@homeflare/alchemy 0.11.0 → 0.13.0

package/src/forgejo/resource.ts

@@ -28,7 +28,7 @@ import { ForgejoError, forgejo } from './client.ts';
 /**
  * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — and it is NOT what the first draft said.
  *
- *   These resources declared `ChildProcessSpawner`, copied from house/proxmox, where it is there
+ *   These resources declared `ChildProcessSpawner`, copied from <estate>/proxmox, where it is there
  *   because a PVE credential is minted by shelling out to `bao`. Nothing in this package shells
  *   out: the token comes from `FORGEJO_TOKEN` in the environment. Declaring a service you never
  *   use is not harmless — it makes a stack provide a layer for nothing, and it hides the one
@@ -152,7 +152,7 @@ export const forgejoOperations = <Props extends object, Attributes>(
  * The five provider handlers for a spec'd Forgejo object, wired once.
  *
  * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in
- *   house/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.
+ *   <estate>/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.
  *
  * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.
  */

package/src/forgejo/team-member.ts

@@ -3,7 +3,7 @@
  *
  * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the
  *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's
- *   scopes only cap it (house/openbao/src/forgejo-bootstrap.ts).
+ *   scopes only cap it (<estate>/openbao/src/forgejo-bootstrap.ts).
  *
  * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and
  *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. The team

package/src/openbao/README.md

@@ -17,7 +17,7 @@ plus `FetchHttpClient.layer`.
 - ⛔ A rename or move onto a name or path that already exists fails the plan, before anything is
   written (every family but the mounts, whose moves are below). Move through a free name, in two
   deploys, or remove the target first.
-- ⛔ **Nothing is adopted without `--adopt`** (0.9.0), not even an object identical to the
+- ⛔ **Nothing is adopted without `--adopt`** (0.9.0, first published as 0.10.0), not even an object identical to the
   declaration: a live name with no state fails the plan, or the apply when a prop was an Output.
   Our own interrupted create still resumes when its row can prove it — not one killed while a
   prop was still an Output. [docs/ownership.md](../../docs/ownership.md). Change
@@ -105,10 +105,10 @@ export const machines = Effect.gen(function* () {
   });
   yield* BaoKubernetesRole('pod', {
     aliasNameSource: 'serviceaccount_name',
-    boundServiceAccountNames: ['litellm'],
+    boundServiceAccountNames: ['llm-gateway'],
     boundServiceAccountNamespaces: ['ai'],
-    name: 'ai-litellm',
-    tokenPolicies: ['ai-litellm'],
+    name: 'ai-gateway',
+    tokenPolicies: ['ai-gateway'],
   });
 });
 ```

package/src/openbao/auth-role.ts

@@ -7,7 +7,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
  *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/openbao/bao-http.test.ts

@@ -31,11 +31,11 @@ describe('baoRead', () => {
       () => reply,
       async (bao) => {
         const env = { BAO_ADDR: bao.address, BAO_NAMESPACE: 'homeflare', BAO_TOKEN: TOKEN };
-        const data = await run(env, baoRead('proxmox-tb4/roles/read'));
+        const data = await run(env, baoRead('proxmox-c1/roles/read'));
         assert.deepEqual(data, { mint_user: 'hf-read@pve', ttl: 3600 });
         const [seen] = bao.seen;
         assert.equal(seen?.method, 'GET');
-        assert.equal(seen?.path, '/v1/proxmox-tb4/roles/read');
+        assert.equal(seen?.path, '/v1/proxmox-c1/roles/read');
         assert.equal(seen?.headers.get('x-vault-namespace'), 'homeflare');
         assert.equal(seen?.headers.get('x-vault-token'), TOKEN);
         assert.equal(seen?.headers.get('x-vault-request'), 'true');

package/src/openbao/bao-http.ts

@@ -2,14 +2,14 @@
  * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family
  * uses since it stopped shelling out to `bao`.
  *
- * ★ `HttpClient`, THE SAME PATTERN house/proxmox and house/forgejo USE AGAINST THEIR APIs, decided
+ * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided
  *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's
  *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so
  *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy
  *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,
  *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)
  * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way
- *   house/proxmox/alchemy.run.ts does.
+ *   <estate>/proxmox/alchemy.run.ts does.
  */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
@@ -34,7 +34,7 @@ export const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEn
 /**
  * ⛔ AT MOST EIGHT EXCHANGES WITH OPENBAO AT ONCE — ACROSS EVERY Bao.* FAMILY, IN ONE PROCESS.
  *
- * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF THE MINI. Alchemy fans
+ * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF ITS HOST. Alchemy fans
  *   resources out with a hard-coded `concurrency: "unbounded"` (alchemy Plan.ts:476, Apply.ts:259,
  *   :263, :303 — no option reaches it), and 555 Bao.CloudflareRole resources each read, diff,
  *   reconcile and read back: well over a thousand requests at one loopback listener within seconds.
@@ -42,7 +42,7 @@ export const BaoEnv = Context.Reference<BaoEnvironment>('homeflare/openbao/BaoEn
  *     HTTP server (listening on 127.0.0.1:8200) exited with error: set tcp
  *     127.0.0.1:8200->127.0.0.1:57974: setsockopt: invalid argument
  *   and KEPT RUNNING with 8200 closed. launchd saw a live process and restarted nothing. Everything
- *   on the mini that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
+ *   on the vault host that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
  *   a manual restart.
  * ★ THE LISTENER DYING IS A GO-ON-DARWIN FAILURE, NOT OURS TO FIX. Traefik lost its entrypoints the
  *   same way on darwin/arm64 (traefik issue 8841). The BURST is ours. The adoption deploy an hour
@@ -70,7 +70,7 @@ const TIMEOUT = '60 seconds';
 /**
  * Mesh in front of a remote OpenBao drops connections under Alchemy's unbounded
  * fan-out. Status 0 is transport, not an OpenBao 4xx — retry twice. Measured
- * 2026-09-16 against api.v.homeflare.dev: a 585-role plan died mid-diff with
+ * 2026-09-16 against bao.example.internal: a 585-role plan died mid-diff with
  * `no response: (no errors given)` while the vault stayed unsealed.
  */
 const retryTransport = <A, R>(effect: Effect.Effect<A, BaoError, R>) =>
@@ -136,7 +136,7 @@ export const baoCall = (
     const address = resolveAddress(env);
     const client = yield* HttpClient.HttpClient;
     // ⚠️ The content type goes on `bodyText`, never in the header map: `bodyText` overwrites it.
-    //   house/proxmox/src/client.ts has the scar.
+    //   <estate>/proxmox/src/client.ts has the scar.
     const request = HttpClientRequest.make(method)(`${address.base}/v1/${path}`).pipe(
       HttpClientRequest.setHeaders(headersFor(address, env)),
       body === undefined

package/src/openbao/bao-status.test.ts

@@ -86,7 +86,7 @@ describe('settle', () => {
 
   // ⛔ A success body can hold a credential, so a malformed one is described and never quoted.
   it('fails an unparseable success body without quoting it', () => {
-    const error = errorOf(settle('read', 'GET', 'pbs-tb4/creds/read', 200, 'secret=abc123 {'));
+    const error = errorOf(settle('read', 'GET', 'pbs-c1/creds/read', 200, 'secret=abc123 {'));
     assert.ok(!error.message.includes('abc123'));
   });
 

package/src/openbao/bao-status.ts

@@ -121,7 +121,7 @@ export const settle = (
     if (errors === undefined) {
       // ⛔ DESCRIBED, NEVER QUOTED. A proxy or gateway error page can echo the request back, headers
       //   and all, so quoting it could carry X-Vault-Token into an error that Alchemy logs (grok,
-      //   2026-09-14). mint in house/proxmox/src/credentials.ts already did it this way.
+      //   2026-09-14). mint in <estate>/proxmox/src/credentials.ts already did it this way.
       return fail([`not an OpenBao error body (${String(text.length)} bytes)`]);
     }
     if (status === 404 && intent !== 'write') return { body: undefined };

package/src/openbao/cloudflare-group-scope.test.ts

@@ -10,7 +10,7 @@
  *   permission-groups`: `Logs Read` is listed twice, `6a315a56…` at `com.cloudflare.api.account`
  *   and `c4a30cd5…` at `com.cloudflare.api.account.zone`. The second is what the four live
  *   security roles carry on their ACCOUNT resource, and what
- *   house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:80 pins as PG_LOGS_ZONE.
+ *   <estate>/nix/scripts/cf-mint-analytics-tokens.py:80 pins as PG_LOGS_ZONE.
  */
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';

package/src/openbao/cloudflare-permission-groups.test.ts

@@ -143,7 +143,7 @@ describe('permissionGroupsFromEngine', () => {
   });
 
   /**
-   * ⛔ r2-backup-mini's ENTRY IS BUCKET-SCOPED (`bucket: homeflare-pg-mini`), and the two groups it
+   * ⛔ r2-backup-host's ENTRY IS BUCKET-SCOPED (`bucket: example-db-backup`), and the two groups it
    *   names are the only two the account lists at `com.cloudflare.edge.r2.bucket` — MEASURED
    *   2026-09-15: 2 of 399. A unique name still resolves whatever scope asks, which is why the
    *   account-scoped `Workers R2 Storage Read` here answers a bucket-scoped question too.

package/src/openbao/cloudflare-permission-groups.ts

@@ -103,7 +103,7 @@ const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>
  * ⛔ A 403 IS A MISSING GRANT, AND IT SAYS SO. `BaoError` alone reports `GET /v1/<mount>/
  *   permission-groups -> 403: permission denied` — true, and it points nowhere: the path is
  *   deployed, the token is valid, and the one thing to change is a policy file. MEASURED 2026-09-15
- *   10:19 on the macmini-admin lane, where `bao write sys/capabilities-self` answered `[deny]` on
+ *   10:19 on the host's admin lane, where `bao write sys/capabilities-self` answered `[deny]` on
  *   this exact path. bao-status.ts argues that a failure must name what it is; this is that
  *   argument one level up.
  */
@@ -147,7 +147,7 @@ const engineGroups = (mount: string): Lookup =>
     if (data === undefined) {
       // ⚠️ 404 IS NOW A MOUNT-SHAPED ANSWER, NOT THE EXPECTED ONE. The path IS deployed
       //   estate-wide (measured 2026-09-15), so a 404 here means this mount is served by an older
-      //   plugin binary or BAO_ADDR is not the mini — never "no groups".
+      //   plugin binary or BAO_ADDR is not the vault host — never "no groups".
       const why = 'GET <mount>/permission-groups answered 404 — the endpoint is not deployed here';
       return Effect.fail(new CloudflareGroupsError(mount, [why]));
     }
@@ -231,7 +231,7 @@ export const permissionGroupsFromEngine = () =>
  *   undeclared live role carries IDs with no names to pair them with — and solves the account at
  *   once.
  * 🔴 WHAT RETIRED IT, 2026-09-15 10:13: `alchemy deploy` could not create
- *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-mini` — `unknown group "Workers R2
+ *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-host` — `unknown group "Workers R2
  *   Storage Bucket Item Write" — no live role on account <account> carries it; a NEW group needs
  *   the engine endpoint`. That is this source's documented blind spot arriving, not a bug in it.
  *

package/src/openbao/cloudflare-policy.ts

@@ -2,7 +2,7 @@
  * A Cloudflare policy document as the engine stores it — resolution from names, parsing from a
  * read, and the one comparison every Bao.CloudflareRole plan rests on.
  *
- * MEASURED from the engine source (house/platform/secrets/vault/plugin/cloudflare/path_roles.go)
+ * MEASURED from the engine source (<estate>/platform/secrets/vault/plugin/cloudflare/path_roles.go)
  * and the 2026-09-14 snapshot of all 586 live roles:
  *   • `policies` is a STRING field holding a JSON array (path_roles.go:67-72). Each entry is
  *     `{effect, resources: map[string]string, permission_groups: [{id}]}` (:25-33).

package/src/openbao/cloudflare-role-form.ts

@@ -2,7 +2,7 @@
  * Props, attributes and field comparison for Bao.CloudflareRole — the resource is
  * cloudflare-role.ts, the policy document rules are cloudflare-policy.ts.
  *
- * MEASURED from the engine (house/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
+ * MEASURED from the engine (<estate>/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
  * 2026-09-14 snapshot of all 586 live roles:
  *   • A role is name, description, policies, ttl and max_ttl AND NOTHING ELSE (path_roles.go:14-20
  *     stores those; :204-210 returns them). Every snapshot read carries exactly those five keys, so
@@ -79,7 +79,7 @@ export interface RoleDifference {
   readonly have: string;
 }
 
-/** `cloudflare-<account>-dns/roles/homeflare-dev-dns-read` — read, write and delete use it. */
+/** `cloudflare-<account>-dns/roles/example-dns-read` — read, write and delete use it. */
 export const rolePath = (mount: string, name: string) => `${mountPath(mount)}/roles/${name}`;
 
 const seconds = (value: unknown) =>

package/src/openbao/cloudflare-roles-expand.ts

@@ -44,7 +44,7 @@ export interface DeclaredPolicy {
    * ⛔ IT MOVES THE LOOKUP, NEVER THE RESOURCE. The entry still binds the groups to the resource
    *   above; only the id chosen for each name changes. That is the shape Cloudflare calls "all
    *   zones from an account" — the ACCOUNT resource carrying ZONE-scoped groups
-   *   (house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
+   *   (<estate>/nix/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
    *   token). Without this field the resource is the only witness, and it says `account`.
    */
   readonly scope?: string;

package/src/openbao/digest.ts

@@ -8,7 +8,7 @@
  * The only form a policy body may be hashed or compared in.
  *
  * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live
- *   server: the assembler emits each fragment followed by a newline, so `homeflare-llm` goes in as
+ *   server: the assembler emits each fragment followed by a newline, so `app-llm` goes in as
  *   41 lines and `bao policy read` hands back 40 — identical text, one `\n` apart, two different
  *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the
  *   stack could never settle. It was invisible until the stack planned for the first time today.

package/src/openbao/forgejo-bootstrap-parse.test.ts

@@ -29,11 +29,11 @@ describe('usernamesFrom', () => {
   test('reads the Username column of the measured table', () => {
     const table = [
       'ID   Username            Email                                   IsActive IsAdmin 2FA',
-      '1    tim                 tim@example.invalid                     true     true    false',
+      '1    alice               alice@example.invalid                   true     true    false',
       '7    forgejo-provision   forgejo-provision@noreply.example        true     false   false',
       '',
     ].join('\n');
-    expect(usernamesFrom(table)).toEqual(['tim', 'forgejo-provision']);
+    expect(usernamesFrom(table)).toEqual(['alice', 'forgejo-provision']);
   });
 
   test('refuses a table it does not recognise rather than reporting nobody', () => {
@@ -63,7 +63,7 @@ describe('readCreateOutput', () => {
   });
 
   test('reports not created when the success line names someone else or is missing', () => {
-    expect(readCreateOutput("New user 'tim' has been successfully created!", user).created).toBe(
+    expect(readCreateOutput("New user 'alice' has been successfully created!", user).created).toBe(
       false,
     );
     const noPassword = readCreateOutput(

package/src/openbao/forgejo-bootstrap-parse.ts

@@ -5,9 +5,9 @@
  *   read off the running 16.0.3 daemon or its source on 2026-09-14, not assumed.
  */
 
-/** Where the mini's Forgejo keeps its state (hosts/macmini/modules/forgejo.nix:235, app.ini:14). */
+/** Where the host's Forgejo keeps its state (its NixOS module and `app.ini`). */
 export const FORGEJO_WORK_PATH = '/opt/homeflare/forgejo';
-/** The file the launchd runner renders at every start (forgejo.nix:78). Readable by tim, who runs Forgejo. */
+/** The file the launchd runner renders at every start. Readable by the account that runs Forgejo. */
 export const FORGEJO_CONFIG = `${FORGEJO_WORK_PATH}/custom/conf/app.ini`;
 
 /**

package/src/openbao/forgejo-bootstrap.ts

@@ -3,7 +3,7 @@
  * straight to the Forgejo engine's role and nowhere else.
  *
  * ★ TIM'S CALL, 2026-09-14: "Random password, piped", and membership of the HomeFlare Owners team
- *   (house/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
+ *   (<estate>/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
  *   that creates users — the bot type is database-only (codeberg issue 8136) — so this is an
  *   ordinary user made by `forgejo admin user create`.
  *
@@ -34,12 +34,12 @@ import {
 } from './forgejo-bootstrap-parse.ts';
 
 export const PROVISION_USER = 'forgejo-provision';
-/** `NO_REPLY_ADDRESS` in hosts/macmini/forgejo/app.ini:117 — a service account's mail goes nowhere. */
+/** `NO_REPLY_ADDRESS` in the host's Forgejo `app.ini` — a service account's mail goes nowhere. */
 const PROVISION_EMAIL = `${PROVISION_USER}@noreply.lab.example.com`;
 export const ROLE_PATH = 'forgejo/roles/provision';
 
 /**
- * ★ THE SCOPES ARE WHAT house/forgejo WRITES TODAY. Org labels, teams and org secrets need
+ * ★ THE SCOPES ARE WHAT <estate>/forgejo WRITES TODAY. Org labels, teams and org secrets need
  *   `write:organization`; repositories, webhooks and branch protection need `write:repository`.
  *   Membership decides what the tokens can reach, and the scopes cap it.
  * ⚠️ FORGEJO TOKENS NEVER EXPIRE ON THE SERVER. The TTL is OpenBao's lease, and revoking the lease is
@@ -92,7 +92,7 @@ export const bootstrapProvisionAccount = Effect.gen(function* () {
   const binary = runningForgejoBinary(ps.stdout);
   if (binary === undefined) {
     return yield* refuse(
-      'no running `forgejo web` found. Run this on the mini, where Forgejo runs.',
+      'no running `forgejo web` found. Run this on the host where Forgejo runs.',
     );
   }
   const cli = (subcommand: string, ...args: string[]) =>

package/src/openbao/kubernetes-role-form.test.ts

@@ -14,16 +14,16 @@ import {
 
 const POD: BaoKubernetesRoleProps = {
   aliasNameSource: 'serviceaccount_name',
-  boundServiceAccountNames: ['litellm'],
+  boundServiceAccountNames: ['llm-gateway'],
   boundServiceAccountNamespaces: ['ai'],
-  name: 'ai-litellm',
-  tokenPolicies: ['ai-litellm'],
+  name: 'ai-gateway',
+  tokenPolicies: ['ai-gateway'],
   tokenTtl: '1h',
 };
 
 const LIVE: Record<string, unknown> = {
   alias_name_source: 'serviceaccount_name',
-  bound_service_account_names: ['litellm'],
+  bound_service_account_names: ['llm-gateway'],
   bound_service_account_namespace_selector: '',
   bound_service_account_namespaces: ['ai'],
   token_bound_cidrs: [],
@@ -32,7 +32,7 @@ const LIVE: Record<string, unknown> = {
   token_no_default_policy: false,
   token_num_uses: 0,
   token_period: 0,
-  token_policies: ['ai-litellm'],
+  token_policies: ['ai-gateway'],
   token_ttl: 3600,
   token_type: 'default',
 };

package/src/openbao/mount.ts

@@ -6,7 +6,7 @@
  *   in OpenBao, not Alchemy state.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — disabling a mount destroys every secret under it.
- *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  *
  * ★ REPLACE SEMANTICS (audited 2026-09-21, see src/openbao/REPLACE.md):
  *   · `type` changed → plans `replace`, and the APPLY FAILS, destroying nothing: the new

package/src/openbao/pki-role.ts

@@ -36,7 +36,7 @@
  *   never a policy one — but neither is a measurement.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — see the delete comment below. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/openbao/policy-wire.test.ts

@@ -28,11 +28,11 @@ describe('policy wire', () => {
   it('round-trips through the stripped newline with equal digests', async () => {
     await withFake(aclPolicies(), async (bao) => {
       const env = { BAO_ADDR: bao.address };
-      await run(env, writePolicy('homeflare-llm', ASSEMBLED));
+      await run(env, writePolicy('app-llm', ASSEMBLED));
       assert.equal(bao.seen[0]?.method, 'PUT');
-      assert.equal(bao.seen[0]?.path, `${PREFIX}homeflare-llm`);
+      assert.equal(bao.seen[0]?.path, `${PREFIX}app-llm`);
       assert.deepEqual(JSON.parse(bao.seen[0]?.body ?? ''), { policy: ASSEMBLED });
-      const live = await run(env, readPolicy('homeflare-llm'));
+      const live = await run(env, readPolicy('app-llm'));
       assert.notEqual(live, ASSEMBLED, 'the fake strips the newline, as OpenBao does');
       assert.equal(sha256(live), sha256(ASSEMBLED));
     });

package/src/openbao/policy.ts

@@ -26,8 +26,8 @@ import { guardRename, judgeRename, nameIdentity } from './rename-identity.ts';
  * ⛔ THERE IS NO `Bao.Secret`, AND THERE MUST NEVER BE ONE. Alchemy persists attributes to
  *   its state store and does NOT encrypt them: StateEncoding.ts unwraps `Redacted` to
  *   plaintext under a marker key, and nothing under alchemy/src/State encrypts. This
- *   estate's state store is the `alchemy` Postgres database, which pg-backup.sh dumps
- *   nightly (it enumerates EVERY non-template database), copies to CT100, and PBS backs up
+ *   estate's state store is the `alchemy` Postgres database, which a nightly job dumps
+ *   (it enumerates EVERY non-template database), copies to a backup guest, and PBS backs up
  *   from there. A KV value here would exist in four places, none of them OpenBao.
  *
  *   So this declares the SHAPE AROUND secrets. Every attribute it stores is a name, a

package/src/openbao/proxmox-role-form.ts

@@ -4,11 +4,11 @@
  * MEASURED 2026-09-13, read-only, against the live server (BAO_ADDR=http://127.0.0.1:8200,
  * BAO_NAMESPACE=homeflare). No write of any kind was issued to a role or a mount:
  *
- *   bao read -format=json proxmox-tb4/roles/read
+ *   bao read -format=json proxmox-c1/roles/read
  *     → { max_ttl: 21600, mint_user: "hf-read@pve",      name: "read",      ttl: 3600 }
- *   bao read -format=json proxmox-tb4/roles/provision
+ *   bao read -format=json proxmox-c1/roles/provision
  *     → { max_ttl: 1800,  mint_user: "hf-provision@pve", name: "provision", ttl: 300 }
- *   GET /v1/proxmox-tb4/?help=1 → components.schemas.WriteRolesNameRequest:
+ *   GET /v1/proxmox-c1/?help=1 → components.schemas.WriteRolesNameRequest:
  *     mint_user  string  — the ONLY required field, described as "The `user@realm` whose
  *                          standing ACL is the minted token's entire privilege set. Created
  *                          out-of-band; this engine never grants ACLs."
@@ -24,7 +24,7 @@ import { sha256 } from './digest.ts';
 import { mountPath, parseDuration, ttlSeconds } from './mount-form.ts';
 
 export interface BaoProxmoxRoleProps {
-  /** Mount path of the proxmox secrets engine, e.g. `proxmox-tb4`. A trailing slash is fine. */
+  /** Mount path of the proxmox secrets engine, e.g. `proxmox-c1`. A trailing slash is fine. */
   mount: string;
   /**
    * Role name, as `<mount>/roles/<name>` takes it.
@@ -105,7 +105,7 @@ const ttlText = (seconds: number | undefined, fallback = '0') => {
   return `${String(seconds)}s`;
 };
 
-/** `proxmox-tb4/roles/read` — read, write and delete all address the role here. */
+/** `proxmox-c1/roles/read` — read, write and delete all address the role here. */
 export const rolePath = (mount: string, name: string) => `${mountPath(mount)}/roles/${name}`;
 
 export const attributesOf = (

package/src/openbao/proxmox-role.ts

@@ -3,20 +3,20 @@
  * mint user, plus the lease ceilings that consumer's tokens get. METADATA ONLY.
  *
  * ★ WHY THIS FAMILY MATTERS MORE THAN IT LOOKS. Declaring these roles is how the estate
- *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On TB4, SEVEN tokens
- *   carry expire=0 and privsep=0 — root@pam!proxbox-sync, mcp@pve!executor,
- *   monitoring@pve!exporter, sablier@pve!sablier, tofu@pve!ro, tofu@pve!apply and
- *   vaultmint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
+ *   replaces HAND-MADE PERMANENT PVE TOKENS with short-lived minted ones. On C1, SEVEN tokens
+ *   carry expire=0 and privsep=0 — root@pam!inventory-sync, agent@pve!executor,
+ *   metrics@pve!exporter, app@pve!app, iac@pve!ro, iac@pve!apply and
+ *   mint@pve!engine. Six of those are one Bao.ProxmoxRole plus a scoped PVE user away from
  *   being a 5-minute lease instead of a forever key.
  *
- *   The seventh cannot be. vaultmint@pve!engine is the credential the ENGINE ITSELF
+ *   The seventh cannot be. mint@pve!engine is the credential the ENGINE ITSELF
  *   authenticates with in order to mint anything at all: the thing that issues short-lived
  *   tokens needs a standing one, and no role can resolve that chicken-and-egg. It stays
  *   permanent, which makes it the single most valuable token on the cluster and the one whose
  *   rotation must be a deliberate, hand-run procedure rather than a plan.
  *
- *   MEASURED here: `bao read proxmox-tb4/config` returns parent_token_id
- *   `vaultmint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
+ *   MEASURED here: `bao read proxmox-c1/config` returns parent_token_id
+ *   `mint@pve!engine`, parent_secret_set true, parent_secret_tail `…eb01` — the engine's
  *   own key, present and, by the schema's own "Write-only: never returned by a read", not
  *   retrievable. The seven-token inventory was handed to this change and NOT re-counted against
  *   the PVE API in this session.
@@ -27,13 +27,13 @@
  *
  * ⛔ ISSUANCE IS NOT THIS RESOURCE, AND MUST NEVER BECOME ONE. `<mount>/creds/<name>` returns a
  *   LIVE PVE TOKEN. Alchemy persists attributes unencrypted (StateEncoding.ts tags Redacted
- *   values rather than encrypting them) into the `alchemy` Postgres, which pg-backup.sh dumps
- *   nightly to CT100, from where PBS backs it up. A minted token declared as a resource would
+ *   values rather than encrypting them) into the `alchemy` Postgres, which a nightly job dumps
+ *   to a backup guest, from where PBS backs it up. A minted token declared as a resource would
  *   outlive its own lease in at least four places, none of them OpenBao. This resource declares
  *   the DOOR; walking through it is a runtime call, not a plan.
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role breaks every consumer that mints from
- *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   it. Opt in with `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
@@ -80,7 +80,7 @@ export const BaoProxmoxRoleProvider = () =>
       BaoProxmoxRole.Provider.of({
         /**
          * ⛔ `bao list <mount>/roles` IS NOT A LIST OF THINGS THIS OWNS. MEASURED today:
-         *   proxmox-tb4/roles answers `provision, read` and proxmox-ops/roles answers `read` —
+         *   proxmox-c1/roles answers `provision, read` and proxmox-c2/roles answers `read` —
          *   four roles created by hand at bringup, none of them declared anywhere yet.
          *   Returning them would invite Alchemy to adopt, and then delete, roles it never
          *   created, and deleting a role is how every consumer of it stops being able to mint.

package/src/openbao/ssh-role.ts

@@ -4,8 +4,8 @@
  * ⛔ THE SIGNING KEY IS OUT OF SCOPE AND MUST STAY OUT. `ssh/config/ca` holds (or generates)
  *   the CA private key and `ssh/sign/<role>` issues certificates. Neither is declarable
  *   here, for the reason policy.ts spells out: Alchemy persists attributes to its state
- *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and pg-backup.sh
- *   dumps it nightly to CT100. A CA key there would outlive the vault that guards it. This
+ *   store WITHOUT encrypting them, that store is the `alchemy` Postgres, and a nightly job
+ *   dumps it to a backup guest. A CA key there would outlive the vault that guards it. This
  *   resource declares the SHAPE a signature must satisfy — principals, extensions, TTLs.
  *
  * ⛔ THE ROLE WRITE IS A FULL REPLACE, NOT A PATCH. OpenBao rebuilds the role entry from the
@@ -29,7 +29,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'`. Deleting this role locks every operator out of the
  *   estate — the memory note "operator SSH is homeflare-bot@<host>" is this CA. Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/proxmox/acl.ts

@@ -41,14 +41,14 @@ export type AclSubjectType = 'user' | 'group' | 'token';
 
 export interface AclProps extends WithTarget {
   /**
-   * The PVE object path the grant is ON — `/`, `/pool/house`, `/vms/101`, `/storage/local-zfs`.
+   * The PVE object path the grant is ON — `/`, `/pool/lab`, `/vms/101`, `/storage/local-zfs`.
    * ⚠️ NOT THE API PATH: `spec.path` below is the endpoint (`access/acl`). PVE's API overloads the
    *   word, so this file does too rather than renaming a field the cluster calls `path`.
    */
   path: string;
   /** Which kind of subject `ugid` names. Identity: changing it is a different grant. */
   type: AclSubjectType;
-  /** `tim@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
+  /** `alice@pve`, `admins`, `hf-provision@pve!hf-provision-…`. Identity. */
   ugid: string;
   /** The role bound here, e.g. `PVEAuditor`. ⚠️ It must exist — PVE refuses an unknown roleid. */
   roleid: string;
@@ -85,9 +85,9 @@ export const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');
 /**
  * ⚠️ PVE NORMALISES ACL PATHS AND RETURNS THE NORMALISED FORM, a forever-update trap when only one
  *   side of the comparison is normalised. `PVE::AccessControl::normalize_path` collapses repeated
- *   slashes and strips the trailing one, so a declared `/pool/house/` reads back as `/pool/house`
+ *   slashes and strips the trailing one, so a declared `/pool/lab/` reads back as `/pool/lab`
  *   and a naive match never fires again. It also refuses a path with no leading slash, so one is
- *   added here rather than letting `pool/house` 400.
+ *   added here rather than letting `pool/lab` 400.
  */
 const normalize = (raw: string) => `/${raw.split('/').filter(Boolean).join('/')}`;
 

package/src/proxmox/adopt-noop.test.ts

@@ -32,8 +32,8 @@ type Case = {
 
 const cases: readonly Case[] = [
   {
-    declare: () => ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET }),
-    live: { 'pools/house': { comment: 'x', members: [] } },
+    declare: () => ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET }),
+    live: { 'pools/lab': { comment: 'x', members: [] } },
     name: 'Proxmox.Pool (pveHandlers: every factory family)',
     provider: ProxmoxPoolProvider as never,
   },
@@ -98,15 +98,15 @@ describe('adopting a matching object only reads', () => {
   });
 
   test('and the harness does see a write: a drifted Pool is PUT once', async () => {
-    const fake = clusterWith({ 'pools/house': { comment: 'old', members: [] } });
+    const fake = clusterWith({ 'pools/lab': { comment: 'old', members: [] } });
     await withoutBao(async () => {
       const engine = engineOver(ProxmoxPoolProvider().pipe(Layer.provideMerge(fake.layer)));
       const declared = () =>
-        ProxmoxPool('house', { comment: 'x', poolid: 'house', target: FAKE_TARGET });
+        ProxmoxPool('lab', { comment: 'x', poolid: 'lab', target: FAKE_TARGET });
       const report = await engine.verify(declared());
       expect(report.rows[0]).toMatchObject({ changed: ['comment'], diff: 'update', ok: false });
-      expect(await engine.deploy(declared())).toEqual({ house: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ lab: 'adopted' });
     });
-    expect(fake.writes()).toEqual(['PUT pools/house']);
+    expect(fake.writes()).toEqual(['PUT pools/lab']);
   });
 });