changes allows 0"
+                    ),
+                ):
+                    run_reconcile(
+                        SimpleNamespace(
+                            state_db=str(state_path),
+                            include_disabled=False,
+                            apply=True,
+                            max_changes=0,
+                        )
+                    )
+
+        execute.assert_not_called()
+
+    def test_apply_budget_blocks_executor_before_mutation(self):
+        config = SimpleNamespace(
+            target_ip="192.168.1.101",
+            include_disabled=False,
+            domain_matching=False,
+            domain=None,
+        )
+        adapter = object()
+        action = SimpleNamespace(
+            operation=SimpleNamespace(value="create"),
+        )
+        plan = SimpleNamespace(
+            actions=(action,),
+            retirements=(),
+        )
+        reconciliation = SimpleNamespace(
+            observations=(),
+            desired=(),
+            plans=(plan,),
+            failures=(),
+        )
+
+        with tempfile.TemporaryDirectory() as directory:
+            state_path = Path(directory) / "state.sqlite3"
+
+            with patch(
+                "dns_sync.cli.AppConfig.from_env",
+                return_value=config,
+            ), patch(
+                "dns_sync.cli._configured_adapters",
+                return_value=[adapter],
+            ), patch(
+                "dns_sync.cli.discover_reconcile_plan",
+                return_value=reconciliation,
+            ), patch(
+                "dns_sync.cli.print_endpoint_plans",
+            ), patch(
+                "dns_sync.cli.execute_endpoint_plans",
+            ) as execute, redirect_stdout(io.StringIO()):
+                with self.assertRaisesRegex(
+                    RuntimeError,
+                    (
+                        r"Refusing to apply 1 mutation\(s\); "
                         r"--max-changes allows 0"
                     ),
                 ):

tests/test_executor.py

@@ -553,7 +553,7 @@ class ExecutionTests(unittest.TestCase):
                 NOW,
             )
 
-            execute_endpoint_plans(
+            result = execute_endpoint_plans(
                 [adapter],
                 [plan],
                 store,
@@ -590,6 +590,17 @@ class ExecutionTests(unittest.TestCase):
                 )
             ],
         )
+        self.assertEqual(
+            result.retired,
+            (
+                (
+                    endpoint.identity,
+                    RetireRequest(
+                        object=old_certificate,
+                    ),
+                ),
+            ),
+        )
 
     def test_failed_verification_is_persisted_and_raises(self):
         endpoint = Endpoint("verizon", "192.168.1.1:443")