@homeflare/alchemy 0.31.1 → 0.31.2

package/dist/proxmox/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAiBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAwBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}

package/dist/proxmox/user-wire.d.ts

@@ -1,18 +1,47 @@
 /**
- * `Proxmox.User`'s wire shape: PVE's create/update forms and how a live item becomes
- * attributes. Split out of user.ts (2026-09-24, the distilled migration) to keep that file
- * under the 250-line cap — the api-token.ts/api-token-form.ts seam.
+ * `Proxmox.User`'s wire shape: PVE's create/update forms, how a live item becomes attributes,
+ * and the read itself. Split out of user.ts (2026-09-24, the distilled migration) to keep that
+ * file under the 250-line cap — the api-token.ts/api-token-form.ts seam.
  */
-import type * as access from '@distilled.cloud/proxmox/access';
+import * as access from '@distilled.cloud/proxmox/access';
+import * as Effect from 'effect/Effect';
 import type { UserAttributes, UserProps } from './user.ts';
+import { UNREADABLE, type Unreadable } from './unreadable-read.ts';
 export declare const USER_CREATE = "pve:POST /access/users";
 export declare const USER_UPDATE = "pve:PUT /access/users/{userid}";
 export declare const createForm: (props: UserProps) => access.CreateAccessUserRequest;
 export declare const updateForm: (props: UserProps) => access.PutAccessUserRequest;
-export declare const attributesOf: (live: access.GetAccessUserResponse, props: UserProps) => UserAttributes;
 /**
  * ⚠️ `tokens` IS NOT COMPARED, and neither is anything create-only. What is compared is exactly
  *   what a PUT can put back; a field PVE reports but will not accept is drift nobody can fix.
  */
 export declare const matches: (attributes: UserAttributes, props: UserProps) => boolean;
+/**
+ * ★ Default `read` role for this family — only the write side needs `provision`.
+ * ⛔ `{ userid: props.userid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression in
+ *   kit 0.31.1. `GetAccessUserRequest`'s schema declares only `userid` (a path label); any OTHER
+ *   key on the object passed to `access.getAccessUser` — `target`, `comment`, every field this
+ *   family's own props carry — is treated by distilled's `buildRequest` as an "unknown key" and
+ *   JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter
+ *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all
+ *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),
+ *   which `runPveWith` retries across every member and exhausts identically —
+ *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
+ *   false `update` on every account.
+ */
+export declare const readUserOrFail: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | Error | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/proxmox/Errors").ParameterVerificationFailed | import("@distilled.cloud/proxmox/Errors").ProxmoxParseError | import("./distilled-pve.ts").PveClusterExhausted | import("@distilled.cloud/caddy").ServiceUnavailable | import("effect/Cause").TimeoutError | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("@distilled.cloud/proxmox/Errors").UnknownProxmoxError, import("effect/unstable/http/HttpClient").HttpClient>;
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT. A
+ *   missing user is a thrown 500 (user.ts's own header), so `reconcile`'s create branch NEEDS
+ *   "absent" from a failure to ever run — without this fold, a brand-new account could never be
+ *   created. Safe here because a wrongful fold costs at most a redundant `createAccessUser` POST,
+ *   which PVE refuses loudly rather than silently corrupting anything.
+ * ⛔ `user.ts`'s `diff` does **NOT** use this — the SAME bug class as the credential denial fix:
+ *   folding a TRANSIENT failure into "absent" at PLAN TIME is what forced a false `update` with
+ *   nothing compared. `diff` calls `readUserOrFail` directly, so a genuine failure there
+ *   propagates and fails the whole plan loudly instead.
+ */
+export declare const readUser: (props: UserProps) => Effect.Effect<typeof UNREADABLE | UserAttributes | undefined, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export declare const dropUnreadable: (live: UserAttributes | Unreadable | undefined) => UserAttributes | undefined;
 //# sourceMappingURL=user-wire.d.ts.map

package/dist/proxmox/user-wire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3D,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAEH,eAAO,MAAM,YAAY,SACjB,MAAM,CAAC,qBAAqB,SAC3B,SAAS,KACf,cAgBD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC"}
+{"version":3,"file":"user-wire.d.ts","sourceRoot":"","sources":["../../src/proxmox/user-wire.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,iCAAiC,CAAC;AAC1D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAoB,MAAM,sBAAsB,CAAC;AAGrF,eAAO,MAAM,WAAW,2BAA2B,CAAC;AACpD,eAAO,MAAM,WAAW,mCAAmC,CAAC;AA2D5D,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,uBAGnD,CAAC;AAEH,eAAO,MAAM,UAAU,UAAW,SAAS,KAAG,MAAM,CAAC,oBAGnD,CAAC;AAoBH;;;GAGG;AACH,eAAO,MAAM,OAAO,eAAgB,cAAc,SAAS,SAAS,YAOF,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,UAAW,SAAS,g2BAG+C,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,UAAW,SAAS,+HAC0B,CAAC;AAEpE,gGAAgG;AAChG,eAAO,MAAM,cAAc,SAAU,cAAc,GAAG,UAAU,GAAG,SAAS,+BACpC,CAAC"}

package/dist/proxmox/user.d.ts

@@ -33,12 +33,12 @@
  *       user, so a role wide enough to edit the account can still be refused for one group.
  *     · `Sys.Audit` (or `User.Modify`) for the read, which the `read` role's auditor already has.
  *
- * ⚠️ A MISSING USER IS A 500, NOT A 404 — "no such user ('x@pve')". distilled turns that into an
- *   `UnknownProxmoxError` (protocol.ts), and `readOrUnreadable`'s own `orElseSucceed` folds it
- *   into "absent" same as the old hand-rolled client did. A 403 therefore also reads as absent
- *   UNLESS it is the one refusal `readOrUnreadable` catches (unreadable-read.ts): a REFUSED
- *   `provision` mint, the cries-wolf case. Any other refusal still reads as absent, and the
- *   honest error arrives one step later, from the create.
+ * ⚠️ A MISSING USER IS A 500, NOT A 404 — MEASURED against the live cluster, "no such user
+ *   ('x@pve')". distilled turns that into an `InternalServerError`, with no distinct "not found"
+ *   tag to catch. `user-wire.ts`'s `readUser` (used by `read`/`reconcile`, where the create
+ *   workflow needs "absent" from exactly this failure) still folds it; `readUserOrFail` (used by
+ *   `diff` below) does not — see that function's own header for why folding it there was the
+ *   cries-wolf bug all over again, just for a genuine PVE quirk instead of a permission denial.
  *
  * ⚠️ THE WIRE URL FOR THIS FAMILY CHANGED, THOUGH NOTHING A CALLER SEES DID. MEASURED
  *   (user.test.ts): distilled's `{userid}` label substitution percent-encodes it —

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAiBtE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAajE,eAAO,MAAM,mBAAmB,iIAgF7B,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AActE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,eAAO,MAAM,mBAAmB,iIAgG7B,CAAC"}

package/dist/verify/fake-engine.d.ts

@@ -48,11 +48,25 @@ export declare const writesOf: (cloud: Cloud) => string[];
 export declare const thingProviders: (cloud: Cloud) => Layer.Layer<Alchemy.Provider<Blind> | Alchemy.Provider<Recorded> | Alchemy.Provider<Thing>, never, never>;
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
 export type Body = Effect.Effect<unknown, unknown, unknown>;
+/** One row of `Alchemy.Drift.detect`'s dry-run report — the fields `drift` below asserts on. */
+export type DriftRow = {
+    readonly action: string;
+};
 export interface FakeEngine {
     /** Plan and apply `body`, as `alchemy deploy --adopt` would; resolves to the planned actions. */
     readonly deploy: (body: Body) => Promise<Record<string, string>>;
     /** Verify `body` against what the earlier deploys recorded. */
     readonly verify: (body: Body, options?: VerifyOptions) => Promise<AdoptReport>;
+    /**
+     * `alchemy drift`'s own dry-run (`Alchemy.Drift.detect`) over whatever `deploy` already
+     * persisted — `body` is used only to resolve the stack's name/stage/providers, exactly as
+     * `verify` does; drift itself reads the state store, not `body`'s declarations. ⚠️ A DIFFERENT
+     * ENGINE PATH FROM `verify`'s `--all` READ, proxmox/read-failure-propagation.test.ts's own ⛔:
+     * `Drift.ts` calls a provider's `read` with `output` set to the PERSISTED attributes, and folds
+     * a `read` that resolves `undefined` into `{action: 'missing'}` with no error — silent, unlike
+     * `verify.ts`'s `readWithState`, which already wraps that same call in `Effect.catchCause`.
+     */
+    readonly drift: (body: Body) => Promise<Record<string, DriftRow>>;
     /**
      * Every state row the store holds, as JSON — what a Postgres store would persist. ★ For tests
      * that must prove a value NEVER reaches state (proxmox/pbs-notification-target-state.test.ts).

package/dist/verify/fake-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,MAAM,WAAW,UAAU;IACzB,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAG,UAyC3E,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}
+{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,gGAAgG;AAChG,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAG,UAmD3E,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}

package/docs/grafana.md

@@ -8,32 +8,61 @@ publicly at `tesla.homeflare.dev/dash/`.
 
 ## The SDK gap — why only `Datasource` ships
 
+✅ **SDK-level gap fixed 2026-09-24** (`@distilled.cloud/grafana`, aliased onto
+`@homeflare/distilled-grafana` — 0.1.0 pre-release, 0.2.0 once its `minor` changeset publishes it;
+see [docs/distilled-interim.md](./distilled-interim.md)).
+The gap below is otherwise unchanged and left as evidence of what was measured and why; only its
+status line moved. **Still true today:** only `Grafana.Datasource` ships as a house _resource_ —
+`Grafana.Folder`, `Grafana.Dashboard`, `Grafana.AlertRule` and friends are follow-up work on top of
+the now-available SDK operations, not part of this fix.
+
 Measured 2026-09-24 against the published `@distilled.cloud/grafana@1.0.0-rc.12` tarball (its
-`lib/services/grafana.d.ts`, 4,938 lines): the package has **no create/read/update/delete
-operations for folders, dashboards, alert rules or contact points**. It covers datasources in
+`lib/services/grafana.d.ts`, 4,938 lines): the package had **no create/read/update/delete
+operations for folders, dashboards, alert rules or contact points**. It covered datasources in
 full (`addDataSource`, `getDataSourceByUID`, `updateDataSourceByUID`, `deleteDataSourceByUID`,
 `getDataSources`), plus org/user/team/role/report/annotation/library-element/public-dashboard/
 snapshot management — but:
 
-- **Folders:** only `updateFolderPermissions` exists. No `createFolder`, `getFolder` or
-  `deleteFolder` — Grafana's `/api/folders` and `/api/folders/{uid}` routes are entirely absent.
-- **Dashboards:** only snapshot and public-dashboard routes exist (`createDashboardSnapshot`,
+- **Folders:** only `updateFolderPermissions` existed. No `createFolder`, `getFolder` or
+  `deleteFolder` — Grafana's `/api/folders` and `/api/folders/{uid}` routes were entirely absent.
+- **Dashboards:** only snapshot and public-dashboard routes existed (`createDashboardSnapshot`,
   `getPublicDashboard`, …). No `POST /api/dashboards/db`, no `GET /api/dashboards/uid/{uid}`, no
-  `DELETE /api/dashboards/uid/{uid}` — the plain dashboard CRUD route family is absent.
+  `DELETE /api/dashboards/uid/{uid}` — the plain dashboard CRUD route family was absent.
 - **Alert rules:** only `routeGetAlertRuleExport`/`routeGetAlertRuleGroupExport`/
-  `routeGetAlertRulesExport` exist — export (read-only) endpoints under `/api/v1/provisioning/`.
+  `routeGetAlertRulesExport` existed — export (read-only) endpoints under `/api/v1/provisioning/`.
   No create/update/delete for `/api/v1/provisioning/alert-rules{,/{uid}}`.
-- **Contact points:** only `routeGetContactpointsExport` exists, same story — no
+- **Contact points:** only `routeGetContactpointsExport` existed, same story — no
   `/api/v1/provisioning/contact-points{,/{uid}}` CRUD.
 
-This is recorded in [`docs/upstream-conformance.md`](./upstream-conformance.md) rather than worked
+**Root cause, measured (not the spec lacking the paths):** Grafana's own OpenAPI document has
+every one of the routes above — the converter dropped them. `skipDeprecated: true` (the distilled
+converter's v0 default) skips any operation the spec marks `deprecated: true`, and Grafana marks
+its entire classic folder/dashboard/alerting-provisioning WRITE surface deprecated, each
+operation's `description` pointing at a `/apis/<group>.grafana.app/v1/...` Kubernetes-apiserver
+route that is a separate API server with its own OpenAPI document — absent from this spec
+entirely, and not what this family's `Grafana.Datasource` (or any planned `Grafana.Folder`/
+`Grafana.Dashboard`/etc.) targets. The fix patches `deprecated` back to `false` on exactly the 32
+operations this gap named (leaving the other 32 deprecated operations — playlists, org/user
+preferences, datasources-by-name, licensing, reports, dashboard stars/tags/versions — excluded, as
+before): see the distilled clone's `packages/grafana/scripts/convert.ts` header and
+`patches/*.patch.json` for the exact list and reasoning, and
+`packages/distilled-grafana/README.md` in this kit for the copied result. `Grafana.Datasource`'s
+own operations (`addDataSource`/`getDataSourceByUID`/`updateDataSourceByUID`/
+`deleteDataSourceByUID`) were never deprecated and are untouched — same props, same attributes,
+same generated code, confirmed by diffing the distilled clone's regenerated output against its
+prior commit operation-by-operation.
+
+This was recorded in [`docs/upstream-conformance.md`](./upstream-conformance.md) rather than worked
 around. Per S23, the fix is a distilled PR (regenerate against a spec that includes these routes,
-or patch them in per S22), not a hand-rolled `HttpClient` client in this package for the missing
-pieces alone — that would put half a family through the SDK and half through a second, parallel
-client, exactly what S23 exists to prevent.
-
-`teslamate-grafana` itself is consistent with this gap being real, not merely unexploited: its one
-datasource is API-manageable and already exists; its dashboards ship baked into the
+or patch them in per S22) — not a hand-rolled `HttpClient` client in this package for the missing
+pieces alone, which would put half a family through the SDK and half through a second, parallel
+client, exactly what S23 exists to prevent. It shipped as a kit interim package
+(`@homeflare/distilled-grafana`), the same S22 route `@homeflare/distilled-netbox` established,
+because `alchemy-run/distilled` is upstream and this house never pushes to it (decision 42) — see
+docs/distilled-interim.md.
+
+`teslamate-grafana` itself is consistent with this gap having been real, not merely unexploited:
+its one datasource is API-manageable and already exists; its dashboards ship baked into the
 `teslamate/grafana` image and are provisioned by the container, not by any API call; it has no
 folders, alert rules or contact points configured at all (measured over ssh, read-only, 2026-09-24).
 
@@ -96,7 +125,8 @@ export class TeslaMateDatasource extends GrafanaDatasource('teslamate-datasource
 
 ## Not covered
 
-- **Folders, dashboards, alert rules, contact points.** Blocked on the SDK gap above — a
-  maintainer decision on whether to patch distilled or wait for upstream to add the routes.
+- **Folders, dashboards, alert rules, contact points, notification policies, mute timings.** The
+  SDK-level blocker is fixed (above); no house `Resource` calls these operations yet — follow-up
+  work, not blocked on anything.
 - **`read` never answers `Unowned`** — the same open gap forgejo's and netbox's own families
   still carry (see upstream-conformance.md); a maintainer decision on the ownership-check shape.

package/docs/upstream-conformance.md

@@ -249,10 +249,20 @@ HttpClient` client. The old status-carrying `NetboxError` and its `cause.status
     `GET/DELETE /dashboards/uid/{uid}`), alert rules or contact points (both have only a
     `routeGet*Export` read-only route under `/v1/provisioning/`, no create/update/delete). S1
     found no upstream `Alchemy` family for any of these either. Full detail:
-    [grafana.md](./grafana.md#the-sdk-gap--why-only-datasource-ships). **Decision:** maintainer,
-    on whether the kit patches distilled (S22) or waits for upstream to add the routes — S23
-    forbids a hand-rolled `HttpClient` client for the missing pieces alone, half a family through
-    the SDK and half through a second client.
+    [grafana.md](./grafana.md#the-sdk-gap--why-only-datasource-ships).
+
+    ✅ **S22 fixed 2026-09-24** (branch `claude2/distilled-grafana`): root cause measured to be
+    `skipDeprecated: true` dropping 64 operations Grafana's own spec marks `deprecated: true` in
+    favor of a separate, undocumented-here Kubernetes-apiserver route — not a spec omission. RFC-6902
+    patches un-deprecate exactly the 32 operations this finding named (folders, dashboards,
+    alerting-provisioning writes); the other 32 stay excluded. Shipped as
+    `@homeflare/distilled-grafana` (0.1.0 pre-release, 0.2.0 once this PR's `minor` changeset
+    releases it), aliased onto `@distilled.cloud/grafana` the same S22 route
+    `@homeflare/distilled-netbox` established. `Grafana.Datasource`'s props/attributes/generated code
+    are unchanged (diffed operation-by-operation against the prior commit). **Still open, and not
+    this PR's scope:** no `Grafana.Folder`/`Dashboard`/`AlertRule`/`ContactPoint`/
+    `NotificationPolicy`/`MuteTiming` resource calls the newly-available operations yet — follow-up
+    PRs, no longer blocked on the SDK.
     - ⛔ **Same open gaps as `forgejo/*` and `netbox/*` above:** `read` never answers `Unowned`
       (H1), and credentials come from an explicit env var NAME at call time rather than an
       `alchemy/Auth` provider (S24) — here the house's own `grafanaCredentials(target)`, not the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.31.1",
+  "version": "0.31.2",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
@@ -107,6 +107,7 @@
   },
   "dependencies": {
     "@distilled.cloud/caddy": "npm:@homeflare/distilled-caddy@0.2.2",
+    "@distilled.cloud/grafana": "npm:@homeflare/distilled-grafana@0.2.0",
     "@distilled.cloud/litellm": "npm:@homeflare/distilled-litellm@0.2.0",
     "@distilled.cloud/netbox": "npm:@homeflare/distilled-netbox@0.3.0",
     "@distilled.cloud/paperless-ngx": "npm:@homeflare/distilled-paperless-ngx@0.3.0",
@@ -118,7 +119,6 @@
     "@distilled.cloud/discord": "1.0.0-rc.12",
     "@distilled.cloud/forgejo": "1.0.0-rc.12",
     "@distilled.cloud/google-workspace": "1.0.0-rc.12",
-    "@distilled.cloud/grafana": "1.0.0-rc.12",
     "@effect/platform-node": "4.0.0-rc.115",
     "@effect/sql-pg": "4.0.0-rc.115",
     "alchemy": "2.0.0-beta.79",

package/src/grafana/index.ts

@@ -5,11 +5,12 @@
  *   the symbols a real stack consumes; the rest of the files (resource.ts's engine, fake-grafana.ts)
  *   are internals a provider needs but a consumer should not depend on.
  *
- * ⛔ ONLY `Grafana.Datasource` SHIPS HERE. `@distilled.cloud/grafana@1.0.0-rc.12` has no folder,
- *   dashboard, alert-rule or contact-point CRUD operations — see docs/grafana.md and
- *   docs/upstream-conformance.md for the measured gap. Adding those resources now would mean
- *   hand-rolling an `HttpClient` client for them, which S23 forbids for a vendor distilled
- *   already covers in part; the right fix is upstream, in distilled, not a house workaround here.
+ * ⛔ ONLY `Grafana.Datasource` SHIPS HERE. `@distilled.cloud/grafana` (aliased onto
+ *   `@homeflare/distilled-grafana` — see docs/distilled-interim.md) now HAS folder, dashboard and
+ *   alerting-provisioning CRUD operations — the SDK-level gap docs/grafana.md and
+ *   docs/upstream-conformance.md recorded is fixed. Building `Grafana.Folder`, `Grafana.Dashboard`,
+ *   `Grafana.AlertRule` etc. on top of them is follow-up work this PR deliberately does not do —
+ *   see docs/grafana.md for what changed and what is still open.
  */
 export {
   type DatasourceAttributes,

package/src/proxmox/acl.ts

@@ -99,15 +99,21 @@ export const ProxmoxAcl = Resource<ProxmoxAcl>('Proxmox.Acl');
 
 /**
  * ⛔ `readRole: 'provision'`, WITHOUT WHICH EVERY GRANT READS BACK AS ABSENT — see the header's
- *   ⛔ on filtering. `orElseSucceed` still folds every OTHER failure into `undefined`.
+ *   ⛔ on filtering.
  * ★ `readOrUnreadable` (unreadable-read.ts) runs first: a REFUSED mint of `provision` — the
- *   "cries wolf" bug — comes back `UNREADABLE` instead of the same `undefined` a genuine
- *   absence produces, so `diff` below can tell them apart.
+ *   "cries wolf" bug — comes back `UNREADABLE` instead of the `undefined` a genuine, SUCCESSFUL
+ *   read (the row simply not being in the list) produces, so `diff` below can tell them apart.
+ * ⛔ NO `orElseSucceed` HERE ANY MORE — found on 2026-09-24, the SAME bug class as the credential
+ *   denial: it used to fold EVERY OTHER failure (a transport error, `PveClusterExhausted`, a
+ *   decode failure) into `undefined` too, which then read exactly like a genuine absence and
+ *   forced the same false `update`. Only a read that actually SUCCEEDS (and the grant is not in
+ *   the list it returns) may mean absent now; every other failure propagates and fails the whole
+ *   plan loudly — the engine's own contract for a failed `read`/`diff` (verify.ts's `readWithState`
+ *   already expects and reports it as `'failed'`).
  */
 const readAttributes = (props: AclProps) =>
   readOrUnreadable(runPve(props.target, 'provision', false, access.listAccessAcl({}))).pipe(
     Effect.map((rows) => (rows === UNREADABLE ? UNREADABLE : attributesOf(rows, props))),
-    Effect.orElseSucceed(() => undefined),
   );
 
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */

package/src/proxmox/api-token.ts

@@ -141,12 +141,22 @@ export const ProxmoxApiToken = Resource<ProxmoxApiToken>('Proxmox.ApiToken', {
   defaultRemovalPolicy: 'retain',
 });
 
-/** ⛔ `readRole: 'provision'` — see the header's ⚠️ on privileges. */
-const readToken = (props: ApiTokenProps) =>
-  readOrUnreadable(runPve(props.target, 'provision', false, access.getAccessUserToken(props))).pipe(
-    Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))),
-    Effect.orElseSucceed(() => undefined),
-  );
+/**
+ * ⛔ `readRole: 'provision'` — see the header's ⚠️ on privileges.
+ * ⛔ `{ userid, tokenid }`, NEVER THE WHOLE `props` — group.ts's readGroup has the full measured
+ *   mechanism (kit 0.31.1's regression): an extra key beyond the schema's own path labels gets
+ *   encoded onto this GET as a body, which a stricter fetch client refuses outright.
+ * ⛔ NO `orElseSucceed` — a MISSING token's absence signal is a SUCCESSFUL read with `expire`/
+ *   `privsep` both absent (`attributesOf`/api-token-form.ts, MEASURED pre-migration), unlike
+ *   user.ts/group.ts's missing-object 500 — so this family never needed their folding split. A
+ *   THROWN failure here is genuinely unexpected and must propagate and fail the plan loudly.
+ */
+const readToken = (props: ApiTokenProps) => {
+  const label = { tokenid: props.tokenid, userid: props.userid };
+  return readOrUnreadable(
+    runPve(props.target, 'provision', false, access.getAccessUserToken(label)),
+  ).pipe(Effect.map((live) => (live === UNREADABLE ? UNREADABLE : attributesOf(live, props))));
+};
 
 /** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
 const dropUnreadable = (live: ApiTokenAttributes | Unreadable | undefined) =>
@@ -193,12 +203,10 @@ export const ProxmoxApiTokenProvider = () =>
         }),
         reconcile: Effect.fn(function* ({ news }) {
           // ⚠️ `dropUnreadable`: reconcile only runs once `provision` already minted for the
-          //   read that fed `diff`'s `update` verdict, so `UNREADABLE` here is a narrow race —
-          //   but UNLIKE group/role/user, the message below assumes genuine absence and would
-          //   misname a transient credential refusal as "this resource does not create tokens".
-          //   Rare (the SAME role must mint twice, once for diff/once for reconcile, and only the
-          //   second is denied) and not silently wrong — the operator still sees a die() and goes
-          //   looking — but named here rather than left for the next reader to assume away.
+          //   read that fed `diff`'s `update` verdict, so `UNREADABLE` here is a narrow race, not
+          //   the routine case `diff` handles. Any OTHER read failure now propagates on its own
+          //   (readToken no longer folds it), so the die() message below is reached only on a
+          //   genuinely absent token, never on a transient failure wearing that message.
           const before = dropUnreadable(yield* readToken(news));
           if (before === undefined) {
             return yield* Effect.die(

package/src/proxmox/group-wire.ts

@@ -1,10 +1,13 @@
 /**
- * `Proxmox.Group`'s wire shape: PVE's create/update forms and how a live item becomes
- * attributes. Split out of group.ts (2026-09-24) to keep that file under the 250-line cap —
- * the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.
+ * `Proxmox.Group`'s wire shape: PVE's create/update forms, how a live item becomes attributes,
+ * and the read itself. Split out of group.ts (2026-09-24) to keep that file under the 250-line
+ * cap — the api-token.ts/api-token-form.ts seam, same reasoning as acl.ts/acl-wire.ts.
  */
-import type * as access from '@distilled.cloud/proxmox/access';
+import * as access from '@distilled.cloud/proxmox/access';
+import * as Effect from 'effect/Effect';
+import { runPve } from './distilled-pve.ts';
 import type { GroupAttributes, GroupProps } from './group.ts';
+import { UNREADABLE, type Unreadable, readOrUnreadable } from './unreadable-read.ts';
 import { csv, text } from './values.ts';
 
 export const GROUP_CREATE = 'pve:POST /access/groups';
@@ -41,10 +44,7 @@ export const updateForm = (props: GroupProps): access.PutAccessGroupRequest => (
   groupid: props.groupid,
 });
 
-export const attributesOf = (
-  live: access.GetAccessGroupResponse,
-  props: GroupProps,
-): GroupAttributes => ({
+const attributesOf = (live: access.GetAccessGroupResponse, props: GroupProps): GroupAttributes => ({
   /**
    * ⚠️ ABSENT IS EMPTY, NOT MISSING — `read_group` sets `comment` only `if defined(…)`. distilled
    *   types it `comment?: string`, so `text()`'s `''` fallback meets the same normalisation.
@@ -61,3 +61,57 @@ export const attributesOf = (
  */
 export const matches = (attributes: GroupAttributes, props: GroupProps) =>
   attributes.comment === storedComment(props.comment);
+
+/**
+ * ★ Default `read` role — nothing widened for this family, see group.ts's header privileges note.
+ * ⛔ `{ groupid: props.groupid }`, NEVER THE WHOLE `props` — MEASURED 2026-09-24, the regression
+ *   in kit 0.31.1. `GetAccessGroupRequest`'s schema declares only `groupid` (a path label); any
+ *   OTHER key on the object passed to `access.getAccessGroup` — `target`, `comment`, every field
+ *   this family's own props carry — is treated by distilled's `buildRequest` as an "unknown key"
+ *   and JSON-encoded onto the request as a BODY, on every one of these bodyless GETs. A stricter
+ *   fetch client than a bare `bun run` of this file refuses a GET carrying any body at all
+ *   (`TypeError [ERR_INVALID_ARG_VALUE]: fetch() request with GET/HEAD method cannot have body`),
+ *   which `runPveWith` retries across every member and exhausts identically —
+ *   `PveClusterExhausted`, then silently folded to "absent" by the old `orElseSucceed`, forcing a
+ *   false `update` on every group. `role.ts`'s list call and acl.ts's `listAccessAcl({})` were
+ *   never at risk: both are always called with a literal `{}`.
+ * ⛔ `live.members === undefined` IS DEFENSIVE, NOT THE ABSENCE SIGNAL — CORRECTED 2026-09-24.
+ *   This file previously claimed a missing group answers 200 with `{"data":null}`, unwrapped to
+ *   `{}`. MEASURED against the live cluster: `GET /access/groups/{missing}` answers a genuine 500
+ *   ("group '…' does not exist"), the SAME shape as user.ts's own measured 500 — there is no
+ *   success-path absence signal here at all. The check stays as insurance against a future PVE
+ *   release that does answer `{}`, but this function is what actually carries the "not found"
+ *   case, as a thrown error — `readGroup` below is the one that folds it.
+ */
+export const readGroupOrFail = (props: GroupProps) =>
+  readOrUnreadable(
+    runPve(props.target, 'read', false, access.getAccessGroup({ groupid: props.groupid })),
+  ).pipe(
+    Effect.map((live) =>
+      live === UNREADABLE
+        ? UNREADABLE
+        : live.members === undefined
+          ? undefined
+          : attributesOf(live, props),
+    ),
+  );
+
+/**
+ * ⛔ FOLDS A GENUINE READ FAILURE TO `undefined` TOO, AND ONLY `read`/`reconcile` MAY USE IT.
+ *   PVE's OWN missing-group answer is a thrown 500 (the ⛔ above), so `reconcile`'s create branch
+ *   NEEDS "absent" from a failure to ever run at all — without this fold, a brand-new group could
+ *   never be created, because its very-first read would always fail loudly. Safe here because a
+ *   wrongful fold costs at most a redundant `createAccessGroup` POST, which PVE refuses loudly
+ *   ("group already exists") rather than silently corrupting anything.
+ * ⛔ `group.ts`'s `diff` does **NOT** use this — found 2026-09-24, the SAME bug class as the
+ *   credential denial fix: folding a TRANSIENT failure (a `PveClusterExhausted`, the encoding bug
+ *   above) into "absent" at PLAN TIME is exactly what forced a false `update` with nothing
+ *   compared. `diff` calls `readGroupOrFail` directly instead, so a genuine failure there
+ *   propagates and fails the whole plan loudly — never silently misreports one row.
+ */
+export const readGroup = (props: GroupProps) =>
+  readGroupOrFail(props).pipe(Effect.orElseSucceed(() => undefined));
+
+/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
+export const dropUnreadable = (live: GroupAttributes | Unreadable | undefined) =>
+  live === UNREADABLE ? undefined : live;

package/src/proxmox/group.ts

@@ -76,19 +76,16 @@ import { guardWrite } from './distilled-guard.ts';
 import {
   GROUP_CREATE,
   GROUP_UPDATE,
-  attributesOf,
   createForm,
+  dropUnreadable,
   matches,
+  readGroup,
+  readGroupOrFail,
   updateForm,
 } from './group-wire.ts';
 import type { PveRequirements, WithTarget } from './resource-spec.ts';
 import { runPve } from './distilled-pve.ts';
-import {
-  UNREADABLE,
-  type Unreadable,
-  readOrUnreadable,
-  unreadableWarning,
-} from './unreadable-read.ts';
+import { UNREADABLE, unreadableWarning } from './unreadable-read.ts';
 
 export interface GroupProps extends WithTarget {
   /**
@@ -127,31 +124,6 @@ export const ProxmoxGroup = Resource<ProxmoxGroup>('Proxmox.Group', {
   defaultRemovalPolicy: 'retain',
 });
 
-/**
- * ★ Default `read` role — nothing widened for this family, see the header's privileges note.
- * ⛔ `live.members === undefined` MEANS ABSENT, NOT AN EMPTY GROUP. `@distilled.cloud/core`'s
- *   REST protocol unwraps PVE's `{"data": null}` (a genuinely missing object — MEASURED in
- *   `protocol.ts`: "a Unit-output endpoint... `data` is null/absent") to `{}` BEFORE the
- *   schema-driven decode, not to a decode failure. `members` is the one REQUIRED field on this
- *   response, so its absence is the only signal that the group was never there — the same trap
- *   api-token-form.ts's `attributes` guards with its own required-field check.
- */
-const readGroup = (props: GroupProps) =>
-  readOrUnreadable(runPve(props.target, 'read', false, access.getAccessGroup(props))).pipe(
-    Effect.map((live) =>
-      live === UNREADABLE
-        ? UNREADABLE
-        : live.members === undefined
-          ? undefined
-          : attributesOf(live, props),
-    ),
-    Effect.orElseSucceed(() => undefined),
-  );
-
-/** `read`/`reconcile` return `Attributes | undefined`; only `diff` tells `UNREADABLE` apart. */
-const dropUnreadable = (live: GroupAttributes | Unreadable | undefined) =>
-  live === UNREADABLE ? undefined : live;
-
 export const ProxmoxGroupProvider = () =>
   Provider.effect(
     ProxmoxGroup,
@@ -162,15 +134,31 @@ export const ProxmoxGroupProvider = () =>
          *   cluster, `admins` (grants `Administrator` on `/`) included. Adoption stays explicit.
          */
         list: () => Effect.succeed([]),
-        read: Effect.fn(function* ({ olds }) {
-          return dropUnreadable(yield* readGroup(olds));
+        // ⚠️ FOLDS ONLY WHEN `output` IS `undefined` — MEASURED 2026-09-24, an adversarial review
+        //   of this very fix caught the gap. The engine calls this ONE hook from FOUR places
+        //   (alchemy/src/{Plan,Apply,Drift}.ts), and only `output` tells them apart: Plan.ts's
+        //   cold-start adoption probe and interrupted-create recovery, and Apply.ts's
+        //   delete-recovery, all pass `output: undefined` — nothing is confirmed to exist yet, so
+        //   `readGroup`'s fold is still needed there or a brand-new group could never be adopted
+        //   or created. `Drift.ts` (`alchemy drift`/`sync`/`deploy --detect-drift`) is different:
+        //   it calls this on an ALREADY-CONFIRMED row (`output: old.attr`, defined), exactly
+        //   `diff`'s own situation below — a transient failure folded to `undefined` there is
+        //   reported as `{action: 'missing'}` with NO error at all, the cries-wolf bug again, one
+        //   command over. `readGroupOrFail` on that branch propagates it instead.
+        read: Effect.fn(function* ({ olds, output }) {
+          return dropUnreadable(
+            yield* output === undefined ? readGroup(olds) : readGroupOrFail(olds),
+          );
         }),
         diff: Effect.fn(function* ({ news, output }) {
           if (!isResolved(news)) return undefined;
           yield* guardWrite(GROUP_CREATE, createForm(news), output === undefined);
           yield* guardWrite(GROUP_UPDATE, updateForm(news), false);
           if (output === undefined) return undefined;
-          const live = yield* readGroup(news);
+          // ⚠️ `readGroupOrFail`, NOT `readGroup` — see that function's own ⛔. A genuine
+          //   TRANSIENT failure here propagates and fails the whole plan loudly instead of
+          //   folding to "absent" and forcing a false update, the cries-wolf class of bug.
+          const live = yield* readGroupOrFail(news);
           // ⛔ THE CRIES-WOLF FIX: a refused read used to fall into `undefined` below and force
           //   `update` on a group that was plainly there — see unreadable-read.ts.
           if (live === UNREADABLE) {