@homeflare/alchemy 0.36.0 → 0.37.1

package/src/proxmox/ceph-fs.ts

@@ -19,12 +19,20 @@
  *   below returns the INDEX and `attributes` picks this filesystem out of the array client-side —
  *   the shape acl.ts uses for the one flat `GET /access/acl`. The POST goes to the `{name}` path,
  *   so `collection()` is the LONGER of the two strings, the mirror of metric-server.ts.
- *   ⚠️ AND THAT IS WHY `delete` AND `reconcile` ARE HAND-WRITTEN BELOW rather than taken from
- *     `pveHandlers`. `pveOperations.destroy` deletes `spec.path`, which here is the index:
- *     `DELETE /nodes/{node}/ceph/fs` is not a route, so a factory delete would fail every destroy
- *     while the filesystem stayed exactly where it was. `reconcile` is hand-written for a second,
- *     independent reason — the forked worker — set out in ceph-fs-wire.ts. acl.ts is the
- *     precedent for a family that genuinely does not fit; this is the second.
+ *   ⚠️ AND THAT IS WHY EVERY HANDLER BELOW IS HAND-WRITTEN rather than taken from a factory. A
+ *     factory `destroy` deletes the read path, which here is the index: `DELETE /nodes/{node}/
+ *     ceph/fs` is not a route, so it would fail every destroy while the filesystem stayed exactly
+ *     where it was. `reconcile` is hand-written for a second, independent reason — the forked
+ *     worker — set out in ceph-fs-wire.ts. acl.ts is the precedent for a family that genuinely
+ *     does not fit a shared shape.
+ *
+ * ★ MIGRATED OFF `client.ts`'s generic `pve()` ONTO `@distilled.cloud/proxmox`'s typed
+ *   `nodes.listNodeCephFs`/`updateNodeCephFs` for the READ and the CREATE (2026-09-24, decision
+ *   43's walk-down, 2c — ceph-fs-distilled.ts). `destroyFs` STAYS on `client.ts`, unmigrated:
+ *   the SDK originally put `remove-pools`/`remove-storages` in a DELETE body, which PVE ignores.
+ *   SDK PR #265 fixes that protocol gap; migrating `destroyFs` remains a separate change.
+ *   The typed-read follow-up removes the catch-all fold from `readFs`: a failed index must
+ *   fail read/diff/reconcile/delete, not report a missing filesystem or a successful destroy.
  *
  * ⛔ CREATING A CephFS CREATES TWO CEPH POOLS, AND A `Proxmox.CephPool` MUST NOT ALSO DECLARE THEM.
  *   `createfs` builds `<name>_data` and `<name>_metadata` itself and refuses outright if either
@@ -59,16 +67,10 @@ import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
-import {
-  createForm,
-  createFs,
-  destroyFs,
-  notCreated,
-  notDestroyed,
-  objectPath,
-  readRow,
-} from './ceph-fs-wire.ts';
-import { type PveRequirements, type WithTarget, pveOperations } from './resource.ts';
+import { createFs, readFs } from './ceph-fs-distilled.ts';
+import { CEPH_FS_CREATE, createForm, destroyFs, notCreated, notDestroyed } from './ceph-fs-wire.ts';
+import { guardWrite } from './distilled-guard.ts';
+import { type PveRequirements, type WithTarget } from './resource.ts';
 
 export interface CephFsProps extends WithTarget {
   /** ⚠️ Which node answers the call, NOT which node holds the filesystem. See the header. */
@@ -143,33 +145,22 @@ export const ProxmoxCephFs = Resource<ProxmoxCephFs>('Proxmox.CephFs', {
   defaultRemovalPolicy: 'retain',
 });
 
-const ops = pveOperations<CephFsProps, CephFsAttributes>({
-  attributes: readRow,
-  /** ⚠️ The `{name}` path — longer than `path()`, deliberately. See the second ⛔ in the header. */
-  collection: objectPath,
-  createForm,
-  endpoint: { create: 'pve:POST /nodes/{node}/ceph/fs/{name}' }, // ⚠️ POSTed on the object.
-  /**
-   * ⛔ NOTHING IS COMPARED, AND THAT IS THE MOST DELIBERATE LINE IN THIS FILE. A CephFS has no
-   *   readable, writable field: the index returns only the name and the pools behind it, and every
-   *   prop this resource accepts is create-time or delete-time. So "present" IS "settled", and the
-   *   only honest comparison is none at all.
-   *   ⚠️ THE TEMPTING ADDITION IS `pg_num`, AND IT WOULD BE THE WORST BUG THIS PACKAGE HAS SHIPPED.
-   *     It is not in the index at all, so it can only be read from the pool endpoint — where the
-   *     autoscaler owns it. MEASURED on C1 today: created at 128, live at 32, with the metadata
-   *     pool already scheduled down to 16. Compared, that is an eternal mismatch; and because
-   *     `updateForm` is undefined, the action it produces is REPLACE. The plan would destroy and
-   *     rebuild a live filesystem on every deploy, triggered by a daemon on its own schedule.
-   *   ⚠️ `data_pools` AND `metadata_pool_id` ARE OUT FOR THE ORDINARY REASONS: a set PVE returns
-   *     in its own order, and an integer id for something written as a name. `name` is out because
-   *     it is the FILTER that produced these attributes, so comparing it is true by construction —
-   *     an identity change is handled in `diff`, not here. `node` is out because it is a route.
-   */
-  matches: () => true,
-  /** ⚠️ THE INDEX, NOT THE OBJECT. There is no GET on `{name}`; see the second ⛔ in the header. */
-  path: (props) => `nodes/${props.node}/ceph/fs`,
-});
-
+/**
+ * ⛔ NOTHING IS COMPARED, AND THAT IS THE MOST DELIBERATE LINE IN THIS FILE. A CephFS has no
+ *   readable, writable field: the index returns only the name and the pools behind it, and every
+ *   prop this resource accepts is create-time or delete-time. So "present" IS "settled", and the
+ *   only honest comparison is none at all.
+ *   ⚠️ THE TEMPTING ADDITION IS `pg_num`, AND IT WOULD BE THE WORST BUG THIS PACKAGE HAS SHIPPED.
+ *     It is not in the index at all, so it can only be read from the pool endpoint — where the
+ *     autoscaler owns it. MEASURED on C1 today: created at 128, live at 32, with the metadata
+ *     pool already scheduled down to 16. Compared, that is an eternal mismatch — and since there
+ *     is no update path, treating this as a diff would plan a REPLACE. The plan would destroy and
+ *     rebuild a live filesystem on every deploy, triggered by a daemon on its own schedule.
+ *   ⚠️ `data_pools` AND `metadata_pool_id` ARE OUT FOR THE ORDINARY REASONS: a set PVE returns
+ *     in its own order, and an integer id for something written as a name. `name` is out because
+ *     it is the FILTER that produced these attributes, so comparing it is true by construction —
+ *     an identity change is handled in `diff`, not here. `node` is out because it is a route.
+ */
 export const ProxmoxCephFsProvider = () =>
   Provider.effect(
     ProxmoxCephFs,
@@ -182,67 +173,71 @@ export const ProxmoxCephFsProvider = () =>
          */
         list: () => Effect.succeed([]),
         read: Effect.fn(function* ({ olds }) {
-          return yield* ops.read(olds);
+          return yield* readFs(olds);
         }),
         /**
-         * ⛔ A CHANGED `name` IS A REPLACE, AND THE FACTORY CANNOT SAY SO ALONE. Left to delegate,
-         *   a rename reads the NEW name, finds nothing, and returns the drift-shaped `update` that
-         *   `pveOperations.diff` uses for "Alchemy has state, the cluster does not" — so reconcile
-         *   would build the new filesystem and LEAVE THE OLD ONE, with its pools, its storage entry
-         *   and its bytes, owned by nobody and invisible in every later plan.
+         * ⛔ A CHANGED `name` IS A REPLACE, AND NOTHING ELSE CAN SAY SO. Left undetected, a rename
+         *   reads the NEW name, finds nothing, and plans the drift-shaped `update` this family uses
+         *   for "Alchemy has state, the cluster does not" — so reconcile would build the new
+         *   filesystem and LEAVE THE OLD ONE, with its pools, its storage entry and its bytes,
+         *   owned by nobody and invisible in every later plan.
          *   ⛔ SAYING `replace` IS HONEST, AND IT IS ALSO WHAT MAKES A TYPO EXPENSIVE. Alchemy
          *     creates first and deletes second, so the old filesystem is destroyed AFTER the new
          *     one exists — with `remove-pools` unset the bytes are stranded rather than erased, and
          *     that default is the only thing between a mis-typed rename and an unrecoverable one.
-         *     Do not "simplify" this back to the factory: the alternative is not safer, it is
-         *     silent. ⚠️ `node` is NOT part of identity and must never join this comparison.
+         *     ⚠️ `node` is NOT part of identity and must never join this comparison.
          */
         diff: Effect.fn(function* ({ news, output }) {
-          if (output !== undefined && isResolved(news) && news.name !== output.name) {
+          if (!isResolved(news)) return undefined;
+          yield* guardWrite(CEPH_FS_CREATE, createForm(news), output === undefined);
+          if (output !== undefined && news.name !== output.name) {
             return { action: 'replace' } as const;
           }
-          return yield* ops.diff(news, output);
+          if (output === undefined) return undefined;
+          const live = yield* readFs(news);
+          if (live === undefined) {
+            yield* guardWrite(CEPH_FS_CREATE, createForm(news), true);
+            return { action: 'update' } as const;
+          }
+          // ⛔ SEE THE ⛔ ABOVE `ProxmoxCephFsProvider`: NOTHING ELSE IS COMPARED. Present is settled.
+          return { action: 'noop' } as const;
         }),
         /**
-         * ⛔ NOT `ops.reconcile`, BECAUSE ITS READ-BACK RACES A FORKED WORKER. The POST returns a
-         *   UPID and nothing else; `createFs` waits the task out and surfaces its real error. The
-         *   read-back the factory does is kept here rather than dropped — waiting proves the task
-         *   ENDED, reading proves the filesystem EXISTS, and PVE has shipped tasks that end OK
-         *   having done nothing.
+         * ⚠️ THE READ-BACK IS KEPT EVEN THOUGH `createFs` ALREADY WAITED OUT THE TASK. Waiting
+         *   proves the task ENDED, reading proves the filesystem EXISTS, and PVE has shipped tasks
+         *   that end OK having done nothing.
          * ⚠️ AN EXISTING FILESYSTEM IS RETURNED UNTOUCHED. There is no update call to make, so the
          *   only write this handler can perform is a create; `diff` has already decided that a
          *   real change is a replace, and Alchemy calls delete for the old generation itself.
          */
         reconcile: Effect.fn(function* ({ news }) {
-          const live = yield* ops.read(news);
+          const live = yield* readFs(news);
           if (live !== undefined) return live;
           yield* createFs(news);
-          const after = yield* ops.read(news);
+          const after = yield* readFs(news);
           if (after === undefined) return yield* Effect.die(notCreated(news));
           return after;
         }),
         /**
-         * ⛔ NOT `ops.destroy`, AND NOT AN OVERSIGHT. It would DELETE `spec.path`, which on this
-         *   family is the index — a route PVE does not implement — so every destroy would fail
-         *   while the filesystem stayed exactly where it was. The read-back afterwards is what
-         *   turns "the task said OK" into "it is actually gone": `destroyfs` refuses while a
-         *   non-disabled `cephfs` storage still references the filesystem, and that refusal must
-         *   fail the destroy rather than letting Alchemy drop the state entry for a live object.
+         * ⛔ THE READ-BACK IS WHAT TURNS "the task said OK" INTO "it is actually gone": `destroyfs`
+         *   refuses while a non-disabled `cephfs` storage still references the filesystem, and that
+         *   refusal must fail the destroy rather than letting Alchemy drop the state entry for a
+         *   live object. `destroyFs` itself stays on `client.ts` — ceph-fs-wire.ts's own header has
+         *   the measured, protocol-level reason.
          */
         delete: Effect.fn(function* ({ olds }) {
           /**
            * ⚠️ A FILESYSTEM SOMEBODY ALREADY REMOVED BY HAND IS NOT AN ERROR. `destroyfs` dies
            *   synchronously with "no such cephfs", which would fail every destroy of a stack whose
            *   filesystem was cleaned up outside Alchemy and leave the state entry unremovable
-           *   without editing the store. ⚠️ THE COST IS STATED PLAINLY: `ops.read` folds a FAILED
-           *   read into "absent" (the storage.ts trap), so a read this credential cannot perform
-           *   turns this into a destroy that reports success having done nothing. That is not a
-           *   new hazard — a broken read defeats the read-back below in exactly the same way — but
-           *   it is the reason a 403 on this family must be fixed rather than lived with.
+           *   without editing the store. The original catch-all read fold could also report
+           *   success after a 403 without deleting anything, and could defeat read-back after a
+           *   write. `readFs` now propagates those failures: only a successful index with no
+           *   matching row may short-circuit this delete or confirm the filesystem is gone.
            */
-          if ((yield* ops.read(olds)) === undefined) return;
+          if ((yield* readFs(olds)) === undefined) return;
           yield* destroyFs(olds);
-          const after = yield* ops.read(olds);
+          const after = yield* readFs(olds);
           if (after !== undefined) return yield* Effect.die(notDestroyed(olds));
         }),
       }),

package/src/proxmox/ceph-osd-tree.ts

@@ -56,9 +56,10 @@
  *   maintenance — the churn-that-reads-like-drift that keeps `digest` out of storage.ts.
  *
  */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import type { CephOsdProps } from './ceph-osd.ts';
-import { pve } from './client.ts';
+import { runPve } from './distilled-pve.ts';
 import { bool, int, num, text } from './values.ts';
 
 /** A CRUSH node. Buckets carry `children`; an OSD leaf carries `type: 'osd'`. */
@@ -181,13 +182,21 @@ export const osdAttributes = (leaf: CrushNode, props: CephOsdProps): CephOsdAttr
  * ★ IT LIVES HERE RATHER THAN IN ceph-osd.ts BECAUSE THE READ SIDE IS THIS FILE'S WHOLE JOB —
  *   `findOsd` and `osdAttributes` are the two halves it composes, and keeping the caller beside
  *   them is what let ceph-osd.ts come back under the 250-line cap when create and delete were
- *   added. ⚠️ A 404 or a 403 both arrive here as `undefined`: see the ⛔ on `readRole` in
- *   resource.ts for why that distinction is invisible and what it costs.
+ *   added.
+ *
+ * ★ MIGRATED OFF `client.ts`'s `pve()` ONTO `@distilled.cloud/proxmox`'s typed `nodes.
+ *   getNodeCephOsd` (2026-09-24, decision 43, 2c) — the tree endpoint, confirmed against
+ *   distilled's own schema to still answer `{flags?, root: unknown}`, matching the shape
+ *   `osdLeaves` already walks. ⛔ STILL NO `Effect.orElseSucceed` — the ⛔ on `handlers.read` in
+ *   ceph-osd.ts is unchanged and is still the reason: this path is a collection that always
+ *   exists while Ceph is installed, so a failure here is never "the OSD is gone" and must
+ *   propagate rather than fold. This is the one migrated Ceph family that does NOT match
+ *   ceph-pool-wire.ts's/ceph-fs-distilled.ts's single-fold shape, because it never had it.
  */
 export const readOsd = (props: CephOsdProps) =>
-  pve<Record<string, unknown>>(props.target, 'read', 'GET', `nodes/${props.node}/ceph/osd`).pipe(
+  runPve(props.target, 'read', false, nodes.getNodeCephOsd({ node: props.node })).pipe(
     Effect.map((t) => {
-      const leaf = t === undefined ? undefined : findOsd(t, props.osdid);
+      const leaf = findOsd(t as unknown as CrushNode, props.osdid);
       return leaf === undefined ? undefined : osdAttributes(leaf, props);
     }),
   );

package/src/proxmox/ceph-osd-write.test.ts

@@ -0,0 +1,61 @@
+/**
+ * `Proxmox.CephOsd`'s create path, through Alchemy's own Plan and Apply over a fake cluster.
+ *
+ * ⚠️ THIS NEVER RUNS ON THE REAL CLUSTER — ceph-osd.ts's own header has the measured reason
+ *   (`createosd`/`destroyosd` carry no PVE permissions block, so any OpenBao-minted token 403s
+ *   regardless of transport). The fake here enforces no such check, which is exactly why it is
+ *   worth running: it is the only way to catch a wire-translation bug (a wrong field name, a
+ *   dropped `device_class`) that a real deploy would never reach far enough to expose.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Layer from 'effect/Layer';
+import { engineOver } from '../verify/fake-engine.ts';
+import { ProxmoxCephOsd, ProxmoxCephOsdProvider } from './ceph-osd.ts';
+import { FAKE_TARGET, type PveCall, fakePve, withoutBao } from './fake-pve.ts';
+
+const NODE = 'node-b';
+const TREE = `nodes/${NODE}/ceph/osd`;
+
+describe('a genuinely new OSD', () => {
+  test('POSTs dev and crush-device-class, and reads the new leaf back by id', async () => {
+    let created = false;
+    const fake = fakePve((call: PveCall) => {
+      if (call.method === 'GET' && call.path === TREE) {
+        const leaves = created
+          ? [
+              {
+                ceph_version_short: '20.2.2',
+                device_class: 'ssd',
+                host: NODE,
+                id: '9',
+                name: 'osd.9',
+                status: 'up',
+              },
+            ]
+          : [];
+        return { flags: '', root: { children: leaves.map((l) => ({ ...l, type: 'osd' })) } };
+      }
+      if (call.method === 'POST' && call.path === TREE) {
+        created = true;
+        return `UPID:${NODE}:fake:createosd`;
+      }
+      return undefined;
+    });
+    await withoutBao(async () => {
+      const engine = engineOver(ProxmoxCephOsdProvider().pipe(Layer.provideMerge(fake.layer)));
+      const declared = () =>
+        ProxmoxCephOsd('node-b-osd9', {
+          dev: '/dev/nvme2n1',
+          device_class: 'ssd',
+          node: NODE,
+          osdid: 9,
+          target: FAKE_TARGET,
+        });
+      expect(await engine.deploy(declared())).toEqual({ 'node-b-osd9': 'create' });
+    });
+    const post = fake.calls.find((c) => c.method === 'POST');
+    expect(post?.form['dev']).toBe('/dev/nvme2n1');
+    expect(post?.form['crush-device-class']).toBe('ssd');
+    expect(fake.writes()).toEqual([`POST ${TREE}`]);
+  });
+});

package/src/proxmox/ceph-osd-write.ts

@@ -11,12 +11,13 @@
  *   `defaultRemovalPolicy: 'retain'`, so removing a declaration does NOT reach `destroyOsd` — a
  *   caller opts in with `.pipe(RemovalPolicy.destroy())`.
  */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import { readOsd } from './ceph-osd-tree.ts';
 import type { CephOsdProps } from './ceph-osd.ts';
-import { pve } from './client.ts';
 import { guardForm } from './constraint-guard.ts';
 import type { EndpointKey } from './constraints.ts';
+import { runPve } from './distilled-pve.ts';
 
 /**
  * The vendor rules the create form is checked against at plan time.
@@ -59,7 +60,16 @@ export const createOsd = Effect.fn(function* (news: CephOsdProps) {
   // ⛔ BEFORE THE POST, BECAUSE THE POST ZAPS A BLOCK DEVICE. A vendor rule broken here is worth
   //   refusing at plan rather than discovering from a 400 after `ceph-volume` has run.
   yield* guardForm(OSD_CREATE_ENDPOINT, form, true);
-  yield* pve(news.target, 'provision', 'POST', `nodes/${news.node}/ceph/osd`, form);
+  yield* runPve(
+    news.target,
+    'provision',
+    true,
+    nodes.createNodeCephOsd({
+      dev: news.dev,
+      node: news.node,
+      ...(news.device_class === undefined ? {} : { crush_device_class: news.device_class }),
+    }),
+  );
   const created = yield* readOsd(news);
   if (created === undefined) {
     return yield* Effect.die(
@@ -91,12 +101,29 @@ export const createOsd = Effect.fn(function* (news: CephOsdProps) {
  *
  * ⚠️ `cleanup` DEFAULTS TO FALSE, so the logical volumes survive and the disk can be re-added
  *   without a rebuild. Ceph still starts backfilling the missing copies the moment the OSD goes.
+ *
+ * ⚠️ `cleanup` RIDES A DELETE BODY, ON `client.ts` AND ON DISTILLED ALIKE — PRE-EXISTING, NOT
+ *   INTRODUCED HERE. `client.ts`'s own `buildRequest` (client.ts) puts `form` in the body for
+ *   every method, DELETE included, and CHECKED against distilled's generated
+ *   `DeleteNodeCephOsdRequest`: `cleanup` carries no `T.Query()` annotation either, so it also
+ *   defaults to a body field. ceph-fs-wire.ts's own ⛔ (measured from PVE's `AnyEvent.pm`) is that
+ *   PVE's server never reads a body on DELETE — so `cleanup=1` was ALREADY silently ignored by
+ *   the live cluster before this migration, on the unmigrated code too. Migrating carries the
+ *   SAME behaviour forward exactly, byte-for-byte, rather than introducing a new gap; unlike
+ *   `Proxmox.CephFs`'s delete, this is not a reason to keep the call on the hand client. It has
+ *   zero practical effect today regardless, since the whole DELETE 403s for this package's
+ *   credential either way (the root-only ⛔ at the top of ceph-osd.ts) — flagged separately as a
+ *   pre-existing, out-of-scope bug worth its own fix (move `cleanup` into the query string, the
+ *   way `destroyPath` in ceph-fs-wire.ts already does).
  */
 export const destroyOsd = (olds: CephOsdProps) =>
-  pve(
+  runPve(
     olds.target,
     'provision',
-    'DELETE',
-    `nodes/${olds.node}/ceph/osd/${String(olds.osdid)}`,
-    olds.cleanup === true ? { cleanup: '1' } : {},
+    true,
+    nodes.deleteNodeCephOsd({
+      node: olds.node,
+      osdid: String(olds.osdid),
+      ...(olds.cleanup === true ? { cleanup: '1' } : {}),
+    }),
   );

package/src/proxmox/ceph-osd.ts

@@ -33,6 +33,12 @@
  *   `hf-provision@pve!…` token would likely be answered 403 however wide its role. That is a
  *   reason to leave the write lane closed, not something to confirm by trying: if the reasoning
  *   is wrong, the confirmation costs a disk.
+ *
+ * ★ MIGRATED OFF `client.ts` ONTO `@distilled.cloud/proxmox` (2026-09-24, decision 43, 2c) — this
+ *   file itself never called `pve()` directly, so nothing here changed; ceph-osd-tree.ts's own
+ *   header has the read side (still no `Effect.orElseSucceed`, unlike every other migrated Ceph
+ *   family), ceph-osd-write.ts's has the write side and the one pre-existing, out-of-scope gap
+ *   this migration carries forward rather than fixes.
  */
 import { Resource } from 'alchemy';
 import { isResolved } from 'alchemy/Diff';

package/src/proxmox/ceph-pool-settle.ts

@@ -6,33 +6,40 @@
  *   synchronous. Ceph's are not — a pool delete returns before the PGs are gone — so this file is
  *   the polling that difference forces, and ceph-pool.ts is the declaration.
  */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
 import * as Effect from 'effect/Effect';
 import type { CephPoolAttributes, CephPoolProps } from './ceph-pool-form.ts';
-import { pve } from './client.ts';
+import { runPve } from './distilled-pve.ts';
 import type { PveRequirements } from './resource.ts';
 
 /**
  * ⚠️ THE DEPENDENCIES ARE PASSED IN RATHER THAN IMPORTED, and that is what made this file
- *   separable at all. `collection`, `object` and `ops.read` are module-level bindings in
- *   ceph-pool.ts; importing them back would be a runtime cycle, and duplicating them would be two
- *   definitions of one path. Passing them is the pattern zfs-pool-write.ts already uses.
+ *   separable at all. `ops.read` — now `readPoolStatus` (ceph-pool-wire.ts) — is a module-level
+ *   binding in ceph-pool.ts; importing it back would be a runtime cycle, and duplicating it would
+ *   be two definitions of one path. Passing it is the pattern zfs-pool-write.ts already uses.
+ *   The error parameter preserves the reader's typed failures through settle; it is not `never`.
  */
-export type PoolRead = (
+export type PoolRead<E> = (
   props: CephPoolProps,
-) => Effect.Effect<CephPoolAttributes | undefined, never, PveRequirements>;
+) => Effect.Effect<CephPoolAttributes | undefined, E, PveRequirements>;
 
 /**
- * ⛔ THE GUARD ON THE CREATE. `read` folds a 403, a timeout and a node that is down into the same
- *   `undefined` as a pool that is genuinely missing — so "absent" is not evidence. This asks a
- *   second, different question: does the cluster LIST this pool? A failure is left to propagate
- *   rather than folded, so "I could not ask" fails the deploy instead of creating over live data.
- *   An empty list is trusted: the collection 403s when the role is too narrow rather than
- *   filtering, so `[]` really does mean a cluster with no pools.
+ * ⛔ THE GUARD ON THE CREATE. The original read folded 403s/timeouts into absence, so this
+ *   independent index check prevented creating over a live pool. The typed reader now
+ *   propagates those failures, but a `CephPoolNotFound` must still not override a listed pool:
+ *   the measured PG-merge risk warrants keeping both observations. Failed index reads also
+ *   propagate. An empty list is trusted: the collection refuses a narrow role with 403 rather
+ *   than filtering, so `[]` really does mean a cluster with no pools.
+ *
+ * ⚠️ `describe` IS STILL A PLAIN STRING (ceph-pool.ts builds it from `object`/`collection` in
+ *   ceph-pool-form.ts) — this function no longer takes a `collection` PATH, since
+ *   `nodes.listNodeCephPool` addresses the endpoint itself; the parameter list keeps `describe`
+ *   only, to name the object in the refusal message.
  */
-export const confirmAbsent = (props: CephPoolProps, collection: string, describe: string) =>
-  pve<{ pool_name?: string }[]>(props.target, 'read', 'GET', collection).pipe(
+export const confirmAbsent = (props: CephPoolProps, describe: string) =>
+  runPve(props.target, 'read', false, nodes.listNodeCephPool({ node: props.node })).pipe(
     Effect.flatMap((rows) =>
-      (rows ?? []).some((row) => row.pool_name === props.name)
+      rows.some((row) => row.pool_name === props.name)
         ? Effect.die(
             new Error(
               `${describe}: the cluster lists this pool but its status could not be read, ` +
@@ -55,9 +62,9 @@ export const confirmAbsent = (props: CephPoolProps, collection: string, describe
  * ⚠️ SHORT POLLS, LOW CAP: 2s apart, 30 tries, about a minute. A pool create takes seconds; one
  *   still unsettled after a minute is a fault to surface, not a wait to lengthen.
  */
-export const settle = (
+export const settle = <E>(
   props: CephPoolProps,
-  read: PoolRead,
+  read: PoolRead<E>,
   done: (live: CephPoolAttributes | undefined) => boolean,
 ) =>
   Effect.gen(function* () {

package/src/proxmox/ceph-pool-wire.ts

@@ -0,0 +1,101 @@
+/**
+ * `Proxmox.CephPool`'s distilled wire lane: the status read, and the two request translations.
+ *
+ * ★ SPLIT OUT OF ceph-pool-form.ts FOR THE 250-LINE CAP (that file is already near it) — the seam
+ *   is "touches the cluster or not", the same one ceph-pool-form.ts itself draws against
+ *   ceph-pool.ts. Nothing in ceph-pool-form.ts changed: `createBody`/`updateBody` still build the
+ *   PVE form, unaware distilled exists: this file is the ONLY place that translates one into a
+ *   typed distilled request.
+ *
+ * ⛔ ONLY TYPED ABSENCE MAY REACH A CREATE. The transport migration deliberately preserved
+ *   `pveOperations.read`'s catch-all `Effect.orElseSucceed(() => undefined)` to avoid changing
+ *   behavior during the swap. That also hid refused credentials and transient failures, risking
+ *   a false update/create. SDK PR #265 added the measured `CephPoolNotFound` tag; the follow-up
+ *   now catches only it. One reader serves read/diff/reconcile/settle, so all propagate other
+ *   failures. `confirmAbsent` still checks the index before create: a missing status alone must
+ *   never override a pool that the index lists (the PG-merge incident, ceph-pool-settle.ts).
+ */
+import * as nodes from '@distilled.cloud/proxmox/nodes';
+import * as Effect from 'effect/Effect';
+import { runPve } from './distilled-pve.ts';
+import {
+  type CephPoolAttributes,
+  type CephPoolProps,
+  UNSET,
+  applications,
+  createBody,
+  updateBody,
+} from './ceph-pool-form.ts';
+import { bool, int, num, text } from './values.ts';
+
+/**
+ * One status answer as attributes, or `undefined` for the index-trap shape — the same defensive
+ * check ceph-pool.ts's pre-migration `attributes` carried, kept even though a well-formed
+ * distilled decode should never hand this function anything else: `GetNodeCephPoolStatusResponse`
+ * declares `name` required, so a response shaped like the INDEX (an array) fails the Schema decode
+ * before this runs at all. Left in as the same fail-safe rather than trusting that alone.
+ *
+ * ⚠️ `live` IS CAST PAST `GetNodeCephPoolStatusResponse`'s OWN TS TYPE, the same measured reason
+ *   node-network-wire.ts's `attributesOf` casts past `GetNodeNetworkResponse`: Effect Schema's
+ *   structural (non-exact) decode does not strip fields the declared type omits, and the live
+ *   probe below (2026-09-24) showed extra fields (`statistics`, `autoscale_status`) surviving.
+ */
+const attributesOf = (live: unknown, props: CephPoolProps): CephPoolAttributes | undefined => {
+  const row = live as Record<string, unknown>;
+  if (typeof row['name'] !== 'string') return undefined;
+  return {
+    applications: applications(row['application_list']),
+    crush_rule: text(row['crush_rule']),
+    id: int(row['id'], UNSET),
+    min_size: int(row['min_size'], UNSET),
+    name: props.name,
+    node: props.node,
+    nodelete: bool(row['nodelete']),
+    nopgchange: bool(row['nopgchange']),
+    nosizechange: bool(row['nosizechange']),
+    pg_autoscale_mode: text(row['pg_autoscale_mode']),
+    pg_num: int(row['pg_num'], UNSET),
+    pg_num_min: int(row['pg_num_min'], UNSET),
+    size: int(row['size'], UNSET),
+    target_size: int(row['target_size'], UNSET),
+    target_size_ratio: num(row['target_size_ratio'], UNSET),
+  };
+};
+
+/**
+ * The live pool, or `undefined` only for the SDK's measured `CephPoolNotFound`. The initial
+ * transport swap preserved `ops.read`'s catch-all fold; the 2026-09-24 follow-up removes that ambiguity.
+ * Read, reconcile and settle now propagate every other failure instead of assuming absence.
+ *
+ * ⛔ `verbose=1` IS WHAT MAKES `applications` VISIBLE AT ALL — ceph-pool.ts's own header has the
+ *   measured reason and the cost (two extra, unguarded mon commands PVE runs to answer it).
+ */
+export const readPoolStatus = (props: CephPoolProps) =>
+  runPve(
+    props.target,
+    'read',
+    false,
+    nodes.getNodeCephPoolStatus({ name: props.name, node: props.node, verbose: '1' }),
+  ).pipe(
+    Effect.map((live) => attributesOf(live, props)),
+    Effect.catchTag('CephPoolNotFound', () => Effect.succeed(undefined)),
+  );
+
+/** The two endpoints, as the keys `guardWrite` (distilled-guard.ts) checks both forms against. */
+export const CEPH_POOL_CREATE = 'pve:POST /nodes/{node}/ceph/pool';
+export const CEPH_POOL_UPDATE = 'pve:PUT /nodes/{node}/ceph/pool/{name}';
+
+/** The actual `createNodeCephPool` call body — `createBody`, translated. No field is renamed. */
+export const toDistilledCreate = (props: CephPoolProps): nodes.CreateNodeCephPoolRequest =>
+  ({
+    ...createBody(props),
+    node: props.node,
+  }) as unknown as nodes.CreateNodeCephPoolRequest;
+
+/** The actual `putNodeCephPool` call body — `updateBody`, translated. No field is renamed. */
+export const toDistilledUpdate = (props: CephPoolProps): nodes.PutNodeCephPoolRequest =>
+  ({
+    ...updateBody(props),
+    name: props.name,
+    node: props.node,
+  }) as unknown as nodes.PutNodeCephPoolRequest;