@homeflare/alchemy 0.11.0 → 0.12.0

package/dist/openbao/mount.d.ts

@@ -6,7 +6,7 @@
  *   in OpenBao, not Alchemy state.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  *
  * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
  *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new

package/dist/openbao/pki-role.d.ts

@@ -36,7 +36,7 @@
  *   never a policy one — but neither is a measurement.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/policy.d.ts

@@ -15,8 +15,8 @@ import type * as HttpClient from 'effect/unstable/http/HttpClient';
  * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
  *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
  *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
- *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
- *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   estate's state store is the `alchemy` Postgres database, which a nightly job dumps
+ *   (it enumerates EVERY non-template database), copies to a backup guest, and PBS backs up
  *   from there. A KV value here would exist in four places, none of them OpenBao.
  *
  *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a

package/dist/openbao/proxmox-role-form.d.ts

@@ -1,5 +1,5 @@
 export interface BaoProxmoxRoleProps {
-    /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+    /** Mount path of the proxmox secrets engine, e.g. `proxmox-c1`. A trailing slash is fine. */
     mount: string;
     /**
      * Role name, as `<mount>/roles/<name>` takes it.
@@ -61,7 +61,7 @@ export interface BaoProxmoxRoleAttributes {
     /** SHA-256 of the managed fields — safe to persist; see policy.ts. */
     digest: string;
 }
-/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+/** `proxmox-c1/roles/read` — read, write and delete all address the role here. */
 export declare const rolePath: (mount: string, name: string) => string;
 export declare const attributesOf: (props: Pick<BaoProxmoxRoleProps, 'mount' | 'name'>, live: Record<string, unknown>) => BaoProxmoxRoleAttributes;
 /**

package/dist/openbao/proxmox-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,8FAA8F;IAC9F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,mFAAmF;AACnF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}
+{"version":3,"file":"proxmox-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/proxmox-role-form.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,kFAAkF;AAClF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAE7F,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,wBAYF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,UACb,mBAAmB,KACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAWzE,CAAC;AAaF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WACjB,MAAM,YACJ,MAAM,uBACK,MAAM,GAAG,SAAS,KACtC,MAAM,GAAG,SAIyF,CAAC;AAEtG,gGAAgG;AAChG,eAAO,MAAM,OAAO,eAAgB,wBAAwB,SAAS,mBAAmB,YAG9C,CAAC"}

package/dist/openbao/proxmox-role.d.ts

@@ -3,20 +3,20 @@
  * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
  *
  * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
- *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
- *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
- *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
- *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On C1, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!inventory-sync, agent@pve!executor,
+ *   metrics@pve!exporter, app@pve!app, iac@pve!ro, iac@pve!apply and
+ *   mint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
  *   being a 5-minute lease instead of a forever key.
  *
- *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   The seventh cannot be. mint@pve!engine is the credential the ENGINE ITSELF
  *   authenticates with in order to mint anything at all: the thing that issues short-lived
  *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
  *   permanent, which makes it the single most valuable token on the cluster and the one whose
  *   rotation must be a deliberate, hand-run procedure rather than a plan.
  *
- *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
- *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   MEASURED here: `bao read proxmox-c1/config` returns parent_token_id
+ *   `mint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
  *   own key, present and, by the schema's own "Write-only: never returned by a read", not
  *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
  *   the PVE API in this session.
@@ -27,13 +27,13 @@
  *
  * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
  *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
- *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
- *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   values rather than encrypting them) into the `alchemy` Postgres, which a nightly job dumps
+ *   to a backup guest, from where PBS backs it up. A minted token declared as a resource would
  *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
  *   the DOOR; walking through it is a runtime call, not a plan.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
- *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/ssh-role.d.ts

@@ -4,8 +4,8 @@
  * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
  *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
  *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
- *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
- *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and a nightly job
+ *   dumps it to a backup guest. A CA key there would outlive the vault that guards it. This
  *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
  *
  * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
@@ -29,7 +29,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
  *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/proxmox/acl.d.ts

@@ -36,14 +36,14 @@ import { type PveRequirements, type WithTarget } from './resource.ts';
 export type AclSubjectType = 'user' | 'group' | 'token';
 export interface AclProps extends WithTarget {
     /**
-     * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+     * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
      * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
      *   word, so this file does too rather than renaming a field the cluster calls `path`.
      */
     path: string;
     /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
     type: AclSubjectType;
-    /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+    /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
     ugid: string;
     /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
     roleid: string;

package/dist/proxmox/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/proxmox/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAiB,MAAM,eAAe,CAAC;AAErF,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,cAAc,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ,CAC1C,aAAa,EACb,QAAQ,EACR,aAAa,EACb,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,UAAU,6CAAsC,CAAC;AAmH9D,eAAO,MAAM,kBAAkB,gIAqE5B,CAAC"}

package/dist/proxmox/api-token-form.d.ts

@@ -12,7 +12,7 @@ import type { ApiTokenAttributes, ApiTokenProps } from './api-token.ts';
  *
  * ⛔ THE WRITE SEMANTICS BELOW ARE READ FROM THE CLUSTER'S OWN PERL RATHER THAN INFERRED FROM THE
  *   API SCHEMA — `/usr/share/perl5/PVE/API2/User.pm`, subs `generate_token` and
- *   `update_token_info`, read over SSH on n2 on 2026-09-13. The two disagree in exactly the place
+ *   `update_token_info`, read over SSH on node-b on 2026-09-13. The two disagree in exactly the place
  *   that costs a forever-diff: the schema gives `expire` the default "same as user", and the code
  *   never implements it. api-token.ts records what that means.
  */
@@ -24,7 +24,7 @@ import type { PveSpec } from './resource.ts';
  *   `ugid`, so reporting it as an attribute is what lets a privilege-separated token be granted
  *   anything at all without somebody retyping the join by hand.
  *
- * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/monitoring@pve/token/exporter` answers
+ * ⚠️ DERIVED, NOT READ. MEASURED: `GET /access/users/metrics@pve/token/exporter` answers
  *   `{"expire":0,"privsep":0}` and echoes back neither half of its own identity. So this is built
  *   from props, cannot disagree with the path the read used, and is therefore true by
  *   construction — which is why it is reported and never compared.

package/dist/proxmox/api-token.d.ts

@@ -2,11 +2,11 @@
  * `Proxmox.ApiToken` — a PVE API token: the thing a service actually authenticates as.
  *
  * ⛔ THE SECRET EXISTS FOR ONE HTTP RESPONSE AND THEN NOWHERE. MEASURED from the cluster's own
- *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13): POST returns
+ *   schema (`/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13): POST returns
  *   `["full-tokenid","info","value"]`; PUT returns `["comment","expire","full-tokenid","privsep",
  *   "value"]` with `value` present ONLY when `regenerate` was set; GET returns
  *   `["comment","expire","privsep"]` and never the secret. A live token agrees —
- *   `GET /access/users/monitoring@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
+ *   `GET /access/users/metrics@pve/token/exporter` answers `{"expire":0,"privsep":0}`. PVE says
  *   it plainly on the POST: the value "needs to be stored as it cannot be retrieved afterwards".
  *
  * ⛔ SO A TOKEN THIS RESOURCE CREATES IS UNUSABLE, AND SAYING SO IS THE POINT OF THIS BLOCK. The
@@ -19,7 +19,7 @@
  *   ★ SO POINT THIS FAMILY AT TOKENS THAT ALREADY EXIST. `comment`, `expire` and `privsep` are the
  *     whole of a token's policy, and declaring them is real work: it is how `expire` stops being
  *     whatever somebody typed in 2024. Mint NEW tokens where the secret can be caught — OpenBao's
- *     `proxmox-tb4` mount, or a human at `pveum user token add`.
+ *     `proxmox-c1` mount, or a human at `pveum user token add`.
  *   ⚠️ THE CREATE PATH IS LEFT REACHABLE RATHER THAN STUBBED. A create that silently did nothing
  *     would be the same lie as the stubbed delete resource.ts's ★ refuses; the honest arrangement
  *     is a create that works and a header that says what it produces.
@@ -31,8 +31,8 @@
  *   that owns the lease, or to a human who is watching.
  *
  * ⚠️ THERE IS A SECOND WRITER TO THESE OBJECTS AND IT IS THE ONE THIS PROVIDER RUNS ON. OpenBao's
- *   `proxmox-tb4` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
- *   `house/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
+ *   `proxmox-c1` engine mints PVE tokens under `hf-read@pve` and `hf-provision@pve` — read from
+ *   `<estate>/platform/secrets/vault/plugin-proxmox/proxmox/`: `privsep=0` (client.go), `expire` set
  *   to the lease deadline, and an id the plugin CHOOSES,
  *   `hf-<role>-<actor>-<entity6>-<stamp>-<nonce>` (tokenname.go). Revocation and WAL rollback look
  *   up that one exact id (wal.go); neither sweeps a prefix. So the two systems cannot collide on
@@ -59,7 +59,7 @@ import * as Provider from 'alchemy/Provider';
 import { type PveRequirements, type WithTarget } from './resource.ts';
 export interface ApiTokenProps extends WithTarget {
     /**
-     * The account that owns the token, realm-qualified: `tofu@pve`, `root@pam`. Identity.
+     * The account that owns the token, realm-qualified: `iac@pve`, `root@pam`. Identity.
      *
      * ⚠️ THE ACCOUNT MUST ALREADY EXIST. Every method here runs `check_user_exist` first, so a
      *   token named under a missing user fails the READ (folded to "absent") and then fails the
@@ -117,7 +117,7 @@ export interface ApiTokenProps extends WithTarget {
      *   — `$privsep = $privsep ? 1 : 0` (AccessControl.pm:1622), so there is no unset state to
      *   preserve. Were this optional, adopting a live token without mentioning `privsep` would plan
      *   an update to 1 and STRIP a working credential of every privilege it has, silently: PVE
-     *   returns 401/403 to the service, nothing errors here, and `tofu@pve!apply` simply stops
+     *   returns 401/403 to the service, nothing errors here, and `iac@pve!apply` simply stops
      *   working. Required, so adopting a token is a sentence that states what it is.
      * ⚠️ AND `false` IS NOT A SHRUG. It is a token with its owner's whole privilege set; under a
      *   provisioning account that is the account's full authority with a separate secret.
@@ -139,9 +139,9 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
  * ★ `retain` BY DEFAULT, AND THIS IS THE PLAINEST CASE FOR IT IN THE PACKAGE. A token's contents
  *   are one irreplaceable secret: delete it and the value is gone, a replacement is a DIFFERENT
  *   value, and every holder loses access the instant `cfs_write_file` returns — with no error
- *   raised anywhere near them. The live cluster's tokens are `monitoring@pve!exporter` (the PVE
- *   exporter feeding VictoriaMetrics), `mcp@pve!executor`, `tofu@pve!apply`, `tofu@pve!ro`,
- *   `sablier@pve!sablier` and `vaultmint@pve!engine` — the last being the parent credential the
+ *   raised anywhere near them. The live cluster's tokens are `metrics@pve!exporter` (the PVE
+ *   exporter feeding VictoriaMetrics), `agent@pve!executor`, `iac@pve!apply`, `iac@pve!ro`,
+ *   `app@pve!app` and `mint@pve!engine` — the last being the parent credential the
  *   OpenBao mount itself authenticates with, so orphaning that one would stop every plan in this
  *   package, this resource included. `delete` is FULLY IMPLEMENTED (DELETE is a real method on
  *   this path, measured) and runs the moment a caller opts in with `.pipe(RemovalPolicy.destroy())`.
@@ -150,7 +150,7 @@ export interface ProxmoxApiToken extends Resource<'Proxmox.ApiToken', ApiTokenPr
 export declare const ProxmoxApiToken: import("alchemy").ResourceClass<ProxmoxApiToken>;
 /**
  * ⛔ `list` IS EMPTY, AND FOR THIS FAMILY THAT MATTERS MORE THAN THE GENERIC ARGUMENT IN
- *   resource.ts. A token index handed to Alchemy would offer up `vaultmint@pve!engine` and every
+ *   resource.ts. A token index handed to Alchemy would offer up `mint@pve!engine` and every
  *   live OpenBao lease for adoption — and adoption is what makes a later plan willing to delete.
  *   The mount's leases in particular appear and vanish on their own; anything that adopted one
  *   would report drift against a credential that was never its to hold.

package/dist/proxmox/ceph-daemon-form.d.ts

@@ -9,7 +9,7 @@
  *   here decides a diff; `findRow` picks a row out of an answer its caller already fetched.
  *
  * ⛔ THE TWO PATHS ARE DIFFERENT AND THAT IS THE WHOLE REASON THIS FILE HAS TWO OF THEM. MEASURED
- *   on n2, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/n2/ceph/mon/n2` answers
+ *   on node-b, 2026-09-13: there is no GET on the id path — `pvesh get /nodes/node-b/ceph/mon/node-b` answers
  *   "No 'get' handler defined" — while POST and DELETE are registered ONLY there. So the read uses
  *   `collectionPath` and the two writes use `daemonPath`, and swapping either one is a silent
  *   501: a create that never lands, or a destroy that reports failure while the daemon runs on.
@@ -38,8 +38,8 @@ import type { CephDaemonProps } from './ceph-daemon.ts';
 export declare const daemonId: (props: CephDaemonProps) => string;
 /**
  * The read path. ⚠️ `{node}` HERE IS ONLY THE NODE BEING ASKED, not a filter. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2 against [n3,n2,n4] from n3. A caller that took
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b against [node-c,node-b,node-d] from node-c. A caller that took
  *   row zero, or assumed the list was this node's daemons, would be wrong on both counts.
  */
 export declare const collectionPath: (props: CephDaemonProps) => string;

package/dist/proxmox/ceph-daemon.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephDaemon` — a Ceph monitor, manager or metadata server on one node.
  *
  * ★ ONE RESOURCE FOR THREE KINDS, AND THE SCHEMAS WERE CHECKED BEFORE THAT WAS DECIDED. Parsed
- *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on n2, 2026-09-13: mon, mgr and mds each
+ *   from `/usr/share/pve-docs/api-viewer/apidoc.js` on node-b, 2026-09-13: mon, mgr and mds each
  *   expose GET on the collection and POST + DELETE on the id below it, each returns
  *   name/host/state/addr/ceph_version*, and the only divergence is the create parameter
  *   (`mon-address` / none / `hotstandby`) and the read-only extras (mon: quorum, rank; mds: rank,
@@ -10,11 +10,11 @@
  *   times over and let them drift — the argument resource.ts already makes for the factory itself.
  *
  * ⛔ THE ONLY GET IS THE COLLECTION'S, AND IT ANSWERS FOR THE WHOLE CLUSTER. MEASURED:
- *   `GET /nodes/n2/ceph/mon` returns n2, n3 AND n4, and `GET /nodes/n3/ceph/mon` returns the same
- *   three IN A DIFFERENT ORDER — [n4,n2,n3] from n2, [n3,n2,n4] from n3 — so a row is found by
+ *   `GET /nodes/node-b/ceph/mon` returns node-b, node-c AND node-d, and `GET /nodes/node-c/ceph/mon` returns the same
+ *   three IN A DIFFERENT ORDER — [node-d,node-b,node-c] from node-b, [node-c,node-b,node-d] from node-c — so a row is found by
  *   `name` and NEVER by position, and the `{node}` in the path is only the node being ASKED.
- *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/n2/ceph/mon/n2` answers
- *   "No 'get' handler defined for '/nodes/n2/ceph/mon/n2'", and mgr and mds answer the same.
+ *   MEASURED too: there is no GET on the id path at all; `pvesh get /nodes/node-b/ceph/mon/node-b` answers
+ *   "No 'get' handler defined for '/nodes/node-b/ceph/mon/node-b'", and mgr and mds answer the same.
  *   That is why `path()` below is the COLLECTION, and that in turn is why `delete` is the one
  *   handler this file writes by hand: `pveOperations.destroy` sends its DELETE to `spec.path`,
  *   which here would be the collection — a 501 reported as a failed destroy, with the daemon still
@@ -27,11 +27,11 @@
  *   strips its section from ceph.conf. THREE MONS TOLERATE ONE LOSS; TWO TOLERATE NONE. Removing
  *   two in one deploy — or removing the mon on the node whose API is serving the call — loses
  *   quorum, and a cluster without mon quorum BLOCKS every RBD and CephFS I/O rather than erroring
- *   it, so on this cluster every guest on `cephtb4` hangs.
+ *   it, so on this cluster every guest on `rbd-c1` hangs.
  *   `mds`: destroying a STANDBY is a non-event; destroying the ACTIVE one fails CephFS over,
- *   and with no standby left `cephfs-tb4` goes unavailable. `mgr`: no guest I/O depends on it, but
+ *   and with no standby left `cephfs-c1` goes unavailable. `mgr`: no guest I/O depends on it, but
  *   the last one takes the PG autoscaler, the dashboard and PVE's own Ceph status with it.
- *   Live on 2026-09-13: mon, mgr AND mds on each of n2, n3, n4.
+ *   Live on 2026-09-13: mon, mgr AND mds on each of node-b, node-c, node-d.
  *
  * ★ AND THE ONLY WAY TO REACH THAT DESTROY IS TO DELETE THE DECLARATION. `matches` is deliberately
  *   total (see its ⛔), so this resource CANNOT plan a `replace` — which is the one action that
@@ -41,7 +41,7 @@
  *   `Sys.Audit`/`Datastore.Audit` on `/`, and PVEAuditor holds both (MEASURED:
  *   `GET /access/roles/PVEAuditor`), so the mount's `read` role can see this family — unlike
  *   `Proxmox.Storage`, which 403s under that lease. POST and DELETE both check `Sys.Modify` on
- *   `/`, and MEASURED on this cluster `LXCProvisioner` already holds it, so the provision lane
+ *   `/`, and MEASURED on this cluster the provision role already held it (it is in `PROVISION_PRIVILEGES`), so the provision lane
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
@@ -80,9 +80,9 @@ export interface CephDaemonProps extends WithTarget {
     name?: string;
     /**
      * mon only. Overrides the autodetected monitor IP; must sit in Ceph's public network — on this
-     * cluster that is 10.20.11.0/24, carried by `vmbr1.11`.
+     * cluster that is 198.51.100.0/24, carried by `vmbr1.42`.
      * ⛔ CREATE-ONLY AND NEVER COMPARED. PVE takes a bare ip-list on write and hands back `addr` as
-     *   `10.20.11.12:6789/0` — an address, a port and a nonce. The two are not the same string and
+     *   `198.51.100.12:6789/0` — an address, a port and a nonce. The two are not the same string and
      *   never will be, so diffing them would report a mismatch on every plan; with no PUT on this
      *   family that mismatch becomes a REPLACE, and a replace of a mon is the quorum loss in the
      *   header. Left out of `matches` on purpose.
@@ -92,7 +92,7 @@ export interface CephDaemonProps extends WithTarget {
      * mds only. Makes this standby replay the active MDS's journal for a faster failover.
      * ⛔ CREATE-ONLY AND NEVER COMPARED, AND THE FIELD THAT LOOKS LIKE ITS READBACK IS NOT ONE.
      *   `standby_replay` in the list is the daemon's CURRENT state, not its configuration: MEASURED
-     *   2026-09-13, all three mds report `standby_replay: false`, n3 included — and n3 is the ACTIVE
+     *   2026-09-13, all three mds report `standby_replay: false`, node-c included — and node-c is the ACTIVE
      *   mds, which is not a standby at all and so can never report true however it was created.
      *   Comparing `hotstandby` to it would plan a replace against whichever mds Ceph happens to have
      *   elected, i.e. against a value no declaration controls.
@@ -121,22 +121,22 @@ export interface CephDaemonAttributes {
     host: string;
     /**
      * mon `running`/`stopped`/`unknown`, mgr `active`/`standby`, mds `up:active`/`up:standby`/…
-     * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr n2 is
-     *   `active` while n3 and n4 are `standby`; mds n3 is `up:active` while n2 and n4 are
+     * ⛔ CEPH ELECTS THIS AND REWRITES IT WITHOUT ANYONE DECLARING ANYTHING. MEASURED: mgr node-b is
+     *   `active` while node-c and node-d are `standby`; mds node-c is `up:active` while node-b and node-d are
      *   `up:standby`. Restart a daemon and the roles move. It is reported so a plan can show what is
      *   live and kept out of `matches` so that an election is never a diff.
      * ⚠️ IT ALSO MEANS THIS RESOURCE DOES NOT MANAGE WHETHER THE DAEMON IS RUNNING. A configured but
      *   stopped daemon is still a row in the list, so it reads as present and plans `noop`.
      */
     state: string;
-    /** Ceph-formatted, e.g. `10.20.11.12:6789/0`. Reported; see `mon-address` for why never compared. */
+    /** Ceph-formatted, e.g. `198.51.100.12:6789/0`. Reported; see `mon-address` for why never compared. */
     addr: string;
     /** `ceph_version_short`, e.g. `20.2.2`. Reported: a straggler after an upgrade is worth seeing. */
     version: string;
     /**
      * mon rank in the monmap, mds rank in the filesystem, `-1` when the daemon has neither.
-     * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked n4=0, n3=1, n2=2 —
-     *   monmap order, not declaration order — and the mds ranks are 0 for the active n3 and -1 for
+     * ⛔ CEPH ASSIGNS IT AND NOTHING DECLARES IT. MEASURED: the mons are ranked node-d=0, node-c=1, node-b=2 —
+     *   monmap order, not declaration order — and the mds ranks are 0 for the active node-c and -1 for
      *   the two standbys. Rank moves when a daemon is added, removed or restarted.
      */
     rank: number;
@@ -145,8 +145,8 @@ export interface CephDaemonAttributes {
     /** mds only, and NOT the readback of `hotstandby` — see the ⛔ on that prop. */
     standbyReplay: boolean;
     /**
-     * mds only: the CephFS this daemon currently serves — `cephfs-tb4` here.
-     * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: n3 carries `fs_name`, n2 and n4 have no such key
+     * mds only: the CephFS this daemon currently serves — `cephfs-c1` here.
+     * ⛔ PRESENT ONLY ON THE ACTIVE MDS. MEASURED: node-c carries `fs_name`, node-b and node-d have no such key
      *   at all. So it is empty for two of three identical declarations, and comparing it would
      *   report work on exactly the daemons that are healthy standbys.
      */

package/dist/proxmox/ceph-daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AA+CH,eAAO,MAAM,yBAAyB,uIAoBnC,CAAC"}
+{"version":3,"file":"ceph-daemon.d.ts","sourceRoot":"","sources":["../../src/proxmox/ceph-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,IAAI,EAAE,cAAc,CAAC;IACrB;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AA+CH,eAAO,MAAM,yBAAyB,uIAoBnC,CAAC"}

package/dist/proxmox/ceph-flag.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFlag` — one cluster-wide Ceph OSD flag, declared: `noout`, `pause`, `norebalance`.
  *
  * ★ ONE RESOURCE PER FLAG, NOT ONE CARRYING ALL ELEVEN, AND THE CLUSTER'S OWN API DECIDED IT.
- *   MEASURED on TB4 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
+ *   MEASURED on C1 2026-09-13 (pve-manager 9.2.11, ceph tentacle 20.2.2) by reading
  *   `/usr/share/perl5/PVE/API2/Cluster/Ceph.pm` and the published schema in
  *   `/usr/share/pve-docs/api-viewer/apidoc.js`:
  *     · `PUT /cluster/ceph/flags` ends in `fork_worker('cephsetflags', ...)` and returns a STRING
@@ -30,7 +30,7 @@
  *     defaulting to false would make `CephFlag('noout', { flag: 'noout', target })` mean "clear
  *     it" — the dangerous direction, chosen by OMISSION. Here the dangerous sentence has to be
  *     typed out by a person. Do not add a default, and do not declare a flag merely to document
- *     that it is off: MEASURED 2026-09-13, all eleven flags on TB4 read 0, so eleven
+ *     that it is off: MEASURED 2026-09-13, all eleven flags on C1 read 0, so eleven
  *     `value: false` lines would plan green forever and do nothing except take the brake off
  *     whenever somebody happens to apply them.
  *
@@ -58,8 +58,8 @@
  *   and plans `noop` straight past it. It cannot express a half-pause, so never use it to prove
  *   one is gone; `ceph osd dump | head -1` can.
  *   ⛔ `pause` AND `noup` ARE ALSO THE TWO THAT TAKE THE CLUSTER DOWN FROM A TYPO. `pause: true`
- *     stops all reads and writes, so every guest on `cephtb4` — the cluster's only rbd pool,
- *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-tb4`. `noup: true`
+ *     stops all reads and writes, so every guest on `rbd-c1` — the cluster's only rbd pool,
+ *     MEASURED 2026-09-13 — freezes on its root disk, and so does `cephfs-c1`. `noup: true`
  *     stops a rebooted OSD from ever rejoining. Neither is undone by deleting the line.
  *
  * ⚠️ PRIVILEGES, AND THE WRITE ONE IS A BIG ASK. Both GETs check `Sys.Audit` on `/`; both PUTs
@@ -80,7 +80,7 @@ import { type PveRequirements, type WithTarget } from './resource.ts';
  *
  * ⚠️ THE ENUM IS CLOSED AND A TYPO IS A 400, WHICH IS WHY THIS IS A UNION AND NOT `string`. Both
  *   the GET and the PUT declare `additionalProperties => 0` over exactly this list.
- * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on TB4:
+ * ⚠️ CEPH HAS FLAGS PVE DOES NOT MODEL, and four of them are always on. MEASURED on C1:
  *   `ceph osd dump` reports `flags sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit`.
  *   PVE reads that same string and answers only about its own eleven, so the others can neither
  *   leak in here nor be set from here — `noautoscale` and `nosnaptrim` included.

package/dist/proxmox/ceph-fs-wire.d.ts

@@ -16,7 +16,7 @@
  *
  * ⛔ POST AND DELETE ANSWER WITH A UPID, NOT A RESULT — THE WRITE IS ASYNCHRONOUS AND A FAILED ONE
  *   IS STILL HTTP 200. Read from the cluster's own source, /usr/share/perl5/PVE/API2/Ceph/FS.pm on
- *   n2: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
+ *   node-b: `createfs` and `destroyfs` both end `return $rpcenv->fork_worker(...)`. Two different lies
  *   come out of trusting that status code. A read-back straight after the POST reports "still
  *   absent" about a filesystem that is being built as it says so — which is precisely the message
  *   `pveOperations.reconcile` would print, pointing at the wrong cause. And a worker that dies
@@ -26,7 +26,7 @@
  *     has not been observed; only the `fork_worker` that guarantees it is there.
  *
  * ⛔ A DELETE BODY IS SILENTLY DISCARDED BY PVE, SO `remove-pools` GOES IN THE QUERY STRING.
- *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on n2: line 928 reads the request
+ *   MEASURED in /usr/share/perl5/PVE/APIServer/AnyEvent.pm on node-b: line 928 reads the request
  *   content into params only `if ($method eq 'PUT' || $method eq 'POST')`, and line 1653 sends
  *   every other method down a branch that parses `$request->url->query()` and nothing else. So
  *   `pve(target, role, 'DELETE', path, form)` would send a body PVE never looks at: the flags would
@@ -41,7 +41,7 @@
  * ⛔ THE POLLER IS NEVER THE TASK'S OWNER, WHICH COSTS A PRIVILEGE, AND THIS ONE IS MEASURED
  *   RATHER THAN FEARED. client.ts mints a fresh credential per call and the mount vends a NEW
  *   token id each time, so the token reading the status is never the token recorded in the UPID —
- *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on n2, `$check_task_user`:
+ *   and PVE compares them exactly. /usr/share/perl5/PVE/API2/Tasks.pm on node-b, `$check_task_user`:
  *   `return $user eq $fulltoken || $user eq $task->{user};`, above it the comment "token only sees
  *   token tasks, user sees user + token tasks". Token B of the same user matches neither branch.
  *   So the fallback is the schema's other clause for `GET /nodes/{node}/tasks/{upid}/status`: "The
@@ -75,8 +75,8 @@ export declare const createForm: (props: CephFsProps) => Record<string, string>;
  *
  * ⚠️ A CREATE NEEDS A RUNNING *AND* A STANDBY MDS, and refuses BEFORE it forks -- "no running
  *   Metadata Server (MDS) found!" / "no standby Metadata Server (MDS) found!" are synchronous, so
- *   they surface as a failed POST rather than as a silent worker. TB4 has three (MEASURED: n3
- *   `up:active` for cephfs-tb4, n2 and n4 `up:standby`), so this is a note for a smaller cluster.
+ *   they surface as a failed POST rather than as a silent worker. C1 has three (MEASURED: node-c
+ *   `up:active` for cephfs-c1, node-b and node-d `up:standby`), so this is a note for a smaller cluster.
  * ⚠️ BOTH WRITES CHECK `Sys.Modify` ON `/` -- the root, with the breadth metric-server.ts warns
  *   about: granting it buys datacenter options and every other cluster-wide config write too.
  */

package/dist/proxmox/ceph-fs.d.ts

@@ -2,7 +2,7 @@
  * `Proxmox.CephFs` — a CephFS on the cluster's own Ceph. The filesystem a `cephfs` storage mounts.
  *
  * ⛔ A REPLACE OF THIS RESOURCE DESTROYS A LIVE FILESYSTEM, AND THERE IS NO PUT TO SAVE YOU FROM
- *   IT. MEASURED from the published schema on n2, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has
+ *   IT. MEASURED from the published schema on node-b, 2026-09-13: `/nodes/{node}/ceph/fs/{name}` has
  *   exactly two methods, POST and DELETE. A CephFS cannot be edited in place, so `updateForm` is
  *   left undefined and anything the factory can see as changed becomes a REPLACE — and Alchemy's
  *   replace is create-then-delete, where the delete is `destroyfs`: the entry leaves the MDS map,
@@ -12,9 +12,9 @@
  *     one it is a live filesystem destroyed on every deploy, forever, because a background daemon
  *     moved a number nobody declared.
  *
- * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on n2:
- *     pvesh get /nodes/n2/ceph/fs/cephfs-tb4
- *       -> No 'get' handler defined for '/nodes/n2/ceph/fs/cephfs-tb4'
+ * ⛔ THERE IS NO SINGLE-OBJECT READ, WHICH INVERTS `path` AND `collection`. MEASURED on node-b:
+ *     pvesh get /nodes/node-b/ceph/fs/cephfs-c1
+ *       -> No 'get' handler defined for '/nodes/node-b/ceph/fs/cephfs-c1'
  *   `GET /nodes/{node}/ceph/fs` is a directory index and is the only read there is, so `path()`
  *   below returns the INDEX and `attributes` picks this filesystem out of the array client-side —
  *   the shape acl.ts uses for the one flat `GET /access/acl`. The POST goes to the `{name}` path,
@@ -28,9 +28,9 @@
  *
  * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.
  *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either
- *   exists ("ceph pools '…_data' and/or '…_metadata' already exist"). MEASURED on TB4: the live
- *   `cephfs-tb4` owns `cephfs-tb4_data` (id 6) and `cephfs-tb4_metadata` (id 7), both of which
- *   `GET /nodes/n2/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES
+ *   exists ("ceph pools '…_data' and/or '…_metadata' already exist"). MEASURED on C1: the live
+ *   `cephfs-c1` owns `cephfs-c1_data` (id 6) and `cephfs-c1_metadata` (id 7), both of which
+ *   `GET /nodes/node-b/ceph/pool` lists like any other pool — and `/nodes/{node}/ceph/pool/{name}` DOES
  *   have GET, PUT and DELETE, so a pool resource would be a clean `pveHandlers` fit and would
  *   adopt them without noticing. Declaring both is double management of one object: whichever
  *   reconciles first wins, and the loser either fails its create or PUTs `size`/`pg_num` onto pools
@@ -38,16 +38,16 @@
  *
  * ⚠️ `add-storage` IS A SECOND SIDE EFFECT AND IT LANDS IN storage.cfg. Set, `createfs` also calls
  *   `PVE::API2::Storage::Config->create` with type `cephfs`, content `backup,iso,vztmpl` and
- *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on n2 holds exactly that — `cephfs:
- *   cephfs-tb4` / `content backup,vztmpl,iso` / `fs-name cephfs-tb4`. So a `Proxmox.Storage`
- *   declaring `cephfs-tb4` would be managing an entry this resource created. Declare ONE of them:
+ *   `fs-name <name>`. MEASURED: /etc/pve/storage.cfg on node-b holds exactly that — `cephfs:
+ *   cephfs-c1` / `content backup,vztmpl,iso` / `fs-name cephfs-c1`. So a `Proxmox.Storage`
+ *   declaring `cephfs-c1` would be managing an entry this resource created. Declare ONE of them:
  *   either `add-storage` here and no storage resource, or `add-storage` off and a
  *   `Proxmox.Storage` that reads this resource's `name` attribute — which also gets the ordering
  *   right for free, because Alchemy orders by data flow.
  *
  * ⚠️ `node` IS A ROUTE, NOT IDENTITY, AND MUST NEVER BE DIFFED. A CephFS is cluster-wide; the node
- *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/n2/ceph/fs`,
- *   `…/n3/…` and `…/n4/…` returned the byte-identical array. So changing `node` plans `noop`, and
+ *   in the path only says which node PVE proxies the call to. MEASURED: `GET /nodes/node-b/ceph/fs`,
+ *   `…/node-c/…` and `…/node-d/…` returned the byte-identical array. So changing `node` plans `noop`, and
  *   two resources naming the same `name` on different nodes are the SAME filesystem — the vmid
  *   hazard from lxc.ts, with a filesystem on the end of it instead of a container.
  *
@@ -72,11 +72,11 @@ export interface CephFsProps extends WithTarget {
      * this is under 32. PVE's default is 128.
      *
      * ⛔ CREATE-TIME ONLY, UNREADABLE, AND OWNED BY THE AUTOSCALER FROM THE SECOND IT LANDS. It is
-     *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. TB4's
-     *   `cephfs-tb4` was created with the default 128 (the arithmetic proves it: `cephfs-tb4_metadata`
-     *   sits at 32, which is 128/4), and `cephfs-tb4_data` reads pg_num 32 TODAY. The autoscaler moved
+     *   never compared — see the ⛔ on `matches` — and this is not caution, it is measured. C1's
+     *   `cephfs-c1` was created with the default 128 (the arithmetic proves it: `cephfs-c1_metadata`
+     *   sits at 32, which is 128/4), and `cephfs-c1_data` reads pg_num 32 TODAY. The autoscaler moved
      *   it by a factor of four, and it is not finished: `pg_autoscale_mode` is `on` for every pool on
-     *   this cluster and `cephfs-tb4_metadata` already reports `pg_num_final: 16` against its live 32.
+     *   this cluster and `cephfs-c1_metadata` already reports `pg_num_final: 16` against its live 32.
      */
     pg_num?: number;
     /**

package/dist/proxmox/ceph-osd-tree.d.ts

@@ -11,13 +11,13 @@
  *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.
  *
  * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.
- *   MEASURED 2026-09-13: asked of n2 it answers `{"flags":…,"root":{"children":[…]}}` whose
- *   leaves include osd.0 and osd.5 on n4; asked of n3 it answers the identical six leaves. The
+ *   MEASURED 2026-09-13: asked of node-b it answers `{"flags":…,"root":{"children":[…]}}` whose
+ *   leaves include osd.0 and osd.5 on node-d; asked of node-c it answers the identical six leaves. The
  *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as "the
- *   OSDs on this node" would find osd.0 through n2 and then report it as living there.
+ *   OSDs on this node" would find osd.0 through node-b and then report it as living there.
  *
  * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.
- *   MEASURED: `GET /nodes/n2/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
+ *   MEASURED: `GET /nodes/node-b/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
  *   `[{"name":"metadata"},{"name":"lv-info"}]` — byte for byte what `…/osd/2` answers for a real
  *   one. It is a directory index (its schema says `permissions: {"user":"all"}`), not a read of
  *   the OSD. Point `PveSpec.path` at it and every declared OSD is "present": `diff` reports
@@ -25,18 +25,18 @@
  *   stops this package recording objects that do not exist — passes on an OSD that was never
  *   built. The only endpoint that can tell present from absent is the tree.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, `GET /nodes/n2/ceph/osd`. Six leaves, all `up` and `in`, Ceph
+ * ★ MEASURED ON C1 ON 2026-09-13, `GET /nodes/node-b/ceph/osd`. Six leaves, all `up` and `in`, Ceph
  *   20.2.2 tentacle:
  *
- *     id  name   host  device_class  crush_weight      reweight  pgs  status
- *     0   osd.0  n4    ssd           1.86299133300781  1          99  up
- *     5   osd.5  n4    ssd           1.86299133300781  1          94  up
- *     1   osd.1  n3    ssd           1.86299133300781  1          96  up
- *     4   osd.4  n3    ssd           1.81939697265625  1          97  up
- *     2   osd.2  n2    ssd           1.81939697265625  1          88  up
- *     3   osd.3  n2    ssd           1.81939697265625  1         105  up
+ *     id  name   host    device_class  crush_weight      reweight  pgs  status
+ *     0   osd.0  node-d  ssd           1.86299133300781  1          99  up
+ *     5   osd.5  node-d  ssd           1.86299133300781  1          94  up
+ *     1   osd.1  node-c  ssd           1.86299133300781  1          96  up
+ *     4   osd.4  node-c  ssd           1.81939697265625  1          97  up
+ *     2   osd.2  node-b  ssd           1.81939697265625  1          88  up
+ *     3   osd.3  node-b  ssd           1.81939697265625  1         105  up
  *
- *   `{ node: 'n2', osdid: 2, host: 'n2', device_class: 'ssd' }` plans `noop` against that row.
+ *   `{ node: 'node-b', osdid: 2, host: 'node-b', device_class: 'ssd' }` plans `noop` against that row.
  *   That is the acceptance test this file was written to pass.
  *
  * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the
@@ -63,8 +63,8 @@ type CrushNode = Record<string, unknown>;
 /**
  * Every OSD leaf under the tree root, at any depth.
  *
- * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. TB4 measures as
- *   root(`default`) -> host(n2|n3|n4) -> osd, but CRUSH admits datacenter, rack and chassis
+ * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. C1 measures as
+ *   root(`default`) -> host(node-b|node-c|node-d) -> osd, but CRUSH admits datacenter, rack and chassis
  *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching
  *   in as `root.children[].children[]` would read this cluster correctly and answer "absent" —
  *   i.e. "the replica is gone" — on the first cluster that has a rack in it.
@@ -128,7 +128,7 @@ export interface CephOsdAttributes {
  * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,
  *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS
  *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical
- *   on every OSD, and both latencies read 0 — TB4 was idle, so nothing was caught in the act. That
+ *   on every OSD, and both latencies read 0 — C1 was idle, so nothing was caught in the act. That
  *   these move is therefore REASONED, from what they count, not observed. Alchemy persists
  *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on
  *   every deploy and record a number that is stale by the time anybody reads it. What is kept is