@homeflare/alchemy 0.11.0 → 0.12.0

package/src/proxmox/lxc.ts

@@ -1,9 +1,9 @@
 /**
  * `Proxmox.Lxc` — a container, declared: adopted as it runs, or created from a template.
  *
- * ★ `hf-provision@pve` HOLDS EXACTLY THE ROLE THIS NEEDS: `LXCProvisioner` on `/` grants
- *   VM.Allocate, VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
- *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What that role cannot do — device
+ * ★ THE PROVISIONING BASELINE HOLDS WHAT THIS NEEDS (provision-baseline.ts): on `/`, VM.Allocate,
+ *   VM.Audit, VM.Config.{CPU,Disk,HWType,Memory,Network,Options}, VM.PowerMgmt,
+ *   Datastore.AllocateSpace, Datastore.Audit, SDN.Use, Sys.Audit. What no token can do — device
  *   passthrough, bind mounts, features beyond nesting — PVE keeps for root@pam, and lxc-judge.ts
  *   refuses at plan with the `pct set` to run instead.
  *

package/src/proxmox/members.test.ts

@@ -15,7 +15,7 @@ const transport = (cause: Error) =>
   new HttpClientError.HttpClientError({
     reason: new HttpClientError.TransportError({
       cause,
-      request: { method: 'PUT', url: 'https://n2.mgmt.example.com:8006/api2/json/x' } as never,
+      request: { method: 'PUT', url: 'https://node-b.mgmt.example.com:8006/api2/json/x' } as never,
     }),
   });
 

package/src/proxmox/members.ts

@@ -1,10 +1,10 @@
 /**
- * TB4 cluster members: ordered failover, last-good preference, transport classification.
+ * C1 cluster members: ordered failover, last-good preference, transport classification.
  *
  * ★ ANY MEMBER'S :8006 API MANAGES THE WHOLE CLUSTER — PVE proxies node paths itself — so the
  *   provider reaches the cluster through whichever member is up, not through one pinned node.
  *
- * ⛔ NEVER cluster-tb4.example.com: it resolves to 10.20.10.250, which nothing serves.
+ * ⛔ NEVER cluster-c1.example.com: it resolves to 192.0.2.250, which nothing serves.
  */
 import * as Effect from 'effect/Effect';
 import * as Result from 'effect/Result';
@@ -120,7 +120,7 @@ export type PveMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
  *   elsewhere can repeat a write.
  *
  * ★ Reads fail over on any transport failure, including timeout — no side effect to duplicate.
- *   MEASURED 2026-09-14: full TB4 plans stayed all-noop with the first member refused (127.0.0.1)
+ *   MEASURED 2026-09-14: full C1 plans stayed all-noop with the first member refused (127.0.0.1)
  *   and with it unresolvable (n9.invalid).
  */
 export const executeOnCluster = (

package/src/proxmox/metric-server-otel.ts

@@ -12,8 +12,8 @@
  *   `Content-Type: application/json` (pve-manager PVE/Status/OpenTelemetry.pm:643) and gzips by
  *   default; there is no protobuf option. vector's opentelemetry source and VictoriaMetrics both
  *   take protobuf only — measured 2026-09-14 — so a server pointed straight at either fails every
- *   push. That is why TB4's declaration points at each node's own vector bridge
- *   (hosts/pve/vector/vector.yaml in homeflare-config) rather than at the estate's intake.
+ *   push. That is why C1's declaration points at each node's own vector bridge
+ *   (the estate's per-node vector config) rather than at the estate's intake.
  *
  * ⛔ `otel-headers` IS `never`, FOR THE REASON `token` IS. It is where an OTLP bearer token goes —
  *   base64 of a JSON object of arbitrary HTTP headers — and Alchemy persists attributes UNENCRYPTED.

package/src/proxmox/network-apply-read.ts

@@ -7,7 +7,7 @@
  *   diff, and the only write in either file is the apply itself.
  *
  * ⛔ THE PENDING STATE IS NOT IN `data`, WHICH IS WHY THIS FILE DOES ITS OWN FETCH. MEASURED in the
- *   cluster's own source on n2, 2026-09-13 — not inferred from documentation:
+ *   cluster's own source on node-b, 2026-09-13 — not inferred from documentation:
  *     PVE/API2/Network.pm   my $tmp = PVE::INotify::read_file('interfaces', 1);
  *                           $rpcenv->set_result_attrib('changes', $changes) if $changes;
  *     PVE/HTTPServer.pm     if (my $diff = $rpcenv->get_result_attrib('changes')) {
@@ -24,9 +24,9 @@
  *   `GET /nodes/{node}/network` answers with the STAGED config and a node about to be reconfigured
  *   looks identical to one already running it. Same trap `sdn-apply.ts` documents for `?running=1`.
  *
- * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On n2 and n3,
- *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on n2,
- *   n3 and n4), `wlp91s0` already comes back with no `active` key at all. Counting interfaces that
+ * ⚠️ `active` IS NOT A PENDING SIGNAL, AND THE OBVIOUS SHORTCUT IS MEASURABLY WRONG. On node-b and node-c,
+ *   with nothing staged anywhere (VERIFIED 2026-09-13: `/etc/network/interfaces.new` absent on node-b,
+ *   node-c and node-d), `wlan0` already comes back with no `active` key at all. Counting interfaces that
  *   are not up as "pending" would report an update on two of the three nodes forever.
  *
  * ⚠️ ONE THING GENUINELY CANNOT BE SEEN FROM HERE, AND IT IS SMALL. The diff is computed as
@@ -58,7 +58,7 @@ export type ClusterHealth = { quorate: boolean; offline: readonly string[] };
  *
  * ⛔ THIS STRING NEVER LEAVES THIS MODULE, AND THAT IS A SECRET RULE, NOT A STYLE ONE. Alchemy
  *   persists attributes UNENCRYPTED (credentials.ts spells out why), and `/etc/network/interfaces`
- *   is a file that can legally contain `wpa-psk` — n2 and n3 both carry a `wlp91s0`, MEASURED — as
+ *   is a file that can legally contain `wpa-psk` — node-b and node-c both carry a `wlan0`, MEASURED — as
  *   well as any `pre-up` command somebody wrote. A diff of that file in a state store is a secret
  *   in a state store. Only the COUNT below ever escapes.
  */
@@ -70,7 +70,7 @@ const stagedDiff = (target: PveTarget, node: string) =>
     //   provisioning lease, and a plan stays a plan even if the write role is missing entirely.
     // ⛔ THROUGH THE LEASE CACHE, NOT `mint`. This read needs no particular identity — only the
     //   apply and its task poll do, and network-apply.ts mints for those itself. Minting here left
-    //   SIX extra `hf-read@pve` tokens on n2 per TB4 plan (one per node, for read and for diff),
+    //   SIX extra `hf-read@pve` tokens on node-b per C1 plan (one per node, for read and for diff),
     //   MEASURED 2026-09-14 while the cache itself made one read mint for the whole run.
     const credential = yield* leased(target, 'read');
     const envelope = (yield* pveEnvelopeWith(target, credential, 'GET', path)) as NetworkEnvelope;
@@ -108,9 +108,9 @@ export const pendingCount = (target: PveTarget, node: string) =>
  * Quorum, and every member that is not online.
  *
  * ⛔ QUORUM ALONE IS NOT THE CHECK, AND ON A THREE-NODE CLUSTER IT WOULD MISS THE ACCIDENT THIS
- *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on TB4:
- *   `{"id":"cluster","name":"HF-TB4","nodes":3,"quorate":1,…}` plus one row per node with
- *   `online: 1`. So a reload that drops n2 off the network is invisible to `quorate` and visible
+ *   RESOURCE IS AFRAID OF. Losing ONE of three leaves `quorate: 1` — MEASURED shape on C1:
+ *   `{"id":"cluster","name":"HF-C1","nodes":3,"quorate":1,…}` plus one row per node with
+ *   `online: 1`. So a reload that drops node-b off the network is invisible to `quorate` and visible
  *   only as `online: 0` on that row. Both are checked, and the node names come back so the failure
  *   message can say WHICH member went away.
  *
@@ -140,7 +140,7 @@ const clusterHealth = (target: PveTarget) =>
  *
  * ★ A REASON RATHER THAN A BOOLEAN, BECAUSE THE CALLER'S ONLY USE FOR IT IS A REFUSAL MESSAGE.
  *   "The deploy stopped because the cluster was degraded" is not actionable at three in the
- *   morning; "quorate=true offline=[n3]" is. The two callers in network-apply.ts ask this before
+ *   morning; "quorate=true offline=[node-c]" is. The two callers in network-apply.ts ask this before
  *   the reload and again after it, and the second answer is the one that stops the chain from
  *   reaching the next node.
  *

package/src/proxmox/network-apply.ts

@@ -4,23 +4,23 @@
  * ⛔ WITHOUT IT EVERY NETWORK DECLARATION IS A GREEN PLAN THAT CHANGES NO NETWORK; WITH IT A GREEN
  *   PLAN CAN TAKE A NODE OFF THE NETWORK. Writes under `nodes/{node}/network/{iface}` edit
  *   `/etc/network/interfaces.new` and touch no interface. `PUT /nodes/{node}/network` is the apply.
- *   MEASURED in the cluster's own source on n2, 2026-09-13 — `PVE/API2/Network.pm`:
+ *   MEASURED in the cluster's own source on node-b, 2026-09-13 — `PVE/API2/Network.pm`:
  *       rename($new_config_file, $current_config_file) if -e $new_config_file;
  *       PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
  *       return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);
  *
- * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON TB4 THE DANGER IS NOT ABSTRACT.
- *   Ceph runs over `vmbr1.11` on n2, n3 AND n4 (MEASURED 2026-09-13: four pools, size 3 /
+ * ⛔ THIS IS THE MOST DANGEROUS RESOURCE IN THE PACKAGE, AND ON C1 THE DANGER IS NOT ABSTRACT.
+ *   Ceph runs over `vmbr1.42` on node-b, node-c AND node-d (MEASURED 2026-09-13: four pools, size 3 /
  *   min_size 2, mon+mgr+mds on all three). `ifreload -a` takes that node's OSDs, mons and MDS off
  *   the cluster network for the length of the reload; two nodes at once puts every pool below
  *   min_size and blocks IO for every guest with an RBD disk. The management address the API is
- *   reached on, `vmbr0.10`, is reloaded by the same call.
+ *   reached on, `vmbr0.41`, is reloaded by the same call.
  *
  * ⛔ AND UNLIKE `SdnApply` IT IS PER NODE, SO A HALF-RECONFIGURED CLUSTER IS THE DEFAULT FAILURE
  *   MODE, NOT AN EDGE CASE. `PUT /cluster/sdn` publishes the whole cluster in one call; this
- *   publishes exactly one node, so a stack holding three of these can apply n2, fail, and leave n3
- *   and n4 on the old layout with Ceph spanning all three. Four things here exist only for that:
- *     1. `after` SERIALISES THEM — chain n3 after n2 and n4 after n3, so at most one node is ever
+ *   publishes exactly one node, so a stack holding three of these can apply node-b, fail, and leave node-c
+ *   and node-d on the old layout with Ceph spanning all three. Four things here exist only for that:
+ *     1. `after` SERIALISES THEM — chain node-c after node-b and node-d after node-c, so at most one node is ever
  *        mid-reload. Three declared in parallel is the outage, and nothing in Alchemy stops you.
  *     2. `reconcile` REFUSES TO START on a cluster that is already degraded.
  *     3. `reconcile` RE-CHECKS quorum and every member's `online` flag AFTER the reload and dies if
@@ -58,7 +58,7 @@ import type { WithTarget } from './resource.ts';
 
 export interface NetworkApplyProps extends WithTarget {
   /**
-   * The node whose staged interfaces file this applies — `n2`.
+   * The node whose staged interfaces file this applies — `node-b`.
    *
    * ⚠️ ONE APPLY PER NODE, AND NEVER TWO FOR THE SAME NODE. Two would each publish the other's
    *   staged half, and both would run `ifreload` on a file the other had not finished writing.
@@ -99,7 +99,7 @@ export interface NetworkApplyAttributes {
    *   `active`, `exists`, `families`, `method`, `method6`, `options`, `priority`, `link-type` and
    *   ten more; `altnames` is returned and is not even in the schema. `priority` is the worst of
    *   them: PVE ASSIGNS it from the order of the interfaces file, so the same logical layout
-   *   carries different numbers on different nodes (MEASURED: n4's differ from n2/n3's by one).
+   *   carries different numbers on different nodes (MEASURED: node-d's differ from node-b/node-c's by one).
    *   Every one of those is a forever-diff waiting for whoever writes `Proxmox.NetworkInterface`.
    *   This resource compares a single integer against zero and never looks at a row at all.
    */
@@ -128,7 +128,7 @@ const read = (props: NetworkApplyProps) =>
  *   decides it is whether the node is carrying a staged change right now.
  *
  * ★ THIS IS ALSO WHY DECLARING THE LIVE CLUSTER PLANS AS `noop`. VERIFIED 2026-09-13:
- *   `/etc/network/interfaces.new` is absent on n2, n3 and n4, so `changes` is absent from all three
+ *   `/etc/network/interfaces.new` is absent on node-b, node-c and node-d, so `changes` is absent from all three
  *   answers, so `pending` is 0 on all three and every one of them plans `noop`.
  */
 const diff = (news: Input<NetworkApplyProps>) =>

package/src/proxmox/node-network-form.ts

@@ -14,14 +14,14 @@
  *
  * * ⛔ THE LAST SEVEN ARE REPORTED AND NEVER COMPARED, AND EACH ONE IS A MEASURED FOREVER-DIFF.
  *   `priority` is assigned by PVE FROM FILE ORDER — `my $priority = 2; ... $d->{priority} =
- *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS TB4: vmbr1.11 is
- *   priority 16 on n2 and n3 and 15 on n4, because n4 has no `wlp91s0` above it. One declaration
+ *   $priority++` — and it is not a POST or PUT parameter at all. MEASURED ACROSS C1: vmbr1.42 is
+ *   priority 16 on node-b and node-c and 15 on node-d, because node-d has no `wlan0` above it. One declaration
  *   reused across three nodes would diff on exactly one of them, forever, over nothing.
  *   `method` is RECOMPUTED on every write from whether the form carried an address, `families` is
  *   recomputed the same way and never written to the file, `active` and `exists` describe the
  *   kernel rather than the config, and `bond_miimon`, `bridge_stp` and `bridge_fd` are emitted by
  *   PVE's writer with defaults (100, `off`, 0) while appearing in NEITHER write schema —
- *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: n2's bond0
+ *   `additionalProperties => 0` means sending one is a 400. Live proof of all three: node-b's bond0
  *   returns `bond_miimon "100"` and vmbr1 returns `bridge_stp "off"`, `bridge_fd "0"`, none of
  *   which any declaration can set.
  */
@@ -74,7 +74,7 @@ export const ifaceList = (value: unknown) =>
  *   `ceph transport` comes back as `ceph transport\n` and the two never compare equal.
  * ⚠️ AND THE READER FOLDS `comments6` INTO `comments` (`$d->{comments} .= $comments6`), so on an
  *   interface that carries an IPv6 comment a declared `comments` CANNOT match what comes back.
- *   TB4 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
+ *   C1 has none; on an interface that does, leave `comments` undeclared rather than fighting it.
  */
 export const comment = (value: unknown) => text(value).replace(/\s+$/, '');
 
@@ -111,7 +111,7 @@ const field = (name: string, value: string | undefined): Record<string, string>
  *
  * ⚠️ `netmask` IS A WRITABLE PARAMETER AND IS DELIBERATELY NOT OFFERED. PVE raises
  *   "netmask conflicts with cidr" when both are sent, and the reader rewrites whatever was written
- *   into prefix form — MEASURED: n2's vmbr1.11 reports `"netmask":"24"`, never `255.255.255.0`.
+ *   into prefix form — MEASURED: node-b's vmbr1.42 reports `"netmask":"24"`, never `255.255.255.0`.
  *   A resource accepting both spellings would let a declaration diff against its own value.
  */
 export const body = (props: NodeNetworkProps): Record<string, string> => ({
@@ -144,7 +144,7 @@ export const body = (props: NodeNetworkProps): Record<string, string> => ({
  *   `ifreload -a` I did NOT measure. Clearing cidr explicitly at least produces a clean, honest
  *   manual interface — and `matches` compares `cidr` UNCONDITIONALLY, so the plan says so first.
  *
- * ⛔ ON vmbr1.11 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
+ * ⛔ ON vmbr1.42 THAT IS THE CEPH TRANSPORT. A declaration of that interface without its `cidr` is
  *   a declaration that it should have no address, applied across three nodes. The plan will read
  *   `1 to update` rather than `noop`; do not wave it through.
  *
@@ -177,7 +177,7 @@ export const readAttributes = (
    *   same call metric-server.ts makes, for a worse reason. `type` is required on the PUT and
    *   the PUT MERGES, so a declaration naming `bridge` for what is really a vlan would write
    *   `type bridge` into the stanza and PVE's writer would then emit bridge-ports and
-   *   bridge-stp lines for vmbr1.11. Reporting absent instead makes reconcile POST a create,
+   *   bridge-stp lines for vmbr1.42. Reporting absent instead makes reconcile POST a create,
    *   which PVE refuses with "interface already exists": loud, and it changes nothing.
    */
   const liveType = text(live['type']);

package/src/proxmox/node-network.ts

@@ -11,23 +11,23 @@
  *   that apply — this one never calls it, exactly as `Proxmox.SdnZone` never calls
  *   `Proxmox.SdnApply`.
  *
- * ⛔ CEPH ON TB4 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
+ * ⛔ CEPH ON C1 RIDES TWO NETWORKS AND THIS API ONLY SEES ONE OF THEM. Measured from
  *   `/etc/pve/ceph.conf` on 2026-09-13:
  *
- *     public_network  = 10.20.11.0/24     -> vmbr1.11, which this resource DOES see
- *     cluster_network = 10.100.0.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
+ *     public_network  = 198.51.100.0/24     -> vmbr1.42, which this resource DOES see
+ *     cluster_network = 203.0.113.0/24     -> every OSD's cluster_addr: .102 / .103 / .104
  *
  *   The cluster network — OSD REPLICATION, the traffic that rebuilds a lost replica — lives on
- *   `10.100.0.10X/32` addresses carried by `en05`, `en06` and `dummy_tb4`: the Thunderbolt mesh.
+ *   `203.0.113.10X/32` addresses carried by `tb0`, `tb1` and `dummy_c1`: the Thunderbolt mesh.
  *
  * ⛔ AND THOSE ADDRESSES ARE INVISIBLE HERE, WHICH IS THE TRAP. They are declared in
  *   `/etc/network/interfaces.d/sdn`, and PVE's network API does not parse that directory.
- *   MEASURED: `GET /nodes/n2/network/en05` answers `{"method":"manual","type":"eth",…}` with NO
- *   address, while `ip -br -4 addr` shows `en05  UP  10.100.0.102/32`. So this resource reports
- *   en05 and en06 as address-less manual ports and will plan `noop` over them — implicitly
+ *   MEASURED: `GET /nodes/node-b/network/tb0` answers `{"method":"manual","type":"eth",…}` with NO
+ *   address, while `ip -br -4 addr` shows `tb0  UP  203.0.113.102/32`. So this resource reports
+ *   tb0 and tb1 as address-less manual ports and will plan `noop` over them — implicitly
  *   asserting they carry no address, which is FALSE.
  *
- *   The consequence, stated plainly: declaring en05/en06 from what this API reports and then
+ *   The consequence, stated plainly: declaring tb0/tb1 from what this API reports and then
  *   DESTROYING or applying over them takes out OSD replication on a cluster whose pools are
  *   size 3 / min_size 2. They read as the most boring interfaces on the node and are the two most
  *   dangerous. Leave them undeclared; if they must be managed, manage the file that actually
@@ -55,7 +55,7 @@
  *   interface a node already has would otherwise leave it holding a pending network change.
  *
  * ⚠️ WHAT IS STILL TRUE: when `matches` is false the PUT rewrites the whole stanza, and that can
- *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.11`, where PVE had
+ *   ADD lines the file did not have — a `vlan-raw-device vmbr1` under `vmbr1.42`, where PVE had
  *   been deriving it from the name. Harmless in content, and it costs nothing until somebody
  *   applies; one more reason the apply is a separate resource.
  *
@@ -79,10 +79,10 @@ import {
 import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
 
 /**
- * PVE's interface types. `unknown` is what a NIC it does not manage reports — n2 and n3 both
- * report `wlp91s0` that way, and n4 has no such interface at all.
+ * PVE's interface types. `unknown` is what a NIC it does not manage reports — node-b and node-c both
+ * report `wlan0` that way, and node-d has no such interface at all.
  *
- * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On n4 the read answers 404,
+ * ⚠️ THAT ASYMMETRY IS A TRAP FOR A DECLARATION SHARED ACROSS NODES. On node-d the read answers 404,
  *   which this provider cannot tell from "deleted", so reconcile POSTs — writing a stanza for a
  *   card that is not in the machine. Declare per node what each node actually has; a physical
  *   interface is discovered, not decided.
@@ -104,24 +104,24 @@ export type NodeNetworkType =
 export interface NodeNetworkProps extends WithTarget {
   /** Which node's file this stanza lives in. Interfaces are per node, never cluster-wide. */
   node: string;
-  /** `vmbr0`, `bond0`, `vmbr1.11`. 2-20 characters, PVE's `pve-iface` format. */
+  /** `vmbr0`, `bond0`, `vmbr1.42`. 2-20 characters, PVE's `pve-iface` format. */
   iface: string;
   /** ⛔ REQUIRED ON EVERY WRITE, update included, never used to retype — see `readAttributes`. */
   type: NodeNetworkType;
   /**
-   * `10.20.11.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
+   * `198.51.100.12/24`. ⛔ THE ONE FIELD WITH NO UNMANAGED MODE: leaving it out is an instruction
    * to make the interface `manual`, not an instruction to leave its address alone. The ⛔ on
    * `updateBody` in node-network-form.ts has the measurement and the consequence.
    */
   cidr?: string;
   /** ⚠️ PVE allows exactly ONE default gateway per node and refuses a second with "Default
-   *  gateway already exists on interface '<other>'". On TB4 it is vmbr0.10's. */
+   *  gateway already exists on interface '<other>'". On C1 it is vmbr0.41's. */
   gateway?: string;
   /**
    * `auto <iface>` in the file. Absent on read means off, which is why `bool`'s fallback is used.
    * ⚠️ UNDECLARED IS UNMANAGED ON AN UPDATE AND OFF ON A CREATE — the same asymmetry storage.ts
    *   has, and it bites harder here: an interface created without `autostart` is one the node
-   *   will not bring up at boot. Every TB4 bridge, bond and vlan carries it.
+   *   will not bring up at boot. Every C1 bridge, bond and vlan carries it.
    */
   autostart?: boolean;
   /** 1280-65520. Unset leaves the file without an `mtu` line and the kernel default in force. */
@@ -145,7 +145,7 @@ export interface NodeNetworkProps extends WithTarget {
   bond_xmit_hash_policy?: string;
   /** active-backup only. Kept hyphenated because that is the wire name. */
   'bond-primary'?: string;
-  /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.11` reports `vlan-id` 11 with no such line in the file;
+  /** ⚠️ DERIVED FROM A DOTTED NAME. `vmbr1.42` reports `vlan-id` 42 with no such line in the file;
    *  declaring it there is harmless but adds a line the file did not have. */
   'vlan-id'?: number;
   'vlan-raw-device'?: string;
@@ -209,7 +209,7 @@ const handlers = pveHandlers<NodeNetworkProps, NodeNetworkAttributes>({
    *   omission is an edit. Comparing it unconditionally is what makes that edit visible in `plan`
    *   instead of at `ifreload` time.
    *
-   * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the TB4 declaration
+   * ⚠️ NOTHING IN THE REPORTED-ONLY BLOCK IS HERE, and that is what makes the C1 declaration
    *   plan as `noop` on all three nodes at once — the ⛔ above `NodeNetworkAttributes` lists them
    *   and the measurement behind each.
    */

package/src/proxmox/notification-target.ts

@@ -39,8 +39,9 @@
  *     reconcile  POST + PUT                   Mapping.Modify on /mapping/notifications AND one of
  *                                             Sys.Audit / Sys.Modify / Sys.AccessNetwork on /
  *     delete     DELETE                       Mapping.Modify on /mapping/notifications
- *   `LXCProvisioner` already carries Sys.Audit on `/` (see lxc.ts), so the delta is the two Mapping
- *   privileges — notably NOT the `Sys.Modify` a backup job costs.
+ *   The provision role already carried Sys.Audit on `/` (see lxc.ts), so the delta was the two
+ *   Mapping privileges — notably NOT the `Sys.Modify` a backup job costs. `PROVISION_PRIVILEGES`
+ *   carries both on `/`: the baseline took the trade below knowingly.
  *   ⚠️ PREFER A SECOND ROLE GRANTED AT `/mapping/notifications` OVER WIDENING THE PROVISIONING ROLE
  *     ON `/`. `/mapping` also holds the PCI and USB passthrough maps, so Mapping.Modify at the root
  *     lets a credential scoped to make containers rewire somebody's hardware.

package/src/proxmox/pbs-datastore-guard.ts

@@ -54,7 +54,7 @@ export const guardPath = (live: PbsDatastoreAttributes, props: PbsDatastoreProps
  *
  * ⚠️ AN UNDECLARED `backend` IS NOT A DIVERGENCE. Undeclared is unmanaged everywhere in this
  *   family, and this guard keeps that rule: it fires only when the declaration says something and
- *   PBS says something else. Adopting `r2-offsite` without mentioning `backend` still plans noop.
+ *   PBS says something else. Adopting `offsite` without mentioning `backend` still plans noop.
  *
  * ⚠️ COMPARED AS A CANONICAL PROPERTY STRING, so `bucket=x,type=s3` and `type=s3,bucket=x` are the
  *   same backend and key order cannot deadlock a plan — the reason `samePath` trims a slash.

package/src/proxmox/pbs-datastore.ts

@@ -10,7 +10,7 @@
  *   `{"data":{"pong":true}}` against a Let's Encrypt certificate for CN=pbs.example.com;
  *   `/version` and `/config/datastore` answer 401 "authentication failed";
  *   `pbs.mgmt.example.com:8007` answers 401 and its certificate verifies too; and
- *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm `Schenanigans`. So the
+ *   `/access/domains` lists the realms `pbs`, `pam` and an openid realm. So the
  *   prefix, the `{"data": …}` envelope and the strict-TLS story are PVE's exactly — and only the
  *   credential differs. There is no `pve` realm here; a PVE token cannot authenticate at all.
  *   The header differs too, which is why `pve()` exists rather than `pve()` being reused — see the
@@ -18,18 +18,18 @@
  *
  * ⛔ THERE IS NO OPENBAO MOUNT FOR PBS TODAY, SO NOTHING HERE CAN DEPLOY YET. `PbsTarget.mount` is
  *   a parameter for the reason `PveTarget.mount` is — the provider must be able to leave this
- *   estate — but the estate has nothing to put in it. MEASURED: under the `claude-code` approle,
- *   `bao token capabilities` answers `deny` for `proxmox-tb4/creds/{read,provision}`,
- *   `proxmox-ops/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could
+ *   estate — but the estate has nothing to put in it. MEASURED: under the agent's approle,
+ *   `bao token capabilities` answers `deny` for `proxmox-c1/creds/{read,provision}`,
+ *   `proxmox-c2/creds/read` and every `…pbs…` path tried, and `sys/mounts` is 403 — so I could
  *   not enumerate the mounts to PROVE a PBS one is absent. That it is absent is the brief's
  *   statement, not my measurement.
  *   ★ WHAT THE MOUNT MUST VEND, so `mint()` is reused unchanged: `bao read -format=json
  *     <mount>/creds/<role>` answering `{"data":{"token_id":…,"secret":…}}`, where `token_id` is a
  *     PBS token id `user@realm!tokenname` — `hf-read@pbs!…` and `hf-provision@pbs!…`. Same short,
- *     non-renewable lease contract as `proxmox-tb4`.
+ *     non-renewable lease contract as `proxmox-c1`.
  *   ⚠️ PBS HAS NO DYNAMIC-SECRETS PLUGIN OF ITS OWN — OpenBao's Proxmox support is a PVE thing — so
  *     the mount is a small custom vendor against `POST /access/users/{id}/token/{name}`. Say which
- *     mount and role you needed rather than reaching for the read-only `monitoring@pbs` token on
+ *     mount and role you needed rather than reaching for the read-only `metrics@pbs` token on
  *     the kv shelf: widening that would delete the outer lock for every reader of the shelf.
  *
  * ⛔ A DATASTORE HOLDS THE BACKUPS, SO `retain` IS THE DEFAULT AND `delete` IS FULLY IMPLEMENTED —
@@ -47,7 +47,7 @@
  * ⛔ NO SECRET IS A PROP OR AN ATTRIBUTE, AND THIS FAMILY IS CLEAN BY CONSTRUCTION: a datastore
  *   section holds no password, token or key — encryption keys belong to the backup CLIENT. Every
  *   field below is a name, a path, a schedule, a count or a policy string, all of which are safe in
- *   a state store Alchemy writes UNENCRYPTED and this estate dumps to CT100 nightly.
+ *   a state store Alchemy writes UNENCRYPTED and this estate copies to a backup guest nightly.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -131,11 +131,11 @@ export interface PbsDatastoreProps {
    *   `datastore create --help` offers `--backend`, `datastore update --help` does NOT, and
    *   `backend` is absent from update's `--delete` enum. PBS will not move a datastore between
    *   local disk and object storage, ever.
-   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `r2-offsite` holds
-   *   `type=s3,client=cloudflare-r2,bucket=homeflare-pbs`. Leaving it undeclared would still plan
+   * ★ IT IS A PROP AT ALL BECAUSE THE ESTATE HAS ONE. `offsite` holds
+   *   `type=s3,client=cloudflare-r2,bucket=example-pbs`. Leaving it undeclared would still plan
    *   noop — undeclared is unmanaged here — but the declaration would then describe a LOCAL
    *   datastore, and anyone recreating from it would get exactly that: an empty directory on the
-   *   mini's disk where the offsite copy used to be, behind a green plan the whole way.
+   *   host's disk where the offsite copy used to be, behind a green plan the whole way.
    * ⚠️ A property string. Compared canonically, so key order is never a diff.
    */
   backend?: string;

package/src/proxmox/pbs-prune-job.ts

@@ -37,10 +37,10 @@
  *   answers 401 "authentication failure", which reads as a bad credential rather than as a
  *   malformed header — the same trap credentials.ts already records for PVE's colon form.
  *   ⛔ AND THERE IS NO MOUNT TO MINT FROM. `mint()` runs `bao read <mount>/creds/<role>`; no
- *     OpenBao mount vends PBS tokens — `proxmox-tb4` and `proxmox-ops` vend PVE ones. The
+ *     OpenBao mount vends PBS tokens — `proxmox-c1` and `proxmox-c2` vend PVE ones. The
  *     `kv/infra/proxmox` shelf holds a READ-ONLY `Audit` token for PBS, and a read-only token
  *     cannot create a prune job. I could not confirm that shelf's contents: this machine's
- *     claude-code approle answers 403 on `sys/mounts` AND on `kv/metadata/infra/proxmox`
+ *     agent approle answers 403 on `sys/mounts` AND on `kv/metadata/infra/proxmox`
  *     (MEASURED). What is needed is a dynamic PBS mount vending a `provision` role with
  *     `Datastore.Modify` — say that, rather than reaching for the stored auditor token.
  *

package/src/proxmox/pbs-sync-job.ts

@@ -12,14 +12,14 @@
  *
  * ⛔ THE CREDENTIAL IS A PBS TOKEN AND IT DOES NOT EXIST YET; NO MOUNT NAME IS INVENTED IN THIS
  *   FILE. PBS wants `user@realm!tokenname` plus a UUID secret, issued by PBS — a PVE token is not
- *   one, whatever it is spelled like. MEASURED from this machine on 2026-09-13: the `claude-code`
+ *   one, whatever it is spelled like. MEASURED from this machine on 2026-09-13: the agent's
  *   approle cannot enumerate mounts (`bao secrets list` -> 403) and
  *   `bao token capabilities kv/infra/proxmox/pbs` -> `deny`, so I could not confirm from here what
  *   does or does not exist. What credentials.ts records is that every PBS token on the kv shelf is
- *   READ-ONLY (`Audit`, as `monitoring@pve`) and STATIC — too narrow to create a sync job, and
+ *   READ-ONLY (`Audit`, as `metrics@pve`) and STATIC — too narrow to create a sync job, and
  *   exactly the kind of credential this provider exists to avoid writing with.
  *   ★ SO THE MOUNT IS A `PbsTarget.mount` THE STACK SUPPLIES, and somebody has to build it first:
- *     a dynamic PBS mount with `read` and `provision` roles mirroring `proxmox-tb4`. Until it
+ *     a dynamic PBS mount with `read` and `provision` roles mirroring `proxmox-c1`. Until it
  *     exists this family can be declared and cannot be deployed. `permission denied` means the
  *     grant is missing — say which mount and role you needed; do not fall back to the shelf token.
  *
@@ -83,7 +83,7 @@ export interface SyncJobProps extends WithPbsTarget {
    *   `Pbs.Remote` family is OUT OF SCOPE for this package rather than merely unwritten:
    *   `POST /config/remote` requires `password`, and Alchemy persists props and attributes to its
    *   state store UNENCRYPTED (StateEncoding.ts tags Redacted values rather than encrypting them),
-   *   which here is the `alchemy` Postgres that pg-backup.sh dumps nightly to CT100. A remote's
+   *   which here is the `alchemy` Postgres that a nightly job dumps to a backup guest. A remote's
    *   password in a prop is that password in four places, for months. The only Remote resource that
    *   could exist would refuse `password` the way storage.ts refuses it — as a `never` — and could
    *   therefore never CREATE a remote, which is a resource that cannot do what its name promises.

package/src/proxmox/pbs-verify-job.ts

@@ -11,7 +11,7 @@
  *
  * ⛔ THIS FILE CANNOT AUTHENTICATE UNTIL TWO THINGS OUTSIDE IT CHANGE, AND IT IS SHIPPED SAYING SO
  *   RATHER THAN SHIPPED LOOKING FINISHED. Both are recorded on `PbsTarget` below:
- *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the `claude-code`
+ *     1. `credentials.ts` has no PBS mint. MEASURED 2026-09-13 from this Mac: the agent's
  *        approle is refused `sys/mounts`, `kv/infra/proxmox` and `proxmox-pbs/creds/read` alike —
  *        403 permission denied on all three — so there is no mount to name and none is invented.
  *     2. `client.ts`'s `authorization()` builds a PVE header, and PBS will not accept it. See the

package/src/proxmox/pool.test.ts

@@ -17,14 +17,14 @@ const target: PoolProps['target'] = {
 
 const props = (over: Partial<PoolProps> = {}): PoolProps => ({
   target,
-  poolid: 'house',
+  poolid: 'lab',
   ...over,
 });
 
 describe('pool forms match generated POST/PUT parameters', () => {
   it('createForm sends exactly poolid and comment', () => {
     const form: PoolsPostParams = poolCreateForm(props({ comment: 'estate' }));
-    assert.deepEqual(form, { poolid: 'house', comment: 'estate' });
+    assert.deepEqual(form, { poolid: 'lab', comment: 'estate' });
     assert.deepEqual(Object.keys(form).sort(), ['comment', 'poolid']);
   });
 

package/src/proxmox/pool.ts

@@ -8,11 +8,11 @@
  *   its own state would have reported noop straight past a hand-edit in the UI.
  *
  * ⚠️ IT 403'd UNTIL THE ROLE WAS WIDENED, AND THE HISTORY IS WORTH KEEPING. `hf-provision@pve`
- *   held `LXCProvisioner` on `/` with no `Pool.Allocate`, so reconcile answered
- *   "Permission check failed (/pool/house, Pool.Allocate)". The credential could not widen itself
+ *   held the provision role on `/` with no `Pool.Allocate`, so reconcile answered
+ *   "Permission check failed (/pool/lab, Pool.Allocate)". The credential could not widen itself
  *   — `PUT /access/roles` is 403 for it too — so the role was extended over SSH with
- *   `pveum role modify LXCProvisioner --privs "<existing>,Pool.Allocate,Pool.Audit"`, preserving
- *   every existing privilege. Each new resource in this package should state the privileges its
+ *   `pveum role modify <role> --privs "<existing>,Pool.Allocate,Pool.Audit"`, preserving every
+ *   existing privilege. `PROVISION_PRIVILEGES` (provision-baseline.ts) carries both now. Each new resource in this package should state the privileges its
  *   reconcile needs, so widening stays a deliberate act rather than a reaction to a 403.
  */
 import { Resource } from 'alchemy';

package/src/proxmox/provision-baseline.test.ts

@@ -0,0 +1,87 @@
+/**
+ * The baseline itself: the one privilege list, the generic defaults, and the names both halves
+ * refuse before either can paste them into a root shell or a declaration.
+ */
+import { describe, expect, test } from 'bun:test';
+import {
+  PROVISION_DEFAULTS,
+  PROVISION_PRIVILEGES,
+  provisionBaseline,
+} from './provision-baseline.ts';
+
+describe('PROVISION_PRIVILEGES', () => {
+  test('is 27 privileges, sorted, unique and frozen', () => {
+    expect(PROVISION_PRIVILEGES).toHaveLength(27);
+    expect([...PROVISION_PRIVILEGES].sort()).toEqual([...PROVISION_PRIVILEGES]);
+    expect(new Set(PROVISION_PRIVILEGES).size).toBe(27);
+    expect(Object.isFrozen(PROVISION_PRIVILEGES)).toBe(true);
+  });
+
+  test('holds what the lane needs to repair its own baseline (role.ts: no lock-out)', () => {
+    for (const needed of [
+      'Sys.Modify', // the role
+      'Realm.AllocateUser', // the users
+      'User.Modify',
+      'Group.Allocate', // the mint group
+      'Permissions.Modify', // the grants, and reading them at all (acl.ts)
+    ]) {
+      expect(PROVISION_PRIVILEGES).toContain(needed);
+    }
+  });
+});
+
+describe('provisionBaseline', () => {
+  test('defaults: one role, one mint group, two lanes bound on /', () => {
+    const baseline = provisionBaseline();
+    expect(baseline.role).toEqual({ privs: PROVISION_PRIVILEGES, roleid: 'HfProvisioner' });
+    expect(baseline.group).toEqual({ comment: PROVISION_DEFAULTS.comment, groupid: 'hf-mint' });
+    expect(baseline.users.map((u) => [u.lane, u.userid, u.groups])).toEqual([
+      ['provision', 'hf-provision@pve', ['hf-mint']],
+      ['read', 'hf-read@pve', ['hf-mint']],
+    ]);
+    expect(baseline.grants).toEqual([
+      { lane: 'provision', roleid: 'HfProvisioner', userid: 'hf-provision@pve' },
+      { lane: 'read', roleid: 'PVEAuditor', userid: 'hf-read@pve' },
+    ]);
+  });
+
+  test('a site passes its own names; an explicit undefined is the default', () => {
+    const baseline = provisionBaseline({
+      mintGroup: 'mint',
+      provisionUser: 'provisioner@pve',
+      readRole: 'Auditor',
+      readUser: 'auditor@pve',
+      role: undefined,
+    });
+    expect(baseline.role.roleid).toBe('HfProvisioner');
+    expect(baseline.grants.map((g) => `${g.userid} ${g.roleid}`)).toEqual([
+      'provisioner@pve HfProvisioner',
+      'auditor@pve Auditor',
+    ]);
+    expect(baseline.users.every((u) => u.groups.join() === 'mint')).toBe(true);
+  });
+
+  test('readUser null is a baseline with no read lane', () => {
+    const baseline = provisionBaseline({ readUser: null });
+    expect(baseline.users.map((u) => u.lane)).toEqual(['provision']);
+    expect(baseline.grants.map((g) => g.lane)).toEqual(['provision']);
+  });
+
+  test('refuses, all at once, every name that would need quoting or is not PVE-shaped', () => {
+    const attempt = () =>
+      provisionBaseline({
+        comment: "it's",
+        mintGroup: 'a b',
+        provisionUser: 'no-realm',
+        readRole: 'x;rm',
+        readUser: 'q{}@pve',
+        role: '$(id)',
+      });
+    expect(attempt).toThrow(/role `\$\(id\)`.*mintGroup `a b`.*readRole `x;rm`/);
+    expect(attempt).toThrow(/provisionUser `no-realm`.*readUser `q\{\}@pve`.*comment/);
+  });
+
+  test('refuses one user for both lanes', () => {
+    expect(() => provisionBaseline({ readUser: 'hf-provision@pve' })).toThrow(/one user/);
+  });
+});