@homeflare/alchemy 0.10.1 → 0.12.0

package/src/ownership/probe.ts

@@ -28,29 +28,28 @@ import type { Owner } from './adopt.ts';
 import { recordedInstance } from './rows.ts';
 
 /**
- * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
- * or the recovery read (header): `found` is ours only when the state store records this instance
- * with its whole declaration AND `settled` — the family's own "live matches these props" — says so.
- * ⛔ `settled` NEVER FAILS THE READ. The recovery read runs with the INTERRUPTED deploy's props, so
+ * Whether the state store proves the live object this instance's own: a row records `ask.instanceId`
+ * with its whole declaration (whole.ts) AND `settled` — the family's own "live matches these props"
+ * — says so. The one proof ownership/ accepts for a live object state holds no attributes for; the
+ * recovery read (`ownedRead`) and an adoption check (adopting.ts) both ask it.
+ * ⛔ `settled` NEVER FAILS THE CALLER. The recovery read runs with the INTERRUPTED deploy's props, so
  *   a declaration that cannot be evaluated any more (a fragments directory since moved, a group
  *   name since renamed) would fail every later plan, the fix included. It reads as "not proven
- *   ours" instead — `Unowned`, which `--adopt` resolves — with the reason logged.
+ *   ours" instead, with the reason logged.
  */
-export const ownedRead = <A extends object, E, R>(
-  ask: Owner,
-  found: A | undefined,
+export const provenOurs = <E, R>(
+  ask: { readonly fqn: string; readonly instanceId: string },
   settled: Effect.Effect<boolean, E, R>,
-): Effect.Effect<A | undefined, never, R> =>
+): Effect.Effect<boolean, never, R> =>
   Effect.gen(function* () {
-    if (found === undefined || ask.output !== undefined) return found;
     const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
-    if (recorded === 'absent') return Unowned(found);
+    if (recorded === 'absent') return false;
     if (recorded === 'partial') {
       yield* Effect.logWarning(
         `${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` +
           'was still an Output when it was written), so the live object is not proven ours',
       );
-      return Unowned(found);
+      return false;
     }
     const unproven = (reason: unknown) =>
       Effect.as(
@@ -60,6 +59,20 @@ export const ownedRead = <A extends object, E, R>(
         ),
         false,
       );
-    const ours = yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
-    return ours ? found : Unowned(found);
+    return yield* settled.pipe(Effect.catch(unproven), Effect.catchDefect(unproven));
+  });
+
+/**
+ * A family's `read` answer. With attributes in state it is `found` as is. Without, it is the probe
+ * or the recovery read (header): `found` is ours only when `provenOurs` says so, else `Unowned`,
+ * which `--adopt` resolves.
+ */
+export const ownedRead = <A extends object, E, R>(
+  ask: Owner,
+  found: A | undefined,
+  settled: Effect.Effect<boolean, E, R>,
+): Effect.Effect<A | undefined, never, R> =>
+  Effect.gen(function* () {
+    if (found === undefined || ask.output !== undefined) return found;
+    return (yield* provenOurs(ask, settled)) ? found : Unowned(found);
   });

package/src/ownership/rows.ts

@@ -31,12 +31,15 @@ const storeOf = Effect.gen(function* () {
 const rowAt = (store: StateService, where: Where, fqn: string) =>
   store.get({ ...where, fqn }).pipe(Effect.orElseSucceed(() => undefined));
 
-type Generation = {
+/** One generation of a persisted row, as far as ownership/ reads it. */
+export type Generation = {
   readonly instanceId?: unknown;
   readonly status?: unknown;
   readonly props?: unknown;
   readonly attr?: unknown;
   readonly old?: unknown;
+  /** Set by Apply on the `updating` row of an adoption, until that update commits (Apply.ts). */
+  readonly adopting?: unknown;
 };
 
 /** The generation of a persisted row that carries `instanceId`: the row itself, or one in `old`. */
@@ -51,7 +54,10 @@ const generationOf = (row: unknown, instanceId: string): Generation | undefined
 };
 
 /** The generation `instanceId` names — at the FQN, or at a former FQN `renamedFrom` names. */
-const recordedGeneration = (fqn: string, instanceId: string) =>
+export const recordedGeneration = (
+  fqn: string,
+  instanceId: string,
+): Effect.Effect<Generation | undefined> =>
   Effect.gen(function* () {
     const found = yield* storeOf;
     if (found === undefined) return undefined;

package/src/ownership/store-fixture.ts

@@ -0,0 +1,50 @@
+/**
+ * A state store and a Stack for the ownership/ unit tests — the two services rows.ts reads.
+ *
+ * ⛔ TEST-ONLY. No provider imports this file and it is not on any barrel.
+ */
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import type { ResourceState } from 'alchemy/State/ResourceState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+
+/** A row with no attributes: `creating`, or `replacing` when it carries an `old` generation. */
+export const row = (
+  fqn: string,
+  instanceId: string,
+  old?: unknown,
+  props: unknown = { name: 'a' },
+): ResourceState =>
+  ({
+    fqn,
+    instanceId,
+    old,
+    props,
+    status: old === undefined ? 'creating' : 'replacing',
+  }) as unknown as ResourceState;
+
+/**
+ * A stack `s` at stage `test` whose store holds `rows`: `A` and `B` declared with a `name`, and `Z`
+ * declared `renamedFrom('X')`.
+ */
+export const withStore = <A>(
+  rows: Record<string, ResourceState>,
+  effect: Effect.Effect<A>,
+): Promise<A> =>
+  Effect.runPromise(
+    effect.pipe(
+      Effect.provideService(State, InMemoryService({ s: { test: rows } })),
+      Effect.provideService(Stack, {
+        actions: {},
+        bindings: {},
+        name: 's',
+        resources: {
+          A: { Props: { name: 'a' } },
+          B: { Props: { name: 'b' } },
+          Z: { FormerFqns: ['X'], Props: { name: 'a' } },
+        },
+        stage: 'test',
+      } as never),
+    ),
+  );

package/src/proxmox/acl.ts

@@ -41,14 +41,14 @@ export type AclSubjectType = 'user' | 'group' | 'token';
 
 export interface AclProps extends WithTarget {
   /**
-   * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
    * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
    *   word, so this file does too rather than renaming a field the cluster calls `path`.
    */
   path: string;
   /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
   type: AclSubjectType;
-  /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
   ugid: string;
   /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
   roleid: string;
@@ -85,9 +85,9 @@ export const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');
 /**
  * ⚠️ PVE NORMALISES ACL PATHS AND RETURNS THE NORMALISED FORM, a forever-update trap when only one
  *   side of the comparison is normalised. `PVE::AccessControl::normalize_path` collapses repeated
- *   slashes and strips the trailing one, so a declared `/pool/house/` reads back as `/pool/house`
+ *   slashes and strips the trailing one, so a declared `/pool/lab/` reads back as `/pool/lab`
  *   and a naive match never fires again. It also refuses a path with no leading slash, so one is
- *   added here rather than letting `pool/house` 400.
+ *   added here rather than letting `pool/lab` 400.
  */
 const normalize = (raw: string) => `/${raw.split('/').filter(Boolean).join('/')}`;
 

package/src/proxmox/adopt-noop.test.ts

@@ -32,8 +32,8 @@ type Case = {
 
 const cases: readonly Case[] = [
   {
-    declare: () => ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET }),
-    live: { 'pools/house': { comment: 'x', members: [] } },
+    declare: () => ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET }),
+    live: { 'pools/lab': { comment: 'x', members: [] } },
     name: 'Proxmox.Pool (pveHandlers: every factory family)',
     provider: ProxmoxPoolProvider as never,
   },
@@ -98,15 +98,15 @@ describe('adopting a matching object only reads', () => {
   });
 
   test('and the harness does see a write: a drifted Pool is PUT once', async () => {
-    const fake = clusterWith({ 'pools/house': { comment: 'old', members: [] } });
+    const fake = clusterWith({ 'pools/lab': { comment: 'old', members: [] } });
     await withoutBao(async () => {
       const engine = engineOver(ProxmoxPoolProvider().pipe(Layer.provideMerge(fake.layer)));
       const declared = () =>
-        ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET });
+        ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET });
       const report = await engine.verify(declared());
       expect(report.rows[0]).toMatchObject({ changed: ['comment'], diff: 'update', ok: false });
-      expect(await engine.deploy(declared())).toEqual({ house: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ lab: 'adopted' });
     });
-    expect(fake.writes()).toEqual(['PUT pools/house']);
+    expect(fake.writes()).toEqual(['PUT pools/lab']);
   });
 });

package/src/proxmox/api-token-form.ts

@@ -12,7 +12,7 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *
  * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE
  *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and
- *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place
+ *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
  */
@@ -26,7 +26,7 @@ import { bool, int, text } from './values.ts';
  *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted
  *   anything at all without somebody retyping the join by hand.
  *
- * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers
+ * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers
  *   `{"expire":0,"privsep":0}` and echoes back neither half of its own identity. So this is built
  *   from props, cannot disagree with the path the read used, and is therefore true by
  *   construction — which is why it is reported and never compared.
@@ -106,8 +106,8 @@ export const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes> = {
   /**
    * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.
    *   MEASURED, by replaying these two functions over the live GET bodies of all four token
-   *   shapes this cluster has: `monitoring@pve!exporter` (no comment), `tofu@pve!apply` and
-   *   `sablier@pve!sablier` (commented), and a live OpenBao lease under `hf-read@pve` (a real
+   *   shapes this cluster has: `metrics@pve!exporter` (no comment), `iac@pve!apply` and
+   *   `app@pve!app` (commented), and a live OpenBao lease under `hf-read@pve` (a real
    *   non-zero `expire`, offered as both `1789327175` and `"1789327175"` since `int` must not care
    *   which). All four answer noop; flipping `privsep` answers update; an empty body answers
    *   absent. ⚠️ THAT IS THE COMPARISON, NOT THE ENGINE — no `alchemy plan` was run against this

package/src/proxmox/api-token.ts

@@ -2,11 +2,11 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns
+ *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
  *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
  *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
  *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/monitoring@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
+ *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
  *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
@@ -19,7 +19,7 @@
  *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
- *     `proxmox-tb4` mount, or a human at `pveum user token add`.
+ *     `proxmox-c1` mount, or a human at `pveum user token add`.
  *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing
  *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement
  *     is a create that works and a header that says what it produces.
@@ -31,8 +31,8 @@
  *   that owns the lease, or to a human who is watching.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
+ *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
  *   to the lease deadline, and an id the plugin CHOOSES,
  *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
  *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
@@ -62,7 +62,7 @@ import { type PveRequirements, type WithTarget, pveHandlers, pveOperations } fro
 
 export interface ApiTokenProps extends WithTarget {
   /**
-   * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.
+   * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
    *
    * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a
    *   token named under a missing user fails the READ (folded to "absent") and then fails the
@@ -120,7 +120,7 @@ export interface ApiTokenProps extends WithTarget {
    *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
    *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
    *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-   *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops
+   *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
    *   working. Required, so adopting a token is a sentence that states what it is.
    * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
    *   provisioning account that is the account's full authority with a separate secret.
@@ -156,9 +156,9 @@ export interface ProxmoxApiToken extends Resource<
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
  *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
  *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,
- *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the
+ *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
+ *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
+ *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
  *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
  *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
  *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
@@ -184,7 +184,7 @@ const ops = pveOperations(apiTokenSpec);
  *   `reconcile` refuses by name and says what to do instead.
  *
  * ★ EVERYTHING ELSE STILL WORKS, AND IT IS THE HALF WORTH HAVING. Adopting an existing token and
- *   converging its `comment`, `expire` and `privsep` are real operations: TB4 carries SEVEN tokens
+ *   converging its `comment`, `expire` and `privsep` are real operations: C1 carries SEVEN tokens
  *   with `expire=0` and `privsep=0` made by clicks nobody recorded. Declaring those freezes the
  *   set, and an eighth appearing shows up as drift.
  *
@@ -203,7 +203,7 @@ const handlers = {
             'the secret only in the create response and it cannot be stored, so a token made here ' +
             'would be a live credential nobody holds. Create it with `pveum user token add` and ' +
             'capture the value, or mint a short-lived one from the OpenBao proxmox mount ' +
-            '(`bao read proxmox-tb4/creds/<role>`) -- then declare it here to manage it.',
+            '(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it.',
         ),
       );
     }
@@ -213,7 +213,7 @@ const handlers = {
 
 /**
  * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every
+ *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
  *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
  *   The mount's leases in particular appear and vanish on their own; anything that adopted one
  *   would report drift against a credential that was never its to hold.

package/src/proxmox/ceph-daemon-form.ts

@@ -9,7 +9,7 @@
  *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.
  *
  * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED
- *   on n2, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/n2/ceph/mon/n2` answers
+ *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers
  *   "No 'get' handler defined" — while POST and DELETE are registered ONLY there. So the read uses
  *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent
  *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.
@@ -41,8 +41,8 @@ export const daemonId = (props: CephDaemonProps) => props.name ?? props.node;
 
 /**
  * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2 against [n3,n2,n4] from n3. A caller that took
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took
  *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.
  */
 export const collectionPath = (props: CephDaemonProps) => `nodes/${props.node}/ceph/${props.kind}`;

package/src/proxmox/ceph-daemon.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.
  *
  * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed
- *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13: mon, mgr and mds each
+ *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each
  *   expose GET on the collection and POST + DELETE on the id below it, each returns
  *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter
  *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,
@@ -10,11 +10,11 @@
  *   times over and let them drift — the argument resource.ts already makes for the factory itself.
  *
  * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2, [n3,n2,n4] from n3 — so a row is found by
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by
  *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.
- *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/n2/ceph/mon/n2` answers
- *   "No 'get' handler defined for '/nodes/n2/ceph/mon/n2'", and mgr and mds answer the same.
+ *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers
+ *   "No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'", and mgr and mds answer the same.
  *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one
  *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,
  *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still
@@ -27,11 +27,11 @@
  *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing
  *   two in one deploy — or removing the mon on the node whose API is serving the call — loses
  *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring
- *   it, so on this cluster every guest on `cephtb4` hangs.
+ *   it, so on this cluster every guest on `rbd-c1` hangs.
  *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,
- *   and with no standby left `cephfs-tb4` goes unavailable. `mgr`: no guest I/O depends on it, but
+ *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but
  *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.
- *   Live on 2026-09-13: mon, mgr AND mds on each of n2, n3, n4.
+ *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.
  *
  * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately
  *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that
@@ -41,7 +41,7 @@
  *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:
  *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike
  *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on
- *   `/`, and MEASURED on this cluster `LXCProvisioner` already holds it, so the provision lane
+ *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
@@ -86,9 +86,9 @@ export interface CephDaemonProps extends WithTarget {
   name?: string;
   /**
    * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this
-   * cluster that is 10.20.11.0/24, carried by `vmbr1.11`.
+   * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.
    * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as
-   *   `10.20.11.12:6789/0` — an address, a port and a nonce. The two are not the same string and
+   *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and
    *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this
    *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the
    *   header. Left out of `matches` on purpose.
@@ -98,7 +98,7 @@ export interface CephDaemonProps extends WithTarget {
    * mds only. Makes this standby replay the active MDS's journal for a faster failover.
    * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.
    *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED
-   *   2026-09-13, all three mds report `standby_replay: false`, n3 included — and n3 is the ACTIVE
+   *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE
    *   mds, which is not a standby at all and so can never report true however it was created.
    *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have
    *   elected, i.e. against a value no declaration controls.
@@ -128,22 +128,22 @@ export interface CephDaemonAttributes {
   host: string;
   /**
    * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…
-   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr n2 is
-   *   `active` while n3 and n4 are `standby`; mds n3 is `up:active` while n2 and n4 are
+   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is
+   *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are
    *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is
    *   live and kept out of `matches` so that an election is never a diff.
    * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but
    *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.
    */
   state: string;
-  /** Ceph-formatted, e.g. `10.20.11.12:6789/0`. Reported; see `mon-address` for why never compared. */
+  /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */
   addr: string;
   /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */
   version: string;
   /**
    * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.
-   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked n4=0, n3=1, n2=2 —
-   *   monmap order, not declaration order — and the mds ranks are 0 for the active n3 and -1 for
+   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —
+   *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for
    *   the two standbys. Rank moves when a daemon is added, removed or restarted.
    */
   rank: number;
@@ -152,8 +152,8 @@ export interface CephDaemonAttributes {
   /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */
   standbyReplay: boolean;
   /**
-   * mds only: the CephFS this daemon currently serves — `cephfs-tb4` here.
-   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: n3 carries `fs_name`, n2 and n4 have no such key
+   * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.
+   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key
    *   at all. So it is empty for two of three identical declarations, and comparing it would
    *   report work on exactly the daemons that are healthy standbys.
    */
@@ -234,7 +234,7 @@ export const ProxmoxCephDaemonProvider = () =>
          *   problem. Everything else here is the factory's.
          * ⚠️ AND IT IS THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a
          *   plan that removes a mon run: two gone at once is a cluster with no quorum and every
-         *   guest on `cephtb4` blocked on I/O.
+         *   guest on `rbd-c1` blocked on I/O.
          */
         delete: ({ olds }: { olds: CephDaemonProps }) =>
           pve(olds.target, 'provision', 'DELETE', daemonPath(olds)),

package/src/proxmox/ceph-flag.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.
  *
  * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.
- *   MEASURED on TB4 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
+ *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
  *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in
  *   `/usr/share/pve-docs/api-viewer/apidoc.js`:
  *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING
@@ -30,7 +30,7 @@
  *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean "clear
  *     it" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be
  *     typed out by a person. Do not add a default, and do not declare a flag merely to document
- *     that it is off: MEASURED 2026-09-13, all eleven flags on TB4 read 0, so eleven
+ *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven
  *     `value: false` lines would plan green forever and do nothing except take the brake off
  *     whenever somebody happens to apply them.
  *
@@ -58,8 +58,8 @@
  *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove
  *   one is gone; `ceph osd dump | head -1` can.
  *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`
- *     stops all reads and writes, so every guest on `cephtb4` — the cluster's only rbd pool,
- *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-tb4`. `noup: true`
+ *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,
+ *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`
  *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.
  *
  * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs
@@ -83,7 +83,7 @@ import { bool, flag } from './values.ts';
  *
  * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both
  *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.
- * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on TB4:
+ * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:
  *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.
  *   PVE reads that same string and answers only about its own eleven, so the others can neither
  *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.
@@ -167,7 +167,7 @@ const handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({
    *
    * ⛔ IT NEVER ANSWERS undefined, WHICH MAKES THE CREATE BRANCH UNREACHABLE, AND ITS ERROR WILL
    *   MISLEAD YOU. All eleven flags always exist; there is nothing for "absent" to mean. So a POST
-   *   to `collection` means the READ failed — an expired 300s lease, n2 down, or ceph simply not
+   *   to `collection` means the READ failed — an expired 300s lease, node-b down, or ceph simply not
    *   configured on the cluster (every one of these four handlers opens with
    *   `check_ceph_configured()`, which dies). Read the resulting "Method 'POST /cluster/ceph/flags'
    *   not implemented" as "the read failed" and go and look at the credential, not at ceph. Same
@@ -187,7 +187,7 @@ const handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({
    *   and `name` exist only on the bulk GET, which this file does not read, so neither can be
    *   compared by accident. Nothing PVE returns here is rewritten, re-ordered or re-typed by the
    *   cluster, because all PVE returns here is one boolean.
-   *   ★ MEASURED: on TB4, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a
+   *   ★ MEASURED: on C1, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a
    *     declaration of `value: false` reads back false and plans `noop`.
    */
   matches: (attributes, props) => attributes.value === props.value,

package/src/proxmox/ceph-fs-wire.ts

@@ -16,7 +16,7 @@
  *
  * ⛔ POST AND DELETE ANSWER WITH A UPID, NOT A RESULT — THE WRITE IS ASYNCHRONOUS AND A FAILED ONE
  *   IS STILL HTTP 200. Read from the cluster's own source, /usr/share/perl5/PVE/API2/Ceph/FS.pm on
- *   n2: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
+ *   node-b: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
  *   come out of trusting that status code. A read-back straight after the POST reports "still
  *   absent" about a filesystem that is being built as it says so — which is precisely the message
  *   `pveOperations.reconcile` would print, pointing at the wrong cause. And a worker that dies
@@ -26,7 +26,7 @@
  *     has not been observed; only the `fork_worker` that guarantees it is there.
  *
  * ⛔ A DELETE BODY IS SILENTLY DISCARDED BY PVE, SO `remove-pools` GOES IN THE QUERY STRING.
- *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on n2: line 928 reads the request
+ *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on node-b: line 928 reads the request
  *   content into params only `if ($method eq 'PUT' || $method eq 'POST')`, and line 1653 sends
  *   every other method down a branch that parses `$request->url->query()` and nothing else. So
  *   `pve(target, role, 'DELETE', path, form)` would send a body PVE never looks at: the flags would
@@ -41,7 +41,7 @@
  * ⛔ THE POLLER IS NEVER THE TASK'S OWNER, WHICH COSTS A PRIVILEGE, AND THIS ONE IS MEASURED
  *   RATHER THAN FEARED. client.ts mints a fresh credential per call and the mount vends a NEW
  *   token id each time, so the token reading the status is never the token recorded in the UPID —
- *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on n2, `$check_task_user`:
+ *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on node-b, `$check_task_user`:
  *   `return $user eq $fulltoken || $user eq $task->{user};`, above it the comment "token only sees
  *   token tasks, user sees user + token tasks". Token B of the same user matches neither branch.
  *   So the fallback is the schema's other clause for `GET /nodes/{node}/tasks/{upid}/status`: "The
@@ -128,8 +128,8 @@ const destroyPath = (props: CephFsProps) => {
 /**
  * Wait for a forked PVE task, and fail loudly rather than quietly.
  *
- * ⚠️ THE UPID IS PERCENT-ENCODED BECAUSE IT IS FULL OF COLONS — `UPID:n2:00396D3A:…:root@pam:`
- *   (MEASURED shape, from `GET /nodes/n2/tasks`) is ONE path segment, not seven. Encoding is what
+ * ⚠️ THE UPID IS PERCENT-ENCODED BECAUSE IT IS FULL OF COLONS — `UPID:node-b:00396D3A:…:root@pam:`
+ *   (MEASURED shape, from `GET /nodes/node-b/tasks`) is ONE path segment, not seven. Encoding is what
  *   guarantees it arrives as one; PVE's router decodes each segment before matching. REASONED from
  *   the URI handling rather than measured — no task of this provider's has been polled yet.
  */
@@ -178,8 +178,8 @@ const settle = (target: PveTarget, node: string, upid: string, what: string) =>
  *
  * ⚠️ A CREATE NEEDS A RUNNING *AND* A STANDBY MDS, and refuses BEFORE it forks -- "no running
  *   Metadata Server (MDS) found!" / "no standby Metadata Server (MDS) found!" are synchronous, so
- *   they surface as a failed POST rather than as a silent worker. TB4 has three (MEASURED: n3
- *   `up:active` for cephfs-tb4, n2 and n4 `up:standby`), so this is a note for a smaller cluster.
+ *   they surface as a failed POST rather than as a silent worker. C1 has three (MEASURED: node-c
+ *   `up:active` for cephfs-c1, node-b and node-d `up:standby`), so this is a note for a smaller cluster.
  * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
  *   about: granting it buys datacenter options and every other cluster-wide config write too.
  */