@homeflare/alchemy 0.11.0 → 0.12.0

package/src/proxmox/firewall-alias-form.ts

@@ -36,7 +36,7 @@ export const fold = (name: string) => name.trim().toLowerCase();
 /**
  * A CIDR reduced to the one form PVE will hand back.
  *
- * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on n2 (pve-manager 9.2.11,
+ * ⛔ MEASURED by running the cluster's own `PVE::Firewall::parse_alias` on node-b (pve-manager 9.2.11,
  *   2026-09-13) — a pure function over a string, no config read and none written:
  *     `10.1.1.5/32`     -> `10.1.1.5`        a /32 host suffix is STRIPPED
  *     `2001:0DB8::1/128`-> `2001:0DB8::1`    a /128 is stripped, and the case is NOT folded

package/src/proxmox/firewall-alias.ts

@@ -61,7 +61,7 @@
  * ⚠️ PRIVILEGES, AND FOR ONCE NOTHING NEEDS WIDENING. MEASURED 2026-09-13 from the cluster's own
  *   schema and its live ACL: the item GET checks `["perm","/",["Sys.Audit"]]`, POST/PUT/DELETE
  *   check `["perm","/",["Sys.Modify"]]`, `hf-read@pve` holds `PVEAuditor` at `/` with propagate and
- *   `hf-provision@pve` holds `LXCProvisioner` at `/` with propagate. Both privileges are already
+ *   `hf-provision@pve` holds the provision role (provision-baseline.ts) at `/` with propagate. Both privileges are already
  *   held, so `readRole` stays the default `read` lane — unlike storage/sdn-zone/sdn-vnet, whose
  *   ITEM reads are gated on an allocate privilege the auditor cannot have.
  *   ⚠️ `Sys.Modify` ON `/` IS STILL A BIG HAMMER — it is the same grant `metric-server.ts` warns

package/src/proxmox/generated/pbs.ts

@@ -2,7 +2,7 @@
  * Generated PBS API types — DO NOT EDIT BY HAND.
  *
  * Run: bun codegen/generate.ts
- * Source: house/proxmox/apidoc/ — see README there for provenance.
+ * Source: the cluster's own `apidoc.js` (pve-docs), extracted outside this repo.
  */
 
 /** GET /config/datastore — `data` payload after client unwrap. */

package/src/proxmox/generated/pve.ts

@@ -2,7 +2,7 @@
  * Generated PVE API types — DO NOT EDIT BY HAND.
  *
  * Run: bun codegen/generate.ts
- * Source: house/proxmox/apidoc/ — see README there for provenance.
+ * Source: the cluster's own `apidoc.js` (pve-docs), extracted outside this repo.
  */
 
 /** GET /cluster/replication — `data` payload after client unwrap. */

package/src/proxmox/group.ts

@@ -1,7 +1,7 @@
 /**
  * `Proxmox.Group` — a PVE group: a name, a comment, and the set of users PVE hangs off it.
  *
- * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `vaultmint@pve` holds the `HFMint` role
+ * ★ DECLARING `hf-mint` IS THE WHOLE POINT OF THIS FAMILY. `mint@pve` holds the `MintTokens` role
  *   ON THE PATH `/access/groups/hf-mint` — measured from `GET /access/acl`, 2026-09-13 — which is
  *   what confines the OpenBao proxmox engine to minting inside that one group. The group is the
  *   fence around the credential every other resource in this package runs on, and until now it was
@@ -17,7 +17,7 @@
  *   in this file could ever settle.
  *
  * ⛔ THE INDEX AND THE ITEM DISAGREE ABOUT BOTH THE NAME AND THE TYPE, and this file reads only the
- *   item. MEASURED against n2, 2026-09-13:
+ *   item. MEASURED against node-b, 2026-09-13:
  *     GET /access/groups         -> [{"groupid":"hf-mint","comment":"…",
  *                                     "users":"hf-provision@pve,hf-read@pve"}, …]
  *     GET /access/groups/hf-mint -> {"comment":"…","members":["hf-provision@pve","hf-read@pve"]}
@@ -27,8 +27,8 @@
  *
  * ⛔ AND THE ITEM'S ORDER IS NOT STABLE BETWEEN TWO CONSECUTIVE CALLS. MEASURED, seconds apart, on
  *   the same endpoint:
- *     ["root@pam","tim@pve","tim@pam","tim@<account>.com@Schenanigans"]
- *     ["tim@pam","tim@pve","tim@<account>.com@Schenanigans","root@pam"]
+ *     ["root@pam","alice@pve","alice@pam","alice@example.com@corp"]
+ *     ["alice@pam","alice@pve","alice@example.com@corp","root@pam"]
  *   `read_group` builds it as `[keys %{ $data->{users} }]` — a bare Perl hash key list, whose order
  *   is randomised per process — while the INDEX sorts (`join(',', sort keys …)`). So the array is
  *   sorted on the way into `attributes` as well as being kept out of `matches`: unsorted, Alchemy's
@@ -45,7 +45,7 @@
  *       So `readRole` is left at the default `read` — unlike storage/sdn-zone/sdn-vnet, whose ITEM
  *       reads PVE gates on an allocate privilege. See the ⛔ on `readRole` in `resource.ts`.
  *     · POST, PUT and DELETE each check `Group.Allocate` on `/access/groups`, and
- *       `hf-provision@pve` holds it via `LXCProvisioner`.
+ *       `hf-provision@pve` holds it via the provision role (`PROVISION_PRIVILEGES`).
  *
  * ⛔ `retain` BY DEFAULT, BECAUSE DELETING A GROUP DESTROYS TWO THINGS THIS FILE CANNOT PUT BACK.
  *   Measured in `PVE::AccessControl` on the node:
@@ -53,8 +53,8 @@
  *       <comment>:`) and DERIVES each user's `groups` map from it at parse time. Deleting the group
  *       deletes the list, and this resource has no `members` prop to restore it from.
  *     · `delete_group_acl` then walks the whole ACL tree and drops every grant where the group is
- *       the SUBJECT. On this cluster that is `Schenanigans -> Administrator on /` and
- *       `HomeAssistant -> PVEAuditor on /`: whole populations of access, gone in one call, with no
+ *       the SUBJECT. On this cluster that is `admins -> Administrator on /` and
+ *       `automation -> PVEAuditor on /`: whole populations of access, gone in one call, with no
  *       confirmation and nothing in the plan to suggest it.
  *   `delete` is FULLY IMPLEMENTED — `DELETE /access/groups/{groupid}` exists, unlike the ACL
  *   family's — so `.pipe(RemovalPolicy.destroy())` really removes the group. See the ★ in
@@ -120,7 +120,7 @@ export const ProxmoxGroup = Resource<ProxmoxGroup>('Proxmox.Group', {
  *   back as absent. Left alone, `matches` would be false on every plan and every deploy would
  *   rewrite the same value into the same hole. Normalising BOTH the comparison and the form is how
  *   `values.ts` already treats `''` as the absence of a boolean rather than as `false`.
- *   ⚠️ MEASURED IN THE SOURCE ON n2, NOT ON THE WIRE — writing `'0'` to the cluster to watch it
+ *   ⚠️ MEASURED IN THE SOURCE ON node-b, NOT ON THE WIRE — writing `'0'` to the cluster to watch it
  *     vanish would have been a write, and this agent had read access only.
  *   ⚠️ `pool.ts` HAS THE SAME LATENT HOLE — `pool:$pool:$comment:…` is written by that same
  *     truthiness test and is not guarded. Not fixed from here; flagged so it is fixed on purpose.
@@ -160,7 +160,7 @@ const handlers = pveHandlers<GroupProps, GroupAttributes>({
      *   without one answers `{"members":[…]}` and nothing else. THAT ONE IS READ OFF THE HANDLER'S
      *   SOURCE, not off the wire — every group on this cluster happens to carry a comment, so the
      *   commentless shape was not there to measure. The empty-MEMBERS shape WAS measured —
-     *   `HomeAssistant` answers `{"comment":"…","members":[]}`. `''` is what an undeclared
+     *   `automation` answers `{"comment":"…","members":[]}`. `''` is what an undeclared
      *   `comment` prop normalises to, so the two sides meet either way.
      */
     comment: text(live['comment']),
@@ -190,7 +190,7 @@ const handlers = pveHandlers<GroupProps, GroupAttributes>({
 
 /**
  * ⛔ THE EMPTY `list` IS INHERITED FROM `pveHandlers` AND IT MATTERS HERE. `GET /access/groups`
- *   answers with every group on the cluster — on this one that is `Schenanigans`, which grants
+ *   answers with every group on the cluster — on this one that is `admins`, which grants
  *   `Administrator` on `/` to every human who logs in. Handing it to Alchemy would invite adoption,
  *   and therefore one day a delete that takes the whole admin group's access with it. Adoption
  *   stays an explicit act, here as everywhere else in this package.

package/src/proxmox/ha-resource.ts

@@ -35,10 +35,11 @@
  *   (node-affinity and resource-affinity) and that is the next family to add; do not port the old
  *   groups endpoint back just because the docs still describe it.
  *
- * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH `LXCProvisioner` DOES NOT HOLD. Read and diff are
+ * ⚠️ RECONCILE NEEDS `Sys.Console` ON `/`, WHICH THE PROVISION ROLE LACKED WHEN THIS WAS WRITTEN
+ *   (`PROVISION_PRIVILEGES` carries it now — ha-rule.ts has the measurement). Read and diff are
  *   fine — `GET /cluster/ha/resources/{sid}` checks `Sys.Audit`, which the role already has — while
  *   POST, PUT and DELETE all check `Sys.Console` on `/` and will answer "Permission check failed
- *   (/, Sys.Console)" until the role is widened. Widen it knowingly: `Sys.Console` is also what
+ *   (/, Sys.Console)" on a role without it. Widen it knowingly: `Sys.Console` is also what
  *   opens a root shell on every node (`/nodes/{node}/vncshell`, `termproxy`), so granting it to the
  *   provision credential buys HA membership at the price of node console access. A separate role
  *   for HA writes is the narrower answer if that trade is not wanted.

package/src/proxmox/ha-rule-form.ts

@@ -16,21 +16,21 @@ import { csv } from './values.ts';
  * A `<node>[:<pri>]` list, spelled the way PVE gives it back.
  *
  * ⛔ THIS IS NOT `csv`, AND THE DIFFERENCE IS A FOREVER-DIFF. MEASURED by reading
- *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on n2 (2026-09-13): `decode_plugin_value`
+ *   `/usr/share/perl5/PVE/HA/Rules/NodeAffinity.pm` on node-b (2026-09-13): `decode_plugin_value`
  *   turns the list into a HASH keyed by node name, and `encode_plugin_value` rebuilds it with
  *   `for my $node (sort keys %$value)` — sorted by NODE NAME, never by the token — emitting the
  *   bare name whenever the priority is falsy, because `PVE::HA::Tools::parse_node_priority` reads
- *   a missing priority as 0. So a declared `n3:1,n2:0` is handed back as `n2,n3:1`: re-ordered AND
+ *   a missing priority as 0. So a declared `node-c:1,node-b:0` is handed back as `node-b,node-c:1`: re-ordered AND
  *   re-spelled. Compare the raw strings and every plan reports an update, forever.
  *
  * ⚠️ SORTED BY NAME, NOT BY TOKEN, AND THE TWO GENUINELY DIVERGE. `csv` sorts whole tokens. Node
  *   names may contain `-` — `parse_node_priority`'s own regex is
- *   `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `n2-a`
- *   and `n2:5` come out in one order by token and the other by name. PVE sorts by the name, so
+ *   `[a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?` — and `-` (0x2D) sorts before `:` (0x3A), so `node-b-a`
+ *   and `node-b:5` come out in one order by token and the other by name. PVE sorts by the name, so
  *   this does too.
  *
  * ⚠️ LAST ENTRY WINS FOR A REPEATED NODE, because PVE's decode is a hash assignment and a hash
- *   keeps one value per key. A declaration saying `n2:1,n2:5` is stored as `n2:5`; matching that
+ *   keeps one value per key. A declaration saying `node-b:1,node-b:5` is stored as `node-b:5`; matching that
  *   is what a Map gives for free.
  */
 export const nodeList = (value: readonly string[] | string | undefined) => {

package/src/proxmox/ha-rule.ts

@@ -1,7 +1,7 @@
 /**
  * `Proxmox.HaRule` — where the CRM may place a guest, and which guests must not share a node.
  *
- * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on n2
+ * ★ THIS IS THE PVE 9 SUCCESSOR TO HA GROUPS, AND THE GROUPS ENDPOINT IS GONE. MEASURED on node-b
  *   (pve-manager/9.2.11, 2026-09-13): `pvesh get /cluster/ha/groups` answers `cannot index groups:
  *   ha groups have been migrated to rules`, and `/etc/pve/ha/` holds `rules.cfg` with no
  *   `groups.cfg` beside it. The published schema still documents groups and still offers a `group`
@@ -48,8 +48,8 @@
  * ⚠️ BOTH LANES ALREADY HAVE THE PRIVILEGES, WHICH IS NEW. MEASURED 2026-09-13:
  *   GET (collection and item) checks `Sys.Audit` on `/` and the built-in `PVEAuditor` holds it, so
  *   `readRole` stays the default `read` lease — unlike storage.ts and the SDN families. POST, PUT
- *   and DELETE all check `Sys.Console` on `/`, and `pvesh get /access/roles/LXCProvisioner` now
- *   returns `Sys.Console` among its 27 privileges. The warning in ha-resource.ts's header — that
+ *   and DELETE all check `Sys.Console` on `/`, and the provision role now returns `Sys.Console` among
+ *   its 27 privileges (`PROVISION_PRIVILEGES`, provision-baseline.ts). The warning in ha-resource.ts's header — that
  *   `Sys.Console` is missing — is stale; the role was widened, and the price it named still stands:
  *   `Sys.Console` is also what opens a root shell on every node.
  *

package/src/proxmox/index.test.ts

@@ -40,6 +40,13 @@ test('control-plane Resource constructors are on the public barrel', () => {
   }
 });
 
+test('the provisioning baseline is on the barrel: the list, the declaration, the bootstrap', async () => {
+  const barrel = await import('./index.ts');
+  expect(barrel.PROVISION_PRIVILEGES).toHaveLength(27);
+  expect(typeof barrel.declareProvisionBaseline).toBe('function');
+  expect(barrel.provisionBootstrap()).toStartWith('#!/bin/sh\n');
+});
+
 test('QEMU and NIC apply stay Provider-only', () => {
   expect(src).not.toMatch(/export \{ ProxmoxVm[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxNodeNetwork[, }]/);

package/src/proxmox/index.ts

@@ -12,6 +12,9 @@
  *   The provider-only version diffed four fields and would have planned a create over any read
  *   failure. The Resource now adopts from the live config, refuses every change PVE cannot make
  *   in place, and retains on destroy (lxc.ts).
+ * ★ THE PROVISIONING BASELINE JOINED 2026-09-21: one privilege list (`PROVISION_PRIVILEGES`), the
+ *   helper that declares it (`declareProvisionBaseline`) and the pure generator of the one-time
+ *   root commands that bootstrap it (`provisionBootstrap`) — docs/provision-baseline.md.
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -40,6 +43,17 @@ export { PbsPruneJob, PbsPruneJobProvider } from './pbs-prune-job.ts';
 export { PbsSyncJob, PbsSyncJobProvider } from './pbs-sync-job.ts';
 export { PbsVerifyJob, PbsVerifyJobProvider } from './pbs-verify-job.ts';
 export { ProxmoxPool, ProxmoxPoolProvider } from './pool.ts';
+export {
+  PROVISION_DEFAULTS,
+  PROVISION_PRIVILEGES,
+  type ProvisionBaseline,
+  type ProvisionLane,
+  type ProvisionNames,
+  type ResolvedProvisionNames,
+  provisionBaseline,
+} from './provision-baseline.ts';
+export { provisionBootstrap } from './provision-bootstrap.ts';
+export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
 export { ProxmoxVmProvider } from './qemu.ts';
 export { ProxmoxReplicationJobProvider } from './replication-job.ts';
 export { ProxmoxRole, ProxmoxRoleProvider } from './role.ts';

package/src/proxmox/lease-cache.test.ts

@@ -17,13 +17,13 @@ import * as Exit from 'effect/Exit';
 import type { PveCredential } from './credentials.ts';
 import { type LeaseKey, makeLeases, timeToLive } from './lease-cache.ts';
 
-const TB4: LeaseKey = {
-  mount: 'proxmox-tb4',
+const C1: LeaseKey = {
+  mount: 'proxmox-c1',
   role: 'read',
   scheme: 'pve',
 };
-/** ⚠️ Same role as TB4, DIFFERENT mount — the collision the key has to survive. */
-const OPS: LeaseKey = { ...TB4, mount: 'proxmox-ops' };
+/** ⚠️ Same role as C1, DIFFERENT mount — the collision the key has to survive. */
+const C2: LeaseKey = { ...C1, mount: 'proxmox-c2' };
 
 const cred = (tokenId: string, leaseSeconds: number): PveCredential => ({
   leaseSeconds,
@@ -85,10 +85,10 @@ describe('lease cache under concurrency', () => {
     await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        const exits = yield* concurrently(20, Cache.get(leases, TB4));
+        const exits = yield* concurrently(20, Cache.get(leases, C1));
         assert.equal(exits.filter(Exit.isSuccess).length, 20);
         // An equal but separately built key is the same entry.
-        yield* Cache.get(leases, { ...TB4 });
+        yield* Cache.get(leases, { ...C1 });
       }),
     );
     assert.equal(mint.calls(), 1);
@@ -102,9 +102,9 @@ describe('lease cache under concurrency', () => {
     await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        const first = yield* concurrently(20, Cache.get(leases, TB4));
+        const first = yield* concurrently(20, Cache.get(leases, C1));
         assert.equal(first.filter(Exit.isFailure).length, 20, 'the waiters share the failure');
-        const second = yield* concurrently(20, Cache.get(leases, TB4));
+        const second = yield* concurrently(20, Cache.get(leases, C1));
         assert.equal(second.filter(Exit.isSuccess).length, 20);
       }),
     );
@@ -116,8 +116,8 @@ describe('lease cache under concurrency', () => {
     await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        yield* concurrently(20, Cache.get(leases, TB4));
-        yield* Cache.get(leases, TB4);
+        yield* concurrently(20, Cache.get(leases, C1));
+        yield* Cache.get(leases, C1);
       }),
     );
     assert.equal(mint.calls(), 2);
@@ -125,25 +125,25 @@ describe('lease cache under concurrency', () => {
 
   it('does not serve one cluster the credential of another with the same mount and role', async () => {
     const mint = countingMint((call) => cred(`hf-read@pve!${String(call)}`, 3600));
-    const [tb4, ops] = await Effect.runPromise(
+    const [c1, c2] = await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        return [yield* Cache.get(leases, TB4), yield* Cache.get(leases, OPS)] as const;
+        return [yield* Cache.get(leases, C1), yield* Cache.get(leases, C2)] as const;
       }),
     );
-    assert.notEqual(tb4.tokenId, ops.tokenId);
+    assert.notEqual(c1.tokenId, c2.tokenId);
     assert.equal(mint.calls(), 2);
   });
 
   it('shares one lease across two members of the same cluster mount', async () => {
     const mint = countingMint((call) => cred(`hf-read@pve!${String(call)}`, 3600));
-    const N2: LeaseKey = { mount: 'proxmox-tb4', role: 'read', scheme: 'pve' };
-    const N3: LeaseKey = { mount: 'proxmox-tb4', role: 'read', scheme: 'pve' };
+    const NODE_B: LeaseKey = { mount: 'proxmox-c1', role: 'read', scheme: 'pve' };
+    const NODE_C: LeaseKey = { mount: 'proxmox-c1', role: 'read', scheme: 'pve' };
     await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        yield* Cache.get(leases, N2);
-        yield* Cache.get(leases, N3);
+        yield* Cache.get(leases, NODE_B);
+        yield* Cache.get(leases, NODE_C);
       }),
     );
     assert.equal(mint.calls(), 1);
@@ -151,11 +151,11 @@ describe('lease cache under concurrency', () => {
 
   it('keeps read and provision apart', async () => {
     const mint = countingMint((call) => cred(`hf@pve!${String(call)}`, 3600));
-    const PROVISION: LeaseKey = { ...TB4, role: 'provision' };
+    const PROVISION: LeaseKey = { ...C1, role: 'provision' };
     const [read, provision] = await Effect.runPromise(
       Effect.gen(function* () {
         const leases = yield* makeLeases(mint.mintFor);
-        return [yield* Cache.get(leases, TB4), yield* Cache.get(leases, PROVISION)] as const;
+        return [yield* Cache.get(leases, C1), yield* Cache.get(leases, PROVISION)] as const;
       }),
     );
     assert.notEqual(read.tokenId, provision.tokenId);

package/src/proxmox/lease-cache.ts

@@ -1,8 +1,8 @@
 /**
  * One credential per (target, role) for the life of a run, instead of one per API call.
  *
- * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the TB4
- *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on n2
+ * 🔴 THE MEASUREMENT THAT MADE THIS NECESSARY. A single `alchemy plan` plus `deploy` of the C1
+ *   stack — 98 resources — left **760 API token entries in `/etc/pve/user.cfg`**, counted on node-b
  *   immediately afterwards. `mint()` asked OpenBao for a new credential on EVERY call, and each
  *   mint creates a real Proxmox token: read, diff, reconcile and read-back each got their own. They
  *   drain as the leases expire (760 down to 712 over five minutes), so nothing was broken — but
@@ -66,9 +66,9 @@ const REMINT_MARGIN_SECONDS = 60;
  * What a credential is cached under.
  *
  * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is
- *   cluster-wide — `user.cfg` is replicated — so n2, n3 and n4 share one credential. Keying on
+ *   cluster-wide — `user.cfg` is replicated — so node-b, node-c and node-d share one credential. Keying on
  *   `api` would mint three identical tokens when failover rotates members.
- * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-tb4`, `proxmox-ops` and `pbs-tb4` are
+ * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are
  *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.
  * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built
  *   literals with the same fields are one entry, which the probe above measured.

package/src/proxmox/lxc-adopt.test.ts

@@ -100,7 +100,7 @@ describe('drift after the adoption is named at plan and written once', () => {
   test('a larger rootfs is a resize after the config, never a new volume', async () => {
     const pve = live();
     const stack = await adoptedAsIs(pve);
-    const props: LxcProps = { ...pasted(), rootfs: 'local-zfs:subvol-100-disk-0,size=64G' };
+    const props: LxcProps = { ...pasted(), rootfs: 'local-zfs:subvol-900-disk-0,size=64G' };
     expect((await stack.deploy(ct(props))).failure).toBe('');
     expect(writesOf(pve)).toEqual([`PUT nodes/${NODE}/lxc/${String(VMID)}/resize`]);
     expect(pve.guests.get(`${NODE}/${String(VMID)}`)?.['rootfs']).toContain('size=64G');
@@ -109,10 +109,10 @@ describe('drift after the adoption is named at plan and written once', () => {
 
 describe('changes PVE cannot make in place fail the plan and write nothing', () => {
   test.each([
-    ['a smaller mount point', { mp0: 'tank:subvol-100-disk-0,mp=/data,size=100G' }, /shrink/],
+    ['a smaller mount point', { mp0: 'tank:subvol-900-disk-0,mp=/data,size=100G' }, /shrink/],
     ['a storage move', { rootfs: 'other:40' }, /pct move-volume/],
     ['an unprivileged flip', { unprivileged: 0 as const }, /read-only option/],
-    ['a device passthrough change', { dev1: '/dev/fuse' }, /pct set 100 --dev1/],
+    ['a device passthrough change', { dev1: '/dev/fuse' }, /pct set 900 --dev1/],
     ['a feature beyond nesting', { features: 'nesting=1,keyctl=1' }, /root@pam/],
     ['detaching a mount point', { mp0: '' }, /unusedN/],
   ])('%s', async (_, change, reason) => {

package/src/proxmox/lxc-create-form.ts

@@ -23,7 +23,7 @@ import { bool } from './values.ts';
 /**
  * ⛔ A CREATE ALLOCATES NEW VOLUMES ONLY. pve-container's `create_disks` allocates `storage:GiB`
  *   and takes anything else as "use specified/existing volid", then `restore_archive` unpacks the
- *   template into the mounted rootfs. So a create naming `local-zfs:subvol-100-disk-0` — a pasted
+ *   template into the mounted rootfs. So a create naming `local-zfs:subvol-900-disk-0` — a pasted
  *   adoption, re-created after its config vanished while the volume survived (a `pct destroy`
  *   only WARNS when a volume will not delete) — unpacks a template over the data on it.
  */

package/src/proxmox/lxc-guards.test.ts

@@ -63,8 +63,8 @@ describe('a guest the cluster no longer lists, with state still held', () => {
     expect((await stack.deploy(declared())).failure).toBe('');
     pve.guests.delete(KEY);
     const run = await stack.deploy(declared());
-    expect(run.failure).toContain('rootfs: local-zfs:subvol-100-disk-0,size=40G names an existing');
-    expect(run.failure).toContain('mp0: tank:subvol-100-disk-0');
+    expect(run.failure).toContain('rootfs: local-zfs:subvol-900-disk-0,size=40G names an existing');
+    expect(run.failure).toContain('mp0: tank:subvol-900-disk-0');
     expect(writesOf(pve)).toEqual([]);
   });
 
@@ -130,13 +130,13 @@ describe('identity and volumes', () => {
     const pve = cluster();
     seed(pve, NODE, VMID);
     const stack = await adoptedAsIs(pve);
-    const mp0 = 'tank:subvol-100-disk-0,mp=/data,backup=1,size=300G';
+    const mp0 = 'tank:subvol-900-disk-0,mp=/data,backup=1,size=300G';
     const run = await stack.deploy(ct(pasted({ mp0 })));
     expect(run.failure).toBe('');
     const path = `nodes/${NODE}/lxc/${String(VMID)}`;
     expect(writesOf(pve)).toEqual([`PUT ${path}/config`, `PUT ${path}/resize`]);
     const put = pve.seen.find((call) => call.path.endsWith('/config') && call.method === 'PUT');
-    expect(put?.form.get('mp0')).toBe('tank:subvol-100-disk-0,mp=/data,backup=1,size=200G');
+    expect(put?.form.get('mp0')).toBe('tank:subvol-900-disk-0,mp=/data,backup=1,size=200G');
     expect(pve.guests.get(KEY)?.['mp0']).toContain('size=300G');
   });
 

package/src/proxmox/lxc-harness.ts

@@ -54,7 +54,7 @@ export const LIVE: Readonly<Record<string, unknown>> = {
   hostname: 'ct-example',
   lxc: [['lxc.prlimit.memlock', 'unlimited']],
   memory: 8192,
-  mp0: 'tank:subvol-100-disk-0,mp=/data,backup=0,size=200G',
+  mp0: 'tank:subvol-900-disk-0,mp=/data,backup=0,size=200G',
   nameserver: '192.0.2.254',
   net0:
     'name=eth0,bridge=vmbr0,firewall=0,gw=192.0.2.1,hwaddr=00:00:5E:00:53:01,' +
@@ -62,7 +62,7 @@ export const LIVE: Readonly<Record<string, unknown>> = {
   net1: 'name=eth1,bridge=vmbr1,hwaddr=00:00:5E:00:53:02,ip=198.51.100.4/24,mtu=1500,type=veth',
   onboot: 1,
   ostype: 'debian',
-  rootfs: 'local-zfs:subvol-100-disk-0,size=40G',
+  rootfs: 'local-zfs:subvol-900-disk-0,size=40G',
   searchdomain: 'example.com',
   swap: 0,
   tags: 'web',
@@ -71,7 +71,7 @@ export const LIVE: Readonly<Record<string, unknown>> = {
 
 /** Where `seed` puts the production-shaped guest by default, and its `node/vmid` key. */
 export const NODE = 'pve1';
-export const VMID = 100;
+export const VMID = 900;
 export const KEY = `${NODE}/${String(VMID)}`;
 
 /** The live config as a declaration: every key, minus what pvesh adds that is not a prop. */

package/src/proxmox/lxc-judge.test.ts

@@ -13,7 +13,7 @@ import { judgeVolume, parseVolume, sizeBytes } from './lxc-volume.ts';
 const props = (over: Partial<LxcProps>): LxcProps => ({
   node: 'pve1',
   target: TARGET,
-  vmid: 100,
+  vmid: 900,
   ...over,
 });
 const live = (config: Record<string, unknown>) => ({ unprivileged: 1, ...config });
@@ -36,7 +36,7 @@ describe('sizes and volumes, as pve-container parses them', () => {
 
   test('an options change on a volume declared as new is written with the LIVE volume id', () => {
     const verdict = judgeVolume('mp0', 'tank:200,mp=/data,backup=1', LIVE_MP);
-    expect(verdict).toEqual({ put: 'tank:subvol-100-disk-0,mp=/data,backup=1,size=200G' });
+    expect(verdict).toEqual({ put: 'tank:subvol-900-disk-0,mp=/data,backup=1,size=200G' });
   });
 
   test('a fractional new-disk size grows by the same GiB', () => {
@@ -44,7 +44,7 @@ describe('sizes and volumes, as pve-container parses them', () => {
   });
 });
 
-const LIVE_MP = 'tank:subvol-100-disk-0,mp=/data,backup=0,size=200G';
+const LIVE_MP = 'tank:subvol-900-disk-0,mp=/data,backup=0,size=200G';
 
 describe('scalars compare the way PVE stores them', () => {
   test.each([
@@ -106,7 +106,7 @@ describe('features follow check_ct_modify_config_perm', () => {
 
   test('clearing features that hold more than nesting is root@pam only, as PVE counts keys', () => {
     const change = judge(props({ features: '' }), live({ features: 'nesting=1,keyctl=0' }));
-    expect(change.refuse[0]).toMatch(/pct set 100 --delete features/);
+    expect(change.refuse[0]).toMatch(/pct set 900 --delete features/);
   });
 });
 
@@ -147,7 +147,7 @@ describe('create', () => {
       ostemplate: 'local:vztmpl/t.tar.zst',
       start: '1',
       unprivileged: '1',
-      vmid: '100',
+      vmid: '900',
     });
   });
 

package/src/proxmox/lxc-lifecycle.ts

@@ -72,7 +72,7 @@ export const readLive = (where: LxcWhere) =>
       'GET',
       'cluster/resources?type=vm',
     );
-    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `"100"` would otherwise
+    // ⚠️ `Number()`, NOT `===` ON THE RAW VALUE: a vmid that came back as `"900"` would otherwise
     //   match nothing, and "listed nowhere" is the one answer that turns into a create.
     const found = (rows ?? []).find((row) => Number(row.vmid) === where.vmid);
     if (found !== undefined && found.node === where.node && found.type === 'lxc') {

package/src/proxmox/lxc-props.ts

@@ -58,7 +58,7 @@ export interface LxcProps extends WithTarget {
   /** MiB. */
   swap?: number;
   /**
-   * `local-zfs:subvol-100-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
+   * `local-zfs:subvol-900-disk-0,size=40G` as read, or `local-zfs:40` (40 GiB, new volume) to
    * create. See lxc-volume.ts for what may change: options in place, size up only.
    */
   rootfs?: string;
@@ -79,7 +79,7 @@ export interface LxcProps extends WithTarget {
   console?: PveFlag;
   tty?: number;
   cmode?: string;
-  /** `tank:subvol-100-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
+  /** `tank:subvol-900-disk-1,mp=/data,backup=1,size=100G`, or `tank:100,mp=/data` to create. */
   [mount: `mp${number}`]: string | undefined;
   /** `name=eth0,bridge=vmbr0,ip=dhcp`. ⚠️ An undeclared `hwaddr` keeps the live MAC. */
   [nic: `net${number}`]: string | undefined;

package/src/proxmox/lxc-read.test.ts

@@ -40,10 +40,10 @@ describe('absent means the cluster does not list the vmid', () => {
 
   test('a 500 for a guest the cluster lists on this node fails with PVE’s error', async () => {
     fake = fakePve();
-    seed(fake, NODE, 100, LIVE);
+    seed(fake, NODE, 900, LIVE);
     const message = 'got timeout\n';
-    fake.configErrors.set(`${NODE}/100`, { body: { data: null, message }, status: 500 });
-    const run = await lxcEngine(fake).plan(declared(100));
+    fake.configErrors.set(`${NODE}/900`, { body: { data: null, message }, status: 500 });
+    const run = await lxcEngine(fake).plan(declared(900));
     expect(run.failure).toContain('got timeout');
     expect(run.actions).toEqual({});
     expect(writesOf(fake)).toEqual([]);

package/src/proxmox/lxc-strict-adopt.test.ts

@@ -59,7 +59,7 @@ describe('a cold adoption that differs from the live guest fails the plan', () =
     ['an unprivileged flip', { unprivileged: 0 as const }, 'unprivileged', ['live 1']],
     [
       'a smaller mount point',
-      { mp0: 'tank:subvol-100-disk-0,mp=/data,size=100G' },
+      { mp0: 'tank:subvol-900-disk-0,mp=/data,size=100G' },
       'mp0',
       ['100G'],
     ],

package/src/proxmox/lxc-volume.test.ts

@@ -14,17 +14,17 @@ import { judge } from './lxc-judge.ts';
 import { type LxcProps, storedConfig } from './lxc-props.ts';
 import { judgeVolume } from './lxc-volume.ts';
 
-const LIVE_MP = 'tank:subvol-100-disk-0,mp=/data,size=200G';
+const LIVE_MP = 'tank:subvol-900-disk-0,mp=/data,size=200G';
 const props = (over: Record<string, unknown>): LxcProps =>
-  ({ node: 'pve1', target: TARGET, vmid: 100, ...over }) as unknown as LxcProps;
+  ({ node: 'pve1', target: TARGET, vmid: 900, ...over }) as unknown as LxcProps;
 const live = (config: Record<string, unknown>) => ({ unprivileged: 1, ...config });
 
 describe('mount points', () => {
   test('another volume on the same storage is refused, never written', () => {
-    const verdict = judgeVolume('mp0', 'tank:subvol-100-disk-7,mp=/data,size=200G', LIVE_MP);
+    const verdict = judgeVolume('mp0', 'tank:subvol-900-disk-7,mp=/data,size=200G', LIVE_MP);
     expect(verdict.refuse).toMatch(/detach the live volume to unusedN/);
     expect(verdict.put).toBeUndefined();
-    const change = judge(props({ mp0: 'tank:subvol-100-disk-7,mp=/data' }), live({ mp0: LIVE_MP }));
+    const change = judge(props({ mp0: 'tank:subvol-900-disk-7,mp=/data' }), live({ mp0: LIVE_MP }));
     expect(change.put).toEqual({});
     expect(change.refuse[0]).toMatch(/unusedN/);
   });
@@ -32,7 +32,7 @@ describe('mount points', () => {
   test('a bind mount is root@pam only, new or changed', () => {
     const added = judge(props({ mp1: '/srv/share,mp=/share' }), live({}));
     expect(added.put).toEqual({});
-    expect(added.refuse[0]).toMatch(/pct set 100 --mp1/);
+    expect(added.refuse[0]).toMatch(/pct set 900 --mp1/);
     const bind = '/srv/share,mp=/share';
     expect(judgeVolume('mp1', `${bind},ro=1`, bind)).toEqual({ rootOnly: true });
     expect(judgeVolume('mp1', bind, bind)).toEqual({});
@@ -41,13 +41,13 @@ describe('mount points', () => {
   test('replicate defaults ON: an explicit replicate=0 is a value, replicate=1 is not', () => {
     expect(judgeVolume('mp0', `${LIVE_MP},replicate=1`, LIVE_MP)).toEqual({});
     const off = judgeVolume('mp0', LIVE_MP, `${LIVE_MP},replicate=0`);
-    expect(off.put).toBe('tank:subvol-100-disk-0,mp=/data,size=200G');
+    expect(off.put).toBe('tank:subvol-900-disk-0,mp=/data,size=200G');
   });
 
   test('options and growth together: the PUT carries the live size, the resize the new one', () => {
     const verdict = judgeVolume('mp0', 'tank:300,mp=/data,backup=1', LIVE_MP);
     expect(verdict).toEqual({
-      put: 'tank:subvol-100-disk-0,mp=/data,backup=1,size=200G',
+      put: 'tank:subvol-900-disk-0,mp=/data,backup=1,size=200G',
       resize: '300G',
     });
   });
@@ -57,7 +57,7 @@ describe('a create allocates new volumes only', () => {
   test('an existing volume id in a create is refused; the new-disk spelling is not', () => {
     const base = { ostemplate: 'local:vztmpl/t.tar.zst' };
     const existing = createRefusals(
-      props({ ...base, rootfs: 'local-zfs:subvol-100-disk-0,size=8G' }),
+      props({ ...base, rootfs: 'local-zfs:subvol-900-disk-0,size=8G' }),
     );
     expect(existing.join('\n')).toMatch(/rootfs: .* names an existing volume/);
     expect(
@@ -84,7 +84,7 @@ describe('keys the resource does not manage', () => {
       mp0: LIVE_MP,
       parent: 'snap1',
       unprivileged: 1,
-      unused0: 'tank:subvol-100-disk-9',
+      unused0: 'tank:subvol-900-disk-9',
     };
     expect(storedConfig(read)).toEqual({
       hostname: 'x',

package/src/proxmox/lxc-volume.ts

@@ -14,7 +14,7 @@
  * ⛔ AN EXISTING VOLUME IS NEVER WRITTEN WITH THE NEW-DISK SPELLING. `tank:100` in a PUT means
  *   "allocate a fresh 100 GiB volume", and PVE then moves the volume the guest was using to
  *   `unusedN`. So a declared `tank:100,mp=/data` that matches a live
- *   `tank:subvol-100-disk-1,mp=/data,size=100G` compares EQUAL, and an options change on it is
+ *   `tank:subvol-900-disk-1,mp=/data,size=100G` compares EQUAL, and an options change on it is
  *   written with the LIVE volume id — the declaration's spelling is never sent back for a volume
  *   that exists.
  */

package/src/proxmox/lxc-wire.ts

@@ -3,7 +3,7 @@
  *
  * ★ EVERY RULE HERE IS READ OFF pve-container 6.1.14 (the PVE 9 line, `src/PVE/LXC/Config.pm` at
  *   git.proxmox.com HEAD, 2026-09-21) or off a live guest's config read with
- *   `pvesh get /nodes/<node>/lxc/100/config`. A rule nobody measured is a forever-diff waiting to
+ *   `pvesh get /nodes/<node>/lxc/<vmid>/config`. A rule nobody measured is a forever-diff waiting to
  *   happen: the plan reports an update, the deploy writes the same value back, and the next plan
  *   reports it again.
  *