@homeflare/alchemy 0.10.1 → 0.12.0

package/src/proxmox/ceph-fs.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFs` — a CephFS on the cluster's own Ceph. The filesystem a `cephfs` storage mounts.
  *
  * ⛔ A REPLACE OF THIS RESOURCE DESTROYS A LIVE FILESYSTEM, AND THERE IS NO PUT TO SAVE YOU FROM
- *   IT. MEASURED from the published schema on n2, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has
+ *   IT. MEASURED from the published schema on node-b, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has
  *   exactly two methods, POST and DELETE. A CephFS cannot be edited in place, so `updateForm` is
  *   left undefined and anything the factory can see as changed becomes a REPLACE — and Alchemy's
  *   replace is create-then-delete, where the delete is `destroyfs`: the entry leaves the MDS map,
@@ -12,9 +12,9 @@
  *     one it is a live filesystem destroyed on every deploy, forever, because a background daemon
  *     moved a number nobody declared.
  *
- * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on n2:
- *     pvesh get /nodes/n2/ceph/fs/cephfs-tb4
- *       -> No 'get' handler defined for '/nodes/n2/ceph/fs/cephfs-tb4'
+ * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on node-b:
+ *     pvesh get /nodes/node-b/ceph/fs/cephfs-c1
+ *       -> No 'get' handler defined for '/nodes/node-b/ceph/fs/cephfs-c1'
  *   `GET /nodes/{node}/ceph/fs` is a directory index and is the only read there is, so `path()`
  *   below returns the INDEX and `attributes` picks this filesystem out of the array client-side —
  *   the shape acl.ts uses for the one flat `GET /access/acl`. The POST goes to the `{name}` path,
@@ -28,9 +28,9 @@
  *
  * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.
  *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either
- *   exists ("ceph pools '…_data' and/or '…_metadata' already exist"). MEASURED on TB4: the live
- *   `cephfs-tb4` owns `cephfs-tb4_data` (id 6) and `cephfs-tb4_metadata` (id 7), both of which
- *   `GET /nodes/n2/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES
+ *   exists ("ceph pools '…_data' and/or '…_metadata' already exist"). MEASURED on C1: the live
+ *   `cephfs-c1` owns `cephfs-c1_data` (id 6) and `cephfs-c1_metadata` (id 7), both of which
+ *   `GET /nodes/node-b/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES
  *   have GET, PUT and DELETE, so a pool resource would be a clean `pveHandlers` fit and would
  *   adopt them without noticing. Declaring both is double management of one object: whichever
  *   reconciles first wins, and the loser either fails its create or PUTs `size`/`pg_num` onto pools
@@ -38,16 +38,16 @@
  *
  * ⚠️ `add-storage` IS A SECOND SIDE EFFECT AND IT LANDS IN storage.cfg. Set, `createfs` also calls
  *   `PVE::API2::Storage::Config->create` with type `cephfs`, content `backup,iso,vztmpl` and
- *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on n2 holds exactly that — `cephfs:
- *   cephfs-tb4` / `content backup,vztmpl,iso` / `fs-name cephfs-tb4`. So a `Proxmox.Storage`
- *   declaring `cephfs-tb4` would be managing an entry this resource created. Declare ONE of them:
+ *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on node-b holds exactly that — `cephfs:
+ *   cephfs-c1` / `content backup,vztmpl,iso` / `fs-name cephfs-c1`. So a `Proxmox.Storage`
+ *   declaring `cephfs-c1` would be managing an entry this resource created. Declare ONE of them:
  *   either `add-storage` here and no storage resource, or `add-storage` off and a
  *   `Proxmox.Storage` that reads this resource's `name` attribute — which also gets the ordering
  *   right for free, because Alchemy orders by data flow.
  *
  * ⚠️ `node` IS A ROUTE, NOT IDENTITY, AND MUST NEVER BE DIFFED. A CephFS is cluster-wide; the node
- *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/n2/ceph/fs`,
- *   `…/n3/…` and `…/n4/…` returned the byte-identical array. So changing `node` plans `noop`, and
+ *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/node-b/ceph/fs`,
+ *   `…/node-c/…` and `…/node-d/…` returned the byte-identical array. So changing `node` plans `noop`, and
  *   two resources naming the same `name` on different nodes are the SAME filesystem — the vmid
  *   hazard from lxc.ts, with a filesystem on the end of it instead of a container.
  *
@@ -84,11 +84,11 @@ export interface CephFsProps extends WithTarget {
    * this is under 32. PVE's default is 128.
    *
    * ⛔ CREATE-TIME ONLY, UNREADABLE, AND OWNED BY THE AUTOSCALER FROM THE SECOND IT LANDS. It is
-   *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. TB4's
-   *   `cephfs-tb4` was created with the default 128 (the arithmetic proves it: `cephfs-tb4_metadata`
-   *   sits at 32, which is 128/4), and `cephfs-tb4_data` reads pg_num 32 TODAY. The autoscaler moved
+   *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. C1's
+   *   `cephfs-c1` was created with the default 128 (the arithmetic proves it: `cephfs-c1_metadata`
+   *   sits at 32, which is 128/4), and `cephfs-c1_data` reads pg_num 32 TODAY. The autoscaler moved
    *   it by a factor of four, and it is not finished: `pg_autoscale_mode` is `on` for every pool on
-   *   this cluster and `cephfs-tb4_metadata` already reports `pg_num_final: 16` against its live 32.
+   *   this cluster and `cephfs-c1_metadata` already reports `pg_num_final: 16` against its live 32.
    */
   pg_num?: number;
   /**
@@ -155,7 +155,7 @@ const ops = pveOperations<CephFsProps, CephFsAttributes>({
    *   only honest comparison is none at all.
    *   ⚠️ THE TEMPTING ADDITION IS `pg_num`, AND IT WOULD BE THE WORST BUG THIS PACKAGE HAS SHIPPED.
    *     It is not in the index at all, so it can only be read from the pool endpoint — where the
-   *     autoscaler owns it. MEASURED on TB4 today: created at 128, live at 32, with the metadata
+   *     autoscaler owns it. MEASURED on C1 today: created at 128, live at 32, with the metadata
    *     pool already scheduled down to 16. Compared, that is an eternal mismatch; and because
    *     `updateForm` is undefined, the action it produces is REPLACE. The plan would destroy and
    *     rebuild a live filesystem on every deploy, triggered by a daemon on its own schedule.
@@ -176,7 +176,7 @@ export const ProxmoxCephFsProvider = () =>
       ProxmoxCephFs.Provider.of({
         /**
          * ⛔ EMPTY, LIKE EVERY OTHER RESOURCE HERE. The index answers with every filesystem on the
-         *   cluster, `cephfs-tb4` included — the one holding this estate's ISOs and templates.
+         *   cluster, `cephfs-c1` included — the one holding this estate's ISOs and templates.
          *   Adopting it would put Alchemy one `destroy` away from it. Adoption stays explicit.
          */
         list: () => Effect.succeed([]),

package/src/proxmox/ceph-osd-tree.ts

@@ -11,13 +11,13 @@
  *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.
  *
  * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.
- *   MEASURED 2026-09-13: asked of n2 it answers `{"flags":…,"root":{"children":[…]}}` whose
- *   leaves include osd.0 and osd.5 on n4; asked of n3 it answers the identical six leaves. The
+ *   MEASURED 2026-09-13: asked of node-b it answers `{"flags":…,"root":{"children":[…]}}` whose
+ *   leaves include osd.0 and osd.5 on node-d; asked of node-c it answers the identical six leaves. The
  *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as "the
- *   OSDs on this node" would find osd.0 through n2 and then report it as living there.
+ *   OSDs on this node" would find osd.0 through node-b and then report it as living there.
  *
  * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.
- *   MEASURED: `GET /nodes/n2/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
+ *   MEASURED: `GET /nodes/node-b/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
  *   `[{"name":"metadata"},{"name":"lv-info"}]` — byte for byte what `…/osd/2` answers for a real
  *   one. It is a directory index (its schema says `permissions: {"user":"all"}`), not a read of
  *   the OSD. Point `PveSpec.path` at it and every declared OSD is "present": `diff` reports
@@ -25,18 +25,18 @@
  *   stops this package recording objects that do not exist — passes on an OSD that was never
  *   built. The only endpoint that can tell present from absent is the tree.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, `GET /nodes/n2/ceph/osd`. Six leaves, all `up` and `in`, Ceph
+ * ★ MEASURED ON C1 ON 2026-09-13, `GET /nodes/node-b/ceph/osd`. Six leaves, all `up` and `in`, Ceph
  *   20.2.2 tentacle:
  *
- *     id  name   host  device_class  crush_weight      reweight  pgs  status
- *     0   osd.0  n4    ssd           1.86299133300781  1          99  up
- *     5   osd.5  n4    ssd           1.86299133300781  1          94  up
- *     1   osd.1  n3    ssd           1.86299133300781  1          96  up
- *     4   osd.4  n3    ssd           1.81939697265625  1          97  up
- *     2   osd.2  n2    ssd           1.81939697265625  1          88  up
- *     3   osd.3  n2    ssd           1.81939697265625  1         105  up
+ *     id  name   host    device_class  crush_weight      reweight  pgs  status
+ *     0   osd.0  node-d  ssd           1.86299133300781  1          99  up
+ *     5   osd.5  node-d  ssd           1.86299133300781  1          94  up
+ *     1   osd.1  node-c  ssd           1.86299133300781  1          96  up
+ *     4   osd.4  node-c  ssd           1.81939697265625  1          97  up
+ *     2   osd.2  node-b  ssd           1.81939697265625  1          88  up
+ *     3   osd.3  node-b  ssd           1.81939697265625  1         105  up
  *
- *   `{ node: 'n2', osdid: 2, host: 'n2', device_class: 'ssd' }` plans `noop` against that row.
+ *   `{ node: 'node-b', osdid: 2, host: 'node-b', device_class: 'ssd' }` plans `noop` against that row.
  *   That is the acceptance test this file was written to pass.
  *
  * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the
@@ -72,8 +72,8 @@ const branches = (node: CrushNode): CrushNode[] =>
 /**
  * Every OSD leaf under the tree root, at any depth.
  *
- * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. TB4 measures as
- *   root(`default`) -> host(n2|n3|n4) -> osd, but CRUSH admits datacenter, rack and chassis
+ * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. C1 measures as
+ *   root(`default`) -> host(node-b|node-c|node-d) -> osd, but CRUSH admits datacenter, rack and chassis
  *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching
  *   in as `root.children[].children[]` would read this cluster correctly and answer "absent" —
  *   i.e. "the replica is gone" — on the first cluster that has a rack in it.
@@ -149,7 +149,7 @@ export interface CephOsdAttributes {
  * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,
  *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS
  *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical
- *   on every OSD, and both latencies read 0 — TB4 was idle, so nothing was caught in the act. That
+ *   on every OSD, and both latencies read 0 — C1 was idle, so nothing was caught in the act. That
  *   these move is therefore REASONED, from what they count, not observed. Alchemy persists
  *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on
  *   every deploy and record a number that is stale by the time anybody reads it. What is kept is

package/src/proxmox/ceph-osd.ts

@@ -11,7 +11,7 @@
  *
  *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an
  *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening
- *   `LXCProvisioner` cannot fix it. Compare the sibling families, which DO carry a check and
+ *   the provision role cannot fix it. Compare the sibling families, which DO carry a check and
  *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.
  *
  * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in
@@ -19,7 +19,7 @@
  *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a
  *   better answer than a `delete` that silently does nothing while the plan claims otherwise.
  *
- * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "n2, n3 and n4 each hold two ssd OSDs"
+ * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "node-b, node-c and node-d each hold two ssd OSDs"
  *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —
  *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the
  *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are
@@ -53,8 +53,8 @@ export type { CephOsdAttributes };
 
 export interface CephOsdProps extends WithTarget {
   /**
-   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree n2 returns and the
-   * tree n3 returns are the same six leaves, n4's included. Point this at any node that is up;
+   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree node-b returns and the
+   * tree node-c returns are the same six leaves, node-d's included. Point this at any node that is up;
    * `host` is the field that says where the disk is.
    */
   node: string;
@@ -63,7 +63,7 @@ export interface CephOsdProps extends WithTarget {
   /**
    * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.
    *
-   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under n3, the plan reports
+   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under node-c, the plan reports
    *   work every time and the deploy fails, because moving an OSD between failure domains is a
    *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the
    *   wrong failure domain is not something to converge quietly past.
@@ -125,7 +125,7 @@ export const ProxmoxCephOsd = Resource<ProxmoxCephOsd>('Proxmox.CephOsd', {
  *   node, an expired lease, a role without `Sys.Audit`, or a cluster with no Ceph at all. Folding
  *   those into "absent" would turn every one of them into the sentence "osd.2 is missing", which
  *   is the most alarming thing this provider can say and would be a lie in all four cases. Left
- *   to fail, the plan shows `PVE GET nodes/n2/ceph/osd -> 500: …` and names the real problem.
+ *   to fail, the plan shows `PVE GET nodes/node-b/ceph/osd -> 500: …` and names the real problem.
  */
 
 /**

package/src/proxmox/ceph-pool-adopt.test.ts

@@ -14,16 +14,16 @@ import { engineOver } from '../verify/fake-engine.ts';
 import { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
 
-const STATUS = 'nodes/n2/ceph/pool/cephtb4/status?verbose=1';
-const OBJECT = 'nodes/n2/ceph/pool/cephtb4';
+const STATUS = 'nodes/node-b/ceph/pool/rbd-c1/status?verbose=1';
+const OBJECT = 'nodes/node-b/ceph/pool/rbd-c1';
 
-/** TB4's rbd pool as `getpool` answers it — the fields ceph-pool.ts reads. */
+/** C1's rbd pool as `getpool` answers it — the fields ceph-pool.ts reads. */
 const livePool = (size: number): Record<string, unknown> => ({
   application_list: ['rbd'],
   crush_rule: 'replicated_rule',
   id: 2,
   min_size: 2,
-  name: 'cephtb4',
+  name: 'rbd-c1',
   pg_autoscale_mode: 'on',
   pg_num: 128,
   size,
@@ -38,18 +38,18 @@ const cluster = (size: number) => {
       for (const [key, value] of Object.entries(call.form)) {
         pool[key] = /^\d+$/.test(value) ? Number(value) : value;
       }
-      return 'UPID:n2:fake:setpool';
+      return 'UPID:node-b:fake:setpool';
     }
     return undefined;
   });
 };
 
 const declared = () =>
-  ProxmoxCephPool('cephtb4', {
+  ProxmoxCephPool('rbd-c1', {
     crush_rule: 'replicated_rule',
     min_size: 2,
-    name: 'cephtb4',
-    node: 'n2',
+    name: 'rbd-c1',
+    node: 'node-b',
     pg_autoscale_mode: 'on',
     size: 3,
     target: FAKE_TARGET,
@@ -67,7 +67,7 @@ describe('adopting a Ceph pool', () => {
       expect(report.rows).toEqual([
         expect.objectContaining({ diff: 'noop', ok: true, planned: 'adopted', read: 'found' }),
       ]);
-      expect(await engine.deploy(declared())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([]);
     expect(fake.calls.every((call) => call.path === STATUS)).toBe(true);
@@ -82,10 +82,10 @@ describe('adopting a Ceph pool', () => {
   test('declaring a field it does not manage: rechecked, still noop, and the deploy only reads', async () => {
     const fake = cluster(3);
     const birth = () =>
-      ProxmoxCephPool('cephtb4', {
+      ProxmoxCephPool('rbd-c1', {
         min_size: 2,
-        name: 'cephtb4',
-        node: 'n2',
+        name: 'rbd-c1',
+        node: 'node-b',
         pg_num: 32,
         size: 3,
         target: FAKE_TARGET,
@@ -100,7 +100,7 @@ describe('adopting a Ceph pool', () => {
         recheck: 'noop',
       });
       expect(report.rows[0]?.why).toContain('does not manage');
-      expect(await engine.deploy(birth())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(birth())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([]);
   });
@@ -112,7 +112,7 @@ describe('adopting a Ceph pool', () => {
       const report = await engine.verify(declared());
       expect(report.rows[0]).toMatchObject({ changed: ['size'], diff: 'update', ok: false });
       expect(fake.writes()).toEqual([]);
-      expect(await engine.deploy(declared())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([`PUT ${OBJECT}`]);
     expect(fake.calls.find((call) => call.method === 'PUT')?.form['size']).toBe('3');

package/src/proxmox/ceph-pool-form.ts

@@ -4,25 +4,25 @@
  * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is
  *   "does this touch the cluster" — the same one metric-server-form.ts draws, just with more on
  *   this side because this family needs it. Here: the declared shape, the reported shape, and the
- *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four
+ *   coercions that turn one into the other. There: reading C1, deciding a diff, and the four
  *   handlers. Nothing in this file makes a call or decides an action.
  * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair
  *   differs from metric-server / notification-target. There is no `import type` cycle back as a
  *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.
  *
  * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from
- *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,
+ *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on node-b, pve-manager 9.2.11,
  *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes
  *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT
  *   reads from the path, and `pg_num`.
  *
  * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT
- *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no
+ *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on node-b: a POST carrying no
  *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool
  *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,
  *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,
  *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose
- *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly
+ *   Ceph traffic shares vmbr1.42 with everything else. ceph-pool.ts guards the create for exactly
  *   that reason; this half simply never offers pg_num to an update.
  */
 import type { WithTarget } from './resource.ts';
@@ -30,10 +30,10 @@ import { csv } from './values.ts';
 
 export interface CephPoolProps extends WithTarget {
   /**
-   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and
-   *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only
+   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: node-b and
+   *   node-c answer byte-identically for `rbd-c1` (measured). The endpoint is node-scoped only
    *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never
-   *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect
+   *   compared, and moving a declaration from node-b to node-c plans noop. Point it at a node you expect
    *   to be up: a node that is down makes the read fail, and a failed read reads as "absent".
    */
   node: string;
@@ -51,7 +51,7 @@ export interface CephPoolProps extends WithTarget {
   min_size?: number;
   /**
    * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With
-   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`
+   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on C1, `rbd-c1`
    *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration
    *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with
    *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE
@@ -61,7 +61,7 @@ export interface CephPoolProps extends WithTarget {
   pg_num?: number;
   /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */
   pg_num_min?: number;
-  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */
+  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four C1 pools have. */
   pg_autoscale_mode?: 'off' | 'on' | 'warn';
   /**
    * The CRUSH rule BY NAME, e.g. `replicated_rule`.
@@ -108,7 +108,7 @@ export interface CephPoolProps extends WithTarget {
  *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not
  *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes
  *   are the only place a plan can show WHY a declared size is not being enforced. All three read
- *   false on all four TB4 pools.
+ *   false on all four C1 pools.
  * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.
  * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change
  *   every few seconds; persisting them would rewrite this resource's state on every deploy and
@@ -170,7 +170,7 @@ export const same = <T>(declared: T | undefined, live: T, frozen = false) =>
  * A declared autoscaler hint, or nothing when it is zero.
  *
  * ⚠️ A DECLARED ZERO IS "NO FLOOR, NO HINT", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT
- *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding
+ *   MEASURED: all four C1 pools carry null for both `pg_num_min` and `target_size`, and finding
  *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and
  *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET
  *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET
@@ -203,7 +203,7 @@ const numeric = (value: number | undefined) => (value === undefined ? undefined
  * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of
  *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to
  *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode
- *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4
+ *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on C1
  *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a
  *   pool somebody tuned by hand.
  *
@@ -216,7 +216,7 @@ const numeric = (value: number | undefined) => (value === undefined ? undefined
  *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size
  *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and
  *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on
- *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
+ *   node-b, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
  *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read
  *   back as 1099511627776 and diff against itself on every plan, forever.
  */

package/src/proxmox/ceph-pool.ts

@@ -18,10 +18,10 @@
  *   string, so HTTP 200 means "the task started" — an immediate read-back can see a pool that does
  *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.
  *
- * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
+ * ⛔ THE FOUR POOLS ON C1 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
  *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),
- *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —
- *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.
+ *   `cephfs-c1_data` and `cephfs-c1_metadata` (the two halves of the `cephfs-c1` filesystem —
+ *   destroying either destroys the filesystem), and `rbd-c1`, the rbd pool the guests sit on.
  *   `list` answers empty like every resource in this package, so adoption stays an explicit act;
  *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.
  *
@@ -107,9 +107,9 @@ const spec: PveSpec<CephPoolProps, CephPoolAttributes> = {
    *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`
    *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and
    *   `name` (the address the read was made at — true by construction, never a diff). In, and each
-   *   measured to round-trip unchanged against TB4's four pools on 2026-09-13: size 3, min_size 2,
+   *   measured to round-trip unchanged against C1's four pools on 2026-09-13: size 3, min_size 2,
    *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on
-   *   cephfs-tb4_metadata, absent on cephtb4), target_size in bytes — and each of the last two
+   *   cephfs-c1_metadata, absent on rbd-c1), target_size in bytes — and each of the last two
    *   through `hint`, which drops a declared zero for the reason given on it.
    */
   matches: (attributes, props) =>
@@ -197,7 +197,7 @@ export const ProxmoxCephPoolProvider = () =>
          *   to remove deliberately.
          * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE, WHICH IS WHY THIS WAITS. The DELETE
          *   forks a worker and answers 200 with a UPID, so mons running with
-         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on TB4
+         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on C1
          *   2026-09-13: the config-db value is false while the running mons report true, i.e. it is
          *   set in ceph.conf and the two sources disagree by design.
          */

package/src/proxmox/client.test.ts

@@ -25,7 +25,7 @@ const CRED: PveCredential = {
 
 const target = (members: readonly string[]): PveTarget => ({
   members,
-  mount: 'proxmox-tb4-test',
+  mount: 'proxmox-c1-test',
   scheme: 'pve',
 });
 
@@ -148,7 +148,7 @@ describe('cluster member failover', () => {
     const backup = counting('UPID:1');
     try {
       await run(
-        pveWith(target([A, B]), CRED, 'PUT', 'nodes/n3/network').pipe(
+        pveWith(target([A, B]), CRED, 'PUT', 'nodes/node-c/network').pipe(
           Effect.timeout('50 millis'),
           Effect.flip,
         ),
@@ -169,7 +169,7 @@ describe('cluster member failover', () => {
     const backup = counting('UPID:2');
     try {
       // Loopback port 1 is closed: Bun answers ConnectionRefused before a byte is written.
-      const data = await run(pveWith(target([A, B]), CRED, 'PUT', 'nodes/n3/network'), {
+      const data = await run(pveWith(target([A, B]), CRED, 'PUT', 'nodes/node-c/network'), {
         [A]: 1,
         [B]: backup.port,
       });

package/src/proxmox/client.ts

@@ -4,7 +4,7 @@
  * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.
  *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed
  *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's
- *   Encrypt certificate (`CN=cluster-tb4.example.com`), and strict TLS answers 401, i.e. the
+ *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the
  *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`
  *   option here to be left switched on by accident in somebody else's estate.
  *
@@ -93,7 +93,7 @@ const buildRequest = (
    *   package can perform was broken from the day the client was written.
    *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted
    *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The
-   *     identical bug in house/forgejo/src/client.ts surfaced the moment a write token existed
+   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed
    *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.
    *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth
    *     more than the fix.
@@ -213,7 +213,7 @@ export const pveEnvelopeWith = (
  * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.
  *
  * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy
- *   of the TB4 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
+ *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
  *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node
  *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.
  *

package/src/proxmox/credentials.test.ts

@@ -29,9 +29,9 @@ const { Bun } = globalThis as unknown as {
 
 const TOKEN = 'hvs.FAKE-sentinel-never-a-real-token';
 const SECRET = 'fake-pve-secret-0000';
-const TB4: PveTarget = {
+const C1: PveTarget = {
   members: ['pve.example'],
-  mount: 'proxmox-tb4',
+  mount: 'proxmox-c1',
   scheme: 'pve',
 };
 
@@ -59,11 +59,9 @@ const withFake = async (
 };
 
 const minted = (env: BaoEnvironment) =>
-  Effect.runPromise(mint(TB4, 'read', env).pipe(Effect.provide(FetchHttpClient.layer)));
+  Effect.runPromise(mint(C1, 'read', env).pipe(Effect.provide(FetchHttpClient.layer)));
 const refused = (env: BaoEnvironment) =>
-  Effect.runPromise(
-    mint(TB4, 'read', env).pipe(Effect.flip, Effect.provide(FetchHttpClient.layer)),
-  );
+  Effect.runPromise(mint(C1, 'read', env).pipe(Effect.flip, Effect.provide(FetchHttpClient.layer)));
 
 const CREDENTIAL = {
   json: { data: { secret: SECRET, token_id: 'hf-read@pve!hf-read-1' }, lease_duration: 3600 },
@@ -79,7 +77,7 @@ describe('mint', () => {
         secret: SECRET,
         tokenId: 'hf-read@pve!hf-read-1',
       });
-      assert.equal(seen[0]?.path, '/v1/proxmox-tb4/creds/read');
+      assert.equal(seen[0]?.path, '/v1/proxmox-c1/creds/read');
       assert.equal(seen[0]?.headers.get('x-vault-token'), TOKEN);
       assert.equal(seen[0]?.headers.get('x-vault-namespace'), 'homeflare');
       assert.equal(seen[0]?.headers.get('x-vault-request'), 'true');
@@ -135,7 +133,7 @@ describe('mint', () => {
       CREDENTIAL,
       async (address, seen) => {
         assert.equal((await minted({ BAO_ADDR: address })).leaseSeconds, 3600);
-        assert.equal(seen[0]?.path, '/v1/proxmox-tb4/creds/read');
+        assert.equal(seen[0]?.path, '/v1/proxmox-c1/creds/read');
       },
       socket,
     );

package/src/proxmox/credentials.ts

@@ -2,13 +2,13 @@
  * The PVE credential a reconcile runs with: minted from OpenBao, alive for five minutes.
  *
  * ⛔ THERE IS NO STATIC WRITE TOKEN IN THIS ESTATE, AND THAT IS DELIBERATE. Every PVE token stored
- *   in `kv/infra/proxmox/*` is read-only — PVEAuditor on media/ops/tb4, Audit on pbs, all as
- *   `monitoring@pve`. The MCP proxmox client says why in its own header: the auditor token bounds
+ *   on the estate's static KV shelf is read-only — PVEAuditor on each cluster, Audit on PBS, all
+ *   as one metrics user. The MCP proxmox client says why in its own header: the auditor token bounds
  *   what a BUG can do, independently of what the code bounds. Adding a long-lived write token to
  *   that shelf would delete the outer lock for every reader of the shelf, not just for this
  *   provider.
  *
- * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-tb4/`
+ * ★ SO WRITES COME FROM A DYNAMIC MOUNT INSTEAD, which the estate already built: `proxmox-c1/`
  *   exposes two roles — `read` (ttl 3600s) and `provision` (ttl 300s, max 1800s, NOT renewable).
  *   A mint returns a PVE API token of its own, `hf-provision@pve!hf-provision-…-<timestamp>-<id>`,
  *   which expires on its own whether or not anything cleans up. Same shape as
@@ -24,7 +24,7 @@
  *
  * ⛔ THE SECRET NEVER TOUCHES DISK, A LOG, OR ALCHEMY STATE. Alchemy persists resource attributes
  *   WITHOUT encryption — StateEncoding.ts writes `Redacted` as `{"@redacted": <plaintext>}` — and
- *   this estate's state store is the `alchemy` Postgres, which pg-backup.sh dumps nightly. A PVE
+ *   this estate's state store is the `alchemy` Postgres, which a nightly job dumps. A PVE
  *   secret that reached an attribute would outlive its 300s lease by months, in four places.
  *   Nothing here returns it to a resource; it is used to build a header and then dropped.
  */
@@ -60,10 +60,10 @@ export type PveRole = 'read' | 'provision';
  *   use this file unchanged; that is the whole difference between a provider and a script.
  */
 export type PveTarget = {
-  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-tb4`. */
+  /** OpenBao mount that vends API tokens for this host, e.g. `proxmox-c1`. */
   readonly mount: string;
   /**
-   * mgmt hostnames for cluster members, e.g. `n2.mgmt.example.com`. Any member's :8006 API
+   * mgmt hostnames for cluster members, e.g. `node-b.mgmt.example.com`. Any member's :8006 API
    * manages the whole cluster; `client.ts` failovers across them.
    */
   readonly members: readonly string[];
@@ -133,14 +133,14 @@ const baoVariable = (env: BaoEnvironment, name: string) =>
  * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
- *   client could not disagree with `bao kv get` about what this machine may do. house/openbao then
+ *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then
  *   learned twice what deciding by stderr costs — every failure read as absent, and two commands
  *   said "absent" in different words — so this reads STATUS CODES: 2xx is a credential, and 403
  *   (denied), 404 (no such role or mount — a mint has no "absent"), 503 (sealed) all fail.
  * ★ THE ENVIRONMENT CONTRACT IS STILL THE CLI's, READ THE CLI's WAY, which keeps the case above
  *   true (openbao v2.6.2 api/client.go:34-66, 370, 503-507, 761-762, 776-785): BAO_AGENT_ADDR over
  *   BAO_ADDR over https://127.0.0.1:8200; BAO_NAMESPACE as X-Vault-Namespace; BAO_TOKEN as
- *   X-Vault-Token; X-Vault-Request always. house/openbao/src/bao-address.ts has the long form.
+ *   X-Vault-Token; X-Vault-Request always. <estate>/openbao/src/bao-address.ts has the long form.
  * ★ AGENT MODE IS NO BAO_TOKEN AND NO TOKEN HEADER. An Agent or Proxy listener with
  *   `api_proxy { use_auto_auth_token = true }` (or the older `cache { … }`) substitutes its
  *   auto-auth token exactly when a request carries none — command/agentproxyshared/cache/handler.go

package/src/proxmox/fake-pve-lxc.ts

@@ -34,6 +34,11 @@ export type FakePve = {
    * keyed `node/vmid` — a guest that appears between a plan and its deploy.
    */
   readonly vanish: Map<string, number>;
+  /**
+   * Hand edits that land mid-deploy, keyed `node/vmid`: once that guest's config has been read
+   * `after` more times, `set` is merged into it — a change made between a plan and its apply.
+   */
+  readonly edits: Map<string, { after: number; readonly set: Record<string, unknown> }>;
   /** Config keys a `PUT …/config` accepts with 200 and then does not store. */
   readonly ignore: Set<string>;
   /** How every task ends, and whether a task-starting call answers with no UPID at all. */
@@ -90,6 +95,7 @@ export const fakePve = (): FakePve => {
   const others: { vmid: number | string; node: string; type: string }[] = [];
   const configErrors = new Map<string, { status: number; body: unknown }>();
   const vanish = new Map<string, number>();
+  const edits: FakePve['edits'] = new Map();
   const ignore = new Set<string>();
   const task = { exit: 'OK', noUpid: false };
   const seen: Seen[] = [];
@@ -148,7 +154,12 @@ export const fakePve = (): FakePve => {
       const message = `Configuration file 'nodes/${node}/lxc/${vmid}.conf' does not exist\n`;
       return json({ data: null, message }, 500);
     }
-    if (tail === '/config' && request.method === 'GET') return json({ data: config });
+    if (tail === '/config' && request.method === 'GET') {
+      const answer = json({ data: config });
+      const edit = edits.get(`${node}/${vmid}`);
+      if (edit !== undefined && --edit.after === 0) Object.assign(config, edit.set);
+      return answer;
+    }
     if (tail === '/config' && request.method === 'PUT') {
       const digest = form.get('digest');
       if (digest !== null && digest !== config['digest']) {
@@ -192,6 +203,7 @@ export const fakePve = (): FakePve => {
   };
   return {
     configErrors,
+    edits,
     fetch: Object.assign(remapped, { preconnect: globalThis.fetch.preconnect }),
     guests,
     ignore,

package/src/proxmox/firewall-alias-form.ts

@@ -36,7 +36,7 @@ export const fold = (name: string) => name.trim().toLowerCase();
 /**
  * A CIDR reduced to the one form PVE will hand back.
  *
- * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,
+ * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,
  *   2026-09-13) — a pure function over a string, no config read and none written:
  *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED
  *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded