@homeflare/alchemy 0.11.0 → 0.13.0

package/src/proxmox/ceph-osd-tree.ts

@@ -11,13 +11,13 @@
  *   `CephOsdProps` is a cycle on paper only: it is erased before anything runs.
  *
  * ⛔ `GET /nodes/{node}/ceph/osd` ANSWERS A TREE, NOT A LIST, AND IT IS THE WHOLE CLUSTER'S TREE.
- *   MEASURED 2026-09-13: asked of n2 it answers `{"flags":…,"root":{"children":[…]}}` whose
- *   leaves include osd.0 and osd.5 on n4; asked of n3 it answers the identical six leaves. The
+ *   MEASURED 2026-09-13: asked of node-b it answers `{"flags":…,"root":{"children":[…]}}` whose
+ *   leaves include osd.0 and osd.5 on node-d; asked of node-c it answers the identical six leaves. The
  *   `{node}` in the path chooses WHO ANSWERS, not what is listed. A provider that read it as "the
- *   OSDs on this node" would find osd.0 through n2 and then report it as living there.
+ *   OSDs on this node" would find osd.0 through node-b and then report it as living there.
  *
  * ⛔ AND THE SINGLE-OBJECT PATH CANNOT BE USED INSTEAD — THIS WALK EXISTS BECAUSE IT LIES.
- *   MEASURED: `GET /nodes/n2/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
+ *   MEASURED: `GET /nodes/node-b/ceph/osd/99`, an id with no OSD behind it, answers HTTP 200 with
  *   `[{"name":"metadata"},{"name":"lv-info"}]` — byte for byte what `…/osd/2` answers for a real
  *   one. It is a directory index (its schema says `permissions: {"user":"all"}`), not a read of
  *   the OSD. Point `PveSpec.path` at it and every declared OSD is "present": `diff` reports
@@ -25,18 +25,18 @@
  *   stops this package recording objects that do not exist — passes on an OSD that was never
  *   built. The only endpoint that can tell present from absent is the tree.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, `GET /nodes/n2/ceph/osd`. Six leaves, all `up` and `in`, Ceph
+ * ★ MEASURED ON C1 ON 2026-09-13, `GET /nodes/node-b/ceph/osd`. Six leaves, all `up` and `in`, Ceph
  *   20.2.2 tentacle:
  *
- *     id  name   host  device_class  crush_weight      reweight  pgs  status
- *     0   osd.0  n4    ssd           1.86299133300781  1          99  up
- *     5   osd.5  n4    ssd           1.86299133300781  1          94  up
- *     1   osd.1  n3    ssd           1.86299133300781  1          96  up
- *     4   osd.4  n3    ssd           1.81939697265625  1          97  up
- *     2   osd.2  n2    ssd           1.81939697265625  1          88  up
- *     3   osd.3  n2    ssd           1.81939697265625  1         105  up
+ *     id  name   host    device_class  crush_weight      reweight  pgs  status
+ *     0   osd.0  node-d  ssd           1.86299133300781  1          99  up
+ *     5   osd.5  node-d  ssd           1.86299133300781  1          94  up
+ *     1   osd.1  node-c  ssd           1.86299133300781  1          96  up
+ *     4   osd.4  node-c  ssd           1.81939697265625  1          97  up
+ *     2   osd.2  node-b  ssd           1.81939697265625  1          88  up
+ *     3   osd.3  node-b  ssd           1.81939697265625  1         105  up
  *
- *   `{ node: 'n2', osdid: 2, host: 'n2', device_class: 'ssd' }` plans `noop` against that row.
+ *   `{ node: 'node-b', osdid: 2, host: 'node-b', device_class: 'ssd' }` plans `noop` against that row.
  *   That is the acceptance test this file was written to pass.
  *
  * ⚠️ EVERY OTHER COLUMN IS REPORTED AND NEVER COMPARED, FOR FOUR DIFFERENT REASONS. `pgs` is the
@@ -72,8 +72,8 @@ const branches = (node: CrushNode): CrushNode[] =>
 /**
  * Every OSD leaf under the tree root, at any depth.
  *
- * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. TB4 measures as
- *   root(`default`) -> host(n2|n3|n4) -> osd, but CRUSH admits datacenter, rack and chassis
+ * ⚠️ RECURSIVE BECAUSE THE TREE IS NOT THREE LEVELS DEEP BY LAW. C1 measures as
+ *   root(`default`) -> host(node-b|node-c|node-d) -> osd, but CRUSH admits datacenter, rack and chassis
  *   buckets between them, and an OSD created outside a host bucket hangs off the root. Reaching
  *   in as `root.children[].children[]` would read this cluster correctly and answer "absent" —
  *   i.e. "the replica is gone" — on the first cluster that has a rack in it.
@@ -149,7 +149,7 @@ export interface CephOsdAttributes {
  * ⚠️ THE TELEMETRY IS DELIBERATELY DROPPED, NOT FORGOTTEN. The leaf also carries `bytes_used`,
  *   `percent_used`, `apply_latency_ms` and `commit_latency_ms`. MEASURED, AND THE MEASUREMENT SAYS
  *   THE OPPOSITE OF WHAT YOU WOULD EXPECT: across two reads minutes apart, all four were identical
- *   on every OSD, and both latencies read 0 — TB4 was idle, so nothing was caught in the act. That
+ *   on every OSD, and both latencies read 0 — C1 was idle, so nothing was caught in the act. That
  *   these move is therefore REASONED, from what they count, not observed. Alchemy persists
  *   attributes; on a cluster doing work, keeping them would rewrite all six resources' state on
  *   every deploy and record a number that is stale by the time anybody reads it. What is kept is

package/src/proxmox/ceph-osd.ts

@@ -11,7 +11,7 @@
  *
  *   A PVE method with no permissions block is refused to every identity except `root@pam`, so an
  *   OpenBao-minted `hf-provision@pve!…` token is answered 403 however wide its role — widening
- *   `LXCProvisioner` cannot fix it. Compare the sibling families, which DO carry a check and
+ *   the provision role cannot fix it. Compare the sibling families, which DO carry a check and
  *   therefore do work with a token: `ceph/fs`, `ceph/mon` and `disks/zfs` all want `Sys.Modify`.
  *
  * ⚠️ SO THE WRITE PATH IS HONEST RATHER THAN USEFUL. It is written out properly in
@@ -19,7 +19,7 @@
  *   operator running as root@pam. Through this package's credential it will 403, and a 403 is a
  *   better answer than a `delete` that silently does nothing while the plan claims otherwise.
  *
- * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "n2, n3 and n4 each hold two ssd OSDs"
+ * ★ WHAT IT IS ACTUALLY FOR, THEN: ASSERTION. It turns "node-b, node-c and node-d each hold two ssd OSDs"
  *   into a line a plan checks, and it gives Ceph-backed resources something real to depend on —
  *   read `osd.osdid` into an `rbd` storage's props and Alchemy orders that storage after the
  *   assertion, so a stack can no longer report a healthy Ceph storage on a cluster whose OSDs are
@@ -53,8 +53,8 @@ export type { CephOsdAttributes };
 
 export interface CephOsdProps extends WithTarget {
   /**
-   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree n2 returns and the
-   * tree n3 returns are the same six leaves, n4's included. Point this at any node that is up;
+   * Which node ANSWERS the read — not where the OSD lives. MEASURED: the tree node-b returns and the
+   * tree node-c returns are the same six leaves, node-d's included. Point this at any node that is up;
    * `host` is the field that says where the disk is.
    */
   node: string;
@@ -63,7 +63,7 @@ export interface CephOsdProps extends WithTarget {
   /**
    * The CRUSH host bucket this OSD must sit in. Undeclared means unmanaged, as in storage.ts.
    *
-   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under n3, the plan reports
+   * ⚠️ DECLARING IT IS AN ASSERTION WITH NO REPAIR. If osd.2 turns up under node-c, the plan reports
    *   work every time and the deploy fails, because moving an OSD between failure domains is a
    *   `ceph osd crush move` this provider will not perform. That is the intent: a replica in the
    *   wrong failure domain is not something to converge quietly past.
@@ -125,7 +125,7 @@ export const ProxmoxCephOsd = Resource<ProxmoxCephOsd>('Proxmox.CephOsd', {
  *   node, an expired lease, a role without `Sys.Audit`, or a cluster with no Ceph at all. Folding
  *   those into "absent" would turn every one of them into the sentence "osd.2 is missing", which
  *   is the most alarming thing this provider can say and would be a lie in all four cases. Left
- *   to fail, the plan shows `PVE GET nodes/n2/ceph/osd -> 500: …` and names the real problem.
+ *   to fail, the plan shows `PVE GET nodes/node-b/ceph/osd -> 500: …` and names the real problem.
  */
 
 /**

package/src/proxmox/ceph-pool-adopt.test.ts

@@ -14,16 +14,16 @@ import { engineOver } from '../verify/fake-engine.ts';
 import { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
 
-const STATUS = 'nodes/n2/ceph/pool/cephtb4/status?verbose=1';
-const OBJECT = 'nodes/n2/ceph/pool/cephtb4';
+const STATUS = 'nodes/node-b/ceph/pool/rbd-c1/status?verbose=1';
+const OBJECT = 'nodes/node-b/ceph/pool/rbd-c1';
 
-/** TB4's rbd pool as `getpool` answers it — the fields ceph-pool.ts reads. */
+/** C1's rbd pool as `getpool` answers it — the fields ceph-pool.ts reads. */
 const livePool = (size: number): Record<string, unknown> => ({
   application_list: ['rbd'],
   crush_rule: 'replicated_rule',
   id: 2,
   min_size: 2,
-  name: 'cephtb4',
+  name: 'rbd-c1',
   pg_autoscale_mode: 'on',
   pg_num: 128,
   size,
@@ -38,18 +38,18 @@ const cluster = (size: number) => {
       for (const [key, value] of Object.entries(call.form)) {
         pool[key] = /^\d+$/.test(value) ? Number(value) : value;
       }
-      return 'UPID:n2:fake:setpool';
+      return 'UPID:node-b:fake:setpool';
     }
     return undefined;
   });
 };
 
 const declared = () =>
-  ProxmoxCephPool('cephtb4', {
+  ProxmoxCephPool('rbd-c1', {
     crush_rule: 'replicated_rule',
     min_size: 2,
-    name: 'cephtb4',
-    node: 'n2',
+    name: 'rbd-c1',
+    node: 'node-b',
     pg_autoscale_mode: 'on',
     size: 3,
     target: FAKE_TARGET,
@@ -67,7 +67,7 @@ describe('adopting a Ceph pool', () => {
       expect(report.rows).toEqual([
         expect.objectContaining({ diff: 'noop', ok: true, planned: 'adopted', read: 'found' }),
       ]);
-      expect(await engine.deploy(declared())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([]);
     expect(fake.calls.every((call) => call.path === STATUS)).toBe(true);
@@ -82,10 +82,10 @@ describe('adopting a Ceph pool', () => {
   test('declaring a field it does not manage: rechecked, still noop, and the deploy only reads', async () => {
     const fake = cluster(3);
     const birth = () =>
-      ProxmoxCephPool('cephtb4', {
+      ProxmoxCephPool('rbd-c1', {
         min_size: 2,
-        name: 'cephtb4',
-        node: 'n2',
+        name: 'rbd-c1',
+        node: 'node-b',
         pg_num: 32,
         size: 3,
         target: FAKE_TARGET,
@@ -100,7 +100,7 @@ describe('adopting a Ceph pool', () => {
         recheck: 'noop',
       });
       expect(report.rows[0]?.why).toContain('does not manage');
-      expect(await engine.deploy(birth())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(birth())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([]);
   });
@@ -112,7 +112,7 @@ describe('adopting a Ceph pool', () => {
       const report = await engine.verify(declared());
       expect(report.rows[0]).toMatchObject({ changed: ['size'], diff: 'update', ok: false });
       expect(fake.writes()).toEqual([]);
-      expect(await engine.deploy(declared())).toEqual({ cephtb4: 'adopted' });
+      expect(await engine.deploy(declared())).toEqual({ 'rbd-c1': 'adopted' });
     });
     expect(fake.writes()).toEqual([`PUT ${OBJECT}`]);
     expect(fake.calls.find((call) => call.method === 'PUT')?.form['size']).toBe('3');

package/src/proxmox/ceph-pool-form.ts

@@ -4,25 +4,25 @@
  * ★ SPLIT OUT OF ceph-pool.ts TO KEEP BOTH FILES UNDER THE 250-LINE CAP, and the seam is
  *   "does this touch the cluster" — the same one metric-server-form.ts draws, just with more on
  *   this side because this family needs it. Here: the declared shape, the reported shape, and the
- *   coercions that turn one into the other. There: reading TB4, deciding a diff, and the four
+ *   coercions that turn one into the other. There: reading C1, deciding a diff, and the four
  *   handlers. Nothing in this file makes a call or decides an action.
  * ⚠️ THE PROPS LIVE HERE RATHER THAN IN THE RESOURCE FILE, which is the one place this pair
  *   differs from metric-server / notification-target. There is no `import type` cycle back as a
  *   result; ceph-pool.ts re-exports both interfaces so the public surface is unchanged.
  *
  * ⛔ POST AND PUT DO NOT TAKE THE SAME PARAMETERS, AND BOTH EXTRAS ARE DESTRUCTIVE. MEASURED from
- *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on n2, pve-manager 9.2.11,
+ *   the cluster's own schema (/usr/share/pve-docs/api-viewer/apidoc.js on node-b, pve-manager 9.2.11,
  *   2026-09-13): POST adds `add_storages` and `erasure-coding` to the shared set, PUT takes
  *   neither. Both are refused below, so what is left between the two bodies is `name`, which PUT
  *   reads from the path, and `pg_num`.
  *
  * ⛔ `pg_num` IS IN THE CREATE BODY AND NOT IN THE UPDATE BODY, AND THAT IS THE MOST IMPORTANT
- *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on n2: a POST carrying no
+ *   LINE IN THIS FILE. MEASURED in PVE::API2::Ceph::Pool::createpool on node-b: a POST carrying no
  *   `pg_num` gets 128 substituted (`$param->{pg_num} //= 128`), and PVE::Ceph::Tools::create_pool
  *   then runs `osd pool create` — which Ceph answers with SUCCESS for a pool that already exists,
  *   before applying the rest of the body to it. So a create fired at a live pool SETS its pg_num,
  *   and lowering pg_num starts a PG MERGE: hours of backfill across every OSD, on a cluster whose
- *   Ceph traffic shares vmbr1.11 with everything else. ceph-pool.ts guards the create for exactly
+ *   Ceph traffic shares vmbr1.42 with everything else. ceph-pool.ts guards the create for exactly
  *   that reason; this half simply never offers pg_num to an update.
  */
 import type { WithTarget } from './resource.ts';
@@ -30,10 +30,10 @@ import { csv } from './values.ts';
 
 export interface CephPoolProps extends WithTarget {
   /**
-   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: n2 and
-   *   n3 answer byte-identically for `cephtb4` (measured). The endpoint is node-scoped only
+   * ⚠️ WHICH NODE THE CALL GOES THROUGH, NOT WHERE THE POOL LIVES. A pool is cluster-wide: node-b and
+   *   node-c answer byte-identically for `rbd-c1` (measured). The endpoint is node-scoped only
    *   because PVE talks to the local RADOS socket, so this is a door, not a location — it is never
-   *   compared, and moving a declaration from n2 to n3 plans noop. Point it at a node you expect
+   *   compared, and moving a declaration from node-b to node-c plans noop. Point it at a node you expect
    *   to be up: a node that is down makes the read fail, and a failed read reads as "absent".
    */
   node: string;
@@ -51,7 +51,7 @@ export interface CephPoolProps extends WithTarget {
   min_size?: number;
   /**
    * ⛔ CREATE-TIME ONLY, AND NEVER COMPARED — the single biggest noop hazard in this family. With
-   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on TB4, `cephtb4`
+   *   `pg_autoscale_mode` on or warn the autoscaler owns this number: MEASURED on C1, `rbd-c1`
    *   sits at pg_num 128 while the autoscaler's own `pg_num_final` is 256, so a declaration
    *   diffing it reports an update the moment Ceph decides to act. A split is gradual even with
    *   the autoscaler off, and `nopgchange` can refuse the write outright — which kills the WHOLE
@@ -61,7 +61,7 @@ export interface CephPoolProps extends WithTarget {
   pg_num?: number;
   /** The floor the autoscaler may not go below. Operator-owned and stable, so it IS compared. */
   pg_num_min?: number;
-  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four TB4 pools have. */
+  /** ⚠️ PVE's create default is `warn`; Ceph's own is `on`, which is what all four C1 pools have. */
   pg_autoscale_mode?: 'off' | 'on' | 'warn';
   /**
    * The CRUSH rule BY NAME, e.g. `replicated_rule`.
@@ -108,7 +108,7 @@ export interface CephPoolProps extends WithTarget {
  *   size or its PG shape, and `set_pool` dies on the whole PUT when any one parameter will not
  *   apply (Tools.pm:310). `matches` refuses to diff the fields they freeze, so these attributes
  *   are the only place a plan can show WHY a declared size is not being enforced. All three read
- *   false on all four TB4 pools.
+ *   false on all four C1 pools.
  * ⚠️ `pg_num`, `id` AND `applications` ARE REPORTED AND NEVER COMPARED — see the props above.
  * ⛔ NO `statistics` AND NO `autoscale_status`, though the verbose read returns both. They change
  *   every few seconds; persisting them would rewrite this resource's state on every deploy and
@@ -170,7 +170,7 @@ export const same = <T>(declared: T | undefined, live: T, frozen = false) =>
  * A declared autoscaler hint, or nothing when it is zero.
  *
  * ⚠️ A DECLARED ZERO IS "NO FLOOR, NO HINT", AND IT IS DELIBERATELY LEFT UNCOMPARED. REASONED, NOT
- *   MEASURED: all four TB4 pools carry null for both `pg_num_min` and `target_size`, and finding
+ *   MEASURED: all four C1 pools carry null for both `pg_num_min` and `target_size`, and finding
  *   out for certain would mean writing to the cluster. Ceph CLEARS both when they are set to 0 and
  *   `osd pool get all` then omits the key, which PVE reports as null and this pair reads as UNSET
  *   — so a declared 0 would compare 0 against -1 on every plan, forever. Mapping 0 to UNSET
@@ -203,7 +203,7 @@ const numeric = (value: number | undefined) => (value === undefined ? undefined
  * ⚠️ AN UNDECLARED FIELD IS NEITHER SENT NOR COMPARED — storage.ts's rule, and the opposite of
  *   Proxmox.Pool's. Undeclared means UNMANAGED here, because a pool has no one set of defaults to
  *   fall back on: PVE's POST fills in size 3, min_size 2, application rbd and pg_autoscale_mode
- *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on TB4
+ *   'warn' (MEASURED in createpool), while Ceph's own defaults — which is what every pool on C1
  *   was actually born with — put pg_autoscale_mode at 'on'. Guessing either set would rewrite a
  *   pool somebody tuned by hand.
  *
@@ -216,7 +216,7 @@ const numeric = (value: number | undefined) => (value === undefined ? undefined
  *   NOT PVE's `1T` STRING. MEASURED: the API parses the string with PVE::JSONSchema::parse_size
  *   and stores Ceph's `target_size_bytes` (Pool.pm:474-477 for POST, 683-686 for PUT), and
  *   `GET .../status` hands that integer back under the name `target_size` (Pool.pm:878). Run on
- *   n2, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
+ *   node-b, `parse_size('1099511627776')` returns 1099511627776 — bare digits are bytes, no
  *   multiplier — so a byte count survives the round trip exactly, while a declared `1T` would read
  *   back as 1099511627776 and diff against itself on every plan, forever.
  */

package/src/proxmox/ceph-pool.ts

@@ -18,10 +18,10 @@
  *   string, so HTTP 200 means "the task started" — an immediate read-back can see a pool that does
  *   not exist yet, or values that have not landed. `settle` waits for the cluster to agree.
  *
- * ⛔ THE FOUR POOLS ON TB4 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
+ * ⛔ THE FOUR POOLS ON C1 INCLUDE CEPH'S OWN, AND NONE OF THEM MAY BE ADOPTED. Measured
  *   2026-09-13: `.mgr` (application `mgr`, created and owned by the manager daemons),
- *   `cephfs-tb4_data` and `cephfs-tb4_metadata` (the two halves of the `cephfs-tb4` filesystem —
- *   destroying either destroys the filesystem), and `cephtb4`, the rbd pool the guests sit on.
+ *   `cephfs-c1_data` and `cephfs-c1_metadata` (the two halves of the `cephfs-c1` filesystem —
+ *   destroying either destroys the filesystem), and `rbd-c1`, the rbd pool the guests sit on.
  *   `list` answers empty like every resource in this package, so adoption stays an explicit act;
  *   the `applications` attribute is reported so that a plan SHOWS which of those a declaration hit.
  *
@@ -107,9 +107,9 @@ const spec: PveSpec<CephPoolProps, CephPoolAttributes> = {
    *   write only ever ADDS to a list), `target_size_ratio` (float equality), `id`, `applications`
    *   and the three `no*` flags (PVE returns them and accepts none of them on write), `node` and
    *   `name` (the address the read was made at — true by construction, never a diff). In, and each
-   *   measured to round-trip unchanged against TB4's four pools on 2026-09-13: size 3, min_size 2,
+   *   measured to round-trip unchanged against C1's four pools on 2026-09-13: size 3, min_size 2,
    *   pg_autoscale_mode `on`, crush_rule `replicated_rule`, pg_num_min where it is set (16 on
-   *   cephfs-tb4_metadata, absent on cephtb4), target_size in bytes — and each of the last two
+   *   cephfs-c1_metadata, absent on rbd-c1), target_size in bytes — and each of the last two
    *   through `hint`, which drops a declared zero for the reason given on it.
    */
   matches: (attributes, props) =>
@@ -197,7 +197,7 @@ export const ProxmoxCephPoolProvider = () =>
          *   to remove deliberately.
          * ⚠️ AND THE REFUSAL CAN ARRIVE AFTER THE RESPONSE, WHICH IS WHY THIS WAITS. The DELETE
          *   forks a worker and answers 200 with a UPID, so mons running with
-         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on TB4
+         *   `mon_allow_pool_delete` false fail once the call has already returned. MEASURED on C1
          *   2026-09-13: the config-db value is false while the running mons report true, i.e. it is
          *   set in ceph.conf and the two sources disagree by design.
          */

package/src/proxmox/client.test.ts

@@ -25,7 +25,7 @@ const CRED: PveCredential = {
 
 const target = (members: readonly string[]): PveTarget => ({
   members,
-  mount: 'proxmox-tb4-test',
+  mount: 'proxmox-c1-test',
   scheme: 'pve',
 });
 
@@ -148,7 +148,7 @@ describe('cluster member failover', () => {
     const backup = counting('UPID:1');
     try {
       await run(
-        pveWith(target([A, B]), CRED, 'PUT', 'nodes/n3/network').pipe(
+        pveWith(target([A, B]), CRED, 'PUT', 'nodes/node-c/network').pipe(
           Effect.timeout('50 millis'),
           Effect.flip,
         ),
@@ -169,7 +169,7 @@ describe('cluster member failover', () => {
     const backup = counting('UPID:2');
     try {
       // Loopback port 1 is closed: Bun answers ConnectionRefused before a byte is written.
-      const data = await run(pveWith(target([A, B]), CRED, 'PUT', 'nodes/n3/network'), {
+      const data = await run(pveWith(target([A, B]), CRED, 'PUT', 'nodes/node-c/network'), {
         [A]: 1,
         [B]: backup.port,
       });

package/src/proxmox/client.ts

@@ -4,7 +4,7 @@
  * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH, AND THAT IS A MEASURED CHOICE RATHER THAN AN OMISSION.
  *   Proxmox is usually met with `curl -k` because a fresh install serves its own self-signed
  *   certificate — I reached for `-k` myself before checking. This cluster serves a real Let's
- *   Encrypt certificate (`CN=cluster-tb4.example.com`), and strict TLS answers 401, i.e. the
+ *   Encrypt certificate (`CN=cluster-c1.example.com`), and strict TLS answers 401, i.e. the
  *   handshake succeeds and only the credential is missing. So there is no `rejectUnauthorized`
  *   option here to be left switched on by accident in somebody else's estate.
  *
@@ -93,7 +93,7 @@ const buildRequest = (
    *   package can perform was broken from the day the client was written.
    *   ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. Ninety-eight resources were adopted
    *     against the live cluster and every one matched, so `reconcile` never reached a PUT. The
-   *     identical bug in house/forgejo/src/client.ts surfaced the moment a write token existed
+   *     identical bug in <estate>/forgejo/src/client.ts surfaced the moment a write token existed
    *     and answered `422 Unsupported Content-Type`; this one is the same line, found by looking.
    *   ★ A PLAN THAT SAYS `noop` PROVES THE READ PATH AND NOTHING ELSE. That is the lesson worth
    *     more than the fix.
@@ -213,7 +213,7 @@ export const pveEnvelopeWith = (
  * Make one call on a credential for `role`, REUSING a still-valid lease rather than minting one.
  *
  * 🔴 IT USED TO MINT PER CALL, AND AT 98 RESOURCES THAT STOPPED BEING FREE. One plan plus deploy
- *   of the TB4 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
+ *   of the C1 stack left 760 token entries in `/etc/pve/user.cfg` — read, diff, reconcile and the
  *   read-back each minted their own, and `/etc/pve` is a replicated cluster filesystem every node
  *   has to agree on. src/lease-cache.ts carries the measurement and the safety argument.
  *

package/src/proxmox/credential-literals.test.ts

@@ -0,0 +1,148 @@
+/**
+ * A literal credential in a plain `Pbs.NotificationTarget` prop is refused — and refused BEFORE
+ * Alchemy writes the props to the state store, which is the whole point.
+ *
+ * ★ THE END-TO-END CASES RUN ALCHEMY'S OWN PLAN AND APPLY (verify/fake-engine.ts) and dump the
+ *   store, because the failure being pinned is not "a refusal exists" but "the token never
+ *   reached the row": before the fix a refused create had already committed its props.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import type { PbsTarget } from './credentials.ts';
+import {
+  isCredentialName,
+  literalCredentialHeaders,
+  literalCredentialsInUrl,
+} from './credential-literals.ts';
+import { fakeNotify } from './fake-pbs-notify.ts';
+import { withoutBao } from './fake-pve.ts';
+import {
+  PbsNotificationTarget,
+  type PbsNotificationTargetProps,
+  PbsNotificationTargetProvider,
+} from './pbs-notification-target.ts';
+import { refusals } from './pbs-notification-target-form.ts';
+
+const PBS: PbsTarget = { api: 'https://pbs.test:8007/api2/json', mount: 'pbs-test', scheme: 'pbs' };
+const LITERAL = 'lit-7a1c-not-real';
+const AM = 'https://alertmanager.example.com/api/v2/alerts';
+
+const hook = (over: Partial<PbsNotificationTargetProps> = {}): PbsNotificationTargetProps => ({
+  method: 'post',
+  name: 'alertmanager',
+  target: PBS,
+  type: 'webhook',
+  url: AM,
+  ...over,
+});
+
+describe('which names are credentials', () => {
+  test('authorization, cookie and credential words — whole names or dash/underscore words', () => {
+    for (const name of ['Authorization', 'proxy-authorization', 'Cookie', 'X-Api-Key', 'api_key']) {
+      expect(isCredentialName(name)).toBe(true);
+    }
+    for (const name of ['X-Auth-Token', 'Private-Token', 'X-Gotify-Key', 'token', 'sig', 'code']) {
+      expect(isCredentialName(name)).toBe(true);
+    }
+    for (const name of ['Content-Type', 'X-Scope-OrgID', 'Author', 'Keyword', 'Passthrough']) {
+      expect(isCredentialName(name)).toBe(false);
+    }
+  });
+});
+
+describe('literal credentials are found by where they sit', () => {
+  test('headers: a literal is refused; a secrets template, `{ fromEnv }` and `""` are not', () => {
+    expect(
+      literalCredentialHeaders({
+        'Content-Type': 'application/json',
+        Cookie: `session=${LITERAL}`,
+        'X-Api-Key': { fromEnv: 'HOOK_KEY' },
+        Authorization: `Bearer ${LITERAL}`,
+        'X-Auth-Token': '{{secrets.token}}',
+        'X-Empty-Token': '',
+      }),
+    ).toEqual(['Authorization', 'Cookie']);
+    expect(literalCredentialHeaders({ Authorization: 'Bearer {{ secrets.token }}' })).toEqual([]);
+    expect(literalCredentialHeaders(undefined)).toEqual([]);
+  });
+
+  test('a URL: a userinfo password and credential-named query parameters, by name', () => {
+    expect(literalCredentialsInUrl(`https://pbs:${LITERAL}@am.example.com/x`)).toEqual([
+      'userinfo',
+    ]);
+    expect(literalCredentialsInUrl(`${AM}?token=${LITERAL}&team=ops&api_key=${LITERAL}`)).toEqual([
+      '?token',
+      '?api_key',
+    ]);
+    expect(literalCredentialsInUrl(`${AM}?code=${LITERAL}#token=${LITERAL}`)).toEqual([
+      '?code',
+      '?token',
+    ]);
+    expect(literalCredentialsInUrl(`${AM}#team=ops&sig=${LITERAL}`)).toEqual(['?sig']);
+  });
+
+  test('a URL that references its secrets, or has no password, is clean', () => {
+    for (const url of [
+      AM,
+      `${AM}?team=ops`,
+      `${AM}?token={{ url-encode secrets.token }}`,
+      'https://pbs:{{ secrets.pw }}@am.example.com/',
+      'https://pbs@am.example.com/',
+      `${AM}?token=`,
+      undefined,
+    ]) {
+      expect(literalCredentialsInUrl(url)).toEqual([]);
+    }
+  });
+
+  test('refusals name the header or the URL part — never the value', () => {
+    const reasons = refusals(
+      hook({ header: { Authorization: `Bearer ${LITERAL}` }, url: `${AM}?token=${LITERAL}` }),
+    );
+    expect(reasons).toHaveLength(2);
+    expect(reasons[0]).toStartWith("header 'Authorization' holds a literal credential");
+    expect(reasons[1]).toStartWith("'url' ?token holds a literal credential");
+    expect(reasons.join(' ')).not.toContain(LITERAL);
+  });
+});
+
+describe('through Alchemy: refused at plan, before anything is stored or sent', () => {
+  const run = async (props: PbsNotificationTargetProps) => {
+    const fake = fakeNotify();
+    let failure = '';
+    let stored = '';
+    await withoutBao(async () => {
+      const engine = engineOver(
+        PbsNotificationTargetProvider().pipe(Layer.provideMerge(fake.layer)),
+      );
+      await engine.deploy(PbsNotificationTarget('alertmanager', props)).catch((error: unknown) => {
+        failure = String(error);
+      });
+      stored = engine.stored();
+    });
+    return { failure, stored, writes: fake.writes() };
+  };
+
+  test('a literal Authorization header on a NEW target never reaches the store', async () => {
+    const { failure, stored, writes } = await run(
+      hook({ header: { Authorization: `Bearer ${LITERAL}` } }),
+    );
+    expect(failure).toContain("header 'Authorization' holds a literal credential");
+    expect(stored).not.toContain(LITERAL);
+    expect(writes).toEqual([]);
+  });
+
+  test('a literal query token on a NEW target never reaches the store', async () => {
+    const { failure, stored, writes } = await run(hook({ url: `${AM}?token=${LITERAL}` }));
+    expect(failure).toContain("'url' ?token holds a literal credential");
+    expect(stored).not.toContain(LITERAL);
+    expect(writes).toEqual([]);
+  });
+
+  test('any other refusal on a new target also fails before the row is written', async () => {
+    const { failure, stored } = await run(hook({ comment: LITERAL, mailto: ['x@example.com'] }));
+    expect(failure).toContain("'mailto' belongs to sendmail/smtp targets, not webhook");
+    expect(stored).not.toContain(LITERAL);
+  });
+});

package/src/proxmox/credential-literals.ts

@@ -0,0 +1,74 @@
+/**
+ * A credential written as a LITERAL in a plain prop — refused, because a plain prop is a value in
+ * the state store.
+ *
+ * ⛔ THE HOLE THIS CLOSES, MEASURED 2026-09-22 (adversarial review of PR 95). write-only.ts keeps
+ *   every `{ fromEnv }` value out of state, and the doc WARNED that a plain header value is a prop.
+ *   A warning is not a guard: `header: { Authorization: 'Bearer <token>' }` planned, deployed, and
+ *   left the token in the dumped state store — and so did `url: 'https://…?token=<token>'`. Alchemy
+ *   stores props unencrypted (write-only.ts has the StateEncoding reading), so the only safe
+ *   literal is one that is not a credential.
+ *
+ * ★ WHAT COUNTS AS A CREDENTIAL IS A NAME, NOT A VALUE. A value cannot be recognised — a token is
+ *   any string — but where it sits can: an `Authorization`/`Cookie` header, a header or query
+ *   parameter whose name has a word like `token`, `key`, `secret`, `password` or `signature`, and a
+ *   password in the URL's userinfo. A false positive costs one edit (declare it `{ fromEnv }`, or
+ *   hold it in `secret` and write `{{ secrets.<name> }}`); a false negative costs a leaked token.
+ * ★ A TEMPLATE THAT READS A SECRET IS NOT A LITERAL. `Bearer {{ secrets.token }}`, and
+ *   `{{ url-encode secrets.token }}` in a query, render on PBS from the root-only secret store —
+ *   the prop holds the reference, not the value.
+ *
+ * ⚠️ WHAT THIS CANNOT SEE: a token in a URL PATH (a Slack-style `/services/T…/B…/<token>`), in the
+ *   `body`, or in a `comment`. Those are plain props too; put the token in `secret` and reference
+ *   it from the template. docs/pbs-notifications.md says the same to the reader.
+ * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.
+ */
+import type { FromEnv } from './write-only.ts';
+
+/** `{{ secrets.x }}`, `{{secrets.x}}`, `{{ url-encode secrets.x }}` — a reference, not a value. */
+const READS_SECRET = /\{\{[^}]*\bsecrets\./;
+
+/** A whole-name match, or one dash/underscore-separated word of the name. */
+const CREDENTIAL_WORD =
+  /(^|[-_])(api[-_]?key|apikey|key|token|secret|password|passwd|pwd|pass|auth|signature|sig|code)($|[-_])/i;
+const CREDENTIAL_HEADER = /^(proxy-authorization|authorization|cookie)$/i;
+
+export const isCredentialName = (name: string): boolean =>
+  CREDENTIAL_HEADER.test(name) || CREDENTIAL_WORD.test(name);
+
+const literal = (value: string): boolean => value !== '' && !READS_SECRET.test(value);
+
+/** Plain header values that are credentials by their header's name. `{ fromEnv }` is never one. */
+export const literalCredentialHeaders = (
+  header: Readonly<Record<string, FromEnv | string>> | undefined,
+): string[] =>
+  Object.entries(header ?? {})
+    .filter(([name, value]) => typeof value === 'string' && isCredentialName(name))
+    .filter(([, value]) => literal(value as string))
+    .map(([name]) => name)
+    .sort();
+
+/**
+ * Where a URL carries a literal credential: `userinfo` (a password before the `@`), or the names
+ * of credential-shaped query (or fragment) parameters. Parsed by hand, not with `new URL`: a URL here is a
+ * TEMPLATE, and `{{ … }}` in the host or the userinfo is not a URL `new URL` will accept.
+ */
+export const literalCredentialsInUrl = (url: string | undefined): string[] => {
+  if (url === undefined) return [];
+  const out: string[] = [];
+  const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(url)?.[1] ?? '';
+  const at = authority.lastIndexOf('@');
+  if (at >= 0) {
+    const userinfo = authority.slice(0, at);
+    const colon = userinfo.indexOf(':');
+    if (colon >= 0 && literal(userinfo.slice(colon + 1))) out.push('userinfo');
+  }
+  // ⚠️ THE FRAGMENT TOO: it is never sent, but it is still a prop — and so still in state.
+  const params = url.replace(/^[^?#]*/, '');
+  for (const pair of params.split(/[?&#]/)) {
+    const eq = pair.indexOf('=');
+    const name = eq < 0 ? pair : pair.slice(0, eq);
+    if (eq >= 0 && isCredentialName(name) && literal(pair.slice(eq + 1))) out.push(`?${name}`);
+  }
+  return out;
+};