@homeflare/alchemy 0.11.0 → 0.12.0

package/src/openbao/forgejo-bootstrap.ts

@@ -3,7 +3,7 @@
  * straight to the Forgejo engine's role and nowhere else.
  *
  * ★ TIM'S CALL, 2026-09-14: "Random password, piped", and membership of the HomeFlare Owners team
- *   (house/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
+ *   (<estate>/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
  *   that creates users — the bot type is database-only (codeberg issue 8136) — so this is an
  *   ordinary user made by `forgejo admin user create`.
  *
@@ -34,12 +34,12 @@ import {
 } from './forgejo-bootstrap-parse.ts';
 
 export const PROVISION_USER = 'forgejo-provision';
-/** `NO_REPLY_ADDRESS` in hosts/macmini/forgejo/app.ini:117 — a service account's mail goes nowhere. */
+/** `NO_REPLY_ADDRESS` in the host's Forgejo `app.ini` — a service account's mail goes nowhere. */
 const PROVISION_EMAIL = `${PROVISION_USER}@noreply.lab.example.com`;
 export const ROLE_PATH = 'forgejo/roles/provision';
 
 /**
- * ★ THE SCOPES ARE WHAT house/forgejo WRITES TODAY. Org labels, teams and org secrets need
+ * ★ THE SCOPES ARE WHAT <estate>/forgejo WRITES TODAY. Org labels, teams and org secrets need
  *   `write:organization`; repositories, webhooks and branch protection need `write:repository`.
  *   Membership decides what the tokens can reach, and the scopes cap it.
  * ⚠️ FORGEJO TOKENS NEVER EXPIRE ON THE SERVER. The TTL is OpenBao's lease, and revoking the lease is
@@ -92,7 +92,7 @@ export const bootstrapProvisionAccount = Effect.gen(function* () {
   const binary = runningForgejoBinary(ps.stdout);
   if (binary === undefined) {
     return yield* refuse(
-      'no running `forgejo web` found. Run this on the mini, where Forgejo runs.',
+      'no running `forgejo web` found. Run this on the host where Forgejo runs.',
     );
   }
   const cli = (subcommand: string, ...args: string[]) =>

package/src/openbao/kubernetes-role-form.test.ts

@@ -14,16 +14,16 @@ import {
 
 const POD: BaoKubernetesRoleProps = {
   aliasNameSource: 'serviceaccount_name',
-  boundServiceAccountNames: ['litellm'],
+  boundServiceAccountNames: ['llm-gateway'],
   boundServiceAccountNamespaces: ['ai'],
-  name: 'ai-litellm',
-  tokenPolicies: ['ai-litellm'],
+  name: 'ai-gateway',
+  tokenPolicies: ['ai-gateway'],
   tokenTtl: '1h',
 };
 
 const LIVE: Record<string, unknown> = {
   alias_name_source: 'serviceaccount_name',
-  bound_service_account_names: ['litellm'],
+  bound_service_account_names: ['llm-gateway'],
   bound_service_account_namespace_selector: '',
   bound_service_account_namespaces: ['ai'],
   token_bound_cidrs: [],
@@ -32,7 +32,7 @@ const LIVE: Record<string, unknown> = {
   token_no_default_policy: false,
   token_num_uses: 0,
   token_period: 0,
-  token_policies: ['ai-litellm'],
+  token_policies: ['ai-gateway'],
   token_ttl: 3600,
   token_type: 'default',
 };

package/src/openbao/mount.ts

@@ -6,7 +6,7 @@
  *   in OpenBao, not Alchemy state.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  *
  * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
  *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new

package/src/openbao/pki-role.ts

@@ -36,7 +36,7 @@
  *   never a policy one — but neither is a measurement.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/openbao/policy-wire.test.ts

@@ -28,11 +28,11 @@ describe('policy wire', () => {
   it('round-trips through the stripped newline with equal digests', async () => {
     await withFake(aclPolicies(), async (bao) => {
       const env = { BAO_ADDR: bao.address };
-      await run(env, writePolicy('homeflare-llm', ASSEMBLED));
+      await run(env, writePolicy('app-llm', ASSEMBLED));
       assert.equal(bao.seen[0]?.method, 'PUT');
-      assert.equal(bao.seen[0]?.path, `${PREFIX}homeflare-llm`);
+      assert.equal(bao.seen[0]?.path, `${PREFIX}app-llm`);
       assert.deepEqual(JSON.parse(bao.seen[0]?.body ?? ''), { policy: ASSEMBLED });
-      const live = await run(env, readPolicy('homeflare-llm'));
+      const live = await run(env, readPolicy('app-llm'));
       assert.notEqual(live, ASSEMBLED, 'the fake strips the newline, as OpenBao does');
       assert.equal(sha256(live), sha256(ASSEMBLED));
     });

package/src/openbao/policy.ts

@@ -26,8 +26,8 @@ import { guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
  * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
  *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
  *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
- *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
- *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   estate's state store is the `alchemy` Postgres database, which a nightly job dumps
+ *   (it enumerates EVERY non-template database), copies to a backup guest, and PBS backs up
  *   from there. A KV value here would exist in four places, none of them OpenBao.
  *
  *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a

package/src/openbao/proxmox-role-form.ts

@@ -4,11 +4,11 @@
  * MEASURED 2026-09-13, read-only, against the live server (BAO_ADDR=http://127.0.0.1:8200,
  * BAO_NAMESPACE=homeflare). No write of any kind was issued to a role or a mount:
  *
- *   bao read -format=json proxmox-tb4/roles/read
+ *   bao read -format=json proxmox-c1/roles/read
  *     → { max_ttl: 21600, mint_user: "hf-read@pve",      name: "read",      ttl: 3600 }
- *   bao read -format=json proxmox-tb4/roles/provision
+ *   bao read -format=json proxmox-c1/roles/provision
  *     → { max_ttl: 1800,  mint_user: "hf-provision@pve", name: "provision", ttl: 300 }
- *   GET /v1/proxmox-tb4/?help=1 → components.schemas.WriteRolesNameRequest:
+ *   GET /v1/proxmox-c1/?help=1 → components.schemas.WriteRolesNameRequest:
  *     mint_user  string  — the ONLY required field, described as "The `user@realm` whose
  *                          standing ACL is the minted token's entire privilege set. Created
  *                          out-of-band; this engine never grants ACLs."
@@ -24,7 +24,7 @@ import { sha256 } from './digest.ts';
 import { mountPath, parseDuration, ttlSeconds } from './mount-form.ts';
 
 export interface BaoProxmoxRoleProps {
-  /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+  /** Mount path of the proxmox secrets engine, e.g. `proxmox-c1`. A trailing slash is fine. */
   mount: string;
   /**
    * Role name, as `<mount>/roles/<name>` takes it.
@@ -105,7 +105,7 @@ const ttlText = (seconds: number | undefined, fallback = '0') => {
   return `${String(seconds)}s`;
 };
 
-/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+/** `proxmox-c1/roles/read` — read, write and delete all address the role here. */
 export const rolePath = (mount: string, name: string) => `${mountPath(mount)}/roles/${name}`;
 
 export const attributesOf = (

package/src/openbao/proxmox-role.ts

@@ -3,20 +3,20 @@
  * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
  *
  * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
- *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
- *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
- *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
- *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On C1, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!inventory-sync, agent@pve!executor,
+ *   metrics@pve!exporter, app@pve!app, iac@pve!ro, iac@pve!apply and
+ *   mint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
  *   being a 5-minute lease instead of a forever key.
  *
- *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   The seventh cannot be. mint@pve!engine is the credential the ENGINE ITSELF
  *   authenticates with in order to mint anything at all: the thing that issues short-lived
  *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
  *   permanent, which makes it the single most valuable token on the cluster and the one whose
  *   rotation must be a deliberate, hand-run procedure rather than a plan.
  *
- *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
- *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   MEASURED here: `bao read proxmox-c1/config` returns parent_token_id
+ *   `mint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
  *   own key, present and, by the schema's own "Write-only: never returned by a read", not
  *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
  *   the PVE API in this session.
@@ -27,13 +27,13 @@
  *
  * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
  *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
- *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
- *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   values rather than encrypting them) into the `alchemy` Postgres, which a nightly job dumps
+ *   to a backup guest, from where PBS backs it up. A minted token declared as a resource would
  *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
  *   the DOOR; walking through it is a runtime call, not a plan.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
- *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -80,7 +80,7 @@ export const BaoProxmoxRoleProvider = () =>
       BaoProxmoxRole.Provider.of({
         /**
          * ⛔ `bao list <mount>/roles` IS NOT A LIST OF THINGS THIS OWNS. MEASURED today:
-         *   proxmox-tb4/roles answers `provision, read` and proxmox-ops/roles answers `read` —
+         *   proxmox-c1/roles answers `provision, read` and proxmox-c2/roles answers `read` —
          *   four roles created by hand at bringup, none of them declared anywhere yet.
          *   Returning them would invite Alchemy to adopt, and then delete, roles it never
          *   created, and deleting a role is how every consumer of it stops being able to mint.

package/src/openbao/ssh-role.ts

@@ -4,8 +4,8 @@
  * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
  *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
  *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
- *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
- *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and a nightly job
+ *   dumps it to a backup guest. A CA key there would outlive the vault that guards it. This
  *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
  *
  * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
@@ -29,7 +29,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
  *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/proxmox/acl.ts

@@ -41,14 +41,14 @@ export type AclSubjectType = 'user' | 'group' | 'token';
 
 export interface AclProps extends WithTarget {
   /**
-   * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
    * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
    *   word, so this file does too rather than renaming a field the cluster calls `path`.
    */
   path: string;
   /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
   type: AclSubjectType;
-  /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
   ugid: string;
   /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
   roleid: string;
@@ -85,9 +85,9 @@ export const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');
 /**
  * ⚠️ PVE NORMALISES ACL PATHS AND RETURNS THE NORMALISED FORM, a forever-update trap when only one
  *   side of the comparison is normalised. `PVE::AccessControl::normalize_path` collapses repeated
- *   slashes and strips the trailing one, so a declared `/pool/house/` reads back as `/pool/house`
+ *   slashes and strips the trailing one, so a declared `/pool/lab/` reads back as `/pool/lab`
  *   and a naive match never fires again. It also refuses a path with no leading slash, so one is
- *   added here rather than letting `pool/house` 400.
+ *   added here rather than letting `pool/lab` 400.
  */
 const normalize = (raw: string) => `/${raw.split('/').filter(Boolean).join('/')}`;
 

package/src/proxmox/adopt-noop.test.ts

@@ -32,8 +32,8 @@ type Case = {
 
 const cases: readonly Case[] = [
   {
-    declare: () => ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET }),
-    live: { 'pools/house': { comment: 'x', members: [] } },
+    declare: () => ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET }),
+    live: { 'pools/lab': { comment: 'x', members: [] } },
     name: 'Proxmox.Pool (pveHandlers: every factory family)',
     provider: ProxmoxPoolProvider as never,
   },
@@ -98,15 +98,15 @@ describe('adopting a matching object only reads', () => {
   });
 
   test('and the harness does see a write: a drifted Pool is PUT once', async () => {
-    const fake = clusterWith({ 'pools/house': { comment: 'old', members: [] } });
+    const fake = clusterWith({ 'pools/lab': { comment: 'old', members: [] } });
     await withoutBao(async () => {
       const engine = engineOver(ProxmoxPoolProvider().pipe(Layer.provideMerge(fake.layer)));
       const declared = () =>
-        ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET });
+        ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET });
       const report = await engine.verify(declared());
       expect(report.rows[0]).toMatchObject({ changed: ['comment'], diff: 'update', ok: false });
-      expect(await engine.deploy(declared())).toEqual({ house: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ lab: 'adopted' });
     });
-    expect(fake.writes()).toEqual(['PUT pools/house']);
+    expect(fake.writes()).toEqual(['PUT pools/lab']);
   });
 });

package/src/proxmox/api-token-form.ts

@@ -12,7 +12,7 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *
  * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE
  *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and
- *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place
+ *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
  */
@@ -26,7 +26,7 @@ import { bool, int, text } from './values.ts';
  *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted
  *   anything at all without somebody retyping the join by hand.
  *
- * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers
+ * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers
  *   `{"expire":0,"privsep":0}` and echoes back neither half of its own identity. So this is built
  *   from props, cannot disagree with the path the read used, and is therefore true by
  *   construction — which is why it is reported and never compared.
@@ -106,8 +106,8 @@ export const apiTokenSpec: PveSpec<ApiTokenProps, ApiTokenAttributes> = {
   /**
    * ⚠️ EXACTLY THE THREE FIELDS A PUT CAN PUT BACK, WHICH IS ALSO EXACTLY WHAT THE GET REPORTS.
    *   MEASURED, by replaying these two functions over the live GET bodies of all four token
-   *   shapes this cluster has: `monitoring@pve!exporter` (no comment), `tofu@pve!apply` and
-   *   `sablier@pve!sablier` (commented), and a live OpenBao lease under `hf-read@pve` (a real
+   *   shapes this cluster has: `metrics@pve!exporter` (no comment), `iac@pve!apply` and
+   *   `app@pve!app` (commented), and a live OpenBao lease under `hf-read@pve` (a real
    *   non-zero `expire`, offered as both `1789327175` and `"1789327175"` since `int` must not care
    *   which). All four answer noop; flipping `privsep` answers update; an empty body answers
    *   absent. ⚠️ THAT IS THE COMPARISON, NOT THE ENGINE — no `alchemy plan` was run against this

package/src/proxmox/api-token.ts

@@ -2,11 +2,11 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns
+ *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
  *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
  *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
  *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/monitoring@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
+ *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
  *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
@@ -19,7 +19,7 @@
  *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
- *     `proxmox-tb4` mount, or a human at `pveum user token add`.
+ *     `proxmox-c1` mount, or a human at `pveum user token add`.
  *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing
  *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement
  *     is a create that works and a header that says what it produces.
@@ -31,8 +31,8 @@
  *   that owns the lease, or to a human who is watching.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
+ *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
  *   to the lease deadline, and an id the plugin CHOOSES,
  *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
  *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
@@ -62,7 +62,7 @@ import { type PveRequirements, type WithTarget, pveHandlers, pveOperations } fro
 
 export interface ApiTokenProps extends WithTarget {
   /**
-   * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.
+   * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
    *
    * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a
    *   token named under a missing user fails the READ (folded to "absent") and then fails the
@@ -120,7 +120,7 @@ export interface ApiTokenProps extends WithTarget {
    *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
    *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
    *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-   *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops
+   *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
    *   working. Required, so adopting a token is a sentence that states what it is.
    * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
    *   provisioning account that is the account's full authority with a separate secret.
@@ -156,9 +156,9 @@ export interface ProxmoxApiToken extends Resource<
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
  *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
  *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,
- *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the
+ *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
+ *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
+ *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
  *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
  *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
  *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
@@ -184,7 +184,7 @@ const ops = pveOperations(apiTokenSpec);
  *   `reconcile` refuses by name and says what to do instead.
  *
  * ★ EVERYTHING ELSE STILL WORKS, AND IT IS THE HALF WORTH HAVING. Adopting an existing token and
- *   converging its `comment`, `expire` and `privsep` are real operations: TB4 carries SEVEN tokens
+ *   converging its `comment`, `expire` and `privsep` are real operations: C1 carries SEVEN tokens
  *   with `expire=0` and `privsep=0` made by clicks nobody recorded. Declaring those freezes the
  *   set, and an eighth appearing shows up as drift.
  *
@@ -203,7 +203,7 @@ const handlers = {
             'the secret only in the create response and it cannot be stored, so a token made here ' +
             'would be a live credential nobody holds. Create it with `pveum user token add` and ' +
             'capture the value, or mint a short-lived one from the OpenBao proxmox mount ' +
-            '(`bao read proxmox-tb4/creds/<role>`) -- then declare it here to manage it.',
+            '(`bao read proxmox-c1/creds/<role>`) -- then declare it here to manage it.',
         ),
       );
     }
@@ -213,7 +213,7 @@ const handlers = {
 
 /**
  * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every
+ *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
  *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
  *   The mount's leases in particular appear and vanish on their own; anything that adopted one
  *   would report drift against a credential that was never its to hold.

package/src/proxmox/ceph-daemon-form.ts

@@ -9,7 +9,7 @@
  *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.
  *
  * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED
- *   on n2, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/n2/ceph/mon/n2` answers
+ *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers
  *   "No 'get' handler defined" — while POST and DELETE are registered ONLY there. So the read uses
  *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent
  *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.
@@ -41,8 +41,8 @@ export const daemonId = (props: CephDaemonProps) => props.name ?? props.node;
 
 /**
  * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2 against [n3,n2,n4] from n3. A caller that took
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took
  *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.
  */
 export const collectionPath = (props: CephDaemonProps) => `nodes/${props.node}/ceph/${props.kind}`;

package/src/proxmox/ceph-daemon.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.
  *
  * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed
- *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13: mon, mgr and mds each
+ *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each
  *   expose GET on the collection and POST + DELETE on the id below it, each returns
  *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter
  *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,
@@ -10,11 +10,11 @@
  *   times over and let them drift — the argument resource.ts already makes for the factory itself.
  *
  * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2, [n3,n2,n4] from n3 — so a row is found by
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by
  *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.
- *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/n2/ceph/mon/n2` answers
- *   "No 'get' handler defined for '/nodes/n2/ceph/mon/n2'", and mgr and mds answer the same.
+ *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers
+ *   "No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'", and mgr and mds answer the same.
  *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one
  *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,
  *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still
@@ -27,11 +27,11 @@
  *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing
  *   two in one deploy — or removing the mon on the node whose API is serving the call — loses
  *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring
- *   it, so on this cluster every guest on `cephtb4` hangs.
+ *   it, so on this cluster every guest on `rbd-c1` hangs.
  *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,
- *   and with no standby left `cephfs-tb4` goes unavailable. `mgr`: no guest I/O depends on it, but
+ *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but
  *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.
- *   Live on 2026-09-13: mon, mgr AND mds on each of n2, n3, n4.
+ *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.
  *
  * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately
  *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that
@@ -41,7 +41,7 @@
  *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:
  *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike
  *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on
- *   `/`, and MEASURED on this cluster `LXCProvisioner` already holds it, so the provision lane
+ *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
@@ -86,9 +86,9 @@ export interface CephDaemonProps extends WithTarget {
   name?: string;
   /**
    * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this
-   * cluster that is 10.20.11.0/24, carried by `vmbr1.11`.
+   * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.
    * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as
-   *   `10.20.11.12:6789/0` — an address, a port and a nonce. The two are not the same string and
+   *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and
    *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this
    *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the
    *   header. Left out of `matches` on purpose.
@@ -98,7 +98,7 @@ export interface CephDaemonProps extends WithTarget {
    * mds only. Makes this standby replay the active MDS's journal for a faster failover.
    * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.
    *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED
-   *   2026-09-13, all three mds report `standby_replay: false`, n3 included — and n3 is the ACTIVE
+   *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE
    *   mds, which is not a standby at all and so can never report true however it was created.
    *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have
    *   elected, i.e. against a value no declaration controls.
@@ -128,22 +128,22 @@ export interface CephDaemonAttributes {
   host: string;
   /**
    * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…
-   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr n2 is
-   *   `active` while n3 and n4 are `standby`; mds n3 is `up:active` while n2 and n4 are
+   * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is
+   *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are
    *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is
    *   live and kept out of `matches` so that an election is never a diff.
    * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but
    *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.
    */
   state: string;
-  /** Ceph-formatted, e.g. `10.20.11.12:6789/0`. Reported; see `mon-address` for why never compared. */
+  /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */
   addr: string;
   /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */
   version: string;
   /**
    * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.
-   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked n4=0, n3=1, n2=2 —
-   *   monmap order, not declaration order — and the mds ranks are 0 for the active n3 and -1 for
+   * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —
+   *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for
    *   the two standbys. Rank moves when a daemon is added, removed or restarted.
    */
   rank: number;
@@ -152,8 +152,8 @@ export interface CephDaemonAttributes {
   /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */
   standbyReplay: boolean;
   /**
-   * mds only: the CephFS this daemon currently serves — `cephfs-tb4` here.
-   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: n3 carries `fs_name`, n2 and n4 have no such key
+   * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.
+   * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key
    *   at all. So it is empty for two of three identical declarations, and comparing it would
    *   report work on exactly the daemons that are healthy standbys.
    */
@@ -234,7 +234,7 @@ export const ProxmoxCephDaemonProvider = () =>
          *   problem. Everything else here is the factory's.
          * ⚠️ AND IT IS THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a
          *   plan that removes a mon run: two gone at once is a cluster with no quorum and every
-         *   guest on `cephtb4` blocked on I/O.
+         *   guest on `rbd-c1` blocked on I/O.
          */
         delete: ({ olds }: { olds: CephDaemonProps }) =>
           pve(olds.target, 'provision', 'DELETE', daemonPath(olds)),

package/src/proxmox/ceph-flag.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.
  *
  * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.
- *   MEASURED on TB4 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
+ *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
  *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in
  *   `/usr/share/pve-docs/api-viewer/apidoc.js`:
  *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING
@@ -30,7 +30,7 @@
  *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean "clear
  *     it" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be
  *     typed out by a person. Do not add a default, and do not declare a flag merely to document
- *     that it is off: MEASURED 2026-09-13, all eleven flags on TB4 read 0, so eleven
+ *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven
  *     `value: false` lines would plan green forever and do nothing except take the brake off
  *     whenever somebody happens to apply them.
  *
@@ -58,8 +58,8 @@
  *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove
  *   one is gone; `ceph osd dump | head -1` can.
  *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`
- *     stops all reads and writes, so every guest on `cephtb4` — the cluster's only rbd pool,
- *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-tb4`. `noup: true`
+ *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,
+ *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`
  *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.
  *
  * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs
@@ -83,7 +83,7 @@ import { bool, flag } from './values.ts';
  *
  * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both
  *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.
- * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on TB4:
+ * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:
  *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.
  *   PVE reads that same string and answers only about its own eleven, so the others can neither
  *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.
@@ -167,7 +167,7 @@ const handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({
    *
    * ⛔ IT NEVER ANSWERS undefined, WHICH MAKES THE CREATE BRANCH UNREACHABLE, AND ITS ERROR WILL
    *   MISLEAD YOU. All eleven flags always exist; there is nothing for "absent" to mean. So a POST
-   *   to `collection` means the READ failed — an expired 300s lease, n2 down, or ceph simply not
+   *   to `collection` means the READ failed — an expired 300s lease, node-b down, or ceph simply not
    *   configured on the cluster (every one of these four handlers opens with
    *   `check_ceph_configured()`, which dies). Read the resulting "Method 'POST /cluster/ceph/flags'
    *   not implemented" as "the read failed" and go and look at the credential, not at ceph. Same
@@ -187,7 +187,7 @@ const handlers = pveHandlers<CephFlagProps, CephFlagAttributes>({
    *   and `name` exist only on the bulk GET, which this file does not read, so neither can be
    *   compared by accident. Nothing PVE returns here is rewritten, re-ordered or re-typed by the
    *   cluster, because all PVE returns here is one boolean.
-   *   ★ MEASURED: on TB4, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a
+   *   ★ MEASURED: on C1, `GET /cluster/ceph/flags` answers value 0 for all eleven flags, so a
    *     declaration of `value: false` reads back false and plans `noop`.
    */
   matches: (attributes, props) => attributes.value === props.value,