@homeflare/alchemy 0.11.0 → 0.13.0

package/src/proxmox/sdn-apply-read.test.ts

@@ -2,7 +2,7 @@
  * The fabric comparison, which is what decides whether `Proxmox.SdnApply` publishes.
  *
  * ⛔ IT IS TESTED HERE RATHER THAN AGAINST THE CLUSTER BECAUSE STAGING A REAL FABRIC CHANGE MEANS
- *   TOUCHING CEPH'S CLUSTER NETWORK. TB4's OSPF fabric pins 10.100.0.102/103/104 to en05 and en06,
+ *   TOUCHING CEPH'S CLUSTER NETWORK. C1's OSPF fabric pins 203.0.113.102/103/104 to tb0 and tb1,
  *   and those are the addresses `cluster_network` runs over. The staged-zone path IS proven end to
  *   end against the live cluster (plan noop -> stage a zone -> plan update -> remove -> plan noop);
  *   the fabric path is proven by construction, with the two ways it could lie pinned below.
@@ -20,20 +20,20 @@ import { UNDIFFABLE, canonical, fabricStaged, subsystemAbsent } from './sdn-appl
 
 /** The shape `cluster/sdn/fabrics/all` actually returns, trimmed to what matters. */
 const N2 = {
-  fabric_id: 'tb4',
-  interfaces: ['name=en05', 'name=en06'],
-  ip: '10.100.0.102',
-  node_id: 'n2',
+  fabric_id: 'c1',
+  interfaces: ['name=tb0', 'name=tb1'],
+  ip: '203.0.113.102',
+  node_id: 'node-b',
 };
 const N3 = {
-  fabric_id: 'tb4',
-  interfaces: ['name=en05', 'name=en06'],
-  ip: '10.100.0.103',
-  node_id: 'n3',
+  fabric_id: 'c1',
+  interfaces: ['name=tb0', 'name=tb1'],
+  ip: '203.0.113.103',
+  node_id: 'node-c',
 };
 
 const running = {
-  fabrics: [{ area: '1', id: 'tb4', ip_prefix: '10.100.0.0/24', protocol: 'ospf' }],
+  fabrics: [{ area: '1', id: 'c1', ip_prefix: '203.0.113.0/24', protocol: 'ospf' }],
   nodes: [N2, N3],
 };
 
@@ -44,8 +44,8 @@ describe('fabric canonicalisation', () => {
         {
           area: '1',
           digest: '7b94d363ff69',
-          id: 'tb4',
-          ip_prefix: '10.100.0.0/24',
+          id: 'c1',
+          ip_prefix: '203.0.113.0/24',
           protocol: 'ospf',
         },
       ],
@@ -76,7 +76,7 @@ describe('fabric canonicalisation', () => {
   it('sees a changed node address', () => {
     const moved = {
       ...running,
-      nodes: [{ ...N2, ip: '10.100.0.199' }, N3],
+      nodes: [{ ...N2, ip: '203.0.113.199' }, N3],
     };
     assert.notEqual(canonical(moved), canonical(running));
   });
@@ -86,7 +86,7 @@ describe('fabric canonicalisation', () => {
       ...running,
       nodes: [
         ...running.nodes,
-        { fabric_id: 'tb4', interfaces: ['name=en05'], ip: '10.100.0.104', node_id: 'n4' },
+        { fabric_id: 'c1', interfaces: ['name=tb0'], ip: '203.0.113.104', node_id: 'node-d' },
       ],
     };
     assert.notEqual(canonical(added), canonical(running));
@@ -95,7 +95,7 @@ describe('fabric canonicalisation', () => {
   it('sees a changed interface list, which is what decides where the address lands', () => {
     const rewired = {
       ...running,
-      nodes: [{ ...N2, interfaces: ['name=en05'] }, N3],
+      nodes: [{ ...N2, interfaces: ['name=tb0'] }, N3],
     };
     assert.notEqual(canonical(rewired), canonical(running));
   });
@@ -135,7 +135,7 @@ describe('what a failed read is allowed to mean', () => {
   });
 
   it('counts an unchanged fabric as nothing staged and a moved node as staged', () => {
-    const moved = { ...running, nodes: [{ ...N2, ip: '10.100.0.199' }, N3] };
+    const moved = { ...running, nodes: [{ ...N2, ip: '203.0.113.199' }, N3] };
     assert.equal(fabricStaged(canonical(running), canonical(running)), 0);
     assert.equal(fabricStaged(canonical(moved), canonical(running)), 1);
   });

package/src/proxmox/sdn-apply-read.ts

@@ -3,12 +3,12 @@
  * collections this package declares resources for.
  *
  * 🔴 THE GAP THIS FILE CLOSES, AND IT WAS FOUND BY ALMOST DECLARING THE APPLY. `pendingCount` in
- *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. TB4 has zero of each — and a
- *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on n2:
+ *   sdn-apply.ts counted `cluster/sdn/zones` and `cluster/sdn/vnets`. C1 has zero of each — and a
+ *   staged OSPF FABRIC that nothing counted. MEASURED 2026-09-13 on node-b:
  *
- *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: tb4, area 1, ip_prefix 10.100.0.0/24
- *                                ospf_node: tb4_n2/n3/n4, interfaces en05 + en06,
- *                                ip 10.100.0.102 / .103 / .104
+ *     /etc/pve/sdn/fabrics.cfg   ospf_fabric: c1, area 1, ip_prefix 203.0.113.0/24
+ *                                ospf_node: c1_n2/node-c/node-d, interfaces tb0 + tb1,
+ *                                ip 203.0.113.102 / .103 / .104
  *     /etc/network/interfaces.d/sdn   the file PVE GENERATES from it, carrying those /32s
  *
  *   Those addresses are Ceph's `cluster_network`. So `diff` would have answered `noop` for ever
@@ -62,7 +62,7 @@ const MARKED = [
  *
  * ⚠️ NAMED RATHER THAN SILENTLY SKIPPED. `ipams` and `dns` answer HTTP 400 to both `?pending=1` and
  *   `?running=1`, so there is no way to ask them what is staged. They are a REAL blind spot: an
- *   ipam edited by hand is published by the apply and cannot be seen from here. TB4 has one ipam
+ *   ipam edited by hand is published by the apply and cannot be seen from here. C1 has one ipam
  *   (`pve`, the built-in) and zero dns entries, so the blind spot is currently empty — which is a
  *   fact about today, not a property of the design.
  */
@@ -181,7 +181,7 @@ const sortDeep = (value: unknown): unknown => {
  *
  * ⛔ ZERO HERE IS THE ONLY THING THAT MAKES DECLARING THE APPLY SAFE. `reconcile` runs on CREATE —
  *   Alchemy always calls it the first time a resource appears — and `PUT /cluster/sdn` regenerates
- *   `/etc/network/interfaces.d/sdn` on every node. On TB4 that file carries Ceph's cluster network.
+ *   `/etc/network/interfaces.d/sdn` on every node. On C1 that file carries Ceph's cluster network.
  */
 export const sdnPendingCount = (target: PveTarget) =>
   Effect.all([markedPending(target), fabricPending(target)], { concurrency: 'unbounded' }).pipe(

package/src/proxmox/sdn-apply.ts

@@ -6,7 +6,7 @@
  *   is the apply, and it is CLUSTER-WIDE — it publishes every staged object at once, not the one
  *   that happened to reconcile.
  *
- * ★ MEASURED ON TB4 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
+ * ★ MEASURED ON C1 ON 2026-09-13, NOT INFERRED. A probe zone was created, inspected and removed:
  *
  *     pvesh create /cluster/sdn/zones --zone zzprobe --type simple
  *     GET /cluster/sdn/zones/zzprobe              -> {"digest":"c438…","type":"simple","zone":"zzprobe"}
@@ -109,8 +109,8 @@ export const ProxmoxSdnApplyProvider = () =>
            *
            * 🔴 WHAT IT PREVENTS. `reconcile` runs on CREATE, the first time this resource appears
            *   in a stack, before `diff` has ever been consulted. `PUT /cluster/sdn` regenerates
-           *   `/etc/network/interfaces.d/sdn` on EVERY node at once — and on TB4 that file carries
-           *   the OSPF fabric holding Ceph's `cluster_network` on en05/en06. Without this branch,
+           *   `/etc/network/interfaces.d/sdn` on EVERY node at once — and on C1 that file carries
+           *   the OSPF fabric holding Ceph's `cluster_network` on tb0/tb1. Without this branch,
            *   adding one line to a stack file reloads networking on all three nodes simultaneously,
            *   which is precisely what the serialised NetworkApply chain exists to prevent.
            *

package/src/proxmox/sdn-subnet-form.ts

@@ -22,7 +22,7 @@ export type DhcpRange = { start: string; end: string };
  *
  * ⛔ MEASURED from `/usr/share/perl5/PVE/API2/Network/SDN/Subnets.pm` on pve-manager 9.2.11, in
  *   the create handler: `my $id = $cidr =~ s/\//-/r; $id = "$zoneid-$id";`. So `subnet=10.0.0.0/24`
- *   goes out and `house-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
+ *   goes out and `lab-10.0.0.0-24` is what exists afterwards. A CIDR cannot be a path segment
  *   anyway — it carries a slash — so there is no spelling of this endpoint that takes the CIDR.
  *
  * ⚠️ `.replace`, NOT `.replaceAll`, AND THE PARITY IS DELIBERATE. Perl's `s/\//-/r` has no `/g`, so

package/src/proxmox/sdn-subnet.ts

@@ -11,7 +11,7 @@
  *   `vnet`; a literal buys no ordering, and here it also buys a wrong path.
  *
  * ⛔ THE ID PVE FILES A SUBNET UNDER IS NOT THE ONE YOU WRITE, AND IT IS THIS FAMILY'S SHARPEST
- *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `house-10.0.0.0-24`.
+ *   EDGE. `POST` takes `subnet=10.0.0.0/24` while GET, PUT and DELETE address `lab-10.0.0.0-24`.
  *   One PVE parameter name, `subnet`, carrying two different values — so they are named APART here,
  *   `cidr` for the declared one and `subnetId` for the derived one, for the reason values.ts gives
  *   about `flag`: a name that means two things is a bug waiting for whoever reads one meaning. The
@@ -50,11 +50,11 @@
  *   seven privileges include SDN.Audit — at `/` with propagate=1. So the default 3600s auditor
  *   lease reads this family, and a `readRole: 'provision'` here would be privilege nobody needed.
  *   Writes are a different answer: POST, PUT and DELETE all require SDN.Allocate on
- *   `/sdn/zones/<zone>/<vnet>`, which `LXCProvisioner` gained on 2026-09-13.
+ *   `/sdn/zones/<zone>/<vnet>`, which the provision role gained on 2026-09-13 (`PROVISION_PRIVILEGES`).
  *
- * ⚠️ NO LIVE SUBNET EXISTS ON TB4 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
+ * ⚠️ NO LIVE SUBNET EXISTS ON C1 TO ROUND-TRIP AGAINST — there are no SDN zones and no vnets, so
  *   there can be no subnets. Every claim above is read off PVE 9.2.11's own schema and Perl sources
- *   on n2, and the noop argument below rests on those rather than on a plan this file has watched.
+ *   on node-b, and the noop argument below rests on those rather than on a plan this file has watched.
  *
  * ⚠️ TWO REFUSALS TO EXPECT, both from `SubnetPlugin::on_update_hook`: PVE will not put a subnet on
  *   a vnet with `vlanaware` set ("you can't add a subnet on a vlanaware vnet"), and it rejects a
@@ -98,7 +98,7 @@ export interface SdnSubnetProps extends WithTarget {
   gateway?: string;
   /**
    * Masquerade this subnet. ⚠️ INERT UNTIL THE CLUSTER FIREWALL IS ON — PVE's own description is
-   *   "enable masquerade for this subnet if pve-firewall", and TB4's cluster firewall was empty and
+   *   "enable masquerade for this subnet if pve-firewall", and C1's cluster firewall was empty and
    *   disabled when this was written. It still round-trips, so declaring it does not diff.
    */
   snat?: boolean;

package/src/proxmox/sdn-vnet.ts

@@ -35,12 +35,11 @@
  *   than an error — see the ⛔ in sdn-zone.ts and docs/privileges.md.
  *
  * ⚠️ PRIVILEGES, AND THE ESTATE'S CREDENTIAL HELD NONE OF THEM UNTIL 2026-09-13. reconcile and
- *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. `LXCProvisioner` grants
- *   SDN.Use, which is what a GUEST needs in order to attach to a vnet and NOT what creating one
- *   needs, so a container declared on this vnet works today while the vnet itself 403s. Widen
- *   deliberately, the way Pool.Allocate was:
- *   `pveum role modify LXCProvisioner --privs "<existing>,SDN.Allocate,SDN.Audit"` over SSH,
- *   preserving every existing privilege.
+ *   delete mint `provision` and need SDN.Allocate on `/sdn/zones`, or on the one zone if scoped. The provision role granted
+ *   only SDN.Use then, which is what a GUEST needs in order to attach to a vnet and NOT what
+ *   creating one needs, so a container on a vnet worked while the vnet itself 403'd. It was widened
+ *   the way Pool.Allocate was, and `PROVISION_PRIVILEGES` (provision-baseline.ts) now carries
+ *   SDN.Allocate and SDN.Audit.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/src/proxmox/storage.ts

@@ -21,9 +21,10 @@
  *   messages point away from the cause.
  *   ★ SO WIDEN OR RE-POINT BEFORE THE FIRST PLAN, outside this file: give the credential mount's
  *     `read` role `Datastore.Allocate` on `/storage`, or read this family with `provision`. The
- *     provision role in the estate this was written for holds `Datastore.AllocateSpace` and
+ *     provision role in the estate this was written for held only `Datastore.AllocateSpace` and
  *     `Datastore.Audit`, and NEITHER IS IT — AllocateSpace writes volumes INTO a storage, Allocate
- *     DEFINES one — so it 403s here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     DEFINES one — so it 403'd here until widened the way `Pool.Allocate` was for `Proxmox.Pool`.
+ *     The provisioning baseline (`provision-baseline.ts`) carries `Datastore.Allocate`.
  *
  * ⛔ THERE IS NO `password` PROP AND THERE MUST NEVER BE ONE. PBS and CIFS storages take one at
  *   create time, and Alchemy persists attributes UNENCRYPTED — a secret in props is one careless
@@ -68,7 +69,7 @@ export interface StorageProps extends WithTarget {
   /** `images,rootdir,vztmpl,iso,backup,snippets`. PVE reports `none` for an empty set. */
   content?: string;
   /**
-   * Node restriction, e.g. `n1,n2`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
+   * Node restriction, e.g. `node-a,node-b`. ⚠️ A STORAGE WITH A `nodes` LIST DOES NOT EXIST ANYWHERE ELSE:
    * an LXC declared on a node outside it fails at create with "storage not available on node".
    */
   nodes?: string;

package/src/proxmox/user.ts

@@ -29,8 +29,9 @@
  *   can then say what a delete would take with it — and kept OUT of `matches`, exactly like
  *   `pool.members`. Reported, never declared.
  *
- * ⚠️ RECONCILE NEEDS PRIVILEGES `LXCProvisioner` DOES NOT HOLD, so state them rather than meet a
- *   403 in the middle of a deploy (pool.ts records how that went the last time):
+ * ⚠️ RECONCILE NEEDS PRIVILEGES A GUEST-ONLY ROLE DOES NOT HOLD, so they are stated rather than met
+ *   as a 403 in the middle of a deploy (pool.ts records how that went the last time).
+ *   `PROVISION_PRIVILEGES` (provision-baseline.ts) carries every one of them:
  *     · `Realm.AllocateUser` on `/access/realm/<realm>` — create and delete.
  *     · `User.Modify` on `/access/groups`, and on `/access/groups/<group>` for EVERY group named in
  *       `groups` — create, update and delete. PVE checks the groups you are granting, not just the

package/src/proxmox/values.test.ts

@@ -99,11 +99,11 @@ describe('num and text', () => {
 
 describe('csv — a set PVE does not give back in the order it was handed', () => {
   it('is order insensitive, so two orderings compare equal', () => {
-    assert.equal(csv(['n3', 'n2']), csv('n2,n3'));
+    assert.equal(csv(['node-c', 'node-b']), csv('node-b,node-c'));
   });
 
   it('trims and drops empties, so a trailing comma is not a phantom member', () => {
-    assert.equal(csv('n2, n3,'), 'n2,n3');
+    assert.equal(csv('node-b, node-c,'), 'node-b,node-c');
   });
 });
 

package/src/proxmox/values.ts

@@ -168,7 +168,7 @@ export const int = (value: unknown, fallback: number) => {
  * A PVE update form with its clear-list attached, and the two guaranteed not to overlap.
  *
  * ⛔ PVE DIES IF A KEY IS SET AND DELETED IN ONE CALL, AND SIX FAMILIES HERE BUILT THAT FORM BY
- *   HAND. Measured in the shipped Perl on n2 — `PVE::SectionConfig::delete_from_config`, line 1860:
+ *   HAND. Measured in the shipped Perl on node-b — `PVE::SectionConfig::delete_from_config`, line 1860:
  *
  *     die "cannot set and delete property '$k' at the same time!\n"
  *         if defined($new_options->{$k});

package/src/proxmox/write-only.test.ts

@@ -0,0 +1,75 @@
+/**
+ * write-only.ts — resolving `{ fromEnv }` and the seal a plan compares instead of a value.
+ *
+ * ★ THE SEAL IS THE WHOLE CHANGE-DETECTION STORY FOR A SECRET THE SERVER WILL NOT RETURN, so each
+ *   property it relies on is pinned: the same values verify, a different value does not, key order
+ *   does not matter, and nothing malformed ever reads as a match.
+ */
+import { describe, expect, test } from 'bun:test';
+import { resolveAll, seal, sealMatches } from './write-only.ts';
+
+describe('resolveAll', () => {
+  test('resolves by variable name and reports every missing or empty one, by name', () => {
+    const env = { HOOK: 's3cret', EMPTY: '' };
+    const got = resolveAll(
+      { a: { fromEnv: 'HOOK' }, b: { fromEnv: 'EMPTY' }, c: { fromEnv: 'UNSET' } },
+      env,
+    );
+    expect(got.values).toEqual({ a: 's3cret' });
+    expect(got.missing).toEqual(['EMPTY', 'UNSET']);
+  });
+
+  test('does not trim: the value sent is the value in the environment', () => {
+    expect(resolveAll({ a: { fromEnv: 'X' } }, { X: ' v\n' }).values).toEqual({ a: ' v\n' });
+  });
+});
+
+describe('seal', () => {
+  const values = { 'secret:token': 'correct horse', password: 'battery staple' };
+
+  test('verifies the values it was made from, and no others', () => {
+    const sealed = seal(values);
+    expect(sealed).toStartWith('scrypt:');
+    expect(sealMatches(sealed, values)).toBe(true);
+    expect(sealMatches(sealed, { ...values, password: 'battery staplf' })).toBe(false);
+    expect(sealMatches(sealed, { 'secret:token': 'correct horse' })).toBe(false);
+  });
+
+  test('never contains a value, raw or base64', () => {
+    const sealed = seal(values);
+    for (const value of Object.values(values)) {
+      expect(sealed).not.toContain(value);
+      expect(sealed).not.toContain(Buffer.from(value).toString('base64'));
+    }
+  });
+
+  test('key order is not a change', () => {
+    const sealed = seal({ a: '1', b: '2' });
+    expect(sealMatches(sealed, { b: '2', a: '1' })).toBe(true);
+  });
+
+  test('a random salt by default: sealing twice gives two seals that both verify', () => {
+    const one = seal(values);
+    const two = seal(values);
+    expect(one).not.toBe(two);
+    expect(sealMatches(two, values)).toBe(true);
+  });
+
+  test('a fixed salt is deterministic — what a header digest needs to not churn state', () => {
+    expect(seal(values, 'fixed')).toBe(seal(values, 'fixed'));
+    expect(seal(values, 'fixed')).not.toBe(seal(values, 'other'));
+  });
+
+  test('nothing to seal is the empty string, and only nothing matches it', () => {
+    expect(seal({})).toBe('');
+    expect(sealMatches('', {})).toBe(true);
+    expect(sealMatches('', values)).toBe(false);
+  });
+
+  test('a malformed seal is never a match', () => {
+    const [, salt, digest] = seal(values).split(':');
+    for (const bad of [`md5:${salt}:${digest}`, `scrypt:${salt}`, `scrypt:${salt}:${digest}:x`]) {
+      expect(sealMatches(bad, values)).toBe(false);
+    }
+  });
+});

package/src/proxmox/write-only.ts

@@ -0,0 +1,106 @@
+/**
+ * Values a declaration may SEND and must never STORE — a webhook secret, a header carrying a
+ * credential, an smtp password — and the one form in which a plan may still remember them.
+ *
+ * ⛔ A SECRET PROP IS A SECRET IN THE STATE STORE, WHATEVER TYPE IT HAS. Alchemy persists props as
+ *   well as attributes — `delete` is handed `olds`, which can only have come from the store — and
+ *   it does not encrypt either: `StateEncoding.ts` TAGS a `Redacted` value and writes the inner
+ *   value beside the tag. So `Redacted` hides a secret from a log line and from nothing else.
+ *   notification-target.ts (PVE) answered that by making no secret declarable at all, and paid
+ *   for it: an authenticated smtp target or a signed webhook could not be created from code.
+ * ★ SO THE PROP HOLDS A NAME, NOT A VALUE. `{ fromEnv: 'PBS_HOOK_TOKEN' }` names the variable the
+ *   DEPLOYING process reads at call time — the shape forgejo/org-actions-secrets.ts already uses.
+ *   The name is what lands in state; the value exists only in that process's memory and on the
+ *   wire to the server.
+ *
+ * ⚠️ A PLAN STILL NEEDS TO KNOW WHETHER A VALUE CHANGED, AND IT CANNOT ASK THE SERVER. PBS returns a
+ *   webhook secret's NAME and never its value, and never returns an smtp password at all. So what
+ *   was last written is remembered as a SEAL: a salted scrypt digest, which lets the next plan
+ *   check "is the value in my environment the one I wrote" without the store holding anything a
+ *   reader could send to PBS.
+ *   ⚠️ A DIGEST OF A GUESSABLE SECRET IS STILL GUESSABLE. The salt defeats precomputed tables and
+ *     scrypt makes each guess cost memory and time; neither makes a dictionary word safe. The
+ *     remedy is a secret worth the name — a random token — not a faster hash.
+ */
+import { Buffer } from 'node:buffer';
+import { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
+
+/** A write-only value, by the NAME of the environment variable holding it. Never the value. */
+export interface FromEnv {
+  readonly fromEnv: string;
+}
+
+/** Where a value is looked up. Defaults to `process.env`, read at call time, never at load. */
+export type Environment = Readonly<Record<string, string | undefined>>;
+
+/**
+ * Each `name → FromEnv` resolved, or the variable names that could not be.
+ *
+ * ⚠️ AN EMPTY VARIABLE IS A MISSING ONE. A secret renderer that failed writes `NAME=` rather than
+ *   omitting the line, and sending `''` would store an empty secret on the server — a webhook that
+ *   authenticates with nothing, reported as a successful deploy.
+ * ⚠️ THE VALUE IS NOT TRIMMED. A token with a trailing newline is a broken header either way, and
+ *   trimming here would make the seal disagree with a value written by any other tool.
+ */
+export const resolveAll = (
+  refs: Readonly<Record<string, FromEnv>>,
+  env: Environment = process.env,
+): { readonly values: Readonly<Record<string, string>>; readonly missing: readonly string[] } => {
+  const values: Record<string, string> = {};
+  const missing: string[] = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value = env[ref.fromEnv];
+    if (value === undefined || value === '') missing.push(ref.fromEnv);
+    else values[key] = value;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+
+/**
+ * ★ PARAMETERS ARE NODE'S OWN SCRYPT DEFAULTS (N 2^14, r 8, p 1) — 16 MiB and tens of
+ *   milliseconds per digest. Plan runs it a handful of times per resource, which is noise, and a
+ *   guesser runs it once per guess, which is the point.
+ */
+const COST = { N: 16_384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 } as const;
+const PREFIX = 'scrypt';
+
+/** Key order must not change a digest, so entries are sorted and serialised as JSON pairs. */
+const canonical = (values: Readonly<Record<string, string>>): string =>
+  JSON.stringify(
+    Object.keys(values)
+      .sort()
+      .map((key) => [key, values[key]]),
+  );
+
+const digest = (salt: Buffer, values: Readonly<Record<string, string>>): Buffer =>
+  scryptSync(canonical(values), salt, 32, COST);
+
+/**
+ * `scrypt:<salt>:<digest>`, or `''` when there is nothing to seal.
+ *
+ * ★ A RANDOM SALT BY DEFAULT, FOR WHAT THIS PROVIDER WROTE. Pass a fixed one only for a value the
+ *   server returns anyway (a header), where a fresh salt per read would churn the state row on
+ *   every plan without protecting anything the server does not already show its auditors.
+ */
+export const seal = (values: Readonly<Record<string, string>>, salt?: string): string => {
+  if (Object.keys(values).length === 0) return '';
+  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, 'utf8');
+  return `${PREFIX}:${bytes.toString('base64url')}:${digest(bytes, values).toString('base64url')}`;
+};
+
+/**
+ * Whether `values` are the ones `sealed` was made from.
+ *
+ * ⚠️ A MALFORMED OR EMPTY SEAL ANSWERS FALSE, never throws: callers decide what "no evidence"
+ *   means, and every caller here treats it as "cannot tell" rather than as drift.
+ */
+export const sealMatches = (sealed: string, values: Readonly<Record<string, string>>): boolean => {
+  if (sealed === '') return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(':');
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer.from(stored, 'base64url');
+  const actual = digest(Buffer.from(salt, 'base64url'), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};

package/src/proxmox/zfs-pool-write.ts

@@ -51,7 +51,7 @@ const SETTLE_ATTEMPTS = 30;
 /**
  * Create the pool if it is absent, and otherwise leave it completely alone.
  *
- * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on n2: the
+ * ⛔ THE POST ONLY FORKS A WORKER. MEASURED in `/usr/share/perl5/PVE/API2/Disks/ZFS.pm` on node-b: the
  *   create handler ends in `$rpcenv->fork_worker('zfscreate', ...)` and its HTTP answer is a UPID
  *   returned the instant the worker is forked — before `zpool create` has run, let alone finished.
  *   A read-back taken immediately, as `pveOperations.reconcile` takes it, finds nothing and would

package/src/proxmox/zfs-pool.ts

@@ -22,22 +22,22 @@
  *     that one line turns a text edit into an unrecoverable one.
  *
  * ⛔ THERE IS NO PUT ON THIS FAMILY AT ALL. MEASURED from the cluster's own published schema
- *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on n2 2026-09-13): `/nodes/{node}/disks/zfs`
+ *   (`/usr/share/pve-docs/api-viewer/apidoc.js`, read on node-b 2026-09-13): `/nodes/{node}/disks/zfs`
  *   has GET and POST, `/nodes/{node}/disks/zfs/{name}` has GET and DELETE, and that is the whole
  *   surface. So `updateForm` is omitted — which, per `resource.ts`, makes any `matches` = false a
  *   REPLACE. A replace is a delete followed by a create, and on this family the delete is the
  *   thing above. Read the ⛔ on `matches` before adding anything to it.
  *
  * ⛔ NOT ONE CREATE PARAMETER COMES BACK ON READ, SO `matches` COMPARES NOTHING. MEASURED against
- *   the live cluster: `GET /nodes/n2/disks/zfs/rpool` answers exactly
+ *   the live cluster: `GET /nodes/node-b/disks/zfs/rpool` answers exactly
  *   `{action, children, errors, leaf, name, scan, state, status}` — no `ashift`, no `compression`,
  *   no `raidlevel`, no `devices`, no `add_storage`. Every create parameter is write-only. There is
  *   therefore no field a declaration and a live pool can both be asked about, and a `matches` that
  *   invented one would plan a replace — i.e. a `zpool destroy` — over a difference it could never
  *   verify in the first place.
  *
- * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/n2/disks/zfs`
- *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of n2 seconds
+ * ⚠️ AND WHAT THE INDEX RETURNS IS LIVE TELEMETRY, NOT CONFIGURATION. `GET /nodes/node-b/disks/zfs`
+ *   gives `alloc`, `free`, `frag`, `dedup`, `size`, `health`. MEASURED: two reads of node-b seconds
  *   apart returned `alloc` 14474944512 then 14472740864 — it moves on its own, with no declaration
  *   anywhere near it. `scan` in the detail read moves the same way (it carries the last scrub), and
  *   `status`/`action` appear and vanish as ZFS feature flags and faults come and go. None of them
@@ -155,7 +155,7 @@ export interface ZfsPoolAttributes {
    *
    * ⚠️ THIS IS WHAT ZFS RESOLVED, NOT WHAT WAS DECLARED, and the two normally differ: PVE rewrites
    *   a `/dev/sdb` into a by-id link before creating, and ZFS reports partition paths (`…-part3`)
-   *   for a pool built on partitions — MEASURED, that is exactly what n2's `rpool` reports. Never
+   *   for a pool built on partitions — MEASURED, that is exactly what node-b's `rpool` reports. Never
    *   compare it with `props.devices`.
    */
   devices: string;
@@ -219,7 +219,7 @@ const spec: PveSpec<ZfsPoolProps, ZfsPoolAttributes> = {
    *   can be compared on: every create parameter is write-only (see the ⛔ in the header) and
    *   everything the read does return is telemetry that moves by itself. So declaring what is live
    *   plans as `noop` — the only honest answer available, and the one the live cluster needs:
-   *   `rpool` exists on n2, n3 and n4 with nothing about its construction readable.
+   *   `rpool` exists on node-b, node-c and node-d with nothing about its construction readable.
    *   ⛔ ANYTHING ADDED HERE IS A REPLACE, NOT AN UPDATE. `updateForm` is omitted because PVE has
    *     no PUT, so `resource.ts` turns a false into `{action:'replace'}` — delete then create — on
    *     a family whose delete is `zpool destroy`. A comparison added here would be one plan away

package/src/talos/credentials.ts

@@ -4,9 +4,9 @@
  * ⛔ TALOSCONFIG AND secrets.yaml HOLD CLIENT CERTIFICATES AND CLUSTER CA PRIVATE KEYS. Alchemy
  *   persists resource attributes WITHOUT encryption — StateEncoding.ts writes `Redacted` as
  *   `{"@redacted": <plaintext>}` — and this estate's state store is the `alchemy` Postgres that
- *   pg-backup.sh dumps nightly. Neither file may be a prop, an attribute, or a log line.
+ *   a nightly job dumps. Neither file may be a prop, an attribute, or a log line.
  *
- * ★ MODELED ON house/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,
+ * ★ MODELED ON <estate>/proxmox/src/credentials.ts: mint at call time through `ChildProcessSpawner`,
  *   use the material to build a client, drop it when the scope ends. The difference is Talos wants a
  *   FILE (`--talosconfig` / `TALOSCONFIG`), so mint writes a temp path and registers cleanup.
  *
@@ -21,7 +21,7 @@ import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawne
 
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
-  /** OpenBao KV mount holding Talos material, e.g. `talos-tb4`. */
+  /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */
   readonly mount: string;
   /** Logical cluster name — safe to persist and log. */
   readonly cluster: string;

package/src/talos/values.test.ts

@@ -21,21 +21,21 @@ const FIXTURE_KUBECONFIG = `
 apiVersion: v1
 kind: Config
 clusters:
-  - name: hf-tb4
+  - name: hf-c1
     cluster:
-      server: https://10.20.10.50:6443
+      server: https://192.0.2.50:6443
       certificate-authority-data: ${b64('not a ca')}
 contexts:
-  - name: admin@hf-tb4
+  - name: admin@hf-c1
     context:
-      cluster: hf-tb4
-      user: admin@hf-tb4
+      cluster: hf-c1
+      user: admin@hf-c1
 users:
-  - name: admin@hf-tb4
+  - name: admin@hf-c1
     user:
       client-certificate-data: ${b64('not a certificate')}
       client-key-data: ${b64('not a key')}
-current-context: admin@hf-tb4
+current-context: admin@hf-c1
 `;
 
 describe('sha256', () => {
@@ -53,9 +53,9 @@ describe('configDigest', () => {
 
 describe('kubeconfigMetadata', () => {
   it('extracts public fields without returning PEM bytes', () => {
-    const meta = kubeconfigMetadata(FIXTURE_KUBECONFIG, 'admin@hf-tb4');
+    const meta = kubeconfigMetadata(FIXTURE_KUBECONFIG, 'admin@hf-c1');
     assert.ok(meta);
-    assert.equal(meta.endpoint, 'https://10.20.10.50:6443');
+    assert.equal(meta.endpoint, 'https://192.0.2.50:6443');
     // ⚠️ HASHED FROM THE SAME ENCODER THE FIXTURE USES, so the assertion cannot drift from it —
     //   and so no base64 blob has to appear in this file. See the ⛔ at the top.
     assert.equal(meta.caFingerprint, sha256(b64('not a ca')));

package/src/verify/cli.test.ts

@@ -43,7 +43,7 @@ const row = (over: Partial<AdoptRow>): AdoptRow => ({
   bindings: 0,
   changed: [],
   diff: 'noop',
-  fqn: 'house',
+  fqn: 'lab',
   ok: true,
   planned: 'adopted',
   read: 'found',

package/src/verify/fake-engine.ts

@@ -130,6 +130,11 @@ export interface FakeEngine {
   readonly deploy: (body: Body) => Promise<Record<string, string>>;
   /** Verify `body` against what the earlier deploys recorded. */
   readonly verify: (body: Body, options?: VerifyOptions) => Promise<AdoptReport>;
+  /**
+   * Every state row the store holds, as JSON — what a Postgres store would persist. ★ For tests
+   * that must prove a value NEVER reaches state (proxmox/pbs-notification-target-state.test.ts).
+   */
+  readonly stored: () => string;
 }
 
 /**
@@ -138,7 +143,8 @@ export interface FakeEngine {
  * ⚠️ THE CASTS ARE AT THE ENGINE'S TYPED BOUNDARY — openbao/fake-stack.ts has the reasoning.
  */
 export const engineOver = <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>): FakeEngine => {
-  const state = Alchemy.inMemoryState();
+  const rows: NonNullable<Parameters<typeof Alchemy.inMemoryState>[0]> = {};
+  const state = Alchemy.inMemoryState(rows);
   const stack = Alchemy.Stack as unknown as (
     name: string,
     options: { providers: typeof layer; state: typeof state },
@@ -161,6 +167,7 @@ export const engineOver = <ROut, E, RIn>(layer: Layer.Layer<ROut, E, RIn>): Fake
     );
 
   return {
+    stored: () => JSON.stringify(rows),
     deploy: (body) =>
       run(body, (compiled) =>
         Effect.gen(function* () {