@homeflare/alchemy 0.19.1 → 0.21.0

package/src/linux/unit-preflight.ts

@@ -48,7 +48,7 @@ export const assertMayWrite = (runner: HostRunner, name: string): void => {
  * ⛔ A MASKED UNIT IS SOMEONE'S DECISION, NOT DRIFT. `systemctl mask` survives reboots and makes
  *   start fail; unmasking here would silently overrule whoever masked it.
  */
-export const assertUsable = (props: SystemdUnitProps, status: UnitStatus): void => {
+export const assertUsable = (props: Pick<SystemdUnitProps, 'name'>, status: UnitStatus): void => {
   if (status.loadState === 'masked' || status.unitFileState === 'masked') {
     throw refuse(
       props.name,
@@ -81,6 +81,24 @@ export const assertUnclaimed = async (
   }
 };
 
+/**
+ * The half of a rename check that needs only the NEW NAME: the old unit deletable, the new one
+ * writable and not masked.
+ * ★ ON ITS OWN it is for the rename unit-handlers.ts `diffHandler` spots while `content` is still
+ *   an Output. That plan is a delete-first replace too, so a masked target refused only in
+ *   reconcile would again arrive after the old unit was stopped. The unit file itself cannot be
+ *   compared until `content` resolves, so `assertUnclaimed` stays reconcile's job there.
+ */
+export const assertRenameTarget = async (
+  runner: HostRunner,
+  old: SystemdUnitAttributes,
+  name: string,
+): Promise<void> => {
+  assertMayWrite(runner, old.name);
+  assertMayWrite(runner, name);
+  assertUsable({ name }, await showUnit(runner, name));
+};
+
 /**
  * A rename, checked at plan time: the new identity must be valid, writable, not masked and free,
  * and the old one deletable — before the plan may promise a delete-first replace.
@@ -92,9 +110,7 @@ export const assertReplaceable = async (
   expect?: string,
 ): Promise<void> => {
   assertValid(next, expect);
-  assertMayWrite(runner, old.name);
-  assertMayWrite(runner, next.name);
-  assertUsable(next, await showUnit(runner, next.name));
+  await assertRenameTarget(runner, old, next.name);
   await assertUnclaimed(runner, next);
   await runner.checkWrite?.(unitPathFor(next), UNIT_WRITE);
 };

package/src/linux/unit-rename.test.ts

@@ -0,0 +1,76 @@
+/**
+ * The rename a plan sees while `content` is still an Output. `diffHandler` cannot run `diffUnit`
+ * there, but it still plans a delete-first replace — so the refusals that need only the new NAME
+ * have to fire in the plan, before Alchemy stops and removes the old unit.
+ *
+ * ★ The fully resolved rename is unit-preflight.test.ts. 🔴 Found by review (2026-09-22): this
+ *   branch returned the replace with no check at all.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { fakeLinuxHost } from './fake-linux-host.ts';
+import { renderUnit } from './unit-form.ts';
+import { diffHandler } from './unit-handlers.ts';
+import { diffUnit, reconcileUnit } from './unit-lifecycle.ts';
+
+const NAME = 'hf-example.service';
+const PATH = `/etc/systemd/system/${NAME}`;
+const RENAMED = 'hf-renamed.service';
+const RENAMED_PATH = `/etc/systemd/system/${RENAMED}`;
+const body = (exec: string) =>
+  renderUnit([
+    { lines: [['Description', 'example']], name: 'Unit' },
+    { lines: [['ExecStart', exec]], name: 'Service' },
+    { lines: [['WantedBy', 'multi-user.target']], name: 'Install' },
+  ]);
+
+const props = { content: body('/usr/bin/example'), name: NAME };
+// ★ An Effect is what isResolved() calls unresolved — the stand-in for a rendered digest.
+const pending = { content: Effect.succeed(props.content), name: RENAMED } as never;
+
+const running = async () => {
+  const fake = fakeLinuxHost({ dirs: { '/etc/systemd/system': 0 } });
+  const output = await reconcileUnit(fake.runner, props, undefined);
+  return { fake, output, writes: () => fake.calls.filter((call) => call[0] === 'write').length };
+};
+
+describe('a rename while content is still an Output', () => {
+  test('a free name plans a delete-first replace and writes nothing', async () => {
+    const { fake, output, writes } = await running();
+    const before = writes();
+    const diff = await Effect.runPromise(diffHandler(fake.runner, 'id', pending, output));
+    expect(diff).toEqual({ action: 'replace', deleteFirst: true });
+    expect(writes()).toBe(before);
+  });
+
+  test('a MASKED target is refused by the plan, with the old unit still running', async () => {
+    const { fake, output } = await running();
+    fake.placeUnit(RENAMED_PATH, body('/usr/bin/other'), { masked: true });
+    await expect(
+      Effect.runPromise(diffHandler(fake.runner, 'id', pending, output)),
+    ).rejects.toThrow(/is masked/);
+    expect(fake.units.get(NAME)?.active).toBe(true);
+    expect(fake.files.has(PATH)).toBe(true);
+  });
+
+  test('an unprivileged runner is refused before anything is removed', async () => {
+    const { fake, output } = await running();
+    const unprivileged = { ...fake.runner, effectiveUid: () => 1001, privileged: false };
+    await expect(
+      Effect.runPromise(diffHandler(unprivileged, 'id', pending, output)),
+    ).rejects.toThrow(/never calls sudo/);
+    expect(fake.units.get(NAME)?.active).toBe(true);
+  });
+});
+
+describe('a resolved rename', () => {
+  test('is read-only: the plan writes nothing, whatever it decided', async () => {
+    const { fake, output, writes } = await running();
+    const before = writes();
+    expect(await diffUnit(fake.runner, { ...props, name: RENAMED }, output)).toEqual({
+      action: 'replace',
+      deleteFirst: true,
+    });
+    expect(writes()).toBe(before);
+  });
+});

package/src/proxmox/ceph-adopt.test.ts

@@ -0,0 +1,210 @@
+/**
+ * The three Ceph Resources the barrel exports since 2026-09-22 — `CephDaemon`, `CephFs`,
+ * `CephOsd` — adopted and then undeclared through Alchemy's own Plan and Apply, over a fake cluster.
+ *
+ * ★ WHY THESE THREE COULD JOIN THE BARREL AT ALL: each is adopt-only BY SHAPE, and this file is
+ *   the proof rather than the claim. CephDaemon and CephFs compare nothing (`matches: () => true`),
+ *   so a present object is always `noop` and never a replace; CephOsd reads the CRUSH tree and
+ *   POSTs only when `dev` is declared, which nothing here does. All three default to `retain`.
+ * ⛔ WHAT A MISTAKE HERE WOULD COST ON A REAL CLUSTER: a mon DELETE loses a quorum member, a CephFS
+ *   DELETE breaks every mount, an OSD DELETE starts a rebalance. So every test ends on the same
+ *   assertion — `fake.writes()` is empty — and one row proves the harness can still see a refusal.
+ * ★ THE FIXTURE IS C1, THE KIT'S REFERENCE CLUSTER (docs/proxmox.md): three nodes, a mon, mgr and
+ *   mds on each, one CephFS, two ssd OSDs per node — shapes and counts measured, names and
+ *   addresses placeholders (RFC 5737). The rows carry only the keys the families read.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import {
+  type CephDaemonKind,
+  ProxmoxCephDaemon,
+  ProxmoxCephDaemonProvider,
+} from './ceph-daemon.ts';
+import { ProxmoxCephFs, ProxmoxCephFsProvider } from './ceph-fs.ts';
+import { ProxmoxCephOsd, ProxmoxCephOsdProvider } from './ceph-osd.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+
+const NODES = ['node-b', 'node-c', 'node-d'] as const;
+const KINDS: readonly CephDaemonKind[] = ['mon', 'mgr', 'mds'];
+const ip = (node: string) => `198.51.100.${String(12 + NODES.indexOf(node as never))}`;
+
+/**
+ * One collection answer per kind. ⚠️ Every node answers the SAME cluster-wide list — measured on
+ * C1, and the reason ceph-daemon-form.ts matches rows by `name` and never by position.
+ */
+const daemons: Record<CephDaemonKind, Record<string, unknown>[]> = {
+  mds: NODES.map((node) => ({
+    addr: `${ip(node)}:6801/1`,
+    ceph_version_short: '20.2.2',
+    host: node,
+    name: node,
+    rank: node === 'node-c' ? 0 : -1,
+    service: true,
+    standby_replay: false,
+    state: node === 'node-c' ? 'up:active' : 'up:standby',
+    ...(node === 'node-c' ? { fs_name: 'cephfs-c1' } : {}),
+  })),
+  mgr: NODES.map((node) => ({
+    addr: ip(node),
+    host: node,
+    name: node,
+    service: true,
+    state: node === 'node-b' ? 'active' : 'standby',
+  })),
+  mon: NODES.map((node, rank) => ({
+    addr: `${ip(node)}:6789/0`,
+    host: node,
+    name: node,
+    quorum: 1,
+    rank,
+    service: true,
+    state: 'running',
+  })),
+};
+
+const fs = [
+  {
+    data_pool: 'cephfs-c1_data',
+    data_pools: ['cephfs-c1_data'],
+    metadata_pool: 'cephfs-c1_metadata',
+    metadata_pool_id: 7,
+    name: 'cephfs-c1',
+  },
+];
+
+/** osd.{2,3} on node-b, osd.{1,4} on node-c, osd.{0,5} on node-d — C1's placement. */
+const OSDS: readonly (readonly [number, string])[] = [
+  [2, 'node-b'],
+  [3, 'node-b'],
+  [1, 'node-c'],
+  [4, 'node-c'],
+  [0, 'node-d'],
+  [5, 'node-d'],
+];
+
+/** ⚠️ The tree spells ids as STRINGS (`"2"`), exactly as measured; ceph-osd-tree.ts narrows them. */
+const tree = {
+  flags: 'sortbitwise,recovery_deletes,purged_snapdirs,pglog_hardlimit',
+  root: {
+    children: [
+      {
+        children: NODES.map((host) => ({
+          children: OSDS.filter(([, on]) => on === host).map(([id]) => ({
+            device_class: 'ssd',
+            host,
+            id: String(id),
+            in: 1,
+            leaf: 1,
+            name: `osd.${String(id)}`,
+            osdtype: 'bluestore',
+            status: 'up',
+            type: 'osd',
+          })),
+          name: host,
+          type: 'host',
+        })),
+        name: 'default',
+        type: 'root',
+      },
+    ],
+    leaf: 0,
+  },
+};
+
+/** GETs answer from the fixture; anything else is recorded and answered like a task that ran. */
+const cluster = () =>
+  fakePve((call: PveCall) => {
+    if (call.method !== 'GET') return 'UPID:node-b:fake';
+    const hit = /^nodes\/[^/]+\/ceph\/(mon|mgr|mds|fs|osd)$/.exec(call.path)?.[1];
+    if (hit === 'fs') return fs;
+    if (hit === 'osd') return tree;
+    return hit === undefined ? undefined : daemons[hit as CephDaemonKind];
+  });
+
+const providers = Layer.mergeAll(
+  ProxmoxCephDaemonProvider(),
+  ProxmoxCephFsProvider(),
+  ProxmoxCephOsdProvider(),
+);
+
+/**
+ * Every live Ceph object of the three families, declared the way a consuming stack would: each
+ * daemon on the node it runs on, the filesystem asked of any node, each OSD's failure domain and
+ * device class asserted.
+ */
+const everything = (osdHost: (host: string) => string = (host) => host) =>
+  Effect.all([
+    ...KINDS.flatMap((kind) =>
+      NODES.map((node) =>
+        ProxmoxCephDaemon(`${kind}-${node}`, { kind, node, target: FAKE_TARGET }),
+      ),
+    ),
+    ProxmoxCephFs('cephfs-c1', { name: 'cephfs-c1', node: 'node-b', target: FAKE_TARGET }),
+    ...OSDS.map(([osdid, host]) =>
+      ProxmoxCephOsd(`osd-${String(osdid)}`, {
+        device_class: 'ssd',
+        host: osdHost(host),
+        node: 'node-b',
+        osdid,
+        target: FAKE_TARGET,
+      }),
+    ),
+  ]);
+
+const engineFor = (fake: ReturnType<typeof cluster>) =>
+  engineOver(providers.pipe(Layer.provideMerge(fake.layer)));
+
+describe('adopting the live Ceph daemons, filesystem and OSDs', () => {
+  test('every row is noop to the verifier, adopted by the deploy, and only read', async () => {
+    const fake = cluster();
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(everything());
+      expect(report.rows).toHaveLength(16);
+      for (const row of report.rows) {
+        expect(row).toMatchObject({ changed: [], diff: 'noop', ok: true, planned: 'adopted' });
+      }
+      const planned = await engine.deploy(everything());
+      expect(new Set(Object.values(planned))).toEqual(new Set(['adopted']));
+      expect(Object.keys(planned)).toHaveLength(16);
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  /**
+   * ⛔ THE ONE THAT MATTERS MOST. `retain` is the whole reason a deleted line is not a lost mon, a
+   *   destroyed filesystem or a pulled replica; Alchemy plans the removal `orphaned` and must drop
+   *   only its own state row.
+   */
+  test('undeclaring all sixteen drops state rows and sends no DELETE', async () => {
+    const fake = cluster();
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      await engine.deploy(everything());
+      expect(engine.stored()).toContain('mon-node-b');
+      // ⚠️ `deploy` reports planned resources only; a removal lives in the plan's `deletions`, so
+      //   the proof is the state store emptying and the cluster seeing no write.
+      expect(await engine.deploy(Effect.void)).toEqual({});
+      for (const fqn of ['mon-node-b', 'mds-node-c', 'cephfs-c1', 'osd-0']) {
+        expect(engine.stored()).not.toContain(`"${fqn}"`);
+      }
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+
+  test('an OSD asserted on the wrong host fails the verifier and the deploy, and writes nothing', async () => {
+    const fake = cluster();
+    const moved = (host: string) => (host === 'node-b' ? 'node-c' : host);
+    await withoutBao(async () => {
+      const engine = engineFor(fake);
+      const report = await engine.verify(everything(moved));
+      const wrong = report.rows.filter((row) => !row.ok).map((row) => row.fqn);
+      expect(wrong.toSorted()).toEqual(['osd-2', 'osd-3']);
+      expect(report.rows.find((row) => row.fqn === 'osd-2')?.changed).toEqual(['host']);
+      await expect(engine.deploy(everything(moved))).rejects.toBeDefined();
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+});

package/src/proxmox/credential-literals.ts

@@ -23,7 +23,7 @@
  *   it from the template. docs/pbs-notifications.md says the same to the reader.
  * ⛔ A REFUSAL NAMES THE FIELD, NEVER THE VALUE — the message lands in a terminal and a CI log.
  */
-import type { FromEnv } from './write-only.ts';
+import type { FromEnv } from '../secrets/write-only.ts';
 
 /** `{{ secrets.x }}`, `{{secrets.x}}`, `{{ url-encode secrets.x }}` — a reference, not a value. */
 const READS_SECRET = /\{\{[^}]*\bsecrets\./;

package/src/proxmox/generated/pbs/nodes-node.ts

@@ -241,4 +241,4 @@ export type NodesNodeDisksZfsPostParams = {
 export type NodesNodeDisksZfsPostReturn = string;
 
 /** GET /nodes/{node}/disks/zfs/{name} — `data` payload after client unwrap. */
-export type NodesNodeDisksZfsNameGetReturn = {};
+export type NodesNodeDisksZfsNameGetReturn = Record<string, unknown>;

package/src/proxmox/generated/pbs.ts

@@ -13,6 +13,13 @@
  * ⚠️ 151 request parameters are typed `\`${number}\`` because the vendor calls them
  *   integer or number. They were `string` before, which accepted 'banana'. A caller holding a
  *   number writes \`${n}\` — `String(n)` is a plain `string` and will not typecheck, deliberately.
+ *
+ * ⛔ 135 OF THESE NAMES ARE ALSO EXPORTED BY `pve.ts`, MEANING SOMETHING ELSE. Both
+ *   products document a `/nodes/{node}` subtree, so a name like `NodesNodeCertificatesGetReturn`
+ *   exists on each side — here an array of objects, there `null`. Nothing stops a pve call
+ *   importing the pbs spelling: it compiles, and the type is simply wrong about the payload.
+ *   Import from the barrel that names your product. tests/schema-types.test.ts pins this count, so
+ *   a vendor upgrade that adds a collision fails there rather than at runtime.
  */
 export * from './pbs/access.ts';
 export * from './pbs/access-users.ts';

package/src/proxmox/generated/pve.ts

@@ -13,6 +13,13 @@
  * ⚠️ 480 request parameters are typed `\`${number}\`` because the vendor calls them
  *   integer or number. They were `string` before, which accepted 'banana'. A caller holding a
  *   number writes \`${n}\` — `String(n)` is a plain `string` and will not typecheck, deliberately.
+ *
+ * ⛔ 135 OF THESE NAMES ARE ALSO EXPORTED BY `pbs.ts`, MEANING SOMETHING ELSE. Both
+ *   products document a `/nodes/{node}` subtree, so a name like `NodesNodeCertificatesGetReturn`
+ *   exists on each side — here an array of objects, there `null`. Nothing stops a pbs call
+ *   importing the pve spelling: it compiles, and the type is simply wrong about the payload.
+ *   Import from the barrel that names your product. tests/schema-types.test.ts pins this count, so
+ *   a vendor upgrade that adds a collision fails there rather than at runtime.
  */
 export * from './pve/access.ts';
 export * from './pve/access-roles.ts';

package/src/proxmox/index.test.ts

@@ -4,6 +4,9 @@
  * ⛔ Vm stays Provider-only. NodeNetwork/NetworkApply stay off the barrel — they stage
  *   interfaces.new. ★ Lxc is a Resource since 2026-09-21: adopt-first, refuse-not-replace,
  *   retain on destroy (lxc.ts).
+ * ★ CephDaemon, CephFs and CephOsd are Resources since 2026-09-22: adopt-only by shape and retain
+ *   on destroy (ceph-adopt.test.ts). ⛔ CephFlag stays Provider-only: a declared flag reasserts a
+ *   maintenance toggle on every deploy (ceph-flag.ts).
  */
 import { expect, test } from 'bun:test';
 import { PbsDatastore, ProxmoxStorage } from './index.ts';
@@ -19,6 +22,9 @@ const resourceExports = [
   'PbsVerifyJob',
   'ProxmoxAcl',
   'ProxmoxBackupJob',
+  'ProxmoxCephDaemon',
+  'ProxmoxCephFs',
+  'ProxmoxCephOsd',
   'ProxmoxGroup',
   'ProxmoxHaResource',
   'ProxmoxHaRule',
@@ -50,14 +56,11 @@ test('the provisioning baseline is on the barrel: the list, the declaration, the
   expect(barrel.provisionBootstrap()).toStartWith('#!/bin/sh\n');
 });
 
-test('QEMU and NIC apply stay Provider-only', () => {
+test('QEMU, NIC apply and the Ceph flag stay Provider-only', () => {
   expect(src).not.toMatch(/export \{ ProxmoxVm[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxNodeNetwork[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxNetworkApply[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxApiToken[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxZfsPool[, }]/);
-  expect(src).not.toMatch(/export \{ ProxmoxCephOsd[, }]/);
-  expect(src).not.toMatch(/export \{ ProxmoxCephFs[, }]/);
-  expect(src).not.toMatch(/export \{ ProxmoxCephDaemon[, }]/);
   expect(src).not.toMatch(/export \{ ProxmoxCephFlag[, }]/);
 });

package/src/proxmox/index.ts

@@ -21,6 +21,18 @@
  * ★ THE VENDOR CONSTRAINT READER JOINED 2026-09-22 (codegen/README.md). `constraintsFor` and
  *   `violations` are exported so a CONSUMING stack can assert its own declarations offline — the
  *   `deploy:pbs` that failed on a 128-character comment had no way to ask that question.
+ * ★ THE CEPH DAEMON, FILESYSTEM AND OSD RESOURCES JOINED 2026-09-22, BECAUSE EACH IS ALREADY
+ *   ADOPT-ONLY BY SHAPE and a live cluster measured that way was waiting on nothing but this line.
+ *   `ProxmoxCephDaemon` (mon/mgr/mds) and `ProxmoxCephFs` compare nothing, so no edit can plan a
+ *   replace; `ProxmoxCephOsd` never POSTs unless `dev` is declared. All three default to `retain`,
+ *   so deleting a declaration drops a state row and leaves the quorum member, the filesystem or
+ *   the replica alone. ceph-adopt.test.ts pins adopting each as reads only, and removing each as
+ *   no DELETE, through Alchemy's own Plan and Apply.
+ * ⛔ `ProxmoxCephFlag` STAYS PROVIDER-ONLY, AND ON PURPOSE. A flag is a hand on the brake, not
+ *   configuration: a declared `noout: false` clears an operator's `noout` on EVERY deploy,
+ *   including one run for an unrelated resource in the middle of a maintenance window
+ *   (ceph-flag.ts has the whole argument). A stack that wants a flag set must reach for the
+ *   Provider deliberately; the barrel does not offer the sentence by default.
  * ★ Anything else unlisted is still reachable by path if you genuinely need
  *   it — that is a deliberate, visible act rather than an accident of barrelling.
  */
@@ -28,10 +40,10 @@ export { ProxmoxAcl, ProxmoxAclProvider } from './acl.ts';
 export { type AlertmanagerBodyOptions, alertmanagerAlertBody } from './alertmanager-body.ts';
 export { ProxmoxApiTokenProvider } from './api-token.ts';
 export { ProxmoxBackupJob, ProxmoxBackupJobProvider } from './backup-job.ts';
-export { ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
+export { ProxmoxCephDaemon, ProxmoxCephDaemonProvider } from './ceph-daemon.ts';
 export { ProxmoxCephFlagProvider } from './ceph-flag.ts';
-export { ProxmoxCephFsProvider } from './ceph-fs.ts';
-export { ProxmoxCephOsdProvider } from './ceph-osd.ts';
+export { ProxmoxCephFs, ProxmoxCephFsProvider } from './ceph-fs.ts';
+export { ProxmoxCephOsd, ProxmoxCephOsdProvider } from './ceph-osd.ts';
 export { ProxmoxCephPool, ProxmoxCephPoolProvider } from './ceph-pool.ts';
 export { constraintsFor, formViolations } from './constraint-guard.ts';
 export {
@@ -92,5 +104,5 @@ export { ProxmoxSdnVnet, ProxmoxSdnVnetProvider } from './sdn-vnet.ts';
 export { ProxmoxSdnZone, ProxmoxSdnZoneProvider } from './sdn-zone.ts';
 export { ProxmoxStorage, ProxmoxStorageProvider } from './storage.ts';
 export { ProxmoxUser, ProxmoxUserProvider } from './user.ts';
-export { type FromEnv } from './write-only.ts';
+export { type FromEnv } from '../secrets/write-only.ts';
 export { ProxmoxZfsPoolProvider } from './zfs-pool.ts';

package/src/proxmox/pbs-notification-target-form.ts

@@ -25,7 +25,7 @@ import type {
   PbsNotificationTargetProps,
 } from './pbs-notification-target.ts';
 import { base64, headerDigest, names, wireItem } from './pbs-notification-target-wire.ts';
-import { type Environment, type FromEnv, resolveAll, sealMatches } from './write-only.ts';
+import { type Environment, type FromEnv, resolveAll, sealMatches } from '../secrets/write-only.ts';
 
 type Props = PbsNotificationTargetProps;
 type Field = keyof Props;

package/src/proxmox/pbs-notification-target-lifecycle.ts

@@ -32,7 +32,7 @@ import {
   targetForm,
 } from './pbs-notification-target-form.ts';
 import { targetAttributes } from './pbs-notification-target-wire.ts';
-import { seal } from './write-only.ts';
+import { seal } from '../secrets/write-only.ts';
 
 type Props = PbsNotificationTargetProps;
 type Attributes = PbsNotificationTargetAttributes;

package/src/proxmox/pbs-notification-target-wire.ts

@@ -23,7 +23,7 @@ import type {
   PbsNotificationTargetProps,
 } from './pbs-notification-target.ts';
 import { bool, text } from './values.ts';
-import { seal } from './write-only.ts';
+import { seal } from '../secrets/write-only.ts';
 
 export const base64 = (value: string): string => Buffer.from(value, 'utf8').toString('base64');
 

package/src/proxmox/pbs-notification-target.ts

@@ -31,7 +31,7 @@ import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import { handlers } from './pbs-notification-target-lifecycle.ts';
 import type { PveRequirements, WithPbsTarget } from './resource.ts';
-import type { FromEnv } from './write-only.ts';
+import type { FromEnv } from '../secrets/write-only.ts';
 
 export type PbsNotificationTargetType = 'sendmail' | 'smtp' | 'webhook';
 

package/src/release/adopt-parity.test.ts

@@ -0,0 +1,106 @@
+/**
+ * Adoption through Alchemy's OWN Plan and Apply (openbao/fake-stack.ts): a file already at the path,
+ * and a stack holding no state for it. What binary-claim.ts decides, measured end to end — the plan
+ * and the apply must give the same answer, and `adopted` must never stand for other bytes.
+ *
+ * 🔴 EVERY REFUSAL BELOW WAS A SILENT WRITE OR LOSS BEFORE 2026-09-22 (adversarial review of PR 138,
+ *   lens: adoption and plan parity), each measured with this harness against the code before the
+ *   fix: other bytes under `--adopt` planned `adopted` (resolved) or `create` (directory an Output)
+ *   and were downloaded over in place; a symlink planned `adopted` and was refused only at apply;
+ *   a renamed declaration claimed the identical file at apply and its old name's delete removed it.
+ */
+import { describe, expect, test } from 'bun:test';
+import { BINARY } from './fake-release.ts';
+import { DIR, PATH, THEIRS, deployHarness as harness } from './fake-deploy.ts';
+
+describe('a file already at the path, with no state', () => {
+  test('OTHER bytes under --adopt, probed: the plan refuses; nothing fetched, their file kept', async () => {
+    const h = harness(true);
+    h.place(THEIRS);
+    await expect(h.stack.deploy(h.literal, { adopt: true })).rejects.toThrow(
+      '--adopt takes over only the pinned binary',
+    );
+    expect(h.events).toEqual([]);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(THEIRS);
+  });
+
+  test('OTHER bytes under --adopt, the directory an Output: refused at apply, before the download', async () => {
+    const h = harness(true);
+    h.place(THEIRS);
+    await expect(h.stack.deploy(h.wired(), { adopt: true })).rejects.toThrow(
+      '--adopt takes over only the pinned binary',
+    );
+    expect(h.events.filter((e) => e.startsWith('GET ') || e.startsWith('write '))).toEqual([]);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(THEIRS);
+  });
+
+  test('a symlink under --adopt: refused by the PLAN, not first by the apply', async () => {
+    const h = harness(true);
+    h.place(new Uint8Array(), 0o755, 'symlink');
+    // ★ The plan-side wording; the apply's own would be "is a symlink".
+    await expect(h.stack.deploy(h.literal, { adopt: true })).rejects.toThrow(
+      'something that is not a regular file',
+    );
+    expect(h.events).toEqual([]);
+  });
+
+  test('the pinned bytes with a wrong mode, under --adopt: adopted, re-written from disk, never fetched', async () => {
+    const h = harness(true);
+    h.place(BINARY.vmalert, 0o775);
+    expect(await h.stack.deploy(h.literal, { adopt: true })).toEqual({ vmalert: 'adopted' });
+    expect(h.events).toEqual([`write ${PATH}`]);
+    expect(h.fake.files.get(PATH)?.mode).toBe(0o755);
+  });
+
+  test('the pinned bytes, the directory an Output, under --adopt: kept, never fetched', async () => {
+    const h = harness(true);
+    h.place(BINARY.vmalert);
+    const planned = await h.stack.deploy(h.wired(), { adopt: true });
+    expect(planned).toEqual({ dir: 'adopted', vmalert: 'create' });
+    expect(h.events).toEqual([]);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(BINARY.vmalert);
+  });
+
+  test('a renamed declaration while its directory changes: refused at apply, the binary kept', async () => {
+    const h = harness(false);
+    await h.stack.deploy(h.wired('vmalert'));
+    h.events.length = 0;
+    // The directory's mode change leaves `dir.path` an Output at plan, so nothing probes the path.
+    await expect(h.stack.deploy(h.wired('vmalert-rules', 0o750))).rejects.toThrow(
+      'it holds the pinned binary, but this stack holds no state for it',
+    );
+    // 🔴 Before: planned {dir: update, vmalert-rules: create, vmalert: delete}; the new name took
+    //   the identical file as its own, the old name's delete removed it, and the deploy succeeded.
+    expect(h.events).not.toContain(`remove ${PATH}`);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(BINARY.vmalert);
+  });
+
+  test('the same rename declared with renamedFrom (the remedy the refusal names): the binary kept', async () => {
+    const h = harness(false);
+    await h.stack.deploy(h.wired('vmalert'));
+    h.events.length = 0;
+    const planned = await h.stack.deploy(h.wired('vmalert-rules', 0o750, 'vmalert'));
+    expect(planned).toEqual({ dir: 'update', 'vmalert-rules': 'update' });
+    expect(h.events).toEqual([`chmod 750 ${DIR}`]);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(BINARY.vmalert);
+  });
+
+  test('the same rename under --adopt: the new name takes the file, the old name leaves it', async () => {
+    const h = harness(false);
+    await h.stack.deploy(h.wired('vmalert'));
+    h.events.length = 0;
+    const planned = await h.stack.deploy(h.wired('vmalert-rules', 0o750), { adopt: true });
+    expect(planned).toEqual({ dir: 'update', vmalert: 'delete', 'vmalert-rules': 'create' });
+    // 🔴 Before 2026-09-22 (release gate): the old name's orphan delete ran `remove ${PATH}` after
+    //   the new name had claimed it, and the deploy succeeded with the binary gone.
+    expect(h.events).toEqual([`chmod 750 ${DIR}`]);
+    expect(h.fake.files.get(PATH)?.bytes).toEqual(BINARY.vmalert);
+    // The new name owns it now: the next deploy of the same declaration changes nothing.
+    h.events.length = 0;
+    expect(await h.stack.deploy(h.wired('vmalert-rules', 0o750))).toEqual({
+      dir: 'noop',
+      'vmalert-rules': 'noop',
+    });
+    expect(h.events).toEqual([]);
+  });
+});