@homeflare/alchemy 0.10.1 → 0.12.0

package/src/openbao/bao-http.test.ts

@@ -31,11 +31,11 @@ describe('baoRead', () => {
       () => reply,
       async (bao) => {
         const env = { BAO_ADDR: bao.address, BAO_NAMESPACE: 'homeflare', BAO_TOKEN: TOKEN };
-        const data = await run(env, baoRead('proxmox-tb4/roles/read'));
+        const data = await run(env, baoRead('proxmox-c1/roles/read'));
         assert.deepEqual(data, { mint_user: 'hf-read@pve', ttl: 3600 });
         const [seen] = bao.seen;
         assert.equal(seen?.method, 'GET');
-        assert.equal(seen?.path, '/v1/proxmox-tb4/roles/read');
+        assert.equal(seen?.path, '/v1/proxmox-c1/roles/read');
         assert.equal(seen?.headers.get('x-vault-namespace'), 'homeflare');
         assert.equal(seen?.headers.get('x-vault-token'), TOKEN);
         assert.equal(seen?.headers.get('x-vault-request'), 'true');

package/src/openbao/bao-http.ts

@@ -2,14 +2,14 @@
  * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family
  * uses since it stopped shelling out to `bao`.
  *
- * ★ `HttpClient`, THE SAME PATTERN house/proxmox and house/forgejo USE AGAINST THEIR APIs, decided
+ * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided
  *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's
  *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so
  *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy
  *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,
  *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)
  * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way
- *   house/proxmox/alchemy.run.ts does.
+ *   <estate>/proxmox/alchemy.run.ts does.
  */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
@@ -34,7 +34,7 @@ export const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEn
 /**
  * ⛔ AT MOST EIGHT EXCHANGES WITH OPENBAO AT ONCE — ACROSS EVERY Bao.* FAMILY, IN ONE PROCESS.
  *
- * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF THE MINI. Alchemy fans
+ * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF ITS HOST. Alchemy fans
  *   resources out with a hard-coded `concurrency: "unbounded"` (alchemy Plan.ts:476, Apply.ts:259,
  *   :263, :303 — no option reaches it), and 555 Bao.CloudflareRole resources each read, diff,
  *   reconcile and read back: well over a thousand requests at one loopback listener within seconds.
@@ -42,7 +42,7 @@ export const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEn
  *     HTTP server (listening on 127.0.0.1:8200) exited with error: set tcp
  *     127.0.0.1:8200->127.0.0.1:57974: setsockopt: invalid argument
  *   and KEPT RUNNING with 8200 closed. launchd saw a live process and restarted nothing. Everything
- *   on the mini that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
+ *   on the vault host that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
  *   a manual restart.
  * ★ THE LISTENER DYING IS A GO-ON-DARWIN FAILURE, NOT OURS TO FIX. Traefik lost its entrypoints the
  *   same way on darwin/arm64 (traefik issue 8841). The BURST is ours. The adoption deploy an hour
@@ -70,7 +70,7 @@ const TIMEOUT = '60 seconds';
 /**
  * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded
  * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured
- * 2026-09-16 against api.v.homeflare.dev: a 585-role plan died mid-diff with
+ * 2026-09-16 against bao.example.internal: a 585-role plan died mid-diff with
  * `no response: (no errors given)` while the vault stayed unsealed.
  */
 const retryTransport = <A, R>(effect: Effect.Effect<A, BaoError, R>) =>
@@ -136,7 +136,7 @@ export const baoCall = (
     const address = resolveAddress(env);
     const client = yield* HttpClient.HttpClient;
     // ⚠️ The content type goes on `bodyText`, never in the header map: `bodyText` overwrites it.
-    //   house/proxmox/src/client.ts has the scar.
+    //   <estate>/proxmox/src/client.ts has the scar.
     const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(
       HttpClientRequest.setHeaders(headersFor(address, env)),
       body === undefined

package/src/openbao/bao-status.test.ts

@@ -86,7 +86,7 @@ describe('settle', () => {
 
   // ⛔ A success body can hold a credential, so a malformed one is described and never quoted.
   it('fails an unparseable success body without quoting it', () => {
-    const error = errorOf(settle('read', 'GET', 'pbs-tb4/creds/read', 200, 'secret=abc123 {'));
+    const error = errorOf(settle('read', 'GET', 'pbs-c1/creds/read', 200, 'secret=abc123 {'));
     assert.ok(!error.message.includes('abc123'));
   });
 

package/src/openbao/bao-status.ts

@@ -121,7 +121,7 @@ export const settle = (
     if (errors === undefined) {
       // ⛔ DESCRIBED, NEVER QUOTED. A proxy or gateway error page can echo the request back, headers
       //   and all, so quoting it could carry X-Vault-Token into an error that Alchemy logs (grok,
-      //   2026-09-14). mint in house/proxmox/src/credentials.ts already did it this way.
+      //   2026-09-14). mint in <estate>/proxmox/src/credentials.ts already did it this way.
       return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);
     }
     if (status === 404 && intent !== 'write') return { body: undefined };

package/src/openbao/cloudflare-group-scope.test.ts

@@ -10,7 +10,7 @@
  *   permission-groups`: `Logs Read` is listed twice, `6a315a56…` at `com.cloudflare.api.account`
  *   and `c4a30cd5…` at `com.cloudflare.api.account.zone`. The second is what the four live
  *   security roles carry on their ACCOUNT resource, and what
- *   house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:80 pins as PG_LOGS_ZONE.
+ *   <estate>/nix/scripts/cf-mint-analytics-tokens.py:80 pins as PG_LOGS_ZONE.
  */
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';

package/src/openbao/cloudflare-permission-groups.test.ts

@@ -143,7 +143,7 @@ describe('permissionGroupsFromEngine', () => {
   });
 
   /**
-   * ⛔ r2-backup-mini's ENTRY IS BUCKET-SCOPED (`bucket: homeflare-pg-mini`), and the two groups it
+   * ⛔ r2-backup-host's ENTRY IS BUCKET-SCOPED (`bucket: example-db-backup`), and the two groups it
    *   names are the only two the account lists at `com.cloudflare.edge.r2.bucket` — MEASURED
    *   2026-09-15: 2 of 399. A unique name still resolves whatever scope asks, which is why the
    *   account-scoped `Workers R2 Storage Read` here answers a bucket-scoped question too.

package/src/openbao/cloudflare-permission-groups.ts

@@ -103,7 +103,7 @@ const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>
  * ⛔ A 403 IS A MISSING GRANT, AND IT SAYS SO. `BaoError` alone reports `GET /v1/<mount>/
  *   permission-groups -> 403: permission denied` — true, and it points nowhere: the path is
  *   deployed, the token is valid, and the one thing to change is a policy file. MEASURED 2026-09-15
- *   10:19 on the macmini-admin lane, where `bao write sys/capabilities-self` answered `[deny]` on
+ *   10:19 on the host's admin lane, where `bao write sys/capabilities-self` answered `[deny]` on
  *   this exact path. bao-status.ts argues that a failure must name what it is; this is that
  *   argument one level up.
  */
@@ -147,7 +147,7 @@ const engineGroups = (mount: string): Lookup =>
     if (data === undefined) {
       // ⚠️ 404 IS NOW A MOUNT-SHAPED ANSWER, NOT THE EXPECTED ONE. The path IS deployed
       //   estate-wide (measured 2026-09-15), so a 404 here means this mount is served by an older
-      //   plugin binary or BAO_ADDR is not the mini — never "no groups".
+      //   plugin binary or BAO_ADDR is not the vault host — never "no groups".
       const why = 'GET <mount>/permission-groups answered 404 — the endpoint is not deployed here';
       return Effect.fail(new CloudflareGroupsError(mount, [why]));
     }
@@ -231,7 +231,7 @@ export const permissionGroupsFromEngine = () =>
  *   undeclared live role carries IDs with no names to pair them with — and solves the account at
  *   once.
  * 🔴 WHAT RETIRED IT, 2026-09-15 10:13: `alchemy deploy` could not create
- *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-mini` — `unknown group "Workers R2
+ *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-host` — `unknown group "Workers R2
  *   Storage Bucket Item Write" — no live role on account <account> carries it; a NEW group needs
  *   the engine endpoint`. That is this source's documented blind spot arriving, not a bug in it.
  *

package/src/openbao/cloudflare-policy.ts

@@ -2,7 +2,7 @@
  * A Cloudflare policy document as the engine stores it — resolution from names, parsing from a
  * read, and the one comparison every Bao.CloudflareRole plan rests on.
  *
- * MEASURED from the engine source (house/platform/secrets/vault/plugin/cloudflare/path_roles.go)
+ * MEASURED from the engine source (<estate>/platform/secrets/vault/plugin/cloudflare/path_roles.go)
  * and the 2026-09-14 snapshot of all 586 live roles:
  *   • `policies` is a STRING field holding a JSON array (path_roles.go:67-72). Each entry is
  *     `{effect, resources: map[string]string, permission_groups: [{id}]}` (:25-33).

package/src/openbao/cloudflare-role-form.ts

@@ -2,7 +2,7 @@
  * Props, attributes and field comparison for Bao.CloudflareRole — the resource is
  * cloudflare-role.ts, the policy document rules are cloudflare-policy.ts.
  *
- * MEASURED from the engine (house/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
+ * MEASURED from the engine (<estate>/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
  * 2026-09-14 snapshot of all 586 live roles:
  *   • A role is name, description, policies, ttl and max_ttl AND NOTHING ELSE (path_roles.go:14-20
  *     stores those; :204-210 returns them). Every snapshot read carries exactly those five keys, so
@@ -79,7 +79,7 @@ export interface RoleDifference {
   readonly have: string;
 }
 
-/** `cloudflare-<account>-dns/roles/homeflare-dev-dns-read` — read, write and delete use it. */
+/** `cloudflare-<account>-dns/roles/example-dns-read` — read, write and delete use it. */
 export const rolePath = (mount: string, name: string) => `${mountPath(mount)}/roles/${name}`;
 
 const seconds = (value: unknown) =>

package/src/openbao/cloudflare-roles-expand.ts

@@ -44,7 +44,7 @@ export interface DeclaredPolicy {
    * ⛔ IT MOVES THE LOOKUP, NEVER THE RESOURCE. The entry still binds the groups to the resource
    *   above; only the id chosen for each name changes. That is the shape Cloudflare calls "all
    *   zones from an account" — the ACCOUNT resource carrying ZONE-scoped groups
-   *   (house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
+   *   (<estate>/nix/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
    *   token). Without this field the resource is the only witness, and it says `account`.
    */
   readonly scope?: string;

package/src/openbao/digest.ts

@@ -8,7 +8,7 @@
  * The only form a policy body may be hashed or compared in.
  *
  * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live
- *   server: the assembler emits each fragment followed by a newline, so `homeflare-llm` goes in as
+ *   server: the assembler emits each fragment followed by a newline, so `app-llm` goes in as
  *   41 lines and `bao policy read` hands back 40 — identical text, one `\n` apart, two different
  *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the
  *   stack could never settle. It was invisible until the stack planned for the first time today.

package/src/openbao/forgejo-bootstrap-parse.test.ts

@@ -29,11 +29,11 @@ describe('usernamesFrom', () => {
   test('reads the Username column of the measured table', () => {
     const table = [
       'ID   Username            Email                                   IsActive IsAdmin 2FA',
-      '1    tim                 tim@example.invalid                     true     true    false',
+      '1    alice               alice@example.invalid                   true     true    false',
       '7    forgejo-provision   forgejo-provision@noreply.example        true     false   false',
       '',
     ].join('\n');
-    expect(usernamesFrom(table)).toEqual(['tim', 'forgejo-provision']);
+    expect(usernamesFrom(table)).toEqual(['alice', 'forgejo-provision']);
   });
 
   test('refuses a table it does not recognise rather than reporting nobody', () => {
@@ -63,7 +63,7 @@ describe('readCreateOutput', () => {
   });
 
   test('reports not created when the success line names someone else or is missing', () => {
-    expect(readCreateOutput("New user 'tim' has been successfully created!", user).created).toBe(
+    expect(readCreateOutput("New user 'alice' has been successfully created!", user).created).toBe(
       false,
     );
     const noPassword = readCreateOutput(

package/src/openbao/forgejo-bootstrap-parse.ts

@@ -5,9 +5,9 @@
  *   read off the running 16.0.3 daemon or its source on 2026-09-14, not assumed.
  */
 
-/** Where the mini's Forgejo keeps its state (hosts/macmini/modules/forgejo.nix:235, app.ini:14). */
+/** Where the host's Forgejo keeps its state (its NixOS module and `app.ini`). */
 export const FORGEJO_WORK_PATH = '/opt/homeflare/forgejo';
-/** The file the launchd runner renders at every start (forgejo.nix:78). Readable by tim, who runs Forgejo. */
+/** The file the launchd runner renders at every start. Readable by the account that runs Forgejo. */
 export const FORGEJO_CONFIG = `${FORGEJO_WORK_PATH}/custom/conf/app.ini`;
 
 /**

package/src/openbao/forgejo-bootstrap.ts

@@ -3,7 +3,7 @@
  * straight to the Forgejo engine's role and nowhere else.
  *
  * ★ TIM'S CALL, 2026-09-14: "Random password, piped", and membership of the HomeFlare Owners team
- *   (house/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
+ *   (<estate>/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
  *   that creates users — the bot type is database-only (codeberg issue 8136) — so this is an
  *   ordinary user made by `forgejo admin user create`.
  *
@@ -34,12 +34,12 @@ import {
 } from './forgejo-bootstrap-parse.ts';
 
 export const PROVISION_USER = 'forgejo-provision';
-/** `NO_REPLY_ADDRESS` in hosts/macmini/forgejo/app.ini:117 — a service account's mail goes nowhere. */
+/** `NO_REPLY_ADDRESS` in the host's Forgejo `app.ini` — a service account's mail goes nowhere. */
 const PROVISION_EMAIL = `${PROVISION_USER}@noreply.lab.example.com`;
 export const ROLE_PATH = 'forgejo/roles/provision';
 
 /**
- * ★ THE SCOPES ARE WHAT house/forgejo WRITES TODAY. Org labels, teams and org secrets need
+ * ★ THE SCOPES ARE WHAT <estate>/forgejo WRITES TODAY. Org labels, teams and org secrets need
  *   `write:organization`; repositories, webhooks and branch protection need `write:repository`.
  *   Membership decides what the tokens can reach, and the scopes cap it.
  * ⚠️ FORGEJO TOKENS NEVER EXPIRE ON THE SERVER. The TTL is OpenBao's lease, and revoking the lease is
@@ -92,7 +92,7 @@ export const bootstrapProvisionAccount = Effect.gen(function* () {
   const binary = runningForgejoBinary(ps.stdout);
   if (binary === undefined) {
     return yield* refuse(
-      'no running `forgejo web` found. Run this on the mini, where Forgejo runs.',
+      'no running `forgejo web` found. Run this on the host where Forgejo runs.',
     );
   }
   const cli = (subcommand: string, ...args: string[]) =>

package/src/openbao/kubernetes-role-form.test.ts

@@ -14,16 +14,16 @@ import {
 
 const POD: BaoKubernetesRoleProps = {
   aliasNameSource: 'serviceaccount_name',
-  boundServiceAccountNames: ['litellm'],
+  boundServiceAccountNames: ['llm-gateway'],
   boundServiceAccountNamespaces: ['ai'],
-  name: 'ai-litellm',
-  tokenPolicies: ['ai-litellm'],
+  name: 'ai-gateway',
+  tokenPolicies: ['ai-gateway'],
   tokenTtl: '1h',
 };
 
 const LIVE: Record<string, unknown> = {
   alias_name_source: 'serviceaccount_name',
-  bound_service_account_names: ['litellm'],
+  bound_service_account_names: ['llm-gateway'],
   bound_service_account_namespace_selector: '',
   bound_service_account_namespaces: ['ai'],
   token_bound_cidrs: [],
@@ -32,7 +32,7 @@ const LIVE: Record<string, unknown> = {
   token_no_default_policy: false,
   token_num_uses: 0,
   token_period: 0,
-  token_policies: ['ai-litellm'],
+  token_policies: ['ai-gateway'],
   token_ttl: 3600,
   token_type: 'default',
 };

package/src/openbao/mount.ts

@@ -6,7 +6,7 @@
  *   in OpenBao, not Alchemy state.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  *
  * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
  *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new

package/src/openbao/pki-role.ts

@@ -36,7 +36,7 @@
  *   never a policy one — but neither is a measurement.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/openbao/policy-wire.test.ts

@@ -28,11 +28,11 @@ describe('policy wire', () => {
   it('round-trips through the stripped newline with equal digests', async () => {
     await withFake(aclPolicies(), async (bao) => {
       const env = { BAO_ADDR: bao.address };
-      await run(env, writePolicy('homeflare-llm', ASSEMBLED));
+      await run(env, writePolicy('app-llm', ASSEMBLED));
       assert.equal(bao.seen[0]?.method, 'PUT');
-      assert.equal(bao.seen[0]?.path, `${PREFIX}homeflare-llm`);
+      assert.equal(bao.seen[0]?.path, `${PREFIX}app-llm`);
       assert.deepEqual(JSON.parse(bao.seen[0]?.body ?? ''), { policy: ASSEMBLED });
-      const live = await run(env, readPolicy('homeflare-llm'));
+      const live = await run(env, readPolicy('app-llm'));
       assert.notEqual(live, ASSEMBLED, 'the fake strips the newline, as OpenBao does');
       assert.equal(sha256(live), sha256(ASSEMBLED));
     });

package/src/openbao/policy.ts

@@ -26,8 +26,8 @@ import { guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
  * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
  *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
  *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
- *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
- *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   estate's state store is the `alchemy` Postgres database, which a nightly job dumps
+ *   (it enumerates EVERY non-template database), copies to a backup guest, and PBS backs up
  *   from there. A KV value here would exist in four places, none of them OpenBao.
  *
  *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a

package/src/openbao/proxmox-role-form.ts

@@ -4,11 +4,11 @@
  * MEASURED 2026-09-13, read-only, against the live server (BAO_ADDR=http://127.0.0.1:8200,
  * BAO_NAMESPACE=homeflare). No write of any kind was issued to a role or a mount:
  *
- *   bao read -format=json proxmox-tb4/roles/read
+ *   bao read -format=json proxmox-c1/roles/read
  *     → { max_ttl: 21600, mint_user: "hf-read@pve",      name: "read",      ttl: 3600 }
- *   bao read -format=json proxmox-tb4/roles/provision
+ *   bao read -format=json proxmox-c1/roles/provision
  *     → { max_ttl: 1800,  mint_user: "hf-provision@pve", name: "provision", ttl: 300 }
- *   GET /v1/proxmox-tb4/?help=1 → components.schemas.WriteRolesNameRequest:
+ *   GET /v1/proxmox-c1/?help=1 → components.schemas.WriteRolesNameRequest:
  *     mint_user  string  — the ONLY required field, described as "The `user@realm` whose
  *                          standing ACL is the minted token's entire privilege set. Created
  *                          out-of-band; this engine never grants ACLs."
@@ -24,7 +24,7 @@ import { sha256 } from './digest.ts';
 import { mountPath, parseDuration, ttlSeconds } from './mount-form.ts';
 
 export interface BaoProxmoxRoleProps {
-  /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+  /** Mount path of the proxmox secrets engine, e.g. `proxmox-c1`. A trailing slash is fine. */
   mount: string;
   /**
    * Role name, as `<mount>/roles/<name>` takes it.
@@ -105,7 +105,7 @@ const ttlText = (seconds: number | undefined, fallback = '0') => {
   return `${String(seconds)}s`;
 };
 
-/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+/** `proxmox-c1/roles/read` — read, write and delete all address the role here. */
 export const rolePath = (mount: string, name: string) => `${mountPath(mount)}/roles/${name}`;
 
 export const attributesOf = (

package/src/openbao/proxmox-role.ts

@@ -3,20 +3,20 @@
  * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
  *
  * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
- *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
- *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
- *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
- *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On C1, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!inventory-sync, agent@pve!executor,
+ *   metrics@pve!exporter, app@pve!app, iac@pve!ro, iac@pve!apply and
+ *   mint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
  *   being a 5-minute lease instead of a forever key.
  *
- *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   The seventh cannot be. mint@pve!engine is the credential the ENGINE ITSELF
  *   authenticates with in order to mint anything at all: the thing that issues short-lived
  *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
  *   permanent, which makes it the single most valuable token on the cluster and the one whose
  *   rotation must be a deliberate, hand-run procedure rather than a plan.
  *
- *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
- *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   MEASURED here: `bao read proxmox-c1/config` returns parent_token_id
+ *   `mint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
  *   own key, present and, by the schema's own "Write-only: never returned by a read", not
  *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
  *   the PVE API in this session.
@@ -27,13 +27,13 @@
  *
  * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
  *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
- *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
- *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   values rather than encrypting them) into the `alchemy` Postgres, which a nightly job dumps
+ *   to a backup guest, from where PBS backs it up. A minted token declared as a resource would
  *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
  *   the DOOR; walking through it is a runtime call, not a plan.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
- *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -80,7 +80,7 @@ export const BaoProxmoxRoleProvider = () =>
       BaoProxmoxRole.Provider.of({
         /**
          * ⛔ `bao list <mount>/roles` IS NOT A LIST OF THINGS THIS OWNS. MEASURED today:
-         *   proxmox-tb4/roles answers `provision, read` and proxmox-ops/roles answers `read` —
+         *   proxmox-c1/roles answers `provision, read` and proxmox-c2/roles answers `read` —
          *   four roles created by hand at bringup, none of them declared anywhere yet.
          *   Returning them would invite Alchemy to adopt, and then delete, roles it never
          *   created, and deleting a role is how every consumer of it stops being able to mint.

package/src/openbao/ssh-role.ts

@@ -4,8 +4,8 @@
  * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
  *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
  *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
- *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
- *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and a nightly job
+ *   dumps it to a backup guest. A CA key there would outlive the vault that guards it. This
  *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
  *
  * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
@@ -29,7 +29,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
  *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/ownership/adopting.test.ts

@@ -0,0 +1,63 @@
+/**
+ * `adopting` answer by answer, against a store fixture: which rows make a call with attributes an
+ * adoption. `Proxmox.Lxc` pins the same answers end to end through the engine
+ * (proxmox/lxc-strict-adopt.test.ts, proxmox/lxc-ownership.test.ts).
+ */
+import { describe, expect, test } from 'bun:test';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import * as Effect from 'effect/Effect';
+import { adopting } from './adopting.ts';
+import { row, withStore } from './store-fixture.ts';
+
+const matches = () => Effect.succeed(true);
+const differs = () => Effect.succeed(false);
+const held = { name: 'a' };
+const owner = (instanceId: string, output: unknown = held) => ({ fqn: 'A', instanceId, output });
+const creating = { fqn: 'A', instanceId: 'probe', output: undefined };
+
+const recorded = (status: string, extra: Record<string, unknown> = {}): ResourceState =>
+  ({ ...row('A', 'mine'), attr: held, status, ...extra }) as unknown as ResourceState;
+
+describe('adopting', () => {
+  test("the probe's instance, which no row holds, is an adoption", async () => {
+    expect(await withStore({ A: recorded('created') }, adopting(owner('probe'), matches))).toBe(
+      true,
+    );
+  });
+
+  test("Apply's adoption row, and an interrupted one, stay adoptions until they commit", async () => {
+    const rows = { A: recorded('updating', { adopting: true }) };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('a row with attributes and no flag is state vouching for the object', async () => {
+    for (const status of ['created', 'updated', 'updating']) {
+      expect(await withStore({ A: recorded(status) }, adopting(owner('mine'), differs))).toBe(
+        false,
+      );
+    }
+  });
+
+  test('a recovered create is ours only when its whole row matches live', async () => {
+    const rows = { A: row('A', 'mine') };
+    expect(await withStore(rows, adopting(owner('mine'), matches))).toBe(false);
+    expect(await withStore(rows, adopting(owner('mine'), differs))).toBe(true);
+    const holed = { A: row('A', 'mine', undefined, {}) };
+    expect(await withStore(holed, adopting(owner('mine'), matches))).toBe(true);
+  });
+
+  test('`settled` is asked with the props of the row that recorded the create', async () => {
+    const seen: unknown[] = [];
+    const spy = (props: unknown) => Effect.sync(() => (seen.push(props), true));
+    await withStore({ A: row('A', 'mine') }, adopting(owner('mine'), spy));
+    expect(seen).toEqual([{ name: 'a' }]);
+  });
+
+  test('a create (no attributes held) is never one; reconcile has its own rule', async () => {
+    expect(await withStore({}, adopting(creating, differs))).toBe(false);
+  });
+
+  test('outside a stack every call with attributes is an adoption — the strict answer', async () => {
+    expect(await Effect.runPromise(adopting(owner('mine'), matches))).toBe(true);
+  });
+});

package/src/ownership/adopting.ts

@@ -0,0 +1,46 @@
+/**
+ * Whether a `diff` or `reconcile` that holds attributes is looking at an ADOPTION — a live object
+ * that reached this stack's state by being FOUND, not by this resource's own create — so a family
+ * whose adoption must never change what it takes over (`Proxmox.Lxc`) can refuse any difference
+ * instead of writing it. adopt.ts and probe.ts decide WHETHER an object may be claimed; this says,
+ * once it is claimed, whether the claim is an adoption.
+ *
+ * ★ STATE ALREADY SAYS WHICH, AT BOTH HALVES OF A DEPLOY (alchemy 2.0.0-beta.79):
+ *   · PLAN, A COLD ADOPTION. The probe mints an instance id no row can hold (Plan.ts
+ *     `generateInstanceId()`), and `diff` then runs with that id and the attributes the probe
+ *     read. So no row holds the id.
+ *   · APPLY, THE SAME ADOPTION. Apply commits an `updating` row with `adopting: true` under that id
+ *     BEFORE it calls reconcile, and the flag stays until the update commits (Apply.ts). An
+ *     adoption whose apply was interrupted keeps it, so the next plan's `diff` sees it too.
+ *   · A RECOVERED CREATE. A `creating` row with no attributes, whose live object the recovery read
+ *     found. It is this resource's own create when the row proves it (probe.ts `provenOurs`, the
+ *     same proof the read asked). Otherwise the plan went on only because `--adopt` said so — an
+ *     adoption like any other.
+ *   · Any other row with attributes is state vouching for the object: not an adoption.
+ * ⚠️ OUTSIDE A STACK — no Stack or State in context, or a store that errors (rows.ts) — no row
+ *   holds anything, so every call is an adoption: the strict answer, never the permissive one. A
+ *   family then refuses an ordinary update's write as if it were an adoption's. `alchemy deploy`
+ *   and the Alchemist session provide both services.
+ */
+import * as Effect from 'effect/Effect';
+import type { Owner } from './adopt.ts';
+import { provenOurs } from './probe.ts';
+import { recordedGeneration } from './rows.ts';
+
+/**
+ * Whether `owner`'s call is an adoption (header). `settled` is the family's "live matches these
+ * props", asked only for a recovered create, with the props of the row that recorded it.
+ * ⛔ A CREATE IS NEVER ONE HERE. `output` undefined is reconcile's create path, which has its own
+ *   rule for a live object it finds (adopt.ts `refuseTakeover`).
+ */
+export const adopting = <E, R>(
+  owner: Owner,
+  settled: (recorded: unknown) => Effect.Effect<boolean, E, R>,
+): Effect.Effect<boolean, never, R> =>
+  Effect.gen(function* () {
+    if (owner.output === undefined) return false;
+    const generation = yield* recordedGeneration(owner.fqn, owner.instanceId);
+    if (generation === undefined || generation.adopting === true) return true;
+    if (generation.attr !== undefined && generation.attr !== null) return false;
+    return !(yield* provenOurs(owner, settled(generation.props)));
+  });

package/src/ownership/ownership.test.ts

@@ -7,46 +7,13 @@
 import { describe, expect, test } from 'bun:test';
 import { AdoptPolicy, Unowned } from 'alchemy/AdoptPolicy';
 import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
-import { InMemoryService } from 'alchemy/State/InMemoryState';
 import type { ResourceState } from 'alchemy/State/ResourceState';
-import { State } from 'alchemy/State/State';
-import { Stack } from 'alchemy/Stack';
 import * as Effect from 'effect/Effect';
 import { refuseTakeover } from './adopt.ts';
 import { ownedRead } from './probe.ts';
 import { noteResume, noteUnfinished, resumes } from './resume.ts';
 import { forgetRefusedCreate, isCreate, recordedInstance } from './rows.ts';
-
-const row = (fqn: string, instanceId: string, old?: unknown, props: unknown = { name: 'a' }) =>
-  ({
-    fqn,
-    instanceId,
-    old,
-    props,
-    status: old === undefined ? 'creating' : 'replacing',
-  }) as unknown as ResourceState;
-
-/**
- * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
- * declared `renamedFrom('X')`.
- */
-const withStore = <A>(rows: Record<string, ResourceState>, effect: Effect.Effect<A>): Promise<A> =>
-  Effect.runPromise(
-    effect.pipe(
-      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
-      Effect.provideService(Stack, {
-        actions: {},
-        bindings: {},
-        name: 's',
-        resources: {
-          A: { Props: { name: 'a' } },
-          B: { Props: { name: 'b' } },
-          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
-        },
-        stage: 'test',
-      } as never),
-    ),
-  );
+import { row, withStore } from './store-fixture.ts';
 
 describe('recordedInstance', () => {
   test('is the row at the FQN, any generation of its `old` chain, or a renamedFrom row', async () => {