@homeflare/alchemy 0.11.0 → 0.12.0

package/dist/proxmox/provision-cli-fake.d.ts

@@ -0,0 +1,38 @@
+export type CliUser = {
+    comment: string;
+    email: string;
+    enable: number;
+    expire: number;
+    firstname: string;
+    lastname: string;
+    groups: string[];
+};
+export type CliGrant = {
+    path: string;
+    type: string;
+    ugid: string;
+    roleid: string;
+    propagate: number;
+};
+export type CliState = {
+    roles: Record<string, string[]>;
+    groups: Record<string, {
+        comment: string;
+    }>;
+    users: Record<string, CliUser>;
+    acl: CliGrant[];
+};
+/** A cluster as PVE installs it: the built-in auditor role, and nothing of the baseline. */
+export declare const freshCluster: () => CliState;
+/** Every item GET the scripts and the providers make, keyed `access/…` without a leading slash. */
+export declare const apiView: (state: CliState) => Record<string, unknown>;
+export type ScriptRun = {
+    code: number;
+    stdout: string;
+    stderr: string;
+    writes: string[];
+    state: CliState;
+};
+/** Run `script` under `sh` against `state`, with the fakes first on PATH. */
+export declare const runScript: (script: string, state: CliState) => Promise<ScriptRun>;
+//# sourceMappingURL=provision-cli-fake.d.ts.map

package/dist/proxmox/provision-cli-fake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-cli-fake.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-cli-fake.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,OAAO,GAAG;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,EAAE,QAAQ,EAAE,CAAC;CACjB,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,YAAY,QAAO,QAc9B,CAAC;AAIH,mGAAmG;AACnG,eAAO,MAAM,OAAO,UAAW,QAAQ,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAsB/D,CAAC;AA0FF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,QAAQ,CAAC;CACjB,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,SAAS,WAAkB,MAAM,SAAS,QAAQ,KAAG,OAAO,CAAC,SAAS,CAkClF,CAAC"}

package/dist/proxmox/provision-declare.d.ts

@@ -0,0 +1,25 @@
+import * as Effect from 'effect/Effect';
+import { ProxmoxAcl } from './acl.ts';
+import type { PveTarget } from './credentials.ts';
+import { ProxmoxGroup } from './group.ts';
+import { type ProvisionNames } from './provision-baseline.ts';
+import { ProxmoxRole } from './role.ts';
+import { ProxmoxUser } from './user.ts';
+export interface DeclareProvisionOptions {
+    /** `true`/`false` pipe `adopt(…)` onto every resource; omitted, the deploy's policy decides. */
+    readonly adopt?: boolean;
+}
+/**
+ * The baseline for one cluster. `id` prefixes every logical id (`<id>-role`, `<id>-mint-group`,
+ * `<id>-provision-user`, `<id>-provision-grant`, and the `read` pair), so one stack can declare a
+ * baseline per cluster. `users` and `grants` come back in `baseline.users` / `baseline.grants`
+ * order: provision, then read. Fails, before declaring anything, on a name the baseline refuses.
+ */
+export declare const declareProvisionBaseline: (id: string, target: PveTarget, names?: ProvisionNames, options?: DeclareProvisionOptions) => Effect.Effect<{
+    baseline: import("./provision-baseline.ts").ProvisionBaseline;
+    grants: ProxmoxAcl[];
+    group: ProxmoxGroup;
+    role: ProxmoxRole;
+    users: ProxmoxUser[];
+}, Error, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=provision-declare.d.ts.map

package/dist/proxmox/provision-declare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-declare.d.ts","sourceRoot":"","sources":["../../src/proxmox/provision-declare.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,KAAK,cAAc,EAAqB,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,OAC/B,MAAM,UACF,SAAS,UACV,cAAc,YACZ,uBAAuB;;;;;;+DAgD9B,CAAC"}

package/dist/proxmox/replication-job.d.ts

@@ -1,15 +1,15 @@
 /**
  * `Proxmox.ReplicationJob` — a guest's ZFS storage replication to a second node, declared.
  *
- * ⛔ NOTHING ON TB4 CAN USE THIS FAMILY, AND THAT IS SAID HERE RATHER THAN FOUND OUT LATER. PVE
+ * ⛔ NOTHING ON C1 CAN USE THIS FAMILY, AND THAT IS SAID HERE RATHER THAN FOUND OUT LATER. PVE
  *   storage replication is ZFS-only: `POST /cluster/replication` calls `get_replicatable_volumes`
- *   and refuses a guest whose disks are anywhere else with "No replicatable volumes found". TB4 is
+ *   and refuses a guest whose disks are anywhere else with "No replicatable volumes found". C1 is
  *   Ceph/RBD-backed — shared storage, where replication means nothing because every node already
- *   sees the volume — so `GET /cluster/replication` answers `[]` (MEASURED on n2, 2026-09-13) and
- *   on this cluster always will. The file is written for a ZFS cluster; against TB4 a declaration
+ *   sees the volume — so `GET /cluster/replication` answers `[]` (MEASURED on node-b, 2026-09-13) and
+ *   on this cluster always will. The file is written for a ZFS cluster; against C1 a declaration
  *   is a create that fails with PVE's own sentence, not a plan that quietly does nothing.
  *
- * ★ WHAT IS MEASURED HERE AND WHAT IS REASONED. Measured on n2 (pve-manager 9.2.11), read-only:
+ * ★ WHAT IS MEASURED HERE AND WHAT IS REASONED. Measured on node-b (pve-manager 9.2.11), read-only:
  *   the published schema for all five methods; `PVE/ReplicationConfig.pm` and
  *   `PVE/API2/ReplicationConfig.pm` line by line; `GET /cluster/replication` -> `[]`; and the ACL
  *   row `{"path":"/","propagate":1,"roleid":"PVEAuditor","ugid":"hf-read@pve"}`. NOT measured: any
@@ -45,12 +45,13 @@
  *   declarations differing only in `jobnum` but naming the same target are not two jobs; the second
  *   is a create that fails.
  *
- * ⚠️ RECONCILE NEEDS `VM.Replicate` ON `/vms/<guest>`, WHICH `LXCProvisioner` DOES NOT HOLD. All
+ * ⚠️ RECONCILE NEEDS `VM.Replicate` ON `/vms/<guest>`, WHICH THE PROVISION ROLE DOES NOT HOLD. All
  *   three writes check it (MEASURED in API2/ReplicationConfig.pm: create, update and delete each
  *   call `$rpcenv->check($authuser, "/vms/$vmid", ['VM.Replicate'])`), and the role's 27 privileges
  *   include `VM.Allocate`, `VM.Audit`, `VM.Backup`, `VM.Config.*` and `VM.PowerMgmt` but not
- *   `VM.Replicate`. Widen it deliberately over SSH, preserving what is there, as `pool.ts` records:
- *   `pveum role modify LXCProvisioner --privs "<existing>,VM.Replicate"`.
+ *   `VM.Replicate` (`PROVISION_PRIVILEGES`). Do NOT widen it by hand: the baseline declares the
+ *   role's exact set, so a hand-added privilege is removed on the next deploy. Grant a second role
+ *   holding `VM.Replicate` on `/vms/<guest>` instead.
  *   ★ THE READ LANE NEEDS NOTHING EXTRA, which is why there is no `readRole` below. The ITEM read
  *     checks `VM.Audit` on `/vms/<guest>`, `hf-read@pve` holds the built-in `PVEAuditor` at `/`
  *     with propagate — both MEASURED — and `PVEAuditor` carries `VM.Audit`. This family is not a

package/dist/proxmox/replication-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAwE/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}
+{"version":3,"file":"replication-job.d.ts","sourceRoot":"","sources":["../../src/proxmox/replication-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAsB,SAAQ,QAAQ,CACrD,wBAAwB,EACxB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,qBAAqB,wDAA4D,CAAC;AAwE/F;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,2IAIvC,CAAC"}

package/dist/proxmox/resource.d.ts

@@ -52,9 +52,9 @@ export type WithApiTarget = {
     target: ApiTarget;
 };
 export type PveSpec<Props extends WithApiTarget, Attributes> = {
-    /** `pools/house`, `nodes/n2/lxc/101` — where ONE object is read, updated and deleted. */
+    /** `pools/lab`, `nodes/node-b/lxc/101` — where ONE object is read, updated and deleted. */
     readonly path: (props: Props) => string;
-    /** `pools`, `nodes/n2/lxc` — where a NEW one is POSTed. */
+    /** `pools`, `nodes/node-b/lxc` — where a NEW one is POSTed. */
     readonly collection: (props: Props) => string;
     /** Live JSON to attributes. Returning undefined means "this is not really there". */
     readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;

package/dist/proxmox/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/proxmox/resource.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGjF;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/C,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,UAAU,IAAI;IAC7D,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,GAAG,SAAS,CAAC;IAC7F,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,QAC7D,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;kBAGX,KAAK;iBAiBX,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBASZ,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;sBAIV,KAAK;IA4DvB;;;;OAIG;oBACa,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,SAAS,aAAa,EAAE,UAAU,SAAS,MAAM,QAC1E,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;IAI9B,IAAI;IACJ,IAAI,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IAChC,IAAI,qBAAqB;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBArHlC,QAAQ;;yBACF,MAAM;;yBAGtC,SAAS;;IAmH5B,SAAS,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACrC,MAAM,aAAa;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAErC,CAAC"}

package/dist/proxmox/sdn-apply-read.d.ts

@@ -3,12 +3,12 @@
  * collections this package declares resources for.
  *
  * 🔴 THE GAP THIS FILE CLOSES, AND IT WAS FOUND BY ALMOST DECLARING THE APPLY. `pendingCount` in
- *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. TB4 has zero of each — and a
- *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on n2:
+ *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. C1 has zero of each — and a
+ *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on node-b:
  *
- *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: tb4, area 1, ip_prefix 10.100.0.0/24
- *                                ospf_node: tb4_n2/n3/n4, interfaces en05 + en06,
- *                                ip 10.100.0.102 / .103 / .104
+ *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: c1, area 1, ip_prefix 203.0.113.0/24
+ *                                ospf_node: c1_n2/node-c/node-d, interfaces tb0 + tb1,
+ *                                ip 203.0.113.102 / .103 / .104
  *     /etc/network/interfaces.d/sdn   the file PVE GENERATES from it, carrying those /32s
  *
  *   Those addresses are Ceph's `cluster_network`. So `diff` would have answered `noop` for ever
@@ -38,7 +38,7 @@ import type { PveTarget } from './credentials.ts';
  *
  * ⚠️ NAMED RATHER THAN SILENTLY SKIPPED. `ipams` and `dns` answer HTTP 400 to both `?pending=1` and
  *   `?running=1`, so there is no way to ask them what is staged. They are a REAL blind spot: an
- *   ipam edited by hand is published by the apply and cannot be seen from here. TB4 has one ipam
+ *   ipam edited by hand is published by the apply and cannot be seen from here. C1 has one ipam
  *   (`pve`, the built-in) and zero dns entries, so the blind spot is currently empty — which is a
  *   fact about today, not a property of the design.
  */
@@ -74,7 +74,7 @@ export declare const canonical: (value: unknown) => string;
  *
  * ⛔ ZERO HERE IS THE ONLY THING THAT MAKES DECLARING THE APPLY SAFE. `reconcile` runs on CREATE —
  *   Alchemy always calls it the first time a resource appears — and `PUT /cluster/sdn` regenerates
- *   `/etc/network/interfaces.d/sdn` on every node. On TB4 that file carries Ceph's cluster network.
+ *   `/etc/network/interfaces.d/sdn` on every node. On C1 that file carries Ceph's cluster network.
  */
 export declare const sdnPendingCount: (target: PveTarget) => Effect.Effect<number, Error, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=sdn-apply-read.d.ts.map

package/dist/proxmox/sdn-apply.d.ts

@@ -6,7 +6,7 @@
  *   is the apply, and it is CLUSTER-WIDE — it publishes every staged object at once, not the one
  *   that happened to reconcile.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
+ * ★ MEASURED ON C1 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
  *
  *     pvesh create /cluster/sdn/zones --zone zzprobe --type simple
  *     GET /cluster/sdn/zones/zzprobe              -> {"digest":"c438…","type":"simple","zone":"zzprobe"}

package/dist/proxmox/sdn-subnet-form.d.ts

@@ -22,7 +22,7 @@ export type DhcpRange = {
  *
  * ⛔ MEASURED from `/usr/share/perl5/PVE/API2/Network/SDN/Subnets.pm` on pve-manager 9.2.11, in
  *   the create handler: `my $id = $cidr =~ s/\//-/r; $id = "$zoneid-$id";`. So `subnet=10.0.0.0/24`
- *   goes out and `house-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
+ *   goes out and `lab-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
  *   anyway — it carries a slash — so there is no spelling of this endpoint that takes the CIDR.
  *
  * ⚠️ `.replace`, NOT `.replaceAll`, AND THE PARITY IS DELIBERATE. Perl's `s/\//-/r` has no `/g`, so

package/dist/proxmox/sdn-subnet.d.ts

@@ -11,7 +11,7 @@
  *   `vnet`; a literal buys no ordering, and here it also buys a wrong path.
  *
  * ⛔ THE ID PVE FILES A SUBNET UNDER IS NOT THE ONE YOU WRITE, AND IT IS THIS FAMILY'S SHARPEST
- *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `house-10.0.0.0-24`.
+ *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `lab-10.0.0.0-24`.
  *   One PVE parameter name, `subnet`, carrying two different values — so they are named APART here,
  *   `cidr` for the declared one and `subnetId` for the derived one, for the reason values.ts gives
  *   about `flag`: a name that means two things is a bug waiting for whoever reads one meaning. The
@@ -50,11 +50,11 @@
  *   seven privileges include SDN.Audit — at `/` with propagate=1. So the default 3600s auditor
  *   lease reads this family, and a `readRole: 'provision'` here would be privilege nobody needed.
  *   Writes are a different answer: POST, PUT and DELETE all require SDN.Allocate on
- *   `/sdn/zones/<zone>/<vnet>`, which `LXCProvisioner` gained on 2026-09-13.
+ *   `/sdn/zones/<zone>/<vnet>`, which the provision role gained on 2026-09-13 (`PROVISION_PRIVILEGES`).
  *
- * ⚠️ NO LIVE SUBNET EXISTS ON TB4 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
+ * ⚠️ NO LIVE SUBNET EXISTS ON C1 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
  *   there can be no subnets. Every claim above is read off PVE 9.2.11's own schema and Perl sources
- *   on n2, and the noop argument below rests on those rather than on a plan this file has watched.
+ *   on node-b, and the noop argument below rests on those rather than on a plan this file has watched.
  *
  * ⚠️ TWO REFUSALS TO EXPECT, both from `SubnetPlugin::on_update_hook`: PVE will not put a subnet on
  *   a vnet with `vlanaware` set ("you can't add a subnet on a vlanaware vnet"), and it rejects a
@@ -88,7 +88,7 @@ export interface SdnSubnetProps extends WithTarget {
     gateway?: string;
     /**
      * Masquerade this subnet. ⚠️ INERT UNTIL THE CLUSTER FIREWALL IS ON — PVE's own description is
-     *   "enable masquerade for this subnet if pve-firewall", and TB4's cluster firewall was empty and
+     *   "enable masquerade for this subnet if pve-firewall", and C1's cluster firewall was empty and
      *   disabled when this was written. It still round-trips, so declaring it does not diff.
      */
     snat?: boolean;

package/dist/proxmox/sdn-vnet.d.ts

@@ -35,12 +35,11 @@
  *   than an error — see the ⛔ in sdn-zone.ts and docs/privileges.md.
  *
  * ⚠️ PRIVILEGES, AND THE ESTATE'S CREDENTIAL HELD NONE OF THEM UNTIL 2026-09-13. reconcile and
- *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. `LXCProvisioner` grants
- *   SDN.Use, which is what a GUEST needs in order to attach to a vnet and NOT what creating one
- *   needs, so a container declared on this vnet works today while the vnet itself 403s. Widen
- *   deliberately, the way Pool.Allocate was:
- *   `pveum role modify LXCProvisioner --privs "<existing>,SDN.Allocate,SDN.Audit"` over SSH,
- *   preserving every existing privilege.
+ *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. The provision role granted
+ *   only SDN.Use then, which is what a GUEST needs in order to attach to a vnet and NOT what
+ *   creating one needs, so a container on a vnet worked while the vnet itself 403'd. It was widened
+ *   the way Pool.Allocate was, and `PROVISION_PRIVILEGES` (provision-baseline.ts) now carries
+ *   SDN.Allocate and SDN.Audit.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/proxmox/sdn-vnet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AAyG1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"sdn-vnet.d.ts","sourceRoot":"","sources":["../../src/proxmox/sdn-vnet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAA8C,CAAC;AAyG1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/storage.d.ts

@@ -21,9 +21,10 @@
  *   messages point away from the cause.
  *   ★ SO WIDEN OR RE-POINT BEFORE THE FIRST PLAN, outside this file: give the credential mount's
  *     `read` role `Datastore.Allocate` on `/storage`, or read this family with `provision`. The
- *     provision role in the estate this was written for holds `Datastore.AllocateSpace` and
+ *     provision role in the estate this was written for held only `Datastore.AllocateSpace` and
  *     `Datastore.Audit`, and NEITHER IS IT — AllocateSpace writes volumes INTO a storage, Allocate
- *     DEFINES one — so it 403s here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     DEFINES one — so it 403'd here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     The provisioning baseline (`provision-baseline.ts`) carries `Datastore.Allocate`.
  *
  * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at
  *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless
@@ -64,7 +65,7 @@ export interface StorageProps extends WithTarget {
     /** `images,rootdir,vztmpl,iso,backup,snippets`. PVE reports `none` for an empty set. */
     content?: string;
     /**
-     * Node restriction, e.g. `n1,n2`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
+     * Node restriction, e.g. `node-a,node-b`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
      * an LXC declared on a node outside it fails at create with "storage not available on node".
      */
     nodes?: string;

package/dist/proxmox/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAgHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IACpD,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,gBAAgB,CAAC,EAAE,KAAK,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAgHH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/proxmox/user.d.ts

@@ -29,8 +29,9 @@
  *   can then say what a delete would take with it — and kept OUT of `matches`, exactly like
  *   `pool.members`. Reported, never declared.
  *
- * ⚠️ RECONCILE NEEDS PRIVILEGES `LXCProvisioner` DOES NOT HOLD, so state them rather than meet a
- *   403 in the middle of a deploy (pool.ts records how that went the last time):
+ * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met
+ *   as a 403 in the middle of a deploy (pool.ts records how that went the last time).
+ *   `PROVISION_PRIVILEGES` (provision-baseline.ts) carries every one of them:
  *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.
  *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in
  *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,UAAU,EAAe,MAAM,eAAe,CAAC;AAGnF,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiGjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,iIACiD,CAAC"}

package/dist/proxmox/values.d.ts

@@ -108,7 +108,7 @@ export declare const int: (value: unknown, fallback: number) => number;
  * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.
  *
  * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY
- *   HAND. Measured in the shipped Perl on n2 — `PVE::SectionConfig::delete_from_config`, line 1860:
+ *   HAND. Measured in the shipped Perl on node-b — `PVE::SectionConfig::delete_from_config`, line 1860:
  *
  *     die "cannot set and delete property '$k' at the same time!\n"
  *         if defined($new_options->{$k});

package/dist/proxmox/zfs-pool-write.d.ts

@@ -37,7 +37,7 @@ export declare const createForm: (props: ZfsPoolProps) => Record<string, string>
 /**
  * Create the pool if it is absent, and otherwise leave it completely alone.
  *
- * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on n2: the
+ * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on node-b: the
  *   create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a UPID
  *   returned the instant the worker is forked — before `zpool create` has run, let alone finished.
  *   A read-back taken immediately, as `pveOperations.reconcile` takes it, finds nothing and would

package/dist/proxmox/zfs-pool.d.ts

@@ -22,22 +22,22 @@
  *     that one line turns a text edit into an unrecoverable one.
  *
  * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema
- *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on n2 2026-09-13): `/nodes/{node}/disks/zfs`
+ *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`
  *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole
  *   surface. So `updateForm` is omitted — which, per `resource.ts`, makes any `matches` = false a
  *   REPLACE. A replace is a delete followed by a create, and on this family the delete is the
  *   thing above. Read the ⛔ on `matches` before adding anything to it.
  *
  * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against
- *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly
+ *   the live cluster: `GET /nodes/node-b/disks/zfs/rpool` answers exactly
  *   `{action, children, errors, leaf, name, scan, state, status}` — no `ashift`, no `compression`,
  *   no `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is
  *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that
  *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never
  *   verify in the first place.
  *
- * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/n2/disks/zfs`
- *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of n2 seconds
+ * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/node-b/disks/zfs`
+ *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of node-b seconds
  *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration
  *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and
  *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them
@@ -133,7 +133,7 @@ export interface ZfsPoolAttributes {
      *
      * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites
      *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)
-     *   for a pool built on partitions — MEASURED, that is exactly what n2's `rpool` reports. Never
+     *   for a pool built on partitions — MEASURED, that is exactly what node-b's `rpool` reports. Never
      *   compare it with `props.devices`.
      */
     devices: string;

package/dist/talos/credentials.d.ts

@@ -2,7 +2,7 @@ import * as Effect from 'effect/Effect';
 import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
-    /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */
+    /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */
     readonly mount: string;
     /** Logical cluster name — safe to persist and log. */
     readonly cluster: string;

package/dist/talos/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,WAAY,WAAW;;iGAsFhD,CAAC"}

package/dist/talos/index.js.map

@@ -3,7 +3,7 @@
   "sources": ["../src/talos/kubeconfig.ts", "../src/talos/credentials.ts", "../src/talos/talosctl.ts", "../src/talos/values.ts", "../src/talos/talos-bootstrap.ts", "../src/talos/talos-cluster-health.ts", "../src/talos/talos-machine-config.ts"],
   "sourcesContent": [
     "/**\n * `Talos.Kubeconfig` — fetch admin kubeconfig so `Kubernetes.*` workloads can connect.\n *\n * ★ REASONED FROM talosctl kubeconfig (Talos v1.13 CLI reference): writes a kubeconfig file;\n *   `--merge=false` keeps it isolated; `-f/--force` overwrites an existing file.\n *\n * ⛔ THE KUBECONFIG FILE CONTAINS A CLIENT CERTIFICATE — IT MUST NOT BE AN ATTRIBUTE. Alchemy\n *   persists attributes unencrypted. This resource:\n *     - writes the file to `runtimePath` at reconcile time (re-minted each deploy),\n *     - persists ONLY public metadata + fingerprints,\n *     - exposes a `connection` field referencing the runtime path for `Kubernetes.ClusterAdapter`.\n *\n * ⚠️ `runtimePath` IS PERSISTED AS A STRING, NOT AS FILE CONTENTS. The path is a contract between\n *   this resource and the host filesystem — same pattern as pointing Kubernetes.KubeConfig at\n *   `/opt/homeflare/...` rendered outside Postgres.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport type { Connection } from 'alchemy/Kubernetes/Connection';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\nimport { kubeconfigMetadata, sha256 } from './values.ts';\n\nexport interface KubeconfigProps extends WithTarget {\n  /** Node that serves `talosctl kubeconfig`. */\n  node: string;\n  /** Context name inside the generated kubeconfig — not secret. */\n  context: string;\n  /**\n   * Host path where talosctl writes the kubeconfig each reconcile.\n   *\n   * ⛔ Must be outside Alchemy state and rotated by redeploy, never copied into attributes.\n   */\n  runtimePath: string;\n  after?: readonly unknown[];\n}\n\nexport interface KubeconfigAttributes {\n  context: string;\n  endpoint: string;\n  certificateAuthorityFingerprint: string;\n  clientCertificateFingerprint: string;\n  /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */\n  credentialGeneration: string;\n  /**\n   * Serializable `Kubernetes.Connection` for downstream workloads.\n   *\n   * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.\n   *   Only `path` and `context` appear here; the adapter reads credentials from disk at call time.\n   */\n  connection: Connection;\n}\n\nexport interface TalosKubeconfig extends Resource<\n  'Talos.Kubeconfig',\n  KubeconfigProps,\n  KubeconfigAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosKubeconfig = Resource<TalosKubeconfig>('Talos.Kubeconfig');\n\nconst generation = (meta: {\n  endpoint: string;\n  caFingerprint: string;\n  clientFingerprint: string;\n  context: string;\n}) => sha256(`${meta.context}\\n${meta.endpoint}\\n${meta.caFingerprint}\\n${meta.clientFingerprint}`);\n\nconst toConnection = (props: KubeconfigProps): Connection => ({\n  auth: { context: props.context, kind: 'kubeconfig', path: props.runtimePath },\n});\n\nconst readFileMeta = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const text = yield* Effect.tryPromise({\n      try: () => Bun.file(props.runtimePath).text(),\n      catch: (cause) => new Error(String(cause)),\n    }).pipe(Effect.orElseSucceed(() => undefined as string | undefined));\n    if (text === undefined) return undefined;\n    const meta = kubeconfigMetadata(text, props.context);\n    if (meta === undefined) return undefined;\n    return {\n      certificateAuthorityFingerprint: meta.caFingerprint,\n      clientCertificateFingerprint: meta.clientFingerprint,\n      connection: toConnection(props),\n      context: props.context,\n      credentialGeneration: generation({ ...meta, context: props.context }),\n      endpoint: meta.endpoint,\n    };\n  });\n\nconst read = (props: KubeconfigProps) =>\n  readFileMeta(props).pipe(\n    Effect.map((meta) =>\n      meta === undefined\n        ? {\n            certificateAuthorityFingerprint: '',\n            clientCertificateFingerprint: '',\n            connection: toConnection(props),\n            context: props.context,\n            credentialGeneration: '',\n            endpoint: '',\n          }\n        : meta,\n    ),\n  );\n\nconst diff = (news: Input<KubeconfigProps>, output: KubeconfigAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (\n      live.credentialGeneration !== '' &&\n      output.credentialGeneration === live.credentialGeneration &&\n      output.context === live.context &&\n      output.endpoint === live.endpoint\n    ) {\n      return { action: 'noop' } as const;\n    }\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    yield* talosctl(\n      [\n        'kubeconfig',\n        props.runtimePath,\n        '--merge=false',\n        '--force',\n        '--force-context-name',\n        props.context,\n      ],\n      { nodes: [props.node], talosconfigPath: credential.talosconfigPath },\n    );\n    const meta = yield* readFileMeta(props);\n    if (meta === undefined) {\n      return yield* Effect.die(\n        new Error(\n          `${props.runtimePath}: talosctl kubeconfig returned no error but the file is missing ` +\n            'or unparsable. Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return meta;\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<KubeconfigProps>;\n    output: KubeconfigAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: KubeconfigProps }) => read(olds),\n  reconcile: ({ news }: { news: KubeconfigProps }) => reconcile(news),\n};\n\nexport const TalosKubeconfigProvider = () =>\n  Provider.effect(TalosKubeconfig, Effect.succeed(TalosKubeconfig.Provider.of(handlers)));\n",
-    "/**\n * The Talos client credential a reconcile runs with: minted from OpenBao, written to a temp file.\n *\n * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy\n *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as\n *   `{\"@redacted\": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that\n *   pg-backup.sh dumps nightly. Neither file may be a prop, an attribute, or a log line.\n *\n * ★ MODELED ON house/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,\n *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a\n *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; paths below follow the same `mount/data/…` shape other infra mounts use.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML.\n   *\n   * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path\n   *   fails closed with a bao error rather than writing an empty talosconfig.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst defaultKey = (target: TalosTarget) => target.talosconfigKey ?? 'data/talosconfig';\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.\n *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.\n */\nexport const mintTalosconfig = (target: TalosTarget) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n      const key = defaultKey(target);\n      const result = yield* ChildProcess.make(\n        'bao',\n        ['kv', 'get', '-format=json', `${target.mount}/${key}`],\n        { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n      ).pipe(\n        spawner.spawn,\n        Effect.flatMap((child) =>\n          Effect.all(\n            {\n              exitCode: child.exitCode,\n              stderr: child.stderr.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n              stdout: child.stdout.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n            },\n            { concurrency: 'unbounded' },\n          ),\n        ),\n        Effect.scoped,\n      );\n\n      if (result.exitCode !== 0) {\n        // ⛔ stderr ONLY — stdout may hold talosconfig YAML with client credentials.\n        return yield* Effect.fail(\n          new Error(\n            `bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`,\n          ),\n        );\n      }\n\n      const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n      const data = parsed.data?.data;\n      const raw = data?.['talosconfig'] ?? data?.['config'];\n      if (typeof raw !== 'string' || raw.trim() === '') {\n        return yield* Effect.fail(\n          new Error(\n            `${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`,\n          ),\n        );\n      }\n\n      const talosconfigPath = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;\n      /**\n       * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file holds the\n       *   cluster's admin client certificate — everything talosctl needs to reconfigure or wipe a\n       *   node. `Bun.write` takes no mode, so it lands at the process umask, which on this estate\n       *   is 0644: world-readable, in a world-readable directory, for as long as the resource\n       *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n       * ⚠️ `wx` IS THE OTHER HALF. Opening with O_EXCL means this cannot be made to write through\n       *   a path an attacker pre-created — the classic /tmp symlink race — and with a UUIDv7 name\n       *   a collision is a genuine error rather than something to paper over.\n       * ⚠️ THE FINALIZER BELOW REMOVES IT ON EVERY EXIT PATH, but a hard kill (SIGKILL, power\n       *   loss) leaves it behind. 0600 is what makes that survivable rather than a disclosure.\n       */\n      yield* Effect.try({\n        try: () => {\n          const fd = openSync(talosconfigPath, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`),\n      });\n\n      yield* Effect.addFinalizer(() =>\n        Effect.tryPromise({\n          try: () => Bun.file(talosconfigPath).delete(),\n          catch: () => undefined,\n        }).pipe(Effect.orElseSucceed(() => undefined)),\n      );\n\n      return { talosconfigPath } satisfies TalosCredential;\n    }),\n  );\n",
+    "/**\n * The Talos client credential a reconcile runs with: minted from OpenBao, written to a temp file.\n *\n * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy\n *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as\n *   `{\"@redacted\": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that\n *   a nightly job dumps. Neither file may be a prop, an attribute, or a log line.\n *\n * ★ MODELED ON <estate>/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,\n *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a\n *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; paths below follow the same `mount/data/…` shape other infra mounts use.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML.\n   *\n   * ⚠️ DEFAULT IS REASONED. The first real deploy will confirm or correct the path; a wrong path\n   *   fails closed with a bao error rather than writing an empty talosconfig.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst defaultKey = (target: TalosTarget) => target.talosconfigKey ?? 'data/talosconfig';\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ★ SHELLS OUT TO `bao` RATHER THAN SPEAKING THE HTTP API — same reasoning as proxmox credentials.\n *   The estate's BAO_ADDR / BAO_NAMESPACE / approle contract already lives in that binary.\n */\nexport const mintTalosconfig = (target: TalosTarget) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n      const key = defaultKey(target);\n      const result = yield* ChildProcess.make(\n        'bao',\n        ['kv', 'get', '-format=json', `${target.mount}/${key}`],\n        { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n      ).pipe(\n        spawner.spawn,\n        Effect.flatMap((child) =>\n          Effect.all(\n            {\n              exitCode: child.exitCode,\n              stderr: child.stderr.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n              stdout: child.stdout.pipe(\n                Stream.decodeText,\n                Stream.mkString,\n                Effect.map((text) => text.trim()),\n              ),\n            },\n            { concurrency: 'unbounded' },\n          ),\n        ),\n        Effect.scoped,\n      );\n\n      if (result.exitCode !== 0) {\n        // ⛔ stderr ONLY — stdout may hold talosconfig YAML with client credentials.\n        return yield* Effect.fail(\n          new Error(\n            `bao kv get ${target.mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`,\n          ),\n        );\n      }\n\n      const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n      const data = parsed.data?.data;\n      const raw = data?.['talosconfig'] ?? data?.['config'];\n      if (typeof raw !== 'string' || raw.trim() === '') {\n        return yield* Effect.fail(\n          new Error(\n            `${target.mount}/${key} returned no talosconfig field. Expected a KV key named 'talosconfig' or 'config' — never store the value in Alchemy props.`,\n          ),\n        );\n      }\n\n      const talosconfigPath = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${target.cluster}-${Bun.randomUUIDv7()}.yaml`;\n      /**\n       * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file holds the\n       *   cluster's admin client certificate — everything talosctl needs to reconfigure or wipe a\n       *   node. `Bun.write` takes no mode, so it lands at the process umask, which on this estate\n       *   is 0644: world-readable, in a world-readable directory, for as long as the resource\n       *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n       * ⚠️ `wx` IS THE OTHER HALF. Opening with O_EXCL means this cannot be made to write through\n       *   a path an attacker pre-created — the classic /tmp symlink race — and with a UUIDv7 name\n       *   a collision is a genuine error rather than something to paper over.\n       * ⚠️ THE FINALIZER BELOW REMOVES IT ON EVERY EXIT PATH, but a hard kill (SIGKILL, power\n       *   loss) leaves it behind. 0600 is what makes that survivable rather than a disclosure.\n       */\n      yield* Effect.try({\n        try: () => {\n          const fd = openSync(talosconfigPath, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing temp talosconfig: ${String(cause)}`),\n      });\n\n      yield* Effect.addFinalizer(() =>\n        Effect.tryPromise({\n          try: () => Bun.file(talosconfigPath).delete(),\n          catch: () => undefined,\n        }).pipe(Effect.orElseSucceed(() => undefined)),\n      );\n\n      return { talosconfigPath } satisfies TalosCredential;\n    }),\n  );\n",
     "/**\n * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.\n *\n * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks\n *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.\n *\n * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a\n *   live cluster in this session.\n *\n * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the\n *   wild to include credential material; stderr is the safe diagnostic channel.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\nexport class TalosError extends Error {\n  constructor(\n    readonly command: string,\n    readonly exitCode: number,\n    detail: string,\n  ) {\n    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);\n    this.name = 'TalosError';\n  }\n}\n\nexport type TalosRunOptions = {\n  readonly talosconfigPath: string;\n  readonly nodes?: readonly string[];\n  readonly endpoints?: readonly string[];\n};\n\n/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */\nexport const talosctl = (args: readonly string[], options: TalosRunOptions) =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const argv = [\n      ...args,\n      '--talosconfig',\n      options.talosconfigPath,\n      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),\n      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),\n    ];\n    const result = yield* ChildProcess.make('talosctl', argv, {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: 'ignore',\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    const command = args.join(' ');\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),\n      );\n    }\n    return result.stdout;\n  });\n\n/** Like `talosctl`, but exit code 1 with \"already\" in stderr is treated as success. */\nexport const talosctlOrAlready = (args: readonly string[], options: TalosRunOptions) =>\n  talosctl(args, options).pipe(\n    Effect.catchIf(\n      (cause): cause is TalosError =>\n        cause instanceof TalosError &&\n        cause.exitCode !== 0 &&\n        /already|exists|bootstrapped/i.test(cause.message),\n      () => Effect.succeed(''),\n    ),\n  );\n",
     "/**\n * Coercions and digests for Talos resources — every function here exists because a trap does.\n *\n * ⚠️ NOTHING IN THIS FILE TOUCHES A LIVE CLUSTER. Digests are computed from repo files or from\n *   kubeconfig YAML already on disk at reconcile time; tests use fixtures only.\n */\nimport { createHash } from 'node:crypto';\n\n/** Trim trailing whitespace only — leading space in YAML is meaningful. */\nexport const canonicalText = (text: string) => text.trimEnd();\n\n/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */\nexport const sha256 = (text: string) =>\n  createHash('sha256').update(canonicalText(text)).digest('hex');\n\n/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */\nexport const configDigest = (text: string) => sha256(text);\n\ntype KubeconfigDoc = {\n  clusters?: {\n    cluster?: { server?: string; 'certificate-authority-data'?: string };\n    name?: string;\n  }[];\n  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];\n  users?: {\n    name?: string;\n    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };\n  }[];\n  'current-context'?: string;\n};\n\n/**\n * Public metadata extracted from a kubeconfig file on disk.\n *\n * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state\n *   may hold the API server URL and CA/client cert digests, never the PEM bytes.\n */\nexport const kubeconfigMetadata = (\n  yamlText: string,\n  contextName: string,\n): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {\n  let doc: KubeconfigDoc;\n  try {\n    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;\n  } catch {\n    return undefined;\n  }\n\n  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;\n  const clusterName = ctx?.cluster;\n  const userName = ctx?.user;\n  if (clusterName === undefined || userName === undefined) return undefined;\n\n  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;\n  const user = doc.users?.find((row) => row.name === userName)?.user;\n  const endpoint = cluster?.server;\n  const ca = cluster?.['certificate-authority-data'];\n  const cert = user?.['client-certificate-data'] ?? user?.['client-key-data'];\n  if (endpoint === undefined || ca === undefined || cert === undefined) return undefined;\n\n  return {\n    caFingerprint: sha256(ca),\n    clientFingerprint: sha256(cert),\n    endpoint,\n  };\n};\n\n/** Resolve a config file path relative to the declaring stack file. */\nexport const resolveConfigPath = (stackDir: string, configFile: string) =>\n  configFile.startsWith('/') ? configFile : `${stackDir}/${configFile}`;\n",
     "/**\n * `Talos.Bootstrap` — initialize etcd once on ONE control-plane node.\n *\n * ★ REASONED FROM talosctl bootstrap (Talos v1.13 CLI reference): one node aborts the etcd join\n *   loop and forms the initial cluster; other control-plane nodes join after Kubernetes starts on\n *   the bootstrap node. This command must run exactly once per cluster.\n *\n * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl, talosctlOrAlready } from './talosctl.ts';\n\nexport interface BootstrapProps extends WithTarget {\n  /** The ONE control-plane node that receives `talosctl bootstrap`. */\n  node: string;\n  /** Machine configs for this node (and peers) must be applied first. */\n  after?: readonly unknown[];\n}\n\nexport interface BootstrapAttributes {\n  node: string;\n  bootstrapped: boolean;\n}\n\nexport interface TalosBootstrap extends Resource<\n  'Talos.Bootstrap',\n  BootstrapProps,\n  BootstrapAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosBootstrap = Resource<TalosBootstrap>('Talos.Bootstrap', {\n  /** etcd data is irreplaceable — opt into destroy explicitly if Talos ever adds an undo. */\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * REASONED: `talosctl get etcdmembers -o json` should list members after bootstrap.\n * ⚠️ NOT MEASURED — first live deploy confirms the resource type name.\n */\nconst isBootstrapped = (props: BootstrapProps, talosconfigPath: string) =>\n  talosctl(['get', 'etcdmembers', '-o', 'json'], {\n    nodes: [props.node],\n    talosconfigPath,\n  }).pipe(\n    Effect.map((text) => text.includes('\"id\"') || text.includes('\"member\"')),\n    Effect.orElseSucceed(() => false),\n  );\n\nconst read = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);\n    return { bootstrapped, node: props.node };\n  });\n\nconst diff = (news: Input<BootstrapProps>, output: BootstrapAttributes | undefined) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* read(news);\n    if (live.bootstrapped) return { action: 'noop' } as const;\n    return { action: 'update' } as const;\n  });\n\nconst reconcile = (props: BootstrapProps) =>\n  Effect.gen(function* () {\n    const credential = yield* mintTalosconfig(props.target);\n    const before = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!before) {\n      yield* talosctlOrAlready(['bootstrap'], {\n        nodes: [props.node],\n        talosconfigPath: credential.talosconfigPath,\n      });\n    }\n    const after = yield* isBootstrapped(props, credential.talosconfigPath);\n    if (!after) {\n      return yield* Effect.die(\n        new Error(\n          `${props.node}: bootstrap returned no error but etcd members are still absent. ` +\n            'Read back rather than trusting the exit code alone.',\n        ),\n      );\n    }\n    return { bootstrapped: true, node: props.node };\n  });\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<BootstrapProps>;\n    output: BootstrapAttributes | undefined;\n  }) => diff(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: BootstrapProps }) => read(olds),\n  reconcile: ({ news }: { news: BootstrapProps }) => reconcile(news),\n};\n\nexport const TalosBootstrapProvider = () =>\n  Provider.effect(TalosBootstrap, Effect.succeed(TalosBootstrap.Provider.of(handlers)));\n",

package/docs/adopt-verify.md

@@ -9,8 +9,8 @@ bunx --bun hf-adopt-verify --config alchemy.run.ts --stage live          # rows
 bunx --bun hf-adopt-verify --config alchemy.pbs.ts --stage live --all    # every row + deletions
 ```
 
-Wrap it in the same credential lane the deploy uses (`bun ./scripts/with-mini-bao.ts --admin …`
-in the Proxmox stacks): a lane that cannot read an object sees it as absent, and the verifier
+Wrap it in the same credential lane the deploy uses (the wrapper that mints
+its OpenBao token): a lane that cannot read an object sees it as absent, and the verifier
 then reports `create` for something that exists.
 
 ## Why a plan line is not enough
@@ -24,8 +24,8 @@ Measured in alchemy `2.0.0-beta.79`:
 - So `alchemy plan` prints `(+) adopted` for a matching object **and** for a drifting one, and
   the deploy reconciles both. Whether that writes is up to each family's `reconcile`.
 
-Measured on TB4, `pvesh get /cluster/tasks`, 2026-09-21: six `cephsetpool` tasks by
-`hf-provision@pve`, one per pool, on 2026-09-13 and again on 2026-09-20 — the deploys that
+Measured on C1, `pvesh get /cluster/tasks`, 2026-09-21: six `cephsetpool` tasks by
+the provision user, one per pool, on 2026-09-13 and again on 2026-09-20 — the deploys that
 adopted the three Ceph pools. `Proxmox.CephPool` sent `setpool` whenever the pool existed,
 whatever its diff said. It was the one PVE/PBS family that wrote on a no-op adoption, and it is
 fixed. [adopted-deploys.md](./adopted-deploys.md) shows what every family does.
@@ -37,10 +37,26 @@ fixed. [adopted-deploys.md](./adopted-deploys.md) shows what every family does.
 | `alchemy plan` (CLI)       | the forced action only; `--detailed` is declared YAML, no JSON  |
 | `Plan.describePlan`        | serializable rows, again only the forced action                 |
 | `forceUpdateAfterAdoption` | a local variable; no log, no warning, no field on the node      |
-| `alchemy drift`            | rows **with** state only, and its non-dry run reconciles        |
+| `alchemy drift`            | rows **with** state only, against the last deploy; exits `0`    |
 | `deploy --adopt --dry-run` | the adoption plan (`plan` has no `--adopt`), same forced action |
 | **the provider service**   | the raw `read` / `diff` answer, per FQN — used                  |
 
+`alchemy drift` has no dry run to gate on (beta.79, `Cli/commands/drift.ts`, `Drift.ts`). Its
+flags are `--repair`, `--config`, `--env-file`, `--stage` and `--profile`: no `--dry-run`, and no
+`--yes`, although [its page](https://alchemy.run/cli/drift) lists one (measured 2026-09-21:
+`Unrecognized flag: --yes in command alchemy drift`, exit `1`). Without `--repair`, a terminal
+run asks Repair or Cancel (default Cancel). A non-interactive run (no TTY, `CI`, `--no-input`,
+`ALCHEMY_PLAIN=1` or `ALCHEMY_NO_TUI=1`, or an agent such as Claude Code) prints the repair plan
+and exits `0` even when something drifted. It skips a row whose provider has no `read`, or whose
+status is not `created` / `updated`. `--repair` restores the props saved at the last deploy, not
+what the code declares now, and recreates a missing object. `--all` (below) asks each
+provider's `diff` about the declaration, as a deploy does, and reads every row again.
+
+⛔ **Repair is a write outside the deploy gate.** Choosing Repair, or passing `--repair` (which
+never prompts), calls each drifted row's `reconcile` directly (`Drift.ts`): no `hf-adopt-verify`,
+no approved plan of the declaration. A HomeFlare gate never runs it. Deploy the declaration
+through the gate instead.
+
 The engine finds every provider in the Effect context by resource type. The verifier opens the
 stack the way `alchemy plan` does (`Alchemist.open`). It swaps each provider for a watched copy
 (`src/verify/spy.ts`) and runs `Plan.make` itself, so output resolution, state lookup, renames,

package/docs/adopted-deploys.md

@@ -71,7 +71,7 @@ reported as a diff.
 `pg_autoscale_mode`, `crush_rule` (and any declared hints) to `nodes/{node}/ceph/pool/{name}`.
 That PUT forks a `cephsetpool` worker under the provision token. PVE's `set_pool` skips each
 setting whose value is unchanged (Tools.pm:293-300), so a matching pool was not re-tuned. It was
-still a provision-lease write and a task on the node every time the pool was adopted. TB4's task
+still a provision-lease write and a task on the node every time the pool was adopted. C1's task
 list shows six such tasks (2026-09-13 and 2026-09-20), one per declared pool per deploy.
 
 ## How it is pinned

package/docs/ownership.md

@@ -4,7 +4,8 @@ A live object this stack holds **no state for** is never taken over silently. Th
 `Bao.*` family, `HostFile`, `LaunchdJob`, `CaddyConfig` and `ProxmoxLxc`, and it holds even when the
 live object is **identical** to the declaration: identical is not ours. Another stack, a person or an old
 script put it there, and once state claims it, a delete under `RemovalPolicy.destroy()` removes it
-from its real owner. (Decided 2026-09-21; the Bao families adopted silently until 0.9.0.)
+from its real owner. (Decided 2026-09-21; the Bao families adopted silently until 0.9.0. 0.9.0 was
+never published, so 0.10.0 is the first release with the rule.)
 
 To take an object over, say so:
 
@@ -92,6 +93,30 @@ read, a resume reads as a fresh create and asks for `--adopt`. `alchemy deploy`
 session both share one. An orphan's interrupted create (no longer declared) cannot be compared with
 a declaration, so Apply leaves its object in place with a note instead of deleting it.
 
+## After a wiped store or `state delete`, it needs `--adopt`
+
+Alchemy's documented repair for a bad record is `alchemy state delete`, then `alchemy deploy`,
+escalating to `--adopt` only on `OwnedBySomeoneElse`
+([inspecting state](https://alchemy.run/cli/inspecting-state#recover-from-bad-state)). For the
+families above that escalation always comes (decided 2026-09-21): an object whose row is gone is
+`Unowned`, so the deploy needs `--adopt`, or `adopt(true)` on its declaration. `MeshNode`
+([mesh-node.md](./mesh-node.md)) and `R2BucketLock` (`src/cloudflare/r2-bucket-lock.ts`) need it
+too. A `CaddyConfig` running the declared config re-imports without it, and so does every family
+whose `read` never answers `Unowned`: the `pveHandlers` resources (Limits), the `forgejoHandlers`
+resources and the Talos resources. Read the takeover first with `hf-adopt-verify`
+([adopt-verify.md](./adopt-verify.md)).
+
+★ This departs from Alchemy's docs, not from its code. The docs say a provider with no ownership
+marker answers plain attributes, so its objects re-import silently (`AdoptPolicy.ts`,
+[adopting resources](https://alchemy.run/cli/adopting-resources),
+[provider](https://alchemy.run/infrastructure-as-code/provider#read)). Many of Alchemy's own
+marker-less providers answer `Unowned` to a read with no state instead, as the kit's families do
+(beta.79: `Cloudflare/Snippets/Snippet.ts`, `Cloudflare/Tunnel/WarpConnector.ts`,
+`Cloudflare/Zone/Hold.ts`). After a wiped store those need `--adopt` too.
+
+⚠️ **That page's `alchemy state delete myapp/pr-42` fails.** A stage or a whole stack is a
+directory, and deleting one needs `-r` (beta.79 `State/Tree.ts`). A single row does not.
+
 ## Limits
 
 - ⚠️ **A check, then a write: not a lock.** Two resources that declare the same name in **one**