@homeflare/alchemy 0.35.0 → 0.37.0

package/src/proxmox/ceph-daemon-form.ts

@@ -29,7 +29,7 @@
  *
  */
 import type { CephDaemonAttributes, CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
-import type { EndpointPair } from './resource-spec.ts';
+import type { EndpointKey } from './constraints.ts';
 import { bool, flag, num, text } from './values.ts';
 
 /**
@@ -38,19 +38,18 @@ import { bool, flag, num, text } from './values.ts';
  * ⛔ ONE PER KIND, NOT A `{type}` PATH. PVE registers `mds`, `mgr` and `mon` as three separate
  *   nodes with three separate parameter schemas — `hotstandby` belongs to the first and
  *   `mon-address` to the third — so a single key would enforce one kind's rules on all three.
- *   That is why `PveSpec['endpoint']` admits a function of props at all.
+ *   `ceph-daemon.ts` indexes this by `props.kind` for exactly that reason, on every `guardWrite`.
  * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by
  *   SCANNING THIS PACKAGE'S TEXT, so a key assembled from `props.kind` would be tabled by
  *   nothing and `constraintsFor` would throw on the first deploy that reached it.
  * ⚠️ THE PARAMETER NAMES DIFFER AND ARE THE VENDOR'S OWN — `{name}`, `{id}`, `{monid}`. The
  *   generator resolves each against the schema, so a tidied-up spelling stops the build.
- * ⚠️ NO `update` ON ANY OF THEM: none of the three has a PUT, which is why the spec declares no
- *   `updateForm` either.
+ * ⚠️ NO `update` HERE: none of the three kinds has a PUT — ceph-daemon-wire.ts's own header.
  */
-export const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointPair>> = {
-  mds: { create: 'pve:POST /nodes/{node}/ceph/mds/{name}' },
-  mgr: { create: 'pve:POST /nodes/{node}/ceph/mgr/{id}' },
-  mon: { create: 'pve:POST /nodes/{node}/ceph/mon/{monid}' },
+export const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointKey>> = {
+  mds: 'pve:POST /nodes/{node}/ceph/mds/{name}',
+  mgr: 'pve:POST /nodes/{node}/ceph/mgr/{id}',
+  mon: 'pve:POST /nodes/{node}/ceph/mon/{monid}',
 };
 
 /**

package/src/proxmox/ceph-daemon-wire.ts

@@ -0,0 +1,115 @@
+/**
+ * `Proxmox.CephDaemon`'s distilled wire lane: one dispatch per kind, because mon/mgr/mds are three
+ * separate distilled operations with three separate request shapes (`{node,monid}` /
+ * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a
+ * per-kind table rather than one templated string.
+ *
+ * ⛔ ONE READ FUNCTION, NOT THE readXOrFail/foldingX PAIR — the same deliberate, measured
+ *   departure ceph-pool-wire.ts and ceph-fs-distilled.ts explain in full: this family's
+ *   pre-migration `pveOperations.read` (resource.ts) already folded every failure unconditionally,
+ *   with no `output`-branching, so `readDaemon` below reproduces that exact single-fold shape
+ *   rather than gaining the newer dual-path pattern along the way.
+ *
+ * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name
+ *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body("mon-address")`,
+ *   confirmed against its schema), the same one-key pattern node-network-form.ts's `RENAMED`
+ *   table carries for three fields. `hotstandby` needs no rename.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
+import { daemonAttributes, daemonId, daemonPath } from './ceph-daemon-form.ts';
+import { runPve } from './distilled-pve.ts';
+
+/**
+ * The index, per kind — the same array `daemonAttributes`/`findRow` already narrow.
+ *
+ * ⚠️ CAST TO `unknown[]` PER BRANCH, NOT LEFT TO INFERENCE. mon/mgr/mds answer three DIFFERENT
+ *   row shapes (`ListNodeCephMonResponseBodyItem` and its two siblings), and a switch returning
+ *   each as-is infers their INTERSECTION rather than their union — TypeScript refuses that under
+ *   `exactOptionalPropertyTypes`. `daemonAttributes` already treats the row generically (it reads
+ *   by string key, the same shape acl.ts narrows), so the cast costs nothing real.
+ */
+const listRows = (props: CephDaemonProps) => {
+  const node = props.node;
+  switch (props.kind) {
+    case 'mon':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMon({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+    case 'mgr':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMgr({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+    case 'mds':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMds({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+  }
+};
+
+/** ⛔ FOLDS EVERY FAILURE TO `undefined` — see this file's own header for why. */
+export const readDaemon = (props: CephDaemonProps) =>
+  listRows(props).pipe(
+    Effect.map((rows) => daemonAttributes(rows as unknown as Record<string, unknown>, props)),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+/** POST — distilled's generator misnames it "update" (checked against `T.Http`); it is a create. */
+export const createDaemon = (props: CephDaemonProps) => {
+  const node = props.node;
+  const id = daemonId(props);
+  switch (props.kind) {
+    case 'mon':
+      return runPve(
+        props.target,
+        'provision',
+        true,
+        nodes.updateNodeCephMon({
+          ...(props['mon-address'] === undefined ? {} : { mon_address: props['mon-address'] }),
+          monid: id,
+          node,
+        }),
+      );
+    case 'mgr':
+      return runPve(props.target, 'provision', true, nodes.updateNodeCephMgr({ id, node }));
+    case 'mds':
+      return runPve(
+        props.target,
+        'provision',
+        true,
+        nodes.updateNodeCephMds({
+          ...(props.hotstandby === undefined ? {} : { hotstandby: props.hotstandby ? '1' : '0' }),
+          name: id,
+          node,
+        }),
+      );
+  }
+};
+
+/** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a
+ *   DELETE-body PVE would ignore, because nothing here is ever sent. */
+export const deleteDaemon = (props: CephDaemonProps) => {
+  const node = props.node;
+  const id = daemonId(props);
+  switch (props.kind) {
+    case 'mon':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMon({ monid: id, node }));
+    case 'mgr':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMgr({ id, node }));
+    case 'mds':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMds({ name: id, node }));
+  }
+};
+
+/** Re-exported so ceph-daemon.ts can narrow a switch exhaustively without importing the union twice. */
+export type { CephDaemonKind };
+
+/** ★ Moved here from ceph-daemon.ts's `reconcile` for the 250-line cap — matches ceph-fs.ts's own
+ *  `notCreated`/`notDestroyed` seam: the message, not the decision to die, lives with the calls. */
+export const notCreated = (props: CephDaemonProps) =>
+  new Error(
+    `${daemonPath(props)}: no ${props.kind} named ${daemonId(props)} in GET nodes/` +
+      `${props.node}/ceph/${props.kind} after the create task finished. POST answers a UPID, ` +
+      'not a result -- watch the task in the PVE UI (ceph-daemon-form.ts).',
+  );

package/src/proxmox/ceph-daemon-write.test.ts

@@ -0,0 +1,158 @@
+/**
+ * `Proxmox.CephDaemon`'s write paths, through Alchemy's own Plan and Apply over a fake cluster —
+ * the paths ceph-adopt.test.ts does not reach: it is adopt-only by design (every assertion there
+ * ends on `fake.writes()` empty). Proves the distilled-based create (ceph-daemon-wire.ts) POSTs
+ * with the right per-kind body — `mon-address` renamed to `mon_address` for mon, `hotstandby` for
+ * mds — reads back, and that delete sends exactly one DELETE.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { ProxmoxCephDaemon, ProxmoxCephDaemonProvider, reconcileDaemon } from './ceph-daemon.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+
+const NODE = 'node-b';
+
+describe('a genuinely new mon', () => {
+  test('POSTs mon-address as mon_address, and reads the collection back', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mon`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let created = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return created ? [{ addr: '198.51.100.12:6789/0', name: NAME, state: 'running' }] : [];
+      }
+      // ⚠️ POST lands on the daemon's OWN path (`{monid}`), not the collection — see
+      //   ceph-daemon-form.ts's own ⛔ on `collectionPath`/`daemonPath`.
+      if (call.method === 'POST' && call.path === OBJECT) {
+        created = true;
+        return `UPID:${NODE}:fake:createmon`;
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declared = () =>
+        ProxmoxCephDaemon('node-b-mon', {
+          kind: 'mon',
+          'mon-address': '198.51.100.12',
+          name: NAME,
+          node: NODE,
+          target: FAKE_TARGET,
+        });
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mon': 'create' });
+    });
+    expect(fake.calls.find((c) => c.method === 'POST')?.form['mon-address']).toBe('198.51.100.12');
+    expect(fake.writes()).toEqual([`POST ${OBJECT}`]);
+  });
+});
+
+describe('a genuinely new mds', () => {
+  test('POSTs hotstandby, and reads the collection back', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mds`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let created = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return created ? [{ name: NAME, state: 'up:standby' }] : [];
+      }
+      if (call.method === 'POST' && call.path === OBJECT) {
+        created = true;
+        return `UPID:${NODE}:fake:createmds`;
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declared = () =>
+        ProxmoxCephDaemon('node-b-mds', {
+          hotstandby: true,
+          kind: 'mds',
+          name: NAME,
+          node: NODE,
+          target: FAKE_TARGET,
+        });
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mds': 'create' });
+    });
+    expect(fake.calls.find((c) => c.method === 'POST')?.form['hotstandby']).toBe('1');
+  });
+});
+
+describe('destroying a mgr', () => {
+  test('RemovalPolicy.destroy() then undeclaring sends exactly one DELETE', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mgr`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let deleted = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return deleted ? [] : [{ name: NAME, state: 'active' }];
+      }
+      if (call.method === 'DELETE' && call.path === OBJECT) {
+        deleted = true;
+        return `UPID:${NODE}:fake:destroymgr`;
+      }
+      return undefined;
+    });
+    const declared = () =>
+      ProxmoxCephDaemon('node-b-mgr', { kind: 'mgr', name: NAME, node: NODE, target: FAKE_TARGET });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mgr': 'adopted' });
+      await engine.deploy(declared().pipe(RemovalPolicy.destroy()));
+      await engine.deploy(Effect.void);
+    });
+    expect(fake.writes()).toEqual([`DELETE ${OBJECT}`]);
+  });
+});
+
+describe("reconcile called directly, no diff first — the adversarial review's own proof", () => {
+  /**
+   * ⚠️ STRUCTURAL, NOT A REFUSAL — checked directly before writing this test:
+   *   `constraints.ts`'s `violations()` never checks a bare `format` rule (`mon-address`'s own
+   *   `{"format":"ip-list","type":"string"}` carries no `pattern`), and `mds`/`mgr`'s create
+   *   endpoints have EMPTY constraint tables — so nothing in this family's vendor table can
+   *   actually refuse a bad value today (a separate, recorded gap; not this PR's to fix). What IS
+   *   provable, and what the review's finding was actually about, is that `guardWrite` — and so
+   *   `createForm(news)`, which it must evaluate to build the value it checks — runs on the
+   *   ADOPTED-ROW PATH at all, before the `live !== undefined` early return. A getter on
+   *   `mon-address` proves it: `createForm` is the ONLY thing that reads this field on that path
+   *   (`createDaemon`, the other reader, is never reached when `live` is already defined), so it
+   *   firing at all means the guard ran; it firing zero times is exactly the bug the review found.
+   */
+  test('guardWrite (and the createForm it checks) still runs on an adopted row, before the early return', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mon`;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return [{ addr: '198.51.100.12:6789/0', name: NAME, state: 'running' }];
+      }
+      return undefined;
+    });
+    let reads = 0;
+    const news = {
+      get 'mon-address'() {
+        reads += 1;
+        return '198.51.100.99';
+      },
+      kind: 'mon' as const,
+      name: NAME,
+      node: NODE,
+      target: FAKE_TARGET,
+    };
+    await withoutBao(async () => {
+      // ⛔ NOT engine.deploy() — this calls the exported `reconcileDaemon` straight, the way a
+      //   resumed apply or a verify harness would, with no `diff` run first.
+      const after = await Effect.runPromise(
+        reconcileDaemon({ news }).pipe(Effect.provide(fake.layer)),
+      );
+      expect(after.state).toBe('running');
+    });
+    expect(reads).toBeGreaterThan(0);
+    expect(fake.writes()).toEqual([]);
+  });
+});

package/src/proxmox/ceph-daemon.ts

@@ -45,19 +45,19 @@
  *   needs no widening for once. ⚠️ `Sys.Modify` on the ROOT path is broad — it also buys
  *   datacenter options and every other cluster-wide config write — so it is worth knowing that
  *   this credential already has it rather than discovering it the next time something is scoped.
+ *
+ * ★ MIGRATED OFF `client.ts` (2026-09-24, decision 43, 2c) — ceph-daemon-wire.ts has the rename
+ *   and why no protocol gap blocks any of the three kinds; `readDaemon` there keeps this family's
+ *   pre-migration single-fold shape (ceph-pool-wire.ts explains why that is not left unfixed).
  */
 import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import {
-  DAEMON_ENDPOINTS,
-  collectionPath,
-  createForm,
-  daemonAttributes,
-  daemonPath,
-} from './ceph-daemon-form.ts';
-import { pve } from './client.ts';
-import { type PveRequirements, type WithTarget, pveHandlers } from './resource.ts';
+import { DAEMON_ENDPOINTS, createForm } from './ceph-daemon-form.ts';
+import { createDaemon, deleteDaemon, notCreated, readDaemon } from './ceph-daemon-wire.ts';
+import { guardWrite } from './distilled-guard.ts';
+import { type PveRequirements, type WithTarget } from './resource.ts';
 
 /**
  * Which Ceph daemon this is. The discriminant picks the collection, the create parameters and
@@ -180,33 +180,41 @@ export const ProxmoxCephDaemon = Resource<ProxmoxCephDaemon>('Proxmox.CephDaemon
   defaultRemovalPolicy: 'retain',
 });
 
-const handlers = pveHandlers<CephDaemonProps, CephDaemonAttributes>({
-  attributes: daemonAttributes,
-  /** ⛔ The ID path, not the collection — POST is registered on `{id}`, exactly like a metric server. */
-  collection: daemonPath,
-  createForm,
-  /** ⚠️ A function, because the kind picks the endpoint — see `DAEMON_ENDPOINTS`. */
-  endpoint: (props: CephDaemonProps) => DAEMON_ENDPOINTS[props.kind],
-  /**
-   * ⛔ TOTAL, AND THIS IS THE REASON THE FILE EXISTS RATHER THAN A SHORTCUT PAST WRITING IT. Every
-   *   field a declaration can carry is CREATE-ONLY and unreadable — `mon-address` comes back as a
-   *   different kind of string, `hotstandby` comes back as a state Ceph elects — and every field
-   *   the read returns is assigned by Ceph: state, rank, quorum, fs_name, standby_replay, addr,
-   *   version. Nothing is left that is both declared and readable. So the honest comparison is
-   *   "does a daemon of this kind and name exist", which `attributes` has already answered by
-   *   returning a value at all, and anything further would be a diff no write could ever satisfy.
-   *   ⛔ AND ON THIS FAMILY THAT DIFF IS NOT MERELY NOISY. There is no PUT, so resource.ts answers
-   *     `replace` rather than `update` whenever `matches` is false — and replace on a mon is
-   *     delete-then-create against a live quorum. A forever-diff here is a forever-OUTAGE-RISK.
-   *   ⚠️ THE PRICE, STATED PLAINLY: editing `hotstandby` or `mon-address` on a declared daemon
-   *     plans as `noop` and never applies. Same bargain storage.ts strikes for a changed `type`.
-   *     Change one by removing the declaration and re-adding it, ONE DAEMON AT A TIME, reading the
-   *     ⛔ on destroy in the header first.
-   */
-  matches: () => true,
-  /** ⛔ The COLLECTION, because there is no GET on the id path. See the second ⛔ in the header. */
-  path: collectionPath,
-  /** ⚠️ No `updateForm`: none of the three has a PUT, so nothing about a daemon is editable. */
+/**
+ * ⛔ TOTAL, AND THIS IS THE REASON THE FILE EXISTS RATHER THAN A SHORTCUT PAST WRITING IT. Every
+ *   field a declaration can carry is CREATE-ONLY and unreadable — `mon-address` comes back as a
+ *   different kind of string, `hotstandby` comes back as a state Ceph elects — and every field
+ *   the read returns is assigned by Ceph: state, rank, quorum, fs_name, standby_replay, addr,
+ *   version. Nothing is left that is both declared and readable. So the honest comparison is
+ *   "does a daemon of this kind and name exist", which `readDaemon` has already answered by
+ *   returning a value at all, and anything further would be a diff no write could ever satisfy.
+ *   ⛔ AND ON THIS FAMILY THAT DIFF IS NOT MERELY NOISY. There is no PUT, so a false mismatch
+ *     would have to be a REPLACE — and replace on a mon is delete-then-create against a live
+ *     quorum. A forever-diff here is a forever-OUTAGE-RISK.
+ *   ⚠️ THE PRICE, STATED PLAINLY: editing `hotstandby` or `mon-address` on a declared daemon
+ *     plans as `noop` and never applies. Same bargain storage.ts strikes for a changed `type`.
+ *     Change one by removing the declaration and re-adding it, ONE DAEMON AT A TIME, reading the
+ *     ⛔ on destroy in the header first.
+ */
+/**
+ * ★ The factory's shape with no `updateForm`: create if absent, else read back untouched.
+ * ⛔ `guardWrite` RUNS RIGHT AFTER THE READ, UNCONDITIONALLY, NOT ONLY ON THE CREATE BRANCH —
+ *   found on adversarial review, 2026-09-24, matching node-network.ts's own `reconcile`.
+ *   `reconcile` also runs for an ADOPTED row with no fresh `diff` first (Plan.ts forces it after
+ *   the probe even when `diff` said noop), so a guard only on the create branch would let a
+ *   caller that skips `diff` (a resumed apply, a verify harness) reach `createDaemon` with
+ *   `mon-address` — a real vendor rule — unchecked.
+ * ★ EXPORTED SO A TEST CAN CALL IT DIRECTLY, bypassing `diff` — the shape the review's own proof
+ *   needed: `findProvider` gives back the wrapped service, this gives the plain function.
+ */
+export const reconcileDaemon = Effect.fn(function* ({ news }: { news: CephDaemonProps }) {
+  const live = yield* readDaemon(news);
+  yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), live === undefined);
+  if (live !== undefined) return live;
+  yield* createDaemon(news);
+  const after = yield* readDaemon(news);
+  if (after === undefined) return yield* Effect.die(notCreated(news));
+  return after;
 });
 
 export const ProxmoxCephDaemonProvider = () =>
@@ -214,19 +222,29 @@ export const ProxmoxCephDaemonProvider = () =>
     ProxmoxCephDaemon,
     Effect.succeed(
       ProxmoxCephDaemon.Provider.of({
-        ...handlers,
+        /** ⛔ Empty, like every other resource here — adopting the whole cluster's daemons is not
+         *   an accident anyone should be one `destroy` away from. Adoption stays explicit. */
+        list: () => Effect.succeed([]),
+        read: ({ olds }) => readDaemon(olds),
+        // ★ Matches the pre-migration factory shape exactly (resource.ts): present is settled.
+        diff: Effect.fn(function* ({ news, output }) {
+          if (!isResolved(news)) return undefined;
+          yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), output === undefined);
+          if (output === undefined) return undefined;
+          const live = yield* readDaemon(news);
+          if (live === undefined) {
+            yield* guardWrite(DAEMON_ENDPOINTS[news.kind], createForm(news), true);
+            return { action: 'update' } as const;
+          }
+          return { action: 'noop' } as const;
+        }),
+        reconcile: ({ news }) => reconcileDaemon({ news }),
         /**
-         * ⛔ THE ONE HANDLER NOT TAKEN FROM THE FACTORY, AND THE ONLY REASON IS THE PATH SPLIT.
-         *   `ops.destroy` DELETEs `spec.path`, which this resource must point at the collection so
-         *   that `read` works at all; DELETE on the collection is not implemented and would answer
-         *   501 while the daemon kept running — a failed destroy that reads like a permissions
-         *   problem. Everything else here is the factory's.
-         * ⚠️ AND IT IS THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a
-         *   plan that removes a mon run: two gone at once is a cluster with no quorum and every
-         *   guest on `rbd-c1` blocked on I/O.
+         * ⛔ THE DANGEROUS ONE. Re-read the destroy ⛔ in the header before letting a plan that
+         *   removes a mon run: two gone at once is a cluster with no quorum and every guest on
+         *   `rbd-c1` blocked on I/O.
          */
-        delete: ({ olds }: { olds: CephDaemonProps }) =>
-          pve(olds.target, 'provision', 'DELETE', daemonPath(olds)),
+        delete: ({ olds }) => deleteDaemon(olds),
       }),
     ),
   );

package/src/proxmox/ceph-fs-delete.test.ts

@@ -0,0 +1,81 @@
+/**
+ * `Proxmox.CephFs`'s destroy path — the one place in this migration that composes a distilled
+ * call (`readFs`, before and after) with a hand-client one (`destroyFs`, unmigrated — ceph-fs-
+ * wire.ts's header has the measured protocol reason) inside a single handler. Flagged by
+ * adversarial review as untested anywhere in the repo before this file: `readFs` alone is proven
+ * by ceph-fs-write.test.ts and ceph-adopt.test.ts, `destroyFs` alone is unchanged from main, but
+ * the two composed together — on a destructive, hard-to-reverse `RemovalPolicy.destroy()` — had
+ * no coverage of the seam itself.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { ProxmoxCephFs, ProxmoxCephFsProvider } from './ceph-fs.ts';
+import { engineOver } from '../verify/fake-engine.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+
+const NODE = 'node-b';
+const NAME = 'oldfs';
+const INDEX = `nodes/${NODE}/ceph/fs`;
+const OBJECT = `${INDEX}/${NAME}`;
+const UPID = 'UPID:node-b:fake:destroyfs';
+const TASK_STATUS = `nodes/${NODE}/tasks/${encodeURIComponent(UPID)}/status`;
+
+const declared = () => ProxmoxCephFs(NAME, { name: NAME, node: NODE, target: FAKE_TARGET });
+
+describe('destroying a CephFS', () => {
+  test(
+    'RemovalPolicy.destroy() then undeclaring: readFs (distilled) finds it, destroyFs ' +
+      '(client.ts) removes it, and the distilled read-back confirms it is gone',
+    async () => {
+      let destroyed = false;
+      const fake = fakePve((call: PveCall) => {
+        if (call.method === 'GET' && call.path === INDEX) {
+          return destroyed
+            ? []
+            : [{ data_pool: `${NAME}_data`, metadata_pool: `${NAME}_metadata`, name: NAME }];
+        }
+        if (call.method === 'DELETE' && call.path === OBJECT) {
+          destroyed = true;
+          return UPID;
+        }
+        if (call.method === 'GET' && call.path === TASK_STATUS) {
+          return { exitstatus: 'OK', status: 'stopped' };
+        }
+        return undefined;
+      });
+      await withoutBao(async () => {
+        const engine = engineOver(ProxmoxCephFsProvider().pipe(Layer.provideMerge(fake.layer)));
+        expect(await engine.deploy(declared())).toEqual({ [NAME]: 'adopted' });
+        await engine.deploy(declared().pipe(RemovalPolicy.destroy()));
+        await engine.deploy(Effect.void);
+      });
+      expect(fake.writes()).toEqual([`DELETE ${OBJECT}`]);
+    },
+  );
+
+  test('a filesystem already removed by hand: delete is a no-op, not a false DELETE', async () => {
+    let removedByHand = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === INDEX) {
+        return removedByHand
+          ? []
+          : [{ data_pool: `${NAME}_data`, metadata_pool: `${NAME}_metadata`, name: NAME }];
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephFsProvider().pipe(Layer.provideMerge(fake.layer)));
+      expect(await engine.deploy(declared())).toEqual({ [NAME]: 'adopted' });
+      await engine.deploy(declared().pipe(RemovalPolicy.destroy()));
+      // ⚠️ Cleaned up outside Alchemy, AFTER that redeploy and BEFORE the undeclare below —
+      //   `readFs` (distilled) already answers absent by the time `delete` runs, the same branch
+      //   ceph-fs.ts's own ⚠️ on `delete` documents. Removing it any earlier would instead read as
+      //   drift on the redeploy above and reconcile a create, which is a different test.
+      removedByHand = true;
+      await engine.deploy(Effect.void);
+    });
+    expect(fake.writes()).toEqual([]);
+  });
+});

package/src/proxmox/ceph-fs-distilled.ts

@@ -0,0 +1,102 @@
+/**
+ * `Proxmox.CephFs`'s distilled half: the index read and the create — see ceph-fs-wire.ts's own
+ * header for why `destroyFs` stays there, on `client.ts`, unmigrated.
+ *
+ * ⛔ `nodes.updateNodeCephFs` IS distilled's GENERATOR MISNAMING A CREATE, NOT A SECOND ENDPOINT.
+ *   Checked directly against its schema (`T.Http({ method: "POST", uri:
+ *   "/nodes/{node}/ceph/fs/{name}" })`) rather than trusted from the function name — it is the
+ *   SAME single write PVE registers, `createfs`. Harmless once named here for what it is.
+ *
+ * ★ THE SETTLE POLL IS A SEPARATE FUNCTION FROM ceph-fs-wire.ts's, NOT A SHARED ONE, because it
+ *   calls a different task-status operation on a different transport — `nodes.getNodeTaskStatus`
+ *   here, `pve()` there — but the POLICY is identical on purpose: same cadence
+ *   (`POLL_SECONDS`/`POLL_ATTEMPTS`, imported, not retyped), same "an unreadable status is not
+ *   settled yet, not a failure" tolerance. That tolerance is why this calls the RAW distilled
+ *   operation directly rather than `@distilled.cloud/proxmox`'s own `Task.awaitTask` — CHECKED
+ *   against its source (`task.ts`): it propagates a poll failure as a genuine typed
+ *   `GetNodeTaskStatusError` instead of treating it as "not yet", which would turn a missing
+ *   `Sys.Audit` grant or a node mid-restart into a failed create instead of a patient one.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { CephFsProps } from './ceph-fs.ts';
+import { POLL_ATTEMPTS, POLL_SECONDS, createForm, objectPath, readRow } from './ceph-fs-wire.ts';
+import { runPve } from './distilled-pve.ts';
+
+/**
+ * The index, read via distilled — the same shape `readRow` (ceph-fs-wire.ts) already narrows.
+ *
+ * ⛔ FOLDS EVERY FAILURE TO `undefined`, matching the pre-migration `pveOperations.read` this
+ *   family used (`resource.ts`, `Effect.orElseSucceed`) — the same single-fold shape
+ *   ceph-pool-wire.ts's `readPoolStatus` preserves and explains: this migration's own rule is
+ *   behaviour surviving byte-for-byte, not the newer dual-path pattern gaining a new family.
+ */
+export const readFs = (props: CephFsProps) =>
+  runPve(props.target, 'read', false, nodes.listNodeCephFs({ node: props.node })).pipe(
+    Effect.map((rows) => readRow(rows as unknown as Record<string, unknown>, props)),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+/** `updateNodeCephFs`'s own request shape — `createForm`, translated. No field is renamed. */
+const toDistilledCreate = (props: CephFsProps): nodes.UpdateNodeCephFsRequest =>
+  ({
+    ...createForm(props),
+    name: props.name,
+    node: props.node,
+  }) as unknown as nodes.UpdateNodeCephFsRequest;
+
+/** Wait for the create's forked task — the distilled twin of ceph-fs-wire.ts's `settle`. */
+const settleCreate = (props: CephFsProps, upid: string) =>
+  Effect.gen(function* () {
+    for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
+      const status = yield* runPve(
+        props.target,
+        'read',
+        false,
+        nodes.getNodeTaskStatus({ node: props.node, upid }),
+      ).pipe(Effect.orElseSucceed(() => undefined));
+      if (status?.status === 'stopped') {
+        if (status.exitstatus === 'OK') return;
+        return yield* Effect.die(
+          new Error(
+            `${objectPath(props)}: PVE task ${upid} finished with "${status.exitstatus ?? 'no exit status'}". ` +
+              'The write returned HTTP 200 because it only forked the worker -- the real error is ' +
+              `in \`pvesh get /nodes/${props.node}/tasks/${upid}/log\`.`,
+          ),
+        );
+      }
+      yield* Effect.sleep(POLL_SECONDS * 1000);
+    }
+    return yield* Effect.die(
+      new Error(
+        `${objectPath(props)}: PVE task ${upid} was still running after ` +
+          `${String(POLL_ATTEMPTS * POLL_SECONDS)}s, or its status could not be read. Check the ` +
+          'task log, and check that the `read` role holds Sys.Audit on ' +
+          `/nodes/${props.node} -- each call mints a new token, so the poller is never the task ` +
+          'owner and is answered 403 rather than told to wait.',
+      ),
+    );
+  });
+
+/** POST the create, then wait for the worker. ⛔ The caller still reads back; see ceph-fs.ts. */
+export const createFs = (props: CephFsProps) =>
+  Effect.gen(function* () {
+    const upid = yield* runPve(
+      props.target,
+      'provision',
+      true,
+      nodes.updateNodeCephFs(toDistilledCreate(props)),
+    );
+    // ⛔ NO UPID MEANS NO WORKER. PVE answers 200 with `{"data":null}` on calls that did nothing,
+    //   and here that is indistinguishable from success by status code alone. Refusing now is the
+    //   difference between a clear failure and a state entry for a filesystem nobody built.
+    if (upid === '') {
+      return yield* Effect.die(
+        new Error(
+          `${objectPath(props)}: POST returned no task id. PVE wraps every answer in ` +
+            '{"data":...} and can report success on a call that did nothing.',
+        ),
+      );
+    }
+    yield* settleCreate(props, upid);
+  });