@homeflare/alchemy 0.10.1 → 0.12.0

package/src/proxmox/lxc-judge.test.ts

@@ -13,7 +13,7 @@ import { judgeVolume, parseVolume, sizeBytes } from './lxc-volume.ts';
 const props = (over: Partial<LxcProps>): LxcProps => ({
   node: 'pve1',
   target: TARGET,
-  vmid: 100,
+  vmid: 900,
   ...over,
 });
 const live = (config: Record<string, unknown>) => ({ unprivileged: 1, ...config });
@@ -36,7 +36,7 @@ describe('sizes and volumes, as pve-container parses them', () => {
 
   test('an options change on a volume declared as new is written with the LIVE volume id', () => {
     const verdict = judgeVolume('mp0', 'tank:200,mp=/data,backup=1', LIVE_MP);
-    expect(verdict).toEqual({ put: 'tank:subvol-100-disk-0,mp=/data,backup=1,size=200G' });
+    expect(verdict).toEqual({ put: 'tank:subvol-900-disk-0,mp=/data,backup=1,size=200G' });
   });
 
   test('a fractional new-disk size grows by the same GiB', () => {
@@ -44,7 +44,7 @@ describe('sizes and volumes, as pve-container parses them', () => {
   });
 });
 
-const LIVE_MP = 'tank:subvol-100-disk-0,mp=/data,backup=0,size=200G';
+const LIVE_MP = 'tank:subvol-900-disk-0,mp=/data,backup=0,size=200G';
 
 describe('scalars compare the way PVE stores them', () => {
   test.each([
@@ -106,7 +106,7 @@ describe('features follow check_ct_modify_config_perm', () => {
 
   test('clearing features that hold more than nesting is root@pam only, as PVE counts keys', () => {
     const change = judge(props({ features: '' }), live({ features: 'nesting=1,keyctl=0' }));
-    expect(change.refuse[0]).toMatch(/pct set 100 --delete features/);
+    expect(change.refuse[0]).toMatch(/pct set 900 --delete features/);
   });
 });
 
@@ -147,7 +147,7 @@ describe('create', () => {
       ostemplate: 'local:vztmpl/t.tar.zst',
       start: '1',
       unprivileged: '1',
-      vmid: '100',
+      vmid: '900',
     });
   });
 

package/src/proxmox/lxc-lifecycle.ts

@@ -72,7 +72,7 @@ export const readLive = (where: LxcWhere) =>
       'GET',
       'cluster/resources?type=vm',
     );
-    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `"100"` would otherwise
+    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `"900"` would otherwise
     //   match nothing, and "listed nowhere" is the one answer that turns into a create.
     const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
     if (found !== undefined && found.node === where.node && found.type === 'lxc') {

package/src/proxmox/lxc-ownership.test.ts

@@ -7,7 +7,8 @@
  *   planned a create refuses a guest it then finds, and forgets its `creating` row; under
  *   `--adopt` it records a matching one with no write and still refuses one that differs; and a
  *   create interrupted after its POST resumes WITHOUT `--adopt` when the guest is what it wrote,
- *   and asks for `--adopt` when someone changed it meanwhile.
+ *   and asks for `--adopt` when someone changed it meanwhile — which then adopts it only as it
+ *   now runs, never writing the declaration back over the change (lxc-adoption.ts).
  * ★ THE INTERRUPTION IS A CREATE TASK THAT ENDS IN AN ERROR AFTER THE FAKE BUILT THE GUEST — to the
  *   engine the same as a deploy killed while it waited on the task: a live guest, and a
  *   `creating` row with no attributes.
@@ -15,20 +16,12 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import { adopt } from 'alchemy/AdoptPolicy';
 import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
-import { LIVE, TARGET, lxcEngine, seed } from './lxc-harness.ts';
+import { KEY, NODE, TARGET, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
 import { ProxmoxLxc } from './lxc.ts';
 import type { LxcProps } from './lxc-props.ts';
 
-const NODE = 'pve1';
-const VMID = 100;
-const KEY = `${NODE}/${String(VMID)}`;
 const TAKEOVER = 'already exists, and this stack holds no state for it';
 
-const pasted = (over: Partial<LxcProps> = {}): LxcProps => {
-  const { lxc: _raw, ...config } = LIVE;
-  return { ...(config as Partial<LxcProps>), node: NODE, target: TARGET, vmid: VMID, ...over };
-};
-
 let fake: FakePve | undefined;
 afterEach(() => {
   fake?.stop();
@@ -146,14 +139,26 @@ describe('an interrupted create', () => {
     expect(stack.status('door')).toBe('created');
   });
 
-  test('asks for --adopt when the guest changed meanwhile, and resumes with it', async () => {
+  test('is our own guest, not an adoption: a declaration changed meanwhile is written', async () => {
+    const { pve, stack } = await interrupted();
+    const run = await stack.deploy(door({ hostname: 'door-renamed' }));
+    expect(run.failure).toBe('');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`, `PUT nodes/${NODE}/lxc/150/config`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-renamed');
+  });
+
+  test('asks for --adopt when the guest changed meanwhile, and adopts it only as it runs', async () => {
     const { pve, stack } = await interrupted();
     const guest = pve.guests.get(`${NODE}/150`) ?? {};
     guest['hostname'] = 'someone-else';
     expect((await stack.deploy(door())).failure).toContain('Cannot resume creating');
-    const resumed = await stack.deploy(door(), { adopt: true });
+    const refused = await stack.deploy(door(), { adopt: true });
+    expect(refused.failure).toContain('adopting it would change hostname');
+    expect(refused.failure).not.toContain('someone-else');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    const resumed = await stack.deploy(door({ hostname: 'someone-else' }), { adopt: true });
     expect(resumed.failure).toBe('');
-    expect(resumed.warnings.join('\n')).toContain('differs from the declaration in hostname');
-    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('door-example');
+    expect(writesOf(pve)).toEqual([`POST nodes/${NODE}/lxc`]);
+    expect(pve.guests.get(`${NODE}/150`)?.['hostname']).toBe('someone-else');
   });
 });

package/src/proxmox/lxc-props.ts

@@ -58,7 +58,7 @@ export interface LxcProps extends WithTarget {
   /** MiB. */
   swap?: number;
   /**
-   * `local-zfs:subvol-100-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
+   * `local-zfs:subvol-900-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
    * create. See lxc-volume.ts for what may change: options in place, size up only.
    */
   rootfs?: string;
@@ -79,7 +79,7 @@ export interface LxcProps extends WithTarget {
   console?: PveFlag;
   tty?: number;
   cmode?: string;
-  /** `tank:subvol-100-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
+  /** `tank:subvol-900-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
   [mount: `mp${number}`]: string | undefined;
   /** `name=eth0,bridge=vmbr0,ip=dhcp`. ⚠️ An undeclared `hwaddr` keeps the live MAC. */
   [nic: `net${number}`]: string | undefined;

package/src/proxmox/lxc-read.test.ts

@@ -40,10 +40,10 @@ describe('absent means the cluster does not list the vmid', () => {
 
   test('a 500 for a guest the cluster lists on this node fails with PVE’s error', async () => {
     fake = fakePve();
-    seed(fake, NODE, 100, LIVE);
+    seed(fake, NODE, 900, LIVE);
     const message = 'got timeout\n';
-    fake.configErrors.set(`${NODE}/100`, { body: { data: null, message }, status: 500 });
-    const run = await lxcEngine(fake).plan(declared(100));
+    fake.configErrors.set(`${NODE}/900`, { body: { data: null, message }, status: 500 });
+    const run = await lxcEngine(fake).plan(declared(900));
     expect(run.failure).toContain('got timeout');
     expect(run.actions).toEqual({});
     expect(writesOf(fake)).toEqual([]);

package/src/proxmox/lxc-strict-adopt.test.ts

@@ -0,0 +1,104 @@
+/**
+ * AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts), through Alchemy's real plan and apply over
+ * fake-pve-lxc.ts (placeholders only).
+ *
+ * ⛔ WHAT THESE PIN: a cold adoption that differs from the live guest in ANY key fails the plan —
+ *   under `adopt(true)` and under `--adopt` alike — naming the keys and none of the values, before
+ *   `judge`'s own refusals (which print a declared value); nothing is written and no row is left.
+ *   A hand edit between the plan and the deploy is refused at apply with nothing written; the
+ *   adoption row it leaves keeps refusing until the declaration says what is live, and then adopts
+ *   with no write. An interrupted create that `--adopt` resumes is held to the same rule:
+ *   lxc-ownership.test.ts.
+ * ★ MUTATION-CHECKED 2026-09-21: removing either `refuseAdoptedDrift` call in lxc.ts, or any one of
+ *   the three adoption answers in ownership/adopting.ts, fails a test here or in
+ *   lxc-ownership.test.ts.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import { adopt } from 'alchemy/AdoptPolicy';
+import { type FakePve, fakePve, writesOf } from './fake-pve-lxc.ts';
+import { KEY, NODE, VMID, lxcEngine, pasted, seed } from './lxc-harness.ts';
+import { ProxmoxLxc } from './lxc.ts';
+import type { LxcProps } from './lxc-props.ts';
+
+const REFUSAL = 'adopting it would change';
+
+let fake: FakePve | undefined;
+afterEach(() => {
+  fake?.stop();
+  fake = undefined;
+});
+const live = () => {
+  fake = fakePve();
+  seed(fake, NODE, VMID);
+  return fake;
+};
+
+const drifted = (): LxcProps =>
+  pasted({ memory: 4096, net1: 'name=eth1,bridge=vmbr1,ip=198.51.100.4/24,mtu=9000' });
+
+describe('a cold adoption that differs from the live guest fails the plan', () => {
+  test.each([
+    ['adopt(true)', () => ProxmoxLxc('ct', drifted()).pipe(adopt(true)), {}],
+    ['--adopt', () => ProxmoxLxc('ct', drifted()), { adopt: true }],
+  ])('under %s: keys named, values never, nothing written', async (_, declare, options) => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const planned = await stack.plan(declare(), options);
+    expect(planned.failure).toContain(`CT ${String(VMID)} on ${NODE}: ${REFUSAL} memory, net1.`);
+    for (const value of ['4096', '8192', '9000', '1500']) {
+      expect(planned.failure).not.toContain(value);
+    }
+    const deployed = await stack.deploy(declare(), options);
+    expect(deployed.failure).toContain(`${REFUSAL} memory, net1`);
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBeUndefined();
+  });
+
+  test.each([
+    ['a device passthrough', { dev1: '/dev/fuse' }, 'dev1', ['/dev/fuse', 'pct set']],
+    ['an unprivileged flip', { unprivileged: 0 as const }, 'unprivileged', ['live 1']],
+    [
+      'a smaller mount point',
+      { mp0: 'tank:subvol-900-disk-0,mp=/data,size=100G' },
+      'mp0',
+      ['100G'],
+    ],
+  ])('%s is the adoption refusal, not the update one', async (_, change, key, hidden) => {
+    const pve = live();
+    const run = await lxcEngine(pve).plan(ProxmoxLxc('ct', pasted(change)).pipe(adopt(true)));
+    expect(run.failure).toContain(`${REFUSAL} ${key}.`);
+    for (const value of hidden) expect(run.failure).not.toContain(value);
+    expect(writesOf(pve)).toEqual([]);
+  });
+
+  test('an exact match still adopts, with no write and no warning', async () => {
+    const pve = live();
+    const run = await lxcEngine(pve).deploy(ProxmoxLxc('ct', pasted()).pipe(adopt(true)));
+    expect(run).toEqual({ actions: { ct: 'adopted' }, failure: '', warnings: [] });
+    expect(writesOf(pve)).toEqual([]);
+  });
+});
+
+describe('a hand edit between the plan and the deploy', () => {
+  test('is refused at apply, and the adoption holds until the declaration says what is live', async () => {
+    const pve = live();
+    const stack = lxcEngine(pve);
+    const declare = (over: Partial<LxcProps> = {}) =>
+      ProxmoxLxc('ct', pasted(over)).pipe(adopt(true));
+    // ★ Two config reads plan a cold adoption — the probe's and diff's — so the edit lands after
+    //   the plan said `adopted` and before reconcile reads.
+    pve.edits.set(KEY, { after: 2, set: { memory: 4096 } });
+    const raced = await stack.deploy(declare());
+    expect(raced.failure).toContain(`${REFUSAL} memory.`);
+    expect(raced.failure).not.toContain('4096');
+    expect(writesOf(pve)).toEqual([]);
+    expect(pve.guests.get(KEY)?.['memory']).toBe(4096);
+    expect(stack.status('ct')).toBe('updating');
+    expect((await stack.plan(declare())).failure).toContain(`${REFUSAL} memory.`);
+    const caughtUp = await stack.deploy(declare({ memory: 4096 }));
+    expect(caughtUp.failure).toBe('');
+    expect(writesOf(pve)).toEqual([]);
+    expect(stack.status('ct')).toBe('updated');
+    expect((await stack.plan(declare({ memory: 4096 }))).actions).toEqual({ ct: 'noop' });
+  });
+});

package/src/proxmox/lxc-volume.test.ts

@@ -14,17 +14,17 @@ import { judge } from './lxc-judge.ts';
 import { type LxcProps, storedConfig } from './lxc-props.ts';
 import { judgeVolume } from './lxc-volume.ts';
 
-const LIVE_MP = 'tank:subvol-100-disk-0,mp=/data,size=200G';
+const LIVE_MP = 'tank:subvol-900-disk-0,mp=/data,size=200G';
 const props = (over: Record<string, unknown>): LxcProps =>
-  ({ node: 'pve1', target: TARGET, vmid: 100, ...over }) as unknown as LxcProps;
+  ({ node: 'pve1', target: TARGET, vmid: 900, ...over }) as unknown as LxcProps;
 const live = (config: Record<string, unknown>) => ({ unprivileged: 1, ...config });
 
 describe('mount points', () => {
   test('another volume on the same storage is refused, never written', () => {
-    const verdict = judgeVolume('mp0', 'tank:subvol-100-disk-7,mp=/data,size=200G', LIVE_MP);
+    const verdict = judgeVolume('mp0', 'tank:subvol-900-disk-7,mp=/data,size=200G', LIVE_MP);
     expect(verdict.refuse).toMatch(/detach the live volume to unusedN/);
     expect(verdict.put).toBeUndefined();
-    const change = judge(props({ mp0: 'tank:subvol-100-disk-7,mp=/data' }), live({ mp0: LIVE_MP }));
+    const change = judge(props({ mp0: 'tank:subvol-900-disk-7,mp=/data' }), live({ mp0: LIVE_MP }));
     expect(change.put).toEqual({});
     expect(change.refuse[0]).toMatch(/unusedN/);
   });
@@ -32,7 +32,7 @@ describe('mount points', () => {
   test('a bind mount is root@pam only, new or changed', () => {
     const added = judge(props({ mp1: '/srv/share,mp=/share' }), live({}));
     expect(added.put).toEqual({});
-    expect(added.refuse[0]).toMatch(/pct set 100 --mp1/);
+    expect(added.refuse[0]).toMatch(/pct set 900 --mp1/);
     const bind = '/srv/share,mp=/share';
     expect(judgeVolume('mp1', `${bind},ro=1`, bind)).toEqual({ rootOnly: true });
     expect(judgeVolume('mp1', bind, bind)).toEqual({});
@@ -41,13 +41,13 @@ describe('mount points', () => {
   test('replicate defaults ON: an explicit replicate=0 is a value, replicate=1 is not', () => {
     expect(judgeVolume('mp0', `${LIVE_MP},replicate=1`, LIVE_MP)).toEqual({});
     const off = judgeVolume('mp0', LIVE_MP, `${LIVE_MP},replicate=0`);
-    expect(off.put).toBe('tank:subvol-100-disk-0,mp=/data,size=200G');
+    expect(off.put).toBe('tank:subvol-900-disk-0,mp=/data,size=200G');
   });
 
   test('options and growth together: the PUT carries the live size, the resize the new one', () => {
     const verdict = judgeVolume('mp0', 'tank:300,mp=/data,backup=1', LIVE_MP);
     expect(verdict).toEqual({
-      put: 'tank:subvol-100-disk-0,mp=/data,backup=1,size=200G',
+      put: 'tank:subvol-900-disk-0,mp=/data,backup=1,size=200G',
       resize: '300G',
     });
   });
@@ -57,7 +57,7 @@ describe('a create allocates new volumes only', () => {
   test('an existing volume id in a create is refused; the new-disk spelling is not', () => {
     const base = { ostemplate: 'local:vztmpl/t.tar.zst' };
     const existing = createRefusals(
-      props({ ...base, rootfs: 'local-zfs:subvol-100-disk-0,size=8G' }),
+      props({ ...base, rootfs: 'local-zfs:subvol-900-disk-0,size=8G' }),
     );
     expect(existing.join('\n')).toMatch(/rootfs: .* names an existing volume/);
     expect(
@@ -84,7 +84,7 @@ describe('keys the resource does not manage', () => {
       mp0: LIVE_MP,
       parent: 'snap1',
       unprivileged: 1,
-      unused0: 'tank:subvol-100-disk-9',
+      unused0: 'tank:subvol-900-disk-9',
     };
     expect(storedConfig(read)).toEqual({
       hostname: 'x',

package/src/proxmox/lxc-volume.ts

@@ -14,7 +14,7 @@
  * ⛔ AN EXISTING VOLUME IS NEVER WRITTEN WITH THE NEW-DISK SPELLING. `tank:100` in a PUT means
  *   "allocate a fresh 100 GiB volume", and PVE then moves the volume the guest was using to
  *   `unusedN`. So a declared `tank:100,mp=/data` that matches a live
- *   `tank:subvol-100-disk-1,mp=/data,size=100G` compares EQUAL, and an options change on it is
+ *   `tank:subvol-900-disk-1,mp=/data,size=100G` compares EQUAL, and an options change on it is
  *   written with the LIVE volume id — the declaration's spelling is never sent back for a volume
  *   that exists.
  */

package/src/proxmox/lxc-wire.ts

@@ -3,7 +3,7 @@
  *
  * ★ EVERY RULE HERE IS READ OFF pve-container 6.1.14 (the PVE 9 line, `src/PVE/LXC/Config.pm` at
  *   git.proxmox.com HEAD, 2026-09-21) or off a live guest's config read with
- *   `pvesh get /nodes/<node>/lxc/100/config`. A rule nobody measured is a forever-diff waiting to
+ *   `pvesh get /nodes/<node>/lxc/<vmid>/config`. A rule nobody measured is a forever-diff waiting to
  *   happen: the plan reports an update, the deploy writes the same value back, and the next plan
  *   reports it again.
  *

package/src/proxmox/lxc.ts

@@ -1,9 +1,9 @@
 /**
  * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.
  *
- * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS: `LXCProvisioner` on `/` grants
- *   VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
- *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What that role cannot do — device
+ * ★ THE PROVISIONING BASELINE HOLDS WHAT THIS NEEDS (provision-baseline.ts): on `/`, VM.Allocate,
+ *   VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
+ *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What no token can do — device
  *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts
  *   refuses at plan with the `pct set` to run instead.
  *
@@ -17,11 +17,11 @@
  * ⛔ AND NOTHING HERE WRITES A VOLUME IT DID NOT ALLOCATE. A create takes `storage:GiB` only
  *   (lxc-create-form.ts), and a deploy that planned a create never writes onto a guest it finds.
  *
- * ⚠️ AN ADOPTION ALWAYS PLANS `adopted`, EVEN WHEN IT WOULD WRITE. alchemy 2.0.0-beta.79 turns a
- *   cold adoption's diff into an update whatever it answered (Plan.ts, `forceUpdateAfterAdoption`)
- *   and prints no property diff for it. So `diff` LOGS the keys a deploy would write, by name
- *   (never by value), as a warning — the only place a plan can say the declaration is not the live
- *   config yet. A clean adoption logs nothing, and its deploy writes nothing (lxc-judge.ts).
+ * ⛔ AND AN ADOPTION NEVER CHANGES A GUEST (lxc-adoption.ts). A guest this stack adopts is taken
+ *   over exactly as it runs: any key the declaration says otherwise FAILS the plan, by name (never
+ *   by value), and reconcile asks again before it would write. Only an exact match adopts.
+ * ⚠️ AN UPDATE STILL PLANS `update` WITHOUT A PROPERTY DIFF, so `diff` LOGS the keys a deploy would
+ *   write, by name, as a warning — the only place a plan says what the deploy will change.
  *
  * ⚠️ POWER STATE IS NOT DECLARED. `onboot` is config; start and stop are an operator's act, as for
  *   `Proxmox.Vm`. `start: 1` starts a guest once, after the create that built it, and never again.
@@ -36,6 +36,7 @@ import { ownedRead } from '../ownership/probe.ts';
 import { provingResumes } from '../ownership/resume.ts';
 import { createRefusals } from './lxc-create-form.ts';
 import { identityRefusals } from './lxc-identity.ts';
+import { refuseAdoptedDrift } from './lxc-adoption.ts';
 import { judge } from './lxc-judge.ts';
 import {
   LxcRefusedError,
@@ -75,8 +76,9 @@ const refused = (reasons: readonly string[]) =>
  *   that follows, so reconcile can tell our own interrupted create from a guest somebody else put
  *   at this vmid.
  */
-const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | undefined) =>
+const diff = (owner: LxcOwner, news: Input<LxcProps>, olds: LxcProps) =>
   Effect.gen(function* () {
+    const { output } = owner;
     const identity = identityRefusals(news, olds, output);
     if (identity.length > 0) return yield* refused(identity);
     if (output === undefined) return undefined;
@@ -96,6 +98,7 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
       return { action: 'update' } as const;
     }
     const change = judge(news, live);
+    yield* refuseAdoptedDrift(owner, news, live, change);
     if (change.refuse.length > 0) return yield* refused(change.refuse);
     const moved = news.node !== output.node;
     if (change.drift.length === 0 && !moved) return { action: 'noop' } as const;
@@ -112,7 +115,8 @@ const diff = (news: Input<LxcProps>, olds: LxcProps, output: LxcAttributes | und
 /**
  * ⛔ THE SAME JUDGE AS `diff`, RE-RUN AGAINST A FRESH READ, AND AN EMPTY CHANGE WRITES NOTHING.
  *   Apply routes `adopted` through reconcile (resource.ts has the Apply.ts lines), so this is what
- *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs.
+ *   runs on the first deploy after an adoption; for a guest that already matches it is two GETs,
+ *   and for one edited since the plan it is a refusal, never a write (lxc-adoption.ts).
  * ⛔ AND IT READS BACK AND JUDGES AGAIN. PVE answers 200 on writes that did nothing, so a change
  *   that did not land is a failure here, not a state row claiming it did. ⚠️ A change PVE parked
  *   as pending on a running guest DOES read back (GET config merges `[pending]` unless asked for
@@ -148,6 +152,7 @@ const reconcile = (owner: LxcOwner, news: LxcProps) =>
             'onto an existing guest: plan again, so the plan can show it and adopt it.',
         ]);
       }
+      yield* refuseAdoptedDrift(owner, news, live, change);
       if (change.refuse.length > 0) return yield* refused(change.refuse);
       if (change.drift.length > 0) yield* updateGuest(news, change, text(live['digest']));
     }
@@ -208,14 +213,13 @@ const handlers = {
   delete: ({ olds, output }: { olds: LxcProps; output: LxcAttributes }) =>
     destroyGuest(whereOf(olds, output), olds),
   diff: ({
+    fqn,
+    instanceId,
     news,
     olds,
     output,
-  }: {
-    news: Input<LxcProps>;
-    olds: LxcProps;
-    output: LxcAttributes | undefined;
-  }) => diff(news, olds, output),
+  }: Asked & { news: Input<LxcProps>; olds: LxcProps; output: LxcAttributes | undefined }) =>
+    diff({ fqn, instanceId, output }, news, olds),
   list: () => Effect.succeed([]),
   read: ({
     fqn,

package/src/proxmox/members.test.ts

@@ -15,7 +15,7 @@ const transport = (cause: Error) =>
   new HttpClientError.HttpClientError({
     reason: new HttpClientError.TransportError({
       cause,
-      request: { method: 'PUT', url: 'https://n2.mgmt.example.com:8006/api2/json/x' } as never,
+      request: { method: 'PUT', url: 'https://node-b.mgmt.example.com:8006/api2/json/x' } as never,
     }),
   });
 

package/src/proxmox/members.ts

@@ -1,10 +1,10 @@
 /**
- * TB4 cluster members: ordered failover, last-good preference, transport classification.
+ * C1 cluster members: ordered failover, last-good preference, transport classification.
  *
  * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the
  *   provider reaches the cluster through whichever member is up, not through one pinned node.
  *
- * ⛔ NEVER cluster-tb4.example.com: it resolves to 10.20.10.250, which nothing serves.
+ * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.
  */
 import * as Effect from 'effect/Effect';
 import * as Result from 'effect/Result';
@@ -120,7 +120,7 @@ export type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
  *   elsewhere can repeat a write.
  *
  * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.
- *   MEASURED 2026-09-14: full TB4 plans stayed all-noop with the first member refused (127.0.0.1)
+ *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)
  *   and with it unresolvable (n9.invalid).
  */
 export const executeOnCluster = (

package/src/proxmox/metric-server-otel.ts

@@ -12,8 +12,8 @@
  *   `Content-Type: application/json` (pve-manager PVE/Status/OpenTelemetry.pm:643) and gzips by
  *   default; there is no protobuf option. vector's opentelemetry source and VictoriaMetrics both
  *   take protobuf only — measured 2026-09-14 — so a server pointed straight at either fails every
- *   push. That is why TB4's declaration points at each node's own vector bridge
- *   (hosts/pve/vector/vector.yaml in homeflare-config) rather than at the estate's intake.
+ *   push. That is why C1's declaration points at each node's own vector bridge
+ *   (the estate's per-node vector config) rather than at the estate's intake.
  *
  * ⛔ `otel-headers` IS `never`, FOR THE REASON `token` IS. It is where an OTLP bearer token goes —
  *   base64 of a JSON object of arbitrary HTTP headers — and Alchemy persists attributes UNENCRYPTED.

package/src/proxmox/network-apply-read.ts

@@ -7,7 +7,7 @@
  *   diff, and the only write in either file is the apply itself.
  *
  * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the
- *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:
+ *   cluster's own source on node-b, 2026-09-13 — not inferred from documentation:
  *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);
  *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;
  *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {
@@ -24,9 +24,9 @@
  *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured
  *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.
  *
- * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,
- *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,
- *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that
+ * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On node-b and node-c,
+ *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on node-b,
+ *   node-c and node-d), `wlan0` already comes back with no `active` key at all. Counting interfaces that
  *   are not up as "pending" would report an update on two of the three nodes forever.
  *
  * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as
@@ -58,7 +58,7 @@ export type ClusterHealth = { quorate: boolean; offline: readonly string[] };
  *
  * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy
  *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`
- *   is a file that can legally contain `wpa-psk` — n2 and n3 both carry a `wlp91s0`, MEASURED — as
+ *   is a file that can legally contain `wpa-psk` — node-b and node-c both carry a `wlan0`, MEASURED — as
  *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret
  *   in a state store. Only the COUNT below ever escapes.
  */
@@ -70,7 +70,7 @@ const stagedDiff = (target: PveTarget, node: string) =>
     //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.
     // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the
     //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left
-    //   SIX extra `hf-read@pve` tokens on n2 per TB4 plan (one per node, for read and for diff),
+    //   SIX extra `hf-read@pve` tokens on node-b per C1 plan (one per node, for read and for diff),
     //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.
     const credential = yield* leased(target, 'read');
     const envelope = (yield* pveEnvelopeWith(target, credential, 'GET', path)) as NetworkEnvelope;
@@ -108,9 +108,9 @@ export const pendingCount = (target: PveTarget, node: string) =>
  * Quorum, and every member that is not online.
  *
  * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS
- *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on TB4:
- *   `{"id":"cluster","name":"HF-TB4","nodes":3,"quorate":1,…}` plus one row per node with
- *   `online: 1`. So a reload that drops n2 off the network is invisible to `quorate` and visible
+ *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on C1:
+ *   `{"id":"cluster","name":"HF-C1","nodes":3,"quorate":1,…}` plus one row per node with
+ *   `online: 1`. So a reload that drops node-b off the network is invisible to `quorate` and visible
  *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure
  *   message can say WHICH member went away.
  *
@@ -140,7 +140,7 @@ const clusterHealth = (target: PveTarget) =>
  *
  * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.
  *   "The deploy stopped because the cluster was degraded" is not actionable at three in the
- *   morning; "quorate=true offline=[n3]" is. The two callers in network-apply.ts ask this before
+ *   morning; "quorate=true offline=[node-c]" is. The two callers in network-apply.ts ask this before
  *   the reload and again after it, and the second answer is the one that stops the chain from
  *   reaching the next node.
  *

package/src/proxmox/network-apply.ts

@@ -4,23 +4,23 @@
  * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN
  *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit
  *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.
- *   MEASURED in the cluster's own source on n2, 2026-09-13 — `PVE/API2/Network.pm`:
+ *   MEASURED in the cluster's own source on node-b, 2026-09-13 — `PVE/API2/Network.pm`:
  *       rename($new_config_file, $current_config_file) if -e $new_config_file;
  *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
  *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);
  *
- * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON TB4 THE DANGER IS NOT ABSTRACT.
- *   Ceph runs over `vmbr1.11` on n2, n3 AND n4 (MEASURED 2026-09-13: four pools, size 3 /
+ * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON C1 THE DANGER IS NOT ABSTRACT.
+ *   Ceph runs over `vmbr1.42` on node-b, node-c AND node-d (MEASURED 2026-09-13: four pools, size 3 /
  *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off
  *   the cluster network for the length of the reload; two nodes at once puts every pool below
  *   min_size and blocks IO for every guest with an RBD disk. The management address the API is
- *   reached on, `vmbr0.10`, is reloaded by the same call.
+ *   reached on, `vmbr0.41`, is reloaded by the same call.
  *
  * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE
  *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this
- *   publishes exactly one node, so a stack holding three of these can apply n2, fail, and leave n3
- *   and n4 on the old layout with Ceph spanning all three. Four things here exist only for that:
- *     1. `after` SERIALISES THEM — chain n3 after n2 and n4 after n3, so at most one node is ever
+ *   publishes exactly one node, so a stack holding three of these can apply node-b, fail, and leave node-c
+ *   and node-d on the old layout with Ceph spanning all three. Four things here exist only for that:
+ *     1. `after` SERIALISES THEM — chain node-c after node-b and node-d after node-c, so at most one node is ever
  *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.
  *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.
  *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if
@@ -58,7 +58,7 @@ import type { WithTarget } from './resource.ts';
 
 export interface NetworkApplyProps extends WithTarget {
   /**
-   * The node whose staged interfaces file this applies — `n2`.
+   * The node whose staged interfaces file this applies — `node-b`.
    *
    * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's
    *   staged half, and both would run `ifreload` on a file the other had not finished writing.
@@ -99,7 +99,7 @@ export interface NetworkApplyAttributes {
    *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and
    *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of
    *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout
-   *   carries different numbers on different nodes (MEASURED: n4's differ from n2/n3's by one).
+   *   carries different numbers on different nodes (MEASURED: node-d's differ from node-b/node-c's by one).
    *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.
    *   This resource compares a single integer against zero and never looks at a row at all.
    */
@@ -128,7 +128,7 @@ const read = (props: NetworkApplyProps) =>
  *   decides it is whether the node is carrying a staged change right now.
  *
  * ★ THIS IS ALSO WHY DECLARING THE LIVE CLUSTER PLANS AS `noop`. VERIFIED 2026-09-13:
- *   `/etc/network/interfaces.new` is absent on n2, n3 and n4, so `changes` is absent from all three
+ *   `/etc/network/interfaces.new` is absent on node-b, node-c and node-d, so `changes` is absent from all three
  *   answers, so `pending` is 0 on all three and every one of them plans `noop`.
  */
 const diff = (news: Input<NetworkApplyProps>) =>