@homeflare/alchemy 0.36.0 → 0.37.1

package/src/cloudflare/r2-bucket-lock.test.ts

@@ -5,15 +5,15 @@
  *
  * ★ THE POINT OF THIS FILE IS THE TAGGED-ERROR PATHS, per the transport swap onto
  *   `@distilled.cloud/cloudflare/r2`: `NoSuchBucket` is matched by Cloudflare's own error code
- *   (10006), never by HTTP status, and only `readLock` treats it as "nothing to adopt" —
- *   `reconcileLock`/`deleteLock` let it die like any other tagged error.
+ *   (10006), never by HTTP status, and only `readLock`/`deleteLock` treat it as "nothing to do" —
+ *   `reconcileLock` still fails on it, but as a typed SDK error, not the `Effect.orDie`
+ *   defect this family used to raise (WI-7, decision 49 "upstream wins", 2026-09-24).
  */
+import * as Retry from '@distilled.cloud/cloudflare/Retry';
 import type { CloudflareOpContext } from '@distilled.cloud/cloudflare/r2';
 import { Unowned } from 'alchemy/AdoptPolicy';
 import { describe, expect, test } from 'bun:test';
-import * as Cause from 'effect/Cause';
 import * as Effect from 'effect/Effect';
-import * as Exit from 'effect/Exit';
 import {
   FAKE_ACCOUNT,
   type FakeR2Lock,
@@ -28,8 +28,14 @@ import { type R2BucketLockProps, deleteLock, readLock, reconcileLock } from './r
 const run = <A, E>(fake: FakeR2Lock, effect: Effect.Effect<A, E, CloudflareOpContext>) =>
   Effect.runPromise(effect.pipe(Effect.provide(fakeR2LockLayer(fake))));
 
-const dies = <A, E>(fake: FakeR2Lock, effect: Effect.Effect<A, E, CloudflareOpContext>) =>
-  Effect.runPromiseExit(effect.pipe(Effect.provide(fakeR2LockLayer(fake))));
+/**
+ * The operation's typed refusal, never a defect — asserts S20/S21 (WI-7). `Retry.none` keeps a
+ * simulated 429 from actually waiting out distilled's real, unbounded-under-test throttling
+ * backoff (`applyRetry`'s `makeDefault` in `@distilled.cloud/core/api.ts`) — the house's own
+ * speed doctrine (S26, `testing-speed-doctrine`) never lets a test wait on a real retry schedule.
+ */
+const refused = <A, E>(fake: FakeR2Lock, effect: Effect.Effect<A, E, CloudflareOpContext>) =>
+  Effect.runPromise(Effect.flip(effect).pipe(Retry.none, Effect.provide(fakeR2LockLayer(fake))));
 
 const rule: R2LockRule = {
   id: 'keep-30d',
@@ -83,11 +89,18 @@ describe('readLock', () => {
   test('a different tagged error at 404 is NOT swallowed as NoSuchBucket', async () => {
     // ⛔ code 7003 is `InvalidRoute`, not `NoSuchBucket` — even at the same 404 status a plain
     //   status check would have treated as "no bucket". `catchTag('NoSuchBucket', …)` leaves it
-    //   alone, and `Effect.orDie` turns it into a defect.
+    //   alone, and it now surfaces as a typed SDK error, never an `Effect.orDie` defect.
     const fake = fakeR2Lock({ onRoute: () => fakeFailure(404, 7003, 'Invalid route') });
-    const exit = await dies(fake, readLock(props(), false));
-    expect(Exit.isFailure(exit)).toBe(true);
-    expect(Exit.isFailure(exit) && Cause.hasDies(exit.cause)).toBe(true);
+    const refusal = await refused(fake, readLock(props(), false));
+    expect(refusal._tag).toBe('InvalidRoute');
+  });
+
+  test('a rate-limited read surfaces as a typed refusal, not a crash', async () => {
+    // ⛔ 429 WITH NO MATCHED CODE maps to distilled's `TooManyRequests` (protocol.ts step 3,
+    //   "Throttling"), one of the `CloudflareOpError` members this resource does not special-case.
+    const fake = fakeR2Lock({ onRoute: () => fakeFailure(429, 0, 'rate limited') });
+    const refusal = await refused(fake, readLock(props(), false));
+    expect(refusal._tag).toBe('TooManyRequests');
   });
 });
 
@@ -108,11 +121,10 @@ describe('reconcileLock', () => {
     expect(fake.locks.get('my-backups')).toEqual([rule]);
   });
 
-  test('NoSuchBucket is NOT caught here: a genuinely missing bucket dies', async () => {
+  test('NoSuchBucket is NOT caught here: a genuinely missing bucket is a typed refusal', async () => {
     const fake = fakeR2Lock();
-    const exit = await dies(fake, reconcileLock(props(), undefined));
-    expect(Exit.isFailure(exit)).toBe(true);
-    expect(Exit.isFailure(exit) && Cause.hasDies(exit.cause)).toBe(true);
+    const refusal = await refused(fake, reconcileLock(props(), undefined));
+    expect(refusal._tag).toBe('NoSuchBucket');
   });
 });
 
@@ -126,14 +138,38 @@ describe('deleteLock', () => {
     expect(fake.locks.has('my-backups')).toBe(false);
   });
 
-  test('NoSuchBucket is NOT caught here either: a genuinely missing bucket dies', async () => {
+  test('deleting when the bucket is already gone succeeds (S11, P10: delete is idempotent)', async () => {
+    // ⛔ THE ONE BEHAVIOUR CHANGE WI-7 MAKES: unlike `reconcileLock`, `deleteLock` now catches
+    //   `NoSuchBucket` into success — a bucket that no longer exists has nothing left to unlock.
     const fake = fakeR2Lock();
     const output = await run(
       fakeR2Lock({ existingBuckets: ['my-backups'] }),
       reconcileLock(props(), undefined),
     );
-    const exit = await dies(fake, deleteLock(output, FAKE_ACCOUNT));
-    expect(Exit.isFailure(exit)).toBe(true);
-    expect(Exit.isFailure(exit) && Cause.hasDies(exit.cause)).toBe(true);
+    await run(fake, deleteLock(output, FAKE_ACCOUNT));
+    expect(writes(fake)).toEqual(['PUT']);
+  });
+
+  test('delete does not swallow InvalidRoute at 404', async () => {
+    const fake = fakeR2Lock({ onRoute: () => fakeFailure(404, 7003, 'Invalid route') });
+    const refusal = await refused(
+      fake,
+      deleteLock(
+        { bucketName: 'my-backups', jurisdiction: 'default', rules: [rule] },
+        FAKE_ACCOUNT,
+      ),
+    );
+    expect(refusal._tag).toBe('InvalidRoute');
+  });
+
+  test('a rate-limited delete surfaces as a typed refusal, not a crash', async () => {
+    const setup = fakeR2Lock({ existingBuckets: ['my-backups'] });
+    const output = await run(setup, reconcileLock(props(), undefined));
+    const limited = fakeR2Lock({
+      existingBuckets: ['my-backups'],
+      onRoute: () => fakeFailure(429, 0, 'rate limited'),
+    });
+    const refusal = await refused(limited, deleteLock(output, FAKE_ACCOUNT));
+    expect(refusal._tag).toBe('TooManyRequests');
   });
 });

package/src/cloudflare/r2-bucket-lock.ts

@@ -103,7 +103,9 @@ export const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(
  *   same case the status check used to cover — but by the vendor's own error identity, not by
  *   reading a number off the response. Letting it propagate would make the resource impossible to
  *   plan; swallowing every failure would also hide a 403 from a mis-scoped token, which is the
- *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else dies.
+ *   failure this estate spends the most time on. So: `NoSuchBucket` → absent, everything else
+ *   propagates with its SDK tag. Upstream `Cloudflare/R2/BucketSippy.ts` at beta.79 uses this
+ *   same catch-and-propagate shape; a blanket remap would hide those typed identities (S20/S21).
  *
  * ⛔ AN EMPTY LIVE RULE SET IS "NO LOCK", NOT "A LOCK WITH NOTHING IN IT", so it reads as absent
  *   and the resource CREATES. The API answers `{}` for a bucket that has never been locked and
@@ -117,15 +119,16 @@ export const R2BucketLock: ResourceClass<R2BucketLock> = Resource<R2BucketLock>(
 export const readLock = (
   props: { accountId: string; bucketName: string; jurisdiction?: Jurisdiction },
   written: boolean,
-): Effect.Effect<R2BucketLockAttributes | undefined, never, CloudflareOpContext> =>
+): Effect.Effect<
+  R2BucketLockAttributes | undefined,
+  Exclude<r2.GetBucketLockError, { _tag: 'NoSuchBucket' }>,
+  CloudflareOpContext
+> =>
   Effect.gen(function* () {
     const jurisdiction = jurisdictionOf(props);
     const live = yield* r2
       .getBucketLock({ accountId: props.accountId, bucketName: props.bucketName, jurisdiction })
-      .pipe(
-        Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)),
-        Effect.orDie,
-      );
+      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.succeed(undefined)));
     if (live === undefined) return undefined;
     const rules = (live.rules ?? []) as readonly R2LockRule[];
     if (rules.length === 0) return undefined;
@@ -144,23 +147,21 @@ export const readLock = (
  *   persisted (or what `read` just adopted), so the comparison costs nothing either.
  * ⛔ `NoSuchBucket` IS NOT CAUGHT HERE. Unlike `read`, a `reconcile` that hits it means the bucket
  *   this declaration names is genuinely gone — that is a real failure to surface, not a case to
- *   paper over, so it dies like every other tagged error `putBucketLock` can raise.
+ *   paper over, so it propagates like every other typed SDK error `putBucketLock` can raise.
  */
 export const reconcileLock = (
   news: R2BucketLockProps,
   output: R2BucketLockAttributes | undefined,
-): Effect.Effect<R2BucketLockAttributes, never, CloudflareOpContext> =>
+): Effect.Effect<R2BucketLockAttributes, r2.PutBucketLockError, CloudflareOpContext> =>
   Effect.gen(function* () {
     const jurisdiction = jurisdictionOf(news);
     if (output !== undefined && rulesEqual(output.rules, news.rules)) return output;
-    yield* r2
-      .putBucketLock({
-        accountId: news.accountId,
-        bucketName: news.bucketName,
-        jurisdiction,
-        ...toBody(news.rules),
-      })
-      .pipe(Effect.orDie);
+    yield* r2.putBucketLock({
+      accountId: news.accountId,
+      bucketName: news.bucketName,
+      jurisdiction,
+      ...toBody(news.rules),
+    });
     return { bucketName: news.bucketName, jurisdiction, rules: news.rules };
   });
 
@@ -170,11 +171,17 @@ export const reconcileLock = (
  *   rule is configured, so retiring the repository has to start here — and it is behind
  *   `defaultRemovalPolicy: 'retain'` and the estate CLI's refusal of `destroy` precisely because
  *   no ordinary deploy should ever reach it.
+ * ⛔ IDEMPOTENT (S11): a missing bucket has nothing left to unlock. Catch only `NoSuchBucket`;
+ *   every other SDK error propagates, like upstream `R2/BucketSippy.ts` at beta.79.
  */
 export const deleteLock = (
   output: R2BucketLockAttributes,
   accountId: string,
-): Effect.Effect<void, never, CloudflareOpContext> =>
+): Effect.Effect<
+  void,
+  Exclude<r2.PutBucketLockError, { _tag: 'NoSuchBucket' }>,
+  CloudflareOpContext
+> =>
   Effect.gen(function* () {
     yield* r2
       .putBucketLock({
@@ -183,7 +190,7 @@ export const deleteLock = (
         jurisdiction: output.jurisdiction,
         rules: [],
       })
-      .pipe(Effect.orDie);
+      .pipe(Effect.catchTag('NoSuchBucket', () => Effect.void));
   });
 
 export const R2BucketLockProvider = () =>

package/src/litellm/operations.ts

@@ -58,10 +58,14 @@ const semaphoreFor = (baseUrl: string): Effect.Effect<Semaphore.Semaphore> =>
 /**
  * Serialises a write against this call's own base URL — see the file header.
  *
- * Resolving `Credentials` can itself fail typed (`ConfigError` — S20/S24, credentials.ts), so
- * the return type carries that alongside the wrapped operation's own error `E`; every call
- * site's declared error type already includes `ConfigError` as a member of the SDK's shared
- * `LitellmOpError` (protocol.ts), so this widening is a no-op for callers.
+ * ⚠️ `Credentials` itself ends in `Effect.orDie` on a missing/misspelled env var (Q6, decision
+ *   49 "upstream wins", 2026-09-24, matching distilled's own convention — 73 of 80 packages'
+ *   `credentials.ts` do the same at `homeflare/base`), so resolving it here can no longer fail
+ *   typed. The `| ConfigError` this function still adds to its return type stays only because
+ *   `@distilled.cloud/litellm`'s own `LitellmOpError` (protocol.ts) unconditionally declares
+ *   `ConfigError` as a member of every generated operation's error union regardless of
+ *   `Credentials`'s own type — so `E` (the wrapped operation's error) already contains it, and
+ *   this widening is a genuine no-op for callers, not dead type-state left over from the revert.
  */
 const mutate = <A, E>(
   io: Effect.Effect<A, E, LitellmOpContext>,

package/src/proxmox/ceph-daemon-form.ts

@@ -29,7 +29,7 @@
  *
  */
 import type { CephDaemonAttributes, CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
-import type { EndpointPair } from './resource-spec.ts';
+import type { EndpointKey } from './constraints.ts';
 import { bool, flag, num, text } from './values.ts';
 
 /**
@@ -38,19 +38,18 @@ import { bool, flag, num, text } from './values.ts';
  * ⛔ ONE PER KIND, NOT A `{type}` PATH. PVE registers `mds`, `mgr` and `mon` as three separate
  *   nodes with three separate parameter schemas — `hotstandby` belongs to the first and
  *   `mon-address` to the third — so a single key would enforce one kind's rules on all three.
- *   That is why `PveSpec['endpoint']` admits a function of props at all.
+ *   `ceph-daemon.ts` indexes this by `props.kind` for exactly that reason, on every `guardWrite`.
  * ⛔ THE STRINGS MUST STAY LITERALS. `codegen/constraints.ts` finds the endpoints to table by
  *   SCANNING THIS PACKAGE'S TEXT, so a key assembled from `props.kind` would be tabled by
  *   nothing and `constraintsFor` would throw on the first deploy that reached it.
  * ⚠️ THE PARAMETER NAMES DIFFER AND ARE THE VENDOR'S OWN — `{name}`, `{id}`, `{monid}`. The
  *   generator resolves each against the schema, so a tidied-up spelling stops the build.
- * ⚠️ NO `update` ON ANY OF THEM: none of the three has a PUT, which is why the spec declares no
- *   `updateForm` either.
+ * ⚠️ NO `update` HERE: none of the three kinds has a PUT — ceph-daemon-wire.ts's own header.
  */
-export const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointPair>> = {
-  mds: { create: 'pve:POST /nodes/{node}/ceph/mds/{name}' },
-  mgr: { create: 'pve:POST /nodes/{node}/ceph/mgr/{id}' },
-  mon: { create: 'pve:POST /nodes/{node}/ceph/mon/{monid}' },
+export const DAEMON_ENDPOINTS: Readonly<Record<CephDaemonKind, EndpointKey>> = {
+  mds: 'pve:POST /nodes/{node}/ceph/mds/{name}',
+  mgr: 'pve:POST /nodes/{node}/ceph/mgr/{id}',
+  mon: 'pve:POST /nodes/{node}/ceph/mon/{monid}',
 };
 
 /**

package/src/proxmox/ceph-daemon-wire.ts

@@ -0,0 +1,112 @@
+/**
+ * `Proxmox.CephDaemon`'s distilled wire lane: one dispatch per kind, because mon/mgr/mds are three
+ * separate distilled operations with three separate request shapes (`{node,monid}` /
+ * `{node,id}` / `{node,name}`) — the SAME reason `DAEMON_ENDPOINTS` (ceph-daemon-form.ts) is a
+ * per-kind table rather than one templated string.
+ *
+ * ⛔ ABSENCE IS A SUCCESSFUL INDEX WITH NO MATCHING ROW. The original transport swap
+ *   preserved `pveOperations.read`'s catch-all fold; the 2026-09-24 follow-up removes it. A failed
+ *   mon/mgr/mds list proves nothing about whether a daemon exists, so its SDK error propagates.
+ *
+ * ⚠️ `mon_address` IS THE ONE RENAME THIS FAMILY NEEDS — distilled's generator maps the wire name
+ *   `mon-address` to `mon_address` on `UpdateNodeCephMonRequest` (`T.Body("mon-address")`,
+ *   confirmed against its schema), the same one-key pattern node-network-form.ts's `RENAMED`
+ *   table carries for three fields. `hotstandby` needs no rename.
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import type { CephDaemonKind, CephDaemonProps } from './ceph-daemon.ts';
+import { daemonAttributes, daemonId, daemonPath } from './ceph-daemon-form.ts';
+import { runPve } from './distilled-pve.ts';
+
+/**
+ * The index, per kind — the same array `daemonAttributes`/`findRow` already narrow.
+ *
+ * ⚠️ CAST TO `unknown[]` PER BRANCH, NOT LEFT TO INFERENCE. mon/mgr/mds answer three DIFFERENT
+ *   row shapes (`ListNodeCephMonResponseBodyItem` and its two siblings), and a switch returning
+ *   each as-is infers their INTERSECTION rather than their union — TypeScript refuses that under
+ *   `exactOptionalPropertyTypes`. `daemonAttributes` already treats the row generically (it reads
+ *   by string key, the same shape acl.ts narrows), so the cast costs nothing real.
+ */
+const listRows = (props: CephDaemonProps) => {
+  const node = props.node;
+  switch (props.kind) {
+    case 'mon':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMon({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+    case 'mgr':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMgr({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+    case 'mds':
+      return runPve(props.target, 'read', false, nodes.listNodeCephMds({ node })).pipe(
+        Effect.map((rows): unknown[] => rows),
+      );
+  }
+};
+
+/** A missing row is absent; a failed index read keeps its typed SDK error. */
+export const readDaemon = (props: CephDaemonProps) =>
+  listRows(props).pipe(
+    Effect.map((rows) => daemonAttributes(rows as unknown as Record<string, unknown>, props)),
+  );
+
+/** POST — distilled's generator misnames it "update" (checked against `T.Http`); it is a create. */
+export const createDaemon = (props: CephDaemonProps) => {
+  const node = props.node;
+  const id = daemonId(props);
+  switch (props.kind) {
+    case 'mon':
+      return runPve(
+        props.target,
+        'provision',
+        true,
+        nodes.updateNodeCephMon({
+          ...(props['mon-address'] === undefined ? {} : { mon_address: props['mon-address'] }),
+          monid: id,
+          node,
+        }),
+      );
+    case 'mgr':
+      return runPve(props.target, 'provision', true, nodes.updateNodeCephMgr({ id, node }));
+    case 'mds':
+      return runPve(
+        props.target,
+        'provision',
+        true,
+        nodes.updateNodeCephMds({
+          ...(props.hotstandby === undefined ? {} : { hotstandby: props.hotstandby ? '1' : '0' }),
+          name: id,
+          node,
+        }),
+      );
+  }
+};
+
+/** ⚠️ NO FLAGS ON ANY OF THE THREE — unlike CephFs/CephOsd, nothing here is at risk of a
+ *   DELETE-body PVE would ignore, because nothing here is ever sent. */
+export const deleteDaemon = (props: CephDaemonProps) => {
+  const node = props.node;
+  const id = daemonId(props);
+  switch (props.kind) {
+    case 'mon':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMon({ monid: id, node }));
+    case 'mgr':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMgr({ id, node }));
+    case 'mds':
+      return runPve(props.target, 'provision', true, nodes.deleteNodeCephMds({ name: id, node }));
+  }
+};
+
+/** Re-exported so ceph-daemon.ts can narrow a switch exhaustively without importing the union twice. */
+export type { CephDaemonKind };
+
+/** ★ Moved here from ceph-daemon.ts's `reconcile` for the 250-line cap — matches ceph-fs.ts's own
+ *  `notCreated`/`notDestroyed` seam: the message, not the decision to die, lives with the calls. */
+export const notCreated = (props: CephDaemonProps) =>
+  new Error(
+    `${daemonPath(props)}: no ${props.kind} named ${daemonId(props)} in GET nodes/` +
+      `${props.node}/ceph/${props.kind} after the create task finished. POST answers a UPID, ` +
+      'not a result -- watch the task in the PVE UI (ceph-daemon-form.ts).',
+  );

package/src/proxmox/ceph-daemon-write.test.ts

@@ -0,0 +1,158 @@
+/**
+ * `Proxmox.CephDaemon`'s write paths, through Alchemy's own Plan and Apply over a fake cluster —
+ * the paths ceph-adopt.test.ts does not reach: it is adopt-only by design (every assertion there
+ * ends on `fake.writes()` empty). Proves the distilled-based create (ceph-daemon-wire.ts) POSTs
+ * with the right per-kind body — `mon-address` renamed to `mon_address` for mon, `hotstandby` for
+ * mds — reads back, and that delete sends exactly one DELETE.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as RemovalPolicy from 'alchemy/RemovalPolicy';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { ProxmoxCephDaemon, ProxmoxCephDaemonProvider, reconcileDaemon } from './ceph-daemon.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+
+const NODE = 'node-b';
+
+describe('a genuinely new mon', () => {
+  test('POSTs mon-address as mon_address, and reads the collection back', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mon`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let created = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return created ? [{ addr: '198.51.100.12:6789/0', name: NAME, state: 'running' }] : [];
+      }
+      // ⚠️ POST lands on the daemon's OWN path (`{monid}`), not the collection — see
+      //   ceph-daemon-form.ts's own ⛔ on `collectionPath`/`daemonPath`.
+      if (call.method === 'POST' && call.path === OBJECT) {
+        created = true;
+        return `UPID:${NODE}:fake:createmon`;
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declared = () =>
+        ProxmoxCephDaemon('node-b-mon', {
+          kind: 'mon',
+          'mon-address': '198.51.100.12',
+          name: NAME,
+          node: NODE,
+          target: FAKE_TARGET,
+        });
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mon': 'create' });
+    });
+    expect(fake.calls.find((c) => c.method === 'POST')?.form['mon-address']).toBe('198.51.100.12');
+    expect(fake.writes()).toEqual([`POST ${OBJECT}`]);
+  });
+});
+
+describe('a genuinely new mds', () => {
+  test('POSTs hotstandby, and reads the collection back', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mds`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let created = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return created ? [{ name: NAME, state: 'up:standby' }] : [];
+      }
+      if (call.method === 'POST' && call.path === OBJECT) {
+        created = true;
+        return `UPID:${NODE}:fake:createmds`;
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declared = () =>
+        ProxmoxCephDaemon('node-b-mds', {
+          hotstandby: true,
+          kind: 'mds',
+          name: NAME,
+          node: NODE,
+          target: FAKE_TARGET,
+        });
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mds': 'create' });
+    });
+    expect(fake.calls.find((c) => c.method === 'POST')?.form['hotstandby']).toBe('1');
+  });
+});
+
+describe('destroying a mgr', () => {
+  test('RemovalPolicy.destroy() then undeclaring sends exactly one DELETE', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mgr`;
+    const OBJECT = `${COLLECTION}/${NAME}`;
+    let deleted = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return deleted ? [] : [{ name: NAME, state: 'active' }];
+      }
+      if (call.method === 'DELETE' && call.path === OBJECT) {
+        deleted = true;
+        return `UPID:${NODE}:fake:destroymgr`;
+      }
+      return undefined;
+    });
+    const declared = () =>
+      ProxmoxCephDaemon('node-b-mgr', { kind: 'mgr', name: NAME, node: NODE, target: FAKE_TARGET });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephDaemonProvider().pipe(Layer.provideMerge(fake.layer)));
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-mgr': 'adopted' });
+      await engine.deploy(declared().pipe(RemovalPolicy.destroy()));
+      await engine.deploy(Effect.void);
+    });
+    expect(fake.writes()).toEqual([`DELETE ${OBJECT}`]);
+  });
+});
+
+describe("reconcile called directly, no diff first — the adversarial review's own proof", () => {
+  /**
+   * ⚠️ STRUCTURAL, NOT A REFUSAL — checked directly before writing this test:
+   *   `constraints.ts`'s `violations()` never checks a bare `format` rule (`mon-address`'s own
+   *   `{"format":"ip-list","type":"string"}` carries no `pattern`), and `mds`/`mgr`'s create
+   *   endpoints have EMPTY constraint tables — so nothing in this family's vendor table can
+   *   actually refuse a bad value today (a separate, recorded gap; not this PR's to fix). What IS
+   *   provable, and what the review's finding was actually about, is that `guardWrite` — and so
+   *   `createForm(news)`, which it must evaluate to build the value it checks — runs on the
+   *   ADOPTED-ROW PATH at all, before the `live !== undefined` early return. A getter on
+   *   `mon-address` proves it: `createForm` is the ONLY thing that reads this field on that path
+   *   (`createDaemon`, the other reader, is never reached when `live` is already defined), so it
+   *   firing at all means the guard ran; it firing zero times is exactly the bug the review found.
+   */
+  test('guardWrite (and the createForm it checks) still runs on an adopted row, before the early return', async () => {
+    const NAME = 'node-b';
+    const COLLECTION = `nodes/${NODE}/ceph/mon`;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === COLLECTION) {
+        return [{ addr: '198.51.100.12:6789/0', name: NAME, state: 'running' }];
+      }
+      return undefined;
+    });
+    let reads = 0;
+    const news = {
+      get 'mon-address'() {
+        reads += 1;
+        return '198.51.100.99';
+      },
+      kind: 'mon' as const,
+      name: NAME,
+      node: NODE,
+      target: FAKE_TARGET,
+    };
+    await withoutBao(async () => {
+      // ⛔ NOT engine.deploy() — this calls the exported `reconcileDaemon` straight, the way a
+      //   resumed apply or a verify harness would, with no `diff` run first.
+      const after = await Effect.runPromise(
+        reconcileDaemon({ news }).pipe(Effect.provide(fake.layer)),
+      );
+      expect(after.state).toBe('running');
+    });
+    expect(reads).toBeGreaterThan(0);
+    expect(fake.writes()).toEqual([]);
+  });
+});