So.. in the process of correcting an omission of mine (leaving PublicIpName out of the config, thus ending up with a random suffix i didn't want in the publicip name) - I noted that it's really hard to change the publicip of an ApplicationGateway:

+-  ├─ azure-native:network:PublicIPAddress     <id>appgw-publicIp                   replaced                [diff: ~publicIpAddressName]
 ~   └─ azure-native:network:ApplicationGateway  <id>appgw                            **updating failed**     [diff: ]; 1 error

Diagnostics:
  pulumi:pulumi:Stack (baseline-infra-dev.infra.infratesting):
    error: update failed

  azure-native:network:ApplicationGateway (n10272appgw):
    error: Code="ApplicationGatewayFrontendIpPublicIpAddressCannotBeChanged" Message="PublicIPAddress property of FrontendIpConfiguration /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/applicationGateways/<id>appgw/frontendIPConfigurations/appGwPublicFrontendIp cannot be changed." Details=[]

And of course any following operation is to try to delete the IP that is still connected to the AppGW that I cannot disconnect because it "cannot be changed":

Updating (dev.infra.infratesting):
     Type                                     Name                                   Status                  Info
     pulumi:pulumi:Stack                      baseline-infra-dev.infra.infratesting  **failed**              1 error
 -   └─ azure-native:network:PublicIPAddress  <id>appgw-publicIp                   **deleting failed**     1 error

Diagnostics:
  azure-native:network:PublicIPAddress (<id>appgw-publicIp):
    error: Code="PublicIPAddressCannotBeDeleted" Message="Public IP address /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/publicIPAddresses/<id>appgw-publicIpb861f3ce can not be deleted since it is still allocated to resource /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/applicationGateways/<id>appgw/frontendIPConfigurations/appGwPublicFrontendIp. In order to delete the public IP, disassociate/detach the Public IP address from the resource.  To learn how to do this, see <http://aka.ms/deletepublicip|aka.ms/deletepublicip>." Details=[]

I might be presuming too much - especially considering the intricacies involved in all this - but pulumi would have to be aware of all the different edge cases of all the different kinds of operations on all the different resources to be able to handle this stuff. Is it at all to be expected that pulumi would ever be able to predictably handle these kinds of changes when the underlying provider is so fundamentally blind to how things should work?

So what would be the ideal behavior here from the Pulumi side?

FWIW, i recall solving delete order issues by specifying

opts.parent

and

opts.depends_on

explicitly